Post Manchester bombing – threat analytics on recent Islamist attacks on entertainment/hospitality venues

ISIS’ attack on the Ariana Grande concert in Manchester on 22 May was particularly heinous because it specifically targeted teen and pre-teen girls. It represents some of the most twisted and hateful ideology known to mankind: Islamist jihadism (IJ). Obviously, this was not the first IJ attack on an entertainment or hospitality venue. Nor did it achieve the highest casualty count. But are we aware of how often these types of attacks happen? The following statistics from 2016 – 22 May 2017 help explain the threat and clarify the capabilities and intentions of IJ groups, particularly regarding entertainment/hospitality venues. It is a wakeup call.

To briefly clarify, the following data and analyses apply to IJ attacks only. Select target locations here include entertainment, food/beverage, lodging, and sports venues. Religious structures and shopping sites such as daily markets and malls were excluded.

Timeline: From January 2016 – 22 May 2017, there were 20 IJ attacks on entertainment/hospitality venues around the world. There were at least 17 attacks in 2016, and there have been as many as three so far in 2017. Statistically, this translates to nearly one every month, a solid operational tempo. For this short time period, the trend line is down, but the casualty rates are beginning to creep up (see below).

Casualties: The total number of casualties for this IJ target set during this timeframe was 357 killed, and 1,094 wounded. In military terms, this equals about two companies and a reinforced battalion, respectively. Comparatively, there were multi-day periods during major WW II battles where US forces sustained such casualty rates. But in this ongoing Islamist war, these are civilian casualties, they are spread out over about a year and a half’s time, and they are global. They have a slow, erosionary, and significant impact on society. Over time, such attacks lower societal morale, cause a loss of faith in government and security forces, trigger ethnic and religious tension, increase internal government friction, and divert government spending. These are classic irregular war effects. It is war by attrition, war by exhaustion.

Global attack geography: Geographically, IJ terrorists spread out their attacks on entertainment/hospitality venues during the established timeframe. Europe, Asia, and Africa each suffered five such attacks. In the Americas, there were three, and in the Middle East, there were two. So this is not simply a “Middle East or Muslim problem” that is “over there.” It is global, and it is certainly happening in the West and in developed countries.

Sub regional attack geography: Sub regional data reinforces the broader global data. This demonstrates that IJ terrorists have invested considerable personnel, intelligence, operational expertise, logistics, and financing into attacking entertainment/hospitality venues in Western Europe, North America, and Southeast Asia.

Country attack geography: The above geographic conclusions are further bolstered by the data on attacks by country. The US suffered three (Orlando, Florida; Seaside Park, New Jersey; and Columbus, Ohio.) Germany, France, and Somalia each suffered two. Afghanistan, Egypt, Indonesia, Burkina Faso, Ivory Coast, Iraq, Malaysia, Bangladesh, Thailand, Turkey, and the UK each had one.

Overall tactics applied: IJ terrorists used three types of tactics on entertainment/hospitality venues during the 2016 – 22 May 2017-time period: raids, attacks using explosives, and vehicular homicide.

Raid tactics: Raids consisted of either a single person or a group attacking a location and then escaping or fighting to the death. It takes audacity and the willingness to murder scores of civilians face-to-face to raid an entertainment/hospitality venue.

In seven cases, groups did the attacking, and in four cases, individuals did. The latter, when firearms are involved, are more commonly known as “active shooter” situations.

The 12 June 2016 attack on the Pulse nightclub in Orlando, Florida, is a prime example of the latter. Here, a single shooter raided the venue with a semi-automatic rifle, killing 49 and wounding 53.

The 15 January 2016 raid on the Cappuccino restaurant and Splendid Hotel in Ouagadougou, Burkina Faso, is an example of a “classic” terrorist raid. Here, as many as six members of AQIM (al Qaeda in the Islamic Maghreb) armed with assault rifles and explosives raided the aforementioned cafe and hotel, killing 30 and wounding 56. They also set the hotel on fire.

In most raids, the attackers used firearms and/or a combination of firearms and explosives, like a car bomb and AK-47s. For example, the 1 June 2016 raid on the Ambassador Hotel by a small squad of AK-47 wielding, al Shabaab terrorists began with a massive car bomb. The casualty rate was 13 killed and 40 wounded.

In three raid cases in the given timeframe, however, the terrorists just used edged weapons, like knives and machetes.

As an example, on 12 February 2016, an Islamist jihadist acting alone attacked the Nazareth Restaurant and Deli in Columbus, Ohio, with a machete, injuring four before police shot him. The 1 July 2016 raid on the Holey Artisan Bakery (restaurant) in Dhaka, Bangladesh, however, is also typical. Here, five ISIS-related terrorists took over the venue with firearms, explosives, and knives. Firmly in control, the terrorists methodically slaughtered scores of hostages over several hours until security forces stormed the establishment. The final casualty rate was 20 killed and 50 wounded.

Explosives tactics: Attacks with explosives consisted of suicide bombers, hidden/planted bombs, a two stage bombing that included a vehicle bomb, and a grenade attack. Planted bombs require tradecraft skillsets regarding circumventing/tricking security and surreptitious placement of an explosive device. Suicide bombs require much less. Grenade attacks require speed in the attack and egress.

An example of a grenade attack comes from Kuala Lumpur. Here, on 28 June 2016, two ISIS terrorists on a motorcycle drove up to the Movida night club/sports bar – much of which is open to the street – and hurled in a grenade before speeding off. No one was killed by the blast, but eight were wounded.

Regarding bombings, and besides the Manchester case, on 24 July 2016, a suicide bomber attacked Eugens Weinstube (Eugene’s Wine Bar) in Ansbach, Germany, next to an ongoing music festival, injuring 15.

Vehicular tactics: Vehicular homicides used cars, vans, or trucks to plow through crowds of people. Vehicles and pedestrians, then – two elements common to every society on earth – are all that is needed; that and a murderous ideology. It is a relatively new tactic, and it can achieve high casualty rates. In fact, of all 20 cases cited here, a vehicle attack – the Bastille Day attack in Nice, France – achieved the highest casualty rate: 87 killed, and 434 wounded. (Usually, the street where this attack occurred, the Promenade des Anglais, is a normal street, but at the time of this attack, it had been turned into a festival venue, so it was included in the attack data.)

The broader tactical analysis for all these attacks is this: it is not just the tactic, but also the target, that dictates casualty rates.

Targeting: As for targeting – the person or thing that terrorists want to destroy – there were five cases of attacks on food/beverage venues, four cases of attacks on lodging (one case involved two hotels in a single attack), and two cases of attacks on combined lodging-food/beverage venues. There were three cases of attacks on night clubs/bars, and three cases of attacks on urban common areas like boardwalks and promenades. Examples of the latter include the attack in Nice and the pipe bomb attack on the boardwalk in Seaside Park, New Jersey, during a Marine Corps charity race, which injured no one.

As for the rest of the targets attacked during the 2016 – 22 May 2017 timeframe, there were two attacks on stadiums, and one attack on a museum.

Hotels and restaurants are popular targets in part because civilians in these places are contained in defined spaces, and to terrorists, attacking them is like shooting fish in a barrel. These places are moreover high traffic areas and are regularly full, so the opportunity for attack is nearly always present. The other venues, like stadiums, are packed with civilians on a less frequent basis, and even average event security can dissuade at least some terrorism, so attacks on these places has been less frequent.

Kill rates by venue and tactic: As stated, casualty rates not only depended on the tactic used, but the civilian capacity of the venue – as in, was it packed with unsuspecting people at the time of the attack? Above are the top five attacks that reaped the most number of killed during the 2016 – 22 May 2017 timeframe. Manchester was number six.

Conclusion – understand the tactics, but also master their ideology

The attack on the Manchester Arena was not uncommon regarding the venue itself. (The mass targeting of young girls was, however.) IJ terrorists see entertainment/hospitality locales as high payoff targets, and they will continue attacking them. Their goal in attacking these and other civilian establishments is to break down their targeted societies slowly but surely, and exhaust them into some kind of politico-religious compromise and/or submission, even if it is incrementally over a long period of time.

Additionally, IJ groups might squabble and even kill each other – the temporary ISIS vs. al Qaeda fight in Syria, for example – but they are increasingly seeing their war as united in politico-religious ideology and global end goals. Many nation states, on the other hand, largely see terrorist attacks in general as singular incidents carried out by cells on a per-country basis. The United States is a classic example. It has scores of national security professionals and multitudes of pundits who see terrorism in this regard. Additionally, causing nation state governments to argue amongst themselves – to politically devour themselves – is an effects-based aspect of this strategy, and it is effective. The political fallout and finger pointing after each entertainment/hospitality attack demonstrates this point.

Strategically, allowing such attacks to go unchecked only empowers IJ groups to do more. Simply absorbing these types of attacks and accepting them as “the new norm” is folly as well, not to mention malpractice. Doing so fails to understand the multiple, profound impacts of irregular warfare.

By the time the US entered the Vietnam War in earnest in 1965, for example, communist assassins were already staging about 1,000 assassinations a year throughout South Vietnam. They targeted government civilian administrators, police officers, staunch civilian supporters of the southern government, etc. Society had already been destabilized, and simply fighting the communists with military force was not enough. There needed to be dramatically enhanced intelligence to identify and neutralize the enemy, heightened physical security, and, most importantly, counter political warfare. It was political ideology, after all, that drove the communist assassins to kill.

What is happening around the world now is similar. But instead of a single country like Vietnam, it is global. Tackling this threat requires a full understanding not only of the enemy’s tactics and violent strategy as demonstrated here, but their ideological intentions as well. It took ideology for the Manchester terrorists to build and deploy a suicide bomb against little girls. Aside from improved security across a wide spectrum, it will take a massive counter ideology campaign to help defeat this threat.

Copyright © Muir Analytics 2017

Posted in Recent Friction Points | Leave a comment

Two stage bombing at major department store, Pattani, Thailand, 9 May 2017

The Bangkok Post reports that just before 3:00 pm on 9 May 2017, insurgents triggered a two stage bombing, which included a car bomb, at the Big C department store in Pattani town. The blasts wounded at least 61. Scores of the victims were women and children as they were buying school supplies for the new academic semester, reports The Nation. National police chief Chakthip Chaijinda says intelligence received a warning about the bomb an hour before hand, but because of unexplained bureaucratic red tape, security forces did not prevent the attack. Authorities blamed the bombing on the BRN insurgent group (Barisan Revolusi Nasional,) or a splinter faction of it, or rogue local BRN commanders.


The terrorists first detonated a small device at 2:50 pm (other reports say 2:30 pm) 100 meters in front of the store’s main entrance where the parking lot meets the main highway, Nong Chik Road.

Alert Big C security guards locked down the building immediately after the first blast. They also noticed, as did several shoppers, a pickup truck suspiciously parked too close to the main entrance of the store, so they ushered shoppers to the rear of the building. Minutes later, the main device in the pickup truck exploded.

Blast damage from the main device was severe. Photographs from The Nation show heavy destruction to the façade of the store and the interior of the building that was closest to the seat of the blast. Steel ceiling beams were mangled, multitudes of parked motorbikes were destroyed, glass windows were completely shattered, and fires dotted the property. Concrete load bearing columns, on the other hand, appeared structurally sound.

Big C officials estimated full cleanup and repairs would take at least four weeks. Initial financial damage estimates were $869,817, but remodeling, lost business, and increased security costs could send this figure to over $1 million.

The police investigation into the bombing quickly revealed that the owner of the pickup truck, a canvas worker, was lured to the Ban Mai village mosque (Nong Chik district, Pattani) under the pretense of setting up a tent. Instead, insurgents abducted, tortured, and then executed the man. The bombers then used the victim’s photo ID and truck to access the Big C’s parking lot, which is tightly monitored by CCTV. At least one of the bombers’ faces was captured on CCTV, which helped speed the investigation along.

Regarding the bombs, investigators ascertained that the first device’s explosive compound was gunpowder. It was a timed device, encased in a blue plastic container, and powered by 1.5 and 9-volt batteries, says the Bangkok Post.

Police say the pickup truck bomb was encased in two cooking gas cylinders, one 4 kg, and one 15 kg. Investigators also found a radio-controlled detonation device and a timer. The explosive compound appears to have been gunpowder. It seems that a flammable liquid in a yellow petrol type container was attached to the bomb. Steel rod fragments were also discovered. The entire device weighed approximately 100 kgs.

Police detained at least six suspects within 24 hours of the blasts, and they estimated there might have been 18 people involved. An Islamic schoolteacher and a Tambon Administrative Organization official (sub-regional administrator) were among those questioned. It is not clear if these two had a role in the attack, or if they were witnesses.

Authorities say the bombers in this case were part of the same group that had carried out similar attacks in the area, including the bombing of the Southern View Hotel and scores of tourist sites in mid-southern Thailand in August 2016. Muir Analytics covered these attacks here, here, and here.

The accused killer of the canvas worker was supposed to be a reformed insurgent who participated in the “Bring People Home” amnesty-program, which is now under review, said Army Colonel Peerawach Saengthong.

A major Muslim organization in Thailand, the Sheikhul Islam Office, published an open letter condemning the attack.

There are seven takeaways here. First, the two stage bombing, colloquially known as a “double tap,” is a popular and effective tactic of the southern Thai insurgency (and other insurgent/terrorist groups around the globe.) Other notable occasions where the Thai insurgents have used this tactic include, but are not limited to:

  • The Southern View Hotel, Pattani, 23 August 2016
  • The CS Pattani Hotel, Pattani, 17 March 2008
  • The Marina and Riviera Hotels, Narathiwat, 31 December 2007 (New Years Eve)

Second, the insurgency has attacked Big Cs before – including the Pattani Big C – indicating that they are standard on the movement’s target list. Attacking them reaps sensational headlines. Past Big C attacks include:

  • September 2006, Hat Yai
  • August 2005, Pattani
  • March 2012, Pattani

Third, this bombing was meant to kill as many civilians as possible. The small device was meant to draw people out of the store, either as spectators to the scene of the small blast, or as panicked shoppers fleeing the violence. The main device was positioned in a prearranged killing zone and was meant to slice through a crowd. The large size of this device, the flammable liquid, and the severe blast damage done to the store all reinforce the intention of causing a massive kill.

Fourth, the desired mass kill here and the torture/murder of the canvas worker signify anger, rage, bloodlust, and dehumanization of civilians. The group that harbors this psychosis has a taste for killing and will continue until stopped by security forces.

Fifth, the professionalism and cool headedness of the Big C’s security staff kept at least 20 civilians from being killed outright and perhaps 40 or more from being severely wounded.

Sixth, while no counterinsurgency initiatives proceed flawlessly, the breakdown in the intelligence-police chain of command highlighted by National Police Chief Chakthip and the defects in the “Bring People Home” program highlighted by Army Colonel Peerawach indicate weaknesses in some of the government’s counterinsurgency efforts. Whereas amnesty programs are complex, and ill meaning actors will occasionally penetrate them, the intelligence-police chain of command, after 13+ years of warfare, should be operating more efficiently.

Finally, this bombing is but one more example of increasingly audacious attacks on civilian targets, and more can be expected. The presumed responsible party, the BRN or one of its splinters/rogue elements, has seemingly grown weary of its insurgency efforts of setting up a shadow government and engaging in “armed politics” at the local and provincial levels. After over a decade of warfare, it has not produced the desired end goal of secession and statehood. Lashing out against the population via audacious terrorist tactics, or “violent communication,” is this group’s solution to the impasse. This is a strategy used by ISIS as well.­­

Sources and further reading:

Pattani Big C store delays reopening,” The Nation, 16 May 2017.

Big C suspects named,” The Nation, 13 May 2017.

Army orders rebel vetting,” Bangkok Post, 13 May 2017.

Vendor brutally killed for truck used as car bomb,” Bangkok Post, 11 May 2017.

18 suspects in car-bombing of Big C,” Bangkok Post, 11 May 2017.

Local leaders arrested in Big C car bombing,” Bangkok Post, 11 May 2017.

Dozens injured in Pattani double bomb blasts,” The Nation, 10 May 2017.

Pattani bomb blasts leave scores hurt,” Bangkok Post, 10 May 2017.

Pattani bombers identified,” Bangkok Post, 10 May 2017.

Bombs at Big C in Pattani injure 56,” Bangkok Post, 9 May 2017.

Copyright © Muir Analytics 2017

Posted in Recent Friction Points | Leave a comment

6 March 2017, ELN violence hinders/halts operations of three major companies in Colombia

As of 6 March 2017, three major corporations in Colombia – Gran Colombia Gold, Occidental Petroleum, and Ecopetrol – have either canceled or put on hold their operations due to attacks by the insurgent group, Ejército de Liberación Nacional (ELN, or the National Liberation Army).

The ELN is a Marxist insurgent group that formed in 1964. It seeks to overthrow the government of Colombia and replace it with a communist regime. It has approximately 1,500 fighters. A decade ago, it had over 5,000. The ELN makes liberal use of terrorist tactics.

The ELN and the government entered into peace negotiations on 7 February 2017. This comes on the heels of similar and more promising peace negotiations between the government and Colombia’s biggest insurgent group, Fuerzas Armadas Revolucionarias de Colombia (FARC, or Revolutionary Armed Forces of Colombia) that have actually seen some FARC units disarm and reject violence.

Regarding the ELN’s violence against corporations, Gran Colombia Gold, on 27 February, announced it was suing the government of Colombia for $700 million over “difficulties” maintaining its mining operations. It blamed illegal miners and attacks by the ELN. The company specifically said the insurgent group had “obstructed projects in the Antioquia region” throughout 2016.

Canada-based Gran Colombia Gold mines gold and silver. Its main geographic focus is Colombia where it runs the largest underground gold and silver mines in country via its Segovia (Antioquia department) and Marmato (Caldas department) operations.

As for Occidental Petroleum, it operates a 50,000-barrel a day oil production project – the Caño Limón Field – in the Llanos Norte Basin (Arauca department), and an enhanced oil production project – the La Cira-Infantas area – in the Middle-Magdalena Basin (Santander department). For the latter, Occidental partners with Colombia’s state-owned oil company, Ecopetrol.

As of 15 February, Occidental shut down 44 of 370 wells in the Caño Limón Field over ELN attacks on the 210,000-barrel a day Caño Limón-Coveñas pipeline. Ecopetrol owns the pipeline. If the pipeline cannot move oil from the field and its onsite storage tanks, then the whole operation has to halt. There have been 17 attacks on the pipeline in 2017, and there were 43 attacks in 2016, reports Reuters.

As a result of these pipeline attacks, says Bloomberg Quint, Ecopetrol, on 15 February, had to declare a “force majeure” and halt oil exports. In layman’s terms, a force majeure absolves a company from fulfilling its business obligations due to “an act of God,” or unforeseen circumstances beyond the control of the company in question.

The ELN has increased operations as of late. On 19 February, it claimed responsibility for a major bombing in Bogota in La Macarena neighborhood just down the street from the city’s main bullfighting ring. The blast killed one, a police officer, and wounded 26. The City Paper Bogota reports that the ELN said it specifically targeted the Mobile Anti-Disturbance Squadron (ESMAD) because it had put down “social protests.”

On 16 February, the ELN bombed the Caño Limón-Coveñas pipeline in El Carmen (Norte de Santander department), which is near the Venezuelan border, reports Business Insider. The attack temporarily shut down the pipeline, and an insurgent minefield hindered repair operations. On the same day, the ELN kidnapped the father of a local town mayor.

On 14 February, the ELN ambushed a military patrol on the Bogotá-Villavicencio highway in eastern Colombia, wounding two.

There are four takeaways here. First, despite pursuing peace talks and its reduced manpower, the ELN maintains its destructive capabilities and ideological motivation for attacking security, infrastructure, and civilian targets. It is not a significantly weakened organization.

Second, the ELN appears to have adopted a “talk-fight” strategy where it engages in peace talks and simultaneously continues its attacks in order to pressure the government to deliver favorable negotiating terms. Both insurgent and conventional forces have made liberal use of the talk-fight strategy throughout history. Communist forces in particular have used it to good effect; the North Vietnamese during the Vietnam War, for example.

Third, the corporate shutdowns mentioned here are not surprising given that these companies are operating in a decades-old low intensity conflict zone where thousands have been killed. If anything, it brings into question the business and legal logic of Gran Colombia Gold’s lawsuit and Ecopetrol’s force majeure. It is difficult to comprehend why any company would assume their operations would function normally in such hostile conditions. No government can protect all businesses from highly experienced insurgent armies. In this environment, no action by the ELN should be considered an “act of God.” It is a war zone, and this group has been carrying out these types of attacks for decades.

Fourth, if any legal term applies here, it is “totality of circumstances,” which essentially means, when referring to violent areas, that attacks happen so often that a corporation should take the responsibility to protect itself, and also that it should absorb at least some of the legal and financial downside should attacks happen.

Looking ahead, the ELN is most likely to continue its talk-fight strategy unless the government ceases peace talks and concentrates massively increased and sustained operations against the insurgents. If the ELN receives favorable negotiating terms up front, it might curb or halt its violence until it becomes useful to pressure the government again. Having said this, the ELN has been fervently dedicated to Marxism since the 1960s, and it is an organization steeped in generations of warfare. For these reasons, the ELN could break off peace negotiations at any time.

Companies seeking to do business in Colombia should take note of the situation of these three companies and weigh the costs of doing business in country, which should include a robust security program, relevant legal expertise, and added insurance.

Sources and further reading:

Colombia rebel group wages oil pipeline war as another disarms,” Bloomberg-Quint, 3 March 2017.

Occidental starts to suspend Colombia production after rebel attacks,” Reuters, 1 March 2017.

“Canadian gold company to sue Colombia for 700m US dollars,” BBC Monitoring Americas, 27 February 2017.

ELN claims responsibility for Colombia bomb attack,” Anadolu Agency, 27 February 2017.

ELN guerrillas claim responsibility for La Macarena bombing, The City Paper Bogota, 27 February 2017.

Explosion rattles Colombia’s capital, injuring dozens,” Miami Herlad, 19 February 2017.

UPDATE 1-Bombing halts pumping on Colombia’s Cano-Limon oil pipeline,” Business Insider/Reuters, 17 February 2017.

Profiles: Colombia’s armed groups,” BBC, 29 August 2013.

Gran Colombia Gold website, Operations & Projects.

Occidental Petroleum website, Colombia.

Copyright © Muir Analytics 2017

Posted in Recent Friction Points | Leave a comment

27 February 2017, Indonesian police shut down Bandung terror attack

The Jakarta Globe reports that at 9:00 am on 27 February in Bandung, West Java, a terrorist detonated a bomb next to a park (Pandawa Park,) injuring no one.

As a pack of school kids chased him shouting, “terrorist!,” the bomber made his way to the Arjuna subdistrict government administrative office while laughing at the kids and taunting them with a knife along the way, says Kompas.com. Once in the Arjuna office, all staff escaped, and the terrorist began to set the second floor offices on fire. He shouted at civilians who accosted him, rejected negotiating attempts by police, and demanded that Indonesia’s main counter terror force, Densus 88, release its Islamist prisoners.

While all this was happening, a handful of students secured the suspect’s motorcycle and identity card, which he left behind.

Shortly after police secured a perimeter around the target building, reports the Jakarta Post, the West Java Police Mobile Brigade (SWAT) breached the building – under cover of fire hose spray from the fire department – and shot the bomber. He died of his wounds shortly thereafter.

Indonesian police on 28 February identified the bomber as Yayat Cahdiyat. He was a member of the terror group, Jamaah Anshar Daulah (JAD,) also called Jamaah Anshar Daulah Khilafah Nusantara (JAKDN.) JAD is one of several Indonesian groups that has pledged support to ISIS. Indonesia’s National Counterterrorism Agency (BNPT) says JAD is the country’s most deadly terror organization.

Yayat, say police, is also a former terrorist convict, having served two years in prison beginning in 2012 for Islamist terrorist training and related activities in Aceh.

The police are investigating eyewitness accounts that assert that Yayat had an accomplice at the beginning of the attack.

Regarding the bomb, police said it was contained in a pressure cooker, a tactic that both al Qaeda and ISIS have propagated in their online magazines and forums. It was used to great affect in the 15 April 2013 Boston Marathon Bombings. There is no word yet on the compound used, but investigators found copious bomb making materials at Yayat’s home, says Tempo.co.

There are four takeaways here. First, this attack is a continuation of ISIS’ Indonesia campaign, which picked up momentum via a string of small attacks and failed attack attempts in 2016. Muir Analytics reported on them here.

Second, this attack, like others in 2016, was oddly ineffectual. Yayat’s bomb, apparently a low power device, did not seem to target any specific people or a building. On the other hand, he certainly attacked the Arjuna subdistrict office, and he clearly meant to extort the government for release of his terrorist comrades from captivity. Yayat’s actions and words demonstrated that he was a clear and present danger to Indonesian society, but he did not massacre the civilians around him when indeed he could have. This might be a sign that some members of ISIS-related groups are trying to avoid civilian casualties and instead focus on government targets. These groups need society’s support to survive and flourish.

As an aside, there is commentary suggesting that Yayat, despite the deradicalization programs he went through in prison, were none too effective, and that he had trouble reintegrating back into society. If true, his attack might have partly been a “suicide by cop” scenario.

Third, it is significant that Bandung civilians (including high school students,) a) chased the bomber, b) accosted the bomber, and c) secured his motorcycle and ID card, all as the attack was unfolding. These actions were not only brave, they prove that the Indonesian government has successfully mobilized parts of the civilian population to reject Islamist jihadi ideology and act against it as an extension of law enforcement. This is artful counterinsurgency methodology.

Fourth, the fact that the Bandung police were able to both secure the scene and inject its SWAT force into the melee so quickly indicates a high state of counter terrorism readiness on behalf of the state. The entire operation was finished in less than two hours.

Regarding assessments, Muir Analytics’ January 2017 prognostication posted here remains relevant. In short, ISIS related groups are likely to continue small and frequent attacks while attempting intermittent punishing and sensational attacks in order to remain relevant. Yayat’s seemingly timid attitude toward civilian casualties should not be taken as ISIS’ modus operandi. It tried to carry out Bali style attacks in 2016, which would have killed scores of civilians. It will try again.

The Indonesian government will need to continually improve upon its largely successful counter terror and counterinsurgency strategies to keep this from happening. Fervently attacking the Islamist jihadi ideology will be necessary in 2017.

Sources and further reading:

Police Search House of Bandung Bomber, Confiscate Evidence,” Tempo.co, 28 February 2017.

Bandung Bomber Does Not Act Alone: Police,” Jakarta Globe, 28 February 2017.

Bandung Bomber Is affiliated with Islamic state: Police,” Jakarta Globe, 28 February 2017.

Bandung terrorist suspect was ‘recidivist’: Police,” The Jakarta Post, 27 February 20-17.

Suspected terrorist in Bandung captured alive,” The Jakarta Post, 27 February 2017.

No casualties reported in Bandung terrorist attack: Police,” Jakarta Globe, 27 February 2017.

Pelaku bom Bandung sempat dikejar puluhan anak SMA,” Kompas, 27 February 2017.

Suspected Bandung terrorist dies en route to hospital: Police,” The Jakarta Post, 27 February 2017.

Copyright © Muir Analytics 2017

Posted in Recent Friction Points | Leave a comment

31 January 2017, Indonesia – ISIS to attempt more violence in 2017 in the face of effective Indonesian counterterrorism operations, with Jay Heisler

In the final months of 2016, there was a flurry of ISIS-related activity in Indonesia, including, but not limited to, the following:

On 28 August in Medan, Sumatra, a man burst into a Catholic church and stabbed a priest who was leading a service, and then attempted to explode his suicide vest, which failed to detonate properly. Time magazine reports that the priest sustained minor injuries to his arm. Churchgoers subdued the attacker and discovered a pipe bomb and an axe on his person. The attacker’s backpack had an ISIS flag on it along with a note that said, “I love al-Baghdadi,” referring to the leader of ISIS, Abu Bakr al-Baghdadi.

On 20 October in Jakarta, ABC News and SBS reported that a man placed an ISIS sticker on a traffic police kiosk and then threw a pipe bomb at police manning the post. After the device failed to detonate, the man then attacked officers with a machete, injuring three, including a local police chief. The police shot and killed the attacker. A sweep of the scene found a pipe bomb nearby. Authorities said that the man was affiliated with the radical Islamist group, Daulah Islam (also written as “Daulah Islamiyyah,”) which means “Islamic State.”

On 13 November at 10:20 am in Samarinda, East Kalimantan province, Time magazine reports that a man wearing a “jihad way of life” t-shirt and who was previously convicted of Islamist jihadist terrorism threw a Molotov cocktail at the Oikume Church. The attack killed a child and wounded three others. Authorities tracked down the perpetrator and arrested him and four cohorts for aiding in the attack and for being associated with ISIS.

On 14 November in Singkawang, West Kalimantan province, assailants at 3:00 am (other reports say 2:30 am) firebombed a Buddhist temple, says Time magazine. The specific target was the Budi Dharma Vihara temple, which was empty at the time. There were no casualties. This anti-Buddhist targeting appears to be in line with Islamist attack ideology, and the timing of the attack came on the heels of the Samarinda church attack.

Additionally, just after the Buddhist temple attack, a bomb threat apparently made by a woman was called into the Paroki Gembala Baik (Good Shepard) Catholic church in Kota Batu, East Java.

On 26 November in Jakarta, police arrested a man named Rio Priatna Wibawa for attempting to bomb multiple targets in Indonesia in support of the Rohingya cause in Myanmar. Rio’s targets included the Myanmar embassy in Jakarta. Rio is alleged to have received guidance and funding from Indonesian ISIS leader Bahrun Naim, who is currently based in Syria. Rio reportedly had a large cache of explosives, including RDX, TNT, HMTD, and possibly TATP. Authorities say that Rio’s cache could have been used to build a bomb more powerful than the 2002 Bali bomb that killed 202 and wounded 209. (This bombing entailed a small device in a nightclub, and a larger one, 2,250 pounds, in a van on the street.)

On 10 December, authorities rounded up a three-person, Bahrun-linked terror cell planning an attack on the changing of the guard at the Presidential Palace in Jakarta. Their plan included using a woman as a suicide bomber, which would have been a first for Indonesia. Police said they were hunting for two more accomplices at the time of the arrest.

On 18 December, police arrested yet another three people in a suspected suicide bomb plot that they again linked to Bahrun. This group, like the one arrested on 10 December, planned to use a woman as the bomber at an undisclosed target, reports the Jakarta Globe.

On 20 December in Jakarta’s popular tourist district, Ubud (a sub-district of Kedewatan,) a bomb in a backpack was found near a food stall in Jakarta, reports Time magazine. The crude bomb was built of “explosives, fireworks, pipes and nails,” and an ordnance disposal team safely detonated it. The backpack was stolen from a Dutch tourist. A food stall owner discovered the device. A note was found in the backpack with the word “bomb” written on it. (Several news outlets report that, because the device contained fireworks, it must have been a non-threatening incident. Because the police reported that it also contained “low grade explosives,” however, and because the police detonated the device, this was probably a viable bombing attempt. If it were simply a bag of fireworks, the police would have just secured the bag and emptied its contents. Muir Analytics suspects that this bombing attempt was linked to the other Islamist attacks, primarily because there have been multiple such attacks and attempts as of late. Moreover, the government would have pinned this bombing on a non-Islamist jihadist party if it were the case in order to reduce the image of the country being a hotbed of ISIS activity. For example, police on 27 December were quick to blame a possible Islamist bombing attempt in Magelang, Central Java, on an employment dispute involving the leader of the Ponpes Islamic boarding school.)

On 21 December in Tangerang, a city 16 miles west of Jakarta, police counterterrorism unit Densus 88 killed three terrorists and arrested a fourth in a firefight at a militant safe house. Police evacuated the neighborhood after the melee upon discovering multiple bombs on site. Authorities said the bombs were part of a Christmas and/or New Year’s Eve attack plot in Jakarta. They also said this cell was connected to the suicide bomb plot reported on 18 December, thereby making it an ISIS-related incident.

There are seven key takeaways here. First, the terrorists mentioned here, whether coordinated or not, demonstrated good organizational capacity and high motivational fervor. They carried out or attempted a total of nine operations in five months, which is an adequate operational tempo for a relatively new terrorist initiative.

Second, despite the adequate tempo, their overall effectiveness was low. Of these nine operations, only four were executed. Of those not executed, one was foiled in the field, and four were thwarted in the plotting phases. The terrorists were not able to inflict high casualties, though the casualties were still odious. One person was killed, and seven were wounded.

Fourth, tactically, these terrorists relied heavily on explosives. Of the nine operations mentioned here, seven involved explosives, and two involved arson. (It is likely that some of the foiled plots might have involved raids such as the 14 January 2016 attack in Jakarta analyzed by Muir Analytics here.)

Fifth, despite their reliance on explosives, the terrorists’ bombing expertise appears minimal because of at least three failed detonations.

Sixth, the targeting regimen of these terrorists clearly falls in line with traditional Islamist jihadist methodologies, particularly in Indonesia, aimed at destabilizing society and rallying like-minded religious zealots. Three targets entailed religious cleansing (two churches and a Buddhist temple,) at least three targets included the government (the police, the Presidential Palace, and the Myanmar embassy,) and two targets were purely civilian.

Seventh, the Indonesian government has demonstrated considerable counterterror expertise by keeping these ISIS-related operations to a minimum. The fact that the police were able to detect and foil the more ambitious Bali-like plots is highly significant.

Looking forward, in 2017, ISIS in Indonesia will attempt to increase its operations. It needs to correct its low performance record in order to remain relevant, and there is no indication that its motivational fervor has decreased. In fact, it has increased, and not just in Indonesia, but in Southeast Asia, overall. At the same time, Indonesian society writ large has continually rejected Islamist jihad, a key reason the Muslim majority nation has never fallen to a radical clique.

Regarding tactics, because of their lack of success in 2016, and because of the high-powered explosives cache discovered in November, ISIS-related cells can be expected to increase, or attempt to increase, 1) operational security, 2) bombing expertise, and 3) destructive capacity. Using women as bombers and/or fighters, as attempted twice in December 2016, remains a possibility. A widening of tactics beyond bombings is possible as well. This might include hard hitting and highly destructive Mumbai type raids, and/or a more professional version of the 14 January 2016 Jakarta attack. ISIS’ targeting regimen, wide as it is, will probably continue on its present course.

As an aside, it is entirely possible that, because of the many failings mentioned here, ISIS in Indonesia might abandon its ambitious, urban operations for smaller, rural attacks in order to build up more tactical expertise and increase its ideological following. This would represent a Mao-like “countryside first strategy,” which might allow the organization to mature under less pressure from Indonesia’s security forces.

If the Indonesian government stays with the ISIS attack curve as it has been doing, or if it gets ahead of it – which requires added intelligence operations and increased physical security – then protection from more hard-hitting ISIS operations is possible.

Sources and further reading:

Investigation of C. Java homemade bomb case continues: Police,” Jakarta Post, 30 December 2016.

Christmas terror plot suspects killed by Indonesian police in shoot-out,” ABC, 21 December 2016.

Christmas bomb plot foiled in Indonesia, three killed,” Gulf Times, 21 December 2016.

Indonesia police: 3 suspected militants killed, bombs found,” Fox News, 20 December 2016.

Indonesian police kill three as suspected bomb found near Jakarta,” The Guardian, 20 December 2016.

Police Arrest Three Over Another Suspected Suicide Bomb Plot,” Jakarta Globe, 20 December 2016.

Bali Police on alert after small bomb found in Ubud,” Jakarta Post, 20 December 2016.

Indonesia police arrest three over suspected suicide bomb plot,” Reuters, 20 December 2016.

Indonesian Police Have Found a Backpack Bomb in a Popular Tourist Area of Bali,” Time, 20 December 2016.

Indonesia mob kills man arrested for school stabbing spree,” Yahoo News, 13 December 2016.

Indonesia police say arrest of woman in bomb plot points to new militant tactic,” Reuters, 11 December 2016.

Indonesia: 200,000 protest Christian governor of Jakarta,” CNN, 2 December 2016.

Indonesia police arrest Islamist militant planning attack on Myanmar embassy,” DW, 26 November 2016.

A Terrorist Attack at an Indonesian Church Has Killed a Toddler and Wounded Three Others,” Time, 14 November 2016.

Suspected Islamic State ‘sympathiser’ attacks Indonesian police officers with machete,” ABC, 20 October 2016.

Militant in Jakarta attack dies,” SBS, 20 October 2016.

The 12 October 2002 Bali bombing plot,” BBC, 11 October 2012.

Copyright © Muir Analytics 2017

Posted in Recent Friction Points | Leave a comment

28 November 2016, Bombing attempt on US embassy, Philippines, with Jay Heisler

On 28 November 2016 a bomb in a trash bin was found outside the US Embassy in Manila in the Philippines, reports the New York Times.

The bomb was comprised of an 81mm mortar connected to a mobile phone. An ordnance disposal team safely detonated it. The trash bin was reportedly as just a few meters from the embassy. The bomb was found by cleaning personnel.

This attack followed a failed bombing of a Manila public park, reports Channel News Asia.

As an aside, the explosive device in this case sounds similar, or nearly identical, to a device that did explode in Davao on 2 September 2016. That bombing killed 14 and wounded 68 (either a 60 or an 81mm jerry-rigged mortar round). A group calling itself “Daulat Ul Islamiya,” (the Islamic State,) claimed responsibility for the Davao blast. Muir Analytics covered this attack here.

Following the trash bin bombing attempt, U.S. embassy communications warned Americans in the Philippines to remain aware of your surroundings, including local events, and monitor local news stations for updates.”

The Manila Times reported that national police declared a “Level 3” terror alert for the entire country – although the exact meaning of this designation and related security measures taken were not specified. The police conducted raids on suspected terrorist safe houses and set up checkpoints, ultimately arresting at least four suspects. One of the arrested was an X-ray technician.

The government blamed the bombing attempt on an organization called Ansar al-Khilafa Philippines, which pledged allegiance to the Islamic State in 2014. Ansar al-Khilafa Philippines is an ally of the Maute terror group, yet another Philippines-based organization that has pledged support to ISIS.

The government fought a siege against Maute rebels in Lanao del Sur province that ended on 30 November with a reported 30 injured security forces, and 61 Islamists killed.

As Muir Analytics has previously reported, there are several Islamist groups in the Philippines, the most well known being the Moro Islamic Liberation Front and the Abu Sayyaf Group. Many of them, listed here, have pledged support to ISIS.

Because the embassy attack was a failed bombing attempt where an actual explosive device was deployed and not a foiled attack merely in its planning stages, Muir Analytics considers this episode an attack. Accordingly, this would be, at the very least, the fifth ISIS or ISIS-inspired/affiliated attack in Southeast Asia, so say open sources. The other ISIS related attacks were:*

*There have been several clashes with security forces in the Philippines and Indonesia with groups linked to ISIS, but the attacks listed here are considered “classic” terror attacks. Muir Analytics might adjust this list later to include a wider category of ISIS related operations.

There are five takeaways here. First, the US embassy bomb failed, apparently not because of its construction, but because it was detected, indicating a lack of bombing placement expertise by Ansar al-Khilafa Philippines. A more efficient attack would have gotten the device closer to the embassy and achieved detonation. (The failed park bomb, apparently by the same group, failed for the same reasons.)

Second, the quick arrests of those responsible for the embassy bombing attempt, if the arrests are legitimate, indicates a lack of operational security on behalf of Ansar al-Khilafa Philippines. Either informants snitched on the group, or the bombers were discovered by CCTV or counter surveillance teams, or by some similar action by Philippine law enforcement and related security entities.

Third, despite these technical failings, five ISIS related attacks in Southeast Asia (two of them in the Philippines) in 2016 indicate that ISIS and its affiliates have made real inroads into this region. Unless there is a concerted effort by regional governments to dramatically increase their anti-ISIS activities – including counter narrative operations, regional intelligence sharing, and coalition counter terror operations – ISIS can be expected to expand its foothold and increase attacks.

It is entirely possible ISIS might increase the lethality of its operations as well by duplicating a 2002 Bali style bombing or a Mumbai 2008 type attack. Regional ISIS actors are surely under pressure from “central ISIS” coordinators in the Middle East to better their performance.

Related to point three, a yardstick of the future prowess of ISIS affiliates such as Ansar al-Khilafa won’t just be their capacity for violence, but their ability to maintain territory.

Fourth, and looking ahead, the arrest of an x-ray technician working for a terror group affiliated with ISIS is troubling, especially regarding the potential for radiological or “dirty” bombs.

Fifth, if ISIS affiliates increase their operations, then President Duterte will certainly launch additional campaigns against them. The potential for tit-for-tat terror attacks, increased casualties, and widened counter terror campaigns is probable.

Sources and further reading:

NCRPO presents third suspect in US embassy bomb try,” Philippine Star, 8 December 2016.

Third suspect in US Embassy bomb scare arrested,” Inquirer, 4 December 2016.

Nation under terror alert,” Manila Times, 2 December 2016.

Philippines raises terror alert after foiled Manila bomb plot,” Channel News Asia, 1 December 2016.

Philippines ends five-day siege against rebels pledged to Islamic State,” Reuters, 30 November 2016.

Bomb defused near US Embassy linked to Maute group: officials,” Business World, 29 November 2016.

Manila police safely detonate suspected bomb near US Embassy,” Philippine Star, 28 November 2016.

Security Message for U.S. Citizens: Improvised Explosive Device Disabled near U.S. Embassy,” US Embassy, Philippines, 28 November 2016.

Manila Police Detonate Improvised Bomb Near US Embassy,” New York Times, 27 November 2016.

Mumbai Terror Attacks Fast Facts,” CNN, 24 November 2016.

Terror Grows in Southern Philippines From Militants Linked to Islamic State,” Wall Street Journal, 18 November 2016.

Philippines: IS-linked Maute group inmates freed in ‘raid’,” BBC, 28 August 2016.

Copyright © Muir Analytics 2016

Posted in Recent Friction Points | Leave a comment

8 November 2016, Kurdistan Workers’ Party actions in London might signal wider conflict, by Jay Heisler

On 8 November, a Turkish mosque in London run by the Turkish Government’s Presidency of Religious Affairs was attacked with windows broken and Kurdistan Workers’ Party (PKK) graffiti spray painted on the walls, reports the news outlet Tellmama. The attack was widely reported in English-language Turkish news and Turkish diaspora news, including reports that PKK affiliate groups had publicly promoted their involvement.

The PKK has been fighting for an independent Kurdish homeland on Turkish soil and in neighboring states since the late 1970s and early 1980s. Unlike many Cold War-era rebel groups, the movement has seen significant violence and even an escalation in conflict since the Cold War ended.

The Turkish government and its ethnically Turkic majority-population have seen rising tension with its Kurdish minority population as of late. This tension has spilled over into the international stage as well. Pro-Turkish and pro-Kurdish camps recently became more openly hostile to each other during protests against the mass arrests of Kurdish political figures in Turkey following the failed coup in July this year and aerial bombings of Kurdish targets in Syria and Iraq. In one case, a crowd or Kurdish protesters in London attacked a Turkish couple that was filming them. Bombings and other attacks blamed on PKK and other Kurdish groups are now part of life in Turkey, particularly for the security forces.

Turkish sources interpret the London mosque vandalism as part of a wave of attacks against Turkish targets across Europe. Other alleged attacks by PKK or sympathetic forces include an attack against the Turkish consulate in Paris with Molotov cocktails, and vandalism of the Yunus Emre Center in the UK. The Yunus Emre Center is part of a broader effort to expand Turkish soft power, cultural identity, and influence on the global stage.

The Kurdish struggle for an independent homeland has long drawn in militias from Kurds in Turkey, Syria, Iraq and Iran. Kurdish separatist movements have drawn support from scores of geopolitical actors, including the US, Israel and Russia.

Northern Iraq has seen significant gains in the autonomy of Kurdish-held territory since the US invasion under former US President George W. Bush in 2003.

There are five takeaways here. First, the graffiti on the walls of the mosque indicates a Kurdish escalation of information operations against the Turkish diaspora abroad.

Second, a propaganda war of words could erupt over which party, Kurd or Turk, is persecuted and which is the aggressor. It remains possible that these attacks were staged by the Turkish government, which is frequently distrusted (along with pro-government media) by the Turkish population. However, the same population would be quick to point out that there is nothing trumped-up or manufactured about PKK attacks against Turkish targets.

Third, while Kurdish forces have become media darlings in the West due to their fighting the Islamic State, more attacks on Turkish mosques and people in Europe (and/or other regions) could tarnish the image of the Kurds.

Fourth, if this current tension between the Turks and Kurds escalates, a spillover of Middle East political violence into European cities is possible.

Fifth, looking further down the road, a serious escalation between Turks and Kurds in Europe (and/or other regions) could result in Turkish security forces enhancing their overseas operations. This might mean increased force application and expanded geographic reach. The Turkish film industry has already produced an infamous anti-American propaganda film promoting Turkish special forces acting abroad, and a fiercely nationalist culture could sanction such activities, thereby reducing domestic pressure on the government for expanding its international footprint.

Sources and further reading:

PKK accepted mosque attack in London,” ILKHA, 10 November 2016.

A timeline of PKK attacks on Turkish citizens in Europe,” Turkey Islamic Justice and Development, 10 November 2016.

PKK sympathizers attack Turkish mosque in London,” BBC, 9 November 2016.

Turkish mosque vandalised with PKK graffiti in London,” Tellmama, 8 November 2016.

Turkish consulate in France attacked with Molotov cocktail,” Daily Sabah, 7 November 2016.

Who are Kurdistan Workers’ Party (PKK) rebels?,” BBC, 4 November 2016.

PKK claims attack on Turkish ruling party official,” Washington Post, 11 October 2016.

Ten Turkish troops killed in two separate ‘PKK attacks’,” Al Jazeera, 26 September 2016.

Turkish Business in the Kurdistan Region of Iraq,” Turkish Policy Quarterly, 7 March 2016.

America the Brutiful,” Foreign Policy, 15 August 2011.

Copyright © Muir Analytics 2016

Posted in Recent Friction Points | Leave a comment

16 November 2016, In-depth analysis of Rohingya insurgency in Myanmar by Michelle Dozier

The Global New Light of Myanmar, a Myanmar government newspaper, reported that on 9 October between 1:00 am – 5:45 am, an estimated 90 insurgents killed nine border guard police officers during coordinated raids on three sites* in Rakhine State (formerly Arakan State):
*Media sources have given several versions of the exact strike points; these come from The Global New Light of Myanmar

1) the Border Guard Police headquarters Kyiganbyin (also written as Kyikan Pyin) village, Maungdaw Township

2) a police post in Kyeedangauk (also written as Kotankauk) village, Rathidaung (also written as Buthidaung) Township

3) and another police post in Ngakhuya (also written as Nagpura,) Maungdaw Township

Eight assailants were killed, and two were captured. The attackers left behind one homemade pistol, two rounds of ammunition, and one magazine. They stole 48 weapons of various types, 6,624 rounds of ammunition, 47 bayonets, and 164 magazines. Rohingya caretakers working at the Border Guard Police headquarters who knew where the weapons were stored have since disappeared.

The culprits were initially reported as the Rohingya Solidarity Organization (RSO,) an insurgent group presumed defunct and/or dormant in recent years. The government later referred to them as the Aqa Mul Mujahidin organization (Faith Movement of Arakan, FMA,) a never before heard of group currently being linked to the RSO.

Rakhine State, which borders Bangladesh, is an impoverished region. It is also where sectarian conflicts between Buddhist Arakanese and Muslim Rohingyas have simmered since clashes in 2012 led to 100 deaths and thousands of internally displaced persons now in refugee camps. Rohingyas are the predominant ethnic group in the townships of Rakhine where the attacks took place, but they are considered non-citizens by the government. The United Nations says they are one of the world’s most persecuted minority groups.

According to the AFP, after the attacks, the Myanmar government closed the border with Bangladesh. It also deployed naval forces to shut down adjacent waterways, and it ferried infantry forces to the affected area by helicopter. Around 180 civilians, mostly Buddhist Arakanese and NGO workers, were evacuated for their safety. Businesses were closed, and an existing curfew was extended.

Following these initial stability operations, on 10 October, Tatmadaw (the Myanmar army,) and local police forces began a counteroffensive to clear the area of insurgents, estimated to number 240. Security forces encountered resistance from villagers armed with guns, knives, and sticks. Between four and seven locals were killed during security sweeps, although it is unclear how many were insurgents or innocent bystanders.

On 11 October, in Pyaungpit village in Maungdaw Township, a purported 300-strong Rohingya force ambushed a Tatmadaw patrol, killing five.

Additional Tatmadaw operations resulted in scores of suspects apprehended and many more dead. Anadolu Agency reported that Muslim organizations in Myanmar have condemned the violence.

Aung San Suu Kyi, State Counselor of Myanmar (the country’s national leader,) has urged caution and patience as the military conducted its investigations and security sweeps, and she requested the cooperation of Bangladesh, Pakistan, and Saudi Arabia in sharing intelligence on the threat.

In total, at least 40 people have died in these clashes, including nine police, five Tatmadaw soldiers, and 26 suspected insurgents.

The Myawady Daily reported that, in the course of their sweeps, government forces discovered 24 RSO flags, 40 RSO badges, a burnt MA-11 assault rifle (a Myanmar-produced copy of an HK-33,) and 1,510 rounds of ammunition.

The RSO emerged in 1982 to fight for Rohingya interests after Tatmadaw offensives in Rakhine State led to a refugee crisis. It fought into the 1990s but declined in 2001 after the Bangladesh military targeted its training camps on the Bangladesh side of the border. Despite many believing the RSO to be largely defunct since then, the RSO was suspected of being behind an attack on Bangladeshi police forces guarding a Rohingya refugee camp in Teknaf Upazila of Cox’s Bazar on 13 May 2016. RSO responsibility was never confirmed, however.

It should be noted that mujahidin violence in Arakan state erupted in 1948 and led to a rebellion that did not surrender until 1961. Accordingly, friction between Muslim communities and the Myanmar government are not new. (Friction with other ethnic groups and the government are not new, either. As many as 20 rebel groups in Myanmar have been active since the end of WW II.)

The Myanmar President’s office issued a report on the October attacks shortly after interrogating four captured insurgents. The report claims the FMA planned the attacks. Their leader is a 45-year-old Rohingya man simply named “Havistoohar” of Kyaukpyinseik village in Maungdaw Township. He is said to have attended a six-month military training course run by the Pakistani Taliban.

To launch his movement, Havistoohar posed as a refugee in Teknaf, Bangladesh, where he began seeking sources of funding from the Middle East. He worked with a Pakistani citizen named Kalis and 15 others to organize a group of fighters and collect supplies and food. Kalis, who also attended a terrorist training camp in Pakistan, came to Maungdaw to train local youths recruited by Havistoohar in weapons tactics.

Their mission, planned by Havistoohar, was simple: assault three security posts, kill the defenders, and steal their firearms. (Their original plan was for 400 fighters to attack six locations manned by Tatmadaw and local police.) Their end goal was to take over two Muslim-majority townships, Buthitaung and Maungdaw, and then spread radical Islamist propaganda through video and social networks to expand the movement.

Several videos were found online after the attacks showing men speaking the Rohingya’s Chittagong dialect of Bengali and carrying weapons similar to those stolen during the raids. One video shows a stocky, mustached, middle-aged man dressed in a black t-shirt and surrounded by young armed men in ordinary clothes. Police have identified the man as Havistoohar. Using the single-finger salute often used by other jihadists, ISIS in particular, he calls on the Rohingya Muslims in Rakhine to join the mujahidin in a holy war against the government – this according to a translation by Reuters. In a second video, he references the military’s helicopters searching for the insurgents and encourages the men surrounding him to accept martyrdom. A third video shows Havistoohar marching along a muddy path leading a long column of what appears to be hundreds of mostly young men and boys, virtually all barefoot, with swords, sticks, firearms.

Throughout Myanmar, there is a deep-seated disregard for the Rohingya, who are still considered Bengalis and denied Myanmar citizenship, despite most having lived in Myanmar for generations. They suffered the worst of the anti-Muslim riots stoked by radical Buddhist nationalists after Myanmar began democratic reforms in 2011. Their plight was widely condemned by international human rights groups and the Organisation of Islamic Cooperation. The violence also prompted a call for action by international jihadist groups, including ISIS and the Pakistani Taliban.

In an October 2014 report, the International Crisis Group suggested that the 2012 Buddhist-Rohingya communal conflict may have led to an attempt to revive the defunct RSO, and it warned that continued discrimination of the Rohingyas risked pushing some of them into violent extremism. It appears this has happened.

There are seven takeaways here. First, it is clear that an ISIS-inspired, radical Islamist insurgency has taken root in Myanmar’s Rakhine State. This was pointedly demonstrated by the attackers’ high level of organization, their military training, the effectiveness of their attacks, their PR videos, and their stated goals. The FMA’s methods of funding, recruitment, and training with foreign fighters are consistent with Islamists and ISIS affiliates elsewhere around the world. Additionally, the stockpiling of food and supplies, and the coordinated raids for weapons is consistent with insurgencies in their start-up phases.

Second, the size of the insurgency is unclear, but it appears large enough to pose a credible threat. Early reports stated only 90 fighters participated in the 9 October raids, but subsequent military sweeps aimed to round up 240 suspects. The 11 October ambush of Tatmadaw forces reportedly involved 300 fighters, and the original goal of the uprising aimed to mobilize 400 insurgents. An elderly resident told AFP that 500-600 were involved in the October attacks. In military terms, these larger numbers represent a battalion-sized force of fighters. Insurgent support forces (auxiliary forces) might number at least three times that as is consistent with insurgent methods of development.

Third, while an undisclosed number of foreigners have been identified in training and assisting the FMA, the group appears to mostly consist of Rohingyas. The movement then might appeal to locals since it does not appear to be a mostly Pakistani-driven one.

Fourth, looking forward, the presence of an ISIS-affiliated insurgency risks stoking already heightened anti-Muslim fears among Myanmar’s majority Buddhist population. This could lead to more Buddhist-Muslim communal violence.

Fifth, Rohingya advocacy groups are concerned that the government might use the cover of battling Islamist insurgents to further persecute the Rohingyas and perpetuate the same vicious cycle of retaliatory violence that has plagued the region in the past.

Sixth, the October violence is likely to derail a nine-member advisory commission designed to tackle the Rohingya issue. Established in August 2016 by State Counselor Suu Kyi and headed by former UN secretary general Kofi Annan, the commission has been heavily criticized by Buddhist nationalists.

Seventh, while Tatmadaw appears to be exercising some restraint in its operations against other rebellious groups elsewhere in the country, it is unlikely to do so with the FMA, especially given the country’s current anti-Muslim/Rohingya sentiment. And while government heavy suppression may be successful in reducing further attacks in the near term, if it leads to excessive civilian casualties, this new Rohingya rebellion will likely grow in the intermediate term. If negative conditions persist for a longer period of time, global Islamist jihadist support for the FMA will likely increase.

Sources and further reading:

Myanmar: The Politics of Rakhine State,” International Crisis Group, 22 October 2014.

All Unquiet on the Western Front,” The Irrawaddy, 20 October 2016.

Myanmar Muslims condemn fatal attacks in Rakhine,” Anadolu Agency, 15 October 2016.

Myanmar gov’t still to name group behind Rakhine attack,” The Myawady Daily/Anadolu Agency, 14 October 2016.

Taliban-trained militants carried out Myanmar border raids: presidency,” AFP, 14 October 2016.

Nine policemen killed, five injured, one missing in border attacks,” The New Light of Myanmar, 10 October 2016.

Myanmar sends troops into Muslim-majority region after deadly attacks,” Reuters, 10 October 2016.

Rakhine border raids kill nine police officers,” AFP, 10 October 2016.

Govt justifies international involvement in Arakan issue,” The Irrawaddy, 29 August 2016.

The Rohingya and Islamic extremism: a convenient myth,” The Diplomat, 29 June 2015.

Attack on border fuels growing concern,” Myanmar Times, 26 May 2014.

Copyright © Muir Analytics 2016

Posted in Recent Friction Points | Leave a comment

4 November 2016, Terror group specializing in hotel attacks joins ISIS

*Note: because of the criticality of this subject material, it is presented both here and on Muir Analytics’ SecureHotel.US website.

On 30 October, a group called al-Murabitun (The Sentinels,) which is a faction of al-Qaeda in the Islamic Maghreb (AQIM,) pledged support to ISIS, according to PJ Media and ISISliveuamap.com. A statement by the group, lead by Abul-Walid al-Sahrawi, simply read: “The Murabitun Brigade under leadership of Abul-Walid al-Sahrawi in northern Mali pledges allegiance to Shaykh Abu Bakr al-Baghdadi and joins the Islamic State.”

Al-Sahrawi, an Algerian, had pledged his individual support to ISIS in 2015, but reportedly few, if any, AQIM fighters followed. This caused some confusion in intelligence circles regarding the march of ISIS in North Africa. Now, however, the issue is clear.

The better-known senior leader of the Murabitun Brigade, Mokhtar Belmokhtar, appears to be remaining with AQIM at the moment.

Belmokhtar previously lead an organization going by several names, including the Masked Brigade and Those Who Sign in Blood. They are most famous for the spectacular January 2013 attack against the BP gas plant in In Amenas, Algeria. Belmokhtar’s group eventually merged with as-Sahrawi’s, which was called the Movement for Oneness and Jihad in West Africa. This then gave birth to the Murabitun Brigade in 2013.

In recent years, the Murabitun Brigade has staged scores of attacks in North and West Africa, including against hotels. In fact, the Murabitun Brigade has specialized in hotel attacks, several of which Muir Analytics has covered. They include the following:

There are four main takeaways here. First, it is not uncommon for Islamist jihadist terror groups, while bonded by strategic end goals, to splinter because of leadership and intricate philosophical-religious issues. Belmokhtar himself has both embraced and shunned al-Qaeda while fighting for its regional and global end goals: total submission to a version of Islam rooted in the extremist ideologies of Sayyid Qutb and Ayman Zawahiri. It should be noted that the ideological motivation of al-Sahrawi and his group also follow this ideology.

Second, the operational capabilities of both al-Sahrawi’s and Belmokhtar’s groups should not be considered diminished because of this split. They should be considered just as dangerous as before. This is because these men still control groups of highly motivated light infantry fighters that have a proven track record of attacking soft targets with aggressive military force – violence of action, to be specific. More to the point, they have a pronounced will to kill civilians, and they have an arsenal of weaponry, including AK-47s, RPK and PK machine guns, grenades, arson kits, and the like. This is all it takes to continue their established pattern of attacking hotels and other soft targets.

Third, one or both of these groups, because of this split, are now more likely to launch attacks to prove themselves. Belmokhtar did this exact thing to differentiate himself from AQIM through the In Amenas gas plant attack. He wanted to remain relevant, and he wanted to demonstrate his vicious reputation, so he planned and executed one of the most ambitious and audacious terror attacks in the post 9-11 period. There is no indication that Belmokhtar’s attitude has changed. Similarly, al-Sahrawi is probably under pressure from ISIS to perform and deliver a debut operation. From a broader view, the global rivalry between al-Qaeda and ISIS will exacerbate the potential for violence from these two organizations.

Finally, all these issues combined indicate more terrorist violence could occur in the near and/or intermediate term in North and West Africa. Local governments and their Western allies might reduce this threat if they strike these groups now during the temporary lull in their operational tempo created by this split. Otherwise, civilian targets, including hotels, should be considered high on each organization’s target list. Together, Belmokhtar and al-Sharawi have killed at least 53 and wounded 119 through their 2015-2016 hotel attacks. And they’ve done millions of dollars in damages as well. At this juncture, dramatically increased hotel security throughout the region is necessary to deter such attacks and save lies.

Sources and further reading:

Terrorists Behind String of Hotel Attacks Pledge Allegiance to ISIS,” PJMedia.com, 31 October 2016.

The Islamic state confirms the Murabitin Brigade lead by Abul-Walid as-Sahrawi in northern Mali has pledged allegiance to ISIS,” ISISliveumap.com, 30 October 2016.

Ivory Coast: 16 dead in Grand Bassam beach resort attack,” BBC, 14 March 2016.

Profile: Mokhtar Belmokhtar,” BBC, 15 June 2015.

Fears for 7 American hostages as Algerians confirm helicopter attack on besieged BP gas plant killed 30 captives and only 11 militants,” Daily Mail, 18 January 2013.

Tag Archives: Movement for Oneness and Jihad in West Africa,” The Long War Journal.

Al Qaeda in the Lands of the Islamic Maghreb (AQRM,)” Counterterrorism Guide, National Counterterrorism Center, US Government.

Copyright © Muir Analytics 2016

Posted in Recent Friction Points | Leave a comment

19 September 2016, ISIS-motivated bomber hits in NYC, New Jersey, stabbing in Minnesota claimed by ISIS

Attack 1

Reuters reports that at 9:30 am on 17 September an explosive device detonated in Seaside Park, New Jersey. The device was hidden in a trashcan near the starting line of a Marine Corp charity race along the beach boardwalk, says CNN and Heavy. The location of the seat of the blast is reportedly D Street and Ocean Avenue.

The bomb consisted of three pipe bombs connected to a cell phone timer, specifically a flip phone. Only one of the bombs exploded.

The detonation injured no one, but town officials called a halt to the race that was happening in the area, the Seaside Semper Five.

Attack 2

The Guardian reports that on 17 September at 8:30 pm in Chelsea, NYC, a bomb exploded in, or next to, a dumpster, injuring 29. The New York City Police Department has stated that the seat of the blast was in front of 131 West 23d Street. (Other reports say 133 W. 23d Street.)

Photos of the blast site show a severely mangled dumpster and a debris field (roughly 100 feet X 100 feet) that encompasses the sidewalk and street. TV news on 18 September said that the dumpster was thrown more than 100 feet from the seat of the blast.

At 11:00 pm, the NYPD located another bomb on 27th Street between 6th and 7th Avenues. Present reporting says that this device was contained in a pressure cooker and had ball bearings inside to use as shrapnel. It was connected to a cell phone timer, specifically a flip phone.

Some reporting says that Christmas tree lights were used as igniters for some or all of the bombs, but this is unconfirmed from official sources. It should be noted that the San Bernardino attackers (2015) used Christmas tree lights as igniters for their bombs.

A 9-11 call to police said there would be more attacks in the future. Investigators assert that the same bomb builder is linked to both attacks.

Additional bombs found

Confirmed reports say that two homeless people found a backpack or duffel with bombs in it at the Elizabeth, NJ, train station. The two removed the bombs from the platform, and police soon after destroyed them.

Attack 3

At 8:00 pm on 17 September, a man named Dahir Adan, wearing a private security company uniform, went on a stabbing frenzy in Crossroads Mall, St. Cloud Minnesota. Adan’s attack injured nine: two females and seven males, reports the Daily Mail. The youngest victim was a 15-year old girl. Adan reportedly asked at least one victim if they were Muslim before he attacked, and he was heard referencing Islam in the midst of his frenzy. An off duty police officer, Jason Falconer, shot Adan dead.

ISIS released a statement claiming responsibility for the stabbings: “The executor of the stabbing attacks in Minnesota yesterday was a soldier of the Islamic State and carried out the operation in response to calls to target the citizens of countries belonging to the crusader coalition.”

Bomb investigation

The bombing investigation unfolded unusually quickly. Authorities began looking for their NYC/NJ primary suspect, Ahmad Khan Rahami, 28, on 18 September. Phone number and fingerprint evidence linked him to the bombs, say reports.

For the first time in U.S. history, authorities put out an electronic wanted poster over the nation’s Wireless Emergency Alerts looking for Rahami, mostly in the NJ and NYC area.

On the run, Rahami finally clashed with police in Linden, New Jersey, where he was wounded and taken in to custody. Investigators found a journal he left behind citing Islamist jihadist reasoning for the bombings. Some quotes from the journal include:

  • “You (USA government) continue your … slaught against … mujahideen be it Afhanistan, Iraq, Sham, Palestine… etc,”
  • “Brother Osama bin Laden offered you a truce…”
  • “I looked for guidence [sic] and Alhumdulilah Guidance came. Sheikh Anwar Brother Adnani Dawla [ISIS spokesperson]. Said it clearly attack the kuffar in their backyard.”
  • “Anwar al Awlaki has spoken the truth. ‘Join us in our new front’ IE Yemen.”
  • “Inshallah the sounds of the bombs will be heard in the streets. Gun shots to your police. Death to your Oppression.”
  • “pipe bombs, pressure cooker bombs on … in the streets they plan to run a mile.”
  • “In my heart I pray to the beautiful wise Allah. To not take jihad away from. I begged for shahadat [martyrdom] & Inshallah this call will be answered.”

Reports on 19 September say the NYC bombs used Tannerite explosives, a common and legal target-marking explosive used by shooting enthusiasts. Since Tannerite is difficult to set off – it requires a bullet moving 2,000 feet per second to make it explode – it could be that there was another compound in the bombs used to initiate the blasts. Additionally, Tannerite begins to degrade 45 minutes after it has been mixed and poured into a container, so it is a curious choice to use as a main compound for a bomb. This could be why the second device in NYC did not explode.

Black powder was detected in the New Jersey bombings.

At present, there are five takeaways here.

First, these bombings and the stabbings – three attacks all within a 12 hour time period – offer yet more proof that the United States is being plagued by an active irregular warfare threat, just like France, the United Kingdom, Turkey, Bangladesh, and other such places. This is par for the course after attacks such as San Bernardino, Orlando, Chattanooga, and Garland, Texas, just to name four. The U.S. is on a war footing whether the country realizes it or not.

Second, U.S. law enforcement rapidly secured the bombing case, demonstrating that the federal-local law enforcement counter terrorism mechanism can be highly effective. It did not prevent these bombings from happening, however.

Third, while the bombings were certainly dangerous, the sloppiness involved indicates a semi-professional (or less than that) terrorist cell or individual, probably home grown with limited training. One sloppiness element here directly refers to the poor bomb detonation ratio (five bombs deployed – one device was a bundle of three – and only two exploded.) More sloppiness was demonstrated by the alleged perpetrator not covering his tracks regarding fingerprints and cell phone numbers. (It is unclear if the several bombs [reportedly one bundle of five] found at the Elizabeth, NJ, train station were purposefully deployed or dumped by an operative who decided not to carry out his/her mission. If deployed, that would make the detonation ratio six bombs deployed with only two exploding.) Overall, a more professional team with a higher level of training and experience most likely would have carried out more successful bombing missions.

Fourth, evidence suggests that the culprits in both the stabbings and bombings were Islamist jihadist motivated. Here’s why:

  • ISIS took responsibility for the stabbings.
  • Dahir Adan asked at least one victim if they were Muslim before his attack, a common Islamist jihadist terror tactic seen in operations such as the Westgate mall attack in Kenya in 2013.
  • Ahmad Khan Rahami’s journal entries clearly link his fight with Islamist jihadist propagandists from both al Qaeda and ISIS. Additionally, his family and friends say Rahami seems to have been radicalized in Afghanistan and Pakistan.
  • Pressure cooker bombs have been used by Islamist jihadist before in cases such as the 2013 Boston Marathon Bombing and the 2006 Mumbai train bombings. The Inspire magazine connection, al Qaeda’s terrorism-promoting magazine, is clear as well. A previous issue told readers how to make these bombs.
  • The Marine Corps race suggests anti-U.S. military and anti-civilian targeting combined. This bolsters the Islamist jihad hypothesis angle, and so does just generally targeting New York City.
  • ISIS has called for attacks in the U.S. for several moths now. One of the most recent was published on 6 September 2016. It called on supporters to attack people on the streets, or commuters, or flower vendors, or any other manner of civilians, etc. Another ISIS threat was issued on 8 September calling on supporters to attack sports venues. This follows the exact same call to action (and then attacks) that have been happening in France, Germany, Belgium, Turkey, Saudi Arabia, and Bangladesh.

Ultimately, more attacks like these can be expected in the United States. It is likely that other terrorist individuals and/or groups will learn from the lessons of the mall stabbings and the NYC/NJ bombings. They are likely to increase operational security and plan for more destructive attacks.

Mumbai 2008 and Paris 2015 style attacks and/or simple to sophisticated bombing attacks should be expected by U.S. law enforcement and government security entities. Islamist jihadist-motivated stabbings like the one in St. Cloud have happened in New York City already, they are not uncommon in France, and they are commonplace in Israel. Attacks should be anticipated not only in the obvious metro areas such as Washington, DC, and New York City, but also in smaller towns such as Elizabeth, NJ. Attacking both metro and rural targets is a common Islamist jihadist tactic – specifically an ISIS tactic – that has been made readily apparent in France. It is now evolving in the US.

Sources and further reading:

New York bomb contained residue of Tannerite,” Israel National News, 19 September 2016.

The hero cop who shot dead rampaging Minnesota mall knifeman who stabbed nine after asking if they were Muslim and talking about Allah,” Daily Mail, 18 September 2016.

ISIS wing claims responsibility for Minnesota mall attack,” CNN, 18 September 2016.

Big blast, 29 injuries in NYC; pressure cooker device removed nearby,” USA Today, 18 September 2016.

At least 29 injured as explosion rocks New York street,” ITV, 18 September 2016.

Bomb explodes near Marine Corps race in New Jersey,” CNN, 17 September 2016.

Seaside Park Explosion Photos: Pictures from the Scene,” Heavy, 17 September 2016.

Device Explodes at Marine Race on Jersey Shore: Police,” NBC 4, 17 September 2016.

Copyright © Muir Analytics 2016

Posted in Recent Friction Points | Leave a comment