NCC – Sunni Extremist Attacks in the USA before 9/11

(U//FOUO) NCTC (National Counterterrorism) assesses that the Sunni extremist threat to the US before 9/11 was characterized by diverse extremist organizations and lone actors motivated by multiple ideological narratives and other factors, including Salafi jihadism, Palestinian nationalism, theological disputes within Islam, anti-Semitism, and anti-Hindu sentiments. We have identified a dozen successful attacks, four disrupted plots, and one attempt to set up an extremist training camp in the US between 1973 and 2001, underscoring the persistent threat from al-Qa‘ida–associated extremists, Palestinian terrorist groups, and Sunni extremist lone actors in the decades leading up to 9/11.



These extremists chose a wide array of targets, with the majority of their attacks before 1993 focused on Hindu, Jewish, or Muslim individuals or institutions. Most attacks after that date were against civilian or US Government targets, because of al-Qa‘ida–associated extremists’ focus on indiscriminate mass casualty attacks. In some cases, we lack clear insight into the attackers’ motivations because of information gaps, and FBI disagrees about the motivations underlying two of these attacks.



Radicalization to Terrorism in the USA

Executive Summary

Since its founding in 2012, the National Institute of Justice’s Domestic Radicalization to Terrorism program has sponsored research on how radicalization to terrorism occurs in the United States in order to support prevention and intervention efforts. These projects have taken a variety of approaches to examining the process of radicalization to terrorism, but in spite of this there is substantial overlap in their findings, which collectively provide evidence of the importance of several facilitators of radicalization and the need to take into account how this process unfolds within individuals over time.

Facilitators of Radicalization to Terrorism
Terrorist belief systems or narratives
Identity processes
Activities that demonstrate commitment to a terrorist group or cause
Connections with terrorists in one’s offline social network
Connections with terrorists via the internet and/or social media
Group dynamics
Triggering events

At the individual level, the radicalization process often involves embracing a terrorist belief system or narrative that identifies particular others or groups as “enemies” and justifies engaging in violence against them. Individuals may also begin to identify themselves as terrorists, as well as to engage in activities that highlight their commitments to their new beliefs, identities, and/or others who hold them. It is, however, important to note that while these beliefs and behaviors may facilitate the movement to terrorism, this outcome is not inevitable. Those close to these individuals may become aware of the changes that their friends and family members are undergoing and attempt to address them or seek help from others who can. An important implication of this is that trusted information and resources need to be available to assist in this effort. Another is that prevention and intervention efforts may benefit from addressing beliefs that justify violence and helping individuals to develop identities in which these beliefs are not central.

Testing Two Theoretical Perspectives on Radicalization to Terrorism

In their completed NIJ-sponsored research, a team led by the University of Arkansas tested whether role identity theory and framing theory help to explain how individuals and groups radicalize to terrorism (Smith et al., 2016). In doing so, the researchers built on previous research conducted using the American Terrorism Study (ATS) database (e.g., Smith & Damphousse, 2009; Smith, Damphousse, & Roberts, 2006; Smith, Roberts, & Damphousse, 2013) and focused not on testing a complete model of the radicalization process but rather on testing what they viewed to be a crucial component of it: the construction of a terrorist identity. This process is outlined in Figure 2 on page 11.

Several concepts displayed in the figure are central to understanding the analyses the team conducted. The first two are identity salience and identity pervasiveness — both of which are based on the premise that everyone has multiple identities (e.g., as a parent, teacher, musician). If an identity is salient, it is more likely to be brought to bear in a particular situation. If an identity is pervasive, it is more likely to be brought to bear in numerous situations. The researchers hypothesized that individuals with more salient and pervasive terrorist identities would be more likely to engage in terrorism.

Christchurch May Inspire Other Terrorists – DHS-FBI

Christchurch May Inspire Other Terrorists – DHS-FBI

This Joint Intelligence Bulletin (JIB) is intended to provide information on Australian national and violent extremist Brenton Tarrant’s 15 March 2019 attacks on two mosques in Christchurch, New Zealand. These attacks underscore the enduring nature of violent threats posed to faith-based communities. FBI, DHS, and NCTC advise federal, state, local, tribal, and territorial government counterterrorism and law enforcement officials and private sector security partners responsible for securing faith-based communities in the Homeland to remain vigilant in light of the enduring threat to faith-based communities posed by domestic extremists (DEs), as well as by homegrown violent extremists (HVEs) who may seek retaliation. This JIB is provided to assist federal, state, local, tribal, and territorial counterterrorism and law enforcement officials and private sector security partners to effectively deter, prevent, preempt, or respond to incidents and terrorist attacks in the United States.

(U) Attack Details

(U//FOUO) On 15 March 2019, New Zealand police arrested an Australian national who appeared to be inspired by a white supremacist ideology and who allegedly conducted a shooting attack on two mosques in Christchurch, New Zealand. This attack highlights the enduring threat of violence posed to faith-based communities. There are currently 49 victims deceased, and 20 others are listed as being in critical condition following the attack.

» (U//FOUO) On 15 March 2019, at about 1:40 PM local time, Australian national Brenton Tarrant used firearms to attack the Masjid Al Noor Mosque in the city of Christchurch, New Zealand, before conducting a similar shooting attack at the Linwood Masjid Mosque, approximately four miles away. Tarrant drove to the attack sites and livestreamed a video of the attack. Police also discovered improvised explosive devices in a vehicle connected with the attack. Tarrant is currently the only known perpetrator; however, investigation of his movements and associates continues.

» (U//FOUO) Tarrant disseminated a manifesto prior to the shooting which detailed his concerns of perceived “white genocide.” The manifesto contains a wide range of anti-immigrant and anti-Muslim views. One reason listed as to why he carried out the attack was “to create conflict…within the United States on the ownership of firearms in order to further the social, cultural, political, and racial divide within the United states [sic].”

» (U//FOUO) Tarrant claimed to have been planning the attack for two years and recently relocated to New Zealand to live temporarily while he “planned and trained.” He claimed to have chosen to conduct his attack in Christchurch three months prior to show such attacks could happen anywhere.

(U) Mosque Attacks Could Incite Like-Minded and Retaliatory Attacks

(U//FOUO) We are concerned online sharing of Tarrant’s livestreamed footage could amplify viewer reaction to the violent attack and possibly incite similar attacks by those adhering to violent extremist ideologies in the United States and abroad, as well as retaliatory attacks from HVEs and individuals otherwise affiliated with foreign terrorist organizations. Tarrant appeared to have been influenced by prior attacks by violent extremists in the United States and other countries, and we remain concerned that US-based DEs of similar ideologies could become inspired by this attack. Although most HVEs generally do not mobilize to violence in response to specific events and instead are usually influenced by a confluence of sociopolitical, ideological, and personal factors, exceptions may occur and we remain concerned for the potential of retaliatory attacks by some HVEs, as we have already seen calls for attacks by violent extremists online.

» (U//FOUO) Tarrant claimed Norwegian mass attacker Anders Brevik gave his “blessing” for the attack. Tarrant’s ammunition cases also displayed handwritten names of violent extremists in Canada and elsewhere who previously conducted violent attacks on Muslims or in support of violent extremist ideologies.

» (U//FOUO) An examination of online jihadist media following the mosque attacks indicates various al-Qa‘ida and ISIS supporters are posting attack images to express outrage and are calling upon all Muslims to respond to the New Zealand attacks by launching their own near-term attacks in retaliation.

Ambulances used as Bombs in Afghanistan

Image result for afghanistan war ambulance cars bombs
(U//FOUO) On January 27, 2019 at approximately 12:15pm local time, a vehicle resembling an ambulance and laden with explosives detonated after it passed through a police checkpoint in Kabul, Afghanistan. The explosion killed more than 100 people and wounded approximately 235 others. According to the deputy spokesperson for the Afghanistan Interior Ministry, the vehicle was painted to resemble an ambulance and had successfully passed through a checkpoint after the attacker allegedly told police he was transporting a patient to a nearby hospital. While stopped at a second checkpoint farther inside the city limits, the attacker detonated the explosives concealed in the vehicle. The explosion occurred in an area known as Chicken Street, which includes a prominent shopping zone and is in close proximity to foreign embassies and government buildings. A Taliban spokesman released a statement claiming responsibility and alleged the attack was in retaliation to an increased presence of U.S. troops and an increase in airstrikes throughout Afghanistan.

(U//FOUO) Individuals may consider using a variety of official vehicles or altering vehicles to look like official vehicles to further their terrorist objectives. The use of ambulances, law enforcement vehicles, fire vehicles, or other government vehicles could enable attackers to enter into secure areas to access sensitive sites or carry attackers, weapons, and/or explosives to an intended target location. Individuals may clone first responder vehicles by modifying unofficial vehicles with paint and decals to make them appear to be official; steal vehicles from residences, vulnerable vehicle lots, or while first responders are at a scene; or purchase retired, official vehicles and potentially re-equip them with equipment that was removed prior to sale to make them appear more legitimate. Incidents involving stealing or cloning first responder vehicles in the United States have often been associated with criminal activity, but individuals in the United States could also gain insight from international attacks to attempt similar tactical use of emergency response and government vehicles in terrorist attacks in the United States.

(U//FOUO) First responders should follow agency protocols for responding to suspicious incidents and safeguarding equipment and vehicles. The following non-exhaustive list identifies potential indicators of misuse or misrepresentation of first responder vehicles.

(U//FOUO) Drivers of government vehicles who are not knowledgeable or who become increasingly nervous when questioned about the organization represented on the vehicle they are driving
(U//FOUO) Incorrect vehicle decals, verbiage, colors, word font, and size
(U//FOUO) Visible identifiers, such as phone number or license plates, that are inconsistent with the vehicle’s operating area or mission are very suspicous.
(U//FOUO) Heavily loaded vehicles, possibly beyond capacity must be considered as dangerous.


Counterterrorism Weekly – A New Media Presented

Image result for counterterrorism center

(U//FOUO) NCTC Counterterrorism Weekly Open Source Digest December 2018
December 24, 2018

Counterterrorism Weekly 6-18 December 2018
Page Count: 18 pages
Date: December 12, 2018
Restriction: For Official Use Only
Originating Organization: National Counterterrorism Center
File Type: pdf
File Size: 1,684,886 bytes
File Hash (SHA-256): 5DB3EF6875E67FA136A736986BC4F476BD2DA0DBCDC4DD30A0DB7241449EC7B1

Download File

(U) Terrorist Profile: Former Jordanian ISIS Official Sa’d Al-Hunayti

(U) Jordanian national Sa’d al-Hunayti was a leading member of the Jihadist Salafi movement in Jordan before he traveled to Syria and joined Nusrah Front then ISIS. Hunayti was ultimately arrested by Hayat Tahrir al-Sham (HTS) for reportedly being a leader in ISIS-run secret cells in Idlib Province, Syria, that planted IEDs and conducted kidnappings and assassinations in northwest Syria.

Related image


(U) During the 1980s, Hunayti studied history at Yarmouk University in north Jordan and was suspended twice for “his political positions.” During this period, he was influenced by Sayyid Qutb’s idea of “governance,” according to Dr. Muhammad Abu-Rumman, a Jordanian researcher who specializes in Political Thought and Islamic Movements. (Sayyid Qutb was the Spotlight topic in the 23 May 2018 issue of this publication.)

(U) In 2011, Hunayti was arrested by Jordanian security forces after demonstrations in Al Zarqa that called for governmental and constitutional reforms. The protests were led by the Islamist movement, which dominated the political opposition, and by the popular protest movement, which encompassed numerous pro-reform organizations. Hunayti was released from Jordanian custody in October 2013.

(U) In April 2014, Hunayti traveled to Syria at the behest of senior Salafi Jihadi ideologue Abu-Muhammad al-Maqdisi to mediate between Nusrah Front and ISIS during their clashes in Deir az-Zour. Bassam al-Nu’aymi, an activist in the Jihadist Salafi movement in Jordan, said that after the failure of his reconciliation initiative, Hunayti received an offer from Nusrah Front leader Abu-Muhammad al-Jawlani to become a Sharia judge and head of the courthouse in northern Syria. The judicial branch faced controversy due to suspicious verdicts, leading to tensions with the Nusrah Front leadership that Hunayti viewed as hindering his “implementation of sharia.”

(U) Telegram Suspends Thousands of Violent Jihadist Accounts

Related image

(U) On 6 December, the Telegram messaging app suspended over 3,000 “terrorist” accounts. Telegram’s daily report on the “terrorist” accounts it blocks usually cites an average of 200-300 take-downs per day, but this rose to 507 on 5 December and significantly jumped to 3,276 on 6 December.

■ (U) Telegram’s “ISIS Watch” initiative to block channels with “terrorist content” was launched in 2016 after the company came under pressure over the number of violent jihadists operating on its platform. The ISIS Watch channel provided daily and monthly totals for its account suspensions.

■ (U) The Telegram cull followed a recent effort by ISIS to beef up its presence on the platform. ISIS operated a network of multiple channels and groups on Telegram under the “Nashir news agency” brand.

■ (U) Since 12 November, Nashir started advertising a flurry of new Telegram groups to complement its already swelling number of channels, enhancing the overall number of ISIS outlets on the platform.

■ (U) The measure of having dozens of mirror accounts, so far unique to ISIS, was designed to mitigate the impact of take-downs on the group’s media operation. So when 10 or 50 accounts are suspended, other duplicate accounts are still active.

■ (U) In November 2017, Nashir claimed to be operating 600 duplicate channels and groups. While this might have been an exaggerated figure, the group indeed has dozens of active accounts on Telegram. (BBC)

JCAT: (U//FOUO) The desire for and reliance on terrorists and their supporters to communicate electronically with like-minded individuals provides potential investigative avenues through human operations, outreach, and targeting analysis. While a subject’s communications can be anonymized or encrypted, often their participation in online forums, chat rooms, and initial contact with others may not be, providing a window for discovering trends and methods in terrorist COMSEC. (JCAT)

CIA released Bin Laden’s Secrets

CIA released Bin Laden’s Secrets

In an effort to further enhance public understanding of al-Qa’ida, the Central Intelligence Agency (CIA) on 1 November 2017 released additional materials recovered in the 2 May 2011 raid on Usama Bin Ladin’s compound in Abbottabad, Pakistan.

With the release of these materials, the information remaining in the collection that has not been released publicly includes materials that are protected by copyright; sensitive such that their release would directly damage efforts to keep the nation secure; pornography; malware; blank, corrupted, and duplicate files. The entire collection has been available to the US Intelligence Community and Department of Defense organizations for years.

The Office of the Director of National Intelligence (ODNI) previously released documents from the collection on 20 May 2015, 1 March 2016, and 19 January 2017 after an interagency review spearheaded by the CIA. The releases align with ODNI initiatives for increased transparency – consistent with national security prerogatives – and the 2014 Intelligence Authorization Act, which required the ODNI to conduct a review of the documents for release.

CIA’s 1 November 2017 release includes additional al-Qa’ida letters, videos, audio files, and communications, as well as routine family correspondence. As a result, it builds on the ODNI releases that provided material relevant to understanding the plans and workings of terrorist organizations. The material is posted in its original Arabic format and in as close to the original form as possible, modified only so the files cannot be edited.

All of the material, which includes audio, document, image, video, and software operating system files, can be found on the All Original Filessection of this page. To view material by category, refer to the Audio, Documents, Images, and Video pages. To view the material by the device from which it originated, refer to the Devices page. Lastly, to view Microsoft Office files of various ages and formats that CIA has converted to Portable Document Format (PDF) for ease of viewing, refer to the Converted Material page.

Follow this link to access CIA’s press release.

The files underwent interagency review, and an effort was made to remove copyrighted material. However, the files may still contain some copyrighted works. Further reproduction, distribution, public performance, or public display of any copyrighted work is generally prohibited without the permission of the copyright owner. Copyright owners may request the removal of their content by submitting a notice via mail to Central Intelligence Agency, Office of Public Affairs, Washington, DC, 20505; via fax to 571-204-3800; or via the contact button on the homepage.

A notice must include:

  • A sufficient description of the copyrighted content to locate and remove it;
  • The copyright owner’s contact information or that of an authorized agent;
  • A statement of good faith belief that the use of the content at issue is not permitted by the copyright owner, an authorized agent, or the law; and
  • A statement that the information in the notice is accurate, including that it is submitted by the copyright owner of the content at issue or an authorized agent.

Bin Ladin’s Journal

1 November 2017

In addition to the computer files and digital media recovered in the May 2011 raid on Usama Bin Ladin’s compound in Abbottabad, Pakistan, CIA recovered Bin Ladin’s journal. As part of the 1 November 2017 release, CIA made available photographs of the journal, which includes an entry the day before Bin Ladin’s death. Please note the photographs were taken in the urgent hours after the raid as the US Intelligence Community analysts reviewed the material in search of clues that would reveal ongoing al-Qa’ida plots, as well as the identities and locations of al-Qa’ida personnel, and other information of immediate importance.

Journal Download Links (118 MB): [pdf] [zip] [tgz]     [zip md5] [tgz md5]

File Downloads

The material in this file collection may contain content that is offensive and/or emotionally disturbing. This material may not be suitable for all ages. Please view it with discretion.
Prior to accessing this file collection, please understand that this material was seized from a terrorist organization. Out of an abundance of caution we took the site down to resolve technical issues associated with the initial posting – and to remove additional detected malware – but we cannot guarantee that all malware has been removed.
Prior to accessing this file collection, please note the large file sizes of some of the material.
File Types File Index File Bundles File Size MD5 Hash
All Original Files
Various File Index [zip] [tgz] 258 GB [zip md5] [tgz md5]
Original Files by Content Type
Audio File Index [zip] [tgz] 30 GB [zip md5] [tgz md5]
Documents File Index [zip] [tgz] 16 GB [zip md5] [tgz md5]
Images File Index [zip] [tgz] 7 GB [zip md5] [tgz md5]
Video File Index [zip] [tgz] 162 GB [zip md5] [tgz md5]
Original Files by Device
Device List
MS Office Files Converted to PDF
PDF File Index [zip] [tgz] 12 GB [zip md5] [tgz md5]

Countering Terrorist Narratives

Countering Terrorist Narratives

This investigation, dispatched by the European Parliament’s Arrangement Division for Subjects’ Rights and Sacred Issues at the demand of the LIBE Panel, gives a review of current ways to deal with countering psychological oppressor stories. The first and second segments layout the distinctive reactions created at the worldwide and European Union levels. The third segment introduces an investigation of four distinctive ways to deal with reacting to fear based oppressor stories: disturbance of publicity conveyance, divert technique, crusade and message outline, and government correspondences and synchronization of message and activity. The last area offers various arrangement proposals, featuring five interrelated ‘lines of exertion’ basic to amplifying the proficiency and viability of counterterrorism and countering fierce fanaticism key correspondence.

1. Worldwide activities to counter fear based oppressor accounts are completed by various distinctive on-screen characters on the supranational, global, local, national and sub-national levels. The UN has set up itself as a key player in the field of counter-stories, rousing related organizations, for example, the Worldwide Counterterrorism Gathering (GCTF) and Hedayah, to help states in building solid designs of activity in this field. Other worldwide associations, for example, NATO and OSCE, have executed activities that attention on vital interchanges and counter-stories. States have likewise expanded endeavors in countering fear based oppressor stories through participation with different states or non-state institutional accomplices. At last, tech organizations have found a way to counteract manhandle of their stages by fear based oppressor on-screen characters.

2. The EU has expected a main part in counter-account endeavors through its own particular offices and projects and in addition through supporting outside activities. Europol assumes a key part in expelling illicit psychological militant substance from the Web while the EU Web Gathering gives a stage to disturb fear monger content and open up counter-accounts. The EU likewise encourages a system of cutting edge specialists, the Radicalisation Mindfulness System, which gives investigations of existing counter-account endeavors. At last, there are various establishments working at the European level, frequently in association with either the EU or Part States, which encourage the making of counter-accounts between governments, industry, and common society.

3. There are four key patterns in current endeavors to handle fear monger purposeful publicity:

I. Interruption of promulgation circulation – The key goal is to meddle with the conveyance of publicity, to put it plainly, to attempt and stop purposeful publicity at the source by keeping it from achieving its intended interest group. Specifically, this has focussed on bringing down promulgation from web-based social networking and erasing affronting accounts.

ii. Divert technique – Instead of eradicating promulgation, this approach looks to divert watchers to various messages trying to ‘bump’ their conduct. Spearheaded by Jigsaw and ISD, this venture diverts those scanning for jihadist material to counter-informing.

iii. Crusade and message outline – These tasks look to give data and aptitudes to Common Society Associations (CSOs) to create correspondence battles, normally in light of counter-story or option account approaches. While interruption looks to stop the spread of purposeful publicity, this approach tries to empower CSOs with the aptitudes to stand up to and undermine the promulgation.

iv. Government correspondences and synchronization of message and activity – There is a propensity for correspondence crusades to be composed in a vacuum, detached from occasions, in actuality. Synchronization approaches take a thorough point of view and intend to connect messages and activities, and to arrange informing crosswise over government and with global accomplices. The quality of these methodologies is to keep the undermining of a story by uncovering its ‘say-do-hole’, through guaranteeing message and activities are adjusted, and through constraining opposing informing.

4. In spite of the fact that counter-accounts is broadly bolstered by governments, think tanks and NGOs, the idea itself is somewhat immature and does not have an exhaustive establishing in observational research. There is little proof to help the adequacy of counternarratives and a significant number of its hidden presumptions have been raised doubt about. There is a requirement for more noteworthy research here and, specifically, compelling observing and assessment of flow counter-account extends keeping in mind the end goal to have the capacity to guarantee that lessons are found out.

5. Counter-psychological oppression (CT) and countering vicious radicalism (CVE) vital correspondences endeavors crosswise over different projects and activities can be educated by the accompanying suggestions:

I. Interruption of fierce fanatic material should be connected extensively and over various stages, keeping in mind the end goal to abstain from dislodging fear monger informing movement between channels. The vacuum made by interruption should be loaded with a progression of messages intended to use a scope of motivational drivers, keeping in mind the end goal to resound with an intended interest group subject to changing inspirations and so as to have a strengthening total impact on that gathering of people.

ii. To guarantee cognizant informing over the short, medium and long haul, battle and message plan standards should be synchronized through the foundation of a reasonable and easy to-comprehend, larger focal account, which is upheld by a specifically assorted exhibit of messages.

iii. An unmistakable recognizable proof of the intended interest group is essential to successful key correspondences, considering a range of potential customers of the message (expected, unintended, supporters, enemies and neutrals). A nuanced behavioral and attitudinal comprehension of that group of onlookers is expected to powerfully shape mentalities and practices.

iv. Measuring the viability of vital interchanges requires appraisals that emphasis on measures of key education, specialized proficiency and target gathering of people. These appraisals should be at first performed preceding the beginning of a key interchanges exertion to build up a standard measure. Once the benchmark measurements are set up, these evaluations should be consistently executed as a way to check the viability and proficiency of the battle after some time.

v. So as to pick up put stock in, believability and authenticity according to an intended interest group, informing should be synchronized with exercises on the ground, in this manner diminishing the apparent uniqueness between what one says and does (the ‘say-do hole’). The focal necessity for enhancing the synchronization of informing and activity crosswise over organizations is to a great extent social. Antiquated states of mind that ‘activities talk louder than words’ add to a hierarchical culture, frequently strengthened by principle, which bears vital interchanges an ex post facto part in operations, procedure and arrangement. Vital correspondences ought to be a key thought in arranging from the earliest starting point of the

iii. A reasonable distinguishing proof of the intended interest group is key to viable vital correspondences, considering a range of potential buyers of the message (planned, unintended, supporters, foes and neutrals). A nuanced behavioral and attitudinal comprehension of that gathering of people is expected to powerfully shape mentalities and practices.

iv. Measuring the adequacy of key correspondences requires evaluations that emphasis on measures of vital education, specialized proficiency and target group of onlookers. These evaluations should be at first performed preceding the beginning of a key interchanges exertion with a specific end goal to build up a benchmark measure. Once the benchmark measurements are built up, these appraisals should be frequently executed as a way to check the adequacy and productivity of the battle after some time.

v. Keeping in mind the end goal to pick up put stock in, believability and authenticity according to an intended interest group, informing should be synchronized with exercises on the ground, in this manner lessening the apparent dissimilarity between what one says and does (the ‘say-do hole’). The focal prerequisite for enhancing the synchronization of informing and activity crosswise over administrations is to a great extent social. Antiquated states of mind that ‘activities talk louder than words’ add to a hierarchical culture, regularly strengthened by precept, which bears key interchanges an ex post facto part in operations, procedure and arrangement. Key correspondences ought to be a key thought in arranging from the earliest starting point of the


Attack on German Christmas Market underscores Threat to Mass Gatherings

Attack on German Christmas Market underscores Threat to Mass Gatherings

Germany: Vehicular Assault at Christmas Market Underscores Threat to Mass Gatherings and Open-Access Venues

Page Count: 4 pages
Date: December 21, 2016
Restriction: For Official Use Only
Originating Organization: Department of Homeland Security, Office of Intelligence and Analysis
File Type: pdf
File Size: 298,161 bytes
File Hash (SHA-256): ED0FA815C6477AA7CF193FB8C1972FE0D727BD52F7599F39FF9C7893C7A86807

Download File

(U) A 25-ton commercial truck transporting steel beams from Poland to Germany plowed into crowds at a Christmas market in Berlin at about 2000 local time on 19 December, killing at least 12 people and injuring 48 others, several critically, according to media reporting citing public security officials involved in the investigation. The truck was reportedly traveling at approximately 40 miles per hour when it rammed the Christmas market stands. Police estimate the vehicle traveled 80 yards into the Christmas market before coming to a halt.

(U) German authorities are calling the attack a terrorist incident, with the attacker still at large. German authorities are warning that it is unclear if the attacker was a lone offender, acted as part of a cell, or if he received any sort of direction by a FTO, and expressed concern that additional attacks are possible. An individual who was initially detained on 19 December was released on 20 December, and is no longer considered a suspect, according to German police. The truck may have been stolen or hijacked with the original driver overpowered or murdered. The original driver, found dead in the truck cab, appears to have died from stabbing and shooting wounds, according to media reporting citing law enforcement officials. The truck tracking location system indicated repeated engine stalls in the time leading up to the attack, leading the owner of the vehicle to speculate this was unlikely if a veteran driver was operating the truck, unless there was some sort of mechanical trouble. In response to the incident, German authorities, as part of their heightened security posture, will place concrete barriers around access points at Christmas markets across Germany.

(U//FOUO) Vehicle Ramming Featured in Recent Terrorist Messaging

(U//FOUO) I&A assesses that the 19 December likely terrorist attack at one of the largest Christmas markets in Berlin highlights terrorists’ continued use of simple tactics and is consistent with recent calls by the self-proclaimed Islamic State of Iraq and the Levant (ISIL) for attacks in the West using “all available means.” In an early December audio statement, ISIL spokesman Abu Hassan al-Muhajir called for attacks in “their homes, markets, street gatherings and anywhere they do not think of.” Vehicle ramming has been featured in recent violent extremist publications and messaging—including in ISIL’s al Rumiyah magazine and al-Qaʻida in the Arabian Peninsula’s (AQAP) Inspire magazine—especially since the mid-July vehicle ramming attack in Nice, France. The early-November third issue of Rumiyah highlighted applicable targets for vehicle ramming attacks such as “large outdoor conventions and celebrations, pedestrian-congested streets, outdoor markets, festivals, parades, and political rallies.” The most recent Homeland attack featuring this tactic occurred at Ohio State University in Columbus on 28 November, where Abdul Razak Ali Artan ran over pedestrians and then continued the attack with an edged weapon after the vehicle came to a stop.

(U//FOUO) On 20 December, ISIL’s A’maq News Agency called the attacker “an Islamic State soldier” consistent with previous instances of quickly posting claims of credit for operations. While the attack bears the hallmarks of ISIL’s tactics and targets, we have not been able to determine a definitive link to the group at this time.

(U//FOUO) I&A has no information indicating a specific or credible threat against individuals, locations or events in the Homeland, but several recent plots and attacks in the United States and overseas involving shopping malls, mass transit, and mass gatherings, including sporting events, have shown that homegrown violent extremists (HVEs) and terrorist groups are interested in attacking these types of targets. I&A assesses that commercial facilities—such as festivals, concerts, outdoor events, and other mass gatherings—remain a potential target for terrorists or HVEs, as they often pursue simple, achievable attacks with an emphasis on economic impact and mass casualties. The most likely tactics in a hypothetical terrorist attack against such events likely would involve edged weapons, small arms, vehicular assaults, and possibly improvised explosive devices. The 19 December events underscore the difficulties the private sector and law enforcement face in securing venues that are pedestrian-friendly, particularly in light of the large number of such aereas.

Isis Attack On Paris, Isis Attack In Us, Isis Attack Israel, Isis Attack In Syria, Isis Attack In France, Isis Attack In Philippines, Isis Attack 2017, Isis Attack In London, Isis Attack In Iran, Isis Attack In America, Isis Attack America, Isis Attack Afghanistan, Isis Attack April 2017, Isis Attack At Concert, Isis Attack Australia, Isis Attack Airport, Isis Attack Asia, Isis Attack Ariana Concert, Isis Attack Ariana, Isis Attack Articles, Isis Attack Brussels, Isis Attack Bangladesh, Isis Attack Britain, Isis Attack Base In Syria, Isis Attack Bus, Isis Attack By Pigs, Isis Attack By Boars, Isis Attack Baghdad, Isis Attack Bohol, Isis Attack Base, Isis Attack China, Isis Attack Church, Isis Attack Concert, Isis Attack Chicago, Isis Attack California, Isis Attack Cnn, Isis Attack Chemical, Isis Attack Catholic, Isis Attack Copenhagen, Isis Attack Churches In Egypt, Isis Attack Dubai, Isis Attack Dates, Isis Attack Drone, Isis Attack During Ramadan, Isis Attack Disney World, Isis Attack Dates 22nd, Isis Attack Dublin, Isis Attack Dates Pattern, Isis Attack Dates 22, Isis Attack Dates Uk, Isis Attack Egypt, Isis Attack Europe, Isis Attack Edc, Isis Attack England, Isis Attack Edinburgh 2016, Isis Attack Edc Las Vegas, Isis Attack Egypt Video, Isis Attack Egypt Palm Sunday, Isis Attack Egypt Church, Isis Attack Egypt Bus, Isis Attack France, Isis Attack Fresno, Isis Attack Fresno Ca, Isis Attack France 2016, Isis Attack Fox News, Isis Attack France 2015, Isis Attack France 2017, Isis Attack Footage, Isis Attack Florida, Isis Attack Facts, Isis Attack Germany, Isis Attack Garland Texas, Isis Attack Great Britain, Isis Attack Greece, Isis Attack Graphic, Isis Attack Glasgow, Isis Attack Geelong, Isis Attack Georgia, Isis Attack Guildford, Isis Attack Gaza, Isis Attack Helicopter, Isis Attack History, Isis Attack Hospital Kabul, Isis Attack Hotel, Isis Attack Hong Kong, Isis Attack Hama, Isis Attack Homs, Isis Attack Homes, Isis Attack Houston, Isis Attack Hastings, Isis Attack In Paris, Isis Attack In Us, Isis Attack Israel, Isis Attack In Syria, Isis Attack In France, Isis Attack In Philippines, Isis Attack In London, Isis Attack In Iran, Isis Attack In America, Isis Attack In Russia, Isis Attack Japan, Isis Attack Jordan, Isis Attack Jakarta, Isis Attack Jerusalem, Isis Attack July 4th, Isis Attack June 2015, Isis Attack July 4th 2015, Isis Attack January 2016, Isis Attack Jamaica, Isis Attack June 26, Isis Attack Kabul, Isis Attack Kuwait, Isis Attack Kirkuk, Isis Attack Kansas City, Isis Attack Kuala Lumpur, Isis Attack Kabul Hospital, Isis Attack Kaaba, Isis Attack Kenya, Isis Attack Kobani, Isis Attack Kitchener, Isis Attack List, Isis Attack Las Vegas, Isis Attack London, Isis Attack Locations, Isis Attack Liveleak, Isis Attack London 2017, Isis Attack Lebanon, Isis Attack Last Night, Isis Attack London 2015, Isis Attack Live, Isis Attack Map, Isis Attack Manchester, Isis Attack Marawi, Isis Attack May 2017, Isis Attack Military Base, Isis Attack Methods, Isis Attack Mosul, Isis Attack Malaysia, Isis Attack Mecca, Isis Attack Manila, Isis Attack News, Isis Attack New Orleans, Isis Attack New York, Isis Attack Nice France, Isis Attack Nice, Isis Attack North Korea, Isis Attack Northern Ireland, Isis Attack New Zealand, Isis Attack Next, Isis Attack Now, Isis Attack On Paris, Isis Attack On Us, Isis Attack On Israel, Isis Attack On France, Isis Attack On Russia, Isis Attack On Syria, Isis Attack On London, Isis Attack On Mosul, Isis Attack On Las Vegas, Isis Attack On Palm Sunday, Isis Attack Paris, Isis Attack Philippines, Isis Attack Palm Sunday, Isis Attack Pakistan, Isis Attack Pictures, Isis Attack Parliament, Isis Attack Pope, Isis Attack Paris 2017, Isis Attack Philippines 2017, Isis Attack Pattern, Isis Attack Queanbeyan, Isis Attack Qaraqosh, Isis Attack Quiapo, Isis Attack Queen, Isis Attack Qatar, Isis Attack Quebec, Isis Attack Quotes, Isis Attack Quaragosh Iraq, Isis Attack Al Qaeda, Isis Plan To Attack Queen, Isis Attack Russia, Isis Attack Recent, Isis Attack Russian Plane, Isis Attack Ramadan, Isis Attack Records, Isis Attack Refugee Camp, Isis Attack Resort World, Isis Attack Resorts World Manila, Isis Attack Rome, Isis Attack Russia 2017, Isis Attack Syria, Isis Attack Seattle, Isis Attack Saudi Arabia, Isis Attack Statistics, Isis Attack Spain, Isis Attack Sweden, Isis Attack Syrian Army, Isis Attack Strategy, Isis Attack St Petersburg, Isis Attack Syria 2017, Isis Attack Timeline, Isis Attack Texas, Isis Attack Today, Isis Attack Turkey, Isis Attack Today In Syria, Isis Attack This Morning, Isis Attack The Philippines, Isis Attack Tikrit, Isis Attack Today In Egypt, Isis Attack Techniques, Isis Attack Us, Isis Attack Usa, Isis Attack Uk, Isis Attack United States, Isis Attack Us Base, Isis Attack Usa 2017, Isis Attack Uae, Isis Attack Us Helicopter, Isis Attack Us Base In Syria, Isis Attack Uk 2017, Isis Attack Videos, Isis Attack Vegas, Isis Attack Vatican, Isis Attack Videos Liveleak, Isis Attack Vietnam, Isis Attack Venice, Isis Attack Virginia, Isis Attack Vancouver, Isis Attack Valparaiso, Isis Attack Vienna, Isis Attack Wiki, Isis Attack Westminster, Isis Attack Warning, Isis Attack World, Isis Attack Wicklow, Isis Attack Wigan, Isis Attack Washington, Isis Attack Wwe, Isis Attack Wolverhampton, Isis Attack Westfield, Isis Xmas Attack, Isis Attack Yesterday, Isis Attack Youtube, Isis Attack Yemen, Isis Attack Yazidi, Isis Attack Yyc, Isis Attack Yarmouk, Isis Attack Yarmouk Camp, Isis Attack Yorkshire, Isis Attack Ypg, Isis Attack Us, Isis Attack Zones, Isis Attack Zurich, Isis Attack New Zealand