** Stratfor: What the Ramadan Attacks Reveal About ISIS

Lead analyst: Scott Stewart

7 July 2016

Summary: The fall of Fallujah and the Ramadan attacks mark a decisive retreat of the jihadist (led by ISIS) from Mao’s Phase 3 operations (holding areas) back to Phase 2 (attacks on the government, terrorism). Last week Stratfor looked at Fallujah; here is their analysis of the Ramadan attacks. Eventually it will get crushed as was al Qaeda, setting the stage for Jihad 3.0.

What the Ramadan Attacks Reveal About the Islamic State

Islamic State spokesman Abu Muhammed al-Adnani called on the group’s followers in late May to launch a spate of attacks during the Muslim holy month of Ramadan. Looking back on that month, which ran from June 5 to July 5, it is clear that his call was answered. This year’s Ramadan has been the bloodiest on record since the Islamic State declared its caliphate in June 2014. {See info about the Ramadan Offensives in in 2003 and in 2006.

That is not to say that past Ramadans did not see their share of violence, too. In 2015, the holy month brought significant attacks against a tourist beach resort in Sousse, Tunisia, and against a military reserve center in Chattanooga, Tennessee. But this year’s carnage has far surpassed last year’s in both scope and body count, in spite of the Islamic State core’s notable losses of territory and fighters in Iraq and Syria.

Contextualizing the Carnage

To truly understand the implications of the recent attacks, we must first recognize that although they were all conducted in the name of the Islamic State, they were not all planned and executed by a single central entity. Instead, much like al Qaeda before it, the global Islamic State movement comprises three distinct levels of actors.

At the top of the organization is the Islamic State core, housed in Syria and Iraq. The core is by far the largest of the movement’s three components, boasting thousands of fighters, significant quantities of military equipment and large swaths of territory under its control. Within the core is a large cadre of experienced militants who are capable of conducting conventional military battles, waging insurgent operations and engaging in terrorism. Of the group’s segments, the Islamic State core is the most militarily proficient; despite its heavy losses in areas such as Fallujah, it still possesses potent insurgent and terrorist capabilities in its primary area of operations, as evidenced by its July 3 truck bombing in Baghdad.

The core has also worked to project its terrorist tactics beyond the Syrian and Iraqi borders. It largely does this by training foreign fighters and dispatching them as external operations teams to conduct attacks elsewhere. The network of operatives responsible for the November 2015 Paris attacks and the March 22 Brussels attacks exemplifies this strategy, as does the cell behindthe June 28 attack against Istanbul’s Ataturk Airport. In general, the operatives tend to have better terrorist tradecraft than their grassroots and franchise group counterparts do. But because they operate in hostile territory far from the Islamic State’s primary base, they typically lack the resources and abilities of the rest of the core. Consequently, external operatives focus most of their attacks on soft targets and have not yet proved able to hit hard targets. In fact, all three of the aforementioned attacks could have been far deadlier had the perpetrators not made fundamental errors while executing them.

The second facet of the Islamic State is its franchises or affiliate groups. For the most part, these groups are existing jihadist organizations — or factions that have splintered off — that have pledged allegiance to the Islamic State’s leader, Abu Bakr al-Baghdadi. Some groups, including Nigeria’s Boko Haram and Egypt’s Ansar Beit al-Maqdis, have been recognized as official Islamic State provinces, or wilaya. (Boko Haram is now known as Wilayat al-Sudan al-Gharbi, while Ansar Beit al-Maqdis has become Wilayat Sinai.) Yet despite their shared affiliation, the numerous franchises vary quite a bit. Some, such as Wilayat Barqa in Sirte, Libya, are closely connected to the Islamic State core and its ideology, while others, such as Wilayat al-Sudan al-Gharbi, are not. Others still, including the faction of the Philippine separatist group Abu Sayyaf led by Isnilon Hapilon, have been accepted into the Islamic State’s fold but have yet to be formally branded as wilaya.

Of course, changing a group’s name does not necessarily change its level of tradecraft. Beyond Wilayat Barqa, there is little evidence that the Islamic State’s franchises receive direct military aid or training from the core. As a result, the groups that have pledged allegiance to the Islamic State have largely maintained their original capabilities, though in some cases groups have adjusted their target sets to more closely approximate that of the core. The July 2 attack in Dhaka, Bangladesh, and the July 4 suicide bombings in Saudi Arabia, for instance, were conducted by Islamic State franchises and did not exhibit a high degree of terrorist tradecraft. Now that Kurdish victories and tightening controls along the Turkey-Syria border have made it more difficult for foreign jihadists to travel to Syria, Islamic State franchises in places like Indonesia and Bangladesh may be adding to their ranks.

Thwarted attempts to join the Islamic State core in Syria have also increased the threat posed by grassroots jihadists — the third segment of the Islamic State — in their home countries. These operatives act according to the principles of leaderless resistance, planning and launching attacks independently rather than at the core’s direction. The Islamic State’s tenets inspire grassroots fighters to think globally but act locally; a grassroots operative who was not allowed into Syria conducted the October 2014 attack against Canada’s Parliament Hill.

And indeed, grassroots jihadists were the audience al-Adnani was hoping to reach with his May 22 message. Given his direct links to the fighters of the Islamic State core, al-Adnani would not need a public statement to urge them to conduct attacks during Ramadan. Similarly, since the core likely maintains contact with most of its franchises, an attack order aimed toward them could have been conveyed privately.

Though al-Adnani said in his speech that he wanted Ramadan to become a month of calamity for non-believers around the world, he specifically singled out “fighters and supporters of the caliphate in Europe and America.” He added, “The smallest action you do in their heartland is better and more enduring to us than what you would if you were with us. If one of you hoped to reach the Islamic State, we wish we were in your place to punish the Crusaders day and night.” A few weeks later, grassroots jihadists were responsible for the June 12 shooting at Orlando’s Pulse nightclub and the June 13 stabbing of two French policemen in Paris.

Countering Three Different Threats

It is important to identify and understand the different facets of the Islamic State because the unique threat that each poses calls for a unique solution. The Islamic State core, for instance, is being beaten back by military means in Iraq and Syria. Meanwhile, members of external operations groups have contacts in the core that can be searched for and used to identify jihadists as they deploy.

By comparison, franchise groups and grassroots operatives may have little or no contact with the Islamic State core. Communications and personal connections might not be as helpful in identifying these fighters — particularly the grassroots jihadists who often have no link at all to the core. Local intelligence is much more useful for identifying less connected, more localized actors.

Just as each level of the Islamic State requires its own response, so too does it carry its own set of risks. The threats that the three facets pose scale according to their skill in terrorist tradecraft: The core is the most dangerous, while grassroots jihadists are the least dangerous. Make no mistake, all three segments can be lethal. But that does not mean that they are equally capable of causing mayhem.

No matter what their abilities are, though, all Islamic State actors must follow the terrorist attack cycle when planning an operation. Terrorist attacks do not appear out of thin air; they are the result of a process. As long as we are watching out for it, that process can be detected and interrupted.

Scott Stewart is Stratfor’s VP of Tactical Analysis, supervising their analysis of terrorism and security issues. Before joining Stratfor, he was a special agent with the U.S. State Department for 10 years and was involved in hundreds of terrorism investigations. He is regularly featured