DHS Warns That ISIS Belgian Plot Could be Roadmap for U.S. Attack

The Department of Homeland Security has issued a ten page intelligence assessment warning that the disrupted Belgian plot could serve as a warning of future attacks against the U.S. and other Western nations. The Assessment highlights the tactics, targets, and tradecraft allegedly used in a plot disrupted by Belgian authorities in January 2015 that potentially could be used in the Homeland by individuals associated with or inspired by the Islamic State of Iraq and the Levant (ISIL).

On 15 January 2015, Belgian authorities raided multiple locations including a safe house in Verviers, a suburb of Brussels, where a firefight ended in the deaths of two individuals and the arrest of a third suspect. The raids disrupted an alleged plot involving an Islamic State of Iraq and the Levant (ISIL) group with at least ten operatives—some of whom were returning foreign fighters—possibly targeting police or the public. The group may have been acting under the direction of a member(s) of ISIL. There is no publicly available information as to whether a specific target was selected. Since the initial raids, multiple individuals in several European countries have been arrested and charged in connection with the group’s activities. The investigation into this plot remains ongoing.

The plot disrupted by Belgian authorities in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIL direction has been discovered and may indicate the group has developed the capability to launch more sophisticated operations in the West. The threat from ISIL plots involving multiple operatives may grow, but are more likely to occur in Europe—where several recruitment networks have been disrupted, and several returning fighters have already demonstrated the ability to conduct attacks—than in the United States given the different operating environments, number of European foreign fighters currently in theater, and Europe’s geographic proximity to the conflicts in Syria and Iraq. While we assess the threat is more likely to manifest in Europe, we cannot discount the possibility for potential complex attacks here in the Homeland. I&A notes that small-scale attacks using comparatively less sophisticated tactics—such as the 3 May attempted attack against a “Draw the Prophet” event in Garland, Texas by individuals inspired to act by ISIL-linked messaging, or by individuals taking direction from an oversea plotter after connecting through social media—could proceed with little to no warning.

OODA Loop Sponsor

The Key judgements of the assessment highlighted that:

• DHS assesses that the plot disrupted by Belgian authorities in January 2015 is the first instance in which a large group of terrorists possibly operating under ISIL direction has been discovered and may indicate the group has developed the capability to launch more complex operations in the West. We differentiate the complex, centrally planned plotting in Belgium from other, more-simplistic attacks by ISIL-inspired or directed individuals, which could occur with little to no warning.
• DHS assesses the group’s choice to operate across several countries highlights both the significant challenges for law enforcement to detect and investigate multi-jurisdictional threats and the necessity of interagency information sharing about emerging and ongoing threats.
• DHS assesses that items recovered by Belgian authorities suggest the group’s plotting may have included the use of small arms, improvised explosive devices, and the impersonation of police officers and underscores the role of the public and private sector in alerting law enforcement of potential terrorist activity through suspicious activity reporting.
• DHS assesses that the security measures used by this group to avoid physical and technical collection highlight how knowledge of law enforcement tactics can help subjects adapt their behavior and the need for investigators to consider whether subjects may be using countermeasures to deflect scrutiny.
• DHS assesses that facilitation efforts by the group were likely aided by members’ criminal background and possible access to criminal groups underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts.
• Awareness of some of the tactics and tradecraft used by the group in Belgium could assist with identifying and disrupting potential plots in the United States.

DHS also noted that the Belgian Plot member’s criminal background likely aided planning and facilitation of the attack and that:

• Facilitation efforts by the group were likely aided by members’ criminal background and possible access to criminal groups, underscoring the potential for operatives to bypass traditional tripwires and obscure operational planning efforts. The nexus between terrorist preoperational planning and criminal activities may offer law enforcement opportunities to detect ongoing plotting, as investigations of intercepted illegal activities may present indicators of other nefarious intentions.
• At least one alleged cell member, Souhaibel Abdi, had previous experience with trafficking forged documents, according to comments from his lawyer reported in open source media.
• The groups’ purported leader Abaaoud spent time in prison for theft before departing Belgium for Syria, according to a US press report.
• The Belgian police uniforms, large cache of illegal weapons—including Kalashnikov rifles, handguns, ammunition, and materials to make explosives—that were seized by police during the raids, were likely acquired illegally, according to a media reporting coverage of Belgian police news conference. Cell members have subsequently been charged with violating Belgian weapons laws, according to statements made by Belgian officials.

The report also highlights that alleged operational security measures suggest knowledge of Law Enforcement methods and that:

• The steps group members reportedly took to avoid physical and technical collection of their preoperational activities suggest members were likely cognizant of the potential for scrutiny by Belgian authorities given their status as returning foreign fighters and had at least a rudimentary knowledge of law enforcement efforts to monitor social media and other communications. The countermeasures used by this group underscore how knowledge of law enforcement tactics can help subjects adapt their patterns of behavior and highlight the need for investigators to consider whether subjects may be using countermeasures to deflect scrutiny.
• Communications Security. The group made extensive efforts to prevent or limit law enforcement’s ability to conduct technical surveillance.
• A group member reportedly changed his cell phone five times and urged operatives to change vehicles often and to search the vehicles for microphones in an effort to thwart potential surveillance by police and intelligence officials, according to Belgian media reporting citing police officials.
• According to an unverified Belgian media report, intercepted communications between cell members were conducted in French, Arabic, and a Moroccan dialect, and frequently used coded language to discuss attack planning to make translation problematic for law enforcement and intelligence services.
• Belgian authorities discovered that the incarcerated brother of one of the cell members may have acted as an intermediary to facilitate communications between Greece- and Belgian-based members after officials at a prison in Belgium notified law enforcement of the brother’s suspicious communications, according to Belgian media reporting.
• The group attempted to obscure their operational travel and material acquisition from Belgian officials.
• According to several media reports, the family of Abaaoud received a call in late 2014 that he had been killed while fighting in Syria. However, Abaaoud’s probable involvement in this plot implies this may have been done intentionally to deter efforts by Belgian officials to track his activities.
• Belgian and Greek authorities recovered multiple identification documents, some of which may have been fraudulent, at safe houses reportedly used by the group, according to media reports.
  Moreover, the use of false identity documents may have led to the misidentification of the two operatives killed during the raid in Verviers, according to a European media report, suggesting the group may have used fraudulent documents to conceal travel from Syria to Europe and to facilitate their attack planning.
• The large amount of cash recovered by Belgian authorities at the safe house in Verviers was likely intended to fund some of the group’s procurement activities and to conceal purchasing patterns.31 Activities such as these highlight the importance of scrutinizing suspicious purchases of bulk quantities of precursor chemicals where individuals insist on paying only in cash.

In their analysis DHS assesses that future Western complex attacks and plots could resemble the size and capabilities of this group and awareness of the tactics and tradecraft used by this group could assist with identifying and disrupting potential complex plots in the United States. Prior to the disruption of this plot, nearly all of the approximately one dozen ISIL-linked plots and attacks in the West to date involved lone offenders or small groups of individuals, raising I&A’s concern that the involvement of a large number of operatives and group leaders based in multiple countries in future ISIL-linked plotting could create significant obstacles in the detection and disruption of preoperational activities.

DHS defines a lone offender as an individual motivated by one or more violent extremist ideologies who, operating alone, supports or engages in acts of unlawful violence in furtherance of that ideology or ideologies that may involve direction, assistance, or influence from a larger terrorist organization or foreign actor.

We assess that plots involving foreign fighters, who have returned from conflict zones, or foreign fighters based overseas, who have the ability to leverage violent extremists in their home countries, are more likely to plot an attack on this scale than are their less-experienced counterparts. While we assess that the threat of such an attack is more likely to manifest in Europe, we cannot discount the possibility for potential complex attacks here in the Homeland.