Europe's Accelerating Terrorism Threat

Mosul and the return of foreign fighters

The Iraqi and US-led coalition forces’ recapture of Mosul in July 2017 is a major symbolic victory in the war against the Islamic State (IS), as it was the city in which the group’s leader announced the formation of the so-called caliphate in 2014. However, as the Islamist militant group continues to lose territory in Iraq and Syria, more foreign fighters will be likely to return to their home countries. It is also likely that IS will modify its organisational model and tactics in response to significant territorial losses, and the group is expected to dispatch foreign fighters to carry out attacks in their home countries to assert its global strength and relevance.

Although the number of foreign fighters travelling to Syria and Iraq has slowed over the last year, it is estimated that 5,000 Europeans have travelled to fight alongside IS since 2014. Not all fighters will return home: some fighters will have been killed in battle, while others may travel to other conflict zones. Nevertheless, there are concerns over the foreign jihadists that do eventually return to Europe. While some of these fighters will arrive home demoralised with no motivation to continue with jihadism, others are likely to return to carry out attacks. A 2013 study of data between 1990 and 2010 showed that one in nine Western foreign fighters returned home to stage terrorist attacks. If these findings are applied to the current estimate of European fighters in Syria and Iraq, the threat posed by returnees is substantial: if all 5,000 were to return to Europe, approximately 540 returnees would have intent to conduct attacks. These actors are likely to have training in bomb-making, weapons handling and military tactics and also have access to networks to allow them to plan sophisticated, coordinated attacks.

Lone actor threat

Aside from centrally coordinated plots carried out by trained militants or networked cells, plots by lone perpetrators or unaffiliated small groups of individuals also poses a threat. IS and Al Qaeda have been able to influence these individuals with sophisticated communications technology. Notably, these groups have published articles in online propaganda magazines advising their sympathisers on how to carry out attacks. In May 2016, for example, both IS and Al Qaeda published global calls for vehicle ramming attacks. Technology is also used to coordinate attacks. Lone actors involved in successful attacks in Europe in recent years have used encrypted messaging applications, such as Telegram, Signal and Wickr, to successfully evade being intercepted by authorities. Although these actors typically lack military experience and rely on rudimentary methods to orchestrate attacks, such incidents have the potential to result in mass casualties. In line with calls on sympathisers to carry out DIY-style attacks domestically, there has been a notable spike in less complex attacks in Western countries involving vehicles, in particular, over the last year:

• 19 June 2017: Champs-Élysées attack
• 3 June 2017: London Bridge attack
• 7 April 2017: Stockholm attack
• 22 March 2017: Westminster attack
• 19 December 2016: Berlin Christmas market attack
• 28 November 2016: Ohio State University attack
• 14 July 2016: Bastille Day attack

Attacks have typically concentrated on easily accessible locations and public spaces with limited security barriers where large numbers of civilians congregate. Such attacks are generally hard to pre-empt, as there are minimal precursor actions or signs for intelligence agencies to detect, thus increasing assailants’ likelihood of success.

Over-stretched security

Multilayered terrorism strategies in Europe present a major challenge for counter-terrorism authorities who are under considerable strain. Even countries with highly-advanced detection and prevention measures, like the UK, have been unable to thwart all plots. There have been significant security failures in the region over the last two years. In March 2017, for example, a leaked EU report assessing 2016 attacks in Berlin, Brussels and Paris exposed significant gaps in security services’ capacity to monitor movements in and out of Europe. The report noted that even EU citizens subject to a European arrest warrant were able to enter and exit the region without detection “due to the non-systematic checks of EU nationals”. Other basic security checks – including limiting suspected extremists’ access to weapons – have also failed. For example, a man who died after driving an explosives-laden van into a police car on the Champs-Élysées on 19 June had a gun license which he renewed repeatedly, despite being on the EU’s security watch list. The assailant reportedly obtained the permit when he joined a gun sports club. In a letter found in the van, the assailant said he joined the club to train as an IS-affiliated jihadist and prepare to commit an attack.

Furthermore, the large number of suspected extremists residing in Europe has also resulted in overstretch among intelligence officials. In the UK, for example, there are as many 20,000 suspected extremists on the government’s radar, of which approximately 3,000 are under regular surveillance. MI5 and GCHQ currently sift through thousands of persons of interest to identify the much smaller pool of individuals whom they believe warrant more intensive investigation. Although these agencies are continuously working to expand their capacity, comprehensive monitoring is an impossible task. Khalid Masood, the assailant behind the March 2017 Westminster attack, had previously featured in MI5 investigations, but was not maintained on police watch lists as a person of interest at the time of the attack.

Leaders at the July 2017 G20 Summit issued a statement urging increased cooperation in countering terrorism and several regional initiatives have been launched over the last two years to enhance intelligence sharing and capacity among counter-terrorism agencies. This is likely to go some way in preventing attacks. However, Europe has numerous soft targets that cannot be placed under permanent lockdown. Considering the sheer speed at which plots can be planned and orchestrated, further attacks will remain an unfortunate reality in the region.

S-RM Terrorism Site Security Review and Response Training

To assist companies with managing the threat of terrorism, S-RM offers a package of services that includes site vulnerability assessments and concise staff training. We aim to identify weaknesses in physical and procedural security arrangements in light of the terrorism threat and our training seeks to raise staff awareness on the issue.  We recommend simple measures to increase the resilience of security procedures and reduce the risk to employees and assets. Training is delivered sensitively and in line with best practice guidance