Salafi-Jihadi Movement Weekly Update, March 29, 2023

To receive the Salafi-Jihadi Movement Weekly Update via email, please subscribe here. Follow CTP on Twitter, LinkedIn, and Facebook.

Data Cutoff: March 29, 2023, at 10 a.m.

Contributor: Sophie Small

Key Takeaways:

Iraq and Syria. ISIS remains a viable insurgency in Syria that aspires to reestablish a territorial caliphate. The US presence in Syria enables the Syrian Democratic Forces (SDF) to maintain sufficient pressure to prevent ISIS’s insurgency from increasing in strength rapidly, but deficiencies in the SDF’s capabilities and a lack of coordination with counterinsurgent forces in regime-held Syria means the SDF is unlikely to be able to defeat ISIS. The SDF remains the most reliable counter-ISIS partner for the United States in Syria. The Syrian regime is incapable of containing ISIS and often tacitly allows ISIS resurgence in select areas.

Somalia. Al Qaeda’s Somali affiliate al Shabaab has retained its vehicle-borne improvised explosive device (VBIED) capabilities in central Somalia, which could help it overturn recent counterterrorism gains. The group will likely continue manufacturing VBIEDs because Somali counterterrorism forces cannot adequately disrupt its supply chains and likely lack the capacity to degrade its havens in the area as the government gives more priority to opening a second front in southern Somalia. Al Shabaab will likely use VBIEDs to target and overrun vulnerable holding forces. Meanwhile, seasonal flooding in Somalia could affect the timeline and scope of the next phase of the Somali Federal Government’s (SFG) offensive in southern Somalia.

Mali. An al Qaeda–linked shadow governor in northern Mali indirectly threatened to attack the US, UK, and EU countries, underscoring the transnational Salafi-jihadi threat emanating from the Sahel. CTP continues to assess that the al Qaeda–linked group in the Sahel is unlikely to pursue transnational attack targets in the West in the near future, although there are signs and past patterns that indicate this could change. The group’s growing freedom in northern Mali increases its ability to host and support transnational attack cells, should it choose to pursue such aims.

Pakistan. The integration of new groups into the Tehrik-e-Taliban Pakistan (TTP) could foreshadow TTP attacks in high-population areas, which would likely have a more deadly and destructive effect and pressure the Pakistani military to respond. The TTP has increasingly integrated independent jihadi groups into its fold since December 2022. The groups likely have not previously played a major role in TTP, unlike TTP splinter groups that rejoined it between 2020 and 2021. However, the location in which the new mergers operate poses a challenge to the Pakistani government.

Afghanistan. The Taliban supreme leader removed the Taliban minister of finance, which may open new rifts in the Taliban’s traditional support base. The Taliban supreme leader’s efforts to form his own military forces may exacerbate concerns he is monopolizing power and further escalate Taliban government infighting.

Assessments:

Iraq and Syria. During a House hearing on March 23, US Central Command Commander Gen. Michael Kurilla said ISIS would return as an effective military organization within one to two years without a US presence in Syria, in line with previous CTP assessments.[1] The US presence in Syria enables the SDF to contain ISIS and the group’s insurgency at a low level. The United States provides intelligence, surveillance, and reconnaissance training and special operations capabilities to the SDF that improve the SDF’s effectiveness in containing ISIS.[2] A US withdrawal would strip the SDF of those enabling functions, exacerbating its capabilities to target key ISIS leaders who plan sophisticated attacks and run ISIS’s military organization. This would allow ISIS to rapidly reconstitute its military strength within one to two years, as highlighted by Kurilla.[3]

ISIS remains a viable insurgency in Syria that aims to create a territorial caliphate in Iraq and Syria. ISIS is not merely a terrorist organization coordinating attacks against the West, even though the group continues to use Syria to plan external attacks and coordinate its global movement.[4] ISIS is also attempting to impose its governance on the population along the Euphrates River in Deir ez Zor by collecting zakat, enforcing dress codes, encouraging defections from the SDF, and assassinating SDF fighters who do not comply with ISIS’s orders to defect.[5] ISIS previously coerced defections from the Iraqi Awakening Movement under threat of assassination during its reconstitution in Iraq in the early 2010s.[6]

The SDF faces constraints on its counter-ISIS operations caused by external factors and capability limitations. The SDF prioritizes threats to Kurdish communities in northeastern Syria from Iranian-backed militias, the Syrian regime, and Turkey over joint efforts with the United States to counter ISIS.[7] The SDF paused counter-ISIS operations during heightened tensions with Turkey in December 2022, allowing ISIS to reconstitute.[8] Iranian and regime-backed militia sleeper cells also attack SDF personnel throughout northeastern Syria, unintentionally assisting ISIS’s own campaigns.[9]

The SDF also faces significant limitations, particularly in Arab-majority areas. SDF counterinsurgency approaches often involve arbitrary arrests and looting or unnecessary destruction of private property.[10] Some SDF commanders avoid punishment for abuse of local civilians.[11] Grievances caused by these actions inadvertently assist ISIS’s ability to cultivate support and strengthen the group’s insurgency. A lack of coordination between the SDF and the Syrian regime across the line of control between northeastern Syria and regime-controlled Syria also imperils the SDF’s ability to defeat or destroy ISIS. The SDF and the regime intermittently fight over smuggling routes along the line of control.[12] Fighting between the two parties inhibits their ability to coordinate to secure the Euphrates. ISIS is capable of retreating to regime-held Syria across the Euphrates River when under significant US and SDF pressure.

The Syrian regime and its partners are exponentially less capable than the SDF, despite the aforementioned factors. The Syrian regime is incapable of conducting effective counterinsurgency operations that would contain ISIS and often tacitly allows ISIS resurgence in select areas. The ISIS caliph was inadvertently discovered in southwestern Syria, two years after the Syrian regime claimed it had cleared southwestern Syria of ISIS.[13] The regime has historically enabled ISIS’s resurgence in select areas—including Deraa province—to undermine anti-regime elements and support regime narratives.[14] A US withdrawal from Syria would allow the regime and its partners to move into northeastern Syria.[15] The regime would replicate the behavior it demonstrated elsewhere in Syria, moving to eliminate opposition forces by any means necessary, including tacit cooperation with ISIS. Local groups accused the regime of permitting ISIS freedom of movement in southwestern Syria in fall 2022.[16]

Figure 1. ISIS Activity in Syria

Note: Some of the locations on this map are approximate. CTP defines “attacks” as kinetic activity, including assassinations, armed assaults on military positions, executions, and bombings. “Activity” includes all forms of ISIS activity, including attacks, force movements, and reports of governance activity like zakat collection. ISIS does not generally report on these non-kinetic activities and does not claim all of its attacks.

Source: Brian Carter.

Figure 2. The Salafi-Jihadi Movement in the Middle East

Source: Kathryn Tyson.

Somalia. Al Shabaab has maintained its VBIED capabilities in central Somalia, despite the group’s losses during the SFG’s offensive between June 2022 and January 2023. Al Shabaab launched a complex attack using a suicide vehicle-borne improvised explosive device (SVBIED) that overran a local militia base on March 21.^[17] The group had not used VBIEDs in central Somalia since conducting a series of coordinated attacks in January 2023.^[18] Al Shabaab likely used explosives and materials stored in areas Somali forces now control or contest in the January attacks, given the close proximity of the attacks to when Somali forces entered areas with known al Shabaab weapon stockpiles.^[19] The gap between the January VBIED surge and the March attack infers that al Shabaab has retained the expertise and logistical resources necessary to build VBIEDs in central Somalia despite the SFG offensive.

Al Shabaab will likely maintain its VBIED capabilities in central Somalia because the SFG cannot sufficiently disrupt its supply chains or degrade havens where the group constructs VBIEDs. Al Shabaab primarily acquires explosive material and other weapons via smuggling networks that run throughout the country and extend to the Gulf of Aden.^[20] Corruption and al Shabaab infiltration have severely restricted the SFG’s ability to disrupt these smuggling networks, even when they operate out of seaports in major government-controlled cities.^[21] Al Shabaab also gets smaller amounts of explosive material when looting the bases it overruns.^[22] The SFG also is opening a new front in southern Somalia, which likely will reduce its capacity to take and hold territory crucial to al Shabaab in central Somalia.[23]

Al Shabaab’s VBIED capabilities could enable the group to recoup some of its losses in central Somalia. Al Shabaab has historically used SVBIEDs to breach security-force bases.^[24] The SFG has relied on a mix of Somali National Army troops and clan militia that are ill-prepared to defend against these attacks to serve as holding forces in central Somalia.^[25] These forces are susceptible to al Shabaab SVBIED attacks, given they have comparatively less training, worse equipment, and more limited access to drone support than Somali special forces, which al Shabaab has overrun using the SVBIED tactic as recently as January 2023.^[26] The March 21 attack demonstrated the holding forces are vulnerable to complex al Shabaab attacks involving SVBIEDs.^[27]

Figure 3. Somali Forces and al Shabaab Conflict in Central Somalia: January–March 2023

Source: Liam Karr and the Hiraal Institute.

Southern Somalia. The early arrival of Somalia’s rainy season and the resulting flooding could delay the next phase of the SFG’s offensive in southern Somalia. Somali and international officials have reiterated that Somali forces will launch phase two of its offensive in southern Somalia soon.^[28] Somali officials have branded the impending campaign as a Ramadan offensive, and the Somali president officially announced the beginning of the campaign on March 26, although there has been no discernable increase in operations.^[29] Heavy rain in southern Somalia and Ethiopia in the last weeks of March has caused flash flooding along the Jubba River in southern Somalia.^[30] Somali officials warned that additional rain in the forecast will lead to sustained high river levels and may result in additional flash floods along the river.^[31] Previous floodplains in central Somalia indicate that these floods will affect government-controlled roads and towns that Somali forces use in the Lower Jubba region.^[32]

The flooding could present an opportunity for Somali and Kenyan forces to target al Shabaab–controlled territory near the Kenyan border. Previous floodplains also indicate the flooding will affect al Shabaab’s logistical and administrative centers in southern Somalia along the Jubba River, which could hinder al Shabaab’s ability to move forces and supplies around southern Somalia.^[33] If true, these restrictions would make al Shabaab havens in the Badhadhe district along the Kenyan border more isolated and vulnerable.^[34] Somali forces in Lower Jubba could focus on these areas with Kenyan forces, who agreed to participate in offensive operations in January 2023 but have not yet arrived in Somalia.[35]

Figure 4. Al Shabaab Infrastructure and Floodplains in the Lower and Middle Jubba Regions

Source: Liam Karr, UN Office for the Coordination of Humanitarian Affairs, Food and Agriculture Organization of the UN: Somalia Water and Land Information Management.

Mali. A recent statement from a regional al Qaeda–linked shadow governor underscores that al Qaeda–linked militants in the Sahel could generate a transnational attack threat to the US and Europe. During an interview with an African news blog released on March 22 but dating to February 2023, a shadow governor from al Qaeda’s Sahelian affiliate Jama’at Nusrat wa al Muslimeen (JNIM) threatened to attack any country that fought alongside French and Malian forces.^[36] The shadow governor explicitly mentioned the defunct European-led Task Force Takuba and the United Nations mission in Mali as key French partners.^[37] This statement justifies attacks on several Western countries, including the US, UK, and numerous EU countries. The shadow governor’s position diverges from the public stance of the al Qaeda in the Islamic Maghreb (AQIM) emir, who reasserted that JNIM is not preparing for external attacks outside of the Sahel and Africa in an interview released on March 6.^[38]

CTP continues to assess that JNIM is unlikely to pursue transnational attacks targeting the West in the near future.^[39] It is more likely that JNIM will use northern Mali to support al Qaeda’s activities in neighboring regions—such as the Gulf of Guinea or North African states—where it is less likely to draw a harsh Western response and has preestablished networks.^[40] However, there are several indicators that JNIM has transnational aims. It remains affiliated with AQIM, has encouraged global attacks, and has not disavowed global jihad like the former al Qaeda affiliate in Syria.^[41] Past patterns also show that groups can rapidly pivot from local to transitional aims and that numerous factors push local groups to pursue or support transnational attacks.^[42]

JNIM’s alliances with militia groups in northern Mali will create havens that could host transnational attack cells as JNIM establishes growing sanctuary in the area. During the interview, the JNIM shadow governor oversees northern Mali’s Kidal region and confirmed that the group has a nonaggression pact with former separatist rebel militias and pro-government militias in northern Mali.^[43] Multiple sources reported that the JNIM emir had met with leaders of the militias in January 2023 to create a united front against the Islamic State affiliate in the region, which has expanded deeper into northeastern Mali since the withdrawal of French forces in 2022.^[44] This is the first time a JNIM official has confirmed the existence of such arrangements. The pact confirms that JNIM is emerging as the primary power broker in northern Mali. The Malian government’s absence from northern Mali makes JNIM the only security partner against Islamic State violence, and JNIM’s strength relative to other actors in northern Mali will likely encourage continued cooperation even if the Islamic State threat subsides.^[45]

JNIM Hostage Release. JNIM released an American aid worker and French journalist to Nigerien forces on March 20.[46] The al Qaeda–linked militants had held American Jeffery Woodke since 2016 and Frenchman Olivier Dubois since 2021.[47] Top Nigerien military and political officials played a key role in negotiating the release of the hostages.[48] Previous hostage negotiations with the al Qaeda–linked militants have involved ransoms and prisoner exchanges.[49] The American, French, and Nigerien governments denied that they had paid any ransom or released prisoners.[50]

Figure 5. The Salafi-Jihadi Movement in Africa

Source: Kathryn Tyson.

Pakistan. The integration of new groups into the TTP could foreshadow TTP attacks in high-population areas, which would likely have a more deadly and destructive effect than in other areas and pressure the Pakistani military to respond. The TTP has increasingly integrated independent jihadi groups into its fold since December 2022. Nine militant factions have joined the TTP since December 2022.[51] These mergers represent a third of the total number of mergers into the TTP since July 2020. The TTP released statements announcing these mergers and included pictures of the alleged pledges. CTP cannot verify which groups are joining.

The recent pledges signal that the TTP continues to successfully unify various Pakistani militant groups under its umbrella.[52] There is no publicly available information on the groups’ commanders, suggesting they did not lead factions that previously belonged to the TTP or played influential roles in the TTP. In contrast, previous mergers of TTP splinter groups led by TTP cofounders in 2020 significantly strengthened the group and led to a steep increase in TTP attacks.[53]

The areas where the newly integrated groups operate pose a challenge to the Pakistani military. Several of the groups operate out of densely populated areas, such as Domel in Bannu district. One operates in Bara, a highly populated city near Peshawar that serves as a base for major military subdivisions such as the Peshawar XI corps. Some of these areas also contain fertile land for agricultural production, which Pakistani security forces help secure.[54] These areas are important for Pakistan, as the country is facing an economic crisis and food shortages.[55] The Pakistani military may face more pressure to address TTP activity in these regions compared to several groups in areas in North Waziristan that have also made pledges, which is mountainous and sparsely populated. The TTP has already expanded attacks into population centers with major military infrastructure. The TTP carried out two large-scale attacks in Peshawar and Karachi in January and February respectively and could use mergers to carry out similar attacks.[56]

The likely TTP killing of a senior Pakistani Inter-Services Intelligence (ISI) official on March 20 will also put pressure on Pakistan to take more direct action against the group. This was the second attack on a senior ISI official since January 2023, which the TTP claimed.[57] The TTP may have killed the leader because of his involvement in peace talks between the TTP and Pakistan, which some members of the TTP oppose.[58] The attack demonstrated that the TTP may have known where the official was traveling and when, suggesting the TTP may have inside links to the forces guarding the official.[59]

Afghanistan. Taliban Supreme Leader Hibatullah Akhundzada reassigned the Taliban Finance Minister Hidayatullah Badri to be the head of Afghanistan’s central bank on March 22, after they fought over the distribution of financial resources from Ministry of Finance.[60] Akhundzada was reportedly withdrawing funds from the Finance Ministry to create a new military force composed of Akhundzada’s Noorzai tribe members.[61] Badri also complained about the Taliban government destroying drug labs controlled by Badri’s Ishaqzai tribe.[62] Badri is an important leader among the Ishaqzai tribe and played a crucial role organizing revenue collection during the Taliban insurgency.[63] This effort reportedly empowered Akhundzada's Noorzai tribe at the expense of Badri’s Ishaqzai tribe.[64] Both the Noorzai and Ishaqzai Pashtun tribal communities are important traditional support bases for the Taliban movement.[65] Akhundzada’s recent actions sidelining Badri and targeting the Ishaqzai tribe could lead to new intra-Taliban rifts in its traditional support base.[66]

Other factions beyond the Ishaqzai tribe are agitating against Akhundzada’s efforts to concentrate power. Taliban leaders aligned with the Haqqani Network broke the arm of a minister close to Akhundzada in a March 23 physical altercation.[67] The leader of the Haqqani Network publicly issued a rebuke of Akhundzada for monopolizing power within the Taliban government on February 11.[68] Akhundzada's formation of his own military forces could exacerbate the Haqqani Network’s concerns that Akhundzada is monopolizing power in the government and escalate Taliban infighting.

Figure 6. The Salafi-Jihadi Movement in Central and South Asia

Source: Kathryn Tyson.