L’espansione della campagna di radicalizzazione di Isis in Europa

/>The initial waves of ISIS’s coordinated attacks in Europe primarily targeted France, Belgium, and Germany in 2014-2016. Returnee foreign fighters conducted most of these attacks. ISW assesses that ISIS returnee foreign fighters also tried and failed to conduct attacks in at least the UK, Spain, Morocco, Italy, Albania, and Kosovo in that timeframe.
The EU Counterterrorism Chief stated on September 12, 2017 that ISIS still has as many as 2,500 European foreign fighters in its ranks in Iraq and Syria and that at least 1,500 have returned to Europe to date. ISIS’s European foreign fighter population in Iraq and Syria will continue to provide the organization with links to jihadist and criminal networks in Europe even if the foreign fighters do not return to Europe. The foreign fighters that have already returned to Europe provide ISIS with latent capability to conduct attacks in addition to logistical and other support operations. ISIS is likely leveraging its foreign fighter cadres to attack new states rather than execute coordinated attacks in states where levels of ISIS-inspired attacks are rising.

ISIS’s success demonstrates that it continues to generate attack capability faster than security services can disrupt new ISIS cells. In the UK, an ISIS returnee foreign fighter detonated a suicide vest (SVEST) at a concert venue in Manchester on May 22, 2017 in the first attack in the UK to date that fits ISW’s definition of a coordinated attack. The attacker met with members of an ISIS external operations cell in Libya prior to the attack, indicating that ISIS is leveraging command and control outside of Syria and Iraq to support its European operations. In Spain, members of an ISIS cell conducted two separate car-ramming attacks in Barcelona and Cambrilis as a contingency operation after an explosion at the cell’s TATP factory killed its leader and other members of the cell. TATP is an explosive that ISIS operatives in Europe commonly use. The cell’s original plan was to conduct a coordinated attack using TATP against the Sagrada Familia Church, a popular tourist destination in Barcelona. The extent of ISIS’s direct support to this attack cell is unclear, due in part to the death of the cell’s leader and numerous other cell members in the explosion of the TATP factory. Reports that the cell’s leader traveled to Belgium in late 2016 could indicate that ISIS has a command-and-control node in Belgium that supported the attack.
More coordinated ISIS attack plots in Europe are likely underway. Unconfirmed reports indicate that ISIS’s external operations node in Libya has also dispatched foreign fighters to Belgium and France in addition to the UK. It is possible that a failed coordinated attack in Paris in 2017 was linked to the Libyan node. ISW cannot confirm any coordinated attack cells in Belgium in 2017, but French and Belgian police arrested one cross-border cell with likely links to ISIS in July 2017. This cell may have been planning attacks. The returnee foreign fighters may also be using Belgium as a base for command and control and logistical operations instead of a base for attacks, as the travel of the Spanish cell’s leader to Belgium suggests. They may have joined a pre-existing ISIS network in Brussels comprised of the initial wave of returnee foreign fighters that reached Belgium before ISIS’s major successful attacks in Paris and Brussels in November 2015 and March 2016, respectively.
Sustained ISIS attempts to conduct coordinated attacks in France and Germany in 2017 indicate that ISIS continues to prioritize those countries. ISIS’s Iraq-based French cyberplanner, Rachid Kassim, planned a coordinated attack in Paris, France involving TATP before a coalition airstrike killed him near Mosul, Iraq in February 2017. French police successfully disrupted the attack and arrested 2 cell members on September 6th, at least one of whom had been in contact with Kassim. German police meanwhile disrupted what could have been a coordinated ISIS attack attempt in Essen by a German foreign fighter in March 2017 who was reportedly recruiting people in the area to conduct an attack.
Future ISIS success are also likely in the states that thwarted coordinated ISIS plots from 2014- 2016, which include at least Italy, Albania, and Kosovo. ISIS’s links to criminal networks in Italy may reduce the group’s incentive to attack there in the near term, since law enforcement responses to such attacks could disrupt important support nodes. ISIS could also risk alienating business partners such as elements of the Italian Mafia if it attacks Italy. The anti-ISIS coalition has eliminated numerous ISIS external operators in Syria tasked with managing ISIS’s attack campaign in Albania and Kosovo in airstrikes in June 2017, meanwhile. These strikes may have disrupted ISIS’s ability to generate attack cells in the Balkans. ISIS may be attempting to leverage Balkan foreign fighters to conduct attacks elsewhere in Europe, however. Italian police arrested a Kosovar cell including at least one returnee ISIS foreign fighter in March 2017 that was planning an explosive attack against the Rialto Bridge. Available reporting does not confirm that ISIS provided direct support to this cell, which could have been merely inspired by ISIS. ISW will update this assessment as new details become available.

Coordinated ISIS attacks using refugees
ISIS’s coordinated attack campaign in Germany relies less on a foreign fighter cadre than elsewhere in Europe. ISIS is also using recruited and possibly trained refugees to conduct coordinated attacks in Germany. ISIS has conducted two successful coordinated attacks in Germany using one returnee foreign fighter and one refugee operative to date. The refugee was a Syrian who had reportedly fought with ISIS before leaving for Europe in 2013. He detonated an SVEST outside a concert in Ansbach on July 24, 2016. German police later discovered chemicals and other bomb-making materials in his room at a refugee center in Germany. German authorities have reportedly thwarted six coordinated ISIS attack attempts, involving three refugees, two returnees, and one local who was likely in contact with an ISIS cyberplanner. Germany authorities have reportedly thwarted an additional nine attacks that could include attempted ISIS coordinated attacks, but for which adequate information does not yet exist.
Refugees have conducted attacks in other countries, but ISW cannot assess any coordinated ISIS involvement with confidence at the time of writing. ISW’s assessment places ISIS-inspired attacks conducted by refugees into the same category as all other instances of ISIS-inspired attacks. Future ISW products will examine the trend of ISIS-inspired attacks in Europe in more detail, to include when and where refugees have conducted such operations.
Attacks consistent with ISIS’s calls for “lone Jihad”
ISIS seeks to create momentum behind a campaign of attacks in Europe that will require less direct input from ISIS over time. ISW assessed in November 2015 that ISIS’s goal in Europe was to provoke overreactions by European governments that would alienate Muslim communities and radicalize them over time. ISIS designed a campaign to inject violence into European societies in order to jumpstart a campaign of low-level attacks against non-Muslim populations in Europe that would further polarize European communities.
The scope and volume of low-level attacks that fit ISIS’s calls for “lone jihad” in Europe nearly quadrupled in Europe from January 2014 to September 2017. This trend could signal a growing resonance of ISIS’s messaging to vulnerable populations despite ISIS’s territorial losses in Iraq and Syria. If so, this trend would demonstrate ISIS success generating a campaign of violence in Europe that requires progressively less direct input from ISIS to sustain.

It is still possible that ISIS cyberplanners or returnee foreign fighters coordinated many of these attacks, however. Available information does not enable ISW to assess these attacks to be coordinated at the time of writing. Attacks consistent with the ISIS calls for “lone wolf” jihad expanded to Spain,2 Italy,3 Switzerland,4 and Finland5 in 2017. The attacks in Finland and rising levels of similar attacks in Sweden are the most likely to have been coordinated by ISIS, since they are in a new theater. Finland raised its threat level in early 2017, which could signal intelligence indicating ISIS was actively attempting to coordinate attacks. The chief of Sweden’s security service (SAPO) warned in June 2017 that extremist activity was rising in multiple Swedish cities. Norway also raised its threat level in early 2017, possibly indicating new ISIS attack efforts. It is also possible that some of these attacks have been inspired or enabled by al Qaeda rather than ISIS, but the available data does not confirm al Qaeda links.

Conclusion
The success of anti-ISIS operations in Europe remains limited. ISIS continues to generate and inspire attacks on a scope and scale larger than European security services can handle. New countermeasures such as “vehicle mitigation barriers” can reduce the lethality of ISIS tactics but are unlikely to disrupt ISIS’s ability to inspire and recruit attackers. Anti-ISIS operations in Syria and Iraq have not severed the link between ISIS’s senior leadership and its operatives abroad, moreover. Coalition airstrikes in Iraq and Syria have eliminated many ISIS external operatives, but have not sufficiently degraded ISIS’s capability. ISIS also continues to use safe haven in Libya as a base from which to support attacks in Europe even after its loss of Sirte, demonstrating how removing ISIS from cities is insufficient to prevent ISIS from conducting attacks. The anti-ISIS coalition is unlikely to dismantle the global ISIS attack network without broadening the scope of anti-ISIS operations beyond a narrow terrain focus. ISIS can use safe-havens in rural and even desert areas to plan, coordinate, and support the conduct of attacks in the West. It must also refocus on addressing the grievances and fears of vulnerable Sunni populations that make them vulnerable to ISIS messaging. The widespread perception that European states and the U.S. are aligned with Iran and the Assad regime against Sunni populations in Syria and Iraq, as well as the rise of anti-Muslim sentiments and perceived anti-Muslim policies in Europe and the U.S. will continue to fuel toleration of and limited but growing support for ISIS (and al Qaeda) attack operations in the West. ISIS is waging a social and informational campaign to gain support among Western populations—Western states will not be able to kill and arrest their way out of this problem.
Appendix: ISW methodology for analyzing attempted attacks
The first graphic in this report depicts the number of attacks and attempted attacks per month in Europe from January 2014 to September 14, 2017. The chart begins in January because it is the month when the first known ISIS attack operative entered Europe after ISIS’s separation from al Qaeda’s Syrian affiliate Jabhat al Nusra in mid-2013. French police arrested that operative, named Abdelkader Tliba, thereby preventing what would have been the first coordinated ISIS attack in Europe. ISW’s data set includes every such known attempted attack in Europe since January 2014.
ISW’s data set most likely under-represents the number of thwarted ISIS attack cells in Europe, which are the most difficult to discern from openly available reporting. The “count” of attempted attacks per month in Europe is the number of thwarted attack cells with proven links to ISIS or that ISW assesses are possibly linked to ISIS based on openly available reporting. The “count” is not estimate of the number of attacks that any given cell would have conducted if not arrested. The actual number of attacks that ISIS has attempted to conduct in Europe may be higher than the graphic in this report conveys, therefore.
The “count” also does not measure the complexity of the thwarted attack cell’s structure or geographic disposition. Some of the attack cells included in this data set are individual attackers who were planning to conduct a single operation based on instructions from an ISIS cyberplanner. Others are larger networks of operatives spread between numerous safe houses in numerous countries. Many fall somewhere in between, or reflect instances where European security services arrested a cell before it had finalized an attack plan.

Comparing attempted vs successful attacks in Europe
The “count” for the successful attacks in Europe is the sum of the locations at which successful attacks occurred. For example, the ISIS attack in Paris November 2015 has a “count” of six. ISW has coded the attack data based on each attack location because each separate attack location reflects a separate successful attack operation that ISIS chose to coordinate and execute simultaneously. This approach is in line with the methodologies used by U.S. military forces in Iraq, Afghanistan and elsewhere, which tally each individual kinetic event even when multiple attacks take place in a coordinated fashion simultaneously, but in different locations.
The comparison of attempted attacks versus attacks provides a proxy for assessing the success of ISIS’s campaign in Europe. The ratio favors ISIS, as ISIS appears to be able to generate attacks faster than European security services can disrupt them.
ISW’s data set does not include instances of partial disruption of an ISIS attack cell. An example of a partial disruption would be the arrest of one of five suicide bombers that reduced the “count” of the successful attack to the observed four attacks. This data set is not an exhaustive accounting of all of the successes of European security services against ISIS, therefore.
ISW has sorted attempted attacks into the same four categories as successful attacks based on available evidence as of September 14, 2017: attempted coordinated ISIS attacks, attempted ISIS-inspired attacks, and unknown attempted attacks for which few details are publically available. ISW routinely updates and re-evaluates the assessment of each attempted attack as new details become available, such as new information about a given would-be attacker’s links to ISIS cyberplanners. ISW will publish updates and refined assessments as appropriate.
ISW’s Data Set vs. Official European Reporting
ISW’s data set includes more events and counts differently than official European reports. For example, ISW’s data for 2016 includes eleven more attacks in EU countries than the EU’s 2017 counterterrorism report and dozens more attempted attacks. The primary reason for these differences is that ISW counts events that the EU member states have not definitively ruled as terrorism. European states must discuss terror attacks on the basis of definitive evidence and the proper application of European laws. ISW’s approach enhances analysis of the ISIS campaign in Europe by widening the aperture to include the entire set of events that likely fit within the ISIS campaign even if insufficient evidence exists at present confidently to designate each event as a terrorist attack. ISW also seeks to inform analysis of the perceived trend of attacks in Europe, which ISIS and other jihadist groups use to recruit even if based in part of false attribution of some acts of violence, as this report explains.
ISW’s methodology to consider each attack location a separate attack also contributes to differences between ISW and European reporting. The EU report considers the March 2016 ISIS attack in Brussels to be a single attack, for example; ISW counts it as three separate, coordinated attacks.