1NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

(U) Counterterrorism Weekly is an UNCLASSIFIED//FOR OFFICIAL USE ONLY compilation of open source publicly available press and relevant commentary on issues related to terrorism and counterterrorism over the past seven days. It is produced every Wednesday, excluding holidays. Counterterrorism Weekly is produced by the National Counterterrorism Center and contains situational awareness items detailing ongoing terrorism-related developments which may be of interest to Federal, State, Local and Tribal Law Enforcement, security, military personnel, and first responders. Information contained in the Counterterrorism Weekly is subject to change as a situation further develops. The inclusion of a report in Counterterrorism Weekly is not confirmation of its credibility or accuracy of the information contained therein nor does it imply NCTC’s official view or endorsement. Comments and requests for information pertaining to articles featured in Counterterrorism Weekly may be directed to nctcpao@nctc.gov.

(U) This product may contain US Persons information deemed necessary for the intended recipient to understand or assess the information provided. This information has been highlighted in the document with the label USPER, pursuant to E.O. 12333 which affords protections for US persons. FVEY partners’ names are also labeled, based on their request.

(U) The material contained in this weekly publication may be subject to copyright. Further reproduction or dissemination by any means is subject to original copyright restrictions and is generally prohibited without the copyright holder’s permission. This weekly publication is intended to assist readers in their official capacities, and is not intended to be a replacement for commercial services.

COUNTERTERRORISMWEEKLY

(U) This section consists of in-depth counterterrorism press

articles including context and background information.

(U) NCTC Commentary/Assessments are written by

seasoned NCTC Directorate of Intelligence Analysts or by the

NCTC Joint Counterterrorism Assessment Team, comprised

of law enforcement and first responders.

(U) This section informs readers on methods terrorists are

utilizing overseas which could be employed domestically.

(U) This section includes press articles with concise summaries

for rapid consumption.

SPOTLIGHT .............................................................................................3(U) New Year’s Attack on Istanbul Club(U//FOUO) Potential Implications of Domestic UAS Weaponization

ON POINT...............................................................................................81 ARIZONA: (U) Man Indicted on Terrorism Charges2 UNITED STATES: (U) Amendment to the Terrorist Designations of Lashkar

e-Tayyiba (LeT)3 EUROPE: (U) ISIL Supporters Call for More Holiday Attacks4 GERMANY: (U) Syrian Arrested for Seeking Attack Funding From ISIL5 FRANCE: (U) Foreign Fighter Sentenced Upon Return From Syria6 BELGIUM: (U) Six Attacks Reportedly Thwarted Over Two Years7 SYRIA: (U) Senior ISIL Commander Reportedly Killed8 IRAQ: (U) ISIL Targets Baghdad With Multiple VBIEDs9 NIGERIA: (U) Police Arrest Man Suspected of Lagos Bridge Bomb Plot10 PHILIPPINES: (U) ISIL-Philippines Releases Video of German Hostage11 PHILIPPINES: (U) Twin Bombings Wound 3912 BANGLADESH: (U) Police Arrest Five Suspects Plotting Attack 13 INDIA: (U) US, Israel Warn on Travel, Citing Threat

TRENDS, TACTICS, & PROCEDURES ...................................13(U) Addressing Prison Radicalization Worldwide(U) US Treasury Sanctions Lashkar-E Tayyiba (LeT) Officials (U) Chief Constable Defends UK Prevent Program(U) French President Vows to Tackle Foreign Fighters and Their Children(U) Denmark Vows Action After ISIL Fighters Receive Benefits Payments (U) Violent Extremism and Radicalization in Kosovo(U) Tunisian Foreign Fighters to be Dealt With Under Antiterrorism Law(U) Religious Leaders Trained on Preventing Violent Extremism in Cameroon(U) Bangladeshi Militants Reportedly Using Families as Cells(U) Terrorism Increases in Indonesia During 2016

PARTING SHOTS .............................................................................18.

28 DECEMBER 2016-4 JANUARY 2017

FOR AMERICA’S PROTECTORS

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

(U) This section provides a comprehensive look at a

terrorist group(s) or leader(s), and/or CT tools and literature.

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

2NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

WORLDWIDE: (U) As of late December, the State Department Bureau of Counterterrorism and Countering Violent Extremism and the International Institute for Justice and the Rule of Law planned a workshop on prison radicalization. [pg. 13]

UNITED STATES: (U) On 28 December, the State Department amended the terrorism designation of Lashkar e-Tayyiba to include the alias Al-Muhammadia Students. [pg. 8]

ARIZONA: (U) On 28 December, an Arizona state grand jury indicted a man on charges he participated and assisted ISIL. [pg. 8]

EUROPE: (U) On 28 December, the pro-ISIL Nashir Media Foundation urged supporters to conduct attacks on targets such as markets and hospitals in Europe over the Christmas holiday period. [pg. 8]

FRANCE: (U) On 1 January, Nicolas Moreau, 32, was sentenced to ten years in prison after returning from fighting with ISIL in Syria. [pg. 9]

BELGIUM: (U) Since November 2014, Belgium reportedly foiled “at least six attacks,” according to the head of judicial police in Brussels, Belgium. [pg. 9]

SYRIA: (U) On 26 December, Abu Jandal al-Kuwaiti, an ISIL leader in Raqqah, was struck and killed by a coalition airstrike near Tabqa Dam, Syria. [pg. 10]

IRAQ: (U) In early January, ISIL targeted Baghdad with multiple VBIEDs. [pg. 10]

INDIA: (U) In late December, Israel’s antiterrorism directorate and the US State Department issued warnings, citing an immediate threat of attack to Western and tourist targets. [pg. 12]

PHILIPPINES: (U) On 30 December, ISIL-Philippines, formerly known as the Abu Sayaf Group, released a video of German hostage Jurgen Kantner. [pg. 11]

1

12

3

4

5

66

17

8

9

10

COUNTERTERRORISMWEEKLY FOR AMERICA’S PROTECTORS

SPOTLIGHT SUMMARY(U) NEW YEAR’S EVE ATTACK ON ISTANBUL CLUB: On 2 January, ISIL claimed responsibility for a 1 January attack by an unidentified gunman on the Reina nightclub—which killed at least 39 people and wounded at least 69—in Istanbul, Turkey, as patrons celebrated New Year’s Eve. (REUTERS, BBC, CNN, AP, AL JAZEERA, A’MAQ, STATE DEPT.)

(U//FOUO) POTENTIAL IMPLICATIONS OF DOMESTIC UNMANNED AERIAL SYSTEM (UAS) WEAPONIZATION: ISIL will most likely continue to weaponize UAS overseas as booby traps and for delivery of IEDs. Although to date the tactic has been demonstrated only by a terrorist group in a warzone, there is a roughly even chance that homegrown violent extremists and transnational terrorists may attempt to replicate the tactic within the US. (NCTC, FBI, DHS)

23

10

7,8

HIGHLIGHTS

EXECUTIVES’ VIEW28 DECEMBER 2016-4 JANUARY 2017

WORLDWIDE1

4,5,6

9

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

3NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

continued

(U) New Year’s Attack on Istanbul Club

(U) On 2 January, ISIL claimed responsibility for a 1 January attack by an gunman on the Reina nightclub—which killed at least 39 people and wounded at least 69—in Istanbul, Turkey, as patrons celebrated New Year’s Eve. The attacker killed a policeman and a security guard at the entrance before entering the club at approximately 0115 local time. Approximately 500 people were thought to have been in the club during the attack. Initial reports mistakenly suggested the attacker may have been wearing a Santa Claus outfit; however, CCTV footage later showed the suspected attacker in dark clothes outside the club.

(U) Reina—located on the shores of the Bosporus, on the European side of the city with waterfront views—caters to a high-end clientele and frequently entertains celebrities, sports personalities, and foreigners.

■ (U) On 2 January, ISIL’s official Nashir channel identified the attacker as a “soldier of the Caliphate,” who reportedly used grenades and an automatic rifle. ISIL added he targeted the nightclub where “Christians” celebrated their “polytheistic holiday,” and claimed the attack was in response to Turkish intervention in Syria. The official claim was released before an A’maq news agency claim, which is out of the norm.

■ (U) On 4 January, Foreign Minister Mevlut Cavusoglu said authorities identified the gunman and an investigation was ongoing. “The home he stayed in has been found and investigated—also, his connections and who has helped him,” Cavusoglu said, adding the Interior Ministry was working to find the attacker, who appeared to have been “prepared professionally.”

■ (U) In addition, on 4 January Turkish police detained 20 suspected ISIL militants thought to be of Central Asian and North African origin in the Aegean coastal city of Izmir, according to a police statement. The suspects were understood to have traveled to Izmir from the central city of Konya, the statement said. The gunman who conducted the attack may have spent time in Konya before coming to Istanbul, according to Turkish media reports.

(U) Attacks claimed by ISIL in Turkey include a November 2016 VBIED attack on a Kurdish city, a bomb attack on a wedding in Gaziantep, a bomb attack on a tourist area of Istanbul, and a claim of responsibility for the likely-accidental death of a US contractor in Adana. ISIL has also elevated calls for attacks against Turkey, including calls from ISIL leader al-Baghdadi and the new ISIL spokesman Abu Al-Hasan Al-Muhajir.

SPOTLIGHT(U) Timeline of ISIL Attacks—or Suspected Attacks—in Turkey

(U) The Istanbul attack was the second major attack ISIL has claimed in Turkey.

■ (U) 4 November 2016: VBIED attack kills nine in the Kurdish city of Diyarbakir; ISIL claimed responsibility.

■ (U) 20 August 2016: Bomb attack on wedding party in Gaziantep kills at least 30 people; ISIL claimed responsibility.

■ (U) 28 June 2016: A gun and bomb attack on Ataturk airport in Istanbul kills 41 people; attack blamed on ISIL.

■ (U) 13 June 2016: ISIL claims responsibility for likely-accidental death of US contractor in Adana.

■ (U) 19 March 2016: Suicide bomb kills four people in shopping street in Istanbul; attack blamed on ISIL.

■ (U) 12 January 2016: 12 Germans killed by ISIL bomber in tourist area of Istanbul.

■ (U) 27 December 2015: Activist Naji Jerf of the group Raqqa is Being Slaughtered Silently killed: ISIL claimed responsibility. Previously, in late October 2015, two other members of the group were found beheaded in the Turkish city of Urfa; attack blamed on ISIL.

■ (U) 10 October 2015: More than 100 killed at peace rally outside railway station in Ankara; attack blamed on ISIL.

■ (U) 20 July 2015: 34 people killed in bombing in Suruc, near Syrian border; attack blamed on ISIL. (A’MAQ, INDEPENDENT, LA TIMES, BBC,)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

4NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

SPOTLIGHT continued

(U) On 22 December, the US Embassy in Turkey issued a general holiday season threat message for Turkey and various parts of Europe. Embassy Ankara noted it does this when there are indications Americans might be targeted or subject to violence.

■ (U) The statement advised Americans to “avoid large crowds or crowded places when possible, especially in locations where Westerners, tourists, and expatriates are known to frequent, including but not limited to restaurants, commercial centers, places of worship, and transportation hubs.”

■ (U) On 29 October, the US Department of State issued a travel warning for Turkey highlighting for US citizens the increased threats from terrorist groups throughout Turkey. The Department of State made this decision based on security information indicating violent extremist groups are continuing aggressive efforts to attack US citizens in areas of Istanbul where they reside or frequent. The warning noted foreign and US tourists have been explicitly targeted by international and indigenous terrorist organizations in Turkey. It went on to note additional attacks in Turkey at major events, tourist sites, restaurants, commercial centers, places of worship, and transportation hubs—including aviation services, metros, buses, bridges, bus terminals, and sea transport—could occur. (REUTERS, BBC, CNN, AP, AL JAZEERA, A’MAQ, STATE DEPT.)

NCTC: (U) On 2 January, ISIL claimed credit for the attack on the Reina nightclub in Istanbul, Turkey via a branded, standalone text statement, which claimed the attack was in response to Turkey’s airstrikes and artillery bombardment against ISIL.

■ (U) ISIL has recently called for attacks in Turkey in a number of high profile media releases, including a 22 December video depicting the immolation of two Turkish soldiers and a 2 November audio statement for ISIL amir Abu Bakr al-Baghdadi which was echoed by the group’s spokesman Abu-al-Hasan al-Muhajir in early December.

■ (U//FOUO) This is the first attack in Turkey ISIL has claimed through an official memorandum, although it has previously claimed small-scale attacks in Turkey using its A’maq news agency. It is unclear why ISIL has chosen to apparently change its stance on claiming attacks in Turkey at this time, although it may be linked to Turkish operations against the group in Iraq and Syria. (NCTC, BBC, NINA, JANE’S TERRORISM AND INSURGENCY CENTRE, A’MAQ)

(U) Images released by Turkish police of alleged attacker (BBC)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

5NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

SPOTLIGHT continued

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

6NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

continued

(U//FOUO) ISIL will most likely continue to weaponize Unmanned Aircraft Systems (UAS) overseas as booby traps and for delivery of IEDs. Although to date the tactic has been demonstrated only by a terrorist group in a warzone, there is a possibility homegrown violent extremists and transnational terrorists may attempt to replicate the tactic within the US.

(U//FOUO) In 2016, ISIL successfully demonstrated the capability to use UAS as a weaponized platform by retrofitting the UAS with explosives to conduct attacks and inflict casualties in Iraq and Syria. ISIL has recently modified its UAS strategy from using UAS for surveillance only to include IED tactics, and its use of weaponized UAS has prompted US commanders in Iraq to issue a warning to forces fighting the group to treat any type of small flying aircraft as a potential explosive device.

■ (U) According to a Western newspaper, on 2 October, two Kurdish Peshmerga were killed and a pair of French military personnel were wounded after an ISIL UAS, equipped with a booby-trapped battery compartment, exploded when they were closely examining it near Mosul, Iraq.

■ (U) According to a separate Western newspaper, on 1 October, Iraqi troops shot down a UAS with a small explosive attached to the top.

(U//FOUO) Violent extremist messaging, the availability and capabilities of UAS technology, the ability to use UAS to circumvent physical security measures, and real-world examples of successful employment of UAS as weapons all highlight the potential for future terrorist attacks using such technology.

(U) INDICATORS:

(U) First responders and security personnel should identify and report potentially suspicious UAS activities and develop guidelines for addressing unauthorized UAS operations within their jurisdictions.

■ (U) The purchase, possession, or use of UAS and related accessories does not necessarily indicate violent extremist activity, but should be evaluated according to the totality of the circumstances, additional indicators, or observed behavior reasonably indicative of terrorism.

■ (U) The indicators listing in the text box on the right-hand side of the page may be useful in identifying and preventing an attack or terrorism-related activity.

SPOTLIGHT(U//FOUO) Potential Implications of Domestic UAS Weaponization

(U) POTENTIAL INDICATORS OF SUSPICIOUS UAS ACTIVITY

■ (U) Keen interest in maximum payload capacity and range as the main deciding factor at the point of purchase;

■ (U) Unusual interest in modifying UAS to add additional functionality and to increase load capacity, range, and flight time;

■ (U) Suspicious pursuit of advanced capabilities, such as autonomous flight methods, GPS guidance, optical, photographic, and radio capability;

■ (U) Interest in UAS coincident with indicators of IED acquisition, possession, or production;

■ (U) Purchase of the same components from multiple commercial or private sources;

■ (U) Use of UAS during unusual hours or locations, such as near sensitive facilities, important landmarks, government buildings, or critical infrastructure;

■ (U) Operating UAS over crowded areas or persons not affiliated with the operator;

■ (U) Modification of safety and warning lights. (NCTC, FBI, DHS)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

7NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

SPOTLIGHT continued

(U) CONSIDERATIONS

(U) First responders and security personnel should approach suspicious UAS with caution and take into account the following: ■ (U) All unmanned aircraft, including those operated exclusively as model aircraft that weigh more than 0.55 lbs. (250grams) and up to 55 lbs. (25 Kg) and operate in national airspace must be registered by the owner, in accordance with Federal Aviation Administration (FAA) regulations.

■ (U) The FAA requires all UAS registration numbers to be readily visible or located within the aircraft, provided no tools are needed to open a compartment. Since there is precedent for booby-trapped battery compartments, first responders should conduct proper scene size-up, use proper personal protective equipment, and use precaution to establish a safe perimeter to protect themselves and the public.

■ (U) First responders should attempt to identify the operator of the UAS and obtain information regarding the purpose of the activity and registration of the UAS. If unable to identify the UAS operator, the first responder should attempt to identify any markings on the UAS at a safe distance.

■ (U) First responders should maintain situational awareness of UAS flight restrictions within their jurisdictions as well as any FAA temporary flight restrictions for VIPs and special events.

■ (U) First responders and security personnel should be alert for potential UAS reconnaissance and surveillance activities in and around critical infrastructure, sensitive facilities, and significant events. Suspicious UAS activities should be promptly reported to the local FBI field office, Joint Terrorism Task Force, and state and major urban area fusion center. (NCTC, FBI, DHS)

NCTC: (U//FOUO) UAS/radio-controlled model aircraft (RCMA) are readily available from commercial sources, and as the technology improves and costs decrease, more advanced UASs/RCMAs will likely become more prevalent in unrestricted commercial markets. To promote UAS/RCMA awareness, see the First Responder’s Toolboxes “Overseas Weaponization of UAS Likely to Continue, Revealing Potential Implications for Domestic Use” (15 December 2016), “Rules Governing Operation of Unmanned Aircraft Systems (UAS)” (23 August 2016), “Complex Operating Environment – Unmanned Aircraft Systems (UAS)/Remote Controlled Model Aircraft (RCMA) at Stadiums and Mass Gatherings” (12 November 2014), and the Roll Call Release “Advances in Remote-Controlled Model Aircraft Capabilities Challenge Security Operations at Major Events” (12 August 2014). All the aforementioned products are available on the Joint Counterterrorism Assessment Team ( JCAT) Community of Interest (COI) on Current, the JCAT Special Interest Group (SIG) on FBI’s Law Enforcement Enterprise Portal (LEEP), and the JCAT tab on the Emergency Services (ES) and Intelligence COI on Homeland Security Information Network (HSIN). (NCTC)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

8NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

1 ARIZONA: (U) Man Indicted on Terrorism Charges

(U) On 28 December, an Arizona state grand jury indicted USPERDerrick Thompson*, a.k.a. Abu Talib al-Amriki, 30, on charges he participated and assisted a criminal syndicate, ISIL, since January 2015.

■ (U) Thompson was also charged with intent to promote or further the objectives of ISIL and knowingly attempting to possess a firearm on 26 January 2015, even though he was prohibited from doing so due to a prior felony conviction.

■ (U) A spokeswoman for the Arizona Attorney General said the decision to pursue the case against al-Amriki in state court, rather than federal court, was a joint decision by state and federal prosecutors. (ARIZONA REPUBLIC)

2 UNITED STATES: (U) Amendment to the Terrorist Designations of Lashkar e-Tayyiba (LeT)

(U) On 28 December, the US State Department announced an amendment of the Foreign Terrorist Organization (FTO) and Specially Designated Global Terrorist entity designations of LeT to include the alias Al-Muhammadia Students (AMS).

■ (U) The designations include a prohibition against knowingly providing, or attempting or conspiring to provide, material support or resources to, or engaging in transactions with this organization, and the blocking of all property and interests in property of designated persons subject to US jurisdiction.

■ (U) The Department of State took these actions in consultation with the Departments of Justice and the Treasury, and the designation was timed in coordination with the Treasury’s designation of two LeT senior leaders, Muhammad Sarwar and Shahid Mahmood as Specially Designated Global Terrorists.

* (U) The charges listed are currently allegations. As in any criminal case, the defendant is presumed innocent until proven guilty in a court of law.

■ (U) Since LeT was designated a terrorist organization, it has repeatedly changed its name and created front organizations in an effort to avoid sanctions. To that effect, AMS is the student wing of LeT. Founded in 2009, AMS is a subsidiary of LeT and has worked with LeT senior leaders to organize recruiting courses and other activities for youth. (STATE DEPT.)

3 EUROPE: (U) ISIL Supporters Call for More Holiday Attacks

(U) On 28 December, the pro-ISIL Nashir Media Foundation urged supporters to conduct attacks on targets such as markets and hospitals in Europe over the Christmas holiday period and urged Muslims to stay away from Christian celebrations.

■ (U) The Nashir Media Foundation posted its message online, accompanied by images of fighters with guns and knives, Santa Claus, reindeer, and a Christmas tree. According to the release, “Their celebrations, gatherings, clubs, markets, theatres, cinemas, malls, and even their hospitals are all perfect targets for you.”

■ (U) The message stated ISIL would “replace their fireworks with explosive belts and devices, and turn their singing and clapping into weeping and wailing,” and reminded ISIL supporters of a call made earlier in December by the group’s new spokesman, Abu al-Hassan al-Muhajer, who said supporters should also attack Turkish consulates and embassies. (REUTERS)

NCTC: (U//FOUO) This call highlights the continued interest by terrorists in promoting and conducting attacks targeting perceived symbolic soft targets or events, likely because of potential limited security, publicized schedules with determinable crowds, and public accessibility. While operational readiness is frequently used to determine the execution of an attack plot, significant events, dates, or venues are also considered during target selection. Established partnerships between first responders and private-sector owners/operators, conducting threat assessments for special events, and information sharing and response planning may help provide an accurate operating picture and coordinated security measures. (NCTC)

ON POINT

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

9NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

ON POINT continued

4 GERMANY: (U) Syrian Arrested for Seeking Attack Funding From ISIL

(U) On 31 December, German authorities arrested an unnamed Syrian, 38, who arrived in Germany in 2014 as an asylum seeker.

■ (U) German prosecutors accused the man of contacting someone in Syria “who he knew was in a position to obtain [ISIL] money for terror financing” via the Telegram encrypted communication service.

■ (U) The suspect allegedly asked for approximately US $190,000 so he could buy and repaint vehicles he intended to outfit with explosives before driving them into crowds. A separate police statement indicated the man sought ISIL financing for an “as yet unsubstantiated attack scenario with the help of prepared vehicles in Germany, France, Belgium and the Netherlands.”

■ (U) The man acknowledged he was in contact with ISIL, but denied “terrorist intentions,” according to the prosecutor. (AP)

NCTC: (U//FOUO) Successful vehicle ramming attacks are likely to spur homegrown violent extremists (HVEs) to use the tactic in the Homeland. Terrorists may attempt to gain access to secure areas by assuming the likeness of authorized personnel through the use of stolen, cloned, or repurposed vehicles. Overseas terrorists have used police cars, ambulances, and public utility vehicles to gain closer access to potential targets. First responders are reminded of possible indicators and mitigation strategies to help prevent such an attack, located in the Roll Call Release “Vehicle Ramming: Simple, Effective Tactic” (12 September 2016), and Fire Line “Terrorist Tradecraft-Impersonation: Use of Stolen, Cloned, or Repurposed Vehicles” (18 January 2013). The products are available on the Joint Counterterrorism Assessment Team ( JCAT) Community of Interest (COI) on Current, the JCAT Special Interest Group (SIG) on FBI’s Law Enforcement Enterprise Portal (LEEP), and the JCAT tab on the Emergency Services (ES) and Intelligence COI on Homeland Security Information Network (HSIN). (NCTC)

5 FRANCE: (U) Foreign Fighter Sentenced Upon Return From Syria

(U) On 1 January, Nicolas Moreau, 32, was sentenced in a Paris court to ten years in prison for criminal association with a terrorist organization. French Prosecutors argued Moreau presented an “extremely dangerous threat,” and warned he risked returning to his “jihadist commitment” once released.

■ (U) At a hearing on 14 December, Moreau warned the court if he was sentenced to over 18 months in jail, he would “return to armed combat.” Moreau conducted petty crime before he was radicalized in prison and left France to join ISIL.

■ (U) Moreau stayed in Syria and Iraq for one and a half years, where he ran an ISIL restaurant the last three months of his stay in ISIL’s de facto capital Raqqa, Syria, according to the prosecutor.

■ (U) Moreau, born in South Korea and adopted by a French family, is the brother of Flavien Moreau, the first French foreign fighter to be tried upon his return from Syria. In November 2014, Flavien was sentenced to seven years in prison. (FRANCE24)

6 BELGIUM: (U) Six Attacks Reportedly Thwarted Over Two Years

(U) Since November 2014, Belgium reportedly foiled “at least six attacks,” according to the head of judicial police in Brussels, Belgium.

■ (U) In January 2015, Belgian police dismantled a cell in Verviers, Belgium, which was later linked to the November 2015 Paris attackers.

■ (U) On 22 March, ISIL-linked attackers struck the Brussels, Belgium, airport and the metro killing 32 people, despite the arrest in the Belgian capital four days earlier of November 2015 Paris attacker Salah Abdeslam.

■ (U) As of late December, the threat level in Belgium remains high at three on a scale of four levels. “Forty-five percent of the federal judicial police in Brussels are assigned to combat terrorism,” authorities said, urging continued reinforcement of the police services. (AFP)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

10NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

ON POINT continued

7 SYRIA: (U) Senior ISIL Commander Reportedly Killed

(U) On 26 December, Abu Jandal al-Kuwaiti, an ISIL leader in Raqqah, was struck and killed by a coalition airstrike near Tabqa Dam, Syria.

■ (U) Al-Kuwaiti was a previous member of ISIL’s war committee and was involved in the group’s retaking of Palmyra, Syria, before being reassigned to Tabqa to try to improve ISIL’s defenses against the Syrian Democratic Forces (SDF). Al-Kuwaiti was involved in the use of suicide vehicles, IEDs, and chemical weapons against the SDF. (DOD)

(U) Abu Jandal al-Kuwaiti. (ISIL)

NCTC: (U//FOUO) If confirmed, the loss of Abu Jandal al-Kuwaiti, a foreign fighter, may result in tactical setbacks for ISIL, judging from his membership in the group’s war committee, involvement in both the seizure of Tadmur from the Syrian regime and operations against the Syrian Defense Forces. Over the past year, ISIL has adapted its narrative to encourage endurance and perseverance in the face of setbacks to inspire continued support from its cadre of fighters. In 2016, ISIL faced high-level leadership losses—including the loss of their spokesman, military commander, and minister of information. (NCTC)

8 IRAQ: (U) ISIL Targets Baghdad With Multiple VBIEDs

(U) In early January, ISIL targeted Baghdad with multiple VBIEDs, which resulted in the death of over 170 people.

■ (U) On 1 January, three bombs killed 29 people in Baghdad. Two blasts, including one suicide attack, occurred at a market in the Sinak neighborhood, according to police. A third blast later in the day killed four people in the eastern New Baghdad district. A pro-ISIL news agency said the target was Shia Muslims.

■ (U) On 2 January, five VBIEDs detonated throughout Baghdad, reportedly killing approximately 70 people. Thirty-six people were killed when a VBIED was detonated at a market in the Sadr City area of Baghdad, a largely Shia neighborhood. The attacker was driving an explosives-laden pickup truck and reportedly pretended to be recruiting day laborers, waiting for them to crowd around the vehicle before setting off the bomb.

■ (U) A hospital in the Sadr City area also was struck on 2 January, killing 27. Another VBIED detonated near al-Kindi hospital in central Baghdad, killing one. Two other VBIEDs reportedly killed six people. ISIL claimed responsibility for the attacks via its A’maq news agency.

■ (U) Separately, also on 2 January, gunmen wearing suicide vests reportedly attacked two police stations in Samarra, killing at least seven policemen. ISIL later stated three of its militants conducted the attack, and claimed the attacks resulted in over 100 casualties. (REUTERS, WP, NY TIMES, REUTERS, ISIL)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

11NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

ON POINT continued

9 NIGERIA: (U) Police Arrest Man Suspected of Lagos Bridge Bomb Plot

(U) On 28 December, Nigerian police announced the arrest of a man, 43, over an alleged plot to blow up a major bridge in Nigeria’s commercial capital Lagos.

■ (U) According to Police Force spokesman Don Awunah, “credible intelligence” suggested the man was an explosives expert who planned to attack the Third Mainland Bridge. Awunah said the man told police he was part of a gang with links to the oil-producing Niger Delta which was unhappy because its members were not part of an amnesty scheme for militants in the region who laid down their arms in exchange for money and training.

■ (U) Police said the man was under surveillance and was arrested on 2 November at a hideout in Ikorodu, on the outskirts of Lagos state. He was found to have two AK-47 rifles.

■ (U) The man identified an accomplice who was followed by police on 26 December; the alleged accomplice abandoned his car in Ikorodu and fled. Explosives and detonation equipment were found in his car. (REUTERS)

10 PHILIPPINES: (U) ISIL-Philippines Releases Video of German Hostage

(U) On 30 December, ISIL-Philippines, formerly known as the Abu Sayaf Group, released a video of German hostage Jurgen Kantner holding a German flag, at times standing in possibly a self-dug grave, and stating “this is my last hour.”

■ (U) Kantner was kidnapped off the Philippines in early November and his partner was killed. Kantner was previously kidnapped and held by Somali pirates for eight years. (TERROR MONITOR)

11 PHILIPPINES: (U) Twin Bombings Wound 39

(U) On 28 December, at least 39 people were injured in two separate bomb attacks in the Philippines.

■ (U) In the first incident, two bombs reportedly exploded on the central island of Leyte, wounding 33 people who were watching a boxing match in Hilongos. Another unexploded bomb was also found in the town.

■ (U) Another bomb went off on a highway on the southern island of Mindanao approximately one hour later, wounding six people, according to the Philippines military. “A lamppost was catapulted from the impact of the explosion,” said Lieutenant Colonel Edgar Delos Reyes.

■ (U) Police said it was too early to say if the bombings were connected or what the perpetrators’ motives might be. (AFP)

12 BANGLADESH: (U) Police Arrest Five Suspects Plotting Attack

(U) In late December, Bangladesh police arrested five militants believed to be plotting an attack targeting New Year’s Eve celebrations. The five were believed members of a faction of the Jamaat-ul-Mujahideen Bangladesh ( JMB) group.

■ (U) Police reportedly seized 60 kg (132 lb) of explosives, when the five were detained in overnight raids in Dhaka.

■ (U) The JMB has pledged allegiance to ISIL, which police believe was involved in organizing the 1 July 2016 attack on the cafe in Dhaka’s diplomatic quarter. (REUTERS)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

12NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

ON POINT continued

13 INDIA: (U) US, Israel Warn on Travel, Citing Threat

(U) On 29 December, Israel’s antiterrorism directorate issued a travel warning for India, citing an immediate threat of attack to Western and tourist targets, particularly in the southwest part of the country.

■ (U) “A particular emphasis should be put on events in the coming days in connection with beach and club parties celebrating the New Year where a concentration of tourists will be high,” the warning said.

■ (U) The statement recommended tourists avoid participation in such parties. It also called on families in Israel to contact their relatives in India and tell them of the threat. In addition, it recommended avoiding markets, festivals and crowded shopping areas.

(U) On 30 December, the US State Department released a security message to add popular tourist destinations such as resorts, beaches, and shopping malls to the list of destinations at which US citizens should maintain a high level of vigilance. The message reminded citizens recent Indian media reports indicated terrorist groups’ desires to attack targets in India, and warned of an increased threat to places frequented by Westerners, such as resorts, beaches, shopping malls, religious sites, markets, and festival venues. (REUTERS, STATE DEPT.)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

13NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

(U) Addressing Prison Radicalization Worldwide(U) Between 12 and 13 December 2016, the International Institute for Justice and the Rule of Law, with grant funding from the US, hosted a global workshop in Valletta, Malta, on efforts to address prison radicalization.

■ (U) Research into the causes of violent extremism has shown prisons often play an important role as incubators of radicalization for disenfranchised individuals. Some of the terrorists involved in recent terrorist attacks in Paris, Copenhagen, and Brussels may have been radicalized to violence while in prison.

■ (U) Prison officials from a number of countries and representatives from international organizations and NGOs compared notes on global and regional trends regarding radicalization to violence in prisons.

■ (U) Representatives reviewed and discussed a range of reference tools, which included handbooks as well as good practices and recommendations documents aimed at addressing prison radicalization developed over the past two years by international experts. They also shared specific experiences and insights related to prison radicalization, such as risk assessments, housing of terrorist inmates, and rehabilitation.

■ (U) Representatives from Algeria, France, Italy, Ireland, Indonesia, Jordan, Kazakhstan, Kenya, Netherlands, Malaysia, Morocco, Nigeria, Niger, Spain, Tunisia, the UK, and the US attended. Experts from Penal Reform International, the UN, the Global Center on Cooperative Security, and the International Counterterrorism Center–The Hague also participated.

■ (U) The aim of the workshop and subsequent regional events is to promote the knowledge and use of numerous recently-developed reference tools which provide examples and guidance on how to mitigate, detect, and address prison radicalization and recruitment. In addition, workshops will help underscore that sound prison policies and procedures can help minimize opportunities for recruitment within prisons and help prison officials to deal effectively with radicalization within their facilities. (STATE DEPT.)

(U) US Treasury Sanctions Lashkar-E Tayyiba (LeT) Officials (U) On 28 December, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated two LeT leaders to disrupt the group’s fundraising and support networks. Muhammad Sarwar and Shahid Mahmood were designated Specially Designated Global Terrorists for acting for or on behalf of LeT.

■ (U) Muhammad Sarwar—a senior LeT official in Lahore for over ten years—held various leadership roles in the group, including his current position as LeT’s emir for Lahore, Pakistan. In his capacity as LeT Lahore emir, Sarwar was directly involved in LeT fundraising activities and used the formal financial system in Pakistan to raise and move funds on behalf of LeT.

■ (U) Shahid Mahmood is a longtime senior LeT member based in Karachi, Pakistan, affiliated with the group since at least 2007. As early as June 2015 through at least June 2016, Mahmood served as the vice chairman of Falah-i-Insaniat Foundation, a humanitarian and fundraising arm of LeT.

■ (U) “These two Lashkar-e Tayyiba leaders are responsible for raising and moving funds to support the terrorist group’s operations,” said John E. Smith, Acting OFAC Director, adding, “Today’s action not only aims to expose their activities, but also disrupts Lashkar-e Tayyiba’s financial network and ability to carry out violent terrorist attacks.” (TREASURY DEPT.)

TRENDS, TACTICS, & PROCEDURES

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

14NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

TRENDS, TACTICS, & PROCEDURES continued

(U) Chief Constable Defends UK Prevent Program(U) As of late December, Leicestershire Chief Constable Simon Cole defended the UK’s Prevent counterradicalization program, stating it was about “putting an arm around” people at risk of radicalization.

■ (U) According to Cole, “We try and divert, allow people the opportunity to help them make better decisions. It’s absolutely fundamental.” Cole further stated, “It has enabled us to try and help stabilize communities and stop people getting us into a cycle of aggravation.”

■ (U) Cole cited a case in which people referred a young man from the Midlands who was considering traveling to fight in Syria. Prevent groups worked with the man and he decided not to go, Cole said. Cole also cited the case of a young man from the north of England who was identified as expressing right-wing views. The man was referred to Prevent and placed in a program where he met people from other races and backgrounds through football.

■ (U) A government independent reviewer of terrorism legislation previously stated while troubled people had “undoubtedly” been helped by the strategy, it suffered from bad PR. The reviewer called for more openness from the government, better engagement with communities, and an independent review of Prevent.

■ (U) Of the 7,500 referrals made to the Prevent program in 2015 and 2016, a quarter were found to be vulnerable but not at risk of involvement in terrorism. No action was taken with 37% of the referrals and 28% were still being considered. According to the program, intervention has played a major role in stopping over 150 attempted journeys to conflicts in Iraq and Syria. (BBC)

(U) French President Vows to Tackle Foreign Fighters and Their Children(U) On 2 January, French President Francois Hollande said France would fight any French violent extremists it finds on the battlefields of Iraq, arrest them if they return home, and work to de-radicalize their children. Hollande made the statement while visiting Baghdad.

■ (U) “We will fight them like [we fight] all jihadists...since they are attacking us, since they prepare attacks on our own territory,” Hollande said, adding, the children of returning militants would be taken in and “de-radicalized.”

■ (U) “Everything that contributes to reconstructing Iraq is an additional step to avoiding [ISIL] strikes on our own territory,” Hollande said, further stating, it would likely take weeks to recapture Mosul, but ISIL would be defeated, adding, “It’s a year that will be a year of victory, here, against terrorism.” (REUTERS)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

15NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

TRENDS, TACTICS, & PROCEDURES continued

(U) Denmark Vows Action After ISIL Fighters Receive Benefits Payments (U) In late December, Denmark’s employment minister demanded immediate action after finding at least 36 Danish citizens received a total of tens of thousands of dollars worth of unemployment benefits despite having left the country to fight for ISIL.

■ (U) The Danish security service PET reported the 36 people fighting in Syria to the Danish Agency for Labor Market and Recruitment in an attempt to stop benefits, according to local press reporting which cited documents received from the country’s employment ministry under Denmark’s freedom of information laws.

■ (U) Together the men have received over 672,000 Danish kroner (approximately US $94,717) since leaving to fight.

■ (U) Of the men, 34 were receiving a benefit called “kontanthjaelp” or “cash help” from their local council, while the other two were receiving “dagpenge,” a private but heavily subsidized unemployment insurance.

■ (U) The councils and employment insurance organizations were seeking to take back the falsely claimed benefits from 29 of the men.

■ (U) Denmark is not the only country where welfare was inadvertently paid citizens fighting for ISIL. Swedish militant Michael Skråmo claimed more than 50,000 Swedish kroner (approximately US $7,046) from Sweden’s social security agency while living and working for ISIL in Ar Raqqa, Syria. (TELEGRAPH)

NCTC: (U) Denmark’s discovery of terrorists receiving funding through unemployment benefits highlights one of many diverse methods terrorist organizations use to obtain the funds necessary to finance their activities, underscoring the importance for law enforcement officers to become familiar with terrorist finance methods. Law enforcement investigations which initially appear criminal in nature may uncover terrorist funding activities and aid in plot disruption. As such, state, local, tribal, and territorial law enforcement are encouraged to report any suspicious activity which may be associated with terrorism financing. (NCTC)

(U) Violent Extremism and Radicalization in Kosovo(U) A recent study explored the dynamics of violent extremism in Kosovo and the disproportionately high number of radicalized fighters from the region in Syria and Iraq. Examining the historic, cultural, geopolitical, and socioeconomic factors behind the phenomenon, the study focused on the flow as a symptom of a larger religious militancy problem within the country.

■ (U) Five municipalities—four near Kosovo’s Macedonian border—appeared particularly vulnerable to violent extremism, judging from their disproportionately high recruitment and mobilization rate. More than one third of the Kosovan male combatants originated from these municipalities, which account for only 14 percent of the country’s population.

■ (U) Long-term and targeted radicalization, recruitment, and mobilization efforts by foreign-funded violent extremist networks were found primarily active in southern Kosovo and northwestern Macedonia. These networks were often headed by local alumnae of Middle Eastern religious institutions.

■ (U) Despite improvements in living conditions since the 1998–1999 Kosovo War, chronic vulnerabilities were judged to have contributed to an environment conducive to radicalization. Frustrated expectations, the growing role of religion as a core part of identity in some social circles, and group dynamics were assessed to be the drivers of radicalization, recruitment, and mobilization in Kosovo. (UNITED STATES INSTITUTE OF PEACE)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

16NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

TRENDS, TACTICS, & PROCEDURES continued

(U) Tunisian Foreign Fighters to be Dealt With Under Antiterrorism Law(U) As of 30 December, returning Tunisian militants would be immediately arrested and judged under antiterrorism laws, according to Prime Minister Youssef Chahed.

■ (U) Chahed said returnees would be dealt with according to a 2015 antiterrorism law designed to ease the arrest and prosecution of suspected militants. Chahed also said authorities had comprehensive records on militants who left the country, adding, “We have all the details on them, we know them one by one, and we have taken all the necessary measures.”

■ (U) More than 3,000 Tunisians are known to have traveled abroad to fight in conflict zones, according to the Tunisian Interior Ministry, which previously stated 800 already returned to Tunisia. (REUTERS)

(U) Religious Leaders Trained on Preventing Violent Extremism in Cameroon(U) As of 20 December, the United Nations Development Programme (UNDP) held a workshop in Maroua with religious leaders from the far north region of Cameroon on how to identify radicalization and how to speak with radicalized youth.

■ (U) The workshop was held particularly for religious leaders because they were identified as likely aware of the causes and consequences of radicalization within their communities, and were well placed to prevent it. The workshop brought together both Muslim and Christian leaders, of whom 15 were women.

■ (U) The religious leaders were trained to identify early signs of radicalization in young people and to prevent violent extremism. They also received leaflets to share with young people. Following the workshop, the religious leaders met young people and participated in events to discuss radicalization, with the aim of preventing young people from becoming radicalized.

■ (U) “The workshop was a refresher training for the leaders to learn certain concept definitions such as radicalization and de-radicalization. The exchange of opinions during the session allowed us to get rid of some stereotypes by expanding our understanding on the issue of radicalization in various forms,” one of the leaders, Imam Mahamat Goni Ali, said.

■ (U) The workshop is part of a UNDP project “Preventing Radicalization and Strengthening Early Recovery efforts of Women and Youth in Response to the Deteriorating Human Security Situation in the Far North of Cameroon,” which is funded by the Government of Japan with a US $2.1 million grant. It is implemented in the regions of Mayo-Sava, Mayo Tsanaga, Logone and Chari, which are the regions in Cameroon most affected by the attacks of Boko Haram. (RELIEFWEB)

(U) Bangladeshi Militants Reportedly Using Families as Cells(U) As of late December, violent extremists were reportedly forming family-based units to expand violent extremist organizations’ networks in Bangladesh.

■ (U) Violent extremist networks reportedly worked to build whole families—including children—into terrorist units.

■ (U) According to the director of Jakarta’s Institute for Policy Analysis of Conflict, recent analysis of militant activities over the past two decades revealed militants prioritized their relatives, neighbors, friends, or people around them to promote their ideologies and to recruit members. These violent extremists then married amongst themselves and focused on building ties of kinship. As their manpower began to decline due to arrests, deaths, and counterterrorism pressure, they began to shift towards a family unit structure, a trend apparent in recent incidents.

■ (U) The trend was reportedly particularly pronounced among Jamaat-ul-Mujahideen Bangladesh members inspired by ISIL ideology. (DHAKA PROTHOM ALO)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

17NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

TRENDS, TACTICS, & PROCEDURES continued

(U) Terrorism Increases in Indonesia During 2016(U) A total of 33 alleged Islamic terrorists were reportedly killed in Indonesia in 2016, an increase from the seven killed in 2015, according to Tito Karniavan, Chief of Indonesia’s National Police.

■ (U) The number of terrorism-related criminal cases rose to 170 in 2016, more than doubling from 82 cases in 2015.

■ (U) The number of terrorism-related criminal cases in 2016 rose in large part due to “Operation Tinombala” in Poso, Central Sulawesi, jointly conducted by Indonesian police and the army to eliminate the Mujahidin Indonesia Timur, or MIT group.

■ (U) Dr. Zuly Qodir, Senior Researcher at the Maarif Institute, stated youth between 16 and 19 years of age were most vulnerable to radicalization, and were often heavily influenced by militants on social media platforms. (INDONESIA INVESTMENTS)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

18NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

1 GERMANY: (U) Prosecutors Accuse German ISIL Suspect of Syria Killings

(U) As of 3 January, German prosecutors accused a man identified as Harry S.—already convicted of membership to a terrorist organization—of participating in the killing of six captives by ISIL in a square in Palmyra, Syria, in June 2015. Prosecutors allege he carried a pistol, led one of the captives to the execution site, and prevented others from fleeing. (AP)

2 FRANCE: (U) Former Hospital Intern Charged With Terrorism Counts

(U) On 30 December, Paris prosecutors announced a former hospital intern in the southern city of Marseille who wassuspected of planning a trip to Syria and Iraq to fight alongside violent extremists was charged with terrorism offenses. The prosecutors’ office said the suspect, whose identity was not revealed, was arrested in Turkey just before Christmas and placed in custody. He was charged with criminal conspiracy in connection with a terrorist enterprise. The trainee doctor, who worked at Marseille’s biggest hospital La Timone, posted hate messages on social media and reportedly chose to be called “Albistouri,”a nickname with an Arabic tone based on the word “bistouri,” which translates as scalpel. (AP)

3 SPAIN: (U) Two Arrested Over Alleged Propaganda

(U) On 28 December, two men were arrested in Madrid on suspicion of spreading violent extremist propaganda, according to the Spanish Interior Ministry. Police released video footage showing officers uncovering magazines and bullets from under rocks in a disused building on the outskirts of Madrid. They uncovered four AK-47 magazines and over 30 bullets but no weapons, the ministry said, adding the arrested men were Spaniards of Moroccan and Gambian origin. (REUTERS)

4 ALBANIA: (U) Kosovo Citizen Arrested on Terrorism Charges

(U) As of 29 December, Albanian police arrested ethnic Albanian Enos Begolli, 30, from neighboring Kosovo. Begolli was wanted for allegedly fighting with terrorist groups in Syria, according to Albanian police. Begolli was turned over to police in Kosovo. (AP)

5 TURKEY: (U) Forty Suspected ISIL Members Detained

(U) On 30 December, police detained approximately 40 suspected ISIL militants in raids in southern Turkey. Special forces police supported by armored vehicles and a helicopter reportedly conducted the raids in the city of Adana. Those detained were suspected of membership in ISIL and of engaging in ISIL propaganda. (AP)

6 MIDDLE EAST: (U) Telegram Reportedly Bans 2,000 ISIL Bots and Channels Per Month

(U) In late December, Telegram released comments stating it banned from its platform approximately 60-70 ISIL bots and channels per day—or approximately 2,000 per month—between September and December. (TELEGRAM)

7 MIDDLE EAST: (U) Pro-ISIL Hacker Group Releases Kill List of Saudi Military Personnel

(U) On 29 December, pro-ISIL hackers, the United Cyber Caliphate (UCC), disseminated pictures of 56 purported Saudi military personnel, along with a message offering a $5,000 reward for killing them. (UCC)

NCTC: (U) Terrorists continue to use the internet and social media to disseminate personally identifiable information (PII) of US military, government, and law enforcement personnel while advocating for “lone wolf ” attacks. First responders are highly encouraged to minimize their online footprint, limit the release of potentially sensitive information on public-facing platforms, and report suspicious activities to mitigate potential targeting. (NCTC)

PARTING SHOTS

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

19NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

PARTING SHOTS continued

8 MIDDLE EAST: (U) ISIL Releases 61st Issue of Al-Naba Magazine

(U) On 29 December, ISIL released the 61st issue of its weekly magazine, al-Naba, praising the December 2016 Berlin attacker and his “attack” in Italy, likely a reference to shooting an Italian officer before being killed. The publication also claimed 265 suicide attacks, which killed or wounded 8,350, were conducted over the previous ten weeks in Mosul. (AL-NABA)

9 BAHRAIN: (U) Policeman Killed, Inmates Freed in Prison Attack

(U) On 1 January, a policeman was killed when armed men attacked a prison in Bahrain, freeing several convicted inmates. The Bahraini Interior Ministry described the incident as a terrorist act. “An armed attack on the Jau reform and rehabilitation center resulted in the death of policeman Abdul Salam Saif and the escape of a number of inmates convicted of terrorist crimes,” the ministry said. The ministry did not provide an exact number for those who escaped or identify them, but said authorities were searching for them. (REUTERS)

10 SYRIA: (U) ISIL Releases Video Depicting Child Soldiers

(U) On 29 December, ISIL Rawalpindi province released a video titled “My Father Told Me.” The video depicted child soldiers, or “cubs,” training in Raqqa and executing four men. (ISIL)

(U) ISIL graphic depicting children in training (ISIL)

11 SYRIA: (U) ISIL Suicide Attackers Kill at Least Two in Tartus

(U) As of 1 January, two suicide bombers detonated their explosives in the coastal city of Tartus killing at least two security officers, according to Syrian state television. The officers were reportedly part of a security patrol which stopped the bombers, who then detonated their explosives. Others were reportedly injured in the blasts, including civilians. ISIL claimed responsibility for the attack in an online statement, claiming two of its members detonated VBIEDs. (REUTERS)

12 IRAQ: (U) ISIL Kills Seven Near Najaf

(U) On 1 January, ISIL militants attacked an Iraqi police checkpoint near the southern city of Najaf. The attack, which involved gunmen and a suicide VBIED, killed seven policemen and wounded 17 others, including civilians. The attack occurred when two vehicles traveling through the desert were stopped at the checkpoint near al-Qadisiya town. The driver of one vehicle reportedly detonated an explosive load while the second vehicle fled. Police pursued it and killed the two militants inside. ISIL claimed responsibility for the attack. (REUTERS)

13 JORDAN: (U) Twenty ISIL Members Sentenced

(U) On 28 December, state media reported the Jordanian State Security Court sentenced five alleged ISIL members to death, and said 15 other alleged ISIL members were given sentences ranging from three to 15 years in prison with hard labor. The 20 militants were convicted of killing a policeman, planning and practicing terrorist actions, manufacturing explosives, possessing weapons, and promoting terrorist ideas. The convicted ISIL members were arrested in a raid on their hideout in the city of Irbid in March 2016. Seven militants and a Jordanian police officer were killed in the raid. (VOA NEWS)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

20NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

PARTING SHOTS continued

14 EGYPT: (U) Roadside Bomb Kills Police Officer, Soldier

(U) On 31 December, a police officer and a soldier were reportedly killed by a roadside bomb in Egypt’s northern Sinai Peninsula. The bomb was detonated remotely when the victims’ armored vehicle passed by during a security operation. There was no immediate claim of responsibility for the attack. (REUTERS)

15 YEMEN: (U) AQAP Supporters Call for Attacks in US, West

(U) As of 30 December, pro-AQAP supporters released online propaganda calling for lone-wolf attacks in the US and the West. (AQAP)

(U) AQAP graphic advocating attacks. (AQAP)

16 YEMEN: (U) Troops Attack Al-Qa‘ida Militants

(U) On 3 January, Yemeni security forces—backed by the Saudi-led coalition—attacked an al-Qa’ida stronghold in the Marakasa mountains, east of Aden, Yemen, which resulted in the deaths of 15 militants and 11 Yemeni forces. (AP)

17 TUNISIA: (U) Militant Cell Broken Up Near Sousse

(U) On 29 December, Tunisian security forces announced they had broken up a ten-member al-Qa‘ida-linked militant cell which was active near the coastal city of Sousse. The interior ministry said the group used the Telegram encrypted messaging system to communicate with associates inside and outside Tunisia, and was plotting to conduct “terrorist operations.” The cell reportedly was linked to Okba Ibn Nafaa, an al-Qa‘ida-linked group based in the Mount Chaambi range near the Algerian border. (NY TIMES)

18 TUNISIA: Ansar al-Sharia Tunisia (AST) “Emir” Extradited From Niger

(U) As of 1 January, reported AST emir Wannes Ben Hassine Fékih—linked to both AQIM and Katibat Uqba Bin Nafaâ (KUBN)—was extradited to Tunisia from Niger. Separately, his associate Mohamed Ben Youssef Zaouali was also arrested. (MENA STREAM)

(U) Wannes Ben Hassine Fékih (MENA STREAM)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

21NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

PARTING SHOTS continued

19 NIGERIA: (U) Purported ISIL-WA Leader Denies Sambisa Forest Defeat

(U) As of 29 December, a man purporting to be ISIL-WA leader Abubakar Shekau denied the group was pushed out of its stronghold in the Sambisa Forest. In a video, the man stated, “We are safe. We have not been flushed out of anywhere,” adding, “If you indeed crushed us, how can you see me like this? How many times have you killed us in your bogus death?” Statements made by the Nigerian military have often swiftly been followed by video denials by someone who says he is Shekau, but poor footage often makes it difficult to confirm whether the person is the same man seen in previous videos. (REUTERS)

20 NIGER: (U) ISIL-WA Fighters Surrender

(U) As of 27 December, dozens of ISIL-WA fighters reportedly surrendered to authorities in southern Niger, according to the Nigerien Interior Minister. “Thirty-one young people from Diffa, who were enrolled a few years ago in Boko Haram, decided to surrender,” Minister Mohamed Bazoum said. The fighters arrived in the remote desert town of Diffa in groups and were reportedly being held by local authorities. (REUTERS)

21 MALI: (U) Ansar Al-Din Group Claims Rocket Attack on UN Barracks

(U) On 26 December, a Twitter user claimed the Ansar al-Din Group was responsible for a rocket attack on UN casern (military barracks) in Kidal. The statement claimed “direct hits” with rockets on a “casern known by the name of Kandi.” (ANSAR AL-DIN)

(U) AAD claim of attack. (AAD)

22 SOMALIA: (U) VBIED Attack Near Mogadishu International Airport Kills Three

(U) On 2 December, a suicide bomber detonated a VBIED near Mogadishu’s international airport as security forces were searching cars at the checkpoint a few hundred yards from the main base of the African Union peacekeeping mission. The blast killed at least three people. (AP)

23 PHILIPPINES: (U) ISIL-Philippines Claims Grenade Attack

(U) On 1 January, fighters affiliated with ISIL-Philippines, formerly known as the Abu Sayaf Group, claimed responsibility for a grenade attack against a Philippines army vehicle in Maguindanao, south Cotabato, which occurred the day prior. (TERROR MONITOR)

(U) ISIL-Philippines claim of attack. (A’MAQ)

24 CHINA: (U) Five Killed in Attack in Xinjiang

(U) On 28 December, attackers drove a vehicle into a government building in China’s western region of Xinjiang, setting off an explosive device and using knives to kill two people before all three of the assailants were shot and killed, according to Chinese state media. Citing the Ministry of Public Security, state media identified those killed as a security guard and a government official, and said three others were wounded. (REUTERS)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

22NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

COUNTERTERRORISM WEEKLY

PARTING SHOTS continued

25 AFGHANISTAN: (U) Taliban Ambush Kills Four Police

(U) On 3 January, Afghan officials announced a Taliban ambush in the northeastern Badakhshan province killed at least four police. Deputy Provincial Police Chief Mohammed Nabi Bayhan said the attack took place late on 2 January, and security forces subsequently launched a clearing operation in the area. Ahmad Bashir Musamum, a provincial council member, confirmed the attack and said seven police were killed. Taliban spokesman Zabihullah Mujahid claimed responsibility for the attack in a statement. (AP)

26 AFGHANISTAN: (U) Police Officer Killed in Bomb Blast

(U) As of 2 January, at least one police officer was killed by a roadside bomb in eastern Logar province. Salim Saleh, spokesman for the provincial governor in Logar, said four other people—including a district police commander and three road construction engineers—were wounded in the blast. Separately, on 1 January, at least six people were wounded in another explosion near the western city of Herat. No group immediately claimed responsibility for either attack. (AP)

27 RUSSIA: (U) ISIL-Linked Militants Reportedly Detained in Dagestan

(U) As of 29 December, Russian authorities reportedly detained seven members of an ISIL-linked cell in Dagestan. The group was allegedly planning attacks with automatic weapons, grenades, and explosives in crowded areas of Moscow, according to the FSB, Russia’s domestic security and counterterrorism agency. The agency said the suspects were detained in the North Caucasus province of Dagestan, adding they also seized “a large quantity of firearms and weapons (grenades and ammunition), as well as components for IEDs.” (INDEPENDENT)

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4

23NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS

NATIONAL COUNTERTERRORISM CENTER (NCTC)NCTC serves as the primary organization in the US Government for integrating and analyzing all intelligence pertaining to terrorism possessed or acquired by the US Government (except purely domestic terrorism); serves as the central and shared knowledge bank on terrorism information; provides all-source intelligence support to government-wide counterterrorism activities; establishes the information technology (IT) systems and architectures within NCTC and between NCTC and other agencies that enable access to, as well as integration, dissemination, and use of, terrorism information.

NCTC serves as the principal advisor to the Director of National Intelligence (DNI) on intelligence operations and analysis relating to counterterrorism, advising the DNI on how well US intelligence activities, programs, and budget proposals for counterterrorism conform to priorities established by the President.

.

Form #07317992-7b2b-4aa4-b9ff-840a5fb243e4