U.S. Intelligence on Terror Threat

In Congressional testimony, U.S. intelligence warned in November that the most serious threat inside the United States is from homegrown extremists, including lone wolves inspired by foreign terrorist organizations who turn violent. In 2022, foreign terrorist organizations (FTOs)—such as al Qaeda and ISIS—were a “less acute” danger to the homeland even though they remained the “most urgent threat” to U.S. interests overseas, Christine Abizaid, director of the National Counterterrorism Center (NCTC), told the Senate Committee on Homeland Security and Governmental Affairs on November 17. Since the 9/11 attacks on the Pentagon and World Trade Center in 2001, 37 attacks inside the United States were inspired by al Qaeda or ISIS, while only eight were conducted by the world’s two most famous terrorist groups.

The public warnings by three of President Biden’s most important national security officials reflected how terrorism campaigns evolved in the two decades since 9/11. But U.S. counterterrorism initiatives restricted the FTOs from conducting large-scale attacks at home. Groups such as al Qaeda and ISIS were “more effective” against regional and local adversaries, Abizaid said. Extremists exploit political instability in developing nations and “ingratiate” themselves locally. By the end of 2022, ISIS had developed a global network with some 20 branches. Al Qaeda sought to cultivate international affiliates and support small-scale attacks, such as in East and West Africa, FBI Director Christopher Wray told the committee.

But both groups still aspired to strike the West and remained “committed” to attacking Americans and U.S. targets worldwide, Abizaid said. In 2022, terrorist groups increasingly used their “highly visible” online presence to inspire lone wolves to conduct attacks in the United States, Homeland Security Secretary Alejandro Mayorkas testified.

In 2022, Hezbollah, a Lebanese militia and political party backed by Iran, was also involved in long-term plotting inside the United States, Wray testified. Tehran sought retaliation for the U.S. drone strike that killed Iranian General Qassem Soleimani in 2020. Soleimani was commander of the Islamic Revolutionary Guard Corps—Qods Force, which oversaw Iran’s proxy network of militias in the Middle East.

Homegrown Extremists

FBI Director Wray: HVEs are the greatest, most immediate international terrorism threat to the Homeland. HVEs are people located and radicalized to violence primarily in the United States, who are not receiving individualized direction from FTOs but are inspired by FTOs, including the self-proclaimed Islamic State of Iraq and ash-Sham (“ISIS”) and al-Qa’ida and their affiliates, to commit violence. An HVE’s lack of a direct connection with an FTO, ability to rapidly mobilize without detection, and use of encrypted communications pose significant challenges to our ability to proactively identify and disrupt potential violent attacks.

ISIS

FBI Director Wray: Despite its loss of physical territory in Iraq and Syria, ISIS remains relentless in its campaign of violence against the United States and our partners— both here at home and overseas. ISIS and its supporters continue to aggressively promote its hate-fueled rhetoric and attract like-minded violent extremists with a willingness to conduct attacks against the United States and our interests abroad. ISIS’ successful use of social media and messaging applications to attract individuals is of continued concern to us. Like other foreign terrorist groups, ISIS advocates for lone offender attacks in the United States and Western countries via videos and other English language propaganda that have, at times, specifically advocated for attacks against civilians, the military, law enforcement and intelligence community personnel.

Homeland Security Secretary Mayorkas: ISIS media and its supporters have also sought to revitalize ISIS’s image as a global enterprise and to portray the group as the true vanguard of resistance against the United States and its allies. ISIS and its supporters continue to call for attacks in the United States, and supporters often share online tactics and techniques for reducing the likelihood of being detected by law enforcement.

NCTC Director Abizaid: ISIS in Iraq and Syria remains an intact, centrally led organization that will most likely continue to pose a global threat to U.S. and other Western interests as well as local populations. Despite losing more than a dozen senior leaders during the past three years, it continues to wage a low-level insurgency in Iraq and Syria since its territorial defeat in 2018 and commands a cohesive global network that has allowed the group to sustain its influence—and in some areas, such as in Africa, expand its recruitment and operations. We assess that in February, after a raid that killed its overall amir, ISIS transitioned seamlessly to a new amir. ISIS members readily accepted the new leader and we see no signs of fissures or splintering by the branches and networks despite limitations the group faces in Iraq and Syria.

Even under new leadership, ISIS remains committed to its long-term goal of establishing an Islamic caliphate and continues to exploit under-governed areas in Iraq and Syria, where it currently operates as a clandestine insurgency. This year, ISIS prioritized and attacked a detention facility in northeastern Syria that housed key ISIS leaders and experienced fighters. While we assess most of the high-value detainees were either recaptured or killed as local forces responded to the attack, the operation itself signifies ISIS’s ability to stage high-profile attacks and prioritize efforts to replenish its dwindling ranks. We have witnessed subsequent calls and efforts, including by ISIS branches as far away as West Africa, to free imprisoned members. ISIS’s capabilities and trajectory will remain dependent upon the level of counterterrorism pressure it faces, particularly by CT actors who continue to routinely disrupt ISIS’s facilitation networks and operations.

On Media: One of ISIS’s primary mechanisms to threaten the West is through its media, even as the group’s overall media capabilities have declined from the group’s early years. Despite this decline, ISIS’s most prolific threat to the United States or other Western countries is through inspired attackers who are vulnerable to influence by ISIS messaging. The group’s ability to inspire violence was most recently demonstrated by an ISIS supporter who carried out an attack in Oslo in June, which killed two and injured 21. Pro-ISIS supporter groups have also helped augment ISIS’s media presence by creating, archiving, translating, and disseminating multilingual propaganda online. One such group supporting ISIS-Khorasan published English-language media focused on delegitimizing the United States and denigrating the Taliban.

On Plots: While we have seen a decline in the number of ISIS-inspired attacks in the West since peaking in 2017, such operations remain a priority for the organization. The group also still aspires to deploy operatives to the West, and we continue to monitor for threats against high-visibility, attractive regional targets that would have similarly high impact and provide propaganda value and publicity, such as the 2022 FIFA World Cup in Qatar. More broadly, ISIS has continued to grow its global enterprise, which now includes approximately 20 branches and networks, through which ISIS leaders’ project strength and dispel the narrative of its defeat. In March, ISIS recognized its newest branch—ISIS in the Sahel—and, in July, the branch claimed responsibility for an attack on Nigeria’s Kuje prison—located 27 miles away from the U.S. Embassy—in which almost 1,000 prisoners were released, including some terrorists.

ISIS has also used its branches and networks to choreograph global attack campaigns since 2019, the most recent of which was in April to avenge the death of the group’s overall amir. ISIS in Iraq and Syria led in the number of attack claims and were boosted by ISIS–West Africa and ISIS-Khorasan, the branches we consider to be among the group’s most capable.

On Expansion: This year, ISIS-Khorasan expanded its ambitions outside Afghanistan with a handful of cross-border rocket attacks against Tajikistan and Uzbekistan and a foiled plot in India. Its ambitions for attacking the West—possibly including the Homeland—remains a top intelligence priority, notwithstanding the withdrawal of U.S. forces from Afghanistan last August.

ISIS is also exploiting uneven local CT pressure in Central, East, and Southern Africa to expand its presence, increase connectivity, and develop new capabilities beyond its traditional strongholds in North and West Africa. ISIS’s expansion in Mozambique increasingly threatens Western-led energy projects there, while signs of ISIS’s influence in the Democratic Republic of Congo, South Africa, and elsewhere in the region demonstrate the group’s growing appeal across the continent.

Al Qaeda

FBI Director Wray: Al-Qa’ida maintains its desire to both conduct and inspire large-scale, spectacular attacks. Because continued pressure has degraded some of the group’s senior leadership, we assess that, in the near term, al-Qa’ida is more likely to continue to focus on cultivating its international affiliates and supporting small-scale, readily achievable attacks in regions such as East and West Africa. Over the past year, propaganda from al-Qa’ida leaders continued to seek to inspire individuals to conduct their own attacks in the United States and other Western nations.

Homeland Security Secretary Mayorkas: Some terrorist-associated individuals maintain a presence in the Western Hemisphere, and could be leveraged to support extremist activities, possibly involving the homeland. For example, al-Qa‘ida-associated individuals in Brazil are involved in financial support through businesses they manage in the country, transferring funds in support of extremist-related activities, and involved in the printing and purchasing of counterfeit currencies in support of al-Qa‘ida’s global efforts.

NCTC Director Abizaid: The death of al-Qa‘ida’s longtime leader Ayman al-Zawahiri, this past July in Kabul, Afghanistan, dealt an important strategic and symbolic blow to the al-Qa‘ida network, which he led from relative isolation for more than a decade. Zawahiri was a respected ideological leader among the al-Qa‘ida global network who strove to enhance interconnectivity across al-Qa‘ida’s dispersed regional affiliates. The network now finds itself without an obvious leader, but how quickly it will adapt to Zawahiri’s loss remains to be seen.

Three months past the operation that killed him, the group has yet to publicly announce a successor. Among the remaining al-Qa‘ida veterans are several Iran-based senior leaders, most notably Sayf al-‘Adl and Abd-al-Rahman al-Maghrebi, who probably continue to provide ideological and strategic guidance to the global network. We expect they both will continue to have important roles in the years ahead, despite the irony of their location in Iran, another of al-Qa‘ida’s sworn enemies. Other, less prominent al- Qa‘ida leaders—who have been featured in globally and regionally focused media—are in charge of the regional affiliates and likely consult across a distributed leadership team about the direction of the al-Qa’ida network. Iran-based senior leaders oversee the global network, which includes regional affiliates in Africa, the Middle East, and South Asia as well as various local networks that support the affiliates.

In West Africa: al-Qa’ida’s Jama’at Nusrat al-Islam al-Muslimin (JNIM) is increasingly threatening capital cities in the Sahel while combatting local militaries, ISIS’s Sahel province, and Russian paramilitary forces in Mali. In July of this year, the group attacked Mali’s largest military camp, located just outside of Bamako, underscoring both its capabilities and growing boldness in the region. JNIM probably hopes to exploit the departure of French forces from Mali earlier this year to accelerate its growth and entrenchment, including into littoral West African states such as Benin, Cote d’Ivoire, and Togo. CT concerns in the region have further led to instability fueling nondemocratic transitions of power, most recently last month in Burkina Faso.

In the Horn of Africa: We remain concerned about the continued threat that al-Shabaab poses to U.S. citizens and Western interests. Al-Shabaab is the wealthiest and most lethal of all al-Qa’ida affiliates, controls large portions of southern Somalia, and has demonstrated the capability to carry out successful operations across the region, including against U.S. service members.

In North Africa: al-Qa‘ida in the Islamic Maghreb (AQIM) has experienced setbacks from CT pressure since early 2018, but probably provides guidance to other al-Qa‘ida elements in the region, particularly JNIM. As of 2020, Algerian Yazid Mebrak was serving as AQIM’s leader and was playing a key role in al-Qa‘ida’s management of global operations, including the abductions and killing of Americans.

In Middle East and Yemen: AQAP is intent on conducting operations in the West and against U.S. and allied regional interests. It has proven itself to be among the al-Qa‘ida network’s most creative branches but has faced significant CT pressure in recent years, creating hurdles for the group’s external operations planning.

In June 2021, AQAP published its sixth issue of Inspire Guide, which provides operational guidance for would-be attackers in the Homeland and suggests the group still maintains a viable media capability, despite the death last year of its key propagandist.

In Syria: al-Qa‘ida elements under the banner of Hurras al-Din have struggled to stabilize their footing and experienced numerous leadership losses and pressure from rival group Hay’at Tahrir al-Sham. However, these elements could use their traditional safe haven in opposition-controlled territory to target U.S. and other Western interests in the region.

In Afghanistan: al-Qa‘ida’s South Asia affiliate, al-Qa‘ida in the Indian Sub- continent (AQIS), is the weakest group in the organization’s global network. Al-Qa’ida remains intent on striking U.S. interests and inspiring its followers to do so but currently lacks a capability to direct attacks against the United States from Afghanistan. Separate from AQIS, there are probably fewer than a dozen al-Qa‘ida legacy members with historical ties to the group located in Afghanistan, and some may have been there prior to the fall of Kabul; we have no indication that these legacy members remaining in Afghanistan are involved in external attack plotting.

Hezbollah

FBI Director Wray: Iran and its global proxies and partners, including Iraqi Shia militant groups, continue to attack and plot against the United States and our allies throughout the Middle East in response to U.S. pressure. Iran’s Islamic Revolutionary Guard Corps-Qods Force (“IRGC-QF”) continues to provide support to militant resistance groups and terrorist organizations. Iran also continues to support Lebanese Hizballah and other terrorist groups. Hizballah has sent operatives to build terrorist infrastructures worldwide.

The arrests of individuals in the United States allegedly linked to Hizballah’s main overseas terrorist arm, and their intelligence collection and procurement efforts, demonstrate Hizballah’s interest in long-term contingency planning activities here in the Homeland. Hizballah Secretary-General Hassan Nasrallah also has threatened retaliation for the death of IRGC-QF Commander Qassem Soleimani. This threat was exemplified in 2022, when the Department charged an Iranian national and member of the IRGC, working on behalf of the Qods Force, with a plot to murder a former National Security Advisor.

Homeland Security Secretary Mayorkas: We continue to see Iran and its partner, Lebanese Hezbollah, pose an enduring threat to the homeland, evidenced by Iran’s public statements threatening retaliation in the United States for Islamic Revolutionary Guard Corps Quds Force (IRGC-QF) Commander Qasem Soleimani’s death and historical arrests of IRGC and Hezbollah members plotting operations in the United States.

In the past several years, U.S. law enforcement has arrested numerous individuals for spying on Iranian dissidents in the United States and for acting as agents of influence for the Iranian Government. In August, federal prosecutors unsealed charges against an IRGC member for plotting to assassinate a former US official. Given its capabilities, Iran could advance an attack plot targeted at the United States with little to no warning. DHS continues to work closely with other law enforcement agencies and the Intelligence Community to stay aware of ongoing threat streams and take preventative actions as appropriate.

NCTC Director Christine Abizaid: Iran continues to encourage and support plots against the United States at home and abroad, especially in the Middle East. Iran and Lebanese Hizballah have remained intent on retaliating for the death of Islamic Revolutionary Guard Corps-Qods Force (IRGC-QF) Commander Soleimani, with Iran plotting attacks against former U.S. officials.