The Increasing Danger of the Islamic State in Afghanistan
The Islamic State Khorasan Province (ISKP), the node of the Islamic State (IS) mostly based in Afghanistan and partly in Pakistan, was behind three attempted foreign terrorist attacks over New Year’s, targeting crowds celebrating the holidays and Christian churches. Two of the thwarted attacks were in Europe and one was in Central Asia. A few days ago, ISKP carried out a “successful” atrocity in Iran. This is part of a trendline that suggests the danger ISKP poses to regional and Western security is growing.
ISKP THWARTED IN EUROPE
A 30-year-old Tajik man was arrested in Germany, in the western North Rhine-Westphalia state, on 24 December 2023, and a week later, on 31 December, three more jihadists were arrested in the same state, in the cities of Duisburg, Herne, and Dueren. All four men are believed by the security services to have been working as part of the same network on behalf of ISKP, which was planning to attack the Cologne Cathedral on New Year’s Eve. In the week of Christmas and New Year, the cathedral is visited by more than 100,000 tourists.
The exact method of the planned attack has not been officially reported, though Cologne’s police acknowledged that the car park underneath the Cathedral had been searched with explosives detection dogs and local media claims the terrorists planned to use a car bomb.
While the ethnic identity of the three men arrested on New Year’s Eve is not known for sure, the German media has reported that they were also Tajiks and German authorities said an investigation is ongoing into a “network of individuals” from Central Asia with links to several German states and other European countries.
The evidence of the spread of this ISKP network is already visible: on Christmas Eve, the same day the first man was arrested in the state of North Rhine-Westphalia, it seems during a reconnaissance mission against the Cologne Cathedral, Austria arrested three men suspected of involvement in an “Islamist network”. It has subsequently been reported these men were planning to blow up the Saint Stephen’s Cathedral in Vienna.
The ISKP network that was disrupted in Germany and Austria over the holiday season is known to be operating is Spain. There were no reported Spanish arrests in response to the terrorist warnings.
A NEAR-MISS IN KYRGYZSTAN
The government of Kyrgyzstan announced on 28 December 2023 that it had foiled an ISKP plot to carry out attacks against churches and near the main New Year tree in the central square of the southwestern city of Jalal-Abad. There are obvious reasons for scepticism about anything that comes from Bishkek, but claims such as this are rare in Kyrgyzstan; it is not a standard pretext for repression. Moreover, the details in the description of the targets that ISKP had eyes on, and the reported conduct of the would-be terrorists—the remote guidance they were receiving from abroad and the pre-recorded videos pledging allegiance to the IS leader—tally closely with the German and Austrian situations, and the specifics of IS’s tradecraft.
ISKP HITS ITS MARK IN IRAN
In Iran, on 3 January 2024, a twin bombing struck crowds of people who had gathered for a ceremony at the tomb of Qassem Sulaymani, the leader of the Quds Force within the Islamic Revolutionary Guards Corps (IRGC) and the driving force of the Islamic Republic’s imperial project until he was killed exactly four years earlier by then-President Donald Trump. The slaughter in Kerman, Sulaymani’s hometown, is said by the Iranian regime to have claimed 84 lives.
A glimpse at how deeply ISKP has infiltrated Iran was given on 5 January, when the Iranian regime’s Intelligence Ministry, often known by the shorthand Ettela’at, announced that it had arrested eleven people related to the atrocity, two of them “for providing support to the two suicide bombers … and nine others based in other parts of Iran who were suspected of links to the incident.”
The nature of the attack—a blast in the crowd and an attack on the first-responders twenty minutes later—always made it likely the Islamic State was responsible, and, in-keeping with the pattern of officially claiming major ISKP attacks a day or two after they are carried out, on 4 January IS put out a statement via Amaq News Agency admitting what it had done.
The IS statement said the Kerman attack was part of the “Kill Them Wherever You Find Them” campaign and photographs of the two suicide bombers were released, with their names given as: Umar al-Muwahhid and Sayfullah al-Mujahid. The duo were said to have targeted a large gathering of “rafidi mushrikeen”, the former word being a derogatory term for Shi’is and the latter word meaning polytheists or idol-worshippers. The attack was claimed to have “resulted in the killing and wounding of more than 300 rafidi mushrikeen”.
U.S. intelligence, for all its problems on the human intelligence (HUMINT) front, has impressive signals intelligence (SIGINT) coverage of IS and Iran, and it was duly confirmed to the press—whether it should have been or not is a different matter—that communications intercepts had established, in as “clear cut and indisputable” a fashion as there is, that ISKP was behind the Kerman atrocity.
[UPDATE: in late January 2024, it became clear why the U.S. knew so definitively and so quickly that ISKP was behind the Kerman bombings: the U.S. had detected IS’s preparations for the attack, and secretly passed this information to the Iranian regime: the warning “was specific enough about the location and sufficiently timely that it might have proved useful to Tehran in thwarting the attack … Iranian officials didn’t respond to the U.S. about the warning, said one American official. It wasn’t clear why the Iranians failed to thwart or blunt the attack, several officials said.”]
IMPLICATIONS
It is not surprising that there is a large chorus in the Middle East to blame the Jews—or “Zionists” or “Israelis”, depending on how circumspect the commentator is being—whenever some horrendous incident like the Kerman bombings occurs. Nor is it surprising that such a body of opinion exists on Twitter, nor that the Islamic Republic of Iran should adopt this as its official position. What was surprising was that allegedly serious people should join in, attempting to link the carnage in Kerman to the targeted Israeli strike in Beirut a day earlier that eliminated HAMAS’ deputy “political” leader and its military commander, Saleh al-Aruri.
The irony of such conspiracy theories, coming as they did from ostensible analysts who usually try to detach the IRGC from its various departments, engaging in (often bad faith) nuance-mongering about the local conditions that animate, say, Ansarallah (“the Huthis”) in Yemen or, indeed, Hizballah in Lebanon, is that the conspiracies were an admission. Israel’s strike in Dahiya was described in a lot of the press coverage as hitting “Hizballah’s operational headquarters”. In reality, the Israelis had struck at the nerve-centre of the IRGC in the Northern Middle East, the most important outpost of the Islamic Revolution outside Iran. The notion that Kerman was an “escalation” atop the assassination of Al-Aruri was a confession of this fact, that these “militias”, like Hizballah, are all components of a singular IRGC Network, something the clerical theocracy is not really shy about, even if Tehran always leaves enough crumbs in its messaging to feed the nuance-mongers.
Another meme (in the Richard Dawkins sense) floating around was that IS has never attacked Israel. This is flatly untrue: IS carried out a terrorist attack in Israel as recently as March 2022. The ghost of a point is that it is true that IS rarely attacks Israel. This is partly practical: IS has struggled to make inroads among the Palestinians and Israeli Arabs, and has not fared well, even at one step remove, in challenging the Israeli security apparatus. Mostly it is for long-established reasons of ideology, namely that IS regards all formerly Muslim-ruled territories—from Spain to the Balkans—as being in urgent need of return to Islamic rule, and denounces as idolatrous Muslims making a fetish of the attempt to reconquer former Mandate Palestine.
There is similar misunderstanding to that over the IRGC, albeit usually in better faith, made about the structure of the Islamic State. For example, it took an absurd amount of time for many analysts to admit that IS was operating in the Democratic Republic of the Congo (DRC). Even now, the jihadists in the DRC are often described as “affiliated” with or “linked” to IS. This is a decade after IS’s model for expansion has been public knowledge. The plain fact is, as one analyst so succinctly documented, “IS, like the IRGC, is a monolithic, entirely centralized, supranational organization; it does not have franchises, affiliates, or allies, only provinces of a supranational Empire, and its leadership controls all personnel, funding, and decision-making in every province.”
While the historical relationship between IS and the IRGC is complicated and by no means as uniformly antagonistic as either side likes to portray it, the recent history of the interaction between these two jihadist imperial projects made it overwhelmingly probable that IS/ISKP was behind the Kerman killings. Hostility to Iran has become part of IS’s effort since 2014 to brand of itself in opposition to Al-Qaeda, which has had a tight relationship with the clerical regime for more than three decades. If Al-Qaeda’s new leader is—as many Western intelligence agencies believe—Sayf al-Adel, then he is a creature of the IRGC who has been based in Iran since 2002.
In addition to IS’s propaganda output against Iran, IS has, since it separated from Al-Qaeda, launched attacks inside Iran, something the organisation says (quite truthfully) it was prevented from doing while it was under Al-Qaeda’s roof. In June 2017, IS inaugurated its campaign within Iran by launching a highly symbolic attack, very similar in format to the one on Wednesday, targeting Imam Khomeini’s tomb and the Iranian “parliament”. In the years since, an intense shadow war has raged between IS and the Iranian security services, with occasional IS break-throughs, notably against the IRGC parade in September 2018 and the last time was October 2022, with an ISKP-designated attack on the Shah Cheragh shrine in Shiraz.
Since the formal announcement that IS was in Afghanistan in January 2015, the “Khorasan” node has continued to gain in strength, and was connected to terrorist activities as far away as Australia as early as 2018, despite for a time facing the combined efforts of NATO and Pakistan’s Taliban-Qaeda forces to crush it. One of President Joe Biden’s defences of his senseless withdrawal from Afghanistan in 2021 was that the jihadists answering to Pakistan—the perpetrators of 9/11 to whom he surrendered the country—were “sworn enemies” of ISKP, and in NATO’s absence they would be willing and able to smother ISKP. Though there were strong early indications this theory was delusional, its proponents could point to the declining official reports of ISKP activity as evidence, and there can be no doubt the Taliban crackdown had an impact.
However, leaked documents from within the IS network support the public claim in its Pashto magazine Khorasan Ghag (Voice of Khorasan) in August 2023 that a “strategic silence policy” had been adopted to deliberately deflect attention from ISKP as it rebuilt. This is hardly unprecedented. IS’s skill in deception operations has been evident since the days of the U.S. regency in Iraq, and ISKP itself has engaged in these tactics, notably the “surrenders” to the Afghan government just before Biden destroyed it. There is also the near-exact parallel of Syria: from 2020 to the summer of 2021, during a period of hardship, “the Islamic State was systematically under-reporting on its activities in the central Syrian Badia”. Once IS had recovered and was capable of defending its position, it began advertising its progress in the Syrian deserts. In that framework, the Khorasan Ghag article is the announcement that ISKP is “back”. And there were signs, even before the Khorasan Ghag piece, that something of the kind was occurring in Afghanistan, warnings that have only gotten louder in the months since.
In May 2023, an ISKP operative was killed by counter-terrorism police while resisting arrest in northern Kyrgyzstan. In July 2013, Spain arrested a Tajik ISKP operative as he landed in Barcelona on a plane from Mexico with plans for an attack on Spanish territory, and around the same time Germany apprehended seven ISKP agents in the North Rhine-Westphalia state that was the target last week. These were clearly parts of the same network behind the New Year’s Eve plots described above. In September, Iran claimed to have rolled up an ISKP network set on blowing up crowds in thirty cities, which seems distinctly dubious, though some ISKP cells might well have been busted. In November, India reported foiling what would have been a devastating series of ISKP bombings in several cities. In December, of course, there were the thwarted plots in Germany, Austria, and Kyrgyzstan.
In Afghanistan of late, the Taliban claimed to arrest a number of Tajik and Pakistani ISKP operatives on 31 December as they plotted terrorist attacks against public buildings and mosques, and in just the last few hours an ISKP suicide bomber has blown up a minibus in a mostly Shi’i district of Kabul, murdering two and wounding fourteen. This second ISKP attack of the year was framed in the same sectarian terms as the first one in Iran.
Perhaps it will be that worries about ISKP are overhyped, at least so long as the Taliban-Qaeda regime sustains its campaign of repression. After all, with the exception of the attack on Sulaymani’s tomb in Iran, all of ISKP’s external attacks have failed, most of them well “left of boom”. The warning signs that something nasty is headed our way from ISKP are mounting up, though, and the conditions are more propitious for the jihadists than they have been for some time. The Interior Minister of the German state that avoided disaster on New Year’s Eve said Islamists are “more active than ever at the moment”, taking full advantage of the social signals that have abetted a rising tide of antisemitism under the cover of protesting against Israel’s counter-stroke to HAMAS. IS terrorism has already returned to Europe in this context, with two attacks in October, one in France and one in Belgium. Those attacks were organised from the “Centre” as far as we can tell, but with the speech by the Islamic State spokesman on 4 January leaning into this opportunity by inciting global attacks in a way not seen since 2014, there is no reason to suppose the other IS nodes, in Afghanistan and Africa, will not be brought into the game. Unfortunately, given the blindness of Western intelligence to dynamics within Afghanistan since Biden abandoned the country, we probably will not know if this is the case until it is too late.