Executive Summary

Download the report here.

America’s counterterrorism strategy risks becoming irrelevant to the new reality. It misconceptualizes the enemy as a set of discrete groups and individuals to defeat and kill. It wrongly emphasizes a kinetic approach to addressing the threats these groups pose to American interests and the homeland. It underestimates the importance of the Salafi-jihadi movement that persists beyond the defeat of specific threat groups. It does not account for the global movement’s reprioritization of its efforts since the outbreak of conflict in the post–Arab Spring environment and its reorganization on the ground.

The Salafi-jihadi movement’s ability to evolve according to circumstances, adapt to US counterterrorism policies, and learn from failures has generated key adaptations that will continue to challenge the current US approach to fighting al Qaeda, the Islamic State, and any other like-minded group. Adaptations include:

• Limiting the effects of a decapitation strategy by focusing on operational security, decentralizing, and delegating decision authorities.
• Avoiding publicly affiliating with or recognizing formal relationships with targeted groups such as al Qaeda and obfuscating relationships to confound a US policy predicated on identifying specific individuals and groups and to better avoid alienating local Sunni communities.
• Creating new groups ostensibly focused on local or regional objectives to distinguish them from groups that openly espouse global jihad objectives, such as al Qaeda or the Islamic State.
• Intermixing into local contexts and conflicts to co-opt insurgencies and capture local governance structures, blurring the line between the Salafi-jihadi base and local insurgent or militia groups and achieving local objectives in controlling governance.
• Creating plausible deniability in attack methods to limit or focus a Western response toward targets of lesser importance to the global movement.

These adaptations have enabled the Salafi-jihadi movement to expand into Sunni communities with little to no opposition from the West. The groups that have insinuated themselves into communi­ties—many through the exchange of basic goods or services for support—seek to gain local hegemony. Their expansion sets the movement on course to succeed in its overarching objective, which is to transform the Muslim-majority world according to its vision of governance and order, and strengthens the movement overall.

America’s counterterrorism framing of the threat does not address the full scope and scale of the Salafi-jihadi movement nor account for how the movement operates today. The current US approach to combating the threat from al Qaeda, the Islamic State, and others will continue to yield short-lived victories at the expense of winning the long war. Only by adapting to the new reality of the enemy and orienting on the full breadth of the Salafi-jihadi movement will the United States achieve any lasting success.

Download the report here.

Introduction

Battlefield innovation and adaptation are signatures of the Islamic State and al Qaeda. These groups creatively transform commercially available items into weapons, enabling them to cheaply wage lethal guerrilla-war campaigns against the most modern military in the world. They have devastatingly attacked the US and European homelands with such sophisticated weapons as box cutters. However, their evolutions and adaptations are not confined to weapons and tactics. The Salafi-jihadi movement of which they are part continuously adapts at all levels of war to changing circumstances on the ground, defeats, and new opportunities. It is an agile learning and adaptive organism.

The United States has also innovated rapidly and effectively on battlefields in Iraq, Afghanistan, Syria, Yemen, and elsewhere. However, American strategy and the intellectual and legal framework shaping it have stagnated. The US is not keeping pace with the strategic and operational transformations of the enemy, potentially putting America on the road to winning all the battles and losing the war.

The current strategic approach to defeating al Qaeda and other like-minded terrorist groups was developed in the aftermath of the 9/11 attacks and has changed little since then. It identifies specific groups and individuals responsible for planning or attacking American interests and attacks, usually with armed force, to capture or kill them. The armed force has been a mix of drone strikes, air and missile attacks, Special Forces raids, and military operations to clear and hold terrain almost always by, with, and through local partners. The US and its international partners also employ economic sanctions, counter-messaging, and counter-extremism programming, but almost invariably in subordinate roles.

The US preference for certain kinds of means has badly distorted America’s understanding of the enemy. Reliance on lethal operations requires precise definitions of licit targets on a bewilderingly complex battlefield. Successive American administrations have thus defined the enemy in the oversimplifying language of designated groups and individuals that facilitates legal review of targeting and warfighting. If the overall American approach were succeeding, this practice might not be so problematic, but the current strategy is failing.

Director of the National Counterterrorism Center’s Directorate of Strategic Operational Planning Lieutenant General Michael K. Nagata said in September 2018: “After 17 years of relentless kinetic action . . . the international forms of terrorism that we are most concerned about are more widespread today than when we’ve started . . . [and] doing [kinetic action] alone or just doing more of that is unlikely to get us the strategic results we truly desire.”[1]

The kinetically based approach has repeatedly yielded short-lived victories against particular groups but left in place the very conditions the groups need to return. Al Qaeda in Iraq thus resurrected itself in Iraq and Syria after the US withdrew forces from Iraq and the rise of Arab Spring opposition in Syria. Warnings of a second such return are already sounding about the Islamic State in Iraq after its most recent defeat.[2]

The oversimplification of the enemy into a series of discrete groups is the crack in the foundation of US counterterrorism strategy. America’s view of the enemy still centers on the terrorist threats that specific Salafi-jihadi groups pose to the United States homeland or American interests. It misses that these groups are part of a global movement that persists beyond the defeat of specific organizations or death of a set of individuals. It largely ignores the fact that the movement seeks to replace the governance systems of the Muslim-majority world, not primarily to attack America or Europe. Above all, it misses the important ways in which the movement has transformed in response to lessons it has learned from both its successes and its failures.

The American policy framework thus does not account for the Salafi-jihadi movement temporarily reprioritizating away from attacking Western homelands toward establishing itself in local communities within the Muslim world. This shift in the adversaries’ priorities has led many Western analysts to argue that the movement has been weakened or even defeated. This perception is wrong.

The Salafi-jihadi movement shifted to focusing on the local context over the global and to infiltrate and co-opt local governance structures by the end of 2011 because its primary objective has always been gaining control of and support from Sunni populations. Only when thwarted in that effort in the 1990s did the movement turn to attacking the US directly.

The Salafi-jihadi movement’s adaptations to current circumstances and counterterrorism pressures have positioned it to drive straight toward its core goals. Its leaders see the opportunity and are taking it. They are integrating lessons learned from their decades of fighting the US to facilitate that effort.

Salafi-jihadi leaders thus focus now on obscuring the connections between local groups and transnational organizations rather than highlighting them as they did in the past. This obfuscation makes the local base more acceptable to local populations and takes advantage of Western definitional errors to shield its fighters from direct counterterrorism pressure. Name changes, reorganization, and a focus on the local conditions helped conceal the true nature of Salafi-jihadi groups, and the concentration of specialized attack capabilities made those groups without specific expertise appear less threatening. The US has explicitly deprioritized disrupting or attacking groups that are digging deep into local communities, even though those groups pose tremendous long-term threats to American security at home and abroad. Salafi-jihadi adaptations and American failures to adapt are now letting the movement advance toward its objective of transforming Muslim societies from the inside, with little hindrance from the West.

Download the report here.

The Salafi-Jihadi Movement Properly Understood

Salafi-jihadi ideology coheres a global movement[3] by creating a unity of purpose among geographically disparate and organizationally distinct groups and individuals. The ideology defines a shared global outcome for its followers: the destruction of Muslim societies today through the use of force and the reification of its vision of a true Islamic society. Put simply, Salafi-jihadists believe armed conflict is the way to restore the Caliphate, unifying the umma (global Muslim community) under a single leader. Individuals and groups pursuing this end state at the local level each contribute to the strength of the global movement because these separate actions build into a global effort.

The global movement pulls together a cross-cutting network of groups, organizations, and individuals that share similar beliefs and constitute the primary support base for the movement. The ideology provides a framework and strategic doctrine for the base that allows it to continue to grow and organize. The Salafi-jihadi base spans the spectrum of interpretations within the movement from those who subscribe to and actively support the Islamic State’s global vision to those who prefer al Qaeda’s down to those who pursue only local objectives. The base has no rigid hierarchy (as seen in the Islamic State) or decentralized network (as seen in al Qaeda’s organization) nor is it a chaotic “leaderless jihad.”[4] All such structures coexist within the movement. It requires only the presence of Salafi-jihadi adherents to begin to emerge and establish itself—or to reemerge and reestablish itself once defeated in a given place.

The Salafi-jihadi movement’s goal is the reestablishment of the Caliphate and its expansion to become the single global political system with all humanity submitting to Allah under Islam as defined by Salafi-jihadis. The movement seeks to return Islam to the peoples who once lived under the former caliphate and to abolish secular governance starting in the Muslim world but ultimately around the globe. Islamic emirates united under a Caliph would replace the current states system. Once Muslim lands—dar al Islam—are again Muslim, then the Caliphate would expand into other lands, including the United States, in dar al harb (literally house of war) to replace those governments. The movement’s leaders have developed a phased strategy to achieve this end state by analogizing the phases of the life of the Prophet Mohammed into a strategic political and military doctrine.[5] This phased strategy is known as the Prophetic Method and is focused on transforming Muslim lands.

The transnational and global nature of the movement belies the importance of the local effort to Salafi-jihadis. The movement seeks to inspire, support, and win a series of local insurgencies in its name that replace current governments with Islamic polities, eventually transforming the Muslim world into a justly governed land under the rule of a Caliph.[6] It has thus sought to mobilize local groups in accordance with local objectives to spread shari’a-based governance and struggle against Western dominance.

Al Qaeda and then the Islamic State developed the capability to conduct mass-casualty attacks in the West in order to force Western states to retreat from the Muslim-majority world. These groups believed they could topple the local governments if only Western support were removed. Salafi-jihadis argue, in fact, that the terrorist attacks against the West are part of a defensive jihad that will enable them to succeed within the Muslim world.[7] They typically envision an apocalyptic battle (or series of battles) at a much later stage through which they will destroy non-Islamic governance globally. The movement generally grades itself on its ability to transform society locally rather than its ability to attack globally—the exact inverse of the way Western counterterrorism strategy is graded.

Ideological differences within the Salafi-jihadi movement have not stunted its growth. Salafi-jihadi religious scholars and leaders have actively debated the intricacies of the religion and their ideology since the movement’s start, but all agree on the basic tenets of Salafi-jihadism. They diverge over the permissibility of certain actions such as killing Muslims intentionally or unintentionally, who is considered Muslim, and the conditions under which certain actions—such as engaging in jihad—are either permissible or obligatory. Such disagreements manifest as organizational and operational frictions (most notably the friction between Jabhat al Nusra and the Islamic State in 2013–14[8]). They sometimes lead to intergroup violence and create local vulnerabilities. However, they have not weakened the movement globally.

The primary obstacle to the expansion of Salafi-jihadism has been its relationship with Sunni communities. These communities, which may be organized along geographic or tribal and family lines, have historically rejected Salafi-jihadi ideology for its extreme views that deviate radically from mainstream Muslim theology and practice. The movement first strengthened during the 1980s when Muslims mobilized to defend Afghanistan against the Soviet invasion and occupation. At least 10,000 fighters answered the calls of leaders such as Abdullah Azzam, a Palestinian religious cleric and key figure in the global Salafi-jihadi movement, to join the jihad. Azzam, Osama bin Laden, and others began to build and consolidate control over a global support network at this time.[9] The movement stagnated after the Afghan-Soviet war, however, and weakened as Salafi-jihadi groups failed to overthrow regimes in the early 1990s. Even al Qaeda, the covert organization Azzam and bin Laden established to guide the movement and umma, was unable to garner real popular support into the 2000s.

Isolated conflicts in the 2000s created opportunities for the Salafi-jihadi movement to expand, but only temporarily. The US invasions of Afghanistan and Iraq[10] sparked insurgencies that the Salafi-jihadi movement sought to infiltrate and dominate. In Iraq, the group that would become known as al Qaeda in Iraq conducted spectacular attacks and developed a network among Sunni insurgent groups, including Baathists and other non–Salafi-jihadi groups aligned against Iraqi Shi’a and the US presence. Al Qaeda in Iraq later oversaw the merger of Iraqi Salafi-jihadi groups in 2006 to form the Islamic State of Iraq (ISI), unifying the overall Salafi-jihadi effort in Iraq. Yet ISI’s tactics alienated key sections of the Sunni populations, and a shift in the US strategy facilitated a popular backlash against ISI. The US was similarly able to shift sentiments in Afghanistan. Coming out of the 2000s, the movement’s only lasting success was in Somalia where the Islamic Courts Union (ICU), a confederation of shari’a-based courts across south-central Somalia, replaced Somalia’s broken federal government. A US-backed 2006 Ethiopian invasion to topple the ICU fed a new insurgency that al Qaeda–backed al Shabaab, an ICU splinter group, dominated and won.

The movement applied lessons learned from failures in Iraq at the next opportunity, the widespread outbreak of conflict and social upheaval that started with the collapse of Arab strongman regimes in 2011. These exogenous events accomplished within a few years what al Qaeda and the Salafi-jihadi movement had been seeking for decades: the breaking of Sunni states. The Arab Spring helped create the conditions that the Salafi-jihadi movement needed to gain support from local Sunni communities. Spreading conflict placed the communities in peril—real and perceived. When no other actor stepped in to help at the local level, necessity drove Sunni communities to tolerate Salafi-jihadi groups in exchange for protection, dispute resolution, security, or even the provision of basic goods. In Syria, Yemen, Mali, Libya, and elsewhere, the movement moved gradually to win popular support first and then to build lasting roots within the communities. The remnants of al Qaeda in Iraq/ISI took the opposite lesson from its experience and, rather than capturing communities through a ground-up governance- and security-based approach, took a militaristic top-down approach that was even more extreme than it had tried in the mid-2000s.

Today, the Salafi-jihadi base includes the global organizations of both Qaeda and the Islamic State, their networks of affiliates and adherents, and groups and individuals that have remained separate from both. It is strongest in Syria, Yemen, West and East Africa, and Afghanistan-Pakistan but has notable presences in Iraq and parts of Turkey and Jordan, in the Maghreb, in Egypt where it is strengthening, in South Asia, and in parts of Russia. A global network connects these geographically diverse areas, formed in part through shared experience on the battlefield—from Afghanistan in the 1980s and up through current-day Iraq and Syria—and through technology.[11] Recovered correspondence and references in groups’ released statements give evidence of these connections. Salafi groups that operate predominately in the political domain, such as the Muslim Brotherhood, are not inherently part of the Salafi-jihadi base, but share the same envisioned end state. Individual members of these groups who provide support—facilitation, financing, recruitment, and other means—to Salafi-jihadists are part of the base.

---

Why Exclude the Muslim Brotherhood?

Both Salafi-jihadists and Muslim Brothers trace components of their ideology to Sayyid Qutb, an Egyptian Islamist ideologue and prominent member of the Muslim Brotherhood in the mid-20th century. He defended jihad bi saif (jihad of the sword or violent jihad) and stated unequivocally that Muslims must wage jihad to “take control of the political authority . . . to establish the Divine system on earth.”[12] The support for violent jihad remains within the ideology of the Muslim Brotherhood, and the group and its branches have engaged in violence to achieve their aims. Yet Muslim Brotherhood leaders have decided to pursue change primarily through political means and have gained a veneer of popular legitimacy over time—earning a furious and vitriolic diatribe by current al Qaeda leader Ayman al Zawahiri for betraying the cause. The rift between al Qaeda and the Brotherhood is real and should be exploited. Treating the Muslim Brotherhood and other political Salafis as enemies will make them enemies and may well drive them to cooperate with groups such as al Qaeda and the Islamic State.[13]

Avoiding a blanket labeling of the Muslim Brotherhood as an enemy leaves an avenue for Salafis to choose a political process over terrorist attacks. The idea is to keep those inclined to political means off the battlefield and, when possible, to leverage them against those who do use violence. Allowing political Salafis access to the political process will not ensure that they will stay out of power; Recep Tayyip Erdogan proves that it is possible to win politically and use that power to reshape the region to the benefit of Salafi-jihadis. The general unpopularity of the Salafist vision has led many of those who do win power at the polls ultimately to lose support, as Hamas in Palestine and the Brotherhood in Egypt both did, even before the military coup removed the Brotherhood from power.[14]

Similarly, exempting all members of the Muslim Brotherhood and other Salafis from prosecution or pressure simply because of they are part of a political organization is shortsighted. Their close ideological alignment with Salafi-jihadism makes it virtually certain that some individuals, cells, and small networks within the organizations provide support directly to Salafi-jihadis. Salafi-jihadi groups have sought to exploit this proximity. For example, al Qaeda wanted to stand up a Yemeni political party to build a pool from which to vet potential recruits. Many key individuals in al Qaeda were once part of the Muslim Brotherhood, including al Qaeda’s leader Ayman al Zawahiri.

The Muslim Brotherhood and other like-minded groups are a challenge that must be managed, but not an enemy so long as they avoid violent means. These groups can be convincing partners against would-be recruits to the Salafi-jihadi movement by providing an alternative to the violent ideology. The Muslim Brotherhood has not fully renounced violence, but it has chosen to pursue a nonviolent strategy in places such as Egypt because of the ground conditions. Younger Egyptian members are questioning this decision today, marking a fundamental shift in the Muslim Brotherhood toward pursuing a more violent approach.[15] If the Muslim Brotherhood or another Salafi political group shifted from a political approach to advocating outright violent jihad, it would become part of the Salafi-jihadi base. However, the US should not push for or support efforts to close the political space completely to these groups, which would almost ensure such a shift on a large scale.

---

The Salafi-jihadi movement’s expansion after 2011 may prove more enduring than its successes in the previous decade. Many obstacles that had impeded the movement’s spread are gone. Strongman regimes that had checked the spread of the movement through repressive tactics have collapsed. Many states are weaker and facing both internal and external pressures, lessening their ability to focus on countering the movement. Moreover, many states will continue to destabilize internally as conflicts protract and may export instability regionally. The Syrian Civil War, for example, has affected Syria’s neighboring states and driven regional conflict.

The spread of conflict has imperiled Sunni communities to a point where they have fallen back on the Salafi-jihadi movement as a last resort against what they perceive to be even worse options. In many places, the Salafi-jihadi movement has mixed with the local populations and in certain cases has replaced governance systems, making it difficult to differentiate between the local community and the local manifestation of the movement. The expanse of the movement and its integration into populations challenge current strategies to counter Salafi-jihadi groups and individuals because these strategies rely heavily on an enemy-centric approach.

Download the report here.

An Overview of America’s Counterterrorism Strategies Since 9/11

The strategies that America has pursued against al Qaeda and now the Islamic State over the past 17 years share general characteristics. Each president has refined and repackaged the US strategic approach to this fight, but the changes have been on the margins. The approach has relied heavily on a Special Operations Forces framework to identify threat groups and networks in order to find, fix, and finish them. The strategy has also included components focused on changing the environment to hinder the growth of terrorist groups and networks and to prevent their reconstitution. Broadly, the approach has been defined by:

• Kinetic Targeting. The US and its partners have hunted al Qaeda and Islamic State leadership globally to either kill or capture the individuals. In certain theaters, the US seeks to target the military forces of these groups in order to defend American or partnered forces from attack. The tactics employed include Special Forces raids and precision airstrikes from both manned and unmanned aircraft.
• Building Partner Capacity. The US has sought to improve the capabilities and capacity of counterterrorism partners on the ground to permit these forces to apply military pressure on al Qaeda or the Islamic State. The intent is for the local security forces to deny terrorist groups safe haven and prevent their reconstitution. In nearly all cases, the US has partnered with the central government and has pushed for counterterrorism cooperation on the military front, sometimes at the cost of longer-term institutional development or infrastructure investment.
• Counter-Threat Financing. The US (and the international community) leverages economic sanctions against designated individuals and groups in order to disrupt financial flows and raise the cost of their illicit activities.
• Foreign-Fighter Flow Disruption. The US has sought to improve the ability of states to disrupt foreign-fighter flows both at their source and in transit through border security and counter-radicalization programs.
• Counter-Messaging. The US identifies the ideology behind al Qaeda and the Islamic State as a source of strength for the groups and particularly as a recruiting tool. It has sought to disrupt and discredit these messages, as well as to equip partners to do the same, through counter-radicalization and countering violent extremism programs, though the effectiveness of these government programs is not clear.[16] The programs have ranged from theater-level efforts to promote democracy or the responsiveness of governments to grievances to hyper-local programs focused on specific imams.
• Reducing Drivers and Root Causes. The US has intermittently employed humanitarian and development assistance to undermine the drivers of radicalization or as a follow-on to a military operation. Targeted efforts seek to reduce specific grievances that enable recruitment.

Different US administrations placed varying emphasis on different elements, but the kinetic and enemy-centric approach to weakening Salafi-jihadi terrorist organizations remained dominant. More nuanced understanding of how the enemy groups operate generated refinements within the US lines of effort against them. In practical terms, the Department of Defense has been the lead agency in carrying out counterterrorism operations and working with counterterrorism partners, and the intelligence community has oriented on understanding specific individuals and networks.

---

US Responses to Attacks Before 9/11

US agencies sought to identify and then locate the individuals involved in the attacks. They then sought to detain and imprison these individuals—with the exception of the targeting of Osama bin Laden, who was under the Taliban government’s protection—to prevent them from committing more terrorist acts.

• 1993 World Trade Center Bombing. The United States pursued the individuals directly behind the attack, arresting or capturing and trying the cell of attackers, as well as the financier (Khalid Sheikh Mohammed) and mastermind (Sheikh Omar Abdul Rahman, died 2017). Those convicted for the attack received sentences that guaranteed they would die in prison. Al Qaeda and other groups with connections to the perpetrators skirted direct blame for the attack.
• 1998 East Africa Embassy Bombings. The bombings in Dar es Salaam, Tanzania, and Nairobi, Kenya, elicited a similar, though escalated response. Operation Infinite Reach—the codename for two cruise missile strikes that targeted al Qaeda compounds in Sudan and Afghanistan—was a preemptive, punitive strike against al Qaeda and an attempt to kill Osama bin Laden. The strikes against al Qaeda training camps in Afghanistan sought to eliminate space for al Qaeda to operate, though they did not deter future al Qaeda attacks. US Defense Secretary William Cohen said at the time: “Our message is clear. There will be no sanctuary for terrorists and no limit to our resolve to defend American citizens and our interests—our ideals of democracy and law—against these cowardly attacks.”[17]
• 2000 USS Cole The FBI investigated the attack in Yemen to identify the perpetrators for arrest and deportation. Similar to previous attacks, the cases followed a law enforcement approach, including indictments of the perpetrators and naming of coconspirators. The Bush administration pressured the Yemeni government to arrest and try individuals connected to the attack, who were sentenced to relatively short prison terms.[18]

---

The 9/11 attacks shifted American prioritization of counterterrorism activities to the point that counterterrorism dominated US foreign policy. Previous American responses—such as to the 1993 World Trade Center bombing, the 1998 East Africa embassy bombings, and the 2000 USS Cole bombing—had sought to uncover those responsible and the network of individuals that supported them and then make examples of the terrorists and their supporters. US actions stopped once the direct perpetrators were held accountable.

The Bush administration reacted differently to the 9/11 attacks by declaring the “war on terror” and seeking to eliminate terrorist safe havens globally, starting with Afghanistan. The Afghanistan and Iraq wars, which toppled the Taliban government and Saddam Hussein’s regime, and the insurgencies that followed in both countries consumed significant US military and intelligence resources. Yet outside those theaters, the US approach remained focused on determining whether a group or individual was responsible for or was planning an imminent attack against US interests. The Bush administration unleashed the intelligence community to unravel the complex al Qaeda network behind the 9/11 attacks and connect the dots to eliminate the possibility of from al Qaeda or another like-minded group launching an attack on US soil or against American interests. Recommendations from the 9/11 Commission Report continue to carry forward: deny sanctuaries, prevent radicalization, and protect against future attacks.[19]

The US approach to countering the Salafi-jihadi base has yielded fleeting results because the foundational understanding of the enemy is wrong. Military victories against groups such as al Qaeda in Iraq certainly eliminated the terrorist threat to the United States from that group for a time, but have proven insufficient to prevent the return of a threat. American and even international counterterrorism pressure has neither prevented the Salafi-jihadi base from expanding nor reduced the terrorism threat to the US homeland. The Salafi-jihadi movement has strengthened as ground conditions provide the means for Salafi-jihadi groups to insinuate themselves into Sunni communities and expand their popular base.[20] The gap continues to widen between the intelligence community and Special Forces community’s understanding of the threat and the authorities US departments and agencies have to counter the threat, as does the gap between those authorities and the actual counterterrorism policies the US has adopted. The enemy, meanwhile, has studied and adapted to these pressures as it adapts to the ground conditions in the Muslim-majority world.

Download the report here.

American Actions, Understood from Abroad

Salafi-jihadi leaders have been careful students of the United States, its inner workings, and specifically how the United States intends to defeat their groups. They are alive to the requirements of survival: that one must know one’s enemy in order to defeat it. The very lethality of the American counterterrorism effort has accelerated this learning—stupid jihadis do not live long. Salafi-jihadi leaders’ understanding of the United States provides insights into how they have then organized and acted against America.

Revelations from internal documents and correspondence show al Qaeda’s focus on studying the United States. Bin Laden amassed an extensive cache of US government publications, as American troops found in the Abbottabad compound. It included the 9/11 Commission Report; Congressional Research Service reports on al Qaeda, Iraq, and the war on terror; Department of Justice documents; and congressional reports, among others.[21] Media articles, think tank reports, books, and other material that would provide insight into the United States and how al Qaeda was being understood were also found at the compound.

A document discussing the Tunisian Arab Spring and how to replicate Tunisia across the Arab world declared: “Part of the war is undoubtedly to know our enemy. Know your enemy as we are at war. It is necessary that we know our enemy.”[22] The idea is echoed in other correspondence: “Each side needs to be informed about its enemy’s culture, history, his way of thinking, his strengths, and his weakest points.”[23]

Osama bin Laden and other al Qaeda leaders developed the assessment that the United States and other Western countries would withdraw from the Muslim world if the cost of maintaining a presence became too high. Thus, the early strategy championed by bin Laden focused on recreating the conditions that led the United States and the West to abandon Lebanon to Hezbollah after the 1983 Marine barracks bombing.[24] Bin Laden sought to remove Western influence from Muslim lands primarily by causing the United States to retreat, which would prevent it from protecting Muslim states from Islamist threats.[25] Al Qaeda attacked US Marines transiting Aden, Yemen, to Mogadishu, Somalia, an attack that bin Laden interpreted as successful, though it is unclear whether it achieved its intended effect.[26] The infamous “Black Hawk Down” incident in Somalia in 1993 did contribute to the US decision to withdraw from the country. However, the identity of the perpetrators and al Qaeda’s role in that attack are unclear even though bin Laden claimed credit for al Qaeda training and transferring weapons to Somalis.[27] Al Qaeda’s 1998 bombings of the US embassies in Dar es Salaam, Tanzania, and Nairobi, Kenya, did not achieve this effect, as noted earlier, though the USS Cole bombing did shift US naval logistics from Aden, Yemen, to the nearby port of Djibouti. The escalation to a direct attack on the US homeland flowed logically from this understanding: It was meant to raise the price exponentially.

Bin Laden understood that the 9/11 attacks placed a decision in front of the US administration. He sought to deliver a blow to the US economy, seeing America’s wealth and status as a key source of strength allowing it to prop up “apostate” Muslim regimes. Bin Laden cited the effect of the 9/11 attack on the US economy in an interview after the attacks, calling out the loss of 16 percent on Wall Street.[28] He wrote Taliban leader Mullah Omar (his host) on October 3, 2001, that the US faced the choice of refraining from action, which would cause its prestige to “collapse” and transform the US into a “third-rate power, similar to Russia,” or of responding with a campaign in Afghanistan, which would be costly and cause further economic collapse, causing the US to follow the Soviet Union’s path.[29] Bin Laden identified a plan to target the American economy and generate pressure from the American people on the US government to withdraw.

But bin Laden severely miscalculated the resonance of the 9/11 attacks globally and the immediate ramifications for the Salafi-jihadi movement. The 9/11 attacks elicited a global reaction to the terrorism problem that had hitherto been fractured or oriented on specific terrorism cases. President George W. Bush issued an ultimatum to nations on September 20, 2001: “Either you are with us, or you are with the terrorists.”[30] The US launched an air campaign in Afghanistan on October 7, 2001, to topple the Taliban government, its first major act in what would become the “Global War on Terror.” Bin Laden had badly underestimated America’s military capabilities, moreover, and did not expect the rapid and relatively bloodless (to Americans) collapse of the Taliban government sheltering him. Neither did he expect America's NATO allies to activate Article V, the mutual self-defense clause of the NATO treaty,[31] with NATO taking command of the International Security Assistance Force in August 2003 and more than 50 countries from around the world sending combat forces into Afghanistan.[32]

America’s European allies also pursued Salafi-jihadi cells inside their own borders, especially after a series of al Qaeda attacks in the mid-2000s, as did Arab and African countries. The 9/11 attacks heightened international security measures and cooperation, decreasing space for al Qaeda and like-minded individuals, rather than the opposite. Senior al Qaeda operative Saif al Adel penned a note in 2002 to the 9/11 mastermind Khalid Sheikh Mohammed entreating him to pause external operations in order for the movement to regroup after a year of punishing counterterrorism actions against it.[33]

Al Qaeda survived its catastrophic miscalculation and sought to end America’s foreign interventions by raising the cost on the Afghanistan and Iraq battlefields. Yet its leaders quickly concluded that they could not fully achieve their objectives on those battlefields. As the late leader of al Qaeda in Iraq, Abu Musab al Zarqawi, wrote in a letter recovered in early 2004: “America did not come to leave, and it will not leave no matter how numerous its wounds become and how much of its blood is spilled.” He warned presciently (and prematurely) that a successful US counter-insurgency campaign could split the Salafi-jihadi base from the Iraqi people and identified that risk as a greater danger than American military power.[34]

Salafi-jihadi leaders came to realize in the mid-2000s that Americans would expend blood and treasure to win wars abroad and that the pressure point to change American policies was instead the American people at home. A letter from 2010 recovered during the May 2011 Abbottabad raid compared Vietnam to Afghanistan, noting Vietnam ended only when public opinion shifted. The author wrote, “The common denominator of most of those wars was that they did not end with the use of the military from outside but ended when public dissatisfaction increased and because of internal opposition.”[35] He continued:

It is within our right to stop this war from its main source, which is the American people, who are the power that can stop it. . . . We have to put the administration of the White House and the Congress . . . under direct pressure by using the equation of fear. That can only happen by directly affecting the American people through conducting operations inside America and affecting the American economy.[36]

The argument continues, saying that Americans might be willing to remain at war for decades except for the state of the economy, which lessens the will among Americans. “Dealing with this enemy,” the author wrote, “requires that you attack its security, and particularly, its economy.”[37] Thus, al Qaeda refined its strategy to be one of “a thousand cuts” against the United States: multiple attacks that ranged in scale that could drive up the cost of homeland security exponentially.[38] The al Qaeda leadership thus modified its approach to attacking the US homeland, but effectively doubled-down on the intent to do so.

The 2008 financial crisis began delivering what al Qaeda could not achieve: popular pressure on the US government to focus American resources on domestic issues. Americans elected President Barack Obama, whose foreign policy platform included ending the Iraq war, reshaping the US military, and building and strengthening partnership and allies to meet common challenges, such as the threat of terrorism.[39] Obama sought to limit American military objectives in Iraq to counterterrorism and to redeploy troops freed up from a drawdown in the Iraq war to fight al Qaeda in Afghanistan. Obama announced within a month of taking office that the US combat mission in Iraq would end by August 31, 2010.[40] Within his first year, Obama announced a surge and then drawdown of forces in Afghanistan beginning in July 2011. He announced the withdrawal of all US troops from Iraq by the end of 2011.[41]

Bin Laden wrote in November 2010: “They [United States] are caught in a spider web, and there is extreme pressure from the West and inside the US for [the US] to pull out of Afghanistan because of their financial crisis.”[42] A separate letter from bin Laden also celebrated the US retreat: “The American reports, in addition to what you see in reality, that the US retreats in each of the economic, military, and political aspects. By the grace of Allah, the retreat is for the enemy and the advancement is for the mujahidin.”[43]

Salafi-jihadi leaders closely studied the vulnerabilities of local US partners as well and devised specific approaches toward each. For some, such as Uganda, they sought to raise the cost of partnering with the United States. An al Shabaab–produced analysis of its July 2010 twin suicide bombings in Kampala, Uganda, described Uganda, a troop-contributing country to the African Union peacekeeping force in Somalia, as having the option of either facing continued attacks in its homeland or being defeated in Somalia.[44] Al Shabaab noted the fall of Ugandan currency and spate of calls for Uganda to withdraw its forces from Somalia. (Instead, Uganda deployed another brigade.) The study also concluded the US reaction to the attack was “mostly diplomatic, political, and intelligence,” as well as the reactions in African countries, noting their primary worries were economic.[45]

For other US partners such as Yemen, Salafi-jihadi leaders decided that the current government was, in fact, better for their movement than what might replace it. Discussion about Yemen focused on two aspects: (1) The country was a critical support zone for al Qaeda and disrupting this in order to establish an emirate imposed costs elsewhere,[46] and (2) the Yemeni government, even though it was a US counterterrorism partner, was weak and better than an alternative.[47] A suggestion to overthrow Ali Abdullah Saleh’s regime received strong pushback, noting that the replacement regime would eliminate all Islamic factions and therefore that preserving Saleh’s regime protected the Salafi-jihadi movement’s interests.[48] Moreover, an al Qaeda leader (most likely Osama bin Laden) wrote that al Qaeda should “consider not attacking America inside Yemen” because it would cause “increasing pressure on the government by America to intensify the military operations against them, which will also accelerate the replacement of [Ali Abdullah Saleh].”[49]

American retrenchment has driven a foreign policy under which the Salafi-jihadi movement not only can survive but has the potential to prosper. The Salafi-jihadi movement did not cause this retrenchment by any means, and the instances of reversal, such as the 2014 launch of Operation Inherent Resolve, were cases in which the United States took direct military actions against Salafi-jihadi groups (the Islamic State, in that case). Both US and partnered military operations against Salafi-jihadi groups have degraded those groups, though the effect will likely be temporary. Moreover, the broader American military and diplomatic drawdown abroad has created space for Salafi-jihadi and other nonstate actors to backfill space once filled by stronger partner states, especially once military operations end. Perhaps what the Salafi-jihadi movement has understood best about the United States is that the American counterterrorism approach will not defeat the movement and that the long war is far from over.

Download the report here.

The Salafi-Jihadi Movement’s Adaptations

The Salafi-jihadi base adapted to changes within Sunni communities and to survive or avoid US counterterrorism pressure. The base itself is ever evolving to achieve its primary objective of developing support within Sunni communities. It is best understood as a complex adaptive system that cannot be known through only the individuals, groups, and organizations comprising it because these components are continuously adjusting to their environments and the relationships among them change. Leaders modified how their groups interacted with local communities and how they prioritized their efforts as they also drove change within their groups to play off US policy decisions and avoid meeting the threshold for US action against their groups. These changes manifest themselves in how the groups operate on the ground and in the leadership decision-making process. The specific adaptations improved the base’s ability to expand into Sunni communities without simultaneously triggering US or partner counterterrorism pressures.US policymakers and many analysts missed the largest adaptation within the Salafi-jihadi movement, which occurred in the tumult of the 2011 Arab Spring. The Salafi-jihadi movement reoriented its efforts to support the Arab Spring revolutions, bolstering popular support in the process and deprioritizing the “far war” against the West. Osama bin Laden wrote in 2011, “Though the Mujahidin have several duties to perform, their main duty is now to support the revolutions taking place.”[50] He added guidance that al Qaeda leaders should “increase our directed media efforts that call for a specific plan that we consult, agree upon and adhere to."

Table 1. Key Salafi-jihadi adaptations

The reduction of al Qaeda’s line of effort against the United States in the aftermath of the Arab Spring and its focus on the local played directly into a widely held assumption in the West about how to measure al Qaeda’s strength, which focused on terrorist activity.[51] It also made US counterterrorism policy against al Qaeda appear more effective than it was because Western analysts wrongly clung to the perception that al Qaeda was weakening. Al Qaeda also supported other Salafi-jihadi groups in establishing themselves, and al Qaeda in Iraq (now the Islamic State) seized the opportunity of co-opting Iraqi Sunni protests over the course of 2012 to begin to reconstitute its support networks.[52]

Even as the Salafi-jihadi movement adapted to changing circumstances and opportunities, US counterterrorism policy remained fairly fixed on an old operational concept and continued to emphasize disrupting terrorist plots and operations and eliminating leadership. A misconception of who and what the enemy was exacerbated gaps between US policy and reality as well as ongoing efforts from both sides of the aisle in the United States to reduce American commitments abroad. The US, therefore, continued apace with escalating drone strikes targeting key leadership—expanding from al Qaeda to include the Islamic State—and focused on operating with local partners to retake terrain from groups militarily. Meanwhile, the Salafi-jihadi movement effectively co-opted local grievances and exploited the mobilization of Sunni communities against external threats by identifying communal needs and meeting them as best it could. US counterterrorism strategy did not account for this shift in prioritization, and the US and other partners have not effectively contested this adaptation to local circumstances at a global scale.

The adaptations and evolutions that the Salafi-jihadi movement has undergone, especially within the past 10 years, have made it more resilient to US counterterrorism actions and more acceptable within many Sunni communities. US Coordinator for Counterterrorism Nathan Sales described Salafi-jihadi groups as having “made themselves less susceptible to conventional military action” through their adaptations.[53] The acceptance of Salafi-jihadi groups in places such as Mali, Yemen, Somalia, and Syria in exchange for justice, security, or other goods since 2011 is a marked change from when these groups could gain little traction on the ground. US policy anticipated and accounted for some adaptations, such as groups wising up on the ground to intelligence collection and targeting methodology (much unfortunately learned through the publication of classified information). Yet other adaptations, such as how local Salafi-jihadi groups relate to the global movement and support global jihad, are not reflected in US counterterrorism policy. These adaptations improve the Salafi-jihadi movement’s ability to advance its lines of efforts to establish its interpretation of shari’a-based governance in the Muslim-majority world.

---

Learning and Adaptive Enemies

America’s adversaries and enemies are clearly learning lessons from their own successes and failures as well as each other’s on the battlefield. Both state and nonstate actors are constantly probing the United States in order to better predict how the US will respond to new developments. The means and methods to act against the United States in the “gray zone,” under the threshold of outright war, are increasingly shared among states and nonstate actors, challenging how the US responds to each.

Similarities, in particular, stand out between Iran’s way of war—its use of proxies to expand the Axis of Resistance into new communities—and the Salafi-jihadi movement’s strategy to establish local groups to insinuate into Sunni communities. The proximity between the two strategies, which include a mix of tactics that range from terrorist attacks targeting American interests to humanitarian projects, facilitates the adoption of methods between the two. Iran’s use of proxies creates deniability for responsibility, as has al Qaeda’s cultivation of local Salafi-jihadi groups and al Qaeda’s and the Islamic State’s focus on inspiring “lone wolves.” Parallels extend further: Lebanese Hezbollah’s good works on the ground bought it legitimacy, as has the work of al Qaeda’s Syrian proxies.

The Salafi-jihadi movement has certainly learned from Iran and its proxies. For example, Hezbollah provided al Qaeda with expertise to build the bombs used in the 1998 East Africa embassy bombings.[54]

A January 2007 letter from an al Qaeda operative in Iran found Iran’s enmity toward the United States to be “genuine” and that the Iranian regime was “prepared to support and assist . . . any person who wants to attack America without implicating the Iranians directly and explicitly.”[55] An earlier letter from 2004 that focused on Iraq indicated that Iran had offered support to al Qaeda at the time, though whether this resulted in any support is not known.[56]

The West should not blithely assume that all parts of the Salafi-jihadi movement are at war with the Islamic Republic of Iran or vice versa. Still less should it assume that each side is not learning from the other. And lessons the West learns in fighting one may also apply to fighting the other.

---

Expected Adaptations to Counterterrorism Measures. The components of the Salafi-jihadi base targeted through counterterrorism measures[57] adapted to such pressure in predictable ways. Senior leadership relocated to more permissive environments, for example, in order to escape the threat of detention in the 1990s[58] and fled Afghanistan in late 2001 to escape advancing American forces. They paid attention to the physical security of operational bases and safe houses: A document recovered in Afghanistan provided guidance on finding a secure location, implementing good security practices, and preparing to defend the location.[59] Members of targeted organizations have also altered how they communicate,[60] eschewing cellular devices that might signal their hiding locations and continuing to adapt communications after intelligence leaks revealed US surveillance methods.[61] More recently, these groups have sought to use encryption to obscure the content of their messages. They have also sought new, innovative methods to attack new targets using concealing explosive devices to evade new security measures.[62]

These foreseeable adaptations, though frustrating for those monitoring these groups, were driven in part through the sharing of information among members of the Salafi-jihadi base and a constant awareness of the means and methods of the US intelligence and military services as well as those of partner governments. Al Qaeda, for example, compiled a list of lessons learned after the fall of the Taliban in Afghanistan, naming specific reasons why members were compromised.[63] These reasons included local knowledge of a safe house, information compromised through communications with other groups over the phone or internet, regular patterns of movement that attract attention, appearance of fighters that differs from the locals, intelligence services’ penetration of cells, and the cavalier response of operatives who knew they had been compromised.

Al Qaeda members regularly passed forward tips and recommendations on evading intelligence and security service detection. Samples of these are sprinkled throughout recovered correspondence.[64] They include warnings about how to communicate and travel and what information to avoid writing down. Osama bin Laden clearly concerned himself with limiting his digital and physical footprints in order to avoid detection by US and foreign intelligence services. His guidance protected operatives at the very tactical level of personal security and attempted to secure al Qaeda’s operational communications. Yet these adaptations were nothing new; evading detection by security forces is an age-old art in the illicit world.

---

Excerpts from Osama bin Laden’s Letters

August 7, 2010, Letter from Osama bin Laden to Atiyah Abd al Rahman

• “Note: Be extra cautious and make sure that no letters or documents fall in the hands of the enemy. Communications with the brothers in Somalia should be handled like letters that contain secret and dangerous information.”
• “We should be careful not to send big secrets by email, especially in Waziristan and the areas around it. . . . We should assume that the enemy can see these emails and only send through email information that can bring no harm if the enemy reads it. They should not trust it just because it is encrypted, because the enemy can easily monitor all email traffic to the al-Mujahidin area. . . . depending on encryption in sending secrets is a great risk. Encryption system works with ordinary people, but not against those who created email and the Internet. All sensitive communications should be done through carriers.”
• “You should consider yourselves under surveillance and you should change houses only on cloudy days.”[65]

October 11, Possibly 2010, Letter Possibly from Osama bin Laden

• “Concerning using the internet for correspondence, it is ok for general messages, but the secrecy of the mujahidin does not allow its usage, as couriers are the only way.”[66]

October 21, 2010, Letter from Osama bin Laden to Atiyah Abd al Rahman

• “We could leave the cars because they are targeting cars now, but if we leave them, they will start focusing on houses and that would increase casualties among women and children. It is possible that they have photographed targeted homes. The brothers who can keep a low profile and take the necessary precautions should stay, but move to new houses on a cloudy day.”[67]

Undated Letter from Osama bin Laden to Atiyah Abd al Rahman

• “The facts prove that the American technology and advanced systems cannot capture a mujahid if he does not make a security violation that will lead them to him. Commitment to operational security makes his technological advancement a waste. Security procedures in our circumstances should be practiced at all times and there is no room for mistakes.”[68]

---

The US decapitation strategy against al Qaeda also led to increased decentralization within the organization itself. Targeted strikes made senior leadership gatherings risky. Likewise, strikes and raids based on signals intelligence added risk to regular communications, driving many in the organization to limit their digital footprint. The growth of affiliates at a distance from the senior leadership created the requirement to delegate daily and regular decision-making to local leaders, leaving high-level strategy with the global leadership.

The decentralization of the organization into a complex network with both a formal hierarchy and informal lateral relations made al Qaeda much more resilient to US counterterrorism actions.[69] Decentralization did not weaken al Qaeda or dampen its efforts globally, as the same Salafi-jihadi ideology and understanding of the Prophetic Method guided all decision makers within the organization. (Arguably, some of these changes, such as the appointment of local leaders to the helms of affiliate groups, could have also been driven in part by al Qaeda’s growth as a global organization.)

Creating Confusion Through Name Changes and Obfuscated Relationships. The Salafi-jihadi movement evolves rapidly in how it manifests on the ground, and it increasingly obfuscates its existing relationships. The changes and hidden relationships test the ability of local communities to understand how the local group connects back to the global movement and the ability of the US intelligence community and US policymakers and lawmakers to keep pace. The groups create conditions to allow deniability about their actual relationship to the global movement in order to gain local acceptance.

Additionally, specifying against which entities and individuals the US must act is a key challenge as policymakers and lawmakers define authorities and the criteria for activating those authorities. Current US policies require classifying groups and members of those groups for US entities to act under existing authorities. US intelligence organizations must identify and assess with a high degree of confidence that an organization or an individual meets a set of statutory criteria before US entities act in accordance with policy. The rate of change on the ground—particularly now in Syria—and the ability of groups to deceive or obscure their ties often creates lags in the implementation of counterterrorism policies.

The case of al Shabaab in Somalia before 2012 displays al Qaeda’s awareness of how an acknowledged relationship with one of America’s greatest enemies can affect the operating environment. To prevent a US reaction bin Laden denied al Shabaab public recognition as part of al Qaeda during his lifetime even after al Shabaab requested it. Al Shabaab had become the dominant Salafi-jihadi group in Somalia by 2008 and had begun unifying other Islamist groups underneath it. The Bush administration had designated al Shabaab as a foreign terrorist organization (FTO), but whether al Shabaab posed a threat to the United States divided the US expert community. A dominant group described al Shabaab as a local organization and insurgency that posed little threat to American interests.[70] Al Shabaab had succeeded the Islamic Courts Union, rising to power in southern and central Somalia by allying and merging with local clan and Islamist militias. The group also provided sanctuary to al Qaeda operatives, including Harun Fazul, who masterminded the 1998 East Africa embassy bombings, and Saleh Ali Saleh Nabhan, who was connected to both the East Africa embassy bombings and the 2002 Mombasa attacks, but it had not publicly affiliated with al Qaeda. Al Shabaab focused its efforts on Greater Somalia (the Somali region in East Africa that includes parts of eastern Ethiopian and northern Kenya), and the known al Qaeda operatives kept a low profile in the country. Al Shabaab merged with the last major Islamist group in Somalia in December 2010, further driving the narrative that it was focused on the local fight.[71] Al Shabaab kept its relationship with al Qaeda plausibly deniable.

Recovered correspondence from al Qaeda shows instead a robust relationship between al Qaeda and al Shabaab leadership, including directives from bin Laden to the group. An early example, a 2006 letter from Atiyah Abd al Rahman, a senior al Qaeda leader, tells the Somali mujahideen to learn how to avoid aerial bombardments.[72] The most poignant example of bin Laden’s deliberate attempt to keep his relationship with al Shabaab deniable is in two letters he drafted on August 7, 2010. Bin Laden wrote to the leader of al Shabaab confirming receipt of a previous letter that reported on the upcoming merger with Hizb al Islam and responding to a possible request to declare an emirate in Somalia.[73] Bin Laden advised an undeclared “practical working emirate,” which avoided calling attention to a US-designated FTO governing significant parts of a country. He explicitly wrote that al Shabaab’s relationship with al Qaeda should be obscured because the US would mobilize against al Shabaab and that would prevent individuals in the Gulf from sending financial support as easily. Bin Laden attached this letter to one to Atiyah and provided additional guidance that al Shabaab should understand the differences among al Qaeda’s enemies and must distinguish between those with conviction to fight and those without.[74] He also suggested that Somalis go to the Gulf to petition for additional financial support.

Other examples exist in letters exchanged in April 2011.[75] The lengthy back-and-forth between al Qaeda senior leaders and al Shabaab, as well as the discussion of what using the name “al Qaeda” and declaring an emirate would do to the response to al Shabaab, shows an acute awareness to the sensitivity within US policy circles to the al Qaeda brand name and its effect on the US prioritization of countering al Shabaab as an FTO. It took Ayman al Zawahiri’s public recognition of al Shabaab as an al Qaeda affiliate in February 2012 to end the debate.[76]

---

The al Qaeda Emirate

Establishing an emirate under shari’a-based governance is a core objective for al Qaeda groups: “Our main goal, and yours, is to resurrect the religion of Islam, and to build a Caliphate-based state in every Muslim country.”[77] Al Qaeda senior leadership recognized by 2010 that declaring an emirate outright placed the development of an al Qaeda quasi-state on the West’s radar. Osama bin Laden counseled al Shabaab against declaring an emirate in August 2010, for example, but recognized that the group controlled a quasi-state. He wrote, “This is an emirate on the ground, and it is real and has millions of people in it.”[78] Al Qaeda in Yemen declared an emirate in 2011 against Atiyah’s advice.[79] Its leaders learned from their mistakes, writing in 2012 to their contemporaries in the Sahel advising against declaring an emirate and then in 2015–16, eschewing titling their holdings in Yemen, even though they controlled the country’s third-largest port city.[80] Likewise, Jabhat al Nusra in Syria has not declared an emirate despite having had significant control over governance in Idlib province.

---

Beginning in 2011, al Qaeda and other components of the Salafi-jihadi movement played a similar name game both with local populations and Western intelligence agencies by cultivating the formation of new popular Salafi-jihadi groups. Salafi-jihadi groups seized the opportunities to expand presented by the Arab Spring: the collapse of Arab strongman regimes, the release of imprisoned Salafi-jihadi leaders and operatives, and mobilization of local communities for change. Tunisian Islamists received a pardon in March 2011 and by April 2011 had announced the establishment of Ansar al Sharia (Helpers of Shari’a).[81] Among Ansar al Sharia’s founders was Seifullah ben Hassine, who fought with al Qaeda in Tora Bora,[82] and the group developed a militant wing.[83] Egyptian Salafi-jihadists thrived under a Muslim Brotherhood government, and al Qaeda in the Arabian Peninsula (AQAP) supported the establishment of a new network under Egyptian Mohammed Jamal, who ran training camps in Egypt and Libya.[84] Al Qaeda–linked individuals stood up Ansar al Sharia in Libya, which gained strength during the revolution and through governance tactics,[85] and AQAP fielded Ansar al Sharia, a new group that established an emirate in southern Yemen.[86] Al Qaeda splinter groups in Mali supported the growth of Ansar al Din (Helpers of the Faith), which governed places such as Timbuktu under its interpretation of shari’a.[87] In Syria, al Qaeda in Iraq fostered the development of a new group, Jabhat al Nusra[88] (the Support Front), which rapidly rose to prominence within the Syrian armed opposition.[89] None of these groups, networked into al Qaeda and the Salafi-jihadi movement, bore al Qaeda’s name or triggered an immediate response from the United States.

Al Qaeda’s name game was a response, in part, to its branding (and reality) problem in Sunni communities. The group’s vision for the future and its message that the Islam the majority of Sunni Muslims practice today is corrupt have not gained much traction on the ground. Moreover, a means by which it is pursuing its objectives—especially terrorist attacks against Western civilians—is isolating for the group. A letter found at Osama bin Laden’s Abbottabad compound discusses possibly changing the name of al Qaeda because it does not “represent us” in the shortened form (from tanzim al qaedat al jihad or the Organization for the Basis of Jihad).[90]

The author cited al Shabaab as a good example. “Al Shabaab,” which translates as “the youth,” is shortened from Harakat al Mujahideen al Shabaab (Mujahideen Youth Movement) and might be more acceptable than a name that includes some variation of “jihad.” The names that al Qaeda groups adopted after the Arab Spring, from Ansar al Sharia to Ansar al Din to Jabhat al Nusra among many others, all avoid direct reference to the idea of jihad. They have more positive connotations in Islam, referring back to positive figures in the religion’s history or more blandly to the notion of providing assistance to embattled forces.

US counterterrorism policy could not keep pace with the proliferation of Salafi-jihadi groups, many of which were direct outgrowths of the al Qaeda network.[91] Designating a group as part of al Qaeda is a simple metric by which to understand the US assessments and prioritization of countering an al Qaeda threat. Of the Salafi-jihadi groups established in 2011, only three received a counterterrorism designation from the United States in 2012: Jabhat al Nusra in Syria, Ansar al Sharia in Yemen, and the Movement for Unity and Jihad in West Africa[92] (MUJAO). Each one received direct support from a designated al Qaeda affiliate to establish itself. The US took almost a year to designate Jabhat al Nusra as an alias for al Qaeda in Iraq.[93] Focus on a potential policy to arm the Syrian opposition probably helped accelerate the designation. It took the US just over a year to designate MUJAO, an al Qaeda in the Islamic Maghreb splinter group. Ansar al Sharia in Yemen began controlling territory under this name by mid-June 2011 after a top AQAP official described the name Ansar al Sharia as the name the group uses to introduce itself to the people in mid-April 2011.[94] The US designation of this group as an alias[95] for AQAP occurred nearly 18 months later in October 2012.[96] Other groups, such as the Libyan and Tunisian Ansar al Sharia groups, took even longer to designate—not until January 2014—possibly because they were new and independent groups.[97] US counterterrorism designations continue to lag behind changes on the ground. Hay’at Tahrir al Sham, an organization that includes leadership from the disbanded Jabhat al Nusra, formed in January 2017 and was only designated (controversially as an alias for Jabhat al Nusra) in May 2018.[98]

The al Qaeda leaders in various regions are increasingly running a decentralized network of groups with fluid names and fluid membership. The success of groups such as AQAP’s Ansar al Sharia drove further creation of proxies that also tout a local narrative, trying to generate local support without drawing attention to the al Qaeda relationship. In some cases, the al Qaeda leadership has stoked and supported this outgrowth independent from their own organizations, such as in the Sahel. Al Qaeda played on local group identities and supported the strengthening of groups, such as the Macina Liberation Front, a local Salafi-jihadi ethnic Fulani group. In Yemen and elsewhere al Qaeda intentionally established new groups. AQAP shifted from Ansar al Sharia, which is its local fighting force, to local groups named the Sons of Hadramawt and the Sons of Abyan, which are Salafi-jihadi groups oriented on local provincial identities in Yemen. In Syria, the breakup and reconstitution of groups confounds many analysts—and the locals—and individuals move among Salafi-jihadi organizations into new positions based on assessments of current operational success and to position for future success. The value of names and membership in understanding and defining the enemy has decreased.

The problem—and why finding a way to win the name game is important—is that many US counterterrorism authorities are tied to the designations or that US policy permits their use against only certain groups. Al Qaeda dropped its name from new groups (all groups after 2009) and intentionally obscured organizational relationships in order to prevent counter–al Qaeda policies from expanding and applying to the entire organization. Salafi-jihadi groups have thus partially escaped US counterterrorism pressure by changing names through rebranding or jumpstarting a new independent organization and, in most cases, have made significant gains before US policy catches up to reality.

Separating the Local from the Global Jihad. The Salafi-jihadi movement has exploited how the US defines enemy groups and how local communities define “terrorist” groups by specializing among and within groups. Salafi-jihadi groups began to assert their local or even regional objectives and distance themselves from the actions of “global” groups such as al Qaeda, which helped them gain local acceptance and avoided being flagged as a threat under US policy. The evolution of the al Qaeda network as it developed local affiliates and then the specialization of the affiliates reflect this trend. The Islamic State’s rise followed a similar development in which the Islamic State focused on local and regional issues before bursting onto the global stage. Both al Qaeda’s and the Islamic State’s focus on the local fight created some marginal concerns in the United States as they were expanding but did not compel US action because the new groups did not seem to present an immediate threat to the US homeland.[99]

US counterterrorism policy is fundamentally defensive: It seeks to prevent the next 9/11 attack. Thus, its main efforts have been against those individuals and groups that have expressed both intent and capability to attack the United States or American interests. This definition constrains US action to only those groups actively pursuing attacks against the United States. In 2001, it was against al Qaeda primarily and secondarily against the Taliban for providing sanctuary to al Qaeda. In 2009, it was against “core” al Qaeda—the senior operatives active on 9/11 and directly surrounding leadership—and then came to be against AQAP after the December 2009 underwear bomb attack from Yemen. Today, it includes the Islamic State in Iraq and Syria. The small number of groups on the list is intentional given the resource and moral cost of eliminating the direct threats. Salafi-jihadi leadership has recognized this prioritization and therefore has intentionally developed global attack nodes within select groups and cells to protect the majority of its groups from US targeting.

The differentiation between those groups that have global intent and capabilities and those that do not, which is realized in both US policy and in local perceptions, creates an incentive for transnational organizations such as the Islamic State and al Qaeda to optimize their organizations for survival. A deliberate separation between the “local” affiliates and branches and the “global” core group enables the Islamic State and al Qaeda to bid for popular support using local narratives. The separation also protects large parts of their organizations from direct US counterterrorism actions and, at times, even from partnered counterterrorism forces.

The Salafi-jihadi base in Pakistan exemplifies how differentiating among groups has enabled the base to exploit weaknesses and unwillingness in the Pakistani government and military to target certain groups.[100] The Pakistani military has historically been willing to pursue the Salafi-jihadi groups that directly threaten the Pakistani state, such as the Tehrik-e-Taliban Pakistan (TTP) and Sipah-e-Sahaba Pakistan. Those groups whose operations benefited the Pakistani state—such as the Afghan Taliban, Lashkar-e-Taiba, and Jaish-e-Mohammed—were generally exempt from Pakistani counterterrorism operations, or when they misstepped, they were brought back into line. Pakistani targeting of foreign and globally focused al Qaeda operatives, however, supported the US-Pakistan relationship and had minimum political cost to it.

The dichotomy of local versus global may have once been useful as it helped divide tasks among stakeholders. In the 1990s, for example, strongman states pursued Salafi-jihadi and Islamist groups to prevent their expansion, and US policy oriented against global groups enabled the United States to best defend itself from the threat. However, support for these authoritarian regimes that use repressive and coercive tactics to survive did not guarantee results and in nearly all cases created conditions favorable to Salafi-jihadi recruitment and expansion once they fell. The problem is twofold: First, the Salafi-jihadi movement became more complex in the 1990s and 2000s. Second, the strongman states no longer exist to tackle the local groups. While reestablishing such strongman regimes might be tempting, they are counterproductive in the long term because the stability they provide rests on the regime’s survival, while the measures they use to survive generate the popular dissent that will cause their downfall. The preservation of such a dichotomy today in US policy produces the hydra phenomenon in which the US repeatedly cuts off the head of a threat only to see the threat regenerate multifold.

---

The Strongman’s False Allure

The series of 2011 revolutions that ended the Arab strongman regimes created the conditions for the Salafi-jihadi movement to expand in the Arab world. These regimes had played a critical role in checking the spread of the movement in the 1990s and throughout the 2000s as US counterterrorism partners. They used coercive measures—limiting free speech and imprisoning Salafi-jihadists—to keep the movement in check. The instability and uncertainty that followed the collapse of these regimes have led some to call for the return of the Arab strongman regimes to restore order.

Strongman regimes are not the solution, however. These regimes were largely able to control Salafi-jihadi groups because these groups lacked popular support and were marginalized within Sunni communities. The writings of Ayman al Zawahiri and others provide reflections on the continued rejection of their ideas by the public. The strongman regime also provides order only as long as it survives. History shows that the regime’s repressive survival methods are its undoing in the end. To return the Arab strongman regime to the region would sacrifice the long term for a short-term solution.

---

The al Qaeda network’s growth and development reflect the specific concentration of an attack node within the network, especially in the late 2000s and early 2010s, to bear the brunt of US counterterrorism efforts while “local” affiliates escaped significant counterterrorism pressure. By the end of the Bush administration and start of the Obama administration, the US was hunting down the remnants of the al Qaeda organization that had been active on 9/11.[101] In fact, US pressure on this part of al Qaeda increased under the Obama administration to the point of nearly eliminating those remaining individuals from the battlefield.[102] The Obama administration continued the Bush administration practice of delineating between the al Qaeda groups that presented an immediate threat to the United States—those involved in active plotting—and those that appeared to have only local or regional aspirations.[103] It excluded locally or regionally focused affiliates, including those that employed global rhetoric but acted regionally, such as al Qaeda in the Islamic Maghreb (AQIM).[104] AQAP, the successor organization to the al Qaeda group that had repeatedly targeted US interests in Yemen (including the USS Cole in 2000 and the US embassy in 2008) came under increased counterterrorism pressure in late 2009, especially after AQAP directed the underwear bomb attack on the US homeland in December 2009.[105]

AQAP became al Qaeda’s primary attack node in the early 2010s. Al Qaeda’s sanctuary in Yemen had enabled the group to recruit, vet, and train foreigners for attacks, including Americans.[106] Sharif Mobley, for example, is an American who traveled to Yemen in 2008 with his wife and who had contact with the radical Yemeni-American cleric and senior AQAP leader Anwar al Awlaki.[107] Al Qaeda senior leadership directed external attacks to run through AQAP. For example, a thwarted al Qaeda plot in 2010 was to have AQAP direct an attack against a European target with funding support from AQIM.[108] AQAP was also behind the October 2010 parcel plot in which two bombs disguised as printer cartridges were shipped to the United States, a May 2012 plot thwarted by American and foreign intelligence agencies, and the August 2013 threat that closed over 20 American diplomatic posts across Africa and the Middle East.[109] Additionally, Ibrahim al Asiri, AQAP’s late bomb maker, trained others in his tradecraft, including foreigners such as Norwegian Anders Cameroon Ostensvig Dale, who left Yemen in 2011, and was linked to the 2014 threat against commercial airliners.[110] AQAP’s founding leader Nasser al Wahayshi also served as al Qaeda’s “general manager” until his death in June 2015, showing AQAP’s prominence within the al Qaeda network.[111]

Al Qaeda’s expansion during the 2011 Arab Spring explicitly prioritized the local over the global.[112] The Salafi-jihadi vanguard transitioned to supporting the local insurgencies and Salafi-jihadi groups that followed the popular revolutions. Atiyah Abd al Rahman, whom Osama bin Laden tasked with this effort, became a key coordinator, especially for al Qaeda’s work in Libya. Atiyah wrote that al Qaeda senior leadership’s strategic goal in Libya was to foster a “real, radical, and revolutionary change that would affirm . . . the dominance of sharia” and in April 2011 noted that “the brothers are starting to organize themselves” in Libya.[113] Al Qaeda sought to gather strength in Libya, establishing training camps and covert networks, toward the eventual goal of erecting an Islamic emirate under shari’a.[114] Al Qaeda quietly extended its tendrils into the Libyan armed opposition to Muammar Qaddafi, and groups it supported emerged as powerbrokers when the Qaddafi regime fell.

The Salafi-jihadi movement expanded rapidly in Iraq and Syria without provoking a significant response from the United States because none of the groups displayed intent and capability to attack the US homeland in 2012 and 2013. Director of National Intelligence James R. Clapper assessed in April 2013 that the goals of the Islamic State’s predecessor organization (al Qaeda in Iraq) “inside Iraq will almost certainly take precedence over US plotting” and that its Syrian network (Jabhat al Nusra, which had not formally split from the Islamic State at the time) had “gained strength both numerically and otherwise” by providing municipal services.[115] Clapper also identified the ungoverned space—in Syria in particular, but also in Yemen and Libya—as an opportunity for groups to “destabilize the new governments and prepare attacks against Western interests inside those countries.”[116] Yet the United States did not act directly to prevent the establishment or strengthening of Salafi-jihadi groups in these areas and instead continued to focus counterterrorism resources on a small fraction of the Salafi-jihadi movement.

The pivot of US and international counterterrorism and military resources to counter the Islamic State in late summer 2014 likely influenced how al Qaeda prosecuted its “far war” against the United States. By September 2014, an estimated 50 al Qaeda veterans had moved into Syria to constitute what became dubbed the Khorasan Group.[117] This al Qaeda cell, which notably included members already on the US targeting list, was involved in external operations planning and providing strategic-level guidance to Jabhat al Nusra, al Qaeda’s newest affiliate. These operatives involved in recruiting and training Westerners for future attacks were not members of Jabhat al Nusra, though they received sanctuary with the group. The Obama administration maintained the distinction between the Khorasan Group, an al Qaeda core cell in Syria, and Jabhat al Nusra, al Qaeda’s affiliate in Syria, by targeting only members of the former.[118]

Maintaining a distinction between al Qaeda core and Jabhat al Nusra in Syria—however fuzzy this distinction was on the ground when operatives coexisted in the same infrastructure—shielded Jabhat al Nusra from US counterterrorism action while enabling al Qaeda to have an external attack capability based in Syria. Jabhat al Nusra leader Abu Mohammed al Julani asserted in May 2015: “Al-Nusra Front doesn’t have any plans or directives to target the West. We received clear orders not to use Syria as a launching pad to attack the US or Europe in order to not sabotage the true mission against the regime. Maybe al-Qaeda does that, but not here in Syria.”[119] Julani, an al Qaeda member, unmistakably differentiates between his group (an al Qaeda affiliate) and al Qaeda. Julani’s organization today remains focused on the Syrian jihad, not the global jihad, but is still part of al Qaeda.

The specialization of Salafi-jihadi groups into “global” and regional or local groups and organizations masks the depth of capabilities across the Salafi-jihadi movement, particularly in regenerating the very threats the West seeks to destroy. A global group must have intent and the capability to generate and deploy a threat node[120]—a cell or group tasked with attacking the United States or the West—to the United States or Europe. This threat node identifies a Western target in Europe or the United States and combines an attack team with a support team to carry out the planned attack. The Salafi-jihadi movement has adapted to create a symbiotic relationship between these threat nodes and the local or regional groups. The Afghan Taliban is an enduring example of a locally focused group that provides safe haven, resources, and other requirements to al Qaeda, enabling al Qaeda to focus on its global objectives. Similarly in Yemen, al Qaeda cultivated Ansar al Sharia and later the Sons of Hadramawt and others to achieve local governance and military objectives while running training camps and pursuing new terrorist plots in Yemeni safe havens. Likewise, Jabhat al Nusra in Syria provided the infrastructure backbone and space in Syria for the Khorasan Group to establishing its training cells for future attacks against the West.

The focus on only those groups with demonstrated threat nodes creates vulnerability for the United States and the West. A group without either intent or external attack capability still has nearly all of the organizational infrastructure in place to support such a threat node. Some groups, such as al Qaeda in Syria, just need to decide to launch an attack. Others, such as al Qaeda and even the Islamic State in the Sahel, need to both develop the intent and overcome some logistical challenges. But the groups that fall in the latter category can support groups in the former, expanding both available resources and reach. The sharing of experience and resources across groups and networks within the Salafi-jihadi movement increases the likelihood of a surprise attack from a group that had previously been locally focused.[121]

Beyond Jihad and Pursuing “Localization.” The Salafi-jihadi movement has increasingly adopted a deliberate “localization” approach: the mixing of a Salafi-jihadi group into the local contexts and conflicts. The local context has always been important to the Salafi-jihadi movement, which seeks to generate global changes through the success of local insurgencies. But the line between Salafi-jihadi groups—the members and their networks that the US intelligence community can readily target—and local militias and insurgent groups is now blurred. The phenomenon, which some have described as a marbling effect, has resulted in Salafi-jihadis insinuating themselves into local institutions and groups and moving beyond just the idea of jihad.[122] The intermingling with non–Salafi-jihadi groups serves to introduce uncertainty about the threat that these new networks pose and to frustrate a US counterterrorism policy predicated on finding and finishing terrorists and terrorist groups.

The global Salafi-jihadi movement has historically had to balance global aspirations to replace the Westphalian states system with national—or local—aspirations to replace the governance system with one based on a Salafi interpretation of Islam. Al Qaeda, as conceived in Abdullah Azzam’s The Solid Base and as originally envisioned by Osama bin Laden, was to serve as a vanguard for true Islam that would facilitate and help lead local Salafi-jihadi revolutions in Muslim lands.[123] The Afghan Arabs—Arabs who fought and trained in Afghanistan during the Afghan-Soviet war or under the Taliban—were the individual vanguard members who exported their ideas, teaching, and training back to their homelands, to local Islamist groups such as the Tunisian Combatant Group, the Islamic Armed Group in Algeria, the Libyan Islamic Fighting Group, and the Egyptian Islamic Jihad. These “local” groups constitute the majority of the Salafi-jihadi movement with a handful of groups—al Qaeda, the TTP, the Islamic State—conducting attacks overseas to advance global objectives.

The Soviet-Afghan jihad, the birthplace of the modern Salafi-jihadi movement, was a localized fight for the future of the Afghan state that also catalyzed the global movement. Azzam argued that jihad in Afghanistan was an individual obligation on every Muslim because of the Soviet impingement on land that was once ruled by Islam and that Muslims must fight in support of the Afghans to bring forth an Islamic State.[124] His clarion call to fight in Afghanistan—and the infrastructure to receive, process, and deploy Arab fighters alongside the Afghan mujahideen—began to build the vanguard cells of Afghan Arabs who would carry the banner of Islam back to their homelands. Azzam called for the establishment of this vanguard to expand Islam:

The Islamic movement will be able to establish an Islamic society only through a general popular jihad. Its movement will be a beating heart and shining mind, similar to a small detonator that triggers a loud explosion, by freeing the Muslim community’s contained energy and releasing the sources of good that it contains deep down. The Prophet’s companions were only a handful of men.[125]

Azzam specifically tackles the argument about the local jihad in Afghanistan in Memories of Palestine:

Those who think that the jihad in Afghanistan is a distraction of the Islamic cause in Palestine are confused and misled and do not understand how one prepares leaders, how one builds a movement, how one founds a core around which a big Muslim army can be gathered to cleanse the earth of the big corruption.[126]

Azzam’s vision, and the vision around which al Qaeda was built, was to use local fights to build the Muslim army that would reconquer Muslim lands to establish the Caliphate.

Al Qaeda has thus sought to unify the jihad—to align the efforts of local Salafi-jihadi groups with the global movement—since its formation and has engaged at the local level to achieve this end. Al Qaeda ran cells in the 1990s that it deployed to various regions around the Muslim world in order to develop relations with local Salafi-jihadi or Islamist leaders. The al Qaeda operatives reported back to Osama bin Laden and other senior al Qaeda leadership on the state of the fight and whether they had made headway in convincing the local leader to join the greater movement.[127] Al Qaeda did not always succeed. Missives from East Africa reveal al Qaeda operatives’ frustrations with Somali Islamist leaders in the 1990s.[128] Al Qaeda was unable to convince these leaders to join its cause. Yet in other cases al Qaeda was able to bring the local group into its global network. The Algerian Salafist Group for Call and Combat (GSPC) pledged allegiance to bin Laden. He recognized the group as an al Qaeda affiliate in 2006. The GSPC rebranded as AQIM in January 2007.[129]

The GSPC, later AQIM, remained focused on the local fight in the Maghreb but served a supporting role to the global jihad. The group continued to pursue objectives in Algeria in the early 2000s, including taking 32 European hostages and supporting terrorist cells in Europe to target countries backing the Algerian government.[130] At the same time, the group facilitated the movement of fighters from the Maghreb to the Iraq theater, where the al Qaeda leader envisioned expanding the jihad beyond the Iraqi borders into the region.[131] The Sinjar records, a set of captured documents on foreign fighters joining al Qaeda in Iraq between August 2006 and August 2007, revealed that recruits from Algeria, Morocco, and Tunisia accounted for just under a fifth of the foreign fighters joining al Qaeda in Iraq at the time, with Libyan recruits accounting for a similar number of fighters.[132] Even today, AQIM remains focused on regional objectives while providing support—primarily financial—to other al Qaeda groups focused on the global fight. These local affiliates remained separate from other local groups, however, enabling the US and its partners to try to cleave off the threat groups and eliminate them.

The Syrian Case. The complexity of the Syrian Salafi-jihadi base epitomizes the challenge facing the United States. Some Salafi-jihadi individuals and groups have insinuated themselves into parts of Syrian society in such a way that targeting these individuals and groups would be ineffective or, more likely, counterproductive. Distressed Sunni Syrian communities chose to accept the support of Salafi-jihadi groups to prevent subjugation by the Assad regime or, in opposition-held territory, to restore some semblance of stability and normalcy to their lives. These communities, which under normal conditions had rejected both the presence and ideology of professed Salafi-jihadists, tolerated the groups as a better alternative to a worse fate.

Al Qaeda’s focus on local objectives and de-emphasis of a global effort enabled it to strengthen locally by exploiting opportunities presented by the Arab Spring without raising sufficient alarm in Washington. By 2013, the US intelligence community assessed Jabhat al Nusra, al Qaeda’s Syrian affiliate, to be “one of the best organized and most capable of the Sunni terrorist groups.”[133] Yet President Obama described what was happening in Syria as different from 9/11—the extremists gaining a foothold were “collections of local militias or extremists interested in seizing territory” and posed “localized threats.”[134] The confusion over whether a group is locally focused or contains global elements benefits the group because, to date, it has paralyzed the United States in reacting to that group. As long as the group remains focused on its immediate environs and indigenous grievances and avoids acting to develop a global reach, the United States has not sought to confront the group directly.

The US focus on the external threat from Salafi-jihadi groups left space in the local arena for groups to develop, and they developed within the Syrian armed opposition and within Syrian opposition governance structures. Al Qaeda operatives established Jabhat al Nusra in Syria as an outgrowth of al Qaeda in Iraq with the intent that the group would come to dominate the Syrian revolution, which it did even after Jabhat al Nusra revealed its al Qaeda ties in April 2013. Jabhat al Nusra and Ahrar al Sham grew in strength by combining their battlefield victories with delivering governance and basic services. Both groups and their successor organizations established and run shari’a courts in areas under their control. These courts have perceived legitimacy because the rulings are fair, compared to corrupt judges in state-run courts.[135] The groups devoted resources to building local governance, and Jabhat al Nusra notably ensured that basic service provision resumed in areas under its control.[136] Local councils are now the primary source of governance outside regime-controlled Syria, and Salafi-jihadi groups have, in some cases, created an umbrella organization for these councils, extending influence down into local governance.[137]

The new battlefield for jihad created an opportunity for the Salafi-jihadi movement to apply many of its lessons learned from other fronts, and the rapidly changing dynamics on the ground helped erase Salafi-jihadi missteps as new leaders and groups sought to establish themselves. The manner and context in which the Syrian Salafi-jihadi base developed, especially as it filled governance vacuums by co-opting the new governance structures, created legitimacy for the Salafi-jihadi groups as part of Syrian society, not just an insurgent force on the field. Specifically, the groups at the center of the debate include Hay’at Tahrir al Sham, a successor organization to al Qaeda’s Syrian affiliate Jabhat al Nusra, and Ahrar al Sham, a Salafi-jihadi group with close ties to Jabhat al Nusra and other more radical groups.

US policy has not addressed the core question of how to treat legitimate, local governance structures that have been captured by the Salafi-jihadi movement. Much of the analytical and policy debate about groups such as Hay’at Tahrir al Sham centers on the relationship with al Qaeda. The absence of popular support for al Qaeda has compelled the group to localize and distance itself organizationally from al Qaeda core, but there is much less evidence that the group has dropped its global Salafi-jihadi, al Qaeda–oriented leanings.[138] Hay’at Tahrir al Sham runs a public service administration in Idlib province, for example, that maintains electrical infrastructure and other municipal services.[139] More complex for the US is the structure run through Ahrar al Sham, the Service Administration Commission, which works with independent local councils and has helped to restructure some. Unlike the Hay’at Tahrir al Sham administration, the Ahrar al Sham administration coordinates with other groups and has integrated partially into the local governance system, forming connective tissues between local councils. The Salafi-jihadi movement has not fully captured governance in Idlib, but it has made significant progress in the absence of competition. The integration of the Salafi-jihadi base into legitimate local structures will require a nonkinetic solution to remove Salafi-jihadi influence from governance bodies.

Indirect Approach: Plausible Deniability in Jihad. Salafi-jihadi groups have incorporated attack methods that create ambiguity as to whether the group is responsible for the attack. The development of local proxies blurred the line of responsibility, obscuring whether the proxy or the core was responsible. Shifting attack types generated even more vagueness about whether even a proxy group was responsible. Other adversaries such as Russia and especially Iran also seek to operate against the US in ways that are plausibly deniable because the US threshold for a response tends to be higher than the individual actions.

US responses to attacks, especially under the Obama administration, differed based on whether an individual or group directly planned and executed an attack, enabled or facilitated an attack, or simply inspired an attack. The full force of American military, intelligence, and law enforcement efforts tracks down the individuals directly responsible for any terrorist attack against American interests. On the other end of the spectrum are inspired attacks. The individual or cell responsible for the attack, including its supporters, is targeted by American intelligence and law enforcement efforts, and sometimes military, but the US does not change its efforts against specific groups. Enabled attacks, likewise, might evoke only limited counterterrorism pressure against a group, targeting training camps or pursuing the network or node within the group that supported the attack cell. The shift in emphasis by Salafi-jihadi groups to the enabled and inspired end of the attack spectrum has created a situation in which the US is less likely to hold specific Salafi-jihadi groups accountable for these attacks.

---

Categorizing Attack Types

Directed. A group provides support to nearly all components of an attack from target selection to recruitment, vetting, and training of operatives to execute the attack.

Enabled. A group provides varying degrees of support for an attack, possibly providing guidance or material support, but does not control the specific details of the attack.

Inspired. An individual or cell conducts an attack in the name of a group but without support. These attacks are sometimes characterized as lone-wolf attacks.[140]

---

The June 2009 shooting at a military recruiting office in Little Rock, Arkansas, marks a shift in the Salafi-jihadi movement to encourage fight-in-place, lone-wolf attacks. The November 2009 shooting at Ford Hood, Texas, followed. Yemeni-American al Qaeda cleric Anwar al Awlaki was critical to this effort because of his outreach through his website and YouTube to would-be recruits in the West. He was described in 2008 as an “example of al Qaeda reach into the Homeland.”[141] AQAP’s English-language Inspire magazine, first published in June 2010[142] under Awlaki’s direction, included an “Open Source Jihad” section, which was continued in later issues. The section was a primer for would-be terrorists and launched with the infamous pressure-cooker bomb recipe, “How to Make a Bomb in the Kitchen of Your Mom.”[143]

Al Qaeda leadership determined that travel to Pakistan and other jihadi hotspots for training, a previous step for future attackers, red-flagged individuals to intelligence and security services.[144] The July 7, 2005, Madrid bombers, for example, traveled to Pakistan before their attack. But the US administration generally cast attackers who did not travel to such places as self-radicalized lone wolves—a moniker that remained attached to the Boston Marathon attackers even after it was revealed that one of them traveled to Dagestan, near a lethal al Qaeda affiliate.[145] Awlaki’s approach sought to empower these recruits to conduct attacks in their home countries without raising alarm or generating a backlash against the groups putting out the material. His death in a drone strike validated his strategy: The US seemed largely satisfied to have killed him and did not significantly expand its efforts against the al Qaeda group that housed and facilitated his activities.

The Islamic State’s ability to inspire added gasoline to al Qaeda’s slow-burning fire. It mobilized individuals globally to conduct attacks in its name with little direct support from the group, though peripheral parts of the Islamic State’s expansive human network created opportunities for these individuals to interact digitally with like-minded followers. Online material from al Qaeda and later the Islamic State identified targets, provided tactical guidance, and sought to rouse Muslims to conduct attacks. Islamic State–affiliated media channels reposted al Qaeda’s attack ideas, and the Islamic State’s Rumiyah magazine provided a “Just Terror” section similar to al Qaeda’s “Open Source Jihad.” The 2016 Berlin Christmas market attack, 2017 Westminster attack, and 2017 Stockholm attack followed advice in “Just Terror.” The 2015 San Bernardino attack attributed to the Islamic State followed methods presented in al Qaeda’s “Open Source Jihad.” Members of the Salafi-jihadi movement exchanged ideas and improved on proven tactics, developing high-casualty, low-cost attack methods that could occur without much lead time for security services to detect and respond to a threat. AQAP published its first “Inspire Guide” after the Orlando Pulse Club shooting in June 2016, which added that the attack could have been more lethal if simple explosive devices were also used.[146] The result is that the Salafi-jihadi movement has launched homegrown low-skilled but deadly terrorists acting in its name, yet US actions against the groups in their safe havens abroad have remained largely unchanged.

Semi-sophisticated attacks from the Salafi-jihadi movement that were portrayed as lone-wolf attacks may also have received more support than had been thought. US intelligence officials originally portrayed Faisal Shahzad, the man behind the May 2010 Times Square bombing, as someone who acted alone: He developed a plan to build the bomb and to place it in Times Square, and no intelligence linked Shahzad to a known terrorist group.[147] Within two weeks, however, officials began questioning his connection to the TTP, and months later, a video surfaced of Shahzad shaking hands with then-leader of the TTP.[148] Similarly, the Tsarnaev brothers, the pair behind the 2013 Boston Marathon bombing, have been cast as lone wolves. Yet one of the brothers traveled to Dagestan where he could have met with members of a local Salafi-jihadi group.[149] Moreover, an FBI analysis of the pressure-cooker bombs showed modifications to the recipe, indicating that the brothers may have been taught in the field.[150] Even the January 2015 Charlie Hebdo attack received support from AQAP. At least one of the two Charlie Hebdo attackers spent time with the group in Yemen, where he probably received training and then followed the group’s direction to assassinate journalists defaming the Prophet Mohammed.[151]

The Islamic State innovated further than simply obfuscating connections to attackers: It digitized them. Al Qaeda, the Islamic State, and other groups used the internet to attract would-be attackers and coax these individuals down a path of radicalization to the point where they might carry out an attack. Three teenage girls from Colorado sought to join the Islamic State in fall 2014 after being radicalized online.[152] The Islamic State also began running operatives virtually by pulling together individuals to build a cell and instructing recruits to pick up materiel at dead drops.[153] Virtual planners based in core Islamic State terrain in Iraq and Syria ran operatives remotely, significantly lowering the risk that the planner and logistician would get caught in a law enforcement net after the attack while creating the illusion of a lone wolf.[154] With planners providing guidance on the minutiae, the Islamic State blurred the lines between an enabled and a directed low-scale attack. The Islamic State found a way to lower the cost of directed attacks by investing remotely in multiple individuals. If one attacker failed, another might succeed.

However, the inclusion of new attack methods has not drawn Salafi-jihadi groups away from the tried-and-true directed mass-casualty spectacular attack. Al Qaeda, which has intentionally retreated from being the focus of US counterterrorism operations, almost certainly retains the capability to attack the US homeland even as it prioritizes its resources against more local efforts. It may even be planning to use a mass-casualty attack to launch Hamza bin Laden in the footsteps of his father. The Islamic State developed and refined an explosive device that would target commercial airliners and attempted such an attack in 2017.[155] The Islamic State similarly developed threat nodes (comparable to al Qaeda’s) based in strongholds such as Raqqa and Manbij, Syria, and Sabratha, Libya.[156] The Islamic State has also trained foreign fighters in developing basic bioweapons, raising fears that fighters who return to their home countries could manufacture a biological weapon with ricin, for example.[157]

Analysts have mistakenly confused the Salafi-jihadi movement’s means—attacking Western targets—with its objectives of embedding itself within the global Muslim community, taking control of it, and then directing a global war of religious conquest. Many analysts use the frequency of attacks on the West as a metric to assess groups’ strength, but al Qaeda’s 9/11 attack occurred when it was weaker and further from accomplishing strategic objectives. The group’s prioritization to exploit the opportunities presented in the local conflicts over directed attacks in the West has thus wrongly contributed to the perception that al Qaeda is in decline. The Islamic State also established itself as the de facto authority in large swathes of Iraq and Syria before even attempting a directed attack against the West. However, it then launched a campaign of attacks against the West, which should make clear the wrong-headedness of equating attacks on the West with group strength. US policymakers must not conflate the decision on whether to conduct a directed mass-casualty spectacular attack with either strength or weakness. Nor should they be quick to dismiss lone-wolf or inspired attacks as one-off incidents that bear no relationship to the Salafi-jihadi movement. The frequency of such attacks increased as the movement strengthened in the Muslim-majority world. These attacks are not occurring in isolation nor are they sui generis. To treat them as such enables al Qaeda, the Islamic State, and the rest of the Salafi-jihadi movement to advance objectives without paying a price.

Download the report here.

Conclusion

The evolution and expansion of the Salafi-jihadi base has outpaced American counterterrorism strategy. US policy has prioritized the battlefield victory against short-term threats, relying heavily on American military and intelligence capabilities. Changes in how Salafi-jihadi groups organize, act, and interrelate are not reflected well in US policy and create real risk that the Salafi-jihadi movement will move beyond a terrorist or insurgent threat to replicate successes it has had in places such as Syria.

The adaptations within the Salafi-jihadi movement have already been effective. They enabled the Salafi-jihadi base to expand into new Sunni communities at the grassroots level, delivering basic goods and services to communities alongside Salafi-jihadi ideology. Such activities have generally not been contested under the US counterterrorism strategy, and because they have been occurring in areas of state breakdown or conflict, they are often contested only through the activities of other nonstate actors.

Locally focused Salafi-jihadi groups are just as threatening in the long term to American interests as global Salafi-jihadi groups. These groups provide the foundation that the transnational organizations such as the Islamic State and al Qaeda use to pursue their global agenda. During the Arab Spring, the Salafi-jihadi movement shifted to prioritize the local conflicts under direct orders from Osama bin Laden, which his successor, Ayman al Zawahiri, has carried forward and which the Islamic State has also pursued.

A successful local Salafi-jihadi group will gain hegemony in the areas it controls. Such a group could be like the Taliban, which became the quasi-recognized government of the state and gave sanctuary to a cell of individuals plotting attacks against the United States. Or it could be like the Islamic State, which ran the trappings of a state while inspiring and facilitating mass-casualty attacks in the West. Or it could be like al Shabaab, which developed linearly from controlling terrain locally to exporting violence to neighboring states. The insinuation of Salafi-jihadi groups into local contexts sets them up to be stronger in the long term. US policy must account for the new localization trend within the Salafi-jihadi movement because, even though groups might not present an immediate and direct threat to the United States or its interests, these groups support and strengthen the global movement.

Key components of the current US counterterrorism strategy fall short in implementation, including the use of sanctions to target terrorist financing and the reliance on local partners to pressure the Salafi-jihadi base militarily on the ground. Salafi-jihadi groups are reorganizing and rebranding at a rate that the US government has not been able to match. The changes on the ground may be driven by local requirements—creating distance between a local group and al Qaeda, for example—but they raise the cost associated with maintaining financial pressure on the groups and require up-to-date information on who and which organizations are under sanctions. Local counterterrorism partners, though a means to limit the American footprint abroad, also come at the cost of weighing partner interests against US interests. Salafi-jihadi groups are aware of where these diverge and have sought to minimize the local partners’ interest in fighting. More recently, the conflicts that have enveloped parts of the Muslim-majority world have also pulled partners away from the counterterrorism fight.

The Salafi-jihadi movement has learned from its failures to strengthen on the ground. The ability of the movement to evolve, specifically to recognize new conditions and adapt to best exploit them, has enabled it to survive and thrive. The recent focus on building popular support through the provision of governance, security, or other basic services was in response to requirements from Sunni communities for these goods. The US push for locally driven solutions to local problems—and avoidance of US interference in local conflicts—has created space for Salafi-jihadi groups and others to shape the solution in their favor. Moreover, the Salafi-jihadi movement has also morphed in such a way that the current US counterterrorism strategy will not be effective at defeating the movement in the long term.

The US mischaracterization of the threat from the Salafi-jihadi movement as a terrorist threat has led to the wrong strategy. A counterterrorism framing of the problem will not be sufficient to address it. The application of the counterterrorism tool kit—from targeting to counter-radicalization—will lead only to the defeat of some immediate threats and will not provide a long-term solution to the Salafi-jihadi threat. US tactical military dominance on the battlefield will not defeat the Salafi-jihadi movement, especially as the movement prioritizes local gover­nance and building popular support among Sunni communities. The United States should take the lesson from its enemy: recognize change and adapt. Until the United States recognizes the true nature of its enemy and adapts its strategy, the Salafi-jihadi movement will persist.

Download the report here.

About the Author

Katherine Zimmerman is a research fellow at the American Enterprise Institute (AEI) and the research manager for AEI’s Critical Threats Project. As AEI’s senior analyst studying terrorist groups, she focuses on the global al Qaeda network and covers the Salafi-jihadi movement and related trends in the Middle East and Africa. She also specializes in al Qaeda in the Arabian Peninsula and Yemen, al Shabaab in Somalia, and al Qaeda in the Sahel.

She has testified before Congress about the threats to US national security interests emanating from al Qaeda and its network. She has also briefed members of Congress, their staff, and US military, diplomatic, and intelligence community personnel. Her analyses have been widely published, including in CNN.com, Foreign Affairs, FoxNews.com, Hill, Huffington Post, Wall Street Journal, and Washington Post.

Acknowledgments

I am deeply grateful to those who generously gave me their time to share their findings, critique my ideas, and engage in discussions that helped advance my understanding of the issues. The conclusions in this paper would not have been possible without these conversations and are better for them. Many people helped me with this effort, but the opinions, findings, and errors in this report are mine alone.

Thank you to those who helped me directly in this effort. My research interns Hailey Kruger and Cole Riggan sifted through the Abbottabad documents to better understand their contents and readily lent their hand to help regardless of the task. The research teams at the Critical Threats Project and at the Institute for the Study of War continue to produce situation assessments that support my work. Emily Estelle’s support in particular was invaluable, and I am indebted to her for both her insights and her incredible ability to manage our al Qaeda research team along with analysts James Barnett and Maher Farrukh. Of course, this paper and my work would go nowhere without AEI’s communications team.

A special thank you is due to Danielle Pletka and Luke Strange for their insights and feedback on drafts. I sincerely appreciate Caroline Goodson for the time and energy she has put into supporting my work and our entire team. I especially thank Dr. Frederick W. Kagan for his ongoing mentorship and time invested in me and my work and for encouraging me to develop my insights further.

About AEI’s Critical Threats Project

The Critical Threats Project at the American Enterprise Institute seeks to inform and educate policymakers, the intelligence and military communities, and all interested citizens who need to understand the nuance and scale of threats to America’s security. The project conducts intelligence analysis on unclassified information to pro­duce continuous assessments of threats to the US and our allies. It develops these assessments into concrete plans for action using best practices drawn from the US military, intelligence community, and diplomatic corps. It provides the executive branch, Congress, the media, and the general public its assessments and recommenda­tions on a nonpartisan basis. Like AEI, Critical Threats accepts no money from the American government or any foreign government.

Critical Threats is directed by AEI Resident Scholar Frederick W. Kagan. Its two analytical teams focus on the threats posed by Iran and the global al Qaeda network, especially in Yemen, the Horn of Africa, Libya, and West Africa.

About Our Technology Partners

The conclusions and assessments in this report do not reflect the positions of our technology partners.

Neo4j is a highly scalable native graph database that helps organizations build intelligent applications that meet today’s evolving connected data challenges including fraud detection, tax evasion, situational awareness, real-time recommendations, master data management, network security, and IT operations. Global organizations such as MITRE, Walmart, the World Economic Forum, UBS, Cisco, HP, Adidas, and Lufthansa rely on Neo4j to harness the connections in their data.

Ayasdi is on a mission to make the world’s complex data useful by automat­ing and accelerating insight discovery. The company’s Machine Intelligence software employs Topological Data Analysis to simplify the extraction of knowledge from even the most complex data sets confronting organiza­tions today—converting data into business impact.

The Institute for the Study of War (ISW) advances an informed under­standing of military affairs through reliable research, trusted analysis, and innovative education. ISW is committed to improving the nation’s ability to execute military operations and respond to emerging threats in order to achieve US strategic objectives. ISW is a nonpartisan, nonprofit, public pol­icy research organization.

Ntrepid enables organizations to safely conduct their online activities. Ntrepid’s Passages technology leverages the company’s platform and 15-year history protecting the national security community from the world’s most sophisticated opponents. From corporate identity management to secure browsing, Ntrepid products facilitate online research and data collection and eliminate the threats that come with having a workforce connected to the Internet.

Linkurious’ graph visualization software helps organizations detect and investigate insights hidden in graph data. It is used by government agencies and global companies in anti–money laundering, cybersecurity, or medical research. Linkurious makes today’s complex connected data easy to under­stand for analysts.

Praescient Analytics is a veteran-owned small business based in Alexandria, Virginia. Our aim is to revolutionize how the world understands informa­tion by empowering our customers with the latest analytic tools and meth­odologies. Currently, Praescient provides several critical services to our government and commercial clients.

AllSource uses satellites, airplanes, drones, social media, weather, news feeds, and other real time data services to deliver Geospatial Intelligence produced by advanced software and analysis.

Hanzo empowers organizations with legally defensible investigation, cap­ture, and preservation of dynamic web content. Its powerful tools are trusted by global corporations, international nonprofits, and government agencies to provide the most efficient and confident capture from the broadest and most complex data sources.