This Assessment highlights the tactics, targets, and tradecraft that potentially could be used in the Homeland by individuals associated with or inspired by the Islamic State of Iraq and the Levant (ISIL); we do not address the likelihood of an attack against the United States by the group. This Assessment is intended to support the activities of DHS to assist federal, state, and local government counterterrorism and law enforcement officials, first responders, and private sector security partners in effectively deterring, preventing, preempting, or responding to terrorist attacks against the United States.
Key Judgments
I&A assesses terrorists directed or inspired by ISIL who are interested in conducting a Homeland attack would most likely employ tactics involving edged weapons, small arms, or improvised explosive devices (IEDs), based on our review of recent plots in Europe and Australia since early this year and statements by the group encouraging Homeland attacks. Such attacks could inflict significant casualties and may not require complex pre-operational planning.
The most likely perpetrators of a potential ISIL-directed or inspired Homeland attack include individuals acting under the direction of foreign-based terrorists, returning foreign fighters, and those who are inspired by the ongoing conflict in Syria and Iraq but who cannot or will not travel overseas.
Targets in recent ISIL-linked terrorist plots against Europe and Australia—which included public gatherings, government entities, and Jewish facilities—were likely selected because they presented an opportunity to successfully execute an attack that would garner media attention and the perpetrators had the expertise or ability to acquire weapons. Although these plots had varying levels of association with ISIL, the degree of the group’s knowledge or direction of them remains unclear.
Australian Arrests Highlight Potential for ISIL-Directed Attacks
A decapitation plot disrupted by Australian authorities highlights the potential threat posed by individuals who have not traveled to Syria or Iraq, but who maintain contact and take some level of direction from overseas-based ISIL leaders. Individuals located in Iraq and Syria could provide encouragement and guidance to potential operatives in the form of tactical guidance, target selection, or bomb-making instructions. Government authorities may be able to gain insight into potential plotting involving operatives who are known to law enforcement and intelligence services, if they become aware of a change in behavior that indicates pre-operational activity.
Australian authorities in mid-September arrested several individuals in connection with a plot to kidnap and behead individuals in Australia on behalf of ISIL. Authorities acted after intercepting a communication between a Syria-based Australian senior ISIL member and a Sydney-based group member discussing a plot reportedly centered on filming the murders of randomly selected individuals in Sydney, which would then be sent to ISIL’s media wing to disseminate via social media, according to press reporting and court documents. According to police, the suspects also discussed the potential of conducting an attack, possibly involving a vehicle-borne improvised explosive device (VBIED) against an unidentified target.
Some Returning Foreign Fighters Prepared to Conduct Attacks
Several returning European foreign fighters connected to ISIL have planned or executed attacks soon after their return to their home countries. These incidents to date have included small arms or IEDs that do not require extensive resources or planning and present fewer observable indicators for law enforcement to detect their activities. Violent, self-initiated plots like those earlier this year in Europe may give other foreign fighters—or homegrown violent extremists (HVEs)—a model to follow for their own attack plotting if they return to their home countries. Although we lack information indicating US persons currently fighting in Syria and Iraq intend to participate in attacks in the United States, we remain concerned that US persons who connect with ISIL in Syria and Iraq could self-initiate or be persuaded to conduct organized or lone-offender style attacks, potentially targeting the United States. Efforts to identify foreign fighters help mitigate this threat, but attempts by travelers to disguise their travel could prevent or delay detection of pre-operational efforts.
In May, a French citizen believed to have fought with ISIL allegedly shot and killed four people at a Jewish museum in Brussels, Belgium. Authorities discovered an ISIL flag and a video recorder as well as an automatic rifle and handgun—the type of weapons used in the attack—among his belongings when he was taken into custody weeks later by French authorities. It is unknown if ISIL was aware of this attack prior to execution; Syria-based foreign fighters, however, praised his attack on social media.
During a February arrest, French authorities recovered a handgun and three IEDs from a French citizen who had recently returned from Syria. Authorities believe he, along with a colleague who was detained en route from Syria, may have been intending to conduct a terrorist attack in France, according to press reports. The individual reportedly discussed targeting France on social media while in Syria and, when stopped in Greece during his return to Europe in January, had bomb-making instructions in his possession, suggesting his plotting may have been planned prior to his departure from Syria.
HVEs Inspired by ISIL Could Attempt Attacks
The use of ISIL’s media wing to publicize and encourage domestic attacks, and extensive media coverage of the ongoing combat overseas could boost the group’s ability to recruit individuals to travel overseas or conduct attacks in their home countries. A late September attack by an alleged Australian violent extremist against two law enforcement officers highlights the potential threat from individuals who are inspired by the conflict in Syria and Iraq, but who for a variety of reasons chose to conduct independent attacks. These types of attacks—likely targeting law enforcement, military, or critical infrastructure—could proliferate as more governments work aggressively to halt travel overseas to conflict zones and if recent statements by ISIL encouraging domestic attacks gains traction. We assess that most HVEs likely will continue in the near term to prefer to travel to Syria and Iraq to fight with terrorist groups rather than attempt to carry out Homeland attacks, but some HVEs—acting alone or in small groups—could attempt attacks against targets of opportunity with little or no warning.
A late September audio message by ISIL spokesman Abu Muhammad al-Adnani called, for the first time, for lone offender attacks against the United States and coalition partners in retaliation for military operations in Iraq and Syria. The message suggested followers target law enforcement, military, and intelligence interests as well as civilians in the United States, Australia, Canada, France, and other coalition nations. In addition to recommending attacks involving small arms, IEDs, edged weapons, and poisons, Adnani urges listeners to use whatever means are at their disposal, to include striking “the enemy” with rocks or running them down with vehicles.
In late September, an 18-year-old Australian male who had publicly supported ISIL was fatally wounded after reportedly stabbing two law enforcement officers outside a police station. The alleged perpetrator volunteered to meet with counterterrorism task force members as part of an ongoing investigation and had recently had his passport revoked. The incident preceded Adnani’s statement calling for attacks against coalition members, but is consistent with ISIL’s more recent messaging encouraging attacks in the West.
DHS Intelligence Assessment: Potential Tactics and Targets in ISIL-Linked Western Attacks
