Robin Simcox
June 18, 2018
Abstract
Almost 1,000 people have been injured or killed in terrorist attacks featuring asylum seekers or refugees since 2014. Over the past four years, 16 percent of Islamist plots in Europe featured asylum seekers or refugees. ISIS has direct connections to the majority of plots, with Germany targeted most often, and Syrians more frequently involved than any other nationality. Nearly three-quarters of plotters carry out, or have their plans thwarted, within two years of arrival in Europe. Radicalization of plotters generally occurred abroad although in the most recent plots, more commonly within Europe itself. Europe’s response to migration flows has been inadequate and inadvertently increased the terrorist threat dramatically. European leaders must acknowledge the mistakes of the past and control the refugee flow strictly in the future.
In November 2015, an ISIS cell killed 130 and injured 368 in coordinated attacks across Paris. In order to plan the atrocity, key members of the cell—a mix of those born in Europe and those born in the Middle East, South Asia, or North Africa—used migrant routes to travel back and forth between Syria and Europe. The potential security risk that bogus asylum seekers pose in Europe was brought into focus with more urgency than ever. It proved disturbingly simple for these ISIS members to conceal themselves among genuine refugees as, at the time, European borders were under great strain. In Africa, hundreds of thousands of people had used an increasingly lawless Libya as a gateway from which to land in Italy via the Mediterranean Sea. In the Middle East, the humanitarian catastrophe in Syria saw hundreds of thousands head to Europe via Turkey. Massive burdens were placed on Greek landing ports and neighboring Balkan countries as asylum seekers headed north. In the fall of 2015, Chancellor Angela Merkel opened Germany’s borders in an attempt to respond to the crisis. The morality and long-term wisdom of this decision remain fiercely debated. Yet the short-term impact on European security is more clear-cut. Pew polling from September 2016 had demonstrated that 59 percent in Europe believed that the refugee crisis would lead to more terrorist attacks. The public’s instinct was proven correct, as asylum seekers struck in ISIS’s name in Berlin, Stockholm, London, and other Western European cities. European leaders must recognize mistakes of the past and control the flow of refugees strictly in the future. As most terrorism plots involving refugees and asylum seekers are prevented or occur within three years of arrival, European security agencies should prioritize monitoring very recent arrivals whom they assess to present a risk. The security agencies should also show a willingness to review how intelligence can be shared more widely with local police.
Context
The recent refugee and migrant flow has forced policymakers to consider security issues related to accepting large amounts of asylum seekers from conflict zones. Yet the negative security implications stemming from European states being insufficiently prudent about accepting Islamist asylum seekers is a decades-old phenomenon. In the 1990s, Islamist ideologues fled authoritarian states across the Middle East and North Africa, claiming asylum in Europe. The likes of Jordanian- Palestinian Abu Qatada al-Filistini; Egyptians, such as Hani al-Sibai and Anwar Shabaan; and Syrian Omar Bakri Mohammed all subsequently helped mainstream Islamist causes in segments of European Muslim communities. The consequences live on: Salman Abedi, the Manchester Arena suicide bomber of May 2017, was the son of a Libyan Islamic Fighting Group refugee who arrived in the U.K. in the 1990s. Most asylum seekers heading to Europe do not pose a terrorist threat. Furthermore, most plots in Europe do not involve refugees or asylum seekers. There were 194 publicly disclosed Islamist terror plots or acts of violence between January 2014 and December 2017; only 16 percent involve refugees or asylum seekers. European police forces have also received almost 2,000 tip-offs from refugees themselves about terrorist activity. One high-profile example led to the arrest of an ISIS operative in Leipzig, Germany. None of this makes Western European countries’ handling of migration flows any less catastrophic. Nor does it alter the fact that the terrorist threat in Europe has increased as a direct result of immigration and open-border policies.
Data
This analyzes terrorist attacks planned in the period between January 2014 and December 2017. During this time, there were a minimum of 32 plots featuring refugees or asylum seekers that were either foiled or took place (an average of eight a year), which featured a total of 44 refugees or asylum seekers. Two of the cases included in this study relate to ISIS cells based in refugee centers awaiting further instruction (one in Germany, one in Austria). The overall number of European plots involving refugees or asylum seekers was relatively small in 2014 and 2015. However, one of those plots was the most devastating terrorist attack in Europe since the al-Qaeda-linked bombings of Madrid in March 2004: ISIS’s attacks in Paris in November 2015.
A series of cases in Germany tied to recent arrivals from Syria drove a sharp increase in plots in 2016, before a drop in 2017. Overall, 84 percent of cases connected to asylum seekers or refugees occurred in the last two years of this four-year study.
Gender.
The age of four of the 44 individuals involved in plots was unknown. Of the remaining 40, the mean age was 25.1; the median age was 24; and the mode was 22 and 23. Eight of the 44 were teenagers (18 percent), with four being minors (9 percent). The youngest person to be involved in a plot was 16 years old. Mohamed J., a Syrian who arrived in Germany in 2015, planned a bombing with an ISIS-linked operative in Israel with whom he had been in contact. Mohamed J. was placed in juvenile detention for two years after being found guilty in April 2017.7 The oldest plotter was 40 years old: Kamal Agoujil, a Moroccan who was part of the ISIS network that planned the Paris and Brussels attacks of November 2015 and March 2016, respectively. Agoujil was arrested in Austria in December 2015. All refugees or asylum seekers involved with terrorist plotting in Europe since January 2014 have been male.
Countries and Nationalities.
The 32 plots were devised or carried out in 12 countries: Austria, Belgium, Denmark, Finland, France, Germany, Italy, the Netherlands, Norway, Sweden, Switzerland, and the U.K. The country most often under attack was Germany (41 percent of all plots). The other countries targeted on multiple occasions were France (on four occasions), Belgium and the U.K. (both on three occasions), and Austria (twice). Those targeting Europe also came from 12 countries (Afghanistan, Algeria, Iraq, Morocco, Pakistan, Russia, Saudi Arabia, Somalia, Sudan, Syria, Tunisia, and Uzbekistan) and six regions (the Middle East, North Africa, East Africa, Eastern Europe, Southern Asia, and Central Asia). In total, 84 percent of the plotters were either from the Middle East (21 individuals, 48 percent) or North Africa (16 individuals, 36 percent).
In total, 15 individual plotters (34 percent) were Syrian. Twelve of these individuals were involved in plots targeting Germany. Another two worked together to target Denmark (although one of these plotters was a refugee who lived in Germany and was also convicted there). The final Syrian, Ahmed Alkhald, was the “explosives chief” for the Paris and Brussels ISIS cell. After Syria, the next highest number came from Morocco with six individuals (14 percent). This included Abderrahman Bouanane, who used a knife to kill two and injure eight in Turku, Finland, in August 2017. Next was Iraq with five individuals (11 percent), including two who participated in ISIS’s Paris attacks of November 2015 and Algeria (also five individuals and 11 percent).
Legal Status.
Twenty-four of the 44 individuals registered as asylum seekers (55 percent); a further 11 were given refugee status (25 percent). The status of the other nine (20 percent) was unclear. Of the 24 asylum seekers, at least nine had their applications rejected but remained in Europe regardless. Of these nine, four committed their attack, and one other was able to attempt to do so without initial detection.
In January 2016, Tarek Belgacem, from Tunisia, was shot and killed Belgacem arrived in Europe in 2011, landing in Romania. He had an asylum request there rejected, as well as in Austria, Germany, Italy, Luxembourg, Sweden, and Switzerland. However, he was not deported.
In December 2016, Anas Amri, also born in Tunisia, drove a truck into a Christmas market in Berlin. He arrived in Italy in 2011, where he spent time in jail, before traveling on to Germany in 2015. His asylum request was rejected that June, but German authorities were unable to deport him; Tunisian authorities refused to accept him as he was not in possession of a Tunisian passport.
Rakhmat Akilov, born in Uzbekistan, committed a vehicular attack in Stockholm in April 2017. He traveled to Sweden in 2014 and applied for asylum, which was rejected; by December 2016, he had been told to leave the country in the next four weeks. However, Akilov disappeared from his registered address and, even if police had been able to track him down, it is unlikely he would have been deported to Uzbekistan due to the country’s poor human rights record.
Ahmed A., born in Saudi Arabia, carried out a series of stabbings in Hamburg in July 2017. He arrived in Europe in 2008, having asylum requests rejected in Norway, Spain, and Sweden. He then traveled to Germany, where his request was also rejected. However, in July 2015, an administrative error allowed Norway to refuse to accept Ahmed A.’s return from Germany, so he remained there. In August 2017, Abderrahman Bouanane from Morocco committed knife attacks in Turku, Finland. Bouanane applied for asylum at the beginning of 2016, an application that was rejected. He was appealing the decision at the time of his attack.
Weapons, Targets, and Casualties.
In the 32 plots, the most common weapon of choice was explosives (nine plots, 28.1 percent). Explosives were used in conjunction with firearms on two additional occasions (6.3 percent); as part of a vehicular attack once (3.1 percent); and as part of an edged-weapon (such as a knife) attack once (3.1 percent). Therefore, overall, explosives were a component of 13 plots (40.6 percent). The use of solely an edged weapon was the secondmost- popular choice (five plots, 15.6 percent). One attack utilizing just a vehicle, and one attack using just a firearm, were also carried out (3.1 percent). In 12 of the plots (37.5 percent), the type of attack was either unknown or the plot was not developed to the extent that the authorities were aware of the mode of delivery.
Civilians were primarily the target (on 18 occasions, 56.3 percent). Various arms of government were the targets on three occasions (9.4 percent). In over a third of the plots (11 times, 34.4 percent), the target was unspecified or the plan not fully developed. Eleven of the 32 plots (34 percent) were broadly successful for the terrorists in that they led to casualties of some kind (either injuries or deaths). In total, these 11 attacks injured 814 people and killed 182. The cell that carried out the Paris attacks in November 2015—which was comprised of both homegrown and foreign-national terrorists exploiting migrant routes is responsible for 368 of these injuries and 130 deaths. The deadliest attack solely carried out by a refugee or asylum seeker was the vehicular attack carried out in Berlin in December 2016, which injured 48 and killed 12. Of these 11 successful attacks, four occurred in Germany. Belgium and France suffered casualties twice. Finland, Sweden, and the U.K. all suffered on one occasion. While there were fewer overall attacks in 2017, a higher ratio led to casualties than the previous year.
Connections with a Designated Terrorist
Organization (DTO).
Twenty-one of the 32 plots (66 percent) had known ties to a DTO. In 18 plots, these ties were solely to ISIS. One plot had connections to both ISIS and the al-Nusra Front (ANF), al-Qaeda’s then-branch in Syria. (Abd Arahman A.K.—a Syrian dispatched to Germany by ISIS in October 2014 in order to build suicide vests as part of an alleged plot in Düsseldorf—had previously constructed bombs for ANF.) Two plots had a connection to the Pakistani terror group Lashkar-e-Taiba via the same man, Mohamed Usman, whom ISIS sent to Europe in October 2015. However, the EU border agency in Greece assessed Usman to be an economic migrant rather than a genuine refugee. Usman was told to leave Greece within a month, an order he ignored, yet the delay prevented him from participating in the Paris attacks the following month. Usman traveled on to Austria to join up with fellow ISIS recruits, where ISIS instructed him to remain. On seven occasions (22 percent), the known contact with a DTO was only electronic. On five occasions (16 percent), it was face-to-face. On seven occasions, it was a combination of both (22 percent). Twice, a contact with a DTO was known to have taken place, but the mode was uncertain (6 percent). In 11 cases (34 percent), there were either no direct connections to a DTO or it was uncertain whether contact had taken place or not. For example, a Somali imam who is suspected of planning an attack in Rome was also praising al-Shabaab (al- Qaeda’s Somali affiliate) and ISIS, encouraging others to join these groups. However, it is unclear if he had any direct ties to them. The 11 successful plots that led to casualties all had varying levels of connections to ISIS. The group directed five (including Stockholm attacker Rakhmat Akilov, despite ISIS somewhat unusually failing to claim credit for his attack after the fact).
ISIS also claimed responsibility for another two attacks, saying its “soldiers” committed them. One such soldier, London Underground bomber Ahmed Hassan, admitted to U.K. immigration officials to being “trained to kill” by the group in Iraq (he denies, however, being sent to Europe in order to carry out a terror operation). ISIS seemingly acted as an inspiration for two others attackers without having any direct ties. Abderahman Bouanane, the terrorist who carried out the stabbings in Finland, was known to have possessed ISIS propaganda, while Ahmed A., the Hamburg assailant, had an ISIS flag. A high proportion of plots showed contact with a DTO between 2014 and 2016. However, there was a significant decrease in 2017. Whether this is the beginning of a trend or an anomaly will only become clear in the years ahead. A positive interpretation of these statistics is that it reflects the success that the U.S.-led, anti-ISIS coalition has had on the battlefield in Iraq and Syria and the increased difficulty ISIS external operations planners have in communicating with recruits. A more pessimistic interpretation would be that ISIS’s ideology and message has now been spread so far and wide that their supporters do not need to contact or be contacted by ISIS planners. They know the kind of terror attacks that ISIS approves of and know they have theological approval to act without ISIS’s direct permission.
Arrival time vs. Attack Launched.
Of the 44 asylum seekers or refugees studied, the year of arrival in Europe was known for 41 of them. The mean distance between arrival in Europe and a plot being thwarted or committed was 26 months (or two years and two months). Of these 41 asylum seekers, 14 (34 percent) arrived in Europe between 2004 and 2014; 26 in 2015 alone (63 percent); and one in 2016 (2 percent). Of the 41, 21 (51 percent) either committed an attack or had it thwarted within the first 12 months of their arrival in Europe as an asylum seeker. A further eight had done so within 13 to 24 months (20 percent). Therefore, nearly three-quarters (71 percent) attempted their attack or had it prevented within two years of arrival. The longest time between an individual arriving in Europe and eventually committing an attack was 13 years. Haashi Ayaanle arrived in Belgium in 2004, having his application for asylum accepted in 2009, becoming a Belgian citizen in 2015, and then injuring two soldiers in a knife terror attack in Brussels in August 2017. The shortest was within a month: Ayoub el-Khazzani entered Hungary on August 1 and then attempted to gun down passengers on a train traveling between Paris and Amsterdam three weeks later.
Radicalization Process.
Radicalization is both a local and foreign phenomenon in these plots. Of the 32 plots, 12 (37.5 percent) could be characterized as local radicalization plots, in that the refugees or asylum seekers appeared to have begun to immerse themselves in violent Islamist ideology once they were in Europe. A further 10 (31.3 percent) involved individuals or cells entirely radicalized abroad. In five plots, there was a mix (15.6 percent). In four of these, while the asylum seekers held radical ideas before coming to Europe, they operated as part of a broader cell working with locally radicalized, homegrown operatives. In one plot, one operative was radicalized locally, while the other plotter’s radicalization source was unclear.
In five plots (15.6 percent), it was unclear where radicalization had occurred.
The most effective terror plots were those four where homegrown terrorists worked together with foreigners who had exploited the migrant routes. These four plots—which included the ISIS attacks in Paris in November 2015 and in Brussels in March 2016—resulted in 671 injuries and 162 deaths. Beyond that, local radicalization plots tended to be more successful. Six of the 12 plots (50 percent) led to casualties, resulting in 77 injuries and 20 deaths. By contrast, plots just containing asylum seekers or refugees who were radicalized abroad succeeded only twice (20 percent). This led to 66 injuries and no deaths. This may be because those radicalized locally tended to plot alone, rather than in a cell, thus perhaps making terrorist activities harder to spot by authorities. Only three plots (25 percent) saw locally radicalized asylum seekers or refugees working as part of a cell (only one of which contained another asylum seeker or refugee in the cell).
The remaining nine saw terrorists seemingly act alone once on the ground (although some were known to be in contact with planners abroad and so could not truly be classified as “lone wolves”).
When breaking this data down by individual rather than by plot, a slightly different picture seems to emerge. Of the 44 refugees or asylum seekers studied, 26 (59 percent) seemingly already held radical ideology prior to arrival in Europe. Slightly fewer (13 people, 30 percent) became radicalized once in Europe. With five cases (11 percent), it was unclear. Individuals or cells who were already radicalized before arriving in Europe (whether their plot was thwarted or carried out) were prevalent between 2014 and fall 2016. However, from November 2016, there was only one example of a plot involving someone already seemingly radicalized before coming to Europe. This was Ahmed Hassan, the London Underground bomber, in September 2017. With the seeming exception of Hassan, there was a shift to plots carried out by those who were radicalized in Europe itself at the latter part of the time period studied. Ten of the 14 individuals involved from November 2016 were known to be radicalized locally (71 percent), with three cases uncertain. More data will need to be monitored in the months and years ahead before decisive conclusions can be drawn as to whether this is a blip or an emerging trend. Fifteen of the 26 foreign-radicalized individuals (58 percent) pertained to Syria (10 occasions) or Algeria (five). The remaining plotters were from Iraq and Morocco (both four occasions), and Afghanistan, Pakistan, and Tunisia (each on one occasion). The locally radicalized individuals came from a slightly broader range of countries (10 in total), with three from Syria and two from Tunisia.
Profile
There is no “one size fits all” to garner from this analysis. However, the data collected from these four years point in a certain direction.
Terrorist profile:
- Male,
- Early to mid-20s,
- From the Middle East, most likely from Syria, or North Africa, and
- More likely to be an asylum seeker than actually given refugee status.
Plot profile:
- A more than one-in-three chance that the plot will have a component with explosives,
- A more than one-in-three chance that Germany will be the country targeted,
- A majority of plots will target civilians,
- Two-thirds of plots will see direct contact with a DTO, and
- Radicalization is both a foreign and local phenomenon, with more local radicalization plots,but more individual plotters radicalized abroad.
Plot outcomes:
- Plotters to act relatively soon after arrival into Europe, with over a one-in-two chance that the plot will be attempted or disrupted within 12 months of arrival, and
- More than a one-in-three chance that the plot will lead to casualties, with Germany suffering most.
The Response
A comprehensive response to some of the above is beyond the remit of any one government. For example, there is only so much that any one European country can do about radicalization of individuals in foreign lands, bringing peace to Syria, or managing the refugee flow it has exacerbated. There is already awareness among governments of some areas upon which this research touches. Trying to monitor the sale of ingredients that can be purchased in order to acquire explosives, for example; installing barriers in an attempt to prevent vehicular attacks; and recognition that it is impossible for law enforcement and intelligence agencies to stop every attack, and that, hence, preventative intervention programs may have some use. The overall number of refugees entering Europe is also, at present, slowly being reduced. In other areas, there is a lack of will or there are legal constraints (surrounding the deportation of terror suspects back to their country of origin, for example). Even with these constraints, however, there are some possible short-term steps that European governments might be willing to take, all of which the U.S. should encourage.
Recommendations
- Acknowledge past mistakes.
Leaders owe the public honesty. In that spirit, there should be a public recognition by key European leaders that taking in a large number of refugees from Islamist conflict zones has increased the terror threat. That does not mean there are not certain benefits to controlled migration of refugees or asylum seekers—human lives are, after all, potentially being saved—which must also be highlighted. However, the dozens of terror plots in which refugees or asylum seekers have also been involved must be acknowledged.
- Significantly reduce the numbers.
The refugee crisis has shown that European countries have strong and admirable humanitarian impulses; it has also presented major security issues. ISIS has infiltrated Europe using this tactic, and its ideology has proven attractive even to recent arrivals who were not previously part of ISIS’s orbit. European governments should be aware that they can reduce the terror threat by reducing the number of refugees they accept from war zones scarred by Islamist conflicts.
- Allocate resources in proportion to the threat.
With resources limited, European countries cannot be constrained by political correctness. For example, the refugee and asylum-seeker threat thus far has come more from Middle Eastern and North African communities than East African or Central Asian; France’s terror threat tends to be homegrown, while a higher proportion of Germany’s plots are tied to migrants. While there is no fail-safe way of knowing who will present a threat in the future, national approaches to counterterrorism should be guided by the experiences of the past.
- Prioritize monitoring high-risk, recent arrivals.
This should particularly be the case for the first 12 months to 36 months. Terror cases involving refugees and asylum seekers tend to come to fruition relatively soon after their arrival in Europe. Knowing whom to monitor is not an exact science. However, when someone claiming asylum already has prior ties to DTOs—such as Ahmed Hassan—he should become a priority for state response (deportation or prosecution where possible, de-radicalization initiatives, or surveillance). However, the latter two options, particularly, offer no assurance of preventing an attack.
- Review the control of intelligence.
After the terror attacks in the U.K. last year, intelligence agencies and the police carried out internal reviews in an attempt to improve performance in the future. David Anderson, the former independent reviewer of terrorism legislation, carried out an independent assessment of these internal reviews and noted a new willingness for “release of more knowledge derived from intelligence to local police and agencies.” The efficacy of this should be monitored—and the ways in which police and intelligence agencies are organized can differ vastly from country to country— but it is an approach others in Europe should at least contemplate.
Conclusion
There are obvious reasons for the refugee flow into Europe. For one, the humanitarian situation in Syria, especially, is utterly catastrophic. Furthermore, even if not a single additional refugee has been allowed into Europe in recent years, the terrorist threat would clearly not disappear. Homegrown radicalization also remains highly relevant, probably even more so. However, the actions of a small minority of terrorists who have exploited migrant routes to come to Europe have had an outsized impact. Innocent people have been murdered. The Paris attacks of November 2015 were the most devastating in Europe in over a decade. The vehicular attacks in Berlin and Stockholm contributed to the physical transformation of major European cities with increasing amounts of bollards and barricades in public places. The fault for this lies with the terrorists. However, ill-conceived immigration policies have made it easier for them to strike. European leaders were either naïve about the risks or failed to communicate honestly with the public the impact that accepting such large amounts of people would have on security. Germany, with its open border policy, was particularly culpable. And as was shown when Syrian refugees based in Germany planned attacks in Denmark, terror threats do not always remain local.
The fall-out from the decision to take in such a large amount of unvetted people in such a short time will continue for decades to come. Yet in the short term, European governments must be realistic about the risk that terrorism poses to their societies, be unafraid to identify its origins—both at home and abroad—and implement policies that match the scale of the challenge.
—Robin Simcox is the Margaret Thatcher Fellow in the Margaret Thatcher Center for Freedom, of the Kathryn and Shelby Cullom Davis Institute for National Security and Foreign Policy, at The Heritage Foundation.
