al-Adnani’s death: A significant but not crippling loss for IS

Posted on

This was originally published on 1st September by ‘The Interpreter’, a blog run by the Lowy Institute, a Sydney-based think tank .

The death of Islamic State’s Abu Mohammed al-Adnani in a US (or possibly Russian) air strike has been described by some as the ‘biggest ever blow to Islamic State.’

Although often identified as the group’s spokesman and chief propagandist, Adnani’s role was much more significant than that. Adnani was one of the group’s first foreign fighters and longest-serving members, having joined the nascent group in 2000. If reports are to be believed, he was even being groomed as a successor to Islamic State leader Abu Bakr al-Baghdadi.

This is not to underestimate the importance of his role as spokesman. While his messages are unlikely to have the radicalising resonance of Anwar al-Awlaki, Adnani’s blunt missives against the West made an impact.

Take, for example, Adnani’s call in 2014 for Islamic State supporters to ‘smash his head with a rock, or slaughter him with a knife, or run him over with your car…’ and the wave of unsophisticated but deadly attacks over the past two years, culminating in July’s truck attack in Nice.

Yet Adnani’s significance goes beyond his ability to recruit and legitimise the violence of disparate individuals and groups across the world. read more

How Islamic State controls ‘lone wolves’ in Europe

Posted on

This was originally published on 9th August by ‘The Interpreter’, a blog run by the Lowy Institute, a Sydney-based think tank .

The New York Times revealed more details last week about the activities of Islamic State’s external operations unit, the Amn al-Kharji. Central to the report was an extensive interview with returned German foreign fighter Harry Sarfo.

This isn’t the first time Sarfo has spoken to the media. Since his return from Syria in July 2015 and arrest by German authorities, he has given interviews to Der Spiegel and The Independent. And aside from including a (very worthwhile) video interview, little of what Sarfo said in the article was new.

What makes the story most noteworthy is that the events of the past few months are starting to make Sarfo’s testimony look worryingly accurate.

His claim that ‘hundreds’ of operatives have been actively sent back to Europe by Islamic State (rather than simply returning), seems less outlandish after a summer dominated by a series of terrorist attacks inspired or directed by Islamic State.

Sarfo’s claims are given further credence by unnamed US intelligence sources and other returnees. And Islamic State spokespeople (in contact with undercover journalists) have similarly referenced large numbers of trained and capable operatives in Europe.

I’d previously hoped that these figures were inflated. After all, consistency does not always equal accuracy. Terrorist groups seek to influence as well as inform those under their command.

But the more we learn about the importance of external operations within the Islamic State operational structure, the more feasible these figures appear. read more

How intelligence agencies should respond to an evolving terror threat (and an update)

Posted on

The past few months have been busy on a number of fronts; as a result, my blog updates have been rather infrequent. I live in hope that this is about to change, but in the meantime, here’s an overview of what I’ve been up to since May:

Firstly, as has become tragically apparent in the last 3 months, the terrorist threat has evolved.

As I wrote back in January, things were always likely to get worse before they got better. Not just because of a shift in Islamic State’s focus as their state-building project becomes unstuck. But more fundamentally because the world, and Europe in particular, are paying the price for the counter-terrorism mistakes that allowed Islamic State and others to exploit the permissive operating environment in Syria and Iraq.

As a result, the focus of my research and writing has been on how intelligence agencies have responded to the evolving terrorist threat, and what this means for counter-terrorism in the short to medium-term.

  • Back in May, I looked at the potential implications of a Brexit vote on the UK’s counter-terrorism capabilities. Three months on, we’re still not sure what Brexit means; unsurprisingly, the future of the UK-EU CT relationship remains similarly uncertain.
  • In June, I looked at the dangers of retrospectively criticising intelligence agencies for dropping investigations or missing clues that in hindsight seem so obvious..
  • Finally, post-Nice attack, I looked at the limits of counter-terrorism in the face of low-capability/high impact attacks from individuals with no or limited interaction with known terrorists.

I discussed all of these issues in detail on an excellent new Australian podcast Sub Rosa, released in early August.

What’s next?

I’m just about to finish a longer piece for the Lowy Institute for International Policy on resilience and reducing the perceived terror threat. I’m hopeful that this will be published in late 2016.

Back in late June, I presented at an excellent NATO-sponsored conference, ‘Terrorist use of the internet’ in Dublin. My paper ‘Beyond big data – surveillance, metadata, and technology-enabled intelligence opportunities’ is due for publication in early 2017.

The conference coincided with me relocating to Europe (specifically London) rather more permanently.

The move shouldn’t have too great an impact on the focus of my writing and research; I’ll continue to keep a close eye on developments in Australian counter-terrorism from afar, and write for the Lowy Institute. But it will allow me to have a greater focus on counter-terrorism in the UK and Europe, and in particular, on the ongoing attempts to update the powers available to the UK intelligence agencies.

Watch this space.

European counter-terrorism after Brussels: What next?

Posted on

Like most terrorism analysts, I have spent the last 6-7 weeks re-evaluating the terrorist threat to Europe following the terrorist attacks in Brussels on 22nd March:

  • Firstly, I analysed European and French preparedness ahead of Euro 2016 for the Lowy Institute for International Policy. Despite my initially positive response to Saleh Abdeslam’s arrest, my concerns about Belgian intelligence and law enforcement capacity were tragically realised within a matter of hours of my article going live.
  • Two days later, in a piece for The Age newspaper in Melbourne, I looked at the flaws in the Belgian counter-terrorism approach. And looked at what next – both from a tactical, operational approach, but just as importantly, from a messaging perspective.
  • Finally, I’ve written on the need for greater collaboration between European intelligence agencies. Not just ‘better intelligence sharing’ but a fundamental re-appraisal of how Europe approaches the terrorist threat over the next 3-5 years. The first piece was published by the Lowy Institute, with a shorter piece appearing in the re-launched i newspaper in the UK.

David Wells worked for UK and Australian intelligence agencies between 2005 and 2014, specialising in counter-terrorism.

 

 

 

Forget needles and haystacks – it’s more complicated than that

Posted on

If the opposing sides in the mass surveillance debate agree on anything, it is the analogy that best describes the job of intelligence agencies. From Edward Snowden to UK Home Secretary Theresa May, the case for and against bulk communications data (particularly in counter-terrorism) rests on the best way to find ‘a needle in a haystack’.

As someone with recent experience using bulk communications data to identify and disrupt terrorists, I’ve always been struck by the gap between this analogy and the reality of my former day job.

Firstly, the similarities. Terrorists are usually extremely difficult to find. And the global nature of the terrorist threat means that you are searching for them across a large area.

But the analogy suggests a laborious, repetitive and unskilled process; an individual manually wading through a stack of hay to find a tiny needle. Using traditional methods – as a 2014 conceptual art performance demonstrated – this is extremely time consuming.

Needle in haystackYet in 2016, there are smarter, more efficient ways of completing this task. Faced with one or a number of haystacks containing one or a number of needles, I could hire a metal detector on my smartphone. Or outsource the job via Airtasker.
Read the rest of this entry »

Be warned ‘Jihadi Jack’, white Brits in Syria are valuable to Isis whatever side they’re on

Posted on Updated on

This was originally published on 28th January by the Independent.

Is ‘Jihadi Jack’ fighting for ISIS on the frontlines in Iraq or carrying out humanitarian work in Syria? Despite claim and counter-claim being light on detail at this stage, Jack Letts is already on trial in the court of public opinion.

His story so far has similarities with that of Australian teenager Oliver Bridgeman. Initial reports in May 2015 – also based on social media activity and comments from school friends – identified Bridgeman as a radicalised, ‘blonde jihadi’, fighting with the al-Nusra Front in Syria.

By August however, footage had emerged of Bridgeman distributing aid for the ‘Live Updates from Syria’ organisation. Bridgeman has subsequently played an active and visible role in their online campaign, removing many of the doubts surrounding his presence in Syria.

Yet some of the details provided by Letts and his parents point to potentially concerning differences between the two, particularly Letts’ time in Isis-controlled areas and the de-facto capital Raqqa. read more

Big data in CT – Investigatory Powers Bill Submission

Posted on

Following my recent blog post on big data in counter-terrorism, I was asked to provide formal input to the Joint Committee assessing the UK ‘Draft Investigatory Powers Bill’. My full submission is available here; I have adapted it below.

To understand the utility of bulk communications data in intelligence and CT, you first need to re-consider the needle/haystack analogy typically used when discussing intelligence agency use of bulk datasets.

Instead, think about how you use the Google search engine, and how much Google – like the ability of intelligence agencies to process big data – has changed over the past 15 years.

Initially, Google only allowed relatively simple search terms. Many businesses had little or no internet presence, while Google’s ‘web-crawling’ technology did not necessarily access all those that did. In short, it lacked a comprehensive dataset to query, and as a result, it was difficult to use with confidence.

These data inconsistencies meant you could not be certain that Google had access to the data you were looking for, or whether the results it pulled back were relevant to your initial query. Like the intelligence analyst Mr Binney describes, you were confronted by too much irrelevant data. Even after clicking through multiple pages of results, you might not find what you were looking for; an alternative, more targeted method (say a local phone book) was often more effective.

In 2016 however, ‘big data’ is a reality. The internet is growing exponentially and plays a central role in everyday life. As a result, the Google search engine has access to a comprehensive and growing dataset. It is in the business of ‘bulk collection’. read more