ISIS-K Goes Global

Over the past few weeks, French authorities have uncovered several terrorist plots targeting the 2024 Olympic Games, which began last week in Paris. In one of them, an 18-year-old Chechen man planned to attack an Olympic soccer match in the French city of Saint-Étienne. He was allegedly in contact with a member of the Islamic State (also known as ISIS). The disrupted plot was just the latest in a spike of terrorist activity linked to ISIS. The group’s affiliate, the South Asian–based Islamic State Khorasan (ISIS-K), is responsible for several successful international terrorist attacks this year alone—at a memorial service in Kerman, Iran, in early January; at a church in Istanbul later that month; and at a concert hall outside Moscow in March. The attacks in Iran and Russia combined left nearly 250 people dead and hundreds more wounded. In Afghanistan and Pakistan, where ISIS-K is based, the group claims responsibility for multiple smaller-scale attacks each month.

ISIS-K is not the only source of a heightened terror threat. In a recent essay in Foreign Affairs, the scholar Graham Allison and the former CIA deputy director Michael Morell compared the current security environment to that of the period leading up to al Qaeda’s attacks on September 11, 2001. The warning lights for large-scale violence, they concluded, are flashing as brightly today as in the years before 9/11, when high-profile attacks targeted U.S. embassies in East Africa and the USS Cole off the coast of Yemen. Of the many threats Allison and Morell outlined, however, ISIS-K is among the most concerning, given its capabilities and intent.

When ISIS-K emerged in 2015, the group primarily concentrated on growing its ranks with new recruits not just from Afghanistan and Pakistan but from countries across Central Asia, particularly Tajikistan and Uzbekistan. Like other ISIS affiliates, ISIS-K pursued a highly sectarian agenda. The group laced its propaganda with anti-Shiite screeds and frequently attacked the Hazara, a Shiite minority in Afghanistan. Between 2015 and 2018, the Afghan military, U.S. and NATO troops, and Pakistani forces were all conducting counterterrorism operations against ISIS-K, though these operations were not always coordinated. The Afghan Taliban were also battling the group in certain parts of the country. During this period, ISIS-K was pushed out of pockets of territory it once controlled and suffered significant manpower losses, particularly among its leadership.

Even at this nadir, the group continued to conduct deadly attacks within Afghanistan, many of them in the capital, Kabul. ISIS-K has proven stubbornly resilient in the years since. It has overcome its personnel challenges by further expanding its recruitment efforts, first among battle-hardened Pakistani militants, then across Central Asia. It has adapted its strategy, too. ISIS-K conducts fewer strikes inside Afghanistan than it once did, and many of the attacks it has planned recently are designed to be more lethal and focus on high-profile targets abroad. Intelligence agencies and law enforcement organizations are rightfully on high alert, but the competitive turn in global politics has made it more difficult for them to coordinate their efforts. To quell the international threat that ISIS-K presents, countries will need to overcome this obstacle to effective counterterrorism.

THE COMEBACK

ISIS-K attacks declined between 2018 and 2021, the group’s receding presence a result of the success of the U.S., Afghan, and allied military campaign. That trend might have continued if not for the disastrous U.S. troop withdrawal from Afghanistan in August 2021. One of the most harrowing episodes of the chaotic evacuation was an ISIS-K suicide attack at the Kabul airport, which killed 13 U.S. servicemembers and dozens of Afghans. The blast was an ominous demonstration of ISIS-K’s lethal capabilities, but U.S. forces were on their way out, leaving the Afghan Taliban as the only entity combating the group on the ground. Without a consistent U.S. military and intelligence presence in Afghanistan, it was only a matter of time before ISIS-K was able to regroup.

The United States has not ended its counterterrorism efforts in the region entirely. But with no physical presence in Afghanistan, it relies on what President Joe Biden has called an “over-the-horizon” approach, using signals intelligence, cooperation with regional partners, and armed drones to attack high-value targets deemed a threat to national security. When a U.S. drone killed the al Qaeda leader Ayman al-Zawahiri at a safe house in Kabul in July 2022, the Biden administration offered the strike as evidence that its over-the-horizon approach could keep Americans safe.

The day-to-day job of containing the threat from ISIS-K, however, fell to the Taliban, which became the de facto government of Afghanistan after the United States withdrew and the political and security institutions it had been supporting rapidly collapsed. At first glance, the Taliban appear to have been surprisingly successful at counterterrorism. Between September 2022 and June 2023, ISIS-K attacks dropped substantially, according to research conducted by Amira Jadoon, Andrew Mines, and Abdul Sayed. During that time, ISIS-K averaged four attacks per month in Afghanistan, down from 23 per month during the first year of the Taliban’s rule. But these figures do not necessarily indicate a degradation of the group’s operational capacity, nor is it clear that the Taliban’s tactics were the primary cause of the decline.

ISIS-K has proven stubbornly resilient.

More likely, the reduced frequency of ISIS-K attacks inside Afghanistan is a result of the group’s strategic pivot. Under its current leader, Sanaullah Ghafari (also known as Shahab al-Muhajir), who assumed this role in June 2020, ISIS-K has expanded its recruitment and propaganda efforts and sought ways to internationalize its agenda. Whereas previously its ambitions were largely local, recently it has ramped up its attacks across the border in Uzbekistan and Tajikistan and on foreign interests within Afghanistan. In 2022, for example, ISIS-K struck the Russian embassy and a hotel frequented by Chinese businesspeople in Kabul.

ISIS-K now has even wider horizons. It is both pushing its propaganda to a more global audience and threatening attacks farther afield. In addition to outreach across its core area of operations in South and Central Asia, ISIS-K is disseminating media content in multiple languages to reach more people. It mainly does so through its in-house outlet, the Al-Azaim Foundation for Media Production, which primarily publishes in Pashto but also produces regular content in English, Farsi, Russian, Tajik, Turkish, Urdu, and Uzbek. To further amplify its messages, ISIS-K encourages its supporters around the world to create their own propaganda that aligns with its positions. The group’s official messaging this year has included direct threats against targets in foreign countries, such as Euro 2024 in Germany, the Olympic Games in France, and the Cricket World Cup in the United States. (Before the start of Euro 2024 in June, a man who had unsuccessfully applied for a job related to the event was arrested at the airport in Cologne, Germany, charged with sending money to ISIS-K.) After the Moscow attack in March, a website affiliated with ISIS-K released an image bearing the text “After Moscow…Who Is the Next?” and listing the names of four European cities—London, Madrid, Paris, and Rome.

ISIS-K’s efforts to threaten the West include radicalizing members of Central Asian diasporic communities in Europe and North America and inciting individuals to violence. In this “virtual entrepreneur” model, which the group has used successfully in the past, operatives in Afghanistan or Pakistan make contact with would-be ISIS-K supporters abroad to try to convince them to carry out attacks in the countries where they reside. If they agree, ISIS-K handlers feed them instructions remotely and put them in touch with operatives on the ground who can provide the fake documentation, weapons, and other logistical support necessary to conduct a terrorist attack.

Since the group’s physical and virtual networks reinforce each other, effective counterterrorism requires disrupting both. Breaking up physical networks involves measures like the ones U.S. officials took just weeks ago when they arrested eight Tajik nationals who had entered the United States via the southern border and were later identified as potentially having links to ISIS-K. To dismantle virtual networks, governments must work with social media and other tech companies to identify and take down accounts and content promoting terrorist propaganda. This alone is not sufficient; no cleanup campaign catches everything, and the low barriers to entry for building a presence online make content removal a cat-and-mouse game. Still, it is necessary as part of an ongoing effort to limit the reach of extremist propaganda.

GLOBAL PROBLEM, GLOBAL SOLUTION

The increasing frequency of foiled ISIS-K plots underscores the need for such measures. One of the first major ISIS-K plots uncovered abroad was in Germany in April 2020, when German police thwarted a plan to attack U.S. and NATO military bases in the country. The Washington Post reported that by February 2023, counterterrorism officials had identified no fewer than 15 separate ISIS-K plots targeting sites around the world, including churches, embassies, and the 2022 World Cup in Doha, Qatar. Authorities foiled ISIS-K plots in Germany and the Netherlands in July 2023, as well as a planned attack on New Year’s Eve celebrations in Cologne, Germany, and Vienna, Austria, in December 2023. This year, in March, President Emmanuel Macron announced that France had disrupted multiple ISIS-K plots on French soil. The same month, German police arrested two Afghan nationals who had been communicating with ISIS-K handlers while planning an attack on the Swedish parliament as an act of revenge for Quran burnings in Stockholm.

The pattern is unnerving policymakers. After the ISIS-K attack in Moscow in March, Christopher Wray, the director of the Federal Bureau of Investigation, warned that “the potential for a coordinated attack” on U.S. soil was “increasingly concerning.” Wray added, “As I look back over my career in law enforcement, I’m hard-pressed to come up with a time when I’ve seen so many different threats, all elevated, all at the same time.”

Dealing with many threats at once requires cooperation. ISIS-K propaganda has denounced a long list of countries—including not just the United States and its European friends but China, India, Iran, and Russia, too—putting all of them in the group’s cross hairs. In a sense, the scope of its threats is similar to that of ISIS in Iraq and Syria from 2014 to 2017. The original ISIS also lashed out against a diverse group of adversaries, including the governments of Iraq and Syria, Kurdish militias, Iranian-backed paramilitary forces, and U.S. and allied forces operating in the region. At its peak, the U.S.-led Global Coalition to Defeat ISIS boasted 87 members. Strange bedfellows worked together or in parallel to squash ISIS and evict the group from the territory it had conquered.

Terrorist groups exploit the seams between great powers.

It is hard to imagine a similar degree of coordination today, however, with intensifying competition leaving countries fewer incentives to cooperate—even when it comes to facing down a group that threatens them all. Countries that might have a shared interest in stopping terrorism, including China, Iran, Russia, Turkey, and the United States, are instead trying to stymie one another’s attempts to project power and build influence in regions where ISIS-K and other terror groups operate, such as Central Asia, the Caucasus, and the Sahel. Before the ISIS-K attacks in Iran and Russia this year, the U.S. intelligence community provided advance notice to Tehran and Moscow in keeping with its “duty to warn” when it has knowledge of impending violence toward civilians. Yet by all accounts the Iranian and Russian governments both shrugged off the warnings.

A common commitment to intelligence sharing seems to be a casualty of the shift from the post-9/11 era, when many governments of different stripes collaborated in the war on terrorism, to the current phase of great-power competition. The United States and its European allies still cooperate, and it is likely that U.S. intelligence helped identify at least some of the foiled plots in Europe this year. But among countries separated by geopolitical fault lines, counterterrorism assistance has become more cumbersome and less frequent.

ISIS-K and other terrorist groups exploit the seams between great powers. Not only do they avoid detection when countries do not share information, but they also deliberately launch attacks that exacerbate sectarian tensions, making it even more difficult for governments to prevent further violence. Terrorist activity is a global problem, as ISIS-K’s newly ambitious strategy shows, and counterterrorism efforts must be global, as well. As long as intelligence agencies remain wary of cooperating or passing along critical information about this shared threat, they will cede the initiative to the groups that would do their countries harm.