Worldwide Terrorist Operations Connected to Lebanese Hizballah or Iran

This Reference Aid analyzes strategies and targets earned from a survey of assaults or disturbed fear based oppressor activities from 2012-2018 connected to either Lebanese Hizballah (LH) or Iran. It recognizes practices and pointers that may ascend to the level for suspicious movement announcing in regions, for example, enrollment, obtaining of ability, materiel and weapons stockpiling, target type, and operational safety efforts, which could help administrative, state, neighborhood, inborn, and regional government counterterrorism offices, law requirement authorities, and private area accomplices in distinguishing, counteracting, seizing, and disturbing potential fear monger action in the Homeland. This Reference Aid doesn’t suggest these pointers would fundamentally be watched or recognized in each circumstance or that LH and Iran essentially utilize similar strategies or exhibit similar markers. A portion of these identification openings may come over the span of ordinary examinations concerning criminal operations in the United States, for example, unlawful travel or carrying of medications, weapons, or money, and lead to the disclosure of pre-operational movement. A rendition of this Reference Aid’s infographic was additionally included as a supplement to a recently distributed Intelligence Assessment. Data in this Reference Aid is present starting at 16 May 2019.

DHS & FBI about ISIS Leader Baghdadi’s current Situation

Image result for baghdadi video

Executive Summary:
(U//FOUO) This Joint Intelligence Bulletin (JIB) is intended to provide information on the recent video appearance by the Islamic State of Iraq and ash-Sham (ISIS) leader Abu Bakr al-Baghdadi. The video addresses the group’s territorial defeat in Syria, discusses the acceptance of pledges of allegiance from ISIS supporters, and praises recent attacks in Sri Lanka and Saudi Arabia. This JIB is provided by the FBI, DHS, and NCTC to support their respective activities and to assist federal, state, local, tribal, and territorial government counterterrorism and law enforcement officials and private sector security partners in deterring, preventing, or disrupting terrorist attacks against the United States. All video details described in this JIB are taken from the translated transcript of Baghdadi’s speech. The information cutoff date is 1 May 2019.

(U) Details of ISIS Leader Abu Bakr al-Baghdadi’s Video Message

(U//FOUO) On 29 April 2019, ISIS’s al-Furqan Media Establishment publicly released an 18-minute video message in Arabic titled “In the Company of the Amir of the Believers”, which shows ISIS leader Abu Bakr al-Baghdadi sitting on a carpet in an undisclosed location with an assault rifle at his side. This is Baghdadi’s first public statement since his August 2018 audio message, and his first video appearance since July 2014, when Baghdadi was filmed introducing himself as “caliph” of the newly-declared caliphate at the Grand Mosque in Mosul, Iraq.

(U) Baghdadi Vows a “Long Battle Ahead” Despite Defeat in Syria

• (U//FOUO) Baghdadi emphasizes that ISIS’s fight is not over, stating, “In truth, the battle between Islam and its people with the Cross and its people is long.” He further explains that ISIS is engaged in a multigenerational struggle and they plan to wear down their enemies with attrition, emphasizing that “jihad will continue until Judgement Day” and that “God Almighty ordered us to wage jihad and did not order us to achieve victory.”

• (U//FOUO) Baghdadi acknowledges that ISIS lost the war in Baghuz, Syria, but emphasizes that the “bravery, steadfastness, and endurance of the Ummah of Islam was evident.” He states that ISIS’s soldiers did not abandon their faith during the battle, and sacrificed their lives rather than giving away land to ISIS’s enemies.

• (U//FOUO) Baghdadi praises the members in all of ISIS’s provinces for their “unified raid to avenge their brothers in Syria, which amounted to 92 operations in eight countries.” He states these attacks indicate the cohesion and steadfastness of the “mujahedeen.” Baghdadi praises and thanks the now-deceased emirs, provincial governors, military personnel, and media members from various countries for their support to ISIS.

(U) Baghdadi Praised the Attacks in Sri Lanka and Saudi Arabia and Calls for Additional Operations

• (U//FOUO) Video footage displays the Sri Lanka attackers—who conducted a series of suicide bombings against luxury hotels and Christian churches in Sri Lanka on 21 April, killing approximately 250 people—pledging allegiance to Baghdadi, while audio of purportedly Baghdadi’s voice is heard stating, “You brothers in Sri Lanka have pleased the monotheists by their commando operations that unsettled the Crusaders in their Easter celebrate to avenge their brothers in Baghuz.” Baghdadi continues with “praise be to God, for among those killed were some Americans and Europeans.” Baghdadi congratulates the Sri Lanka attackers on their pledge of allegiance to join the “caliphate,” and asked God to accept them as martyrs.

• (U//FOUO) Baghdadi acknowledges the attack in Saudi Arabia—where ISIS fighters attacked a Saudi security building in Az Zulfi on 21 April—and asked God that it be “followed by another one.” He calls on members in Saudi Arabia “to continue down the path of jihad” against the Saudi regime.

• (U//FOUO) While Baghdadi appears in discussion with unidentified men, text on the screen indicates he was giving directives to “double the effort and intensify the blows against the Crusaders, apostates, and their supporters.”

(U) Baghdadi Accepts Pledges of Allegiance and Praises Global Network

• (U//FOUO) The video shows Baghdadi being handed booklets by one of the unidentified men which are labeled with the names of ISIS provinces, including Libya, Khorasan, Somalia, Yemen, Caucasus, West Africa, Central Africa, and Turkey, as well as Tunisia, which is not publicly identified as a province. This is the first time ISIS has referred to Turkey as an official province, or “wilayah,” in its media releases.

• (U//FOUO) Additionally, Baghdadi accepts pledges of allegiance from ISIS members in Burkina Faso and Mali, and congratulates them for joining the “caliphate.” He recommends they intensify their attacks against France and its allies and to avenge their brothers in Iraq and Syria.

• (U//FOUO) Baghdadi congratulates ISIS members in Libya for their resoluteness and their raid on the town of Al Fugaha, Libya. He states that despite their withdrawal from it, they have shown their enemies that they are capable of taking the initiative, knowing their battle today is a battle of attrition.

(U) Baghdadi’s Image Starkly Contrasts with Last Appearance in 2014

(U//FOUO) The video’s presentation of Baghdadi as an insurgent leader—similar to the images of now-deceased al-Qa‘ida (AQ) leader Usama Bin Laden and now-deceased AQ in Iraq leader Abu Musab al-Zarqawi from prior videos—contrasts with Baghdadi’s July 2014 appearance at the Grand Mosque in Mosul, Iraq, where he delivered a formal address from the mosque’s pulpit wearing a black turban and robe probably to evoke images of the last caliphs who ruled from Baghdad.

(U) Outlook

(U//FOUO) The FBI, DHS, and NCTC assess Baghdadi’s appearance almost certainly will bolster the morale for ISIS’s existing supporters around the world, including those in the United States, by indicating Baghdadi is alive and in control of the group as of late April 2019. Most homegrown violent extremists (HVEs) generally do not mobilize to violence in response to specific events and instead are usually influenced by a confluence of sociopolitical, ideological, and personal factors.a However, those wavering in their commitment to ISIS might feel a sense of renewed devotion to the group as Baghdadi is alive and apparently still managing ISIS.

NCC – Sunni Extremist Attacks in the USA before 9/11

(U//FOUO) NCTC (National Counterterrorism) assesses that the Sunni extremist threat to the US before 9/11 was characterized by diverse extremist organizations and lone actors motivated by multiple ideological narratives and other factors, including Salafi jihadism, Palestinian nationalism, theological disputes within Islam, anti-Semitism, and anti-Hindu sentiments. We have identified a dozen successful attacks, four disrupted plots, and one attempt to set up an extremist training camp in the US between 1973 and 2001, underscoring the persistent threat from al-Qa‘ida–associated extremists, Palestinian terrorist groups, and Sunni extremist lone actors in the decades leading up to 9/11.



These extremists chose a wide array of targets, with the majority of their attacks before 1993 focused on Hindu, Jewish, or Muslim individuals or institutions. Most attacks after that date were against civilian or US Government targets, because of al-Qa‘ida–associated extremists’ focus on indiscriminate mass casualty attacks. In some cases, we lack clear insight into the attackers’ motivations because of information gaps, and FBI disagrees about the motivations underlying two of these attacks.



Radicalization to Terrorism in the USA

Executive Summary

Since its founding in 2012, the National Institute of Justice’s Domestic Radicalization to Terrorism program has sponsored research on how radicalization to terrorism occurs in the United States in order to support prevention and intervention efforts. These projects have taken a variety of approaches to examining the process of radicalization to terrorism, but in spite of this there is substantial overlap in their findings, which collectively provide evidence of the importance of several facilitators of radicalization and the need to take into account how this process unfolds within individuals over time.

Facilitators of Radicalization to Terrorism
Terrorist belief systems or narratives
Identity processes
Activities that demonstrate commitment to a terrorist group or cause
Connections with terrorists in one’s offline social network
Connections with terrorists via the internet and/or social media
Group dynamics
Triggering events

At the individual level, the radicalization process often involves embracing a terrorist belief system or narrative that identifies particular others or groups as “enemies” and justifies engaging in violence against them. Individuals may also begin to identify themselves as terrorists, as well as to engage in activities that highlight their commitments to their new beliefs, identities, and/or others who hold them. It is, however, important to note that while these beliefs and behaviors may facilitate the movement to terrorism, this outcome is not inevitable. Those close to these individuals may become aware of the changes that their friends and family members are undergoing and attempt to address them or seek help from others who can. An important implication of this is that trusted information and resources need to be available to assist in this effort. Another is that prevention and intervention efforts may benefit from addressing beliefs that justify violence and helping individuals to develop identities in which these beliefs are not central.

Testing Two Theoretical Perspectives on Radicalization to Terrorism

In their completed NIJ-sponsored research, a team led by the University of Arkansas tested whether role identity theory and framing theory help to explain how individuals and groups radicalize to terrorism (Smith et al., 2016). In doing so, the researchers built on previous research conducted using the American Terrorism Study (ATS) database (e.g., Smith & Damphousse, 2009; Smith, Damphousse, & Roberts, 2006; Smith, Roberts, & Damphousse, 2013) and focused not on testing a complete model of the radicalization process but rather on testing what they viewed to be a crucial component of it: the construction of a terrorist identity. This process is outlined in Figure 2 on page 11.

Several concepts displayed in the figure are central to understanding the analyses the team conducted. The first two are identity salience and identity pervasiveness — both of which are based on the premise that everyone has multiple identities (e.g., as a parent, teacher, musician). If an identity is salient, it is more likely to be brought to bear in a particular situation. If an identity is pervasive, it is more likely to be brought to bear in numerous situations. The researchers hypothesized that individuals with more salient and pervasive terrorist identities would be more likely to engage in terrorism.

Christchurch May Inspire Other Terrorists – DHS-FBI

Christchurch May Inspire Other Terrorists – DHS-FBI

This Joint Intelligence Bulletin (JIB) is intended to provide information on Australian national and violent extremist Brenton Tarrant’s 15 March 2019 attacks on two mosques in Christchurch, New Zealand. These attacks underscore the enduring nature of violent threats posed to faith-based communities. FBI, DHS, and NCTC advise federal, state, local, tribal, and territorial government counterterrorism and law enforcement officials and private sector security partners responsible for securing faith-based communities in the Homeland to remain vigilant in light of the enduring threat to faith-based communities posed by domestic extremists (DEs), as well as by homegrown violent extremists (HVEs) who may seek retaliation. This JIB is provided to assist federal, state, local, tribal, and territorial counterterrorism and law enforcement officials and private sector security partners to effectively deter, prevent, preempt, or respond to incidents and terrorist attacks in the United States.

(U) Attack Details

(U//FOUO) On 15 March 2019, New Zealand police arrested an Australian national who appeared to be inspired by a white supremacist ideology and who allegedly conducted a shooting attack on two mosques in Christchurch, New Zealand. This attack highlights the enduring threat of violence posed to faith-based communities. There are currently 49 victims deceased, and 20 others are listed as being in critical condition following the attack.

» (U//FOUO) On 15 March 2019, at about 1:40 PM local time, Australian national Brenton Tarrant used firearms to attack the Masjid Al Noor Mosque in the city of Christchurch, New Zealand, before conducting a similar shooting attack at the Linwood Masjid Mosque, approximately four miles away. Tarrant drove to the attack sites and livestreamed a video of the attack. Police also discovered improvised explosive devices in a vehicle connected with the attack. Tarrant is currently the only known perpetrator; however, investigation of his movements and associates continues.

» (U//FOUO) Tarrant disseminated a manifesto prior to the shooting which detailed his concerns of perceived “white genocide.” The manifesto contains a wide range of anti-immigrant and anti-Muslim views. One reason listed as to why he carried out the attack was “to create conflict…within the United States on the ownership of firearms in order to further the social, cultural, political, and racial divide within the United states [sic].”

» (U//FOUO) Tarrant claimed to have been planning the attack for two years and recently relocated to New Zealand to live temporarily while he “planned and trained.” He claimed to have chosen to conduct his attack in Christchurch three months prior to show such attacks could happen anywhere.

(U) Mosque Attacks Could Incite Like-Minded and Retaliatory Attacks

(U//FOUO) We are concerned online sharing of Tarrant’s livestreamed footage could amplify viewer reaction to the violent attack and possibly incite similar attacks by those adhering to violent extremist ideologies in the United States and abroad, as well as retaliatory attacks from HVEs and individuals otherwise affiliated with foreign terrorist organizations. Tarrant appeared to have been influenced by prior attacks by violent extremists in the United States and other countries, and we remain concerned that US-based DEs of similar ideologies could become inspired by this attack. Although most HVEs generally do not mobilize to violence in response to specific events and instead are usually influenced by a confluence of sociopolitical, ideological, and personal factors, exceptions may occur and we remain concerned for the potential of retaliatory attacks by some HVEs, as we have already seen calls for attacks by violent extremists online.

» (U//FOUO) Tarrant claimed Norwegian mass attacker Anders Brevik gave his “blessing” for the attack. Tarrant’s ammunition cases also displayed handwritten names of violent extremists in Canada and elsewhere who previously conducted violent attacks on Muslims or in support of violent extremist ideologies.

» (U//FOUO) An examination of online jihadist media following the mosque attacks indicates various al-Qa‘ida and ISIS supporters are posting attack images to express outrage and are calling upon all Muslims to respond to the New Zealand attacks by launching their own near-term attacks in retaliation.

Ambulances used as Bombs in Afghanistan

Image result for afghanistan war ambulance cars bombs
(U//FOUO) On January 27, 2019 at approximately 12:15pm local time, a vehicle resembling an ambulance and laden with explosives detonated after it passed through a police checkpoint in Kabul, Afghanistan. The explosion killed more than 100 people and wounded approximately 235 others. According to the deputy spokesperson for the Afghanistan Interior Ministry, the vehicle was painted to resemble an ambulance and had successfully passed through a checkpoint after the attacker allegedly told police he was transporting a patient to a nearby hospital. While stopped at a second checkpoint farther inside the city limits, the attacker detonated the explosives concealed in the vehicle. The explosion occurred in an area known as Chicken Street, which includes a prominent shopping zone and is in close proximity to foreign embassies and government buildings. A Taliban spokesman released a statement claiming responsibility and alleged the attack was in retaliation to an increased presence of U.S. troops and an increase in airstrikes throughout Afghanistan.

(U//FOUO) Individuals may consider using a variety of official vehicles or altering vehicles to look like official vehicles to further their terrorist objectives. The use of ambulances, law enforcement vehicles, fire vehicles, or other government vehicles could enable attackers to enter into secure areas to access sensitive sites or carry attackers, weapons, and/or explosives to an intended target location. Individuals may clone first responder vehicles by modifying unofficial vehicles with paint and decals to make them appear to be official; steal vehicles from residences, vulnerable vehicle lots, or while first responders are at a scene; or purchase retired, official vehicles and potentially re-equip them with equipment that was removed prior to sale to make them appear more legitimate. Incidents involving stealing or cloning first responder vehicles in the United States have often been associated with criminal activity, but individuals in the United States could also gain insight from international attacks to attempt similar tactical use of emergency response and government vehicles in terrorist attacks in the United States.

(U//FOUO) First responders should follow agency protocols for responding to suspicious incidents and safeguarding equipment and vehicles. The following non-exhaustive list identifies potential indicators of misuse or misrepresentation of first responder vehicles.

(U//FOUO) Drivers of government vehicles who are not knowledgeable or who become increasingly nervous when questioned about the organization represented on the vehicle they are driving
(U//FOUO) Incorrect vehicle decals, verbiage, colors, word font, and size
(U//FOUO) Visible identifiers, such as phone number or license plates, that are inconsistent with the vehicle’s operating area or mission are very suspicous.
(U//FOUO) Heavily loaded vehicles, possibly beyond capacity must be considered as dangerous.


Counterterrorism Weekly – A New Media Presented

Image result for counterterrorism center

(U//FOUO) NCTC Counterterrorism Weekly Open Source Digest December 2018
December 24, 2018

Counterterrorism Weekly 6-18 December 2018
Page Count: 18 pages
Date: December 12, 2018
Restriction: For Official Use Only
Originating Organization: National Counterterrorism Center
File Type: pdf
File Size: 1,684,886 bytes
File Hash (SHA-256): 5DB3EF6875E67FA136A736986BC4F476BD2DA0DBCDC4DD30A0DB7241449EC7B1

Download File

(U) Terrorist Profile: Former Jordanian ISIS Official Sa’d Al-Hunayti

(U) Jordanian national Sa’d al-Hunayti was a leading member of the Jihadist Salafi movement in Jordan before he traveled to Syria and joined Nusrah Front then ISIS. Hunayti was ultimately arrested by Hayat Tahrir al-Sham (HTS) for reportedly being a leader in ISIS-run secret cells in Idlib Province, Syria, that planted IEDs and conducted kidnappings and assassinations in northwest Syria.

Related image


(U) During the 1980s, Hunayti studied history at Yarmouk University in north Jordan and was suspended twice for “his political positions.” During this period, he was influenced by Sayyid Qutb’s idea of “governance,” according to Dr. Muhammad Abu-Rumman, a Jordanian researcher who specializes in Political Thought and Islamic Movements. (Sayyid Qutb was the Spotlight topic in the 23 May 2018 issue of this publication.)

(U) In 2011, Hunayti was arrested by Jordanian security forces after demonstrations in Al Zarqa that called for governmental and constitutional reforms. The protests were led by the Islamist movement, which dominated the political opposition, and by the popular protest movement, which encompassed numerous pro-reform organizations. Hunayti was released from Jordanian custody in October 2013.

(U) In April 2014, Hunayti traveled to Syria at the behest of senior Salafi Jihadi ideologue Abu-Muhammad al-Maqdisi to mediate between Nusrah Front and ISIS during their clashes in Deir az-Zour. Bassam al-Nu’aymi, an activist in the Jihadist Salafi movement in Jordan, said that after the failure of his reconciliation initiative, Hunayti received an offer from Nusrah Front leader Abu-Muhammad al-Jawlani to become a Sharia judge and head of the courthouse in northern Syria. The judicial branch faced controversy due to suspicious verdicts, leading to tensions with the Nusrah Front leadership that Hunayti viewed as hindering his “implementation of sharia.”

(U) Telegram Suspends Thousands of Violent Jihadist Accounts

Related image

(U) On 6 December, the Telegram messaging app suspended over 3,000 “terrorist” accounts. Telegram’s daily report on the “terrorist” accounts it blocks usually cites an average of 200-300 take-downs per day, but this rose to 507 on 5 December and significantly jumped to 3,276 on 6 December.

■ (U) Telegram’s “ISIS Watch” initiative to block channels with “terrorist content” was launched in 2016 after the company came under pressure over the number of violent jihadists operating on its platform. The ISIS Watch channel provided daily and monthly totals for its account suspensions.

■ (U) The Telegram cull followed a recent effort by ISIS to beef up its presence on the platform. ISIS operated a network of multiple channels and groups on Telegram under the “Nashir news agency” brand.

■ (U) Since 12 November, Nashir started advertising a flurry of new Telegram groups to complement its already swelling number of channels, enhancing the overall number of ISIS outlets on the platform.

■ (U) The measure of having dozens of mirror accounts, so far unique to ISIS, was designed to mitigate the impact of take-downs on the group’s media operation. So when 10 or 50 accounts are suspended, other duplicate accounts are still active.

■ (U) In November 2017, Nashir claimed to be operating 600 duplicate channels and groups. While this might have been an exaggerated figure, the group indeed has dozens of active accounts on Telegram. (BBC)

JCAT: (U//FOUO) The desire for and reliance on terrorists and their supporters to communicate electronically with like-minded individuals provides potential investigative avenues through human operations, outreach, and targeting analysis. While a subject’s communications can be anonymized or encrypted, often their participation in online forums, chat rooms, and initial contact with others may not be, providing a window for discovering trends and methods in terrorist COMSEC. (JCAT)