EDMUND G. BROWN JR. GOVERNOR MARK S. GHILARDUCCI DIRECTOR VIA EMAIL ONLY: willparrish2016@gmail.com October 16, 2017 Will Parrish Investigative Journalist Willparrish2016@gmail.com Subject: September 1, 2017 Request for Public Records Dear Mr. Parrish: Please find the attached bates stamped documents, “PARRISH PRA_00001 to 00285” in response to your September 1, 2017 Public Records Act request. Certain information contained within the attached response has been redacted pursuant to Government Code section 6254(f). Other entire documents that were identified as responsive to your request were exempted from disclosure pursuant to Government code sections 6254(f) and 6254(l). Please be advised that the California Governor’s Office of Emergency Services (Cal OES) is still reviewing additional, potentially responsive documents. Once a determination regarding the additional documents is made, we will notify you of the same. We anticipate notifying you on or before October 23, 2017. Of course, should you have any questions, please contact me at (916) 845-8972 or by email at pra@caloes.ca.gov. Sincerely, Amanda De Alba Attorney, Office of Legal Affairs cc: Alex Pal, Assistant Chief Counsel 3650 SCHRIEVER AVENUE, MATHER, CA 95655 (916) 845 - 8972 TELEPHONE (916) 845 - 8389 FAX LAW ENFORCEMENT SENSITIVE SYMBOL INTELLIGENCE GROUP Officer Awareness Bulletin intelligence on Trending 15mm (LES) ANTIFA ANTI-ANTIFA MOVEMENT SYMBOLS (LES) Antifascist Action aka Antifa, AFA, Black ?ier: Is a global netvvork of left?wing anarchIst groups whose Lgoal' Is to 'smash fascism' In ali its forms' specifically sexism; raCIsm, homophobla government corruption and lslarnophobia The AntI?Antlfa Movement :5 a giobal collective of extreme right rIatIonalIst groups who popese antifascist groups Anti Antifa groups have appropnated some of the symbolism and tactics . of Antifa. Both movements are active in giobal protests advocate aggressive tactics and use violence against police and each other Left Wing Anarchists . Right WIng NationalIsts (LES) FA has grOWn significantly In the S. in response to (LES) Is both a slogan and a name that refers to the election of PresIdent Donaid Trump Militant Antifa individuais and groups who are engaged' In_ a political battle against anarchists. use biack bloc tactics to oppose those they perceive as Antifa groups in rare cases Anti?Antifa Is a term for right wing i fascists including the. police They are very active in Antr?Trurnp demonstrations and recently have destroyed property at the. 7 presidential inauguration and Liniv. of California Berkeley They ?5conservatwes who are not with racist natIonaiIsts Anti~ y?AntIfa activists are fteo recruited from violent rIght Wing extremist _;groups and Inciud iItant white neo- ?Nazis,- ratist frequently engage in ioient pretests against white nationalist skinheads and footbali hooiigans Anti4Antifa activists have adopted groups: in June 201,6 severai peopie were hospItaiIzed when the outing tactics of Annie arid pubiish perstinai data ofAntIfa Antifa members attacked and fought with White Supremacist members. Althea 0 groups do not pubiish direct cails for the grotipsf outside the state Capitol' In Sacramento A popular Antifa 1 7 jo dissuade it- resuiting' In IntImIdatIon and tactic is disclosmg private information online of individuals A On March 4 2017, Philadelphia Anti? 'Invoived In white nationaiist groups Some Antifa Facebook 7? poeteti. on heir ebsite a $5000 reward for information and a members In the area and wrote i?We 7 pages advocate and depict violence destruction and theft of . . their addresses and where the work property against perceived fascists ANTIFA ANTEFANET LAW ENFORCEMENT SENSITIVE PARRISH saws-away "um umLAW ENFORCEMENT SENSITIVE Symbol intelligence Group Officer Awareness Bulletin 15 March 2017 (LES) ANTIFA MOVEMENT SYMBOLS (LE5) ANTIFA 8r. ANTI-ANTIFA Emblems initiaily appear simiiar. Anti?Antifa groups have apprOpriated some of Antifa?s symbolism for several reasons: 1) displaying openly Nazi symbois Is illegal In many countries, 2) to ridicule what the symbols represent and 3) to mimic the success of left wing movements. Annie and AntI~AntIfa symbols appear as 19305, flags, tattoos, patches graffiti, signs, stickers and on clothing Logos are eIItremeiy similar so it can be easy to mIsmterpret which group individuals are affiliated with. The following analysis provides detailed Information that dIstInguIshes AntIfa left anarchIsts from AnthAntIfa right wing nationalists ANTIFA Left Wing Anarchists I (LES) ANTIFA Emblem consists of a black circle With red and black flags 7 in the center. Distinguishing attributes include the words Antifa or Antifascist Action (in Various langUages) written on the black circle. Sometimes the name and/or locatidn of a specific group is written The positions of the black and red flags can differ The origin of the symbol Is the 1932 German communist paramilitary movement Aktion iogo that depicted the circle and the flags facing right' In red (LES) Three Arrows In a Circle Is another popular Antifa symbol and sometimes appears on the flag. The symbol of three arrows pointing southwest/to the lower left inside a circle originated With the German 193Q?s antIfasCIst ,group ?iron Front? it was designed to easily Cover Naz sWastikas The Antifa international Website claims that the arrows currently stand for equality, fraternity, and selidarity . 7,13, g; Way I- was: (.1: . 54:52.32: 912:2. .: :45; LAW ENFORCEMENT SENSITIVE Right hiationalists (LES) AntivAntifa Emblems consiIIt of a black circle with red and black . ?ags In the center that are identicai to the Antifa iogo. Distinguishing attributes include variations of the Words and symbols on the flag Anti? .1AntIfa groups replace the words Antifa Action with expressions such as Anti Antifa Action and the names and/or geographic locations of them I .group The Celtic Cross Is often depicted on the black flag and the 'SVSwastiica on the red flag Anti~Antifa graphics have included the No symbol (a circle with a red diagonal line through it) encircling the Antifa . .a'symbol and other popular white supremacist symbols. LEsiTiIe Swastika Is" tJ1e symbol of the Nazi Party In Germany it as the PARRISH .fr (LES) ANTIFA ANTI- ANTIFA Good Night Symbols LAW ENFORCEMENT SENSITIVE Symbol intelligence Group Officer Awareness Bulletin 15 March 2017 (LES) ANTIFA MOVEMENT SYMBOLS (LES) The Good Night White Pride aka GNWP Logo orIgInated from _-an actual incident In Ann Arbor Michigan. On May 9 1998 the held a rally and clashed with anti racist countenprotesters A photo Of I1I8~4year-old Harlon Jones, an Ann Arbor anti?racist kicking a member' In the head at the rally became the Iconic Silhouette Image of the logo- Good Night symbols appear as logos, flags tattoos patches graffiti, signs, stickers and on clothing There have been Inany subsequent variations of the GocIId Night theme by both Antifa and Anti Antifa activists Since the ieft and their ighIt both employ the iconic Image it can be easy to misinterpret which group an individual Is affiliated with The following analysis prowdes dIstInctIons between Antif-a ieft wing anarchIsts from Anti~AntifaI right wing nationalists. ANTI FA - Len: Wing AnarChists (LES) Good Night White Pride Logo White pride signifies white nationalist ideology. The symbol on the victim in the image is typically a Swastika or other popular white supremacist emblem to indicate who is iosing the fight Variations in images inciude multiple offenders and attack positions. Variations of the Ii I I expression Good Night White Pride include; Good Night Alt Right and Good Night Right Side (photo that inspired logo below Right Wing Good Night Red Side Logo Red Side sIgnIers SOCiailSt . communist and left~wing ideologies The symboi on the victim In thIeI' Image is typically a five pointed red star sIgnIfyIng communism or identifiers of an Antifa group. VarIatioIns In images include multiple offenders, attack positions and vehicle: attaoks Variations I of: the expression Good Night Red Side include; Good NIgiIt Anti? WhIte, Good NI II ht Left Side aka GNLS and Good NIght AntIfa Scum.- LAW ENFORCEMENT SENSITIVE PARRISH LAW ENFORCEMENT SENSITIVE Symbol Intelligence Group Officer Awareness Bulletin 15 March 2017 ANTI-ANTIFA MOVEMENT SYMBOLS (LES) ANTIFA ANTI-ANTIFA Emblems (LES) Both and ANTI ANTIFA activists and organizations are. based In many countries Several cities, states, regions and political causes have their own variations of Antifa emblems The followmg are just: a few examples The most popular variation is to add the name of the city or region to the logo The addition of other colors and/or graphics typically signifies a particular cause IIand/or geographic location. Sometimes other popular left wing symbols are incorporated into a local logo. OrIgInai1930? logo. Sydney,Austraiia Catalan Countries Brittany, France - Norway London, England SICIly,Eta y .?IFrance hue-m: manu- Antivspeciesism Anonymous we; Philadelphia-IPA LI I -BIerkeley,CA Portland, OR (LE5) ANTIFA Left There are many graphic variations ofthe flags, arrows and colors of the Antifa symbol (LE5) ANTI-ANTIFA Autonomous (AN) are a new generatIon of primarily German neo~NaZIs who have and as a method to appeal to natiOnalist youth by mIrrorIng the subculture of global justice movements in addItIorI to the AntIfa logo AN activists have appropriated some of the most popular left?Wing symbols including the' Iconic image pf. Che Guevara and the Palestinian kefliyeh scarf Their emblems Include variations of the Antifa logo, typically with the words Autonomous NatlonalIsts (in local languages) and the name of the city or regIon A common symbol of Is the red crossed hammer and sword which orIgInated With the 1930 group the ?Black Front that- advocated a more radical anti capitalist and worker~based form of Nazism a precursor of: Third Position politics AN Is vew active in Anti? AntIfa actIons They are extremely violent and have targeted Antifa protesters These are a few examples of their logos ENFORCEMENT SENSITIVE PARRISH I adopted the far left's organIzatIonal concept of autonomous activism, black bloc tactics and symbolIsm as Ipa'rt of a ?Third Posmon ideology LAW ENFORCEMENT SENSITIVE Symbol intelligence Group Officer Awareness Bulletin 15 March 2017 (LES) ANTIFA ANTI-ANTIFAMOVEMENT SYMBOLS (LES) FOOTBALL HOOLIGANS 8t ULTRAS Football hooliganism involves conflict between association football clubs, aka soccer, for the purpose of intimidating and physically attacking supporters of other teams Certain teams have longstanding rivairies. with other clubs Violence may take place before during or after matches and In extreme cases hooligans, police, and bystanders have been killed Ultras aIfe similar to hooligans In that they are renowned for ultra fanatical support Although the terms are often used Interchangeably, the main goal? of hooligan Clubs :5 to fight hooligans of other ciubs while the main focus of ultras Is generally to support their main team Ultras are Inore Influenced by political ideas and some embrace extreme political ideologies ranging from white natIonalIsts to Their political views are eVIdent In their banners signs, gestures and graffiti ANTIFA HOOLIGANS Left Wing Ultras . HOOLIGANS Wing Ultras Some left wing radical ultras groups are commoniy referred to as AntiuAntifa football ciubs openly diSplay white supremacist Antifa Uitra or Antifa Hooligans They display Antifa flags and i symbols and Neo Nazi ?ags during matches A common other socialiSt and communist symbols, such as Che Guevara, red 7 expression on banners and signs is 10095 AntiMAntifa _Some far- stars and red fiagsin their emblems and banners at stadiums. right tra fans have perfOrmed _Nazi salutes at scatter games Ami IIO0LIGANS nootieans (LES) The infonnation 111 this bulletin 15 piovided to assist law en?fmceinent In adchessing potential event safety and secmity tlu eats. In the event that any of these symbols ate obsei ved 111C011jl111Cti011 with suspicious activity law enfoicement should follow established In otocols Repoit piepared by the Symbol Intelligence Gioup F01 additional infonnation about the Symbol Intelligence Gioup visit 0111 website at a rat Copyright (C) 2017 Symbol Intelligence Gioup, LLC. All Rights Reserved LAW ENFORCEMENT - SENSITIVE PARRISH August 27th Rallies Media Intelligence Summary Event Date: Sunday, August 27"h 2017 Report Date and Time: Wednesday, 8/23/17 at 1200 Prepared by: UC Berkeley OEM The information In this report is gathered from open sources, including social media and news sites. i I. Event Overview II. important Developments Ill. Planned Rallies Media Coverage Summary V. Social Media Summary VI. Social Media Hashtags VII. Threats Information is accurate as of the report date and time. To easily access links within the document, do not download the document. Click on the thumbnail preview at the bottom of the email to View in your browser. Berkeley UNIVERSITY or CALIFORNIA MANAG EM ENT Questions? Contact oem @berliigfgj ch B?'rkejiey i; '4 and, CIVIC Hosted by Amber-CUmmings MLK Jr Civic 1300-1700 313 Going, "No to Marxism in Center Park 850 America" FB for Host: Interested .5) F3 for Rally: 83051, MLK Jr Civic 1200?1700 7 UNK "Protest at the Hosted by Communities Against Racism Fascism Center Park White Supremacist (CARF) Rally" F3 for Host: F3 for Rally: 5: tin url.com 82c3086 Ohlone Park 1100?1400 289 Going "Resist Racist Hosted by Showing Up for Social Justice (SURJ) Hearst Ave. 620 Violence and Hate Group plans to meet at Ohlone Park and march to and MLK Jr. interested in Berkeley? City Hall Way F3 for Host: httos: facebook. com/SURJBavArea/ FB for Rally: 8324[ Wednesday, August 23, 2017 Prepared by UC Berkeley OEIVI - 3 PARRISH Ill. Planned Rallies Cont. Ohlo'ne Fark Way i 1200-9150;) -j HearSt Ave 5-16825s' . a: Interested Coalition March Against White Supremacy . Hosted by- Together We Stand Group plans to meet, at Ohlone Park and "marCh to MLK Jr CIVIC Center Park for- Host . . .7 FB for. Rally: . 3 bnmeemzij' f" Jr CIVIC Center Park and/or Old City Hall _."Defend Berkeley from the: TAlt- nght" . Note: A flyer ?Keep Nazis Out of Berkeley? has been circulating on social media. No additional information was available on this rally. It does not appear to be a ??new ?rally so is not documented here. OEll/l research indicates it might be simply promoting other existing rallies. See Section IV for more information. Wednesday, August 23, 2017 Prepared by UC Berkeley DEM 4 PARRISH IV. Media Coverage Summary (New) Mainstream media coverage remains mostly limited to local news. The main focus is on how both SF and Berkeley are preparing for the weekend rallies and the large police presence. Several articles include coverage of the Berkeley Mayor?s press conference to denounce racism and bigotry and included his message to "stay away from Civic Center Park?. The West Crescent rally has not been the primary focus of media coverage. The Daily Cal posted an editorial yesterday (8/22) that may encourage more students to attend the planned rallies. The white the city, Berkeley should not back down?, states ?Berkeley should not tell community members to back down, not when people flooding the city in hordes threatenthe very existence of many people here?. The Mercury News article "With all?hands-on desk police action, Bay Area cities prepare forfree speech rallies? reports that police leaders and local officials are fine?tuning plans to prevent a repeat of violence. http: mercurvnews com/2017/08/22/with all hands- ~~on ?-deck police? action bav ar ea cities Morepare ?for free speech- rallies/ NBC Bay Area article ?White Supremacists Unwelcome at Anti-Marxism Rally: Organizer? reports that Amber Cummings has again publically said that white nationalists are not welcome at her anti- -rnarxism rally' In Berkeley. Cummings says ?If anybody Is coming with the intent of violence, do not come to my rally?. http: nbcwashington. com/news/national international/Berkelev-Rallv Organizer-Fl res ?~Back?Upon Being~Lumped? With White Nationalists 441425443.html SFGATE article ?Hundreds ofcops to be in SF, Berkeley to police right-wing rallies? reports that authorities in San Francisco and Berkeley are planning a large show of force this weekend at two right?wing rallies. The article mentions the Crissy Field rally in SF and the Civic Center Park rally in Berkeley. It states the rallies are expected to be magnets for far-right extremists and there is fear that confrontations between counter-?protesters could escalate into violence. The article mentions coUnter?protests at Civic Center Park but does not mention the West Crescent rally specifically. httb: sfgate. com/news?/article/Hundreds of~cops to? descend- -on- ~San? Francisco- 11 Wednesday, August 23, 2017 Prepared by UC Berkeley OEIVI 5 PARRISH V. Social Media Summary Social Media Source: No More Presidents "Even after one oftheir own killed a protester in Charlottesville earlier this month, alt?right white supremacists and neo-fascists continue to mobilize for a ?No to Marxism? rally in Berkeley. A diverse array of A2 I A community groups and individuals are organizing to ensure that these peOpIe never come back to Berkeley again. Their movement is already suffering from I . 0 I immense backlash. Let?s drive the nail into coffin, make sure they don get to have their rally, and get rid of these fascists once and for all. a? ATTENTION ALL ANTI Alarm-fats . Iggy Link:rThe Facebook page for this rally has either expired . or may only be visible to an audience we are not in. SUNDAY AUGUST 2'7 11AM OHLONE PARK ma 1? OLD CITY HALL ?gs? BAY AREA UNITED AGAINST WHITE Social Media Source: Enough is Enough . A . . . 45k Enough?. is Enough! @enouthrt Aug 19 may nOt be a new rally! but flyer '5 bEIng kg! BE.) #?erkaleyAug 27: Counter circulated On social mEdia. Enough is Enough is not organizing this event: ?we are publishing this text for' people across the US and Europe to be able to see what is going on and for documentation only." Li k: 2017/ 08 10 ?11111 C.) z. 49 an E3 Wednesday, August 23, 2017 Prepared by UC Berkeley DEM 6 PARRISH Social Media Source: Berkelev Antifa Berkeley Antifa has tweeted the following regarding confrontation with white supremacists and? police. Link: l' Berks-Ear I . ?re?eiefmi?a If you?re coming to Berkeley next week ta confront white supremacy, you save to be against the peliee teno- tens: Fm! Against steam F?s-m saw 9; masses: is: sees sag: seem in Essex 11w: 1- c?ietwmi assess 1111st geezer ages is a grass. .rr me??f?f?S m: 5: 33113 Mei 51331561113} 2731'? e3 ?ush 7 55:23:53.: w- @bssk?eysnzi?a sai- Emmi semis- es: Ti1-ese 31911:: are beginning to go up at 11:21:13! busmesses Nazils,aait-rigfl1t festists not welceme here; s: 13' is: as: i?weei- yew regs; Antifa reports anti alr-right flyers are appearing in Berkeley. Link: 58152192 7 ass is -151 ms; 211': sigma 2.51 mm as; ?g 1?31 gg gg? :m Ed Wednesday, August 23, 2017 Prepared by UC Berkeley OEIVI 7 PARRISH Social Media Source: Berkelev Antifa (continued) Antifa tWeeted that controversial alt-right figure Augustus Invictus plans to speak at the 8/27 rally. It is not clear from the tweet what'location he might speak at. Augustus lnvictus? twitter account (@Senatorlnvictus) has no recent mention of being' In or coming to Berkeley. His facebook appears to be shutdown Link: . II: It I'Ef?t Inga dawn llI it II WEI-spams QITIIQIFIIW Rama?! [ma ?r ?I?l i113?; I I1 if! II Wednesday, August 23, 2017 Prepared by UC Berkeley OEIVI 8 PARRISH Social Media SOurce: Kvle Chapman. AKA Based Stickman Twitter . Ham??ticiman @SasedStEckManw - ?ug 21, Emmet]: ?tea'mrist earganizattens Antifa and Betta/?EN ergamizfieg a massive attaek :on the SE: and Berekiey Iailies this weekendg Pattints need ed! Baee?S-tiekman 23h We; are a true gamut artist warmer @Ramimbigge. Never Surrenden HE see arm]: there Dr?ihEI?i Based Stickman wart-2:3 Joe Biggs's post.? 22 ?55 Joe Bigus Yesterday at 9:17am . mmti'n? Im'going to San Fran'anpj Blakeley this speak atthe Freedom Rally Jae Biggie @Ftem?mmgga Emakihg atthe Freadem an . Comment ?r Share ., a: a: Wednesday, August 23, 2017 Prepared by UC Berkeley (DEM 9 PARRISH VI. Social Media Hashtags There are no trending hashtags for this event at this time. Useful hashtags inclUde #berkeley, #antifa, and #Nazis. VII. Threats Berkeley Antifa retweeted a post from "Stickman" asking "all warriors to suit up and booth this? weekend.? Berkeley Antlfa . @berkeieyantifa Stickman is nervous after his pathetic showing in Boston. He'sgetting desperate and calling "all warriors to suit up and boot" this weekend Kyle Ghapman shared Patrlet Prayer?e video. 3 2:51 mine . e" . As I told you before, the Battles of Berekley were jdet the beginning. San Francisco and Berekiey P?eould stand down this Saturday and Sunday. We?re looking at majer Antifa and .BLM oppoaltian. i've flown all over this country to support patridts and freedom ?ghters. I?verepelatedfy put my life and freedem en the line. It's time to return the favor. I need alt warriors to suit up and bootthis weekend. #Fiea?etklarxiam I #Crusht?i?ommunisim 4:06 PM 21Aug 201.7 107 Fletweets 136 Likes g? GE a: .22 Til 1m .135 If?) Tweetyour reply Berkeley Antifa @be?rkeleyantifa . 2% Replying to ii Btw, his court date for his'feiony charge is this Friday. 9AM. Wiley Manuel courthouse in Oaldand dept 112 ??11 33 C3 52 El Wednesday, August 23, 2017 Prepared by UC Berkeley 10 PARRISH 235;. its,? ?ii its? ANNEKZ ANNEXB ANNEXA ANNEXE ANNEKO AND. SEPARATIST FOREWORD OF THE DIRECTOR 4 TRENDS 5 GENERAL OVERVIEW 9 1.1 Terrorist attacks and arrested suspects 10 1.2 Terrorist and violent extremistactivities 12 1.3 Court proceedings, verdicts and individuals in concluded court proceedings 17 JIHADIST TERRORISM 2.1 Terrorist attacks and suspects arrested in the EU 2.2 Communications 2.3 Developments outside the EU TERRORISM LEFT-WING AND ANARCHIST TERRORISM RIGHT-WING TERRORISM SINGLE ISSUE TERRORISM OVERVIEW OF THE AND CO PER EU MEMBER STATE AND PER AFFILI IN 2016 49 ARRESTS IN 2016 PER EU MEMBER ST 50 CONVICTIONS ANO PENALTIES (EUROS METHODOLOGY 7 ACRONYMS 56 AMENDMENTS IN NATIONAL LEGISLATION ON TERRORISM IN 2016 57 EUROPOL ACTIVITIES IN COUNTER-TERRORISM 7 59 PARRISH FOREWORD 4 OF THE DIRECTOR Since 1 July 1999 the date of taking up its activities Europolhas had the authority to deal with terrorist activities. Over recent years the organisation's involvement, in this area has seen a steep increase. The number of Europeans travelling as foreign terrorist ?ghters (FTFs) to the con?ict areas in Syria and Iraq, the intensive use of the internet and social media in propaganda and recruitment activities, and the terrorist attacks in EU Member States directed or inspired byjihadist terrorist organisations, have caused a major increase in the number of cases at Europol concerning ?crimes committed or likely to be committed in the course of terrorist activities against life, limb, personal freedom or property? a development that is not expected to come to a halt soon. In order to remain up to par in cooperating With Member States in counter-terrorism activities and to improve the quality of Europol's services where possible, the European Counter Terrorism Centre (ECTC) was established, and started its activities in January 2016. The ECTC is developing into a pan~European centre of counter? terrorism expertise and provides direct operational support for ongoing investigations, such as the ca5e of ?Taskforce Fraternit?", following the 13 November 2015 Paris attacks. The team consisting of Europol experts and has, along with the French and Belgian investigating teams, processed and analysed more than 14 terabytes (TB) of information, resulting in Several I . investigative leads. Another example of Europol?s operational support is delivered on a daily basis by the EU Internet Referral Unit (EU IRU), to detect and Investigate malicious content on the internet and in social media. This not only produces strategic insights intojihadist terrorism, but also provides information for use in criminal Investigations. Meanwhile, the ECTC also works to track the ?ow of terrorist finance and links between terrorist suspects and criminal sources of (illegal) firearms and counterfeit documents, At the cornerstone of its work Europol provides a well-functioning apparatus for the swift and secure exchange of information. Never before has the need for information sharing become more evident as it has in the past two years, with its unprecedented number of failed, foiled, but also completed jihadist terrorist attacks across Europe. In contrast to ethno-nationalist and separatist terrorism, and most manifestations of both right-wing and left-wing violent extremism, is jihadist terrorism an international issue. This new edition ofthe yearly EU Terrorism Situation and Trend Report (TE-SAT), which Europol has produced since 2007, provides a concise overview of the nature of terrorism that the EU faced in 2016. In this report you will find information on terrorist attacks that occurred in 2015 and the numbers of arrests and convictions for terrorist offences. Also included is a brief overview of the terrorist situation ?outside the EU. I would like to thank all EU Member States and Eu rojust for their contributions to the TE-SAT2017. I would also like to express my gratitude to authorities in Switzerland and Turkey for the information they provided. Finally, I would like to recognise the work of the members of the Advisory Board, consisting of the ?Troika? (Presidencies of the Council of the Slovakia, Malta and Estonia), France, Spain, Eurojust, the EU Intelligence Analysis Centre (INTCEN) and the Of?ce of the EU Counter- Terrorism Coordinator. Their valuabie contributions were indispensable for the production of this 2017 edition of the TE-SAT. I 4.5, Rob Wainwright Executive Director of Europol PARRISH a A av: ew 1 0 TERRORIST ATTACKS AND SUSPECTS ARRESTED Member States reported that 142:.- viCtims died in terrorist attacks and 379:. people were injured. In 2016, a total of 142% . failed, foiled and completed attacks were reported. in 2016 a total of 142 failed, foiled and completed attacks were reported by eight Member States. More than half (76) of them were by the UKZ. France reported 23 attacks, Italy 17, Spain 10, Greece 6, Germany 5, Belgium 4 and Netherlands 1. Of the 142 attacks, less than half (47) were completed. Member States reported that 142 victims died as a result of terrorist attacks and 379 people were injured. Nearly all reported fatalities3 and most of the casualties were the result ofjihadist terrorist attacks. The total number of 142 attacks is a continuation of a downward trend that started in 2014 when there were 226 attacks, followed by 211 In 2015. The largest number of attacks in which the terrorist af?liation could be identi?ed were carried out by ethno~nationalist and separatist extremists (99). Attacks carried out by left?"wing violent extremists have been on the rise since 2014; they reached a total of 27 in 2016, of which most (16) were reported by Italy. The number of jihadist terrorist attacks decreased from 17 in 2015 to 13 in 2016, of which 6 were linked to the so-called Islamic State (IS). However, a precise ranking amongst'and within terrorist af?liations across the EU cannot be established because the UK does not provide disaggregated data on attacks. Explosives were used in 40% of the attacks, with similar numbers to 2015. The use offirearms dropped considerably from 57 in 2015 to 6 in 2016. Apart from jihadist, ethno~nationallst and left-wing extremist attacks, an Increasing stream of violent assaults by right-wing 2 All attacks reported by the UK ware acts of Northern Irish-related terrorism and Involved 49 shooting Incidents and 27 bombing Incidents. Of these, four Involved attacks on National Security Targets. 3 The exceptions are six victims of paramilitary violence In Northern Ireland and the murder of a UK Member of Parliament by what was reported as a domestic violent extremist. extremist individuals and groups was noted across Europe, In particular over the past two years, targeting asylum seekers and ethnic minorities in general?. These assaults however do not generally qualify as terrorism5 and are therefore not included in the numbers of terrorist attacks being reported by Member States, with only one exception In 2016, reported by the Netherlands. The number of arrests for terrorist offences in 2016 (1002) is lower than that of 2015 (1077). Most arrests were related to jihadist terrorism, for which the numbers rose for the third consecutive year: 395 in 2014, 687 In 2015 and 718 in 2016. Numbers of arrests for left-Wing and separatist terrorist offences dropped to half of what they were in 2015 (from 67 and 168 in 2015 to 31 and 84 in 2016 respectively). Numbers of arrests for right? wing terrorism remained low at 12 in 2016 compared to 11in 2015. France is the only Member State .In which the overall numbers of arrests continue to increase: from 238 in 2014, to 424 in 2015 and to 456 in 2016. Almost one-third of arrestees (291) were 25 years old or younger. Only one in ten arrestees In 2016 was older than 40 years. Arrests for terrorist activities (preparing, ?nancing, assisting, attempting or executing attacks) decreased from 209 in 2015 to 169 in 2016. Arrests for travelling to con?ict zones for terrorist purposes also decreased: from 141 In 2015 to 77 in 2016. This was similar to the decrease in numbers of arrests of people returning from the conflict zones in Syria and Iraq: from 41 in 2015 to 22 in 2016. ?1 An average of nearly 10 attacks a day were carried out on refugees In Germany In 2015, according to Germany's interior Ministry, as reported In open source media. 5 Please see the de?nition of terrorist attacks, Included In the Annex on Methodology. PARRISH an:- FIGURE 1 FIGURE 2 (2-213 ARRESTS arrested sUspects 2014 to 2016 Number of failed. foiled or completed attacks 7 201 4 I Attacks and arrests by EU Member State in 2016. number of' SITUATION AND TREND REPORT 2017 1 1? . II 1.2. AL 0 i 1 2 TERRORISTAND VIOLENT EXTREMIST ACTIVITIES Recent EU terrorist attacks have been funded by an. opportunistic mix of licit and illicit sources. Up to 40% of terrorist plots in Europe are believed to be at least partly ?nanced through crime, especially drug dealing, theft, robberies, the sale of counterfeit goods, loan fraud, and burglaries. Using funds raised through criminality is regarded an ideologically correct and legitimate way of ?nancing ?jlhad? in the ?lands of war?. Terrorists in 2016 were agile in the diversity oftheir funding mechanisms, both from legal and illegal sources. The young ages of a large proportion ofjihadists, the majority. of whom are computer literate, has caused an increase in the use of modern technological ?nancial services. These ?nancial services and applications, Including ?nancial low transfer apps, are ?uid, and partially anonymised, allowing a desirable ?nancial conduit for terrorists who seek a borderless, reliable and shielded ?nancial mechanism, optimised and readily accessible for real?time small value transfers. 2016 has seen lower amounts of funds moved regularly through the ?nancial sector. These small denomination values sent by supporters and family members are transferred to support FTFs and their organisational expenses?. More than 5000 individuals emanating from the EU are believed to have travelled to conflict areas in Syria and Iraq. As was observed In 2015, Individuals from Belgium, France, Germany and the UK account for the majority of this total. On a per capita basis, Belgium appears to have the highest numbers. In addition, more than 800 persons are believed 5 The International Centre for the Study of Radicallsation and Political Vioience (ICSR), "Criminal Pasts, Terrorist Futures: European Jihadists and the New Crime-Terror Nexus", 2016. 7h c.co k-3 508537 tohave travelled to Syria and iraq from the Western Balkan countries, predominantly joining IS. There is also likely to be a ?dark number' of travellers to and from Syria and iraq that have not yet been detected. Turkey reported that, as of November 2016, it had approximately 7670 individuals from EU M5 on a suspected FTF no-entry list. A number of countries, including the Netherlands, France, Denmark, Sweden, Austria, Germany and Switzerland reported that, since the beginning of 2016, the flow ofjihadists travelling to con?ict zones abroad - especially Syria and Iraq - has apparently continued to decline. Nonetheless, Germany and Italy for example, maintain that the level of departures - remains high or constant. The sustained pressure facing IS In Syria and Iraq due to the air strikes and ground offensive ofthe anti-IS coalition is likely to be the main reason for the general decline in outgoing travellers. The air assaults have also targeted lS?s ?nancial structures, which has led to decreased incomes for FTFs. Moreover, it has become increasingly dif?cult to cross the Turkish border to Syria. Neighbouring countries have improved their border security and, since IS does not control the border area anymore, It is now more dif?cult to reach the territory it does control. Furthermore, IS leadership and messaging has indicated that their sympathisers should no longer go to Syria and Iraq, but should instead join IS branches in other countries or focus on attacks in their homelands. Attack planning against the EU and the West in general continues in Syria and Iraq. Groups including IS and al-Qaeda have both the intent and capability to mount complex, mass-casualty attacks. It is believed that there is not a lack of volunteers for such operations. The 2016 attacks In Brussels in March, then in Istanbul in June, appeared to demonstrate the ongoing effectiveness of external operations capability. The Paris and Brussels attacks again showed that terrorist networks directed from Syria can rely on the help of sympathisers in Europe who have never been to Syria themselves. According to the Netherlands for example, it is possible that there are still dozens of IS operatives (attackers sent by IS, and their accomplices) in Europe. italy reported concerns of potential sleeper cells from the external operations unit of IS or al-Qaeda operatives and af?liated organisations inspired by jihadist ideology. PARRISH 7 EU TERRORISM SITUATION AND TREND REPORT 20W Germany asserted that there is no doubt-about the ?rm determination of all internationally focused Jihadist groups to seize every opportunity to carry out an attack in a Western country, but that despite this determination, in recent years, the planning and execution of such attacks has shifted mainly to lone actors or small groups without direct links to an organisation modifying the threat situation accordingly. Furthermore, Germany assessed that individuals who have either been prevented from travelling abroad or failed to travel for other reasons should be regarded as particularly dangerous in view of the fact that their ideological delusion and propensity for violence are strongest at the time of the planned departure, Ongoing contact on social media between combatants in Syria/Iraq and 'stay?at-home jihadists? fuels the enduring potential threat posed by jihadist networks; now that leaving the country to take part in jihad has become more dif?cult, would-be attackers may indeed shift their focus to their countries of residence. IS also supports the interactions between some of its ?ghters in the region and individuals recruited back in the EU (for example, in thejihadist milieu in France) in order to carry out violent actions on home soil. These recruitments are made via social networks such as Telegram. Several countries, including Italy and Switzerland, stated that one of the greatest risks to their domestic-security is posed by lone actors or small groups, be they self-radicalised - individuals or returning FTFs. TRAVELLING OF WOMEN AND CHILDREN The UK were amongst countries that reported an increase In the number of women, families and minors engaging in the con?ict in Syria/Iraq, althoUgh they remain a small proportion of overall travellers. They also reported that the average age at time of travel of those engaging in the con?ict has reduced significantly; nearly half of those travelling aged 18 and under have departed since the declaration of IS's 'caliphate? in July 2014. Poland stated that its citizens who travelled are all less than 22 years old. Although I overall figures for the EU are-not available, of further concern is that by the end of 2016 the Netherlands recorded a total of over 40 children (age 0?12 years) that have travelled to Syria or Iraq with their parents. Austria noted that women, including minors, leave or want to leave for the con?ict zones and that some women married FTFs in Syria under Islamic law, partly via social media. Denmark stipulated that only very few persons departed in 2016. The vast majority of these travellers were young women. In general, women account for nearly one eighth of the total number of travellers from Denmark. They also noted that more women play an active and independent role within jihadist circles in Denmark, and may consequently have an increasingly radicalising effect on their associates and families. Belgium reported that returning women (and children) are of concern, due to the apparent involvement of female activists in the preparation of attacks. Some may also have received military training. In addition, IS propaganda has repeatedly depicted the training and indoctrination of minors. However, Spain reported a decrease in the number of women arrested in 2016, and that only one was willing to travel to the con?ict zone. The average age of arrestees in Spain was 31 (an increase of 2 years from the previous reporting period). A minor was taken into care due to his parents? arrest, after they attempted to travel to the con?ict zone. I . RETURNING FIGHTERS . Most of the FTFs appear to return to Europe through the same route they used for their outbound travel, i.e. mainly taking indirect ?ights from Turkey and through other European countries. Portugal, for example, reported that those on their way to the con?ict areas used not only Lisbon airport, but also more recently the airport in Porto (taking advantage of the new connection to Istanbul). Travel also occurred via the so-called Balkan route. Hungary and Poland reported that they were used as transit countries for FTFs travelling to or from Syria/Iraq. Romania was transited by a limited number of FTFs on their way to and from the con?ict areas, the country not being positioned on the route most often used by them. Cases of individuals transiting through Switzerland were also reported, highlighting the risk of Switzerland serving as a logistical base to prepare attacks elsewhere. Facilitation activity continued in 2016. In Italy for example, investigations led to the arrest of 19 people Involved in PARRISH reCruitment for IS and facilitating the movement of FTFs to combat zones. In Switzerland, police operations led to the discovery of a recruiting celi composed of a number of individuals involved In faCilitating the travel of Swiss and Italian residents to Syria. This cell also bene?ted from the logistical Support of associates located in Turkey; the main suspect in this case was a Swiss-Turkish dual citizen who supported the ideology of Jabhat Fath alnSham (former al-Qaeda affiliate Jabhat aI-Nusra). Denmark reported that recruitment, radicalisation and facilitation of people and resources to the con?ict zone takes place in circles that are less visible and organised than previously observed. It appears to have become increasingly harder to leave IS territory. Italy reported oniy one returnee to Europe in 2016 and? Denmark reported that the number of returnees from Syria/ Iraq has been declining since mid-2014. The Netherlands also stated that there have been only a few new returnees in the past two years (four in 2016), but that there have recently been indications that a number of Dutch men and women would like to leave Syria. It is important to emphasise that a particularly strong security threat is posed by individuals who have received prolonged ldeoiogical GENERAL OVERVIEW 14, indoctrination, military training in the use of weapons and explosives, or have gained combat experience during their stay In a con?ict region. They may also have established links to other FTFs abroad and become part of capable transnational networks. These returning fighters will have increased proficiency in terms of carrying out attacks, either under direction or independently. In addition it is assessed that lndividualswho have joined terrorist groups like IS will be more brutallsed and prone to violence; the in?uence being greater if their stay was They may 7 also have developed a high degree of security awareness. Moreover, some returnees will perpetuate the terrorist threat to the EU through radicalising, fundraising and facilitation activities. The first groups of returnees were often disappointed with their situation In the "caliphate?. The motivations of the more recent ones are not yet entirely clear. The subsequent activities of the returnees from the con?ict regions are reported to be diverse. They range from followers, who reduce their involvement in thejihadist milieu (even'to the point where such activities are no longer noticeable), to persons prone to violence. However, it has been suggested (by Germany for example) that a disposition to jihadist ideology is likely to prevail, which, - under certain conditions, allows the subject?s mobilisation at short notice. Denmark also noted that the threat from returning fighters may become apparent within a very short time frame, but may remain dormant and not appear until a triggering event. As reported in the 2016 TE-SAT, the irregular migrant ?ow was exploited in order to dispatch terrorist operatives clandestinely to Europe (in regards to the November 2015 Paris attacks). The procurement and use of high duality falsefadministrative' documents was also successfully applied by terrorist operatives (for example by those involved in the March 2016 Brussels attacks). Over this reporting period, the Netherlands stated that in some cases IS operatives have applied for asylum in European countries. A case in Switzerland Involved three suspects purporting to be Syrian refugees and asylum?seekers. Two of them arrived in Switzerland with humanitarian visas and at the time of writing were being investigated as potential IS members. Italy also stated they have had cases of refugees with previous jihadist backgrounds; and Austria reported it had several cases of individuals - suspected of terrorism among the migrants staying in, or travelling through, Its territory. EU TERRORISM SITUATION AND TREND REPORT 2017 15 Even though terrorists use a wide range of readily available weapons, explosive devices continue to be used in terrorist attacks, due to their high impact and symbolic power. In 2016, the transfer of terrorist tactics, techniques and procedures (TTPs) from the current conflict zones and Illicit spread of bomb?making knowledge and instructions has been observed. The availability of explosive precursors has facilitated the use of Home-MadeExplosives (HMEs). Of particular concern are improvised explosive device attacks on soft targets and the use of suicide person-borne lEDs (PBIEDs). IMPROVISED EXPLOISIVE DEVICES (IEDS) Jihadist terrorist IED attacks generally aimed at soft targets, with the main intention .of causing a large number of civilian casualties. In recent years, targets included alrand rail transport facilities, commercial premises and major sports events. Two distinct trends have been observed with regards to jihadlst terrorists? use of lEDs in the EU. lEDs, have been reported to show similarities in design and construction with lEDs used in conflict zones. Some elements of these lEDs appeared to have been modified baSed on available resources and circumstances in the EU. For example, HMEs and improvised components were used in place of military components that are difficult to procure. Such devices have been more prevalent in attacks by terrorist groups and lone?actors directed by IS. These incidents commonly required additional logistical support and specific knowledge in the manufacturing of larger amounts of HMEs. Nonetheless, these lEDs were not particularly sophisticated but relatively reliable and simple to use. Bomb-making knowledge, in some cases, was transferred to the attackers through direct contact and experience (facilitated by foreign terrorist ?ghters and returnees). In other cases, knowledge and guided instructions have been transferred via 'remote assistance' using various social media and online communication channels. Secondly, more rudimentary lEDs have been used by jihadlst terrorists recently. These mostly consisted of readily available explosive components, such as gas cylinders, pyrotechnic articles and ammonium nitrate-based products. Such lEDs can be constructed without any specific expertise, preparation, extensive planning or logistical support. They have been primarily used by Small terrorist groups or self?radicalised lone-actor terrorists inspired by IS.,lt is also notable that IS has started to promote the use of readily available flammable products to construct basic improvised Incendiary devices (lle) and commit arson attacks a new simple terrorist tactic recommended for lone-actors. Regarding the potential use of alternative and more sophisticatedtypes of lEDs, the current trend In using. weaponised unmanned aerial vehicles (UAVs) in the Syria/Iraq con?ict zone might also inspire otherjihadist supporters and expand the use of this kind of tactic outside this area ofoperation. Additionally, as seen in recent attacks in Egypt and Somalia, threats posed to civil aviation by attacks are still present. Main threats emanate from the use of concealed and hardly detectable lEDs and facilitation by affiliates working as airport employees to bypass security checks. Groups and individuals belonging to the extreme right?wing scene maintained their af?nity to weapons and explosives. This was illustrated by the signi?cant increase in the number of incidents involving arson and explosives, as well as seized explosive devices. In addition to common types of such as Molotov cocktails and improvised pipe bombs, these groups tend to use military-grade explosive devices. Left-wing and anarchist groups have predominantly carried out arson attacks using flammable liquids and lle, such as Molotov cocktails and gas cylinders. Nevertheless, an increase has been noted in the number of terrorist attacks in which perpetrators constructed and delivered postal lEDs/lle ?lled with incendiary or low-explosive charges, such as gunpowder. in general, all devices have been constructed from improvised material readily available on the open market. The attack methodologies and capabilities used by Dissident Republican (DR) groups in Northern Ireland (UK) varied across groups. Many attacks involved ?rearms or small lEDs such as pipe bombs but they have also employed larger and/or potentially more destructive devices such as Vehicle-borne lEDs (VBIEDs) and explosively formed projectiles (EFPs). There have been four DRIED attacks in 2016 including a fatal attack on a prison of?cer. All groups retain access to a range of ?rearms and explosives and there is an ever-present threat of under~vehicle IED'attacks, HOME-MADE EXPLOSIVES HMEs have been the most common type of explosive used in recent terrorist attacks. The explosive used in most of the attacks was trlacetOne triperoxide (TATP), a home?made explosive that remains the explosiVe of choiCe for terrorists. The internet continues to be a crucial resource for lone- actor terrorists to gain bomb-making skills. Internet 7 websites, forums, social networks and the Da rknet facilitate access to bomb?making knowledge and information. MILITARY EXPLOSIVES The availability of explosives in current and former Conflict areas such as the Western Balkans and Ukraine, and the illicit traf?cking of explosives into the EU, is believed to present a signi?cant threat. Terrorists are known to have acquired hand grenades, rocket launchers and high-grade PARRISH plastic explosives and detonators from organised crime groups (OCGs). In addition to trafficking explosives, other methods of obtaining military explosive ordnance include thefts from military explosives storage facilities and the illegal collection of explosive remnants of war (ERW) and unexploded ordnance (UXO) from former battle zones. COMMERCIAL EXPLOSIVES Commercial pyrotechnic articles and gunpowder continue to be misused for terrorist purposes as a source of explosive compounds for constructing IEDs. These pyrotechnics are widely available, and the use of pyrotechnic mixtures In lEDs is promoted in jihadist terrorist publications. This threat might increase in the future. Misuse of pyrotechnics has been observed in most EU countries. The pyrotechnic articles have been used in various forms: in the original state; modi?ed; or by extracting the pyrotechnic mixture and utilising it in IEDs. Pyrotechnics have largely been used in smal ?scale bomb attacks. The most frequently used types have been the categories F3 and F2, which are sold to the general public. However, it appears that the misuse of professional category F4 ?ash bangers has increased in the recent period. To date, no large-scale CBRN attacks in the EU by any terrorist group have been reported. However, IS has significantly improved its capacity to produce explosives and improvised explosive devices through the adaptation of existing military ordnance stolen or retrieved from abandoned or conquered military facilities. There is concern that they have also accumulated knowledge to develop CBRN weapons that could later be used in attacks. In territories under its control, IS might have gained control of CBRN facilities (abandoned military and industrial facilities, laboratories or stockpiles) allowing . access to chemical agents. In addition, the group might have recruited, voluntarily or by force, scientists previously working In the chemical, biological or radio-nuclear sectors. The Organisation for the Prohibition of Chemical Weapons? United Nations (OPCW-UN) Joint Investigative Mechanism confirmed that IS has used chemical weapons in Syria. Furthermore, in 2016, CBRN-related topics continued GENERAL OVERVIEW 16 to appear in terrorist propaganda. Various jihadist media outlets used social media channels, in particular Telegram, to express intentions to commit CBRN attacks, share possible tactics for attacks and suggest targets. For example, in May 2016, a jihadist tutorial on ricln toxin extraction, addressing lone actors, was published online. Threats to intentionally contaminate food or water occurred in 2016, both in criminal and extremist contexts. In two cases, anarchists threatened to use toxic chemicals. In JUne, Italian anarchists threatened to poison foodstuff in supermarkets in Lombardy using herbicide. The campaign aimed to protest against the use of toxic chemicals in the agriculture, engineering and food production Industries. Those anarchists posted atechnical description of the'methods to be used and a list of potential targets on their website. In December, Greek anarchists published a warning claiming that they had contaminated several food and drink products of multinational companies. Their operation, "Green Nemesis was planned to take place between Christmas and New Year in Athens, Greece. The warning message posted on the anarchist website explained how to introdUce chlorine and hydrochloric acid into products while leaving packaging Intact. Similar threats to contaminate beverages were also expressed in December 2013. In November 2016, several Slovak institutions including the Ministry of Justice, district courts and a regional police of?ce, received suspicious envelopes containing anonymous letters. The letters expressed dissatisfaction with the judicial system and mentioned a lost court trial. One letter referred to radioactive contamination and incidents in 2015 and 2016 when employees of various judicial institutions were exposed to radioactive material emitting alpha-particles. Further laboratory expertise confirmed the presence of small amounts of radioactive Americium-241 in the envelopes. The case was investigated by the Slovak authorities as an act of terrorism. This incident demonstrated that certain CBRN materials that are commonly used in various civilian applications, in particular radioactive substances, can be acquired by criminals or terrorists due to inadequate security measures. PARRISH EU TERRORISM AND TREND REPORT 2017 covers England, Scotland, Wales and Northern Ireland. The UK contribution Includes proceedings on offences under anti- terrorism legislation, as well as other offences assessed to be terrorism related. Similar to 2014 and 2015, the UK data for 2016 refers only to convictions. In case a verdict pronounced in 2016 was appealed and the appeal was concluded before the end of the year, Eurojust counted the proceeding?as one and reported only on the latest/?nal verdict. 9 Please refer to Annex for additional information and clari?cation on the numbers mentioned in this section. 1? According to Council Decision the information to be submitted to Euroiust is In relation to final convictions. Due to the specifics of reporting, Member States submit information on both ?nal and not ?nal decisions. Therefore, reference is also made to those declsions pendingiudlcial remedy and they are Included in the reported numbers. The data provided by the United Kingdom did not distinguish between ?nal verdicts and verdicts pendingjudicia! remedy. As reported, all convictions in the United Kingdom are effective from the moment of their being pronounced, even if an appeal is made. PARRISH . FIGURE3 Number of individuals in concluded court proceedings for terrorist offences in- 2014. 2015 and 2016, as reported to Eurojust*. INDIVIDUALS TRIED 2014 2015 2016 The data for the previous years corresponds to the data reported in the respective reports. The vast majority of verdicts In the Member States in 2016 were pronounced in relation to jihadist terrorism.11 This con?rms the ?ndings in 2015 when, for the ?rst time since 2008, the concluded court proceedings in the EU resulted in a higher number of verdicts forjihadist terrorism offences than for separatist terrorist offences. I 11 The data proVided by the United Kingdom was not broken down by type of terrorism and is therefore not included in the numbers that follow. GENERAL OVERVIEW Momma?. 18 As evidenced In the past couple of years, the majority of the verdicts forjihadist terrorism concerned offences related to the con?ict in Syria and Iraq. They involved persons who had prepared'to leave for or have returned from the con?ict zone, as-weii as persons who have recruited, indoctrinated, ?nanced or facilitated others to travel to Syria and/or Iraq to join the terrorist groups ?ghting there. Individuals and cells preparing attacks in Europe and beyond were also brought before courts. Similar to 2015, courts in Belgium rendered the highest number of verdicts concerningjihadist terrorism In 2016 (138). A large number of such verdicts were also rendered in Germany and the Netherlands. In Belgium, as well as in seven other Member States, only verdicts concerning jihadist terrorism were pronounced in 2016. Those Include Austria, Estonia, Finland, France, Italy, Portugal and Sweden. The Brussels Criminal Court, for example, sentenced 15 .men ?with nine in absentia ?to prison sentences of up to 15 years for membership in a terrorist organisation and planning of terrorist attacks. The defendants formed the so-called Verviers cell, which had ties with persons involved in the November 2015 terrorist attacks in Paris. Three of the defendants present at trial were considered to be the leaders of the Cell, each receiving a 16 year sentence. The court found that one of them had travelled to Syria to receive instructions on targets, while the others had been responsible for arranging the logistics, including securing a safe house in Verviers and obtaining weapons and chemicals needed for the planned attacks. Another defendant received a sentence of 30 months in prison for helping a radiCalised family member to travel to Syria in order to ?ght for IS. Similarly, another cell member received a 3 year sentence on probation for having attempted tojoin IS in Syria. The defendants Convicted in absentia received sentences of 5 to 7 years in prison. Mostare considered foreign terrcirist ?ghters who left for Syria to ?ght in the ranks of IS. Also in Belgium, the Court oprpeal of Brussels con?rmed the guilty Verdict pronounced in July 2015 by the Court of First Instance of Brussels against a leader of a terrorist group that had recruited and sent ?ghters to Syria. The Court oprpeai handed down a 15 year prison sentence, which is 3 years longer than the one given in ?rst instance. The same sentence of 15 years was ordered for another person, who had received a penalty of 8 years? imprisonment in July 2015. The prison terms of two other group members were also increased. All four were part of an organised network that had recruited, indoctrinated and facilitated the travel to Syria of potential ?ghters. One of the group members sentenced in absentia is believed to have played a major role in the attacks that took place ?in Paris on 13 November 2015. He was reported dead following a police action in the aftermath of the attacks. Another one, also sentenced in absentia and suspected to have been plotting terrorist acts, was arrested in March 2016 In France. In France, seVen men Including the brother of one of the 13 November 2015 Paris attackers, were convicted by the Paris Criminal Court on 6 July 2016 to sentences of 6 to 9 years for participating in a criminal conspiracy to carry PARRISH EU TERRORISM AND TREND REPORT 2017 out terrorist attacks. They had travelled to Syria, where they had been trained by IS and fought In the ranks of the terrorist organisation. The men were part of a larger group that had travelled to Syria at the end of 2013. After two of the initial members had been killed, the rest exCept one of the 13 November attackers returned toFrance in April 2014, to be arrested a month'later. The prosecutor in this I case used wiretaps and variousjihadi-inspired materials taken from the defendants? devices as evidence. However, this conviction-is not final as the public prosecutor has appealed. In another case against a terrorist group with international ties in Italy, four members of the Merano cell of the Rawti Shax group were convicted by the Court of Assizes in Trento of planning terrorist attacks throughout Europe. The leader of the group was sentenced to 6 years in prison, while the other three members of the cell to 4 years respectively. The defendants had as their stated aim the establishment of a theocratic state and the overthrow of the government of Kurdistan. Theprosecution built its case on intercepted communications which showed that, despite the transnational nature ofthe Rawti Shax group, the Merano cell operated to a large extent Independently. Its members were able to engage in fundraising and were theoretically capable of carrying outthe attacks referred to in their communications. The Merano cell members were arrested as part of a big multinational Operation coordinated by Eurojust In November 2015. WIth- regards to evidence, an interesting precedent was set by the District Court of Glostrup in Denmark,iwhich was the ?rst court In Europe to refer to a questionnaire/form used by IS. The form offered the possibility to indicate one?s role for IS and was made available by foreign authorities. It contained information on a Danish citizen charged with terrorist offences. In the form, he had been registered as a ?ghter. Reference to the form was made when questioning the accused about his role within the terrorist organisation. The court held that his statement about histasks, mainly cooking and serving food, was not reliable. Based on this and other evidence, the accused was found guilty, amongst other charges, ofjoining a terrorist organisation and sentenced to 6 years? imprisonment. The Intense propaganda, recruitment and indoctrination strategy applied byjihadist terrorist groups is also evident in the verdicts pronounced in the EU. In.Spain, for example, the Audiencia Nacional found seven Spanish and Moroccan nationals guilty of terrorist indoctrination. Directed by IS, the seven had formed a terrorist cell that managed a numberof social medlaaccounts used to disseminate terrorist propaganda, glorify the jihad and praise IS. The accounts were also used to recruit persons who would later join IS in Syria and Iraq or commit terrorist acts In Spain. The accounts?attracted a lot of followers who sympathised with IS and its terrorist activities. Some of those followers were selected as ?most suitable? and were brought in, contact with a cell member located in Turkey who would help them reach Syria or Iraq or collaborate with IS In another manner. All seven cell members were handed down prison sentences of 3V: to 7% years. In another case, one defendant was sentenced to 3% years? imprisonment after the court found him guilty of self-indoctrination. Further to verdicts concerning jihadist terrorism, Spanish courts dealt with the highest number of separatist terrorism cases in the EU in 2016. The vast majority of those cases concerned the terrorist organisation ETA. Individuals charged with offences related to other separatist terrorist groups the PKK and LTTE) were tried in Denmark, Germany and the Netherlands. Greece was the only Member State that reported verdicts for left-wing terrorist offences, while. courts in Hungary, the Netherlands and Spain also tried right-wing terrorism cases. The highest number of female defendants in the concluded proceedings in 2016 were tried for separatist terrorist offences (22) and forjihadist terrorist offences (also 22). In 2016, Austria, Estonia, France, Germany, Greece and Hungary reported successful prosecutions resulting in no acquittals for terrorist offences?. Germany remains the only Member State where prosecutions for terrorist offences led to guilty verdicts and no acquittals In the period 2010?2016. The year 2016 registered a record high conviction rate in the concluded court proceedings The acquittal rate of 11% is signi?cantly lower than that in 2015 and in 2014 and continues the downward trend compared to the years before?. In some cases, defendants were acquitted of terrorist offences but convicted of other offences such as illegal possession offirearms, document forgery, preparing an armed robbery, manufacturing drugs, inciting racial hatred, etc?. All prosecutions for left-wing and right-wing terrorist . offences resulted in convictions in 2016. The concluded jihadist terrorism cases also had a very high conviction rate similar to that in 2015 The acquittal rate among the verdicts related to separatist terrorism decreased significantly in 2016 comparedto 2015 The guilty verdicts pronounced by courts in the EU In 2016 resulted In various penalties Including imprisonment, ?nes, treatment in mental health care facilities, community service and restraining orders. In some cases the court also imposed restrictions on civil rights and bans on entering the national territory on completion of the prison term, or revoked the citizenship of those convicted of terrorist offences. 1""The UK data for 2016 refers only to convictions and is not Included In the numbers In this section. 13 The number of acquittals In 2015 includes the annulled cases against two Individuals in Belgium, In which the court referred to the ne his in Idem principle. "4 Eurojust considers It one verdict If an Individual ls convicted of more than one terrorist offence within the same proceeding, or convicted of a terrorist offence and acquitted of another offence. If an Individual Is acquitted of a terrorist offence and convicted of another offence, the verdict is included In the overview as acquittal of terrorism. 15 The data provided by the United Kingdom was not broken down by type of terrorism and is therefore not included In the numbers. PARRISH FIGURE4 Average sentences (excluding non?prison penalties) per Member State in 2016, as reported to Eurojust. Average sentence in years :GENERAL OVERVIEW HUNGARY NETHERLANDS period of time. In other cases guiltyverdicts were . I down but no penalty was yet ordered at the time of rdered life sentences. in another ease in the ,s the court pronounced a guilty'verdict but 7- penalty based on Article 93 of the Criminal rt considered the defendant?s acts as a one- and recognised the efforts he had made to to Dutch society. son sentence for terrorist offences in the EU . years. This is lower than the reported average 'd to 12%, compared to 20% In 2015 purpose of the calculation of the average prison sentence, penalties 40 years of imprisonment and life sentences were counted as 40 he cases where the court ordered a minimum number of years of the fence to be served the sentence was included in the overview with thie number of years indicated Similar to 2015, in 2016 the average prison sentence for ieft-wing terrorist offences was the highest, increasing from 12 to 28 years. Jihadist and separatist terrorist offences were punished with an average prison sentence of 5 years, and right-wing terrorist offences with 4 years?. it should however, be taken into consideration that the severity of the penalty in each case would depend on the respective offence and cannot serve any comparative purposeSQAlso, in some Member States the average - sentence is calculated on the basis of one conviction, while in others it is-based on a considerably higher number of convictionsi I 17 The data provided by the United Kingdom was not broken down by type of _terrorism and Is therefore not included In the overview Il2.1. JIHADIST TERRORISM mamm? 22 TERRORIST ATTACKS AND SUSPECTS ARRESTED IN THE EU 135 3 people killed in jihadist terrorist attacks 7185??; people arrested on suspicion of jihadist terrorism related offence 2016, 135 people were killed in jihadist terrorist attacks in the EU. In total 13 terrorist attacks were reported: France 5, Belgium 4 and Germany 4. Out of these 13 attacks, 10 were completed. A totai of 718 people were arrested on suspicion ofjihadlst terrorism related offences. Numbers of arrests increased in particularin France: from 188 in 2014 and 377 In 2015 to 429 in 2016. There was also an increase in the Netherlands to 36 in 2016 compared to 20 in 2015. In the other Member States the numbers of arrests stayed at approximately the same level, or. showed a (slight) decrease. Women have increasingly assumed more operational roles in jihadist terrorism activities, as have minors and young adults, as demonstrated in recent (primarily) failed and foiled attacks in Member States. One in four of the arrestees In 2016 were women, a signi?cant increase compared to 2015 Attack planning against the West continues in Syria and Iraq. Groups including IS and al-Qaeda are believed to have both the intent and capabilities to mount complex, mass casualty attacks. IS is training operatives in Syria/Iraq to carry out terrorist acts in the West and has no shortage of volunteers to be part of teams to be sent abroad for this purpose. AI?Qaeda, despite decreased operational capabilities of its core organisation, has maintained its ambition to carry out large-scale operations against Western targets. The terrorist threat in the EU in 2016 emanated from remotely directed individuals operating alone or In small groups, and those that may have been inspired by terrorist propaganda, but not directed. The former are receiving direction and personal instruction from, and are possibly being facilitated by, a terrorist organisation. The latter are individual attackers, possibly but not necessarily being helped by family and/ or friends as accomplices. They are inspired bylihadlst propaganda and messaging, but not necessarily receiving personal direction or instruction from ?any group On 7 January a man wearing what appearedto be a suicide vest and wielding a meat cleaver outside the Goutte d?Or police station in Paris, was shot and killed as he tried to force his wayAin. Also In January a Jewish teacher, wearing traditional dress and kippa, was attacked and wounded with a machete in Marseille while walking to work. The attacker was a 15-year-old boy who had arrived in France in 2010. On 13 June a French police commander and his wife were stabbed to death by a former convict of terrorism-related offences. The police of?cer was attacked on arriving at his home In Magnanville, near Paris. The attacker subsequently entered the house, where he held the officer?s wife and their 3-year-old son hostage. After the police had ended the siegethey found the mother of the child dead. The boy survived. After killing the woman, the attacker broadcast a statement live from the scene via social media in which he pledged allegiance to ISand called for more attacks. The IS related A?maq News Agency posted the video online and a statement that the attack was carried out by an IS fighter. On 26 July two attackers armed with knives entered the church of Saint- Etienne?du-Rouvray (near Rouen) during morning prayers and murdered an 86-year-old priest and seriously PARRISH EU TERRORISM SITUATION AND TREND REPORT 201 7 in?spired/jihadi?st terrorism 20.12 to_2016' ?78bo5?' :7 wounded a nun. She was one of ?ve hostages taken by the perpetrators (the others escaped), while the two attackers, both aged 19, ?lmed themselves in front of the altar. They were shot dead by police as they came out of the church. One of them had tried to travel to Syria twice in 2015. In the evening of 14 July, a 31-year-old Tunisian, living'in France, attacked Bastille Day celebrations in Nice by driving a truck for two kilometres through the crowds ofpeople who had attended a ?rework display on the Promenade des Anglais. He killed 85 people, including 10 children, and injured 201, a number of them critically. The attacker ?red a handgun at police before being shot dead. Evidence from mobile phones and computer records suggest that he may have planned his attack for up to a year. On 16 July, after 36 hours, IS claimed responsibility forthe attack, however, at the time of writing no actual links had been con?rmed. Vehicles have been used as weapons for attacks in France before, including the one in Valence in January and those in Dijon and Nantes in December 2014. These previous attacks however were relatively small scale compared to the Nice attack. A similar soft target attack as in Nice took place on 19 December in Berlin, Germany. A truck was driven Into a Christmas market in the city centre, killing 12 and injuring 56 people. The incident took place next to the Kaiser Wilhelm Memorial Church, an area heavily frequented by both tourists and locals. IS claimed responsibility for the attack through the A?maq News media outlet one day later, calling the attacker a "soldier", who ?carried out the attack 74.! fair itresponse to calls to target citizens of the international coalition?. The perpetrator, a 24-year?old Tunisian national, with a criminal record in Tunisia and Italy, had'arrived in Europe 5 years earlier on the Italian island of Lampedusa and later travelled to Germany where he applied for political asylum. Prior to the attack, he made a video in which he pledged allegiance to iS and provided it to A?maq News. Three days later, he was shot dead after he attacked a police officer in Sesto San Giovanni, a suburb of Milan (Italy), during a routine check. Priorto that, he had passed the Dutch, Belgian and French borders on his way to Italy. The attack in Berlin was preceded by a number of other completed, failed and foiled attacks in Germany in 2016. The ?rst incident with a violent jihadist signature occurred on 26 February when a 15-year-old German girl of Moroccan descent stabbed and seriously Wounded a police of?cer with a kitchen knife in Hanover. The Incident occurred at the main train station, after two police of?cers had approached the girl and had asked her to present her identi?cation papers. After her arrest police found that she was also carrying a second larger?? knife. The girl had travelled to the Turkish-Syrian border in November 2015 to join is, but had returned to Germany on 28 January 2016. On 18 July a 17?year-old Afghan refugee attacked passengers with an axe and a knife on board a train heading to Wijrzburg in southern Germany. Five persons were seriously wounded. The attacker ?ed the train but was chased by officers who shot him dead. The perpetrator appeared to have travelled to Germany as PARRISH an unaccompanied minor In 2015. A video released by IS claims to show him delivering a speech in Pashto to the camera while holding a knife. The video calls him ?a soldier of the Islamic State who "ca rrled out the Wiirzburg attack?. On 24 July a 27-year-old Syrian killed himself and injured 12 people ?three seriously - by detonating a backpack bomb in'Ansbach, near Nuremberg. It appears that the -Ansbach Open Music Festival was the intended target. The perpetrator entered Germany in 2014 and applied for asylum but his request was turned down a year later; he was allowed to stay in Germany because of the ongoing war in Syria. He was known to police, had tried to kill himself twice before and had been in care. The lS-linked A?maq News agency stated that the attacker was an IS soldier, responding to the group?s calls to target countries of the US-led coalition against IS in Syria and Iraq. On 22 March Belgibm was struck by two large?scale terrorist attacks. Both attacks were coordinated and carefully prepared with a high level of sophistication and logistical support. In the first attack two suicide bombers detonated improvised explosive devices in the check-in area of Brussels Zaventem Airport, causing the death of 11 people. In the second attack, approximately one hour later, an Improvised explosive device was'detonated by a third suicide bomber in the middle carriage of a metro train at Maelbeek station (ciose to several European Union institutions). Two surviving attackers were subsequently arrestedmessesx'mwezwrs'5m27gmo 24 at - ?i One ofthe suicide bombers at the airport had been Involved in an earlier attempted robbery at a currency exchange of?ce and a subsequent shootout with police that left one of?cer Injured, for which he Was sentenced to 10 years In prison but was paroled In 2014 under the condition that he did not leave the country. The suicide bomber in the metro train was earlier convicted of Several carjackings, possessing a number of Kalashnikov rifles, and a 2009 bank robbery and kidnapping. All ?ve were connected to the network that organised and executed the November 2015 Paris attacks. A total of 32 people were killed and 340 people injured in the attacks. Later in the year Belgium faced two other terrorist attacks that were carried out without the impact and sophistication of the Brussels attacks (international travel, safe houses, use of false documents, manufacturing of explosives), but were nevertheless serious. In August in Charlerol, two police of?cers, both female, were attacked with a machete outside a police station. Both of?cers were wounded severely, but not life?threatening. The suspect was a 33-year-old Algerian, who had been living in Belgium since 2012 and was known to the police for criminal offences, but had not been linked to terror activities before. He was shot by a third of?cer who was-nearby and subsequently died of his wounds. On 7 August IS claimed responsibility for the attack, calling it a reprisal carried out by one of Its 'soldiers?. In October two police of?cers were stabbed in Schaerbeek, north?east of Brussels, by-a 43-year-old Belgian national. The assailant was stopped by a second group of police PARRISH a i I EU TERRORISM SITUATION AND TREND REPORT 2017 of?cers. He broke the nose of one of?cer, who shot him in the leg. Apart from completed attacks there were a number of failed and foiled terrorist attacks and arrests on suspicion of terrorist activities. Two plots that could have had a signi?cant impact in terms of loss of life If they had not been stopped in time are included here by way of examples. One was thwarted In France, the other in Germany. In March a French national was arrested in the Argenteuil suburb of Paris, In what was believed to be the advanced stages of preparation for a terrorist attack. The arrested individual was believed to be part of a terrorist network that planned to commit an attack in France. The suspect had already been found guilty in absentia by a Belgian court and sentenced to 10 years in prison for ties to a jihadist network in 2015. Police seized 2 kilograms of the explosive TATP and a Kalashnikov ri?e, and also found materials to make more explosives. In June German police arrested three alleged IS members of Syrian nationality, on suspicion of plotting a terror attack in Germany. The three were caught separately in different cities. It was believed that the men had received orders from IS leadership to attack the city of D'Lisseldorf using suicide vests, explosives and rifles. The plan was allegedly for two men to blow themselves up in central Diisseldorf before other attackers would kill as many people as possible with ?rearms and explosives. In 2016 EU citizens were killed in IS attacks outside the EU. On 12 January, 10 German tourists were killed In a suicide bomb attack in Istanbul (Turkey). This was one of seven fatal attacks in Turkey attributed to IS in 2016. On 1 July nine Italian citizens were amongst the victims who lost their lives in Dhaka (Bangladesh) in an attack on a bakery located In an a? ear IS claimed was later disputed by Bangladesh? 5 belonged to Ja The high numb of terrorism suspects, indicate a continued threat towards countries of the EU, and those Member States of the EU that are part of a coalition against IS?in Syria/Iraq In particular. Therefore the threat ofjihadist terrorism is- not perceived equally amongst Member States, of which the majority have not been confronted with jihadist terrorist activities at all In 2016, nor in one of the preceding years. These countries might be used for transiting of foreign terrorist ?ghters, (potential) jihadists or returnees, or for a safe haven for them. These and other factors, however, including perceived insults to Islam, may influence potential risks. Switzerland for instance, not being an EU MemberState and not being part of a coalition against IS, is aware of its vulnerability to jihadist terrorism by association with other Western countries and its international pro?le. Since the IS announcement in June 2014 that it had re-established the caliphate, the group claimed that all Muslims were under the religious obligation to join it. It was alleged that, by doing so, they would re-enact the historical migration (Hijrah) of Prophet Muhammad to Medina in 622 AD to evade persecution In Mecca. The group declared .that refusal to join it was proof of apostasy from Islam. In 2015 IS insisted that the only excuse for Muslims for not joining the group in the territories under its control was to perpetrate a terrorist attack in their places of residence. As military pressure on IS increased and meas prevent potential recruits frOm reaching lS-co territory became more effective, IS adapted It tactics. It now declared that perpetrating a ter 7 in the West was even preferable to travellin In a speech released on 21 May 2016, IS spo PARRISH Muhammad was subsequently killed in August 2016 near Aleppo, urged volunteers that were prevented from travelling to join IS to perpetrate attacks in their placeslof residence. IS supporters, in particular in the United States and Europe, should carry out attacks with any means available during the month of Ramadan (6 June to 5 July 2016). Al-Adnani stressed that even the smallest attack in the West would have a great impact, as it would terrorise the enemy. The increased efforts to incite IS sympathisers in the West to perpetrate attacks were re?ected in practical guidance for lone actor attacks provided in IS publications. The IS multI?language magazine Rumiyo'h18 contained a series of articles under the title ?Just Terror Tactics?, which suggested terrorist attacks using knives, vehicles or arson, and gave tips on how to maximise the numbers of victims and impact. Perpetrators were admonished to leave some kind of evidence stating the motivation of the attack and allegiance to IS, such as anote attached to the victim?s body or a last will. In 2016 IS preferred to claim lone actor attacks through its A?maq News Agency?. Starting with the 12 June 2016 attack on a in Orlando, Florida, (US), A?moq News issued short messages labelling the perpetrators of lone acto'r attacks outside IS?controlled territory as ?soldiers of the Islamic State?, generally adding that they acted in response to calls to attack citizens of anti?IS coalition countries. As a precautionary measure, most of these claims pointed Out that the information was received by A?maq News from a ?security [read intelligence] source?. The public tribute paidby IS to lone actor terrorists was away to give incentives'to other potential attackers, while placing responsibility for the success of the attack entirely on the perpetrator. A?maq News? claims for attacks were mainly released within 24 hours after the attack, except in the case of the 14 July 2016 attack in Nice, when the claim came two days later. It has been speculated that the IS leadership had no prior knowledge of the attack or that the delay was a deliberate strategy to create confusion and maximise media coverage. In addition to the short statements by A?maq News, in several lone actor attacksin EU Member States in2016, the perpetrators sent previously recorded video statements in which theyjustified their attacks and pledged allegiance to IS, which were published on the A?maq News website. The precedent for this strategy was set during the 13 June 2016 murder of a police of?cer and his wife in Magnanville near Paris. After killing his two victims, the perpetrator broadcast a video message live from the location of the crime through a social media service. The video was later re-published on'the A'maq News website. In subSequent attacks, prior to the commission of the crime, the perpetrators recorded videos in which they announced and justi?ed their attacks. These videos were published on A?maq News following the attack as proof of the attackers' motivation. This strategy was used in the 18 July stabbing 7 attack in a train headed to Wiirzburg, Germany; the 24 18 See section below on communication. 19 See section below on communication. .JIHADIST TERRORISM 26 July bomb attack in Ansbach, Germany; the 26 July murder of a priest in St?Etienne-du?Rouvray, France; and the 19 December 2016 attack on a Christmas market in Berlin. The increased efforts by IS to directly recruit vulnerable people via social media and incite them to perpetrate terrorist acts in their country of residence, seem to not be limited to male targets. Media reporting suggests that . women were also targeted, as In the 26 February knife attack in Hanover by a 15-year-old girl. In addition, in . early September, a cell consisting of three-women was dismantled In Paris. They were suspected of having planted a car containing ?ve gas bottles and a rudimentary ignition mechanism close to Notre Dame cathedral and planning further attacks. At least one of the suspects was reportedly In contact with a French male IS member thought to be In IS-controlled territory at the time. An attack on a police station by three women in Mombasa, Kenya, on 11 September was claimed by IS. Another cell of 10 women was arrested In Morocco in early October. In all cases, there are reports that the suspects were in contact with IS operatives. IS ideology, as that of otherjihadist groups, exempts women from theobligation to participate in armed action except for self-defence, but does not explicitly prohibit them from engaging in fighting. By implication, women may, if theyso wish, carry out attacks on perceived enemies. At first glance, however, self-organised terrorist activities by women seem to be at variance with the strict gender segregation, the conscription of women to the closed circles of-the family home and the extremely limited areas of activity outside of It, propagated in IS propaganda?. As a result, IS propaganda does not address women directly, but does not explicitly'exclude them from the obligation to fight either. The attack in Mombasa was commented upon in an'article in the IS Arabic newsletter ol?Nabcr?,Z1 which described the attackers as ?sisters supporting the Islamic State?, not as "soldiers". The known cells seem to have consisted only of women, which might be linked to the obligation of gender segregation. In 2012, already before the emergence of IS, al-Qaeda had redesigned its strategy to ensure its survival under the changed political circumstances following the Arab rebellions: al?Qaeda would merge with the population to the extent possible; cooperate with other Muslim groups based on common interests; and administerterritories' that fell under its control alienate the population. The aim was to create safe havens from which aI?Qaeda could plan and execute attacks on Western targets. The intransigent behaviour of IS toward local populations made the implementation of this new strategy even more pressing for al?Qaeda In an effort to mark the- difference to its opponent. 2'0 See section below on Jihadist propaganda. ?1 See section below on communication. PARRISH EU TERRORISM SITUATION AND TREND REPORT 20w We 27 He asked Muslims and the different ?ghting factions in Syria to trust its local af?liate Jabhat ai-Nusra with the futureof the Levant.22 He exhorted opposition groups in Syria not to let the country fall into the hands of Shi?is, or IS. At times, the new rhetoric adopted by aI?Qaeda seemed to pick up on demands for representative government formulated during the Arab rebellions. In a video message commemorating the 15??anniversary of the 11 September 2001 attacks, for example, Ayman al?Zawahiri stated that the 2001 attacks were meant to ?restore the equilibrium? between Muslims and the West. The attacks 'were claimed to be a reaction to the West?s alleged crimes in the Muslim world. With aI?Qaeda?ssupport, he claimed, the Arab 7 revolutions would acquirean Islamic character and form the nucleus of an assembly that would be able to elect a caliph in the future. He said that the Muslim community had the right to choose, hold responsible and depose its leader. At the same time, he rejected negotiations; only armed struggle could bring a solution. In most of its material published in Arabic language, al? Qaeda tends to downplay its international aspirations. By contrast, a ~Qaeda Communication targeting audiences in the West contains views and calls for action very similar to those of IS. This is likely to be an attempt to bene?t from the gradual decline of IS communication with the aim of again gaining ascendency in the global jihadist movement. Interestingly, in doing so al?Qaeda copied successful propaganda formats developed by IS. 22 For developments In Syria concerning Jabhat ai-Nusra, see section below on Syria. The competition with IS for leadership In the global jihadist movement was apparent in the 2016 publication of a new issue of al-Qaeda in the Arabian Peninsula?s (AQAP) - Inspire magazine. The 16th issue of Inspire, released on 12 November, praised three lone actor attacks in the . US on 17 September 2016 (one of which was claimed by IS), likening them to the 11 September 2001 attacks. It provided instructions on how to build iEDs, Justi?ed lone actor attacks in the West, and Incited minorities (African Americans) to act. - In addition to the continuation of the Inspire magazine, AQAP introduced a new format, the Inspire Guides - short commentaries on completed and foiled attacks in the West with recommendations for future attacks. The ?rst such document was released on 23 June 2016 and analysed the 12 June 2016 attack on a in Orlando, Florida, US. While praising the attack for the good planning and execution, it advised that future attacks should target places mainly frequented by white Anglo-Saxon people, who allegedly hold power in the US, rather than places that are popular with sexual or ethnic minorities. A second edition on 21 July 2016 praised the IS-linked attack in Nice, France, a week earlier. It recommended that the perpetrator should send a message so that the people may know and understand his motives. In a comment on the arrest of a female lS-linked terrorist cell In Paris In 'early September, inspire Guide Insisted that women be prevented from conducting terrorist attacks. By contrast, with regard to the three 17 September attacks in the US, an article labelled as an Inspire Guide in the November issue of Inspire gave practical instructions on how to maximise the Impact of lone actor attacks in the West. PARRISH rrorist and armed criminai groups continue to consider ?zens of the EU and other western countries as high? targets for kidnapping. This is because ransom money signi?cant source of revenue for some groups; the t?nsive media attentiOn attracted by western hostages exploited for propaganda and poiiticai pressure; hostages can be used in prisoner swaps. It is assessed at?militant groups do not select individuals of specific 'onalities but target their victims opportunistically. total number of abducted EU citizens is dif?cult stimate due to the fact that not ali the kidnapping dents are reported for reasons related to the security of. ostages. In 2016, the kidnap threat remained very high around conflict zones as well as in areas with Iittle or: gernmentai controi. incidIIents involving the kidnapping- es. Iin addition Syria Iraq and Yemen remained Icountries, although no abductions were reported ing', inter alia, the reiease ofits fighters. risons, as well as of a member ofAnsoIr- ideo was released In June as proof of as still In the hands of at the time lso Continued to hold a BrItish~South the hands of his captors' In 2016 The . in May 2015 by a factIon of In!- I umbitun. had merged in Iiate' "them online said to have been y. a in the region. Romania vernment did not receive TERRORSSM in Libya, IS and other militant groups continued to take 'I-'aIclvantage of the instability ofthe country and carried on With their terrorist and criminal activities. In March 2016 two Italian employees ofa construction company were I killed In the area of Sabratha, during a ?ght between Libyan security forces and their captors. They had been abducted by 15in July 2015 near?the towns of Zwara and Mellitah, aiong- with two other Italians who were held In a different location and managed to escape, also in March 2016. IS militants stiil hoid an Austrian and a Czech national Who I were abducted? In March 2015 from an oil?eld In Zalia, along :with seven more people from Ghana and the Philippines. In Ghat,? south Western Libya a iocal armed group kidnapped tho Itaiian employees of a construction company in September 2016 and released them in November. No details regarding their abduction or release have been disclosed. I in- the Philippines. the terrorist group Abu Sayyaf continued 7 to carry out kidnappings In April its members killed a British Canadian and' In June a Canadian hostage. Both men had been abducted' In september 2015 along with a NoIrWegian- and a from a resort In the southern Philippmines The Norwegian man remained captive at . the time of writing,- whereas the Filipino was reieased in June 2015 Abu Sayyaf militants Were. also behind the 3 kidnapping of a German man and the murder of his Wife whiie they were off the southern Filipino coast in November They demanded a ransom of PHP 30 miliion (EUR 565 000) but conseqUently killed the hostage. In February 2017 a video was posted oniine that appeared to show the execution An Italian citizen abducted by Abu - jSayyaf In October 2015' In the city of Dipoiog was .3. released In April 2016 The hostage was held on the island of Jolo,? tIhe stronghoid of the terrorist group, where he - spent his captivity with other hostages. In Syria In May, Jobhot Fath ail-Sham (former Jabhat oI?NusIral reieased three Spanish journalists that were abducted near Aleppo In July 2015 The group also claimed it freed a German woman and her baby In September 2016 denying it was responsible for her kidnapping. The woman I had been abducted In October 2015. These reieases are assessed to be part of the group 5 attempts to distance itself from is practices A British journaiist held hostage by IS since November 2012 continued to appear in propaganda material. He featured In two IS videos released' In December 2.016 II 2.2. EU TERRORISM SITUATION AND TREND REPORT 2017 COMMUNICATIONS titer.? The quantity of IS propaganda decreased in 20i 6 due to lower production rates and containment of dissemination ?will IS messages shifted from the rhetoric of victorious Islam, to calls for retaliation for alleged attacks on Islam Terrorists have an interest in ensuring that their messages reach the audiences that they want to address. As they perceive themselves to be ?ghting for a legitimate cause, they need tojustify their violent actions to supporters and opponents. Public communication is used to attract'potential recruits, procure material and ?nancial support, and intimidate opponents. At present, large volumes of people use'online 7 services to communicate. Terrorists are compelled to maintain an online presence and compete for visibility with other actors in public communications, including individuals, civil movements, governments, political opponents, and competing terrorist groups. In 2016 terrorist groups continued to use online services for communication in targeted and diverse ways. Terrorist propaganda was spread primarily through social media platforms and ?le sharing sites. and . technologies freely available online, and a multitude of platforms, enable terrorists to spread propaganda while maintaining their anonymity. However, measures taken by some social media platforms23 started to have a disruptive effect, in particular on IS communication, with the volume of messaging gradually decreasing in the course of the year; In 2015 IS had devised a strategy to counter the . Increased suspension of accounts, which relied on posting identical messages through a multitude of accounts?. In 2016 this strategy reached its limits as detection capabilities increased. At the same time, is and other terrorist 23 For example, in late 2016, Facebook. Microsoft, Twitter and Google (YouTube) created a joint database to quickly identify and remove images and videos promoting terrorism from their platforms. When one company identifies and removes such a piece of content, the others will be able to use a unique digital ?ngerprint (hash) to identify and remove the same piece of content from their own network in accordance with their own policies, See "Partnering to Help Curb Spread of Onllne Terrorist Content", FacebOok Newsroom, 5 December 2016. Tie-sin 201s. groups increased their use of other social media platforms, most notably Telegram. IS used the platform for networking and dissemination of information among its community of supporters. Telegram is a closed communication space; its contents are not indexed in search engines. As such, it is not suited for outreach to individuals that are yet to be Initiated into terrorist ideology. IS supporters use Telegram as a space for preparation, discussion and collaboration as well as a virtual training camp and Massive Open Onllne Course (MOOC) platform?. However, supporters are enjoined starting point to move to platforms that have a stronger impact, in particular Twitter and, to a lesser extent, Facebook. IS praised its supporters on Telegram for being part of its propaganda apparatus. To reach out to audiences beyond closed circles, iS supporters on Telegram organised coordinated campaigns that aimed to flood Twitter and other major social media platforms with messages within minutes of new propaganda items being released. Before the release, IS supporters were told to create Twitter accounts to advertise the new propaganda production. Once published, the item was spread In a great number of messages. To achieve wide dissemination, the messages contained hashtags referring to current events unrelated to terrorism, such as political rallies or sports matches, in languages of regions of interest, including Europe and other Westernrcountries, but also hashtags used by IS opponents in the Middle East. Simultaneously, the original ?les were repiicated from their original source of publication to a great number of download sites to ensure continued availability despite containment efforts made by online service providers. In addition to the increased dif?culties in dissemination, the volume of IS 25 A MOOC platform allows online learning and its content ls accessible to any person who wants to take a course, with no limit on attendance. PARRISH propaganda production also experienced a setback in 2016. After a peak in mid~2015, the number of new videos produced by IS slowly decreased. In the second half of 2016, the frequency of new releases dropped even further. This seems to indicate that lS?s propaganda apparatus was severely degraded due to the increased pressure on the group in its areas of activity; leading ?gures in its propaganda apparatus and media production infrastructure in areas under IS control were targeted. The group struggled to counter the loss of iconic leadership ?gures, propaganda of?cials and production capabilities, and to maintain the reach of its messages by adapting its communication strategies to use remaining capacities more ef?ciently. These losses notwithstanding, IS's propaganda apparatus remained highly strati?ed. Its central media outlets continued to be mainly reserved for messages from the central leadership. Their statements were ampli?ed by a second layer of media outlets named after purported "provinces?. These ?provincial? media of?ces issued videos but also ?urgent? messages, generally in picture format, claiming military victories in their area of operation. Starting in 2015, IS's Arabic weekly news bulletin aI-Noba? (?Tthe news?) acquired increasing importance In 2016 in attempt to maintain a continued flow of propaganda messages. Initially unattributed, starting in October 2016, aI?Naba?was labelled as an of?cial production of central media of?ce. The publication focussed on military successes of lS'and contained some moralistic or ideological articles. Its primary audience was IS ?ghters on the ground, and IS published . pictures of al-Nqbq?being disseminated to and consumed by these. Its subsequent wide dissemination on the internet is likely to be an attempt to create synergies In order to counter diminishing production capacities. in addition to the of?cially acknowledged media outlets, IS had seVeral outlets pretending to be journalistic organs, most prominently the A?maq News Agency and aI-Bayan Radio. Within lS?s propaganda machinery, these entities have the role of acting as purportedly independent media entities providing infOrmation from IS territoryp Al~Bayon Radiois an online radio station that issues daily news bulletins in'several languages. The A?maq News Agency was created in 2014 to counter reporting by mainstream media opposed to IS, and broadcasts from the conflict area through short media-style messages and videos proclaiming IS military successes. To maintain the appearance of independence, IS did not acknowledge A?maq News as an of?cial media outlet. Of?cial publications referred to it as a source, in an effort to elevate A?maq News to the status of an independent information provider. For example, ai?Naba?articles combined information taken from mainstream media with information spread by A?maq News. Efforts by IS to reach out to non-Arab audiences continued in 2016. During the ?rst half of the yea r, the ai-Hayat Media JIHADIST TERRORISM 30 Centre, an of?cially recognised IS media outlet specialising in propaganda in languages other than Arabic, continued to publish glossy magazines in English (Dabiq), French (Dar (II-Islam), Turkish (Konstan?niyye) and Russian (istok). These elaborate publications were produced separately, with contents that speci?cally targeted the respective language community. In mid-2016, these formats were abandoned and seemingly replaced with a new publication named Rumiyah, in reference to the city of Rome which, according to a Prophetic tradition, would be conquered by Islam after Constantinople. Starting in September, Rumiyah was issued in eight, and later 10, languages including English, French, German, Russian and Turkish, on a basis for the rest of 2016 and Into 2017. While the magazine perpetuated the glossy style of its predecessors, Rumiyah's texts were for the most part translations of articles published previously in Arabic in ai-Naba?. To these are added a small number of articles that occur only In one or a few language versions and thatserve to adjust the magazine to particular audiences. Around this network of propaganda entities acknowledged by IS or acting as purportedly independent news outlets reporting from areas ofoperation, there are a number of IS-supporting entities which are not of?cially recognised as mouthpieces by IS but are left to represent the base of IS supporters. These translate IS propaganda into different languages and produce additional material in different formats, Including Videos, graphics and texts, with a view to multiplying the messages of the official IS propaganda entities and creating the impresSion of a large global following. In 2016, it appeared that these IS?supporting media outlets are not as independent or autonomous as the IS leadership would like the general public to believe; they apparently have access to raw footage from areas of operation and respond to of?cial releases in a speed that suggests central coordination, for example by publishing a video in support of an of?cial publication within less than a day?s interval. In addition, production from these purportedly independent media outlets decreased in 2016 at the same rate as official IS propaganda. To a signi?cant extent, therefore, these entities are part of the centrally coordinated IS propaganda machinery. As the volume of IS propaganda diminished, al-Qaeda and its af?liates attempted to take advantage of the situation and Increased their efforts to reach new audiences. The nominal head of aI?Qaeda, Ayman al-Zawahiri, appeared in several video messages In 2016, trying to position al-Qaeda as a credible alternative to IS. This was supported by a multitude of written material published online. Al-Qaeda and its af?liates published new issues of established English glossy magazines, such as inspire and Al Risaiah, with justi?cations and practical advice for terrorist attacks. Like IS, aI-Qaeda also moved increasingly to Telegram to avoid suspension. Some ideologues effectively restricted their activity to the chat platform. PARRISH 7 EU TERRORISM SITUATION AND TREND REPORT 2017 The origins of practically all majorjihadist terrorist groups can be traced to regions outside the EU. Consequently, online propaganda is an essential part of their attempts to reach out to audiencesin EU Member States, as it enables them to make the link between the grievances of potentially vulnerable people living in the EU with . the armed struggle that they conduct in their areas of operation. Jihadist online propaganda has developed over some two decades. The methods used today are tested and optimised to achieve the greatest possible impact. They have been tailored for speci?c audiences. This long experience notwithstanding, jihadist propaganda has adapted quickly to new forms of communication and design, most recently incorporating graphical elements and styles copied from youth culture and online gaming, in an attempt to attract younger audiences in particular. Likewise, the contents ofjihadist propaganda vary over time, always aiming to achieve the greatest impact at any giVen point. Following the claim by IS that it re?established the calehate, IS propaganda in 2014 and 2015 aimed to create the impression that the group represented victorious Islam. Its main topics were the purported defence of Islam, the creation of an Islamic state under IS leader Abu Bakr al- . Baghdadi In his arrogated function of caliph of all Muslims.. [S?s claim to success in this endeavour was supported with the display of IS policies thatostensibly guaranteed justice, welfare and services for the population under its control. Videos showed the Implementation of social policies, consumer protection, religious education, but also military victories and the execution of enemies. In 2016 the topics dominating IS propaganda shifted. The most remarkable change was the replacement of the narrative of .a victorious Islam, embodied'by IS, with one that depicted Sunni Muslims as being under attack by an alleged Western?Jewish?Shi?i alliance that aimed to eradicate Sunni Islam. The lS leadership claims that its fight against its enemies is part of the final battle, detailed in the sources of Islam, in will prevail on the Day of Judgement. In August. 2016, the Dabiq magazine, whose name refers to the location In which Islamic tradition locates the last battle between Gaod and Evil, claimed that IS was not ?ghting the'West due to its policies but on account of its ?unbelief?. In an effort to suppress and deter any attempt of dissension in territories under its control, IS published a large number of videos showing individuals labelled as traitors and spies for the anti?IS coalition. Other videos showed the killing of members of armed opposition groups fighting against IS. The victims were made to confess deeds that were alleged to be crimes against Muslims and then assassinated, generally by beheading or shooting from a close range. Videos showing these killings used repetition, multiple cameras and slow motion to increase theimpact of the killings. In one video published in late 2016, two Turkish soldiers captured by IS In Syria were burnt alive. With regard to the West, IS told its supporters that they were obliged to seek ?retributive justice" for attacks perpetrated by the international anti?l5 alliance. Muslim scholars opposed to IS were also Identi?ed as targets of lone actor attacks. IS also called for the killing of prominent representatives of Sunni Muslims in Europe, including Sala?st preachers opposed to it. PARRISH JIHADIST TERRORISM mamwwm 32 In an attempt to restrict access to independent information in areas underlt's control, in earlyJune 2016 IS condUcted a media campaign, including a series of videos, urging people to destroy their satellite dishes and receivers. IS tried to compensate reports about military setbacks by continuously projecting a propaganda image characterised by a combination of military victories and utopian views oforderly daily life and undisturbed functioning of the administration and services provided under IS rule. That the situation did change, and with it lS?s priorities with regard to recruits, is illustrated by its attitude towards women. In 2016, as in previous years, IS formulated rules for women?s behaviour in areas under its control that aim to give men control over every aspect of their lives. IS expected women to marry IS ?ghters. They were obliged to obey their husbands, a duty that, IS insisted, also applied to foreign women, who cannot pretend to be privileged because of their travelling to join IS (Hijrah). Women have no right to question their husbands? decisions in their or their children's regard. Their principle role under IS Is to bear children, keep the household and educate the children to become ?ghters in line with IS ideology. Women are. enjoined to stay athome and not go out without their husbands? permission. If they do go out, they must cover their body entirely, including face and hands. Despite this puritanical code of behaviour, IS used the possibility to acquire women as an incentive to attract male ?ghters. To this end, in 2014 IS declared the re-introduction of slavery, so that IS members could capture or purchase women from the Yazidi community, which had been declared pagans by IS for that purpose. Possibly after the expansion bf IS came to a halt in 2015, the supply of women for enslavement decreased. In 2016 IS publications tried to persuade women that polygamy, I.e. the marriage of a man with up to four Muslim women, was the right of men, probably as a means to maintain the sexual stimulus for IS ?ghters. Another new aspect In IS propaganda targeting women was the request to provide material support to IS from their private property Which, contrary to ?ghting, it described as a form ofJIhad that is obligatory for women. In the past, IS had tried to attract recruits with the promise that all their housing and salary needs would be catered for. Propaganda targeting Western women In principle contained the same messages as for Arab audiences. In addition, however, it tried to give the impression that under IS rule women were able to play more active roles, which Is at odds with the proclaimed restrictions on women?s freedom. At the same time, IS propaganda portrayed life in the West as corrupted, denigrating for women and contrary to human nature. In late 2016, IS added a new topic to its messages to ensure the organisation?s survival: in case of defeat In Syria and Iraq, IS af?liates in other geographical areas should continue the struggle. For example, in a 3 November 2016 speech following the launch of the military campaign to end IS control of Mosul in Iraq, IS leader Abu Bakr aI-Baghdadi called Upon IS members to be steadfast in the face of the attacks of the anti?IS coalition, describing its members as enemies of Sunni Muslims. He urged IS ?ghters in areas outside Iraq and Syria to continue the ?ght, even if the IS leadership was killed, and asked IS sympathisers to . move to these regions rather than trying to join the group In Iraq and Syria. In 2016 the most active iS af?liates outside Syria and Iraq with regard to video production were In Libya, Egypt and Afghanistan. PARRISH EU TERRORISM SITUATION AND TREND REPORT 2017 $23; 9% :39 a ggefg 691% aag?ga ?55Meagan a 55gfig? 1:522:911152: 2:215 aw5a$?a??a$6?eg?ge?fa?a?95?3??: 995kg Raggaga??ga aea??g?? sage i @3299 Q19 ?35, 3% . a as; saga 92%? I g5? g?g at: 9699 eager 3 tag ?egg a i 3 2?9 ass-acct @a eg a sagas i gg$a?g?a?g massage Bag; 9 a ??aeaa ?es? a 0533a?ag Wag.? aimed at provudmg combat training. - 3:619 . . .7 i . . *aae . 7 The number of arrests made 5 . I 65 a '3 under Increasmg . region In recent years attest to the fact .7 . - age a - tthe r'mar terror threa '92? i military pressureregion has been, and Will continue to be, losmg temtory th at'lt - - 'ihadist terrorism re resented both a 5' The con?ict In Syria has had an I a used to control in Syria and Iraq Turkey faced a number of largescale terrorist attacks Political Instability and insecurity in Lybia continued in 2016 AQIM carried out a series of attacks on hotels popular with Western citizens in Mali, Burkina Faso and Ivory Coast. Jihadist terrorists also attacked Wes-tern citizens in the Middle?East and North- Africa (MENA) region, including in Egypt, Jordan and Lybia enormous resonance in Albania, Bosnia and Herzegovina, Kosovo, the former Yugoslav Republic of Macedonia and Serbia. More than 800 FTFs have so fartravelled to Syria to join the armed con?ict from the countries of the Western Balkans. In some parts of the Western Balkan region, radical lslamist ideology promoted by radical preachers and/or leaders of some saia?st groups, challenging the traditional dominance of moderate Islam in the region, has gained considerable ground. Bosnia and Herzegovina, the so-called Sandzak region (between Serbia and Montenegro), Albanian?speaking territories in Serbia and the former Yugoslav Republic of Macedonia, Kosovo, and Albania until recently were considered the main hot- spots for radicalisation, recruitment, and facilitation activities of FTFs destined for Syria. The region has also been a well- established and recognised traVel route to and from conflict zones in the Middle East. Common battle experiences amongst Western-Balkan FTF returnees may cross-cut ethnic and national boundaries after their return home and may pose a signi?cant threat to the region. The presence of illegal weapons, especially small and light weapons, as well as mines and explosive devices is a signi?cant security issue in the Western Balkans. Available data do not corroborate media reports on the existence of so- called ?training camps? in the region similar to those allegedly present in Syria, returnees from the con?ict zone in Syria and Iraq, and home-grown radicalised and inspired individuals. In November 2016 competent authorities of Albania, Kosovo and the former Yugoslav Republic of Macedonia prevented the occurrence of two terrorist attacks planned to be committed on their territories, with 19 arrests in Kosovo and six in Albania and the former Yugoslav Republic of Macedonia. The attacks, allegedly intended to simultaneously target a football match in Albania (between Albania and Israel) and a target in Kosovo, are believed to have been planned and directed from Syria. TATP, ?rearms and electronic equipment were seized in police raids. The level of threat posed by extreme left- wing, anarchist and extreme right-wing terrorism in Western Balkan countries appears to be insigni?cant compared to religiously motivated terrorism (primary threat) and ethno-nationalist and- separatist terrorism (secondary threat) in the region. IS claimed responsibility for seVeral attacks in Dagestan in 2016. is Caucasus province tried to persuade people to ?ght in the Caucasus, rather than travel to Syria. IS claimed an attack by two individuals on PARRISH 17 August In Balashikha near Moscow on a Russian traf?c police outpost. They had sent a video to A?maq News in which they explained that they were acting on IS orders to strike with whatever means available. They claimed to act in revenge for the killing of Muslims in Syria and Iraq. The US faced a number of lone actor attacks In 2016. The most severe attack took place on 12 June, when the perpetrator stormed a in Orlando, Florida, killing 49 people and taking hostages. in telephone calls to the emergency number, the attacker, who was subsequently killed by police, is reported to have pledged allegiance to 15. While questions about . his motivations persist, A?maq News described him as an ?Islamic State fighter". Two other attacks in the USA were claimed by IS. On 17 September, a man stabbed and injured 10 people in a shopping mail In St Cloud, Minnesota. The attack was claimed by IS through A?maq News. On 28 November, an attacker rammed a car into a group of students at Ohio UnIVersity, Columbus, Ohio, before attacking them with a knife. A total Of 13 people were injured. The attack was claimed by IS through A?maq News. Additional attacks that were not claimed by iS included two bomb attacks on 17 September in Seaside Park, New Jersey, and New York City, respectively. Whereas the first attack did not cause casualties, in the New York attack, 29 people were injured when a pressure cooker bomb exploded In a busy street. Another device was found nearby unexploded. On 18 September, an explosive device found in a train station in Elizabeth, NewJersey, exploded during an attempt todisarm It, causing no injuries. The individual believed to have carried out these attacks was arrested. This series of attacks was not commented on by IS, but Itwas praised, together with the St Cloud attack, in AQAP's Inspire magazine, published in November 2016. Another JIHADIST 34 lone actor attack was carried out on 7 January, when a police of?cer In Philadelphia was shot and injured by an individual pledging allegiance to IS. IS did not claim the attack. in addition to the attacks In the US, on 27 October, a security of?cer was stabbed outside the US embassy in Nairobi (Kenya). This attack was also claimed by IS through A?maq News. In canada, police in Strathroy, Ontario, killed a man planning to carry out a suicide attack using an IED on 10 AuguSt. In November, a prominent Islamic State militant of Australian origin, who was thought to~have been killed in an air strike in Iraq, was arrested in Turkey. In December, police arrested five men suspected of planning a terrorist attack . in Melbourne on Christmas Day. In 2016 IS came under increasing . military pressure, losing territory that it used to control In Syria-and Iraq. In Syria, the city and historic sites of Palmyra (or Tadmur In Arabic), which were captured by IS In 2015, were re-taken by the Syrian regime in March 2016 before brie?y being re-captured by IS in December. An IS attack?in December at a Crusader castle in the town of Karak in Jordan killed 10 people, including a Canadian tourist. In Iraq, IS lost strategic towns such as Ramadi In February and ai?Falluja in June. The campaign to expel IS from Mosul was launched in October. Several high-ranking IS leaders and propaganda of?cials were killed in 2016, including the of?cial IS spokesman Abu Muhammad al- Adnani In August. IS media production infrastructure was reportedly destroyed in Mosul. . Both In Syria and Iraq, IS continued destroying cultural heritage. Further destruction was reported from Palmyra. In June 2016, IS destroyed the 2800-year?oid Nabu temple at the archaeological site of Nimrud near Mosul. In Syria, the civil war entered its sixth year In 2016. Several attempts by the UN and other international actors to reach a lasting cease?re, all ofwhich excluded IS and Jabhat al?Nusra (?support front?), aI-Qaeda?s of?cial af?liate in Syria, were unsuccessful. The regime continued to receive military support from'ShI?I militias, iran and Russia. IS, while on the defensive, continued to ?ght the regime and armed opposition forces. Thus, the Syrian armed opposition is locked In a two?front war against the regime on one side and IS on the other. Turkey sent troops into Syria in August to push back IS militants and Kurdish-led rebels from a section of the two countries? border, In cooperation with a number of Arab opposition factions. Syrian opposition forces consist of a multitude of groups of different orientations with varying degrees of cooperation. The core of the Free Syrian Army (FSA) still seems committed to a secular model of . society. It cooperates with groups of Islamist orientation, but rarely with jihadist factions. This notwithstanding, in the course of the escalating con?ict, in particular in the wake of Russia's military Intervention in support of the Syrian regime, the armed opposition in general has increasingly referred to Sunni concepts related to jihad and, In light of the support by Iran and Shi?i militias, adopt-ed anti-Shi?l rhetoric. In late July, Jabhat al-Nusra changed its name to Jabhat Fath aI-Sham ("Levant conquest front?), declaring that It was an organisation without ties to any external organisation. This disassociation from al-Ciaeda was likely done to eschew being labelled as a proscribed terrorist organisation. In addition, the move was designed to facilitate the group?s cooperation and integration withln the Syrian armed opposition. In ?a speech in late August 2016, the nominal head of al?Qaeda, Ayman ai~Zawahiri, promoted the idea of creating a uni?ed council in Syria that would decide disputes among ?mujahidin?. A model for such a council was Jaysh al-Fath (?conquest army?), a coalition of ?ghting groups including the former Jabhat al-Nusra, which took control of Idllb In northern Syria in 2015. In 2016jihadist Ideologues and Jabhat Fath aI-Sham promoted, with some success, the creation oflaysh al- Fath in Aleppo, which acted alongside an FSA alliance in the opposition- controlled sections of the city during the siege by regime forces. In mid? December, however, regime troops and militias took control of the last sections of the city that had remained under opposition control. The defeat led to new efforts to unite the Syrian armed opposition. The main point of contention was whether a merged opposition force should include Jabhat Fath aI~Sham25. 'Turkey faced a number of arge?scale terrorist attacks in 2016, several of them attributed to jihadist groups, thereby continuing a series of attacks that started in mid-2015. On 12 January, a suicide attacker detonated an IED in the central historic district of Istanbul, killing 13 tourists, 12 of'them German citizens. Turkish government sources attributed the attack to IS. In March, another suicide attack using an IED in a central shopping street in Istanbul killed four, including three Israeli citizens. In June, three suicide attackers killed 45 people at Istanbul airport. Another attack targeted a wedding in Gaziantep on 20 August, killing at least 50, including many children. The attack was attributed to IS. On 31 December, an attack targeted a in Istanbul, killing 39. The attack was claimed by IS. The perpetrator, reportedly an ethnic with links to IS, was arrested. Following Turkey?s military intervention In Syria in August, IS propaganda increasingly singled out Turkeyas a major enemy of Islam' and an allyof the West. IS Insisted that dominant Muslim currents in Turkey deviated from true Islam and, consequently, have become legitimate attack targets. 7'6 In January 2017 this dynamic led to the merger of- several ?ghting factions, Including Jabhat Fath al- Sham, Into Hay?at Tahrir aI~Sham (?Levant liberation committee?). (a ??2ng ?it? git?? $293,662 arf?ga -53 {33 ag??aa eggs-2v 0?19 9? ?groggy; a . e9. 6% $52,235??ng are, ma aa?go?a ?ag} we- ,6 63a: .563 as a :3 no ,?mfe '960.69311 .1 {we} a; 1 (a EU TERRORISM SITUATION AND TREND REPORT 2017 35 Whereas in 2016 IS propaganda activity in the Turkish language faced the same challenges as that in Arabic, several internet sites in Turkish, which acted as news portals, were openly supportive ofjihadist groups in Syria, including Jabhat Fath aI-Sham, and al- Qaeda in general.- On 19 December, the Russian ambassador to Turkey was murdered by a Turkish national in Ankara. Iabhat Fath al-Sham denied responsibility, saying that the murder was a "natural reaction? to Russia's interference in the Syrian war. Other attacks, including a 10 December attack using a car bomb in Istanbul killing 38 people and a November attack by car bomb in Adana killing two, were not claimed or attributed. In 2016, IS "Sinai province?, the IS af?liate In Egypt?s Sinai Peninsula, continued perpetrating terrorist attacks mainly targeting Egyptian security forces. In addition, IS tried to expand Its area of Operation beyond Sinai. For example, in January,_a series of small-scale attacks targeted . I, g, 9% a?ggaf?ea?iag @?egga?s ??g??aggegk/ ?35; a a . ?74 ?39. aa?gogfe?ge, ?99 a? as 33 {3969 as}. Q??aee?g are ?as $.53 Gar; . a, sea. a We go a $qu 'aaea giaggo? Egypt?s tourism industry. On 7 January a tourist bus was shot at in front of a hotel in Cairo without casualties. The following day, two men armed with knives attacked a tourist hotel in Hurghada, injuring three people. On 9 January, two policemen were killed in Giza. The attacks in Cairo and Giz were claimed by IS. A suicide attack on a Coptic cathedral in Cairo on 11 December was claimed by an Egypt?based af?liate of IS, however without explicit reference to its Sinai branch. The attack killed 25 people, mainly women and children. The cause of the crash of an Egyptian aeroplane travelling from Paris to Ej?g . to ?36355 ea??13 mat?? 53633:; {a {53 IE) ?5 Cairo with 66 people on board on 19 May remained unknown at the time of writing. In North Africa the continued Instability In Libya and the prospect of a large number of IS ?ghters of North African origin returning to their home countries remained a source of concern. The region witnessed the competition for dominance between aI-Qaeda-linked groups and IS. This was illustrated in a series of videos published simultaneously in January 2016 by ?provincial" media outlets, including IS Algeria province which emerged from a splinter group of al-Qaeda in the Islamic Maghreb In the videos IS tried to specifically attract people from North Africa, with several of the videos targeting al-Qaeda followers in the . region, calling on them to pledge allegiance to IS. In Libya, political instability and insecurity continued in 2016 despite the creation of a joint Presidency Council in the Libyan capital Tripoli in March 2016, which was tasked with forming a unity government comprising the two existing governments in Tripoli in Western Libya, and Tobruk and al-Bayda in eastern Libya. In addition, the forces of General Khalifa Haftar, who rejected the agreement, extended the territories under their control beyond Benghazi, seizing much ofthe oil-rich Gulf of SIrte In September. The competition for control over Libya?s natural resources is expected to continue tensions between the different competing factions. Meanwhile, In early December, forces 2? Europol. EU Terrorism Situation and Trend Report (TE-SAT) 2015, p. 32. loyal to the unity government took complete control of Sirte. 15 had seized the city in early 2015, at one point controlling some 300 km of the Mediterranean coastline. The campaign against IS started in May 2016, supported by US airstrikes starting in August. IS had already lost the eastern Libyan coastal town of Darna in 2015. It was able to maintain a presence in suburbs of Benghazi for much of 2016, before being defeated there by Haftar forces. The number of IS ?ghters in Libya reportedly Increased twofold from 2015 to 2016, reaching between 4000 and 6000 by April 2016. However, the forces were described as less successful in seizing territory and apparently . comprised very few local ?ghters. IS carried out several large?scale terrorist attacks in Libya In 2016. These included a lorry bomb attack on 7 January, which killed dozens at a?pollce training centre In Zliten. The attack was claimed by '18 Tripoli province. On 21 January IS attacked Ras Lanuf oil terminal, setting oil storage tanks ablaze. After the decline of Its af?liate Ansar al-Shari'a (?shari?a supporters?) in Libya, parts of which had joined IS, aI-Qaeda tried to maintain its influence in Libya. For example, in January 2016, aI-Qaeda In the Islamic Maghreb (AQIM) released a recording in which'it accused Italy of occupying the Libyan capitaITripoli (referring to an Italian general, who is the senior military advisor for UNSMIL in Libya). In an. audio statement released on 9 October, leader Abu Mus'ab Abdulwadud called upon Muslims in Libya to unite against secularforces. In particular, he exhorted all Muslims to oppose Khalifa Haftar?s aggression in Benghazi. The group denounced the alliance between local secular groups, including Haftar?s Libyan National Army, and international actors (Egypt and UAE). The Libyan crisiscontinued to affect neighbouring countries, in particular Tunisia. On 7 March, a massive attack on Tunisian police and military in Ben Guerdane on the Libyan border killed 45 people, including 28 attackers. IS was suspected to have carried out the attack. Tunisia fears that the return of thousands of foreign ?ghters from conflict areas, and extraditions from Europe, will have a destabilising effect on the country. JIHADIST TERRORISM 36 In late 2015 and 2015, AQIM carried out a series of attacks on hotels popular with Western citizens in Mali, Burkina Faso and Ivory Coast. AQIM claimed that the attacks targeted locations used for espionage and conspiracies against Muslims. This string of attacks from north to south in . West Africa likely aimed to increase the group?s relevance in the region In the face ofthe IS challenge. After an attack on a hotel in the Malian capital Bamako on 20 November 2015, which was claimed by ql-Murabitun in cooperation with a similar attack on a hotel took place in Ouagadougou, capital of. Burkina Faso, on 16 January 2016. The attack was claimed by AQIM in a 17 January statement. On Telegram, the attack had earlier been attribUted to ai-Murabitun, which had joined AOJM in December 2015. On 13 March 2016, another group of terrorists attacked a tourist resort near Abidjan, capital of Ivory Coast, killing 19. The attack was claimed by AQIM in a statement?issued the same day. AQIM increased its propaganda output targeting Sahel countries in 2016. It adopted propaganda styles developed by IS. For example, AQIM. issued videos showing the killing of alleged spies, accused of working for France, albeit without the same amount of graphic detail. its messages to local populations, however, differ notably from those of IS. Rather than threatening Muslims with accusations of unbelief If they fail to join the group, AQIM purported to defend the interests and lives of the MuSIim population, while punishing ."corrupt" governments for their collusion with foreign powers against Muslims. Western companies were labelled as legitimate targets for their alleged exploitation of the Muslim population and the pollution of Muslim land. For example, in March, AQIM claimed responsibility for a rocket attack on a gas plant in Algeriajointly run by BP and Statoil, saying it was part of its ?war on the interests of the Crusaders?. In a May statement, AQIM claimed an attack on the uranium mine 9?3 Europol, EU Terrorism Siruatfon and Trend Report (TE-SAT) 2016, pp. 32-33. in Arlit, Niger, operated by French company Areva. It then reaf?rmed its Intention to strike French targets. In Mali, AQIM continued to claim attacks on Malian, French and MINUSMA29 troops in 2016 and to incite people to ?ght or support the ?ght against the Malian government, alleging that the latter brought French troops to the country. In an 8 July audio message, the head of Sahara division called upon Muslims in Mali to ?ght against France. He referred to the powerful role France still played in Its former colonies. Several Western hostages were held by AQIM in Mall in 2016, including a Swedish and a South African citizen and a Swiss woman. Since late 2015, the enemies of the UN mission in Mali, Including AQIM and Ansar aI-Din ("supporters of the religion?, Ansar Dine), increased their cooperation, for example by exchanging expertise in IED production and modus operandi. In several attacks in 2016, UN troops and Mauritanian soldiers were killed. These included a Joint attack by AQIM, Ansar al?Din and another local group on 21 July on a military post in Nampala near the Mauritanian border, which killed at least 17 Mauritanian soldiers. The competition between AQIM and IS, which in 2015 led to a split within al- Murabituna", continued in 2016. In late, October, A?maq News publicised a repetition of the pledge of allegiance by al?Murabitun?s iS-leaning faction to the IS leadership. As mentioned - above, immediately after this, AOJM released a video showing a Romanian hostage supposedly held by the IS faction. Whereas the faction was not of?cially integrated into system of ?provinces?, several attacks in the Sahel region In the last quarter of 2016 were attributed to this IS branch. In Nigeria, jihadist militia Boko Haram, which had pledged allegiance to IS in March 2015, changing its name into ?West Africa province?, split in early August 2016 when aI?Naba? newsletter Introduced Boko Haram?s former spokesman as the new "governor" of 7'9 The United Nations Multidimensional Integrated Stabilization Mission In Mail. 5? Europoi, EU Terrorism Situation and Trend Report (TE-SAT) 2016, p. 32. 31 Europol,-EU Terrorism Situation and Trend Report (TE-SAT) 2015, p.33. PARRISH a; 5w 5 ?a fea??i?g?i? ?55 6? ,giegge??eag? e? a garja?gg?ies ?gamma TERRORISM SITUATION AND TREND REPORT 2017 I the ?province". The leader of Boko . Haram, Abubakar Shekau, rejected the appointment, insisting that he remained in charge. In late December, the Nigerian army claimed having defeated Boko Haram militarily. In a reply, Abubakar Shekau denied that the group had been driven from its stronghold in the Sambisa Forest in north-eastern Nigeria. Yemen?s civil war between the Houthi rebels and the internationally recognised government under Abd? Rabbu Mansour Hadi continued to undermine the security and political Infrastructure of the country, which has suffered a humanitarian catastrophe as a result. After capturing the Yemeni capital Sana?a in September 2014, the Houthi rebels ousted the government in February 2015. In response, Saudi Arabia and a coalition of Sunni Arab countries, backed by Western powers, launched a military intervention with the aim of reinstating the Hadi government. The conflict has a pronounced sectarian character: on the one'side the Houthis, who belong to the Zaydi branch ofShi?i Islam, are accused of receiving support from Iran; on the other the government is supported internally by Sunni Islamist militias and tribal forces and externally by the Saudi Arabia-led coalition. In this climate, al-Qaeda in the Arabian Peninsula (AQAP), based on its Sunni extremist ideology, has been able to forge alliances with Sunni tribes and militias, which have enabled it to multiply its ?ghters and resources. The group took control of territory along the southern coast of Hadramawt province in April 2015, including the provincial capital aI-Mukalla. In dealing with the local populations in territories under its control, it took lessons from an earlier attempt at governance in southern Yemen in 2011-12. It emphasised the provision of services, education and justice based on Islamic law to the population, while refraining from implementing severe punishments, except for alleged spies. Rather than exercising power directly, AQAP created a governing council . m, 37 comprising local dignitaries. Despite being driven from aI-Mukalla In May 2016, AQAP continued its activities In the region, often blending into the local population. Compared with AQAP, IS has a rather small following in Yemen. Being primarily present In urban areas, in particular Aden which was occupied by Houthi forces in 2015, it claimed a number of attacks on Houthi and Hadi government targets, including several suicide attacks by VBIEDs in Aden in May, June and December 2016. In Saudi Arabia, IS was accUSed of being behind a series of bomb attacks in early July. On 4 July a suicide attacker detonated his explosive belt near the US consulate in Jeddah, when approached by police. The affiliation of the individual remained unknown at the time of writing. Oh the same day, a similar attack took place near the Prophet?s Mosque in Medina, in which the attacker and four security staff were killed. A third bomb attack in the easternmajority Shi?i city of Katif killed only the attacker. Harakat almShabab aI-Mujahia'in (HSM, ?mujahid youth movement?) continued activities in Somalia and reaching out. to Kenya. Although it had previously lost control of urban centres, in 2016 it perpetrated at least seven large-scale terrorist attacks on restaurants, hotels and markets in Mogadishu, several of which combined the explosion of an IED with a subsequent ambush using ?rearms. Similar attacks were perpetrated in- other cities; On 14 January, HSM attacked AMISOM troops in southern Somalia, killing a large number of soldiers. A 27 July HSM suicide?attack on the AMISOM headquarters In Mogadishu killed at least seven people. In addition, perpetrated two attacks on residential compounds In Mandera, north-east Kenya on 6 and 15 October, killing 6 and 12 people respectively. In January HSM published a video showing the killing of a Ugandan soldier. A faction that split from HSM in Somalia in October 2015 and pledged PARRISH allegiante to IS32 continued its activities despite attempts by HSM to suppress it. The group, whose numbers prob-ably do not exceed 200, has not been of?cially recognised by IS. Nevertheless, in late October 2016 it succeeded in taking control of the coastal toWn of Qandala in Puntland, from which it was expelled in late December. Another split-off from HSM, using the name Jahba East Africa and reportedly consisting of former HSM members from Kenya, Tanzania and Uganda, pledged allegiance to IS in April 2016. The same month, the group attacked an AMISOM convoy in Somalia. An IED exploded in an aeroplane of a local airline during a ?ight from Mogadishu to Djibouti on 2 February. The detonation ripped a hole in the skin of the aircraft; the alleged perpetrator died when he was sucked out of the passenger compartment. The pilot managed to perform an emergency landing. Reportedly, the . individual was originally booked on a Turkish Airlines ?ight. The attack was not claimed by any group. In Afghanistan, since NATO forces withdrew from Afghanistan by the end of 2014, the Taleban have expanded the territory that they control. In 2016, their offensives were focused on the provinces of Baghlan in the north and Helmand and Uruzgan in the south. In March, the Taleban announced that they were prepa ring. to capture major cities in Afghanistan. In mid-April and again in October, they started offensives to retake Kunduz, which they had brie?y captured in late - September 2015. In late October, they blocked the connection between Kabul and the southern city of Kandahar. In addition, the Taleban claimed a signi?cant number of large-scale terrorist attacks, many of which targeted military and security forces. Several attacks combined the_use of VBIEDs with an ambush using firearms. By contrast, the Taleban denied responsibility for the explosion of an 37? Europol, EU Terrorism Situation and Trend Report (TE-SAT) 2016, p.33. TERRORISM 38 IED hidden in a on a market in Badakhshan province on 20 June. Several attacks on Western targets were claimed by the Taleban. On 20 June, a suicide attack by a PBIED targeted Nepalese security personnel working for the Canadian Embassy in Kabul. The attack, which killed 14 people, was claimed by the Taleban. On 1 August, the Taleban carried out a lorry bomb attack on a hotel in Kabul popular with Western citizens. One policeman and three attackers were killed. On 24 August, the American University of Afghanistan was attacked by several armed ?ghters, some reportedly wearing suicide vests. Hundreds of students and foreign teachers were taken hostage for 10 hours. Seven students, two'university security guards and three policemen were reportedly killed. The attack was attributed to the Taleban but not claimed by the group. On 10 November, the Taleban attacked the German consulate in Mazar? e-Sharif in northern Afghanistan with a VBIED and possibly ?rearms. The German consulate personnel remained unharmed, but six people were killed and many injured, most of them civilians present at the site. The Taleban claimed the attack, saying that it was revenge for a US attack on Kunduz. On 12 November, a PBIED suicide attack targeted a sports event inside the US military base on Bagram Air?eld near Kabul on 12 November. The attack killed a total of 5 US citizens. The attack was claimed by the Taleban. In 2016, the IS af?liate in Afghanistan (?Khorasan province") increased its attacks in particular in the east 'of the country. On 23 July, two simultaneous IED explosions killed around 100 people In Kabul, mainly of the Shi?i Hazara ethnic minority. The attack was claimed by IS through A?maq News. On 11 October, three armed individuals attacked a Shi?i shrine in Kabul during a religious ceremony, killing 14 people. The attack was attributed to IS. Responsibility for a suicide attack on 19-April, on the headquarters of the Afghan intelligence service in Kabul which killed at least 64 people, was disputed between the Taleban and IS. Three Australians and one US citizen were kidnap'pedin Afghanistan in 2016. In April, an Australian charity worker was abducted by unknown militants in Jalalabad and was released 4 months later. In August, the Taleban abducted a US and an - Australian citizen in Kabul. The two victims were academics working at the American University of Afghanistan. In November, another Australian, working at a non-governmental organisation, was kidnapped in Kabul. The three hostages remained in captivity at the time of writing. The Taleban leader was killed in Pakistan's Baluchistan province in May 2016. A successor was appointed by the Taieban?s Shura Council within days. Pakistan continued to suffer terrorist attacks in 2016, which targeted universities, security forces and religious minorities. These were carried out-by local jihadist groups, Taleban offshoots or alleged IS af?liates. In Bangladesh, 20 people, including 18 foreigners, Were killed In an attack on a bakery located near diplomatic representations in Dhaka on 1 July. A claim of responsibility by IS was dismissed by government sources, which attributed the attack to Jamaat?ul-Mujhaideen. Nevertheless, the attack was celebrated by iS in the October issue of Rumiyah. In Indonesia, IS claimed an attack on "a gathering of citizens of the Crusader coalition, which ?ghts the Islamic State" in Jakarta on 14 January. The attack, which was carried out using several simultaneously?detonated IEDs, and ?rearms, killed at least eight people. One Dutch UN employee was injured. ?l . PARRISH 99$ foiled, failed and completed attacks carried out labeled as ethno?nationalist and seperatist terrorism. EU TERRORISM SITUATION AND TREND REPORT 2017 39 In 2016 Dissident Republicans were involved in 76 failed, foiled and completed attacks, of which four were carried out using improvised explosive devices, including one in March In which a prison of?cer was killed. The police, prison of?cers and members of the armed forces in North Ireland remain the primary targets. There are three main violent Dissident Republican groups In Northern Ireland: the Continuity IRA (CIRA), the new IRA and Oglaigh na hEireann (ONH). All mentioned groups retain access to a range of ?rearms and explosive devices, including under? vehicle IEDs. A total of 123 people were arrested in 2016. for terrorism-related offences. In May 2016, the threat level In the UK for terrorlsm related to Northern Ireland was raised from 'moderate? to 'substantial', which means an attack Is a strong possibility. number of incidents targeting Turkish institutions, cultural premises and . properties occurred in several EU Member States. Five IED attacks against Turkish government buildings and cultural associations were reported by France. Belgium also reported incidents between Turkish and Kurdish groups involving the use of arson and explosives. Germany reported various incidents. A signi?cant number occurred in the context of demonstrations for or against the PKK. Turkish propertiesand institutions were damaged by incendiary devices. In one arson incident, the damage amounted to at least EUR 2 million. In August In Nuremberg, three participants were injured during a ?ght, in which at least one was stabbed. Belgium, France, Germany*, Italy, Romania and Switzerland reported that the PKK continuad its fundraislng, propaganda and recruitment activities. In France it operated a legal front, which Includes the Conseil Kurde de France (CDK-F) and the Centre d?informah?on du Kurdistan and a clandestine branch aimed at collecting funds, using violence in some cases. In France alone, the fundraising campaign is believed to have yielded EUR 5.3 million. Italy reported recruitment among Kurdish migrants to join Kurdish militia in conflict zones or to become PKK-activists in Europe. In addition, Switzerland stated that the PKK were maybe running a number of ideological training camps for its youth In remote pre?Alpine areas during the second half of 2016. PARRISH ETH AND SEPARATISTTEH Numberof suspects arrested foretno nationalist- .. and separatist terrorIsm 2012to 2016 I 167 7. ATTACKS {Number of suspects arrestedfor etno an1! separatlst terrorism in EU PARRISH PRA 00005513115" Tiff EU TERRORISM SITUATION AND TREND REPORT 2017 41 Since ETA announced its cease?re in October 2011, it released a series of communiqu?s to-con?rm i'ts separatist objectives, aligned with the strategy of the Basque separatist left-wing lzquierda Abertzale movement,- its activities were focused on propaganda and controlling the sealing of its arsenals. Five separatist terrorist actions of sabotage werereported in 2015 by Spain, compared to 18 in 2015; these actions are attributed not only to Izquierda Abertzale, namely the youth group Erna], but also to dissident groups within this movement. In 2016, a senior ETA leader was arrested and a signi?cant amount of weapons and explosives were seized in Spain. France and neighbouring countries continue to be used by ETA for hiding operatives and weaponry. Switzerland reported that, in July 2016, 13 defendants associated with the Liberation Tigers of Tamil Eelam (LTTE) were indicted on charges of supporting and/or being members of a criminal organisation, fraud, false certi?cation and money laundering. The suspects are accused of having provided ?nancial support to the LTTE through a sophisticated credit system. Members of the community were persuaded to enter into credit contracts and pass on the funds to the Swiss branch and front organisations. This systematic and rapid scheme allowed them to obtain money from the Tamil diaspora in Switzerland. Investigations showed that substantial sums (around CHF 15 million) were obtained using this system as well as through donations and extortion. These funds, together with money collected abroad through similar schemes and transported to Switzerland by couriers, were to be later funnelled abroad to fund the purchase of weapons in Sri Lanka. PARRISH Err-Wine TERRORISM Numbers of attacks of left-wing and anarchist terrorists increased in 2016 compare-d to 20i5 Ia. Left?wing and anarchist activities included riots, In 2016, left-wing and anarchist terrorist groups or indi: viduals in the EU carried out 27 attacks. This was a sharp increase, compared to the number of attacks that occurred In 2015. EU Member State authorities arrested 31 people related to left-wing and anarchist terrorism in 2016, most of them in Spain. Italy, Greece and Spain were again the only EU Member States to experience left-wing and anarchist terrorist attacks. Over the past two decades, anarchist terrorist groups in these three countries have developed similar characteristics, used the same mod! operandi and endorsed similar agen- das. In 2016, there were no coordinated terrorist campaigns across the three countries. However,'it is assessed that some attacks in Italy were carried out in response to a call for action by imprisoned anarchist terrorists in Greece. In Italy in 2016, a total of 16 attacks were carried out by left wing and anarchist terrorist groups. Although the incidents increased in number compared to 2015, it appeared that arson attacks and attacks with explosives, criminal damage and spreading propaganda the operational capabilities of the groups remained low. The majority of the attacks in 2016 were carried out using unsophisticated improvised incendiary/explosive devices Containing ?ammable liquids or gunpowder and crude ignition mechanisms, some of which failed to operate. Eight people were arrested on charges related to left-wing and anarchist terrorism. Italian anarchist terrorist groups targeted facilities related to the management of migration-related issues in general; and to the function of the Identi?cation and Deportation Centres . (CIE) in particular. Five victim-operated Improvised explosive devices (VOIEDs, parcel bombs) were sent between Febru- ary and September to travel agencies and companies related to the CIEs, without causing injuries or damage. Italy also experienced the re~emergence of Federazr'one An- archica InformaIe/Fronte Rfvoluzionario Internazionale FRI, Informal Anarchist Federation/International Revolution- ary'Front). In January for example, its Pyrotechnical Com- mittee for an Extraordinary Year celi placed an IID outside the Courthouse of Civitavecchia in Rome, causing damage. In June, two VOIEDs were sent by the Danaus Plexippus FRI celI: one was addressed to the European Food Safety Authority In Parma and was detected by security personnel; PARRISH EU TERRORISM SITUATION AND TREND REPORT 2017 43 the other was sent to a private biotechnology company and caused minor injuries?to the ?rm?s owner. A cell is also believed to have placed an IED outside a Carabinieri Station in Bologna that caused damage to the building. In Greece, it appears that left-wing and anarchist terrorist groups have retained their operational capabilities as well as their access to weapons. In 2016 they carried out six attacks involving the use of IEDs, ?rearms and grenades. In October, Synomosia Pyirnon 11's Foh'as (Conspiracy Cells of Fire) placed an outside the residence of a prosecutor In Athens. The . powerful explosion caused signi?cant damage. The Organosi Epanastatikis Aftoamynas (Revolutionary Self~Defence Or- ganisation) adopted a more International scope in its attacks. It targeted two foreign embassies In Athens: in July, its mem- bers carried out a drive?by shooting against the Embassy of Mexico and caused minor damage to the building; in Novem- ber, they threw a hand grenade at the Embassy of France, injuring the police of?cer guarding the premises. In spain, left-wing and anarchist terrorist activities remained at low levels. Five attacks occurred?in 2016 but did not Involve extensive operational planning or the use of sophisti- cated iEDs or ?rearms. Notwithstanding this, 19 people were arrested in relation to left-wing and anarchist terrorism. The number of arrests in the country has remained consistently high, with a total of 100 people arrested since 2013. This has apparently had an impact on operational capabilities, mainly of the anarchist terrorist groups, causing a decrease in the number of attacks over the same period oftime. Of interest is that members of Spanish extremist groups adhering to communist ideologies joined Kurdish militias in Syria and Iraq, and were aetively involved in combat activi- ties against the so-called Islamic State (IS). It remains to be seen how their participation in the con?ict will affect their activities on Spanish soil. Marxist-Leninist terrorist groups in the EU have ceased to be operational and limit their activities to propaganda. Howev- er, the Turkish Devrimci Haik Kutruius Partisi/Cephesi (DHK- Revolutionary People's Liberation Party/Front) remained active in Turkey and carried out ?ve attacks, targeting police, judicial and government employees. The has never conducted attacks in the EU but retains a network in several EU Member Statesthat provides ?nancial and logistical sup?, port to Operatives in Turkey Its structures in the EU operate partially under the cover of legally established associations. In 2016, one Dutch citizen was arrested In Germany on charges of terrorism ?nancing connected to the In 2016, left-wing and anarchist extremist groups and indi? viduals remained a public order threat in a number of EU Member States. Their activities included riots, arson attacks, criminal damage?and spreading propaganda. Left?wing and anarchist extremists continued to take advantage of lawful demonstrations to launch violent attacks against govern- mental property and law enforcement; Anarchist groups and individuals tended to be more violent than those belonging to left-wing extremist moVements. Anarchist and left-wing extremist activities largely take place in urban milieu. In several cities in the EU, anarchists and left-wing extremists prefer to reside in speci?c areas. In these zones, they have established squats and "community centres", where they plan and organise actions. Extremists are also very active in and around universities, where they can ?nd opportunities for recruitment. Arson campaigns continued to occur in EU Member States with active anarchist communities. Groups and individuals employed unsophisticated lle or ?ammable liquids to torch their targets. In Germany, for example, anarchist extremists carried out numerous arson attacks in 2016, mainly targeting police and private vehicles onthe streets. Belgium experiw enced similar problems with arsons of cars and cell-phone masts. In Greece and Italy, anarchists are believed to be behind a number of incendiary attacks on vehicles and prop- erty as well as on banks. Apart from traditional means of propaganda, such as graf?ti and lea?ets, anarchist and left-wing extremists have exten- sively made use of the internet. Numerous websites, blogs and social media accounts provided ?alternative news", translated communiqu?s, conveyed messages of imprisoned extremists and disseminated propaganda material. There were no changes in the themes of anarchist and left?wing extremist propaganda in 2016. The main subjects remained the criminal Justice system, politicians and political parties, the refugee crisis, socIo-economic issues and the activities of right?wing extremists. In 2016, left-wing and anarchist extremists continued to travel around Europe to participate in violent and non-vio~ lent acts. For example, the ?No Border Camp? which took place in Thessaloniki (Greece) in July, attracted ieft-wlng and anarchist extremists from all over the continent. Their ac- tions included violent riots and clashes with police forces in the city of Thessaloniki, as well as in rural areas In northern Greece. In addition, anarchists from Belgium were arrested in Germany, France, Finland and Switzerland for participating in riots and arson attacks. A French extremist was arrested in Germany, In execution of an international arrest warrant on charges related to participation in violent riots. PARRISH . AND TERRORISMNumber ofsuspects arrested for left and 7 7 4' 57 2012t0 2016 - '7 '7 I '7 . 7 -754755_: 0f suspecs arres ed for,,left-wrng and anarchist tenorls; EU Member States PARRISH PRA 000059 "Mothers?t; 45 Right?wing extremist activities primarily carried out by individuals, or loosely coOrdinated networks or groups . fess?i Li-' For 2016 the Netherlands reported an incident which was classed as an act of right?wing terrorism. This marks a signi?cant decrease compared to 2015, when a total of nine right-wing terrorist attacks were reported by. France and Greece. Poland, Germany and the Netherlands reported a total of 12 arrests related to right-wing terrorism. in February 2016 six individuals were arrested in connection to an arson attack on a mosque in the Dutch city of Enschede. At the time of the attack several people were inside the mosque. They detected the ?re which was extinguished quickly and nobody was injured. The group was charged with attempted arson with terrorist intent. The court later decided this was a terrorist attack. Four attackers were sentenced to prison terms of several years. This decision marked the ?rst (failed) right-wing terrorist attack in the Netherlands and the ?rst terrorist attack in 12 years. German-y stated that after the investigation into the Na?onal-Sozlalis?scher Untergrund (NSU, National Socialist Underground) in 2011, additional investigations into gration and the perceived threat from lslamisation are key topics on the agenda of right?wing extremists groups such as the Old School Society in 2015 and Gruppe Freital (Fre?itai Group) in April 2016 demonstrated that the formation of right-wing terrorist structures cannot be excluded. With regard to Gruppe Freital, police searched 20 houses in the federal states of Saxony and Mecklenburg? West Pomerania in April. Five suspects were arrested and charged with membership of a terrorist organisation, attempted murder and the detonation of two explosive devices at two asylum seeker homes in Freital, as well as another one at an ?alternative living project? (commune) in Dresden. Similar to previous years a majority of EU Member States have no indication that terrorist methodologies or tactics have been adopted by their right-wing scenes and . considered the threat from (violent) right-Wing extremism (RWE) to be low. The scene is described by most Member States as fragmented, lacking consistent leadership and organisation, and suffering from internal conflict. However, in some EU, Member States the'right-wing extremist scene increased its activities to a level causing concern to authorities. Confrontations with political opponents PARRISH continued and xenophobic offences became more violent. Numerous RWE?motivated attacks have been committed by loosely coordinated networks/groups or individuals not necessarily linked to a known RWE group or party. This underlines the threat from [one actors and small groups In or outside the scene. According to national statistics for 2016, almost 50% of all known RWE individuals in Germany are prone to violence. This is mirrored in the increased numbers of attempted murder offencesf'3 as well as the use of incendiary and explosive devices34 against migrants and migrant shelters throughout the reporting periodas?ln addition, it was stated that Germany faces an increasing amount of?rst-time offenders who were previously unknown to authorities as extremists?. The crimes against asylum accommodation have 'at times shown the modus operandl of a well-organised group, however they have predominantly been committed by' individuals and small groups. A high number of perpetrators of these attacks remain unknown. The migration phenomenon affecting the European continent and the perceived threat from Islamisation remain key topics on the RWE agenda and have been used by the right-wing scene to induce public opinion to adopt its xenophobic and Islamophobic position. These topics are exploited to spread fear and concern. Events'such as the . Paris attacks in 2015, Brussels and Berlin in 2016, as well as the sexual assaults during New Year?s Eve 2015/2016 In Cologne, serve as justification for xenophobic offences. In addition, the Netherlands and Germany reported cases of vigilantes (showing affinity with the right-wing scene) who claimed that the authorities were unable to protect society from these threats. These vigilantes appear at times In 'civil patrols? in their local districts. This phenomenon was' previously observed in Finland in 2015. Germany, among other EU Member States, hasreportedly - experienced high'numbers of attacks on refugee shelters - since the start of the migration crisis in 2015. Resumption of border controls and improved checks led to decreasing numbers of newly arriving migrants in 2016. Nonetheless, xenophobic and racist criminal acts increased both in number and ieve?l ofviolence. In June 2016, the UK voted to leave the EU and as a result, a signi?cant number of Brexit?lnspired events were held across the country in- the run up to the voting date of 23 June. There was a sharp increase in the number of racially 33. 2015 11; 2015 a 2014 1. 3?1 61 incendiary devices; 10 violations against the explosives law; 4 cases in which an detonated In or at an asylum sheiter. 35 ngriffe-BOO- 35 RIGHT-WING TERRORISM 45 or religiously aggravated offences recorded by the police following the EU Referendum. The number of racially or religiously aggravated offences recorded by the police in July 2016 was 41% higher than in July 2015?. Negative online commentary towards migrants, refugees and foreign workers has increased and continues at a higher level than previously seen. The threat from extremists in the UK was realised on 16 June, when a British Labour Party Member of Parliament was murdered by a lone actor, shortly before she was due to hold a constituency surgery for the UK to remain a member ofthe EU. In Germany politicians continue to be the target of an increasing amount of harassment and threats?. According to ?gures collated by the German government in regard to current members in the German national parliament (Bundestag), incidents against politicians reached an all-time high In 2016. These included physical attacks, but also non-violent incidents such as damaged offices, spray-painting of unconstitutional signs on politicians' houses/of?ces, or harassment via the internet. Politicians advocating pro-refugee policies and active against right- wing extremism were more likely to fall victim to such attacks. In 2016, in addition to existing far-right or extremist groups, a number of new ones were founded and several others banned, In Germany In October 2016, one police officer was shot and kilied and three others injured by a member of the movement? in the federal state of Bavaria when they attended his premises to confiscate his weapons. Already in August, a member of the same movement shot and injured a police officer during a house eviction. The German anti-Islam movement Patrio?sche Europc'ier gegen die Islamisierung des Abendlandes (PEGIDA, Patriotic Europeans against the Islamisation of the West) appears to have lost momentum, having previously attracted thousands of people to its demonstrations. In 2016 EU MS I noticed a decrease In people identifying themselves with PEGIDA. In December the UK proscribed the group National Action 37 ment__ 3? There was a near~fatal knife attack on a mayoral candidate In Cologne in 2015. 39 The (Empire?s citizens) movement comprises an estimated 4500 supporters. It consists of either small groups or single individuals, who deny the legitimacy of the Federal Republic of Germany and assert that the German Reich continues to exist in Its 1937 pre?WW I borders. PARRISH EU TERRORISM SITUATION AND TREND REPORT 2017 47 (NA), the most active and well organised RWE group in the country. This is the first time a RWE group has been proscribed in the UK. in 2016 the group increased its recruitment campaigns and attendance at other RWE groups? events, compared to previous year. MS investigations throughout the last few years have consistently cOnfirmed that the?RWE scene has access to weapons. Although the majority ofthese weapons appear to be knives and other cut-and-thrust bladed weapons,'at times firearms were also seized. A few EU MS mentioned the use of improvised incendiary devices (lle) and improvised explosive devices (lEDs) to commit an attack. In Germany the signi?cant increase of such attacks, as well as of seized precursors for these devices, came in conjunction with a continued escalation in violence connected to the migration phenomenon. The use of the internet has maintained its importance to the right-wing scene with regards to radicalisation, recruitment, mobilisation and networking. The migration phenomenon and the jihadist terrorist threat have dominated social media and forum conversations within the right-wing scene. Most hate postings are on the edge of lawful expression of opinion and criminal incitement. Language is becoming more aggressive and hate crimes such as sedition, encouragement of crimes on minorities and migrants as well as disparagement up to threats towards representatives of the state, have signi?cantly increased. These xenophobic and racist comments have even caused the closure of comment sections attached to articles of news and TV outlets. RWEs urge their peers to protect themselves or their organisation online so as not to jeopardise their activities. Several RWE websites have published guidelines giving advice on how to protect personal data and directions on how to communicate on the internet.?0 On social media, RWEs have increasingly made use of closed or hidden groups. ?10?Leltf?iden zur Dokumenta?on bel Spitzelei und Guidelines for documentation in case of spying efforts and approaches" Right? extremists and their internet Presence issued by the German Federal Of?ce for the Protection of the Constitu?on/Bundesa mt fiir PARRISH Single?issue movements remain currently largely peaceful and within the boundariesof'law Environmental issues and animal rights remain the main themes of single?issue activism In 2016, no attack related to single?issue terrorism occurred in EU Member States. Singie-issue movements in the EU remained largely peaceful and within the boundaries of law, pursuing their goals via demonstrations and online activities. Nevertheless, a number of violent incidents linked to single-issue activism took place in several EU Member States. This is due to anarchist and left-wing extremist groups and individuals consistently attempting to impose their ideology and modus operandi in the single-issue arena. The role of extremists in single-issue movements varied: on some occasions, extremist groups constituted the actual movement;.on others, single-issue movements marginalised radical elements. In 2016, there were no thematic changes in the single-issue agenda, with environmental and animal rights subjects remaining the main themes. Activists opposed, among others, the construction of large infrastructure projects, animal testing, animal exploitation,lnuc ear energy and oil drilling. Mod! operandi also remained unchanged: demonstrations were the predominant mode of action. In Belgium, for example, animal rights activists organised numerous protests against animal testing and slaughtering of animals without anaesthesia. Their acts were lawful with the exception of a few cases of trespassing in fur farms that aimed to record the conditions of the animals and den-ounce their abuse. in Germany, extremists sabotaged railways and?cable connections related to the railway system. They also targeted a vehicle belonging to an electric power company related to open-cast mining. In italy, the movement opposing the construction and function of the Treno ad Alta Velocitr?J (TAV) largely marginalised its anarchist elements and was comprised of left-wing groups operating under the umbrella of the Bussoleno Comitoto di Lotto Popoiare (People?s Struggle Committee) that promoted a less violent strategy. This led to a decrease in the number of unlawful actions against TAV-related infrastructure. However, anarchist extremists appeared to be willing to continUe their violent activities without the support of the wider movement, embedding their opposition to the construction of the TAV in a broader anarchist agenda. An arson attack on a TAV building site in Bologna in January and another one on the railway traf?c control system in Rome in May are assessed to be part of this campaign. The 'No Tav? movement has inspired the creation of a number of similar -issue initiatives in Italy, such as the No Grand! Navi, against the arrival of large cruise ships in Venice; the No Ponte, against the construction of'a bridge over the Messina strait; and the No Ombrina, against the construction of offshore oil drilling platforms in the Adriatic Sea. I PARRISH . EU TERRORISM SITUATION AND TREND REPORT 2017 49 ANNEX 1 OVERVIEW OF THE FAILED, FOILED AND COMPLETED ATTACKS IN 2016 PER EU MEMBER STATE AND PER AFFILIATION Belgium Germany Italy Spain In 2016, 142 terrorist attacks occurred in eight Member States. The United Kingdom reported more than half of the total number of attacks (76). The total number of terrorist For the majority of the attacks the affiliation was separatism (99). Italy, Greece and Spain together reported 27 terrorist attacks by left-wing and anarchist groups. Despite the continued decrease of the total number of attacks, the number of attacks by anarchist and left?wing groups increased by more than 100% (from 13 in 2015 to 27 attacks in 2016). 3? The countries reporting terrorist attacks linked to separatist terrorism are the UK (76), France (18) and Spain (5). - attacks dropped by 33% in 2016 (142) compared to 2015 casualties and 142 fatalities were reported as a result of terrorist attacks. The 13 attacks classified as religiously-inspired terrorism were reported by France (5), Belgium (4 and Germany (4). This category is the one causing the most casualties (374 out of 379) and 135 out of 142 fatalities). The Netherlands reported one right?wing terrorist attack. No attack related to single-issue terrorism was reported in 2016. Attacks In which firearms were used dropped from 57 in 2015 to 6 in 2016. PARRISH ANNEX 2 A EX 50 ARRESTS IN 2016 PER EU MEMBER STATE AND PER AFFILIATION Austria Denmark Germany 2,19). .- Ireland Netherlands Romania In 2016, 1002 individuals were arrested for terrorism?related offences in 17 EU Member States. This was a decrease of 7% compared to 2015, from 1077 to 1002. Most arrests were reported by France (456), United Kingdom (149) and Spain (120). There is a decrease of 50% in the number of individuals arrested for separatist terrorism, and a continued increase for the third consecutive year of those arrested for religiously-inspired terrorism, from 395 in 2014, to 687 in 2015 and to 718 in 2016. Most of the countries registered a decrease or a similar number of arrests in 2016, apart from France where the arrests number continued to increase from 238 in 2014, to 424 in 2015, and to 456 in 2016, and Belgium from 61 to 65, but still under the level of 2014 (72). The number of EU citizens amongst the arrestees decreased by 25% In 2016 compared to 2015, from 592 in 2015 to 437 in 2016. Arrests for religiously-inspired terrorism continue to represent the largest proportion of the total arrests in the The arrests for ethno-nationalist and separatist terrorism dropped from 168 in 2015 to 84in 2016. The number of individuals arrested for anarchist and left- wing terrorism offences dropped from 67 in 2015 to 31 in 2016. The number of arrests for terrorism in 2016 (12) is quite stable compared with 2015 (11). No arrests were reported in relation to single-issue terrorism. PARRISH EU TERRORISM SITUATION AND TREND REPORT 2017 51 ANNEX 3 CONVICTIONS AND PENALTIES This annex contains statistical information on the concluded court proceedings for terrorist offences in 2016, as reported to Eurojust. It highlights some key ?gures and, where relevant, compares those with the ?gures for previous years. The key ?gures are supplemented by further details and clari?cations, as needed. TABLE Number of individuals in concluded court proceedings for terrorist offences per EU Member State in 2014, 2015?? and 2016?, as reported to Eurojust. The data for the previous years corresponds to the data reported In the respective reports. "2 Eurojust received contributions containing information on terrorism?related court decisions in 2016 from the following Member States: Austria, Belgium, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Lithuania, the Netherlands, Portugal, Slovenia, Spain, Sweden- and the United Kingdom. As ln2014 and 2015, the UK contribution for 2016 covers England, Scotland, Wales and Northern ireland. The UK contribution includes proceedings on offences under anti? terrorism ieglslation, as well as other offences assessed to be terrorism related. Similar to 2014 and 2015, the UK data for 2016 refers only to convictions, In case a verdict pronounced in 2016 was appealed and the appeal was concluded before the and of the year, Eurojust counted the proceeding as one and reported only on the latest/?nal verdict. The ?gures Included in the UK submissionvto the TEDSAT differ from those reported by Eurojust. The UK i submission included a ?gure of 68, consisting of 56 convictions and 12 acquittals. The TEOSAT is using the Eurojust figures for consistency. in 2016, 17 EU Member States reported to have concluded In 2016 there were 53 female defendants in the conc-iuded a total of 275 court proceedings in relation to terrorism. 'court proceedings for terrorist offences. The concluded court proceedings concerned 580 In .2016, Spain reported the highest number of concluded individuals. Seven of those individuals appeared before court proceedings and the highest number of individuals the court more than once in 2016 in the framework of convicted or acquitted of terrorist offences. different criminal proceedings?. Asa result, the tOtal number of verdicts pronounced for terrorism?related offences in 2016 was 587. ?3 In'Spain, three'individuafs appeared before the court twice in 2016 in the framework of different criminal proceedings. In Belgium, the cases against two individuals were annulled on the basis of the me his in idem principle, as the court ruled the two had been convicted of the same facts earlier in 2015 and 2016. In France, two individuals appeared before theJUVenile court and the criminal court. PARRISH ANNEXES 52 3? The vast majority of verdicts in the Member States in while courts in Hungary, the Netherlands and Spain also 2016 were pronounced in relation to jihadist terrorism. tried right?wing terrorism cases. Sl'milarto 2015, courts in Belgium rendered the highest . number of verdicts concerningjihadist terrorism in 2016 The highest number Of female defendants the (138) concluded proceedings in 2016 were tried for separatist terrorist offences (22) and forjihadist terrorist offences 1? All verdicts pronounced in Austria, Belgium, Estonia, (also 22). Finland, France, Italy, Portugal and Sweden in 2016 related to jihadist terrorism.?A large number of such verdicts were also rendered in Germany and the Netherlands. The Spanish courts dealt with the highest number of separatist terrorism cases in the EU in 2016. Individuals charged with offences related to separatist terrorist groups were also tried in Denmark, Germany and the Netherlands. Greece was the only Member State that reported verdicts for left?wing terrorist offences, The average prison sentence for left?wing terrorist offences was the highest, increasingfrom 12 years in 2015 to 28 years in 2016. Jihadist and separatist terrorist offences were punished with an average prison sentence of 5 years, and terrorist offences with 4 years. Number of verdicts in 2016 per EU Member State and per typeof terrorism, as reported toEurojust. Germany . The data provided by the United Kingdom was not broken down by type of terrorism and is therefore included under the category ?Not speci?ed?. The ?gures included in the UK submission to the TE-SAT differfrom those reported by?EuroJust. The UK submission included a ?gure of 68, consisting of 56 convictions and 12 acquittals. The TE-SAT is using the Eurolust ?gures for consistency. EU TERRORISM SITUATION AND 2017 53 Austria 26 Number of verdicts, convictions and acquittals per EU Member State in 2016. as reported to Eurojust. Germany Spain 134 23 1 100% 15% United Kingdom? ?89 - I The number of acquittels in 2016 Includes the annulled cases against two individuals in Belgium, in which the court referred to the ne bis in idem principle. The UK data for 2016 refers only to convictions and is not included in the calculations of percentages. The ?gures included In the UK submission to the TE-SAT differ from those reported by EuroJust. The UK submission included a ?gure of 68, consisting of 56 convictions and 12 acquittals. The TE-SAT Is using the Eurojust ?gures for consistency. ?In 2016, Austria, Estonia, France, Germany, Greece and Hungary reported successful prosecutions resulting In no acquittals for terrorist offences. Germany remains the only Member State where - prosecutions for terrorist offences ied to guilty verdicts and no acquittals In the period 2010?2016?. The year 2016 registered a record high conviction rate In conciuded court proceedings The acquittal rate of 11% is significantly lower than those In 2015 and in 2014 and continues the downward trend compared to the years before. Eurojust considers it one-verdict If an individual Is convicted of more than one terrorist offence within the same proceeding, or convicted of a terrorist offence and acquitted ofanother offence. Ifan individual is acquitted ofa terrorist offence and convicted of another offence. the verdict Is inciuded in the overview as acquittal of terrorism. All prosecutions for left-wing and right-wing terrorist offences resulted In convictions in 2016. Also the concluded jihadistterrorism cases had a very high conviction rate similar to that in 2015 The acquittal rate among the verdicts related to separatist terrorism decreased signi?cantly in 2016 compared to 2015 WW ?15 The data provided by the United Kingdom was not broken down by type of terrorism and Is therefore not Included In the numbers. PARRISH ANNEX 4 METHODOLOGY The EU Terrorism Situation and Trend Report (TE-SAT) was established in the aftermath of the 11 September 2001 attaCks in the United States of America (USA), as a reporting mechanism from the Terrorism Working Party (TWP) of the Council of the EU to the European Parliament. in 2006 Europol replaced the TWP. The methodology for producing this annual report was developed by Europol and endorsed by the Justice and Home Affairs (JHA) Council on 1 and 2 June 2006. The content of the TE-SAT is based on information supplied by EU Member States, some third states and partner organisation Eurojust, as well as information gained from open sources. In accordance with ENFOPOL 65 (8196/2/06), the TE- SAT is produced annually to provide an overview of the terrorism phenomenon in the EU, from a law enforcement perspective. It seeks to record basic facts and assemble ?gures regarding terrorist attacks and arrests in' the EU. The report also aims to present trends and new developments identi?ed from the information available to Europol. The TE-SAT is a situation report which describes and analyses the outward manifestations of terrorism, i.e. terrorist attacks and activities. It does not Seek to analyse the root causesof terrorism, neither does it attempt to assess the impact or effectiveness, of counter-terrorism policies and law enforcement measures taken, although it can serve to illustrate some of these. This edition of the has? been produced by EurOpoi in consultation with the 2017 Advisory Board, composed of representatives of the past, present, and future Presidencies of the Council ofthe EU, Le. Slovakia, Malta and Estonia (the 'Troika'), along with permanent members, representatiVes from France and Spain, the EU Intelligence Analysis Centre (INTCEN), Eurojust, the of?ce of the EU Counter Terrorism Coordinator, and Europol staff. For the preparation of this report, Europol collected qualitative and quantitative data on terrorist offences in the EU, and data on arrests of people suspected of involvement in those offences, provided or con?rmed by Member States. As in previous years, Eurojust collected data on the number of court proceedings in each Member State, the number of individuals in concluded court proceedings, the number of convictions and acquittals, the type of terrorism, the gender of defendants, the penalties imposed, as well as the type of verdicts ?nal or pending judicial remedy. Similar data were collected, when available, of offences In which EU interests were affected outside ofthe EU. Eurojust contributed data on convictions and penalties for terrorist offences in EU Member States and relevant A 54 amendments in national legislation on terrorism. included as 'arrests? are those judicial arrests warranted by a prosecutor or investigating judge, whereby a person is detained for questioning on suspicion of committing a criminal offence for which detention is permitted by national law. The fact that the person may subsequently be provisionally released or placed under house arrest does not impact the calculation of the numberof arrests. The de?nition of the term ?terrorist offences? is indicated in Article 1. of the Council Framework Decision of 13 June 2002 on combating terrorism which all EU Member States have implemented in their national legislation. This FrameWork Decision specifies that terrorist offences are intentional acts which, given their nature or context, may seriously damage a country or an international organisation when committed with the aim of: seriously intimidating a population, or unduly compelling-a government or international organisation to perform or abstain from performing an act, or seriously destabilising or destroying the fundamental political, constitutional, economic or social structures of a country or an international organisation. - In cases in which the wording of Article 1 of the Framework Decision leaves room for interpretation, the TE-SAT 2017 respects Member States? de?nitions of terrorist offences on their territories. At times, it can be dif?cult to assess whether a criminal event should be regarded as an act of 'terrorism' or as an act of ?extremism?. Contrary to terrorism, not all forms of extremism sanction the use of violence.? Nevertheless, extremism as a phenomenon may be related to terrorism and exhibit similar behavioural patterns. Therefore, the TE-SAT 2017 mentions criminal acts with the potential to seriously destabilise or destroy the fundamental political, constitutional, economic or social structures of a country, when they were reported by the Member States as extremism, in an effort to provide a clearer picture of the phenomenon and its relation to terrorism. However, these cases were not considered in the statistical data of this report, which exclusively re?ect incidents reported as terrorism by EU Member States. The EU Council Decision of 20 September 2005 (2005/671/ JHA), on the exchange of information and cooperation concerning terrorist offences?, obliges Member States to collect all relevant information concerning and resulting from criminal investigations conducted by their law enforcement authorities with respect to terrorist offences, 4'3 Amended by the Council Framework Decision of 28 November 2003. PARRISH EU TERRORISM SITUATION AND TREND REPORT 2017 and sets out the conditions Under which this information should be sent to Europol. Europol processed the data and the results were cross-checked with the Member States. In cases of divergences or gaps, the results were corrected, complemented, and then validated by the Member States. Eurojust also collected data on prosecutions and convictions for terrorist offences on the basis of the aforementioned EU Council Decision. The data used in this report concerns relevant court decisions and legislation amendments in 2016. Due to the specifics of reporting, Member States submit information on both final and non? ?nal decisions. Therefore, reference is also made to those decisions pending judicial remedy. Verdicts from 2016 on which an appeal is pending are included in the reporting as pendingjudicial remedy. In cases where a verdict pronounced in 2016 was appealed, and the appeal was concluded before the end of the year, Eurojust counted the proceeding as one. Eurojust's contribution was veri?ed with the Member States that provided relevant data. The TE-SAT categorises terrorist organisations by their source of motivation. However, many groups have a mixture of motivating ideologies, although usually one ideology or motivation dominates. It is worth noting that a categorisation of individuals and terrorist groups based on the ideology or goals they espouse should not be confused with motivating factors and the paths to radicalisation. The underlying causes that lead people to radicalisation and terrorism must be sought in the surroundings (structural factors) and personal interpretations factors) of the individual. The choice of categories used in the SAT re?ects the current situation in the EU, as reported by Member States. The categories are not necessarily mutually exclusive. JIHADIST Jihadist terrorist acts are those that are committed out of a mindset that rejects democracy on religious grounds and uses the historical comparison with the Crusades of the Middle Ages to describe current situations, in which it is believed that Sunni Islam is facing a ?Crusader alliance? composed of Shi?is, Christians and Jews. RIGHT-WING Right-wing terrorist organisations seek to change the entire political, social and economic system on an extremist right-wing model. A core concept in right?wing extremism is supremacism, orthe idea that a certain group of people sharing a common element (nation, race, culture, etc.) is superior to all other people. Seeing themselves in a supreme position, the particular group considers it is their natural right to rule over the rest of the population. Racist behaviour, authoritarianism, xenophobia and hostility to immigration are commonly found attitudes In right- wing extremists. Right-wing terrorism refers to the use of terrorist violence by right-wing groups. Variants of right? wing extremist groups are the neo-Nazi, neo-fascist, and ultra-nationalist formations. LEFT-WING AND ANARCHIST TERRORISM Left-wing terrorist groups seek to replace the entire political, social and economic system of a state by introducing a communist or socialist structure and a classless society. Their ideology is often Marxist-Leninist. A sub-category of left-wing extremism is anarchist terrorism which promotes a revolutionary, anti-capitalist and anti- authoritarian agenda. Examples of left-wing terrorist groups 7 are the Italian Brigate Rosse (Red Brigades) and the Greek Revolutionary Organisation 17th of November. ETHNO-NATIONALISM AND SEPARATISM E?thnonnatlonalist and separatist terrorist groups are motivated by nationalism, ethnicity and/or religion. Separatist groups seek to carve out a state for themselves from a larger country, or annex a territory from one country to that of another. Left- or right-wing ideological elements are not uncommon In these types of groups. The Irish Republican Army (IRA), the Basque ETA, and the Kurdish PKK organisations fall into this category. SINGLE-ISSUE Single-issue extremist groups aim to change a specific policy or practice, as opposed to replacing the whole political, social,_and economic system in a society. The groups within this category are usually concerned with animal rights, environmental protection, anti-abortion campaigns, etc. Examples of groups in this category are the Earth Liberation Front (ELF), and the Animal Liberation Front (ALF). - PARRISH ANNEX 5. ACRONYMS AMISOM African Union Mission in Somalia AQAP al-Qaeda in the Arabian Peninsula Tanzim qa?idat alei'had jazirat al~?arab AQIM -al~Qaeda in the islamic Maghreb Tanzim al?qa?ida bi-bilad al~Maghrib al~lslami BNP . British National Party CBRN Chemical, Biological, Radiological, Nuclear Conseil Kurde de France CIK Centre d'information du Kurdistan CIRA Continuity lrish Republican Army Devrr'mci Ha'lk Kurtulus Partisi/Cephesi DHKPIC Revolutionary People's Liberation Party/ Front DR Dissident Republican EDL English Defence League ERW Explosive remnants of war ETA Ens/radii ta Askatasuna Basque Fatherland and Liberty EU European Union EU MS European Union Member States AI Federazione Anarchica Informal/e informal Anarchist Federation Federazione Anarchica Informale informal Anarchist Federation/international Revolutionary Front FSA Free Syrian Army FTF foreign terrorist ?ghter HME home-made explosive SM Harakat aI~Shabab al~Mujahidfn mujahid youth movement Irautzaleen Bilguneak Revolutionary Assemblies IED improvised explosive device IID improvised incendiary device INTCEN EU intelligence Analysis Centre IS Islamic State ISIL Islamic State in Iraq and the Levant ell-Iraq viral-Sham JHA Justice and Home Affairs KGK Kongra Gel LTTE Liberation Tigers of Tamil Eelam NA National Action NSU National-Suzialistischer Untergrund National Socialist Underground ONH Oglaigh ne?r h?Eireann Warriors of Ireland OPCW Organisation for the Prohibition of Chemical Weapons PBIED personwborne improvised explosive device Patriotische Europ?ier gegen die Islamisierung cles Abenlaades Patriotic Europeans against the lslamisation of the Occident PKK Partiya Karker?n Kurdistan Kurdistan Workers' Party RG Resist?ncfa Galega Galician Resistance TATP triacetone triperoxide TAV Treno ad Alta Velocita high speed train TE-SAT European Union Terrorism Situation and - Trend Report terrorist tactics, techniques and procedures TWP Terrorism Working Party UAV Unmanned aerial vehicle UK United Kingdom UN United Nations US United States (of America) UXO unexploded ordnance VBIED vehicle-borne improvised explosive device VOIED victim-operated improvised explosive device PARRISH EU TERRORISM SITUATION AND TREND REPORT 2017 57 ANNEX 6 AMENDMENTS INNATIONAL LEGISLATION 0N TERRORISMIN 2016 By virtue of the Law of 27 April 2016, the Belgian legislation was amended to allow house searches and arrests to take place between 9 pm. and 5 am. in case of a terrorist offence or a planned attack. Furthermore, the Law of 5 August 1992 On the Police Service was amended to'provide for the estab- lishment of common databases aimed at the prevention and suppression of terrorism or of extremism that can lead to terrorism, as well as for the possi- bility to share information from such databases with foreign law enforce- ment and intelligence services and international organisations for police and judicial cooperation. The existing provisions of the Belgian Criminal Code were extended by the Law of 3 August 2016 to include the incitement (Article 140bis) and the recruitment (Article 140ter) to travel to or from Belgium for terrorist purposes (Article 1405exies). Furthermore, the Law of 3 August 2016 extended the Belgian extraterritorial jurisdiction to allow the prosecution of those who commit terrorist offences, provided for in Book II, Title lter of the Criminal Code, against a Belgian national or a Belgian or European insti- tution abroad. The Law also speci?ed the powers of the Federal Prosecutor?s Office in relation to terrorist 'offenc- es. The Law of 14 December 2016 introduced further amendments to the Criminal Code, concerning: the participation in an activity of a terrorist group, making it sufficient to know or could have known that such participa? tion could contribute to the commis- sion of a crime by the terrorist group (Article 140, 1), (ii) the preparation of terrorist acts by the so called 'lone wolves (Article 140septies), and the provision or collection of direct or indirect material support, including ?nancial means, forthe commission of a terrorist offence (Article 141). 6 na 2016- 611 of 10 February7201. Amendments concerning Article 114] of the Danish Criminal Code came into force on 30 September 2016. They criminalise the travel to certain areas in Syria and lraq without a permit from the Danish authorities. The amend- ments envisage a penalty of up to six years of imprisonment for Danish nationals or persons with a permanent residence in Denmark, who travel into .or stay in the designated areas. I 1:1;ge? As of December 2016, new legislation entered into force in Finland. The new legislation criminalises travel to a State other than the State of residence or nationality of the traveller, if the purpose of-the travel is to commit, plan or prepare a terrorist act or to give or to receive terrorist training. The new legislation also criminalises funding of travel for the aforementioned purn poses. The new legislation is based" on United Nations Security COuncil Resolution 2178 (2014) of 14 Septem; -. ber2014. By Law n? 2016-731 of 3 June 2016,7the' 5 French Criminal Code was amended '7 and supplemented by criminalising the traf?cking of cultural goods coming from areas in which terrorist groups are operating and (ii) the regu as a consequenCe has been r?d by the new Law n? -2017'? 258 Of 28 :February 2017 Law n? 2016-731 of 3 June 2016 also extended the powers of magistrates and investigators, making it possible to conduct night-time house searches and use new Investigation techniques for data collection. Furthermore, the law reinforced arms and ammunition control, created provisions aimed at prOtecting witnesses, and strengthened the ef?ciency of administrative controls to avert terrorist acts and to allow for . the surveillance of those coming back to France after travelling abroad to partici- - pate in terrorist activities. In 2016, the Hungarian Parliament amended the regulation of acts of terrorism, provided for in Articles 314- 316 of the Criminal Code of Hungary. The amendment criminalises the travel through or from Hungary with the intention to join to a terrorist group, and envisages a penalty of-between 2 and 8 years? imprisonment. Furthermore, the ?organisation of a terrorist group? has also become punishable. The amend- ment entered into force on 17 July 2016. A new provision was added to the italian Criminal Code (Article 270quinquies), which criminalises any conduct consist- ing of gathering funds or goods with the objective of committing terrorist of- fences, even without a link to a criminal association or a conspiracy to commit terrorist offences. Therefore, any con- duct for the purpose of procuring means to finance terrorist activities is crimi? nalised as such. FurthermoreJuly 2016, italy rati?ed several conventions in the ?eld of coun? tar-terrorism, including the Council of Europe Convention on the Prevention of Terrorism, the International Convention for the Suppression of Acts of Nuclear Terrorism, the Protocol amending the European Convention-on the Suppres? sion of Terrorism, the Council of Europe Convention on Laundering, Search, Seizure and Con?scation of Proceeds from Crime and on the Financing of Terrorism, and the Additional Protocol to the Council of Europe Convention on the Prevention of Terrorism. in February 2016 the Latvian Saeima adopted amendments to the Law on the Prevention of Money Laundering and Terrorism Financing. The amendments concern, among others, the government regulations on the lists, compiled by certain countries or international organi- sations, of persons suspected of being involved in terrorist activities or of the manufacturing, keeping, transporting, using or distribution of weapons of mass destruction, as well as the sanctions lists compiled by the Latvian govern" ment with the aim of combating the involvement in terrorist activities or the manufacturing, keeping, transporting, using or distribution of weapons of mass destruction. The?Law on the Prevention of Money Laundering and Terrorism Financing was further amended in May 2016. The amendments envisage a number of. measures to be taken by legal persons to ensure compliance with the law. On 1 April 2016, the legal possibility to take away Dutch citizenship in case of dual citizenship and ?nal conviction for terrorist offences was extended to preparatory offences (including training for terrorism). Such a measure would require the decision of the Minister of Security and Justice. in March 2016, Article 57 (2) ofthe Law 135/2010 on the Code of Criminal Procedure was amended. The article concerns the criminal investigation acts carried out by special criminal investi- gation bodies. In conformity with the amendment, these bodies may, upon the prosecutor?s order, enforce technical surveillance warrants in case of terrorist offences and of offences against the national security, as provided for In Title of the Criminal Code. Also in March 2016, Articles 8 and 13 of the Law no. 14/1992 on the organisation and func- timing of the Romanian Intelligence Service were amended to designate the National Centre for Interception of Communications ?of the Romanian intel- ligence Service as a competent authority to obtain, process and store information on national security retrieved from providers of publicly available electronic communications. it was established that, for the purpose of enforcing tech- nical surveillance (as a special inves? tigative technique}, the Centre has to allow the criminal investigation bodies to have direct and independent access A ES stm?wg?aramam 5 8 to its technical systems. The possibility, by way of exception,to designate the bodies of the Romanian Intelligence Service as special criminal investigation bodies in accordance with Article 55 paragraphs 5 and 6 of the Romani- an Criminal Procedure Code, is also envisaged. Furthermore, in November 2016 Law no. 535/2004 on the preven? tion and ?ghting against terrorism was amended to de?ne travel abroad for terrorist purposes. The amendment criminalises the (attempt to) travel to a state, other than the state of nationality or residence, for the purpo'se of com? mitting, planning or preparing a terrorist offence, participating in or providing or receiving instruction or training for the purpose of committing terrorism, or for the purpose of supporting in any way a terrorist entity. The law envisages a cus- todiai Sentence between 5 and 12' years? imprisonment and restriction of rights. At the end of 2015 the Slovak Parlia- ment adopted the so-calied ?anti~terror package? in response to the November 2015 terrorist attacks in Paris. As part of the package, police, prosecution of?ces, courts and intelligence services received new powers in the ?ght against terrorism. Prison sentences for-those convicted of conspiracy to commit a terrorist act were extended, as the offence was included in the category of ?particuiariy serious crimes'. A new criminal offence of ?participating in combat operation within an organised armed group abroad? was introduced into the Criminal Code also in response to the phenomenon of foreign terrorist ?ghters. All changes and amendments came into force in January 2016. Further amendments to the Swedish Criminal Code were made to counter the phenomenon of foreign terrorist ?ghters. On 1 April 2016, new provisions came into force criminalising travelling to a country other than the country of which the suspect is a citizen, with the purpose of committing or preparing serious crimes, particularly terrorist crimes, gathering, supplying or receiving money or other property with the pur- pose of supporting such travel and also passive training for terrorism. PARRISH SITUATION AND TREND REPORT 2017 INVESTIGATIVE SUPPORT: THE EUROPEAN COUNTER-TERRORISM (ECTC) - scent developments that include the terrorist attacks Brussels and Berlin, a number of failed, foiled and also r?npleted other attacks, the propaganda videos that we been produced in European languages by IS to call attacks, and a high number of arrests on suspicion of orist activities, show that the terrorist threat towards EU is high. Even though a furthermllitary defeat of In Syria and [raq is expected, the severity of the threat the EU may even'increase. The videos indeed give the :pression that IS is increasingly under strain in Syria Iraq, but at the same time they show a strategy of obilising lone actors to com mit attacks against citizens in ntries of the anti-is coalition. =ensure an effective response to the constant changing ryelopments in terrorism, the European Counter Terrorism tre (ECTC) has been established at Europol, under the hority and direction of the European Council. It builds her on the already established tools and counter orism (CT) networks of Europol, but includes a number new features. These aim at enhancing the CT capabilities id at better facilitating information exchange among CT I'thorities, to bring cross-border cooperation in this ?eld to :1ew level. ECTC is designed as a central hub in the EU in the ?ght - inst terrorism. In fact, it is the single point in the EU . ere CT operational information from law enforcement 7. am all EU MS, but also from third parties, is brought ether for analytical purposes. Specialised teams of and experts work on thisinformation to "tablish the wider EU perspective on CT phenomena for iath operational and strategic goals. To ensure ef?cient .. rmation exchange, the ECTC bene?ts from an excellent work of CT of?cers throughout the EU and beyond. principal task ofthe ECTC is to provide operational ?pport upon request for ongoing investigations, such zthose folloWing the Paris attacks. The ECTC can assist cross-checking live operational data with the already ilable data at Europol, quickly bringing ?nancial leads light, and by analysing all available investigative details .. 5; .5, g: assist in compiling a structured picture of the terrorist In case of a major terrorist event, the ECTC can tribute to the coordinated response. For this purpose . erent teams are available, often combined with ;:perts temporarily secondedfrom MS, depending on the .iture of the event. PARRISH EUROPOL INFORMATION SYSTEM (EIS) One of Europol's core databases is the Europol Information System (EIS). Through this system, Member States directly share and retrieve information on suspects, convicted persons, events and devices connected with serious and organised crime and terrorism. The EIS offers ?rst?line investigative support as this reference system allows MS to quickly identify whether or not information they are looking for is available in one of the EU MS, with cooperation partners or Europol. In case of a positive hit, more information may_then be requested through the user?s Europol National Unit. In December 2016 the EIS held information on. over 7800 foreign terrorist ?ghters, contributed by 24 countries. IN-DEPTH ANALYSIS: THE COUNTER TERRORISM ANALYSIS WORK FILE (AWF) AND THE FOCAL POINTS For a more in~depth analysis, the ECTC works with the counter terrorism analysis work ?le (AWF). This ?le provides the framework for operational analytical support with the MS and third partners. As a result, the number of data categories that are permitted to be stored and processed is broader than in the EIS (within the CT AWF, there Is focused analysis on certain CT phenomena). Existing and emerging terrorist phenomena are handled within separate focal points. In these highly secure environments the information is collected, cross?matched and analysed. This is done by dedicated teams of CT and CT experts. Within CT, a major focal'point is ?Travellers?, which deals with foreign terrorist ?ghters. In response to the concerted efforts of Member States with the assistance of Europol the amount of data on foreign terrorist ?ghters within Focal Point Travellers increased substantially In 2016, re?ecting the increase of entries on foreign terrorist ?ghters in the EIS. The ECTC usesan integrated approach, meaning that data inserted in one system is automatically cross?checked against all other databases at Europol, to close intelligence gaps. in addition regular manualchecks are carried out. . INFORMATION EXCHANGE: SIENA In an organisation like Europol, with its main focus on information exchange, secure and swift transmission of data is essential, especially when it comes to CT data. Information from a Member State must reach Europol, and vice versa, without the risk of interception. To facilitate this information exchange, the Secure Information Exchange - Network Application (SIENA) was designed and has been in use for a number of years by MS, Europol and third parties that have operational cooperation agreements with Europol. A dedicated area has been created within SIENA especially A 6 0 for CT authorities. This means that CT authorities now have the possibility to send information directly to Europol or other CTauthorities. Until very recently, countries could only use SIENA for sending their contributions on terrorism to Europol Indirectly, through the Europol National Units and Liaison Bureaux. The extended infrastructure now also allows CT authorities from different countries to directly exchange information amongst themselves, and the involvement of Europol is optional. However, It Is recommended that Europol is involved, otherwise possible links to other MS and third partners may remain undiscOvered as well as potential links between organised crime and terrorism. In practice, this means that every CT of?cer in the Member States can check the EIS from'their own computers, or can directly send information to, or receive information, from the focal points. The options described for sharing information are at the discretion of the Member State. The dedicated SIENA CT envirOnment is already operational with 90% of all MS, and in total 46 CT authorities, now connected to the system. INTERNET REFERRAL UNIT (IRU) Terrorists? use ofthe internet and social media has increased enormously over the course of recent years. Jihadist groups, in particular, have demonstrated a sophisticated understanding of how social networks operate and have launched well-organised, concerted social media campaigns to recruit followers and to promote or glorify acts of terrorism and violent extremism. As this is a problem that spans multiple linguistic audiences and jurisdictions, a common EU response was necessary, hence the establishment of an Internet Referral Unit (IRU) at the ECTC. The IRU has the following core tasks: To coordinate and share the Identi?cation tasks (flagging) of terrorist and violent extremist online content with relevant partners; To carry out and support referrals quickly, ef?ciently and effectively, in close cooperation with industry; To support competent authorities, by providing strategic analysis and operational analysis. TERRORISM FINANCE. TRACKING PROGRAMME ITFTP) The ECTC uses a number of tools to help detect ?nancing of terrorism, of which one of the most known is TFTP - the Terrorism Finance Tracking Programme. In 2010, the European Parliament adopted the Terrorist Finance Tracking Programme (TFTP) Agreement. I Relevant information obtained through the TFTP Is provided by the US Treasury Department to Europol, competent authorities of EU Member States and Eurojust PARRISH EU SITUATION AND TREND REPORT 2017 . 61 (either spontaneously by the US, pursuant to Article 9, or upon request, Article 10), with the aim of combating terrorism and terrorist ?nancing. The TFTP has proven to be a valuable tool in terrorism- related investigations - it enhances the ability to map out terrorist networks, often ?lling in missing links in an investigative chain. It is used to track terrorist money flows, allowing authorities to identify and locate operatives and 7 their ?nanciers, and assists in broader efforts to uncover terrorist cells. EXPLOSIVES AND CBRN THREATS The bomb-making process, potential recipes for the harmful use of explosives precursors as well as potential new threats usi?ng'chemical, biological, radiological and nuclear (CBRN) materials are monitored daily and cross~ checked by Europol specialists at the ECTC. Europol also . facilitates cooperation between CBRN and explosives specialists through the European Explosive Ordnance Disposal Network (EEODN). The agency provides seminars and training where responses to potential and realistic scenarios of terrorist attacks can be rehearsed. EUROPEAN CYBERCRIME CENTRE (EC3) Launched in January 2013, the European Cybercrime Centre (EC3) can deliver high-level technical, analytical and digital forensic expertise to support investigations of EU Member States and third parties in cases of convergence of cyber and terrorism. DIRECT OPERATIONAL SUPPORT FOR CT CASES The core business is to support MS in ongoing investigations, for which it has several teams and available to produce analytical products, ranging from cross-check reports to intelligence noti?cations, and risk and threat assessments. To provide direct operational support, and to also contribute to a coordinated response in cases of major terrorist attacks or. threats, the ECTC applies a scalable approach where other teams can be . activated depending on the need. For example, the Europol Emergency Response Team (EMRT). This team exists of Europol experts and with relevant backgrounds and experience, to support emerging investigations on a 24/7 basis. THE CTJOINT LIAISON TEAM European Union Member States have recently established the Counter Terrorism Joint Liaison Team for closer cooperation on cross-border investigations. The team consists of CT from the Member States and Europol. TEAM OF ROTATING AT IMMIGRATION HOTSPOTS Between January and December 2016, approximately 363 400 migrants entered Europe by sea, mainly in Greece and Italy. And still, every day, many people attempt to cross those borders to escape the atrocities in Syria and Iraq. There is no concrete evidence that terrorist travellers systematically use those flows of refugees to enter Europe unnoticed, but it is indisputable that some terrorists have entered the EU posing as a refugees, as was seen in the Paris attacks of 13 November 2015. To counter this threat, Europol has recently approved the recruitment of up to 200 counter?terrorist and other investigators for deployment to migration hotspots in Greece and soon also to Italy. Up to 50 of these ?guest of?cers" will be deployed on rotation at key points on the external borders of the EU to strengthen security checks on the inward flows of migrants, in order to identify suspected terrorists and criminals, establishing a second line of defence. PARRISH gig? LSENHOWERWN 73, 2517 KK HAGUE, THE NETHERLANDS - 08.33839.? 09 alm?emw?j Dr 4,8.7m22 JOINT REGIONAL INTELLIGENCE CENTER NOTIFICATION (U) On 11 August, white supremacists gathered at the University of Virginia, the evening before a scheduled "Unite the Right" .raily, protesting the removal of a General Robert E. Lee statue. Skirmishes between protestors and counter- protestors resulted in at least one arrest and several minor injuries. (U) On 12 August, police dispersed the "Unite the Right? rally before its scheduled start time. At approximately 1342 EDT, James Alex Fields Jr., 20, of Maumee, Ohio, deliberately drove his Dodge Challenger into counter-protesters and fled, killing 1 and injuring 19. . (U) Polite arrested Fields shortly after the incident and charged him with second? degree murder, three counts of malicious wounding, and one count of hit-and-run. (U) Fields reportedly embraced Nazi ideology. Acquaintances said he displayed a liking for Hitler and had screamed obscenlties about Hitler and racial slurs in school. Recent political rallies attended by far-right wing and far-left wing extremists have resulted in violence. - (U) 15 April 2017 Far-left counter-protesters fought with ?Patriot Day? demonstrators In Berkeley, resulting in 21 arrests and 11 injuries. - (U) 25 March 2017 Approximately 1,700 ?Make America Great Again? protesters, many Nazi supporters, violently clashed with counter-protesters in Huntington Beach, resulting in three arrests for felony illegal use of pepper spray and one for misdemeanor battery. . (U) 26 June 2016 Severa hundred anti-Nazi protesters violently confronted the white supremacist Traditional Worker Party during a permitted rally in Sacramento, resulting in 106 arrests and 10 injuries, 2 life-threatening. . (U) 27 February 2016 Counter-protestors attacked a small group of Ku Klux Klan demonstrators in Anaheim, resulting in 13 arrests and 5 injuries, 1 suffering a knife wound. USE ONLY CHARLOTTESVILLE (U) Left: James Alex Fields Jr. booking photo; Source: Albemarle Charlottesville Regional (U) Right: Vehicle plowing into counter-protesters; Source: The Daily Progress The JRIC has no specific, credible information regarding potential threats to the JRIC area of responsibility (AOR) connected to this incident. The JRIC is not aware of any scheduled white supremacist rallies in the JRIC AOR. There are several planned rallies in support of ?Stand in Solidarity with Charlottesviile? in the JRICAOR. Although these events promote non?violence, the JRIC cannot rule out the possibility of violent clashes between opposing sides. - (U) 14 August: ?Stand for Charlottesviile, Stand for your Neighbors" rally at Moorpark Park in Studio City. - (U) 14 August: "'Enough? Rally and March? at the Quad in Whittier. . (U) 14 August: "Stand in Solidarity" rally at the Huntington Beach Pier. - (U) 17 August: Not? Hate, Makes America Great? rally in front of Congressman Brad Sherman's office In Sherman Oaks. - (U) 9 September: ?United4Love2? rally at the Upland City Hall. To request briefings. 0 submit questions/comments. please contact the JRIC at jric@jnc,org or (562) 345-1100. Receiving agencies are cautioned not to take actions baited solely on this reporting. The informa tion, graphics, or photographs in this document may be drawn from open-source reporting, finished intelligence products, or raw reporting. The inclusion of any reference should not be construed as an endorsement ofany viewpoint. entity, process, or product by the the JRIC is not responsible ierany claims or losses arising from the use of information container] within this document Is Unclassi?edI/For Of?cial Use Only. it contains sensitive information that cannot be released to the public or outside of the public. safety community. Ref PARRISH 2? OFFICIAL USE ONLY us NATIONAL COUNTERTERRORISM CENTER NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS COUNTE RTE RRORISMWEEKLY 03-09 AUGUST 2017 SPOTLIGHT (U) Details of ISIS?Directed Aviation Attack Plot (U) ISIS Recruitment Methods ON POINT 1 OHIO: (U) Man Sentenced for Soliciting Murder of US Soldiers 2 - MARYLAND: (U) Man charged with Attempting to provide Material Support and Attempted Murder WORLDWIDE: (U) Al-Qa'ida Releases Ayman AI?Zawahiri Audio Message WORLDWIDE: (U) ISIS Calls For Attacks on Embassies, Staff? WORLWIDE: (U) ISIS Published Second Issue of "Inside of the Caliphate? WORLDWIDE: (U) Twelfth Issue of Rumiyah Magazine Released UNITED KINGDOM: (U) Court Sentences ISIS Recruiter UNITED KINGDOM: (U) Four Men Guilty of Planning Attack; Sentenced to Life 9 UNITED KINGDOM: (U) Man Sentenced for Attempting to Join ISIS '10 FRANCE: (U) Man Arrested for Attempted Knife Attack 711 SYRIA: (U) Airstrikes Kill ISIS Operatives 12 MALI: (U) AI~Qa'ida Group Releases South African Man Kidnapped In 2011 13 SOMALIA: us Con?rms Strike Against All Jabal 14 AFGHANISTAN: (U) ISIS Suicide Attack at Mosque Kills at Least 29 mummhw TRENDS, TACTICS, PROCEDURES (U) UN Adopts New Resolution, on Terrorism (U) NATO Soldier Kill Afghan Soldier Insider During Operation (U) German Authorities Test Facial Recognition Software (U) indonesian School Seeks to Prevent Violent Extremism In Youths (U) Charity Run by Violent Extremist Launces Political Party PARTING SHOTS NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS- OFFICIAL USE ONLY (U) Counterterrorism Weekly is an UNCLASSIFIEDHFOR OFFICIAL USE ONLY compilation of open source publicly available, press and relevant commentary on issues related to terrorism and counterterrorism over the past seven days. It is produced every Wednesday. excluding hoiidays. Counterterrorism Weekly is produced by the National Counterterrorism Center and contains situational awareness items detailing ongoing terrorism-related developments which may be of interest to Federal, State, Local and Tribal Law Enforcement, security, military personnel. and first responders. Information contained in the Counterterrorism Weekly is subject to change as a situation further develops The inclusion of a report in Counterterrorism Weekiy is not confirmation of its credibility or accuracy of the information contained therein nor does it imply NCTC's official view or endorsement. Comments and requests for information pertaining to articles featured in Counterterrorism Weekiy may be directed to (U) This product may contain US Persons information deemed necessary for the intended recipient to understand or assess the information provided. This information has been highlighted in the document with the label ?595?, pursuant to E0. 12333 which affords protections for US persons. FVEY partners? names are also labeled. based on their request. (U) NCTC Commentary/Assessments are written by seasoned NCTC Directorate of Intelligence Analysis or by the Joint Counterterrorism Assessment Team, a collaboration of federal, state, and local government personnel. (U) The material contained in this weekly publication may be subject to copyright. Furtherreproduction or dissemination by I any means is subject to original copyright restrictions and is generally prohibited without the copyright holder's permission. This weekly publication is intended to assist readers in their official capacities. - and is not intended to be a replacement for commerciai services. PARRISH OFFICIAL USE ONLY TO THE PUBLIC OR FOREIGN GOVERNMENTS US NATIONAL COUNTERTERRORISM CENTER COUNTERTERRORISM WEEKLY UTI WORLDWIDE m1 1: 7mg. OHIO: (U) On 2August, USPERTerrence McNeil, 24, was UNITED KINGDOM: (U) On 3 August, four individuals sentenced to 20 years, in prison for seeking to have were convicted of plotting an attack against a police military members killed on behalf. [pg or military target in the UK and sentenced to life.) MARYLAND: (U) On 8 August, US legal permanent [pg 9] resident Nelash 'Das, age'25, was charged with FRANCE: U) On 5 August, a 19?year?old French man, attempting to provide material support and resources to recently discharged from a hospital, ISIS and, attempting to murder an FBI Special Agent. brandished a knife and tried to breach security at the [pg 6] Eiffel Tower while shouting the phrase ?Allahu Akbar? womn: (U) On 4 August, ISIS released the 92nd (60d '3 great)? [pg' 10] issue of Its weekly paper, Al-Naba which called on SOMALIA: (U) On 30 July, the US conducted a strike its supporters to target embassies and embassy 7 near Tortoroow in southernSomaIia, killing senior personnel..[pg 8] aI?Shabaab IeaderAli Muhammad Hussein, known as Ali Jabal. [pg 11] WORLD: (U) On 6 August, the AI?Hayat Media Center published the 12th issue of Rumiyah magazine featuring (U) On 3 August, Africa s_foreIgn an interview with the group?s military commander for mInister announced-South AfrIcan Stephen Raqqah. [pg 8] McGowanm?kldnapped by ai?Qa?Ida In Mail, In - . . 2011?-was released. [pg 11] WORLD: (U) On 2August, aI-Futah media center posted AFGHANISTAN: (U) On 2 August, a suicide attack links to download an as?Sahab-?featuring Ayman targeted a Shia mosque in Herat during evening AI-Zawahari condemning the Pakistani Government and prayers, killing at least 29 people. [pg 12] eulogizing several deceased members. [pg 7] SPOTLIGHT SUMMARY (U) Details of ISIS?Directed Aviation Attack Plot (U) On 4 August, Australian police provided details of recently disrupted ISIS plots to target an Etihad Ainlvays flight using an IED hidden in a meat mincer, and a related aspirational attack using poisonous gas. (REUTERS, NYT) (U) ISIS Recruitent Methods (U) In late July, a German reporter coordinated with security officials to pose as an individual interested in conducting an ISIS-sponsored attack. The reporter described attempted to recruit and encourage him to conduct an attack on its behalf. (BILD) NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS OFFICIAL USE ONLY PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS US NATIONAL COUNTERTERRORISM CENTER COUNTERTERRORISM WEEKLY (U) This section provides a comprehensive look at a terrorist group(s) or leader(s), and/or_CT tools and literature. (U) Details of ISIS?Directed Aviation Attack Plot (U) On 4 August, Australian Federal Police Deputy Commissioner Michael Phelan held a press conference to detail the recently disrupted ISIS plot to target an Etihad Airways flight using an IED hidden In a meat mincer, and a related aspirational attack using poisonous gas. (U) Phelan stated Police arrested and charged two brothers, Khaled Khayat and Mahmoud Khayat with two counts of planning a terrorist act which carry a maximum punishment of life in prison. Two additional men were arrested; one was released, and another was charged with illegal possession of weapons. I (U) Australian police believed Syria-based ISIS operatives sent parts . of the explosive used to construct the lED?including high~grade military explosives?mto Australia using international air cargo originating in Turkey. I (U) Phelan stated an unnamed Syria?based ISIS commander instructed one of the alleged suspects on assembling the explosive device into what police believed was a ?functioning for the flight. (3U) ockuspect Khaled (SYDNEY I (U) Police assessed once the was constructed Khaled and HERALD) Mahmoud sent another unwitting brother to the airport on 15 Juiy to board the Etihad flight with the - (U) Police noted theplan was aborted at the last minute, and although the piece of luggage was taken to the airport, it was not checked in. The unwitting brother then boarded the flight without the luggage (U) Communication between the Khaled Khayat and the Syria based ISIS member directing the plot began in April, according to Phelan (U) Australian police added, following the airline plot?s failure, the suspects allegedly tried to create an improvised chemical device, intended to release ?highly toxic? hydrogen sulfide. (U) Australian police noted the Syria?based ISIS operative advised the men on which public areas to place the device highlighting "preliminary and hypothetical" discussions between the suspects and Syria-based - ISIS members suggested a plan to deploy it in a crowded place, such as public transport, according to Phelan. (U) Police stated precursor chemicals and other components were found; however, the accused were ?a long way" from making a functioning device. (REUTERS, NEW YORK TIMES) NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS CLASSI OFFICIAL USE ONLY PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS US NATIONAL COUNTERTERRORISM CENTER. COUNTERTERRORISM WEEKLY SPOTLIGHT NCTC: (U) Australia has recently taken measures to enhance its CT posture and cooperation between intelligence and . security agencies. Australia?s Prime Minister said the CT operation that disrupted the aviation plot demonstrated ?tight cooperation and collaboration" between agencies, according to a press report. The New South Wales (NSW) Joint Counter Terrorism Team?which includes members ofASlO, the NSW police, the Australian Federal Police, and the NSW Crime Commission?conducted the operation, according to the same reportJuly, the Australian Government directed airlines and airports to more thoroughly screen baggage, according to international press reports. I (U) On 18 July, Australia?s Prime Minister announced the establishment of a new Home Affairs Ministry, which will serve as a central department providing strategic planning, coordination, and support to ASIO, the Australian Federal Police (AFP), Border Force, and Criminal intelligence Commission, according to his remarks to press. The Justice Minister and Attorney General previously exercised responsibility for the AFP and ASIO, respectively. The new Home Affairs minister asserted that the new structure will enable closer interagency cooperation against terrorism, espionage, and cyber threats according to a radio interview in mid~July. - (U) On 17 July, Australia?s Prime Minister announced new laws to afford the Australian military greater inVoIvement in domestic CT operations, according to press reporting. (NCTC) NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS OFFICIAL USE ONLY PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS US NATIONAL COUNTERTERRORISM CENTER I I COUNTERTERRDRISM WEEKLY I I (U) This section provides a comprehensive look at a terrorist - I I QFOUDIS) 0F leader(s), and/0r CT tools and literature. (U) ISIS Recruitment Methods (U) In late July, a German reporter coordinated with security officials to pose as an individUal interested In conducting an ISIS-sponsored attack. The reporter described how ISIS attempted to recruit and encourage him to conduct an attack on its behalf. The reporter was able to infiltrate and read messages in a closed-Telegram chat group and eventually asked how he could send a video to Amaq news agency'in which he would posthumously claim responsibility for an attack ISIS hoped he would conduct. a- (U) An ISIS recruiter, reportedly operating from Syria advised the reporter ISIS considered Telegram unsafe and not to use it to communicate any further about a potential video as part of his preparation to conduct an attack. Instead, the ISIS recruiter recommended using the messenger service Wickr, because ISIS considered its security mechanisms safer. I (U) Following his initial contact, the ISIS recruiter instructed the reporter to plan an attack and promised the reporter would be identified as a ?soldier of the islamic State? through official ISIS propaganda once he conducted the attack. - (U) When the ISIS recruiter continued to ask the reporter to send the video, the reporter stalled, and several days later, the ISIS recruiter forwarded the reporter to a ?German brother? who continued to assist the reporter?s recruitment. (U) The instructor recommended a video which provided instructions on how to conduct knife attacks. In the video, ISIS member Abu Sulayman aI?Faransi used an ISIS prisoner to demonstrate where and how to stab a person when conducting an attack. The video also provided instructions on how to make explosives and showed a backpack IED used to kill another prisoner. a (U) The instructor identified numbers of targets the reporter could use the knife techniques on, including an ?old people?s home, monastery, or church.? The reporter informed the instructor he believed he was too ?clumsy? to conduct a knife attack, failed at producing an IED, and had no drivers license to conduct a vehicle ramming attack. The instructor suggested the reporter ?walk into a hospital Take flowerswith you" (to hide the knife) ?and go to the inpatient ward, where the severely are. Then calmly slay them a (U) The instructor then quoted deceased ISIS spokesman Abu - Muhammad aI?Adnani? instructions to conduct simple operations which IUI were difficult for security services to disrupt. IEChn'qUes a (U) To remove any additional doubts an attacker may have,_the instructor promised additional ?heavenly rewards" for ?conducting an attack which inspires others to also conduct attacks.? (BILD) NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS- OFFICIAL USE ONLY PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS ON POINT tori-Salicifins ['Murd er ofUSSoIdIers (U) On 2 August, USF?ERTerrence McNeil, 24, was sentenced to 20 years in prison for seeking to have military member-s killed on behalf. McNeil?s conviction stems from charges against him in April in which he pleaded guilty to five Counts each forf?solicitatio'n to commit a crime of violence? and ?making threatening interstate communications." (U) According to a Department of Justice press release, around 24 September 2015, McNeil posted a hit listmconsisting of names and addresses of 100 military members?using his Tumblr account topost the information under the blog title, ?Target: United States Military? and ?Leak: Addresses of 100' US Military Personnel.? In the post, McNeil asked readers to kill military members on behalf of ISIS to which he claimed his support. I (U) In ?additiOn, McNeil researched online prices of firearms for sale and possessed detailed bomb?making instructions, according to the press release. (egg, REUTERS) US NATIONAL COUNTERTERRORISM CENTER COUNTERTERRORISM WEEKLY (U) This section consists of in-depth counterterrorism press articles including context and background information. pvthI? (U) On 8AUgust, a federal grand jury charged Bangladeshi national and US legal permanent resident Nelash Das*, age 25, with attempting to provide material support and resources to ISIS and using and carrying a firearm during and in relation to a crime of violence, attempting to murder a federal employee an individual who was a member of the uniformed services and an FBI Special Agent. Das previously had been indicted on material support charges and remains detained. Thesuperceding indictment alleges from October 2015 September 2016 Das attempted to provide material support and resources to ISIS and alleges he knew ISISI is a designed terrorist organization engaging in terrorist activity. a (U)According to court documents, ISIS members and supporters posted identifying information about US military personnel online in hopes ISIS supporters would conduct attacks against them. Das allegedly planned to kill a US military member in support of ISIS. a Das faces a maximum sentence of life in prison. (DOJ) (U) The charges listed are currently allegations. . As in any criminal case, the defendant is presumed innocent until proven guilty in a court of law. NOT RELEASABLE TO THE PUBLIC FOREIGN GOVERNMENTS OFFICIAL USE ONLY PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS US NATIONAL COUNTERTERRORISM CENTER COUNTERTERRORISM WEEKLY ON POINT WORLDWIDE (U) AI- ido Releases Aymcm WORLDWIDE (U) ISIS Coils For Attacks on Al ZowohIrI AudIo Message Staff (U) On 2 August, al?Futah media center posted links (U) On 4August, ISIS released the 92nd issue of its weekly to download an as-Sahab?produced a 25 minute paper, Al?Naba which called on its supporters to target Arabic?language video with English?language subtitles diplomatic missions and personnel of countries opposed to titled "The of Waziristan: ?UmarAbu-Khalil and the group. Abu?Dujanah al-Basha? and presented it as the fifth episode of Zawahiri?s ?Take Up the Weapon of the Martyr" series. a The incitement came in an article titled ?War against embassies, the most devastating for infidel countries.? The editorial described diplomatic missions as ?centers a (U) In the video, Zawahiri eulogized Abu?Khalil and for espionage, information gathering, and coordination Basha, condemned the Pakistani Government, of attacks against enemies and opponents." and praised media wing as-Sahab. Zawahiri praised as-Sahab?s founder Khlaid Sheikh Mohammed?currently in prison in Guantanamo Bay?and key deceased as?Sahab members USPER (U) Calling for lone actor attacks, the publication stated every follower should improvise and choose the best method to target ?infidel" diplomatic missions and their Adam Gadhan, Umar Talib, Ahmad Faruq, and other :32:er shoutlrcii takle holstage as-Sahab members killed or imprisoned(U) Zawahari announced the death onuhair al~Maghribi a German who worked for As-Sahab, the terror network?s media arm', and described him as a ?martyr.? Maghribl is believed to have provided logistical support to the Hamburg~based Sept. 11 hijackers. I (U) Zawahari spoke about Abu?Khalil and Basha ?who showed exemplary steadfastness in the face of treachery by the despicable Pakistani Army in its last offensive in Waziristan launched in Sh'aban 1435.? (AL -- -- QAIIDA) (U I 92nd Issue of Al Nobcr ?fer attacks against (AL-NABA) Eg?agsu Etna-snaps aaxmd??eemum, - (U) Aymdn AI-Zowohori video stiII (AL-FUTAH) NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS OFFICIAL USE ONLY PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS ON POINT NCTC: Terrorists continue to target to secure, government facilities, including personnel, for future attacks. Secure facilities may have a variety of internal and external controls, which may prevent or inhibit an emergency response to an act of terrorism. The physical security measures, meant to safeguard the facilities and employees within them, may potentially hinder an emergency response by restricting movement of personnel and vehicles and placement of equipment. The First Responder?s Toolbox ?Complex Operating Environment?Secure Facilities? (16 December 2015) highlights many common attributes associated with secure facilities that might hinder an emergency response, tactics which may be used by nefarious actors to access these facilities, and additional considerations which should be taken into account by owners, operators, and - first responders. The product may be found on the Joint Counterterrorism Assessment Team (JCAT) Community of Interest (COI) on Current, the JCAT Special Interest Group (SIG) on FBl?s Law Enforcement Enterprise Portal (LEEP), and the JCAT tab on the Emergency Services (ES) and Intelligence COI on Homeland Security Information Network (HSIN). (JCATVPERSPECTIVVE) Terrorist ideological propaganda continues to encourage lone wolf attacks, underscoring the importance of first responder awareness of the terrorist planning cycle. First responder situational awareness, combined with knowledge of the indicators and behaviors, when reported offerthe potential to di'srupt'a plot prior to an attack. Thirteen Roll Call Releases highlight Suspicious Activity Reporting (SAR) highlight suspicious activities with the potential nexus to terrorism,_including "Roll Call Release: Opportunities to Disrupt Terrorist Planning Cycle" (5 March 2010) that can be used to provide situational awareness information. The product may be found on the Joint Counterterrorism Assessment Team (JCAT) Community of Interest (COI) on Current, the JCAT Special Interest Group (SIG) on FBl's Law Enforcement Enterprise Portal (LEEP), and the JCAT tab on the Emergency Services (ES) and Intelligence COI on Homeland Security Information Network (HSIN). (JCAT PERSPECTIVE) US NATIONAL COUNTERTERRORISM CENTER COUNTERTERRORISM WEEKLY ?InSIde of the CaIIphate (U) On 7 August, ISIS published the second episode of ?Inside the Caliphate? with Australian fighter ?Abu Adam aI-Australi" demanding migration and lone?wolf attacks. Abu Adam suggests Australians migrate to the Philippines . or ?make the lands of the Crusaders your?battlefield.? (ISIS) I According to the director if SITE Intelligence, despite losses in Iraq and Syria, media is a powerful and boUntifuI Weapon, in Arabic, English, and other languages. ?So, regardless of what locations ISIS holds/ loses, supporters still maintain uninterrupted stream of directives propaganda" which she deemed troubling. ISITE INTEL) (U) On 6August AI- -Hayat Media Center published the 12th issue of Rumiyah magazine released in 11 languages?English, French, German, Russian, Turkish, Kurdish, Indonesian, Pashto, Serbo?Croat/ Bosnian, Uighur, and Urdu (ISIS). According to SITE, the issue featured an 7 interview with the group?s (U) Cover 0 twe military commander for Rumiyah (ISIS) Raqqah, wherein he promised that the war will not be a ?picnic" for the enemy but will be a grueling fight. This issue also including a first-hand perspective from a fighter who was active in the Mosul battle. NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS OFFICIAL USE ONLY PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS ON POINT US NATIONAL COUNTERTERRORISM CENTER COUNTERTERRQRISM WEEKLY UNITED KINGDOM I Court Sentences ISIS RecrUIter (U) On 3August, ISIS recruiter Hamasalih, 35, who launched an ?active and committed? campaign for ISIS from his home in Birmingham, was sentenced to six years inprisonment for ISIS membership and four years in jail?with a one-year extension?won parole for each count related to the possession'of terrorism related documents. Hamasalih helped the group through speeches, social media, crowdfunding, and even tipped off an ISIS commander in Iraq of an imminent attack. I (U) Hamasalih was also found guilty of possessing a military document containing information about the Identities of Peshmerga fighters resisting ISIS expansion which authorites found at his home during his 2016 November arrest. (BIRMINGHAM MAIL) UNITED Four Men GUIlty of PlonnIng Attack Sentencedto LIfe'; (U) On 3 August, Ali, 28, UKF?ERKhobaib Hussain, 25, UKPERMohibur Rahman, 33, and UKF"ERTahirAziz, 38, were convicted of plotting an attack against a police or military target in the UK. Police described the SlS~inspired group as ?dangerous men? who were committed to conducting a "mass? ?casualty attack. Ali, Hussain, and Rahman were given life imprisonment with a minimum term of 20 years. Aziz was sentenced to life with a minimum term of 15 years. I (U) Evidence found on their phones and devices revealed they shared violent ?radical and extremist beliefs? and called themselVes the ?Three Musketeers? when exchanging messages on Telegram. I (U) The four looked at violent material online, joined violent extremist social media groups, and bought new mobile phones to help them further their attack plans. I (U) Prior to their arrest, police searched Ali?s car and found a partially?constructed pipe bomb and meat cleaver with the word mscratched on it, an imitation gun, cartridges, a 9mm bullet, latex gloves, and industrial tape. A search of Hussain?s car revealed a samurai?style sword. I (U) Ali and Hussain were previously jailed for terrorism offenses when they" returned to the UK after attempting to join an aI?Qa?ida training camp in Pakistan in 2011. All and Hussain met Rahman, convicted of possessing an al-Qa?ida magazine, while the'three were in prison. (513g, REUTERS) (U) Police custody images of (top Ieft to right) Ali, Hussc: . and (bottom left to right) Rahmcm and Aziz (WEST MIDLANDS POLICE) NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS OFFICIAL USE ONLY PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS ON POINT US NATIONAL COUNTERTERRORISM CENTER COUNTERTERRORISM WEEKLY NCTC: Violent extremists may use mobile applications, such as Telegram, to communicate and conduct preoperational activities. These messaging applications with end?to-end hinder the ability of the Intelligence Community, law enforcement, and private sector partners to detect violent extremist rhetoric and attack plotting. Recent crackdowns by social media providers on pro-terrorist group accounts have led terrorists and their sympathizers to devise new technical practices or modify technology to evade law enforcement and private sector efforts. For a better understanding, refer to Adherents Using Social Media as a Radicalization and Mobilization Tool" (16 January 2015), which may be found on the Joint Counterterrorism Assessment Team (JCAT) Community of Interest (COI) on Current,the JCAT Special Interest Group (SIG) on FBl?s Law Enforcement Enterprise Portal (LEEP), and the JCAT tab on the Emergency Services (ES) and Intelligence COI on Homeland Security Information Network (HSIN). (JCAT PERSPECTIVE) (U) On 5August, Hussain, 31, who previously admitted engaging in conduct in preparation for committing an act of terrorism and engaging in conduct with the intention of assisting another person to commit an act of terrorism, was sentenced to six years in prison. a (U) Hussain bought plane tickets from an undercover officer, with the intention of travelling to Syria and said he would rather die than return to the UK. He also stated he would give a pledge of atlegiance to ISIS whenhe arrived. (SEEM I (U) On 5 August, a 19?year-old French man, who was recently discharged from a hospital, brandished a knife and tried to breach security at the Eiffel Tower while shouting the phrase ?Allahu Akbar? (God is great). a (U)The man was in a hospital for several months and was granted permission to leave care from 4 to 6 August. The man was returned to a hospital after he was deemed unfit to faceprosecution for the attempted attack. I (U) During police questioning, the man said he wanted to conduct an attack against a soldier and had been in contact with a member of ISIS, who had encouraged him to act. a (U) In 2016, he was convicted of defending acts of terrorism, for making death threats, and was given a four?month suspended sentence. (REUngg, 1W NCTC: Terrorists are likely to continue to attack opportunistic civilian targets, using readily available weapons and tactics, resulting in feWer observable indicators and reducing time for detection and disruption. Historically, terrorists have executed attacks when operationally ready; however, they may speed operational planning to act more quickly in order to target a significant date or event anniversary. The terrorist attack planning cycle consists of steps which may be observable throughout the development ofa plot. Understanding the cycle can help first responders and public safety personnel identify, mitigate, and disrupt Operational activities, by increasing awareness of observable behaviors. For enhanced situational awareness, refer to First Responder?s Toolbox ?Terrorists Likely To Attack Opportunistic Targets Using Readily Available Weapons, Limiting Time for Detection and Disruption? (9 May 2017), which may be found on the Joint Counterterrorism Assessment Team (JCAT) Community of Interest (COI) on Current, the JCAT Special Interest Group (SIG) on FBl?s Law Enforcement Enterprise Portal (LEEP), and the JCAT tab on the Emergency Services (ES) and Intelligence COI on Homeland Security Information Network PERSPECTIVE) NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS OFFICIAL USE ONLY PARRISH USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS 0N POINT US NATIONAL COUNTERTERRORISM CENTER COUNTERTERRORISM WEEKLY SYRIA Ty )AIrstrIkes ISIS Operatives (U) On 3 August, the US?led coalition fighting ISIS in Iraq and Syria announced It killed 12 ISIS members operating inside Syria in recent days, many of whom were involved in planning attacks against Western targets. In the past few months, the strikes targeted several members of ISIS to include Lavdrim Muhaxheri, an ehtnic Albanian from Kosovo and the "self-proclaimed leader of ISIS foreign fighters from Kosovo? and other?lSlS recruiters who facilitated the movement of foreign fighters to Syria. I (U)The strikes mainly took place in Abu Kamal and Mayadin, Syria, along the middle Euphrates River valley, where many ISIS leaders and fighters have moved since military operations to liberate the group?s ?capital" in Ar Raqqah began in the last few months. . (cum) (U) On 3 August South African foreign minister Maite Nkoana? Mashabane announced South African Stephen McGowan?kidnapped by al Qa? ida in the Islamic Maghreb in Timbuktu, Mall, in 2011?was released (U) Three other men were kidnapped with McGowan. Swede Johan Gustafsson was freed in June. Their German friend was killed in the initial kidnapping, and Dutch national Sjaak Rijke was freed in 2015 in a raid by French special forces. (REUTERS) SOMALIA TU US Confirms Strike Against All (U) On 30 July, the Department of Defense conducted a successful kinetic strike near Tortoroow In southern Somalia, killing senior al-Shabaab leader Ali Muhammad Hussein, known as All Jabal. I (U) Ali Jabal, was responsible for leading aI-Shabaab forces operating in Mogadishu and Banadiir, Somalia, and planning and executing attacks against the capital of Mogadishu. I (U) He used the Lower Shabelle Region of Somalia, a known al-Shabaab safe haven, as a hub for these activities. In recent months, aI?Shabaab Operatives were known to have conducted VBIED attacks and assassinations targeting police, governmental and military leaders in the capital. at (U) There were no civilian casualties from this strike. . (AFRICQMT NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS OFFICIAL USE ONLY PAFIFIISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS US NATIONAL COUNTERTERRORISM CENTER ON POINT AFGHANISTAN (U) ISIS Attack at L, Mosque Kills at Least 29 (U) On 2 August, a suicide attack targeted a Shia mosque in Herat during evening prayers, killed at least 29 people. (U) According to Herat police spokesman Abdul Ahad Walizada, ?Based on our initial information, two terrorists were involved one of them wearing a suicide vest, who detonated himself while the second one was armed with a rifle. They are both dead.? I (U) ISIS claimed responsibility for the attack through theirA?maq news agency but alleged 50 killed and 80 wounded on a ?Husaynia (Shias Religious Center)" (AL-JAZEERA) NCTC: Foreign terrorist organizations (FTOs) and homegrown violent extremists (HVEs) continue to target houses of worship and other faith-based facilities in the West, highlighting the importance of increased first responder awareness of suspicious activity indicators. Situational awareness?including the improvement of security protocols?~?can be enhanced through communication, coordination, and training among federal entities, state, local, tribal, and territorial first responder agencies; religious community groups; and private sectors. For additional information, refer to First Responder?s Toolbox ?Threats Against Religious Facilities and Adherents Highlight Importance of Religious Community Outreach? (19 July 2017), which may be found onIthe Joint Counterterrorism Assessment Team (JCAT) Community of Interest (COI) on Current, the JCAT Special Interest Group (SIG) on Law Enforcement Enterprise Portal (LEEP), and the JCAT tab on the Emergency Services and Intelligence on Homeland Security Information Network (HSIN). (JCAT PERSPECTIVE) 1311511] 3.1.1.1?.E1a?i? (U) cidim of responsibility For Mosque (AMAQ NEWS AGENCY) NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS OFFICIAL USE ONLY COUNTERTERRORISM WEEKLY PARFIISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS us NATIONAL COUNTERTERRORISM CENTER COUNTERTERRORISM WEEKLY D8 TACT I RO CE RES (U) This. section informs readers on methods terrorists are I I . utilizing overseas which could be employed domestically. UN Adopts New Resolution on Terrorism (U) On 2-August, the UN Security Council unanimously adopted a resolution aimed at preventing terrorists from acquiring weapons, particularly small arms and light weapons, as they ?continue to pose threats to international peace and security and cause significant loss of life.? The council ?strongly condemned? the continued flow of weapons, military equipment, Unmanned Aerial systems (UASs) and their components, and IED components to and between ISIS, al?Qa?ida, their affiliates, associated groups, illegal armed groups, and criminals. I (U) Member states were specifically urged to ensure the ability to take appropriate legal actions?through strengthening judicial, law enforcement and border control capacities?against those who are knowingly engaged in providing terrorists with-weapons and to ensure proper physical security and management for stockpiles of small arms and light weapons. The council also encouraged the implementation of marking and tracing procedures of small arms and light weapons to improve traceability of such weapons which could be provided to terrorists through illicit trafficking. (U) "The spectre of terrorists acquiring lethal technologies and new weapons, including weapons of mass destruction, poses a serious threat to international peace and security,? according to a statement to the Council by Jehangir Khan, the-Officer?in-Charge of the newly created UN Counterterrorism Office. (mg) I (U) NATO Soldier Kill Afghan Soldier Insider During Operation (U) On 5 August, Romanian?soldiers, who were part of the Resolute Support mission providing-security for the Train, Advise and Assist Command south advisers, killed an Afghan police officer when he opened fire on them in Southern Kandahar province. I (U) The Romanians had completed scheduled law enforcement training and were attacked by the police officer as they were preparing to return to their base. I (U) Awounded Romanian soldier WAS treated at KandaharAirfieid?s medical facilities and another Afghan policeman wounded in the gunfire exchange was treated at an Afghan medical facilityiFOXNEWS) (U) German Authorities Test Facial Recognition Software (U) On 1 August, German police deployed the first facial recognition cameras at a main'railway station in Berlin, testing new technology which could help track and arrest . crime and terrorism suspects. I (U) The images of a few dozen German volunteers have been entered into the new monitoring system at the Stidkreuz station, a main transport hub in the capital, where testing will occur. a (U) The six-month pilot project?"part of a promise by Chancellor Angela Merkel?s conservatives to raise funds for police and security?will gauge how well the software can recognize terrorism suspects and distinguish them from passersby. (REUTERS) NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS OFFICIAL USE ONLY PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO OR FOREIGN GOVERNMENTS TRENDS, TACTICS, PROCEDURES 1 (U) Indonesian School Seeks to Prevent Violent Extremism In Youths (U) On 1 August, the AI Hidayah Islamic Boarding School in Sei Mencirim, North Sumatra, Indonesia graduated 20 students. The school was founded by former radicalized to violence preacher Khairul Ghazali, for young boys?whose fathers were either killed in terrorist~re ated raids er in prison for terrorism offenses?to prevent them from becoming the next generation of Indonesian terrorists. in (U) Ghazali, 52, has written several books against violent radicalism and professes to be a changed man wanting to prevent young boys from becomingthe next generation of terrorists. There are at least 2,000 sons and daughters of killed and imprisoned violent extremists at?risk of becoming part of a new wave of violent jihadism, according to Ghazali. a (U) The school which opened in 20155 supported by counterterrorism officials from the military and district and provincial governments. Local police have spoken to villagers, raising awareness about its purpose. ABC NEWS . NCTC: This outreach program highlights the important aspect to a whole of government approach to stemming radicalization and homegrown violent extremism, including schools, community centers, and religious facilities. Other types of systems through public service announcements and interviews with local and national press can assist state, local, tribal, and territorial government personnel, community leaders, and family members?who may be best positioned to witness indicative behaviors-win the identification of individuals at risk. For further information, see the Roll Call Release ?Identifying Homegrown Violent Extremists Before They Strike? (8 October 2010), which may be found on the Joint Counterterrorism Assessment Team (JCAT) Community of Interest (COI) on Current, the JCAT Special Interest Group (SIG) on FBl?s Law Enforcement Enterprise Portal (LEEP), and the JCAT tabon the Emergency Services (ES) and Intelligence COI on Homeland Security Information Network (HSIN). (JCAT PERSPECTIVE) NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS OFFICIAL USE ONLY - US NATIONAL COUNTERTERRORI-SM CENTER COUNTERTERRORISM WEEKLY (U) Charity Run by Violent Extremist Launces Political Party (U) On 8 August, a Pakistani charity?accused of being a front for Lashkar?e?Tayyaba led by Hafiz Saeed, who who staged the 2008 Mumbai attacks has entered politics by forming a new party, according to charity officials. The new Milli Muslim League party will follow the ideology of Jamaat?ud?Dawa as it has filed registration papers for a new party with Pakistan's electoral commission. officials have always denied the charity is a front for and tout the group's humanitarian work as an example of Islamic charity. in (U) ?We have decided to make a new political party, so that Pakistan is to make areal Islamic and welfare state," according to a statement by Milli Muslim League President Saifullah Khalid. PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS NO SHOTS US NATIONAL COUNTERTERRORISM CENTER COUNTERTERRORISM WEEKLY (U) This section includes press articles with concise summaries for rapid consumption. I WORLDWIDE: IUISenior Airstrik'es (U) On 8 August, ISIS supporters posted on social media Saudi national and senior ISIS religious official Abu Bakr Al?Qahtani was reportedly killed in a Coalition airstrike. Bakr was one of the first to split from Jibhat aI-Nusrah and accuse it of deviation. (ISIS, MENA) UNITED KINGDOM )AuthorItIes Arrest IndIVIduaI Alleged To Be Plotting Terrorlst Acts (U) On 3 August, UK authorities arrested, and then released on ball, a man at Southend Airport in eastern England on allegations of preparing acts to commit terrorism as he prepared to board an outbound flight. Police conducted a related search at a location in Essex. (MET POLICE) 3 DENMARK (U) AuthorItIes Prosecute Woman for Jommg ISIS: _In Syria (U) On 3 August, Danish authorities charged, in absentia, a likely Syria-based 19 yearmold Danish woman for suspicion of violating terrorism laws after she allegedly travelled to Syria and joined ISIS in June. The woman was also accused of attempting to help a female family member travel to Syria in March. (A31 5:1: deernrh?ntAdds-j Ne t9 'Ter'rerist List - (U) On 4August, three men and six women have joined terrorist groups were added to The Netherlands? National Terrorism List, had theirfunds frozen and access their Dutch bank accounts and credit cards was blocked, according to a Ministers of Foreign Affairs? press release. a (U) The National Terrorist List is not a search list or list of mostsought-after terrorists. The list includes persons and organizations to whom a so-calied freezing measure applies. (ANP) TUNISIA. (U) National Guard Arrests Suspected Terrorist (U) On 5 August, a 37?year-old man was arrested in Khammouda, Kasserine, and previously sentenced to 14 years in prison for his previous'involvement in a terrorist case. (IAJQ IRAQ (U ISIS Claims KiIIing Dozens of Iran Troops Near Iraqi/Syrian Border I (U) On 7-August, ISIS claimed on Telegram its operatives attacked Iraqi army positions in al?Jamuna area near the aI-Tanaf border crossing, which lies on the Syrian side of the Iraqi border. The attack reportedly began with a suicide bombing followed by an assault conducted by. ISIS operatives, killing 68 and capturing one soldier. (BBC MONITORING) YEMEN (U VBIED) Five Soldiers (U) On 2 August, two attackers detonated a VBIED near a security checkpoint in the Redhoom District of Shabwah Goveronate, killing five soldiers and injuring others including residents. AQAP claimed responsibility for the attack, alleging seven Yemeni soldiers were killed. IBELJLERLAQAPI 7 #955 (31$ 3am riff ($13105 333M s?i? I dam Esra-u asses Isaia- (U) AI-Qa?ida claim of responsility for attack against Yemeni soldiers. (AQAP) IRAQ: Sudanese Fighter In Mosul On 5 August, Sudanese ISIS fighterAliAbdel Ma? arouf k. a- Abu aI?AsbatAI- -Sudani), was killed during a battle launched by the Iraqi army to retake Mosul from ISIS. Abdel-Ma?arouf was the head of prisons in Mosul?including one of the legislators who held senior ISIS one ofthe most prominent trainers on the uSe of weapons and the martial arts. (SUQAN NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS OFFICIAL USE ONLY PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS PARTING SHOTS IRAN (U) Authorities -Arrest ISIS Attacks? (U) On 8 August, Iranian security forces reportedly arrested an ISIS-linked group, which was planning attacks against religious centers and trying to hide weapons in home appliances. The operation ended with a total of 27 alleged suspects being arrested. Ten people were arrested at the group?s leadership center abroad along with 17 people inside Iran. Five of the 17 were due to conduct the attacks in Iran, and the other 12 were supporting (U) ISIS May HoveFIredRoc-?ketsmto Leb?h?n . (U) On 7August, ISIS possibly fired seven Grad rockets into Lebanon from its enclave on the border with Syria. This would mark the first use of those weapons by ISIS fighters there for several years and comes as the Lebanese army prepares for an assault on their enclave. (REUIERS) IUISecurItySuspectsTurn Themsewesi-In (U) On 8 August, three Saudi men?on a list of 23 people wanted by the authorities over security offences?turned themselves in. Saudi security forces pushed ahead with an operation in the eastern part of the kingdom to try to flush out armed men, including those on the list announced in, January 2012. . Offensesf (U) On 7 August, a former member of the Saudi military who fought for ISIS and led a terrorist cell in Saudi Arabia as well as planned an attack on Azar Airport in Northern Borders Province was sentenced to 20 years in prison. He was convicted ofjoinlng ISIS, meeting its leaders, training its fighters, and taking part In its terrorist operations.- He was also convicted of storing potentially harmful information and sending it through the Telegram messaging app to an ISIS member. (ARABNEWS) - US NATIONAL COUNTERTERRORISM CENTER COUNTERTERRORISM WEEKLY, SAU DIV ARABIA: TerroristfKillsd liqliif-?I Arrested (U) On 7 August, security forces killed one terrorist and captured two others during an operation in Salhat, in eastern Saudi Arabia. The security sources have not revealed the identity of the dead or captured terrorists, nor has the Interior Ministry released a detailed statement about the security operation. Mills) he! (U) On 7 August, Egypt?s top national security prosecutor ordered the transfer of an Egyptian man who stabbed three foreign tourists to death at a Red Sea resort in July to a mental hospital for evaluation. Abdel Rahman Shaban Abokorah had tried to join ISIS and investigators I AI?Ck?r?toiMentaI;Hospital . initially recommended he face charges of terrorism, in what was the first major attack on foreign tourists since a similar assault on the same resort more than a year ago. Abokorah was caught by hotel staff and arrested after - he killed two German women, and a Czech woman and wounded three other tourists. Death . (U) On 7 August, al?Shabaab released a video shoWing the execution of a captive Kenyan soldier in an attempt to 7 influence Kenya?s presidential election. The soldier was captured by aI-Shabaab in Somalia in January 2016, and in the video he blamed Kenyan President Uhuru Kenyatta and his government for his death. (Am NOT RELEASABLE TO THE PUBLEC OR FOREIGN GOVERNMENTS OFFICIAL USE ONLY PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS PARTING SHOTS ENIGERIAIU (U ISIS CIaIms for Attack. on Oil Exploration Team (U) ISIS reported in the 92nd issue of al-Naba Africa claimed responsibility for the killing of nearly 70 ?apostates? in an attack on an oil exploration team in northeast Nigeria. (ISIS) (U) On 5 August, a suicide bomber killed at least seven people in a small town innorthern Cameroon near the Nigeria border, according to iocal officials. Although the area has been a target for Boko Haram suicide bombers in the past, no group has claimed responsibility for the attack, and the. identity of the bomber was unknown. (REUTERS) AFGHANISTAN 'on NATO TWO US SerVIce Member (U) On 3 August, the Taliban took responsibility for a suicide attack on a NATO patrol north of the Afghan capital of Kabul, which killed two US service members and wounded six others. Mg, AB) - With I6 Tons of Exploswes . (U) On 6 August, Afghan intelligence officials seized a truck with Pakistani license plates in Kabul, Afghanistan, carrying more than 16 tons of explosives hidden in boxes marked as poultry feed. Five people were arrested upon seizure of the vehicle. In statement made by Afghanistan?s National Directorate of Security, the vehicle was ?loaded with explosives to make bombs, suicide vests, and conduct terrorist activities in IIban ClaIm Attack If; AFGHANISTAN Off?CIals Selze Truck? US NATIONAL COUNTERTERRORISM CENTER COUNTERTERRORISM WEEKLY NCTC: This reporting highlights the importance of law enforcement (LE) officers recognizing suspicious activities, items, or behaviors during the performance of daily, routine duties, including traffic stops. Awareness of explosives and precursor materials serves as a vital component of LE safety and the prevention of potential terrorist activity through the recognition of suspicious and potentially preoperational activity. According to Fire Line ?Reporting Suspicious Activity? (9 August 2013), the Nationwide Suspicious Activity Reporting (SAR) Initiative (NSl)?a collaborative effort led by the US Department ofJustice, Bureau ofJustice Assistance, in partnership with DHS, FBI, and state, local, tribal, and territorial LE partners-u-provides first responders tools to prevent terrorism by establishing a national capacity for gathering, documenting, processing, analyzing, and sharing SAR information. - For further information reiated to NSI, to include relevant training, refer to the aforementioned Fire Line, which may be found on the JCAT tab on the Emergency Services COI on the Homeland Security Information Network (HSIN), JCAT Special interest Group on Law Enforcement Enterprise Portal (LEEP), and JCAT COI on Current?J and Current?S. (JCAT PERSPECTIVE) PAKISTAN (U) Bomb Blast Inlures 22 In Lahore, PakIstanI (UH) On 7 August, a bomb blast wounded at least 22 people in Lahore, Pakistani, with no one immediately claiming responsibility. Attacks in the Punjab provincial capital have become less frequent over the past couple of years, but Islamist violent extremists groups are still active there and periodically conduct major attacks. (Rigging) NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS OFFICIAL USE ONLY PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS US NATIONAL COUNTERTERRORISM CENTER COUNTERTERRORISM WEEKLY PARTING SHOTS - Hundreds my; Rdidsf ClaimsResponsibilitya for'Ai?ackfiniM??hoindhco - .. . . On 8August, more than 400 people?mainly from On 7 August, ISIS claimed responSIbIlity for killing nine Bangladesh, India, and Pakistanhwere detained in a and injuring Six Islamic Liberation Front fighters in counterterrorism operation in the capital Kuaia Lumpur, Maghomdnao, Ph'l'pp'msr the prior day. ?5'9 according to authorities. Machines used to create fake passports and forge Malaysian immigration documents were among the items seized. Security in the city has increased ahead of the Southeast Asian Games, which 'will begin in over one week. @1191 (U) ISIS cidim of responsibility for attack. (AMAQ NEWS AGENCY) NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS I FF A 0 [Ci LUSE ONLY PARRISH OFFICIAL USE ONLY NOT RELEASABLE TO THE PUBLIC OR FOREIGN GOVERNMENTS us NATIONAL COUNTERTERRORISM CENTER (NCTC) NCTC serves as the primary organization in the US Government for integrating and analyzing all intelligence pertaining to terrorism possessed or acquired by the US Government (except purely domestic terrorism); serves as the central and shared knowledge bank on terrorism information; provides all-source intelligence support to government-wide counterterrorism activities; establishes the information technology (IT) systems and architectures within NCTC and between NCTC and other agencies that enable access to, as well as integration, dissemination, and use of, terrOrism information. NCTC serves as the principal advisor to the Director of National intelligence (DNI) on intelligence operations and analysis relating to counterterrorism, advising the DNI on how well US intelligence activities, programs, and budget proposals for counterterrorism conform to priorities established by the President. NOT RELEASABLE TO THE PUBLIC FOREIGN GOVERNMENTS OFFICIAL USE ONLY PARRISH UNCLASSIFIEDHFOR OFFICIAL USE ONLY Homeland Security 9 AUGUST 2017 Domestic Terrorista Violence at Lawfully Permitted White supremacist Rallies Likely to Continue This article highlights violent confrontations between probable anarchist extremists" and probable white supremacist extremistsc, and identi?es factors increasing the potential for violence Our analysis is based primarily on our review of the six incidents since Pebruar 2016 where both groups clashed at lawfully permitted white supremacist rallies. This article is intended to alert law enforcement to the potential for violence at future white supremacist rallies, including one planned for 12 August 2017 in 'Charlottesville, Virginia. We assess that anarchist extremists use of violence as a means to oppose racism and white supremacist ext1em1sts p1eparatlons to counte1attacl< anarchist extlemists are the principal drivers of violence at 1ecent white supremacist 1allies. Each of the white supremacist rallies since February 2016 where we observed violence?six in total? were co- organized by prominent white supremacist figures or groups who promoted their rallies online weeks 1n advance, which we judge provided anarchist extremists and white supremacist extremists with ample time to prepare for and at times explicitly incite violence.1 Co-organizers of the rallies included the neo-Nazi group Traditionalist Worker the Ku Klux and Richard Spencer?sUSPER National Policy lnstituteUSPER, a white supremacist think tank. These groups and individuals associated with them are widely opposed by anai cl11st extremists, based on our review of anarchist extremist online activity. Anarchist extremists planned to violently oppose the rallies via social media and flyer campaigns after they were announced by the white supremacist organizers. For example after the Traditionalist Workers Party announced its June 2016 rally in Sacramento, Californiad, anarchist extremists began planning a counter event, stating ?No ?Free Speech? F01 Fascists!? Their rally must be stopped by any means necessary? a DHS defines domestic terrorism as any act of unlawful violence that is dangerous to human life, or potentially destructive of critical infrastructure or key resources, committed by a group or individual-based, and operating entirely within the United States or its territories without direction or inspiration from a foreign terrorist group. This act is a Violation of the criminal laws of the United States, or of any state or subdivision of the United States, and appears to be intended to intimidate or coerce a civilian pOpulatio11,to influence the policy of a government by intimidation or coe1 cion 01 to affect the conduct of a gove1 11n1ent by mass destruction, assassination, or kidnapping. A domestic terrorist diffels f1 om a homegrown violent ext1 emlst in that the f01 mer is not inspired by, nor takes d11 ectlon f1 om, a f01 elgn ter1 oust g1 oup 01 otl1e1 fo1eign powei DHS defines anal ex t1 as groups 01 individuals who facilitate or engage in acts of unlawful violence as a means of changing the government and society in support of the belief that all forms of capitalism and corporate globalization should be opposed and that governing institutions ale unnecessaly and harmful to society. DHS defines white supremacist extremists as groups or individuals who facilitate 01 engage in acts of unlawful violence directed at the federal govelnment, ethnic 11111101 1t1es, 01 Jewish persons in supp01t of theil belief that Caucasians are intellectually and mm ally supelior to othe1 races and tl1ei1 pe1 ceptlon that the gove1 11me11i IS controlled by Jewish persons. For more in? depth 1nf01mat10n on this events and a similar one in Anaheim, CA please see the FAR titled "Calif01 1111 Recent Violent Clashes Suggest Heightened T111 eat Environment at Lawfully O1ganized White Supl emacist Events? dated 29 SEP 2016. $22886-t7 FY17.HITEX.8.9B OFFICIAL USE ONLY . PARRISH UNCLASSEFIEDHFOR OFFICIAL USE ONLY according to a website sympathetic to anarchist extremism.? Anarchist extremists followed through on these threats by attacking the white supremacists.4 White supremacist extremists planned to . .defend ourselves viciously if attacked,? according to a white supremacist website. The statement was posted after the author became aware of the threatened violent opposition to the June 2016 rally.5 We assess?that a'heavily promoted white supremacist rally planned for 12 August 2017 in Charlottesville, Virginia, could be among the most violent to date. Our judgement is based on the planned attendance of numerous prominent white supremacists and on the growing importance of the location for white supremacist extremists and anarchist extremists since two white supremacist rallies were held there this year. The upcoming rally? titled ?Unite the Right? ?will occur at a park that was renamed in June 2017 from ?Robert E. Lee Park? to ?Emancipation Park?, and will be attended by many of the same white supremacist groups and individuals who attended rallies where violence has occurred since February 2016.6 White supremacist groups and individuals planning to attend the 12 August rally include the Traditionalist Workers Party, Richard Spencer, and white supremacist Jason KesslerUSPER, according to press reporting.7 During a 13 May 2017 rally in Charlottesville organized by Richard Spencer, anarchist extremists attackedwhite supremacists and several fights broke out. This lead to several arrests, including Jason Kessler, according to press reporting.B At a 7 July rally in Charlottesville 01ganized by Ku Klux Klan?~ held in opposition to the park?s renaming?? a counter rally planned by self?desc11bed anti- racists led to two felony charges of assault and battery, according to p1ess reporting.9 Anarchist extremists and white supremacist extremists online are calling on supporters to be prepared for or to instigate violence at the 12 August rally. For instance, a probable white supremacist posted online a to arms. . .antifa must be destroyed,? according to DHS open source reporting. We judge ?antifa? in this context to mean probable anarchist extremists, who often identify as ?antifa? or anti?fascists.10 (UHFOUO) The Virginia Fusion Center is cur1ently monitoring social media and other online sources fo1 calls to commit criminal activity surrounding the ?Unite the Right? 1all J, scheduled to began at 1200 on Saturday, 12 August at Emancipation Park in Chailottesville, Vi1giniap-The Virgmia Fusion Center and Vi1gin1'a State Police will be providing support to local law enforcement through the event 3 concluswn and will pIO'Uide future situational awareness reports as required, and will take act1on accordingly. 0 The Virginia Fusion Center (VFC) recognizes that all Americans are afforded the constitutionally?protected right to peacefully assemble as outlined in the First Amendment of the United States Constitution, and will take action accordingly. USE ONLY PARRISH OFFICIAL USE ONLY (U) Source Summary Statement. Reportingin this article was derived from press articles, government press releases, police reports, and DHS Open Source Information Reports. has medium confidence in our assessments regarding group affiliations and motivation of attackers. We have some concerns about the quality of information in the media reporting used, as information about actors? motivations and background continues to develop as additional incidents occu1. Additional media repOrting or information pe1taining to investigations that add1ess such developments would strengthen our assessment. has medium to high confidence in our assessment that these events will continue because of ongoing event planning observed on social media. Our assessment on the violence that may affect these events would be strengthened by more specific plans being observed online in relation to preparation for violence. has high confidence in our assessment that the groups mentioned will be in attendance at the .12 August rally as several sources in the press and in social media have confirmed permits and crowd sized. Additionally, Traditionalist Worker Party, the Ku Klux Klan, Identity Europa, Richard Spencer, and Jason Kessler have all publically declared they will be' attendance Prepared by EPA Coordinated with the Virginia Fusion Center 1 Analysis review of compiled spreadsheet; 5 MAY 2017; 01 APR 2010 to 05 MAY 2017; Race related violence; Extracted information Overall spreadsheet classification is UNCLASSIFIED. 2 Authors; LosAngeIes Times; ?7 stabbed at neo?Nazi?event outside Capitol in Sacramento?; 26 JUN 2016; accessed on 9 AUG 2017; Online News Source. 3 By Any Means Necessary; ?No Free Speech For Fascistsl?; 21 JUN 2016; for-fascists; accessed on 08 AUG 2017; Website sympathetic to anarchist extremism. 4 Sacramento Bee; "Police Defend Response to Violent Rally at California Capitol?; 27 JUN 2016; http: sacbee. html; accessed on 26 JUL 2016; Local online newspaper. )Golden State Skinheads; ?The Mindless Opposition Approachesl"; 22 JUN 2016; http: org/uncategorized/the mindless- -opposition- approaches/; accessed on 03 AUG 2017; Website sympathetic to white supremacist extremists Henry Graff; ?Charlottesville City Councilors to Hold Closed Door Meeting on Unite The Right Rally; 01 AUG 2017; http: nbc29_. ?city- ~counci ors?to? hold? closed door- ?meeting? on unite-the- -right- -ral y; accessed on 04 AUG 2017; Internet news source. Kyle Swenson; Washington Post; ?Airbnb boots white nationalists headed to ?Unite the Right? rally In Charlottesville?; b2; 8 AUG 2017; accessed on 09 AUG 2017; Internet news source. 8 Lauren Berg; Daily Progress; Three Including Jason Kessler Arrested During Lee Park Counter Protest; 15 MAY 2017; accessed on 03 AUG 2017; Internet news source. USE ONLY PARRISH OFFICIAL USE ONLY 9 Hawes Spencer and Matt Stevens; New York Times; 23 Arrested and Tear Gas Deployed After A Rally in Virginia; 08 JUL 2017; accessed on 03 AUG 2017; Internet news source. 10 26 JUL 2017; DOI 26 JUL 2017; Virginia-based militia extremist promotes violence at upcoming free speech event in Charlottesville; Extracted information is Overall document classification is UNCLASSEFIEDHFOR USE ONLY - PARRISH OFFICIAL USE ONLY Homeland Intelligence Today (HIT) Is a product of the DHS Intelligence Enterprise, prepared by the DHS Office of Intelligence and Analysis I The HIT Is disseminated throughout DHS and to Federal departments and agencies. The HIT, in whole or in part, is not for dissemination outside of the Federal government and state and local partners without expressed approval from the Chief, Production, Media Services. and Dissemination Branch. For questions, comments. Or requests, please contact HomelandIntelilgenceToday@dhs Ic. gov or 202~ 282- 8 68. - (U) This product may contain US person information that has been deemed necessary for the intended recipient to understand. access, or act On the information provided. It has. been highlighted' In this document with the label and shbuld be handled In accordance with the recipient?s oversight and/or. Information handling procedUres. - The information In this report may be provided for intelligence purposes only but may be used to deveIOp potential investigative leads. No information contained' In this report, nor any Information derived there from, may be used In any proceeding (whether criminal or civil), to include any trial, hearing, or other proceeding before any. court department, agency, regulatory body, or other aUthority of the United States without the advance approval of_ the Attorney General andlor the agency or department which originated the Information contained in this report. These restrictions apply to any information extracted from this document and used In derivative publications or briefings. OFFICIAL USE ONLY PARRISH UNCLASSIFIEDIIFOR OFFICIAL USE ONLY if JQINTINTELLIGENLEBULLETIN 1r 4 at- $37! . White Supremacist Extremism Poses Persistent Threat of Lethal Violence (U) Scope - (UIIFOUO) This joint Intelligence Bulletin (HE) is intended to provide new insight into the targeting preferences of white supremacist extremists and the state of white supremacist extremism violence in the United States. This le is provided by the FBI and DHS to support their respective activities and to assist federal, state, local, tribal, and territorial government counterterrorism and law enforcement officials and private sector security partners in deterring, preventing, or disrupting terrorist attacks in the United States. lA-0154-[7 (U) ?waimng: in; document is unwashed/Iron om'cmu?ssonu that {my be exempt from public release we: the Freedom oflnforniotianlict (iufsc. 552)., l! is'iope -- controlled, stored, handled, transmitted aistiibuted and disposed of in accordance with DHS policy ri?lating to FOUO information and is net to be released to the public, themedia, or other personnel. who do net-have a valid 2.. need priorap'proval dfonrauthqifized ?nd fecal-homeld?d Security officials may share this infrastructure land key resourcep'ersonnel qnd'privute sector -, 7 - .. -. . .7 (U), All US piersan infarm'tition hosrbge?mininiized, Should you require theiniininiized USperson informution, please contactrihe l?clfi'luroduction Brainchioi I - use ONLY PARRISH UNCLASSIFIEDHFOR OFFICIAL USE ONLY I White Supremacist Extremist Movement Continues to Pose Threat of Violence to US Law Enforcement We assess lone actors and small cells within the white supremacist extremist (WSE) movement likely will continue to pose a threat of lethal violence over the next This assessment is based on a review of lethal and potentially lethal incidents of WSE violence 3 from 2000 to 20 6 and the often spontaneous and opportunistic nature of these acts that limits prevention by law enforcement. (U) Opportunistic Targeting of Minority Groups Typical of WSE Violence We judge the opportunistic nature of WSE attacks and the use of edged and other weapons instead of firearms likely contributed to the relatively low number of fatalities in 20l6 compared to previous years (see Figure I). WSEs committed one lethal and five potentially lethal attacks in 20 6 All six attacks involved the opportunistic targeting of racial or religious minorities, including Hispanics, African?Americans, a Chinese student, and one person perceived to be Jewish. Distinct from previous years, attackers in these incidents showed a preference for edged weapons over firearms. On l8 February 20 6, a WSE allegedly attacked an l8-year-old Chinese student with a hatchet while she was taking photos for a school project in Nashville, Indiana. The victim survived the attack but suffered two-inch deep lacerations on her back. According to court documents, the suspect self-identified as a white supremacist and stated he wanted to kill the student because of her race I The individual' Is currently' In custody awaiting trial. On 28 February 20 6, three WSE members of a local racist skinhead group I were arrested on multiple counts of felonious assault with a deadly weapon and one count I 7 of felonious assault with force likely to cause injury after they allegedly attacked a group of Hispanic men with knives In a Los Angeles County park According to open source media reports, the three suspects allegedly yelled racial slurs before assaulting the victims. All three suspects are currently awaiting trial.2 On 2 August 20l6, local authorities arrested a self-identi?ed WSE for allegedly murdering an African-American male with a knife in Fort Wayne, Indiana, due to the victim?s race, according to open source media reporting.3:4.5 On 3 December 20 6, local authorities arrested two WSEs for allegedly stabbing another Klansman multiple times following an argument in an East Yanceyville, North Carolina, residence. According to law enforcement sources, the suspects accused the The FBI and DHS define a lone actor as an individual acting alone or without the witting support of others to further social or political goals, wholly or in part, through activities that involve unlawful acts of force or violence. Lone offenders may act within the context of recognized domestic extremist ideologies, their own interpretation of those ideologies, or personal beliefs. The mere advocacy of political or social positions, political activism, use of strong rhetoric, or generalized philosophical embrace of violent tactics may not constitute extremism, and may be constitutionally protected activities. (UIIFOUO) The FBI and DHS define white supremacist extremists as individuals who seek, wholly or in part, through uniawful acts of force or violence, to support their belief in the inteilectual and moral superiority of the white race over other races. The mere advocacy of political or social positions, political activism, use of strong rhetoric, or generalized philosophic embrace of violent tactics?may not constitute extremism, and may be constitutionally protected activities. UNCLASSIFIEDIIFOR OFFICIAL USE ONLY Page20f7 PARRISH OFFICIAL USE ONLY victim of beingjewish and secretly working for law enforcement; they were charged with assault with a deadly weapon with intent to kill or inflict serious injury. They are currently being held In jail awaiting trial. 6 . (U) Attacks and Fatalities by Year indicates mass casualty) 2000* 2001 2002 2003 2004 2005 2006 2007 2008 2009* 2010 2011 2012* 2013 2014*2015* 2016 Number of Attacks Fatalities (U) Figure I: Attacks and fatalities by Year (Source: Derived from incident data collected from FBI investigations, other law enforcementreporting, and open sources.) There were no mass-casualty attacks in 20l6, although there was one plot to . commit mass? ~casualty violenCe, which attests to the ongoing threat of such violence from the WSE movement* In this instance, the plotter, a juvenile, allegedly planned to target racial and religious minority classmates using firearms. On 7 October 20l6, local authorities disrupted a plot by a WSE who allegedly planned to conduct a shooting at a high school in Hilliard, Ohio. The suspect was arrested following a local law enforcement investigation that uncovered specific planning, including explosives research, Weapons and equipment pricing, recruitment efforts, and a map indicating where to effectively place shooters The SUSpect? 5 phone contained Nazi imagery, images asSociated with white supremacy ideology, information about school shootings, and language advocating for killing jewish persons and African?Americans. The individual remains in custody pending further legal actions, according to open source media reporting.7 (U) 20 I6 Violence Diffuse among Ideological FaCtions The perpetrators of WSE lethal and potentially lethal violence in 20l6 included members of racist skinhead groups, Klan members, and individuals who lacked group affiliationsi (U) For purposes of this bulletin, ?mass-casualty violence? refers to criminal acts or plots in which an individual or group actually or clearly intended to kill three or more people, or cause grievous bodily harm to ten or more people (cf. l8 USC ?r The WSE movement is experiencing widespread infighting and a lack of charismatic leadership, which have made it difficult for groups to organize nationally and sustain their memberships and influence In addition, the Internet, including the emergence of social media, has enabled individuals to engage the WSE movement without joining organized groups. OFFICIAL USE ONLY Page 3 of 7 PARRISH .UNCLASSIFIEDIIFOR OFFICIAL USE ONLY One of these attacks also involved a suspected WSE who was a member of a racist prisOn gang and acted without direction or sanction of the gang. The ideology apparent in the motivation behind this attack represents a departure from usual racist prison gang activity, whose members typically pursue organized criminal activity for purposes of financial gain. On I6 August 20 6, a WSE allegedly stabbed an African-American man in Olympia, Washington, after seeing him kiss, a Caucasian woman outside a restaurant. The victim survived the attack. The suspect stated to police upon his arrest that he was part of a white supremacist group and had come to fight ?Black Lives Matters people.? The individual is a member of a Washington State-based racist prison gang and is currently in jail, charged with two counts of second-degree assault with a deadly weapon and one count of malicious harassment, according to FBI reporting.B (U) Perspective Motivations of Racist I ,Prison Gang Members ,rp'ris?on gangs as pro?t-driven, organizations that lack the ideological objectives of WSE . example, may tolerate associations their criminal business f?enterprIses Despite the tendency it?? racist prison gang members to 5_ fprIorItIze ?nancial gain over members have . LfoccaSIonally targeted mInorItIes for - reasons . The FBI and ms label racist groups. Racist prison gangs, for With minority gangs in furtherance WSEs were responsible for 49_homicides' in 26 attacks from 2000 to 20 6 (see Figure I), more than any other domestic extremist movement. WSEs used firearms in most of these lethal incidents, which were typically mass-casualty attacks. Knives and other edged weapons caused the second?most fatalities (see Figure 2). UNCLASSIFIED (U) Weapons Used in WSE Incidents, 2000?2016 (26 total incidents) a Firearm a Edged Weapon 6: Assault 1% Strangulation FiguFeTZ. Weaponsused in WSE Incidents, 2000 2016' .1 . -. :11. I ?Wat-4: a - (Source: Derived from incident data coliected from FBI investigations, other law enforcement reporting, and open sources.) UNCLASSIFIEDIIFOR OFFICIAL USE ONLY Page 4 of 7 PARRISH OFFICIAL USE ONLY A review of incidents since 2000 shows racial minorities have been the primary victims of WSE lethal violence (see Figure 3). The second most common victims were other Caucasians, including the homeless, drug dealers. sex offenders, and other white supremacists perceived as disloyal to the WSE movement. Adherents of the WSE movement view these persons as legitimate targets, as they pose a threat to, or reflect poorly on, the white race. Other-targets have included persons or facilities associated with government and law enforcement. I -- 5m?. (U) Victims in WSE Attacks, 2000?2016 (49 total victims) a Racial/Ethnic Minority a Caucasian a Law Enforcement is Jewish a Sexual Orientation . I (U) Figure 3: Victims in WSE attacks, 2000-20l6 (Source: Derived from incident data collected from FBI investigations, other law enforcement reporting, and open sources.) (U) Outlook We assess most WSE lethal violence over the next year very likelywill derive from the capabilities of lone offenders-or small cells, rather than the resources of larger groups, due to the decentralized and often disorganized status of the WSE movement. Although plot- derived mass-casualty violence remains possible, we judge it more likely that violence will continue to be spontaneous and involve targets of opportunity; Despite a lack of shooting attacks in 20 6, firearms likely will continue to pose the greatest threat of lethal violence by WSEs due to their availability and ease of use. (U) FBI and DHS Resources about Active Shooter Situations (U) Both FBI and DHS maintain resources on the Internet that provide information on active shooter scenarios: (U) FBI: (U) DHS: OFFICIAL USE ONLY PageSof7 PARRISH OFFICIAL USE ONLY (U) Source Summary Statement (U) Domestic extremist InCIdent data collected for this intelligence bulletin froIIn 2000?20l6 was derived from Investigations, court documents, and Open source reporting; the FBI and DHSI deeIn these sources to. be I I credible and reliabie _The _open source reporting Was current as of 7 February As the Ideological motivations behind a criminal action are often underreported, ambiguousI,I- -or unclear, multiple sources help . . j. provide the corroboration neICesSary to make the case for an incident being an act of domestic extremism _When available, statements made by_ the subiects; as transcribed in _Icourt documents, were particularly helpful I I Identifying the Ideological motivations behind white supremacist extremist Violent attacks and plots I I port Suspicious Activity I To report suspicious activity, law enforcement, Fire- private security personnel, and . emergency managers shoUld follow established protocols; all other personnel should cI__al_l 9 I or 'chtact local law enforcement SUSpidqus activity reports (SARs) Will be forwarded _to the appropriate fusion center and FBI joint Terrorism Task Force for further actiOn. For more Information on the NationWIde SAR Ilnitiative, ._visit http: ifnsi. ncirc. gov/resources as'px. - - . FCI) IIOI) Information contained In this Intelligence bulletin Is for official use on IShouIIcl be released to the rnedia, the general public, or over nonsecure Internet servers. could adversely affect or jeopardize Investigative attivities: . For comments or questions related to the content or dissemination of this document please contact Counterterrorism AnalySIs Section by email at FBI Ifbi gov or the Production Branch by e-mail . . Tracked by: HSEC-8.2, HSEC-8.3, HSEC-BA, HSEC-8.5 Online news article; CBS News; Investigating Indiana Hatchet Attack as Hate Crime? 26 February 20l6; http: cbsnews. i-nvestigating- indiana- hatchetuattack- as- hate- crimel; accessed on l4 February _2 Online newspaper article, The New York Times; ?3 Men Charged with Hate Crimes In Attack on Hispanics In California?; 4 March 20l6; com/20l6lO3/05luslhate- ~crime- -charges- --lal