ISIS’ Virtual Puppeteers

The Islamic State (also known as ISIS) has taken a beating on the battlefield throughout 2016. U.S. officials estimate that the group has lost half of its territory in Iraq and roughly 20 percent in Syria, including key supply routes from Turkey that had been vital to the group’s inflow of foreign fighters. Although ISIS’ territorial holdings continue to dwindle, the threat it poses does not. ISIS has proven itself to be an endlessly adaptive organization, utilizing creative measures to shape-shift in its response to external pressures. As the group’s territory shrinks and its leadership is picked off by U.S.-led airstrikes, ISIS will rely increasingly upon its “virtual planners”—members who operate in the dark spaces of the Internet—to inspire and coordinate attacks abroad.

Since at least early 2015, ISIS has been planning high-profile operations against the West, with Europe standing directly in the crosshairs. As has become clearer over time, ISIS’ strategy for external operations in Europe is not haphazard—its methods are deliberate and carefully organized under the direction of one of its wings, the Amn al-Kharji. Although it is fairly opaque, bit by bit, analysts have been able to piece together this wing’s hierarchical chain of command. According to ISIS defector Abu Khaled, Abu Mohammed al-Adnani—ISIS’ now deceased spokesman—served as the official head of the Amn al-Kharji. A French national, Abu Suleyman al-Firansi, of which little more than his nom de guerre is known is the director of external operations. A key group of theater commanders sit below al-Firansi, and are in charge of operations spanning Europe to Southeast Asia. Theater commanders seem to be assigned to an area of responsibility according to their language abilities and nationalities—similar to the way in which ISIS groups other members—enabling them to draw on extensive knowledge of the area when organizing plots. They are responsible for directing some of ISIS’ bloodiest operations, including the November 2015 attacks in Paris.

A lesser-known cadre inside the Amn al-Kharji includes ISIS’ virtual planners, who are responsible for inspiring and directing many of the plots that have mistakenly been labeled as “lone wolf” attacks. Many observers have assumed that operations carried out by one or two attackers have simply been inspired by ISIS’ call for independent strikes across the world, a request first made by Adnani in September 2014. Such an assumption is highly problematic; it underestimates ISIS’ broader external strategy and dismisses the sophisticated structure through which its operations are organized. (There is no indication, however, that Ahmad Khan Rahami, who may have conducted the most recent attack in New York City, is linked to ISIS and it is not yet clear whether he is connected to a larger cell.)

ISIS’ virtual planners—who are usually based in Syria and Iraq—draw from and advise a population of supporters abroad who have expressed an interest in carrying out attacks, but who may lack the technical or operational knowledge to do so. The mobilization of ISIS adherents who are already living in the West has clear advantages; it allows ISIS to instruct its supporters through encrypted apps, such as Telegram and WhatsApp while avoiding the risks associated with training and dispatching operatives from Syria. This strategy has become a crucial component of the group’s global efforts. One ISIS operative claims that the group has even begun discouraging foreign fighters from joining the organization in the Middle East and North Africa, instead advising them to “stay in their countries and rather wait to do something there.”

This advice has been echoed by one of ISIS’ most dangerous virtual planners, Rachid Kassim, a 29-year-old French jihadist who inspires and directs ISIS adherents in Europe from his base inside ISIS-held territory. In a propaganda video, Kassim told ISIS supporters, “Tear up your tickets for Turkey”—which is a stopover for ISIS recruits en route to Syria and Iraq—“paradise is at your feet.”

Kassim, likely of Algerian origin, is believed to have radicalized sometime in 2011. Prior to that, Kassim reportedly worked at a social center in Roanne in central France and had a passion for rap music. It was after a trip to Algeria that an acquaintance of Kassim’s started noticing a change, recalling “at the very beginning we knew he was sociable, cheerful…his family was not very religious…I saw his radicalization evolve.” By the summer of 2015, Kassim had migrated to ISIS’ self-declared caliphate, making his first public appearance from Iraq during a July 2016 ISIS propaganda video produced by ISIS’ media wing in Welayat Nineveh. In it, Kassim wears military gear and a black scarf around his head while holding a knife above a shackled ISIS prisoner. He praises the June 14 truck attack in Nice and promises continued operations against France. At the end of the video, Kassim beheads the captive whom he deems an apostate.

Kassim maintains a heavy online presence, including a Facebook page and Telegram channel, where he regularly posts messages directed at ISIS supporters, urging them to carry out attacks against the West. Kassim encourages his followers to apply the “law of retribution” by attacking France as revenge for its aggression against the caliphate. His social media profiles are strewn with photos of Syrian and Iraqi children who have been killed in airstrikes, and are accompanied by messages such as “we kill them as they kill us.” Kassim has even used Snapchat to communicate messages to his followers, suggesting that they conduct operations inside France as an alternative to migrating to the caliphate.

It would be a mistake to dismiss Kassim as a simple propagandist. Rather, he directly manages aspiring plotters, helping them translate their intent into action. Several links have been made between Kassim, Adel Kermiche and Abdel Malik Nabil Petitjean, the terrorists who killed a priest at the St.-Étienne-du-Rouvray church in July 2016. Investigators found Telegram conversations between Kassim and the two men that suggested that Kassim may have inspired and directed the operation from afar. Kassim may have also been the one to introduce the two operatives who lived over 400 miles apart and are thought to have met in person only days before the attack.

Moreover, it appears that Kassim took over Kermiche’s Telegram account after he was killed by the police. A week after the attack, an audio recording appeared on Kermiche’s feed, likely recorded by Kassim, in which the speaker congratulates his “brothers” for the attack. Since then, several more recordings have appeared, including an August 18 recording in which the speaker mentions the church attack and promises that plans for new operations are underway. Audio recordings seem to be Kassim’s preferred method of communication, as he posts several per day on his own Telegram account. Kassim also reposts audio recordings from Kermiche’s feed—by a group called Haqq wad Dalil—onto his own, suggesting a continued link between the two accounts.

It is highly likely that Kassim is responsible for directing other plots throughout France, especially ones that have been accompanied with posthumous video messages from the attackers. Kassim has published a number of guides for ISIS supporters in which he specifies the name and location of recommended targets and gives tactical and strategic advice to ensure the success of the operation. One guide includes a hit list of dozens of high-profile individuals including politicians, journalists, security personnel, and rappers. Larossi Abballa, who in June 2016 stabbed and killed a police chief and his partner in ISIS’ name, may have also been in contact with Kassim. Abballa filmed the attack on Facebook Live, and according to French police, had a list of targets including “rappers, journalists, police officers, and public personalities.”

Kassim continues to advise would-be terrorists. Most recently, French authorities arrested a group of women who were planning to set off a car bomb near Paris’s Notre Dame Cathedral with orders likely given by Kassim. At least one of the women’s fingerprints were found in a car parked close to the cathedral, which contained six gas canisters. In one of Kassim’s online guides, he recommends that his followers “fill a vehicle with gas bottles…and park in a busy place.” During the raid in which the women were arrested, police reportedly found a handwritten pledge of allegiance to ISIS Emir Abu Bakr al-Baghdadi. French prosecutors believe the women were in contact via Telegram and were being directed from Syria. French authorities also believe that three 15-year-old boys, who were recently arrested on suspicion of planning attacks in France, may have also had links with Kassim, though it is unclear if they knew one another.

In early August, Kassim posted an audio recording on Telegram in which he instructed future attackers to send him a video message prior to their operation. According to Belgian journalist Guy Van Vlierden, who first reported on the recording, Kassim specified that the video “must contain an oath of allegiance and a message of dawa” that encourages others to carry out attacks. Kassim promised that once he received the video he would have it translated and broadcast. “I am involved in this area, which means that in two seconds they will be translated Arabic-French,” he explained in his Telegram message. “They will be transmitted to the entire world.”

In the same recording, Kassim mentions that a man named Abu Isleym Al Belgiki, a Belgian, had just sent him such a video, indicating that a Belgian ISIS fighter may be preparing for an operation. Van Vlierden believes Kassim is referring to Brussels-born ISIS member Azzedine El Khadaabia, who left for Syria in 2014 and whose whereabouts are currently unknown. Van Vlierden reported that four people have been arrested in connection with the audio recording, two in France and two in Belgium.

Kassim’s role is almost certainly replicated throughout ISIS, with dozens of virtual planners organizing operations around the world. Small-scale attacks should not immediately be labeled as “lone wolf” attacks, a term which disregards the potential for remote guidance from ISIS commanders in Iraq, Syria, and elsewhere.

Moreover, although ISIS’ loss of its territorial holdings is crucial to eroding the organization as a whole, it will undoubtedly find new ways to adapt, and the use of virtual planners is a strategy the group can use over the long term. Virtual planners can operate from anywhere, armed with only a computer and an Internet connection. As the coalition continues to defeat ISIS on the ground, we must keep our sights on its operatives in the online space, and prepare to see attacks in the West long after the fall of the caliphate.