Islamic State Capabilities in Europe

Investigations into the latest attacks in Brussels on 22 March, which killed 35 people and injured over 300 others, have yielded disconcerting evidence of established European networks of Islamic State (IS) operatives. While the exact strength, coherence and hierarchy of these networks remain unclear, the attacks against Zaventem Airport and Maalbeek metro stations in Brussels may point to an oversight in terms of both European authorities’ assessments of IS terrorism strategy and public discourse on lone actor terrorism in Europe. 

The Brussels attacks occurred just four months after the November 2015 Paris attacks, where 137 people died and over 360 others were injured. Unlike previous IS-inspired attacks in Europe, both of these assaults showed increased sophistication and coordination. It has become clear that several of the assailants also had connections to the Paris attacks. A key link between the two attacks was Najim Laachraoui, the second suicide bomber at the Brussels airport, who also made bombs used in the Paris attacks. Fingerprints of at least three Paris attackers were found in apartments rented by two of the Brussels bombers. Moreover, police raids in the wake of the Brussels attacks point to a wider network in Europe; on 27 March, a suspect was arrested in Italy on suspicion of supplying fake documents for the Brussels attackers. Three other suspects have also been detained, one near Paris and two in Brussels, for having links to the attackers and were allegedly planning another attack in Paris. While media outlets have strongly emphasised the lone actor threat, European authorities have been aware of IS’s external operations unit for some time. French authorities believe that at least 21 trained operatives have been dispatched to Europe since 2014 with orders to carry out attacks. 

These developments counter the narrative that IS is primarily concerned with capturing and maintaining territory in Syria and Iraq, leaving attacks in the West to be carried out by lone actors. Instead, IS has a more agile, multifaceted approach than previously understood. This does not mean that IS will solely focus on more complex, centrally-coordinated assaults. Rather, these will continue to be planned in parallel with self-directed attacks by its supporters abroad, particularly given that these types of attacks still inspire significant fear and distract authorities’ attention away from more sophisticated plots. Post-Brussels, counterterrorism efforts will focus on developing a more comprehensive understanding of IS capabilities in an effort to increase Europe’s resilience to attacks. 

IS has demonstrated tactical flexibility through advanced coordination, communication and resourcefulness in its European operations. In both recent attacks in Europe, IS used local operatives and returnee fighters from Syria – a deadly combination of local knowledge and technical skills. According to online IS propaganda, attacks directed by IS leadership grant assailants a large degree of operational autonomy. The group reportedly provides assailants with training and resources to carry out attacks, but the actual targets are mostly selected by attackers themselves. This enables operatives to assess local conditions before carrying out attacks, optimising their chances of success and minimising detection. European authorities have confessed that gathering, processing and analysing all suspicious online activity is also a major challenge, even before accounting for encryption software increasingly used by IS. Further, recent arrests of suspected militants in Europe suggest that lower-level IS recruits have limited details about other operatives in Europe. This limits the risk of apprehended suspects revealing compromising information to police about future IS plots. While IS has effective barriers to detecting communications, the means of attack are also relatively accessible. For example, the explosive material used in the Brussels and Paris attacks, triacetone triperoxide (TATP), comprises common household products – acetone and hydrogen peroxide. However, the explosive remains highly volatile meaning tracing IS bombmakers will continue to be a priority. 

While IS’s tactics are designed to evade detection, the latest attacks also point to significant counterterrorism failings in Belgium. These shortcomings pertain to a failure to curb the rate of radicalisation within Muslim communities, structural deficiencies within security agencies, as well as gaps in intelligence sharing and coordination. 

Radicalisation remains a concern in the country, with reports indicating that Belgium provided the most foreign fighters per capita of all EU countries in 2015. Furthermore, significant planning behind the plot took place in Molenbeek, a predominantly Muslim suburb in Brussels. Salah Abdeslam, one of the Paris attackers, was arrested days before the Brussels bombings in the same neighbourhood. Molenbeek residents had allegedly hidden Abdeslam for months, suggesting that areas in Brussels are permissive operating environments. Belgian authorities have been aware of this long-standing radicalisation problem, but had done little to counter it until the November Paris attacks. Institutionally, although Belgium’s counterterrorism strategy includes a pillar on terrorism prevention, authorities in the country have acknowledged that this element of counterterrorism has not received adequate attention. 

In addition to concerns over radicalisation, the attacks highlighted structural issues regarding Belgium’s counterterrorism capabilities. The Brussels area, with one million residents, is governed by 19 municipalities and is served by six police forces, each of which answers to a different mayor. Efficient coordination within this bureaucratic labyrinth is further hampered by arbitrary regulations such as no police raids between 21h00 and 05h00. Even once the attacks were underway, Belgian authorities failed to coordinate a swift response. In the hour-long gap between the airport and metro bombings, officials failed to suspend and secure all public transport services in the city, despite the obvious lessons that should have been learned from previous attacks in Europe. Internationally, the attacks underscore further gaps in information sharing among western counterterrorism agencies. These included the Dutch receipt of a warning of an attack in Brussels from New York Police which was not passed on, and a Turkish claim that they informed the Belgian government that it had deported one of the assailants in July 2015. 

IS will see the Brussels attacks as a major victory, which will embolden its leaders to coordinate further attacks to maintain momentum. However, there is significant uncertainty over the strength of the group’s foreign networks, and whether in future they can continue to match this intent with capability. Whether IS manages to orchestrate further complex attacks in Europe will also depend on how security services respond to Brussels. In the coming months, European authorities are likely to announce new legislation, improved controls on fighters returning from conflicts in the Middle East and North Africa, increased budgets for counterterrorism agencies, and enhanced intelligence sharing with regional neighbours. However, developing advanced counter-terrorism capabilities is a long-term endeavour and in the meantime, Europe will remain vulnerable.