// 2.1. TERRORIST ATTACKS AND SUSPECTS ARRESTED IN THE EU

135 people killed in jihadist terrorist attacks

718 people arrested on suspicion of jihadist terrorism related offence

In 2016, 135 people were killed in jihadist terrorist attacks in the EU. In total 13 terrorist attacks were reported: France 5, Belgium 4 and Germany 4. Out of these 13 attacks, 10 were completed.

A total of 718 people were arrested on suspicion of jihadist terrorism related offences. Numbers of arrests increased in particular in France: from 188 in 2014 and 377 in 2015 to 429 in 2016. There was also an increase in the Netherlands to 36 in 2016 compared to 20 in 2015. In the other Member States the numbers of arrests stayed at approximately the same level, or showed a (slight) decrease. Women have increasingly assumed more operational roles in jihadist terrorism activities, as have minors and young adults, as demonstrated in recent (primarily) failed and foiled attacks in Member States. One in four (26%) of the arrestees in 2016 were women, a significant increase compared to 2015 (18%).

Attack planning against the West continues in Syria and Iraq. Groups including IS and al-Qaeda are believed to have both the intent and capabilities to mount complex, mass casualty attacks. IS is training operatives in Syria/Iraq to carry out terrorist acts in the West and has no shortage of volunteers to be part of teams to be sent abroad for this purpose. Al-Qaeda, despite decreased operational capabilities of its core organisation, has maintained its ambition to carry out large-scale operations against Western targets.

The terrorist threat in the EU in 2016 emanated from remotely directed individuals operating alone or in small groups, and those that may have been inspired by terrorist propaganda, but not directed. The former are receiving direction and personal instruction from, and are possibly being facilitated by, a terrorist organisation. The latter are individual attackers, possibly but not necessarily being helped by family and/ or friends as accomplices. They are inspired by jihadist propaganda and messaging, but not necessarily receiving personal direction or instruction from any group.

On 7 January a man wearing what appeared to be a suicide vest and wielding a meat cleaver outside the Goutte d’Or police station in Paris, was shot and killed as he tried to force his way in. Also in January a Jewish teacher, wearing traditional dress and kippa, was attacked and wounded with a machete in Marseille while walking to work. The attacker was a 15-year-old boy who had arrived in France in 2010.

On 13 June a French police commander and his wife were stabbed to death by a former convict of terrorism-related offences. The police officer was attacked on arriving at his home in Magnanville, near Paris. The attacker subsequently entered the house, where he held the officer’s wife and their 3-year-old son hostage. After the police had ended the siege they found the mother of the child dead. The boy survived. After killing the woman, the attacker broadcast a statement live from the scene via social media in which he pledged allegiance to IS and called for more attacks. The IS related A’maq News Agency posted the video online and a statement that the attack was carried out by an IS fighter.

On 26 July two attackers armed with knives entered the church of SaintEtienne-du-Rouvray (near Rouen) during morning prayers and murdered an 86-year-old priest and seriously wounded a nun. She was one of five hostages taken by the perpetrators (the others escaped), while the two attackers, both aged 19, filmed themselves in front of the altar. They were shot dead by police as they came out of the church. One of them had tried to travel to Syria twice in 2015.

In the evening of 14 July, a 31-year-old Tunisian, living in France, attacked Bastille Day celebrations in Nice by driving a truck for two kilometres through the crowds of people who had attended a firework display on the Promenade des Anglais. He killed 85 people, including 10 children, and injured 201, a number of them critically. The attacker fired a handgun at police before being shot dead. Evidence from mobile phones and computer records suggest that he may have planned his attack for up to a year. On 16 July, after 36 hours, IS claimed responsibility for the attack, however, at the time of writing no actual links had been confirmed. Vehicles have been used as weapons for attacks in France before, including the one in Valence in January and those in Dijon and Nantes in December 2014. These previous attacks however were relatively small scale compared to the Nice attack.

A similar soft target attack as in Nice took place on 19 December in Berlin, Germany. A truck was driven into a Christmas market in the city centre, killing 12 and injuring 56 people. The incident took place next to the Kaiser Wilhelm Memorial Church, an area heavily frequented by both tourists and locals. IS claimed responsibility for the attack through the A’maq News media outlet one day later, calling the attacker a “soldier”, who “carried out the attack in response to calls to target citizens of the international coalition”. The perpetrator, a 24-year-old Tunisian national, with a criminal record in Tunisia and Italy, had arrived in Europe 5 years earlier on the Italian island of Lampedusa and later travelled to Germany where he applied for political asylum. Prior to the attack, he made a video in which he pledged allegiance to IS and provided it to A’maq News. Three days later, he was shot dead after he attacked a police officer in Sesto San Giovanni, a suburb of Milan (Italy), during a routine check. Prior to that, he had passed the Dutch, Belgian and French borders on his way to Italy.

The attack in Berlin was preceded by a number of other completed, failed and foiled attacks in Germany in 2016. The first incident with a violent jihadist signature occurred on 26 February when a 15-year-old German girl of Moroccan descent stabbed and seriously wounded a police officer with a kitchen knife in Hanover. The incident occurred at the main train station, after two police officers had approached the girl and had asked her to present her identification papers. After her arrest police found that she was also carrying a second – larger – knife. The girl had travelled to the Turkish-Syrian border in November 2015 to join IS, but had returned to Germany on 28 January 2016.

On 18 July a 17-year-old Afghan refugee attacked passengers with an axe and a knife on board a train heading to Würzburg in southern Germany. Five persons were seriously wounded. The attacker fled the train but was chased by officers who shot him dead. The perpetrator appeared to have travelled to Germany as an unaccompanied minor in 2015. A video released by IS claims to show him delivering a speech in Pashto to the camera while holding a knife. The video calls him “a soldier of the Islamic State who carried out the Würzburg attack”.

On 24 July a 27-year-old Syrian killed himself and injured 12 people – three seriously – by detonating a backpack bomb in Ansbach, near Nuremberg. It appears that the Ansbach Open Music Festival was the intended target. The perpetrator entered Germany in 2014 and applied for asylum but his request was turned down a year later; he was allowed to stay in Germany because of the ongoing war in Syria. He was known to police, had tried to kill himself twice before and had been in psychiatric care. The IS-linked A’maq News agency stated that the attacker was an IS soldier, responding to the group’s calls to target countries of the US-led coalition against IS in Syria and Iraq.

On 22 March Belgium was struck by two large-scale terrorist attacks. Both attacks were coordinated and carefully prepared with a high level of sophistication and logistical support. In the first attack two suicide bombers detonated improvised explosive devices in the check-in area of Brussels Zaventem Airport, causing the death of 11 people. In the second attack, approximately one hour later, an improvised explosive device was detonated by a third suicide bomber in the middle carriage of a metro train at Maelbeek station (close to several European Union institutions). Two surviving attackers were subsequently arrested.

One of the suicide bombers at the airport had been involved in an earlier attempted robbery at a currency exchange office and a subsequent shootout with police that left one officer injured, for which he was sentenced to 10 years in prison but was paroled in 2014 under the condition that he did not leave the country. The suicide bomber in the metro train was earlier convicted of several carjackings, possessing a number of Kalashnikov rifles, and a 2009 bank robbery and kidnapping. All five were connected to the network that organised and executed the November 2015 Paris attacks. A total of 32 people were killed and 340 people injured in the attacks.

Later in the year Belgium faced two other terrorist attacks that were carried out without the impact and sophistication of the Brussels attacks (international travel, safe houses, use of false documents, manufacturing of explosives), but were nevertheless serious. In August in Charleroi, two police officers, both female, were attacked with a machete outside a police station. Both officers were wounded severely, but not life-threatening. The suspect was a 33-year-old Algerian, who had been living in Belgium since 2012 and was known to the police for criminal offences, but had not been linked to terror activities before. He was shot by a third officer who was nearby and subsequently died of his wounds. On 7 August IS claimed responsibility for the attack, calling it a reprisal carried out by one of its ‘soldiers’. In October two police officers were stabbed in Schaerbeek, north-east of Brussels, by a 43-year-old Belgian national. The assailant was stopped by a second group of police officers. He broke the nose of one officer, who shot him in the leg.

Apart from completed attacks there were a number of failed and foiled terrorist attacks and arrests on suspicion of terrorist activities. Two plots that could have had a significant impact in terms of loss of life if they had not been stopped in time are included here by way of examples. One was thwarted In France, the other in Germany.

In March a French national was arrested in the Argenteuil suburb of Paris, in what was believed to be the advanced stages of preparation for a terrorist attack. The arrested individual was believed to be part of a terrorist network that planned to commit an attack in France. The suspect had already been found guilty in absentia by a Belgian court and sentenced to 10 years in prison for ties to a jihadist network in 2015. Police seized 2 kilograms of the explosive TATP and a Kalashnikov rifle, and also found materials to make more explosives.

In June German police arrested three alleged IS members of Syrian nationality, on suspicion of plotting a terror attack in Germany. The three were caught separately in different cities. It was believed that the men had received orders from IS leadership to attack the city of Düsseldorf using suicide vests, explosives and rifles. The plan was allegedly for two men to blow themselves up in central Düsseldorf before other attackers would kill as many people as possible with firearms and explosives.

In 2016 EU citizens were killed in IS attacks outside the EU.

On 12 January, 10 German tourists were killed in a suicide bomb attack in Istanbul (Turkey). This was one of seven fatal attacks in Turkey attributed to IS in 2016. On 1 July nine Italian citizens were amongst the victims who lost their lives in Dhaka (Bangladesh) in an attack on a bakery located in an area near embassies, for which IS claimed responsibility (this was later disputed by Bangladesh’s minister of home affairs, who stated that the perpetrators belonged to Jamaat-ul-Mujahideen).

The high numbers of failed, foiled and completed jihadist attacks in 2016, and the equally high numbers of arrests of terrorism suspects, indicate a continued threat towards countries of the EU, and those Member States of the EU that are part of a coalition against IS in Syria/Iraq in particular. Therefore the threat of jihadist terrorism is not perceived equally amongst Member States, of which the majority have not been confronted with jihadist terrorist activities at all in 2016, nor in one of the preceding years. These countries might be used for transiting of foreign terrorist fighters, (potential) jihadists or returnees, or unintentionally providing for a safe haven for them. These and other factors, however, including perceived insults to Islam, may influence potential risks. Switzerland for instance, not being an EU Member State and not being part of a coalition against IS, is aware of its vulnerability to jihadist terrorism by association with other Western countries and its international profile.

Incitement of lone actor attacks in the West

Since the IS announcement in June 2014 that it had re-established the caliphate, the group claimed that all Muslims were under the religious obligation to join it. It was alleged that, by doing so, they would re-enact the historical migration (Hijrah) of Prophet Muhammad to Medina in 622 AD to evade persecution in Mecca. The group declared that refusal to join it was proof of apostasy from Islam. In 2015 IS insisted that the only excuse for Muslims for not joining the group in the territories under its control was to perpetrate a terrorist attack in their places of residence.

As military pressure on IS increased and measures to prevent potential recruits from reaching IS-controlled territory became more effective, IS adapted its recruitment tactics. It now declared that perpetrating a terrorist attack in the West was even preferable to travelling to join IS. In a speech released on 21 May 2016, IS spokesman Abu Muhammad al-Adnani, who was subsequently killed in August 2016 near Aleppo, urged volunteers that were prevented from travelling to join IS to perpetrate attacks in their places of residence. IS supporters, in particular in the United States and Europe, should carry out attacks with any means available during the month of Ramadan (6 June to 5 July 2016). Al-Adnani stressed that even the smallest attack in the West would have a great impact, as it would terrorise the enemy.

The increased efforts to incite IS sympathisers in the West to perpetrate attacks were reflected in practical guidance for lone actor attacks provided in IS publications. The IS multi-language magazine Rumiyah (See section on communication) contained a series of articles under the title “Just Terror Tactics”, which suggested terrorist attacks using knives, vehicles or arson, and gave tips on how to maximise the numbers of victims and impact. Perpetrators were admonished to leave some kind of evidence stating the motivation of the attack and allegiance to IS, such as a note attached to the victim’s body or a last will.

In 2016 IS preferred to claim lone actor attacks through its A’maq News Agency (See section on communication). Starting with the 12 June 2016 attack on a nightclub in Orlando, Florida, (US), A’maq News issued short messages labelling the perpetrators of lone actor attacks outside IS-controlled territory as “soldiers of the Islamic State”, generally adding that they acted in response to IS’s calls to attack citizens of anti-IS coalition countries. As a precautionary measure, most of these claims pointed out that the information was received by A’maq News from a “security [read intelligence] source”. The public tribute paid by IS to lone actor terrorists was a way to give incentives to other potential attackers, while placing responsibility for the success of the attack entirely on the perpetrator. A’maq News ’ claims for attacks were mainly released within 24 hours after the attack, except in the case of the 14 July 2016 attack in Nice, when the claim came two days later. It has been speculated that the IS leadership had no prior knowledge of the attack or that the delay was a deliberate strategy to create confusion and maximise media coverage.

In addition to the short statements by A’maq News, in several lone actor attacks in EU Member States in 2016, the perpetrators sent previously recorded video statements in which they justified their attacks and pledged allegiance to IS, which were published on the A’maq News website. The precedent for this strategy was set during the 13 June 2016 murder of a police officer and his wife in Magnanville near Paris. After killing his two victims, the perpetrator broadcast a video message live from the location of the crime through a social media service. The video was later re-published on the A’maq News website. In subsequent attacks, prior to the commission of the crime, the perpetrators recorded videos in which they announced and justified their attacks. These videos were published on A’maq News following the attack as proof of the attackers’ motivation. This strategy was used in the 18 July stabbing attack in a train headed to Würzburg, Germany; the 24 July bomb attack in Ansbach, Germany; the 26 July murder of a priest in St-Etienne-du-Rouvray, France; and the 19 December 2016 attack on a Christmas market in Berlin.

The increased efforts by IS to directly recruit vulnerable people via social media and incite them to perpetrate terrorist acts in their country of residence, seem to not be limited to male targets. Media reporting suggests that women were also targeted, as in the 26 February knife attack in Hanover by a 15-year-old girl. In addition, in early September, a cell consisting of three women was dismantled in Paris. They were suspected of having planted a car containing five gas bottles and a rudimentary ignition mechanism close to Notre Dame cathedral and planning further attacks. At least one of the suspects was reportedly in contact with a French male IS member thought to be in IS-controlled territory at the time. An attack on a police station by three women in Mombasa, Kenya, on 11 September was claimed by IS. Another cell of 10 women was arrested in Morocco in early October. In all cases, there are reports that the suspects were in contact with IS operatives.

IS ideology, as that of other jihadist groups, exempts women from the obligation to participate in armed action except for self-defence, but does not explicitly prohibit them from engaging in fighting. By implication, women may, if they so wish, carry out attacks on perceived enemies. At first glance, however, self-organised terrorist activities by women seem to be at variance with the strict gender segregation, the conscription of women to the closed circles of the family home and the extremely limited areas of activity outside of it, propagated in IS propaganda (See section on jihadist propaganda). As a result, IS propaganda does not address women directly, but does not explicitly exclude them from the obligation to fight either. The attack in Mombasa was commented upon in an article in the IS Arabic newsletter al-Naba’ (See section on communication), which described the attackers as “sisters supporting the Islamic State”, not as “soldiers”. The known cells seem to have consisted only of women, which might be linked to the obligation of gender segregation.

Resurgent al-Qaeda

In 2012, already before the emergence of IS, al-Qaeda had redesigned its strategy to ensure its survival under the changed political circumstances following the Arab rebellions: al-Qaeda would merge with the population to the extent possible; cooperate with other Muslim groups based on common interests; and administer territories that fell under its control in a way so as not to alienate the population. The aim was to create safe havens from which al-Qaeda could plan and execute attacks on Western targets. The intransigent behaviour of IS toward local populations made the implementation of this new strategy even more pressing for al-Qaeda in an effort to mark the difference to its opponent.

In 2016, al-Qaeda spent great efforts to refute the legitimacy of IS’s claim to leadership of all Muslims. Al-Qaeda’s nominal head, Ayman al-Zawahiri, disputed in several audio and video messages the legitimacy of IS’s declaration of the caliphate. In a May audio speech, he urged Muslims in Syria to unite and build a true caliphate. He asked Muslims and the different fighting factions in Syria to trust its local affiliate Jabhat al-Nusra with the future of the Levant. (For developments in Syria concerning Jabhat al-Nusra, see section on Syria). He exhorted opposition groups in Syria not to let the country fall into the hands of Shi’is, secularists or IS.

At times, the new rhetoric adopted by al-Qaeda seemed to pick up on demands for representative government formulated during the Arab rebellions. In a video message commemorating the 15 th anniversary of the 11 September 2001 attacks, for example, Ayman al-Zawahiri stated that the 2001 attacks were meant to “restore the equilibrium” between Muslims and the West. The attacks were claimed to be a reaction to the West’s alleged crimes in the Muslim world. With al-Qaeda’s support, he claimed, the Arab revolutions would acquire an Islamic character and form the nucleus of an assembly that would be able to elect a caliph in the future. He said that the Muslim community had the right to choose, hold responsible and depose its leader. At the same time, he rejected negotiations; only armed struggle could bring a solution.

In most of its material published in Arabic language, al-Qaeda tends to downplay its international aspirations. By contrast, al-Qaeda communication targeting audiences in the West contains views and calls for action very similar to those of IS. This is likely to be an attempt to benefit from the gradual decline of IS communication with the aim of again gaining ascendency in the global jihadist movement. Interestingly, in doing so al-Qaeda copied successful propaganda formats developed by IS.

The competition with IS for leadership in the global jihadist movement was apparent in the 2016 publication of a new issue of al-Qaeda in the Arabian Peninsula’s (AQAP) Inspire magazine. The 16 th issue of Inspire, released on 12 November, praised three lone actor attacks in the US on 17 September 2016 (one of which was claimed by IS), likening them to the 11 September 2001 attacks. It provided instructions on how to build IEDs, justified lone actor attacks in the West, and incited minorities (African Americans) to act.

In addition to the continuation of the Inspire magazine, AQAP introduced a new format, the Inspire Guides - short commentaries on completed and foiled attacks in the West with recommendations for future attacks. The first such document was released on 23 June 2016 and analysed the 12 June 2016 attack on a nightclub in Orlando, Florida, US. While praising the attack for the good planning and execution, it advised that future attacks should target places mainly frequented by white Anglo-Saxon people, who allegedly hold power in the US, rather than places that are popular with sexual or ethnic minorities. A second edition on 21 July 2016 praised the IS-linked attack in Nice, France, a week earlier. It recommended that the perpetrator should send a message so that the people may know and understand his motives. In a comment on the arrest of a female IS-linked terrorist cell in Paris in early September, Inspire Guide insisted that women be prevented from conducting terrorist attacks. By contrast, with regard to the three 17 September attacks in the US, an article labelled as an Inspire Guide in the November issue of Inspire gave practical instructions on how to maximise the impact of lone actor attacks in the West.

EU citizens kidnapped or killed

Terrorist and armed criminal groups continue to consider citizens of the EU and other western countries as highvalue targets for kidnapping. This is because ransom money is a significant source of revenue for some groups; the extensive media attention attracted by western hostages can be exploited for propaganda and political pressure; and hostages can be used in prisoner swaps. It is assessed that militant groups do not select individuals of specific nationalities but target their victims opportunistically.

The total number of abducted EU citizens is difficult to estimate due to the fact that not all the kidnapping incidents are reported for reasons related to the security of the hostages. In 2016, the kidnap threat remained very high in and around conflict zones, as well as in areas with little or no governmental control. Incidents involving the kidnapping of westerners occurred in Libya, Mali, Afghanistan and the Philippines. In addition, Syria, Iraq and Yemen remained high-risk countries, although no abductions were reported in their territories in 2016.

Al-Qaeda in the Islamic Maghreb (AQIM) has been very active the regions of Maghreb and the Sahel. In January, AQIM militants abducted a Swiss female missionary in Timbuktu (Mali). Shortly after, the group posted a video online demanding, inter alia, the release of its fighters held in Malian prisons, as well as of a member of Ansar Dine (supporters of the religion), who was at that time standing trial at the International Criminal Court in The Hague. A second video was released in June as proof of life. The hostage was still in the hands of AQIM at the time of writing. AQIM also continued to hold a British–South African and a Swedish hostage, who were kidnapped from a restaurant in Timbuktu in November 2011.

In the same region, a Romanian citizen that was abducted in April 2015 in the border area between Burkina Faso, Mali and Niger, remained in the hands of his captors in 2016. The kidnapping was claimed, in May 2015, by a faction of al-Murabitun, which at the same time pledged allegiance to IS. In October 2016, al-Qaeda in the Islamic Maghreb (AQIM), with which the rest of al-Murabitun had merged in late 2015, posted a video statement online, said to have been recorded in late September, in which the hostage stated that he was in good health and pleaded to the Romanian government to do everything for his release. The release of the video by AQIM coincided with the faction responsible for the kidnapping reiterating its pledge to IS. Thus, the hostage seems to have become an object of dispute in the conflict between IS and al-Qaeda in the region. Romania reported that the Burkina Faso government did not receive a request for ransom.

In Libya, IS and other militant groups continued to take advantage of the instability of the country and carried on with their terrorist and criminal activities. In March 2016, two Italian employees of a construction company were killed in the area of Sabratha, during a fight between Libyan security forces and their captors. They had been abducted by IS in July 2015 near the towns of Zwara and Mellitah, along with two other Italians who were held in a different location and managed to escape, also in March 2016. IS militants still hold an Austrian and a Czech national, who were abducted in March 2015 from an oilfield in Zalla, along with seven more people from Ghana and the Philippines. In Ghat, south-western Libya, a local armed group kidnapped two Italian employees of a construction company in September 2016 and released them in November. No details regarding their abduction or release have been disclosed.

In the Philippines, the terrorist group Abu Sayyaf continued to carry out kidnappings. In April, its members killed a British–Canadian and in June a Canadian hostage. Both men had been abducted in September 2015, along with a Norwegian and a Filipino, from a resort in the southern Philippines. The Norwegian man remained captive at the time of writing, whereas the Filipino was released in June 2016. Abu Sayyaf militants were also behind the kidnapping of a German man and the murder of his wife while they were sailing off the southern Filipino coast in November. They demanded a ransom of PHP 30 million (EUR 565 000) but consequently killed the hostage. In February 2017, a video was posted online that appeared to show the execution. An Italian citizen abducted by Abu Sayyaf militants in October 2015 in the city of Dipolog was released in April 2016. The hostage was held on the island of Jolo, the stronghold of the terrorist group, where he spent his captivity with other hostages.

In Syria in May, Jabhat Fath al-Sham (former Jabhat al-Nusra) released three Spanish journalists that were abducted near Aleppo in July 2015. The group also claimed it freed a German woman and her baby in September 2016, denying it was responsible for her kidnapping. The woman had been abducted in October 2015. These releases are assessed to be part of the group’s attempts to distance itself from IS practices.

A British journalist held hostage by IS since November 2012 continued to appear in propaganda material. He featured in two IS videos released in December 2016.