Equipo Nizkor - Beyond the Caliphate: Islamic State activity outside the group's defined Wilayat

KEY FINDINGS

The Islamic State is leveraging local militant groups in Southeast Asia to solidify and expand its presence in the region.

Forty-five percent of Islamic State-linked attacks and plots in the region had financial and communication ties to Southeast Asian Islamic State operatives in Syria where group members sought to enable and guide attacks remotely.

While the majority of Islamic State activity in Southeast Asia occurred in Malaysia and Indonesia, most attacks were conducted in the Philippines, specifically in regions where local militant groups have engaged in violent conflict with the state.

In the Philippines, the most common attack target was the military, and the most common attack method was the use of small arms.

Although the Islamic State has yet to declare an official wilaya (province or governorate) in Southeast Asia, a flurry of activity in the region that has been tied to the group has taken place over the past three years. |1| This includes a siege–on-going at the time of this release–of the Philippine town of Marawi on the island of Mindanao by militants associated with the Maute group. As of May 30, 2017, the death toll in Marawi stood at 65 militants, 20 government soldiers, and 24 civilians. |2|

Since June 2014, the Maute group and other militant organizations active in Southeast Asia have pledged bay'a (allegiance) to the Islamic State. |3| (For a list of these bay'a pledges, see table on page 5.) Nearly one year ago, in June 2016, the Islamic State released its first official video about Southeast Asia, which focused on the Philippines. |4| The Islamic State used the video to anoint Abu Abdulla al-Fil-ipini, or Isnilon Hapilon–the individual who is being hunted by the Philippine military in Marawi–as its local emir of the Philippines. |5| This appointment, and the events of last week, illustrate how the Islamic State's interest, and influence, in the region is growing.

The following analysis employs an open source dataset of directly linked and conceptually inspired Islamic State attacks, plots, and arrests for support of the organization in Southeast Asia from June 2014 through April 2017. |6| It is important to note that since the Islamic State did not

officially claim any event in Southeast Asia until January 2016, Combating Terrorism Center researchers coded events prior to this point as being linked to or inspired by the Islamic State only if government and/or credible media sources asserted that the Islamic State was responsible for or had inspired the event.

Fig 1. Islamic State Affiliated Activity in Southeast Asia
June 2014-April 2017

Mapped by Brandon Mohrfor the Combating Terrorism Center at West Point; Service Layer Credits: Source: Esri, DigitalGlobe, GeoEye, Earthstar Geographies, CNES/Airbus DS, USDA, USGS, AEX, Getmapping Aerogrid, IGN, IGP, swisstopo, and the GIS User Community.

Geographic Overview

The dataset consists of 20 attacks, 35 plots, and 88 events of arrests for support activity for the Islamic State in Southeast Asia. As the map illustrates, Islamic State activity occurred primarily in Malaysia (41%), Indonesia (36%), the Philippines (17%), and Singapore (6%). |7| Over the time period studied, the majority of attacks, however, occurred in the Philippines (50%) and Indonesia (45%), with only 5% conducted in Malaysia.

In stark contrast to attacks, the majority of plots occurred in Malaysia (43%) and Indonesia (37%), while only 14% of plots occurred in the Philippines. A similar breakdown by country is evident in the support activity data.

The difference between plot and support activity data with that of attacks could be explained by the historical presence of jihadi groups, like Jemaah Islamiyah (JI) and Abu Sayyaf, in Indonesia and the Philippines. |8| The experiences of local networks in these states provide access to resources and capabilities that could help cells to better orchestrate and execute attacks. This disparity could also be explained by the different counterterrorism capabilities and authorities that Malaysia, Indonesia, and the Philippines possess. |9|

Fig 2 Activity by Country

Country Attacks Plots Support Total

Philippines 10 5 9 24

Malaysia 1 15 42 58

Indonesia 9 13 29 51

Myanmar 0 1 0 1

Brunei 0 0 1 1

Singapore 0 1 7 8

Operational Dynamics

Connections to the Islamic State in Syria: The majority of attacks and plots (60%) in Southeast Asia from June 2014 through April 2017 were linked to Islamic State operatives. |10| For these linked attacks and plots, evidence indicates that Islamic State operatives in Syria directed, funded, or were in contact with local cells and individuals in the region who were sympathetic to the Islamic State. Southeast Asian foreign fighters providing direction from Iraq and Syria likely aided this level of connected activity. Indeed, Southeast Asian foreign fighters in Syria facilitated 45% of linked plots and attacks in the dataset.

Most notably, Malaysian Muhammad Wanndy Mohamad Jedi and Indonesian Bahrun Naim, who fought with the Islamic State in Syria, have served as key players in the facilitation of plots and attacks back home in Southeast Asia. |11| In the three-year time span studied, Jedi has orchestrated three plots and one attack in Malaysia. Naim has directed four plots and two attacks in Indonesia. Both Jedi and Naim communicated with local cells using Telegram, |12| and in some instances, they transferred funds |13| to local individuals to conduct attacks.

Beyond demonstrating formal financial and communication ties between agents of the caliphate in Syria and sympathetic cells in Southeast Asia, the cases of Jedi and Naim also speak to a certain level of Islamic State interest in fomenting violent activity in Malaysia and Indonesia. |14| As noted earlier, the Islamic State released its first official video about Southeast Asia, and the Philippines in particular, in June 2016. |15| Although the organization has yet to declare an official wilaya in the region, in the video the Islamic State appointed Isnilon Hapilon (who publicly pledged bay'a to Abu Bakr al-Baghdadi in 2014 |16|) as the emir of the Philippines. The appointment was significant as Hapilon has long been active with a number of militant groups in the Philippines. This includes time spent with the Moro National Liberation Front and serving as a senior leader with Abu Sayyaf. |17|

Foreign fighters in Raqqa from Malaysia, Indonesia, and the Philippines were also interviewed in the June 2016 video. Similar to calls made by other Islamic State foreign fighters, the Malaysian fighter called on the Muslims of Malaysia, Indonesia, Thailand, and the Philippines to travel to Syria or the Philippines to engage in jihad. If they were unable to do so, they were instructed to carry out attacks against infidels in their home countries.

Local Networks: The data also indicates that the Islamic State is building relations with, and leveraging, local militant organizations to further embed itself in the Southeast Asian region. Southeast Asian jihadi organizations have a history of discipleship. |18| Young jihadi recruits typically have a "strong personal loyalty" to their mentors. |19| The jihadi network in the region is fluid, and individuals "float between Al Qaeda groups" or Islamic State affiliates due to patronage. |20| With this fluidity comes interconnectivity between groups, allowing for Islamic State thought and ties to disperse across the region.

Philippine soldiers raise a flag in a southern town after clashes with Islamic State-affiliated militants.

This fluidity seems to be having operational effects as well. Local terrorist groups orchestrated 40% of attacks and plots in the dataset. Groups like the Jemaah Ansharut Daulah |21| in Indonesia and the Maute Group |22| in the Philippines are conducting attacks to advance their agendas, gain publicity, and earn notice from the Islamic State. |23| The Maute group in particular conducted the second most lethal attack in the dataset. |24| On September 2, 2016, the group bombed a night market in Davao City, resulting in 15 dead and 71 wounded. The attack was conducted in conjunction with an Abu Sayyaf faction and Ansarul Khilafah Philippines, |25| indicating both the fluidity and varying levels of cooperation among local groups.

Islamic State activity in the Philippines also occurs in areas where local insurgent groups are active. The overwhelming majority of Islamic State attacks in Southeast Asia, for example, occurred in territory where Abu Sayyaf yields influence |26| or in Mindanao where the Maute Group operates. |27|

The dynamics of the assault on the city of Marawi in May 2017 further illustrate the level of fluidity and inter-group collaboration, and the emergence of local operational alliances, between militant entities that have either pledged bay'a to the Islamic State or are acting locally as representatives of it. For example, it has been reported that militants from the Maute group are responsible for the attack on Marawi and that their assault on the city (which apparently had been planned for some time) coincided with an effort by the Philippine military to hunt down Hapilon. |28|

Lack of clarity about the organizational coherence and status of Abu Sayyaf and the nature of Hapilon's new position further complicates what is already a fairly messy and evolving picture. Similar to al-Shabaab in Somalia, parts of Abu Sayyaf's leadership have identified with the Islamic State, but the organization as a whole has not publicly pledged bay'a to al-Baghdadi. A video released on the jihadi forums in January 2016 demonstrates, however, that–in addition to serving as a senior Abu Sayyaf com-mander–Hapilon serves as the leader of a new alliance of four Philippine units, which includes Abu Sayyaf in Basilan - Katibat (Brigade) Abu Dujana and three other smaller groups (Ansarul Khilafah, Katibat Ansar al-Shari-ah, and Ma'rakat al-Ansar in Sulu) that previously pledged baya to the Islamic State. |29| This new meta-grouping is primarily active in the Mindanao region. |30| Yet, besides these four local groups, it is not yet clear how far-ranging the Islamic State's appointment of Hapilon as its emir for the Philippines is or how it affects entities like Maute and other Abu Sayyaf factions.

The list of Southeast Asian groups that have pledged baya to the Islamic State underscores that al-Baghdadi's group has a number of willing partners in the region.

These dynamics indicate, first, that there is a desire by some local groups to officially be part of the Islamic State and, second, that the Islamic State does want to incorporate local Philippine groups into its mission (and that it might already be cooperating with some of them) but is approaching the issue with some trepidation. The caution to declare an official wilaya could be rooted in the Islamic State's past experience, particularly its quick expansion through various parts of Africa. The Islamic State's acceptance of Boko Haram's baya and the creation of its West Africa wilaya, for example, not only expanded the Islamic State's territory and "soft power" but also brought new dilemmas to overcome and address. |31| By acknowledging a bay'a but not declaring a wilaya, the Islamic State reaps the benefits of local jihadi groups but bears none of the burden of formal association with those same entities. It is worth remembering that even though some of these same local groups had meaningful operational ties to al-Qa'ida, al-Zawahiri's organization never established a formal al-Qa"ida affiliate in the region.

Table 1 Bay'a Pledges by Southeast Asian Groups

Weapons: Islamic State activity in Southeast Asia has relied heavily on small arms and explosive devices. |32| Of the 20 attacks, seven attacks used small arms, six used explosive devices, two used explosive devices and a knife or an ax, and one used both small arms and explosive devices. Plots diverged from attacks in that 18 of the 35 plots planned to use explosives.

Fig 3 Weapons Used in Islamic State Attacks

For Figures 3 and 4, n=20.

Surprisingly, Islamic State attacks and plots in Southeast Asia have not relied heavily on the use of suicide bombers. According to the CTC data, suicide bombers have only been used on three separate occasions, all in Indonesia. Two of these attacks were linked directly to Naim and the Islamic State in Syria, while the third was an inspired attack where the bomber's device failed to detonate. |33|

One other point worth noting is the involvement of females in operations in Southeast Asia. The Islamic State in the Levant typically does not use women to conduct military operations, including suicide attacks, but cells linked to the Islamic State in Southeast Asia have planned to use female suicide bombers. In fact, two separate plots tied to Naim that were disrupted in Indonesia in December 2016 involved using females in suicide bomber roles. |34|

Targets: Due to the small sample size of attacks and plots (which often do not have a precise or disclosed target), caution should be used in trying to identify trends in what the Islamic State intends to target in Southeast Asia. When it comes to attacks, all but one attack had a single target as opposed to multiple target types (e.g. targeting a police station and a cafe during the same attack). |35| The data also reveals that Islamic State-linked or -inspired attacks in Southeast Asia tend to target the military (25%), police (20%), and businesses (20%). All of the attacks that targeted military personnel or facilities used small arms and occurred in the southern portion of the Philippines where Abu Sayyaf has its stronghold and is in violent conflict with the Philippine military. As one might expect, these events were more insurgent in character. The four attacks on two other types of targets (businesses and police) occurred in other countries across the region in Indonesia, Malaysia, and the Philippines.

Fig 4 Target of Islamic State Attacks

Regarding the plot data, over 20% of plots targeted local or foreign governments. Three plots were thwarted in Malaysia and Indonesia, respectively, while one was disbanded in the Philippines. All but one attempted to use an explosive device, three of which planned to use a suicide delivery system. Four of the seven plots that planned to target a local or foreign government were linked to the Islamic State in Syria.

Conclusion

The Islamic State appears to be embedding itself and expanding its influence in Southeast Asia by leveraging local groups and networks of inspired individuals to plot, plan, and conduct attacks in a number of local countries. The group's appointment of a regional emir for the Philippines but its hesitancy to officially declare a wilaya in Southeast Asia strongly suggests that the group is taking a 'wait and see' approach and is currently more focused on building out its capabilities and connections in the region. The Islamic State's decision in this regard could be a matter of timing. It could also be tied to local circumstances and the presence of a number of jihadi organizations–like Abu Sayyaf and Jl–that have long been active in the region and still hold a certain level of local, militant sway and influence. The lack of an official Islamic State wilaya in the region could also speak to a reluctance on the part of groups like JI and

Abu Sayyaf to throw their lot in with al-Baghdadi's group. Besides being able to inspire small networks or to splinter factions from these larger, more established groups to conduct a series of one-off attacks, the Islamic State's strategic and long-term viability in the region is likely tied to how it navigates and manages relations with the region's jihadi old guard, and particularly those groups that have seized terrain and carved out safe-haven areas. Developments in this space will be a key indicator of the Islamic State's broader plans in the region.

Although the data did not identify Myanmar as an important area for Islamic State operational events or support activity, anecdotal evidence suggests that this may be changing. The persecuted Rohingya Muslim minority has inspired Southeast Asian Islamic State networks to plan terrorist activity in Myanmar and in their respective countries against symbols of the Myanmar government. |36| This is supported by one failed plot in Indonesia, which was under the direction of Islamic State operative Naim, that planned to target the Myanmar Embassy. |37| These dynamics suggest that the Islamic State, like other jihadi groups, view the Rohingya issue as an opportunity area.

Currently, the Islamic State poses a growing threat to local governments in Southeast Asia. To minimize the risk of a ratcheting up of the threat, or an increase in the capability and sophistication of local Islamic State-linked actors, careful attention should also be placed on mon-itoring–and preventing–the return of Southeast Asian foreign fighters who have spent time with Islamic State Central in Syria and Iraq. As demonstrated in France and Belgium, individuals with this type of experience have served as key nodes and operational enablers to facilitate strategic and high-profile Islamic State attacks in Europe. And there is a danger that Southeast Asia is an area where the Islamic State could follow a similar playbook.

The Combating Terrorism Center is an independent, privately funded, research and educational institution situated at West Point that contributes to the academic body of knowledge and informs counterterrorism policy and strategy.

[Source: By Marielle Ness, Combating Terrorism Center, West Point Militar Academy, Jan18]

Notes:

1. Southeast Asia is defined in this study as the Philippines, Malaysia, Indonesia, Vietnam, Laos, Cambodia, Thailand, Myanmar, Brunei, Singapore, and East Timor. [Back]

2. Felipe Villamor, "Filipinos Who Fled ISIS-Inspired Fighting: 'There Was Gunfire Everywhere,'" New York Times, May 30, 2017. [Back]

3. "ISIL Bay'a Timeline," ISIL, Syria & Iraq Resources, Combating Terrorism Center; "Chapter 2. Country Reports: East Asia and Pacific Overview," Country Reports on Terrorism 2015, U.S. Department of State Bureau of Counterterrorism and Countering Violent Extremism, 2015. [Back]

4. "The Solid Structure" (video), Media Office of the Philippines, The Islamic State, June 21, 2016; in a video released by the Islamic State on December 26, 2015, "al-Baghdadi specifically included the Bangsamoro struggle (in the Philippines) as one of several campaigns that Muslims from around the world should support." For background, see Peter Chalk, "The Islamic State in the Philippines: A Looming Shadow in Southeast Asia?" CTC Sentinel 9:3 (2016): pp. 10-13. [Back]

5. The Islamic State has more recently referred to the Philippines and the Southeast Asian region more broadly as "East Asia." [Back]

6. Support, as defined in this study, is any type of assistance an individual provides the Islamic State that ends in an arrest, including but not limited to recruitment, facilitation of travel, monetary or material support, virtual support, or personnel support. For more information on all categories, see the CTC's Beyond the Caliphate project webpage at https://www.ctc.usma.edu/programs-resources/beyond-the-caliphate-2. [Back]

7. The geographic visualization of Islamic State activity in Southeast Asia was constructed using geo-coordinates of events from the dataset. Only 13 events did not have corresponding geo-coordinates and were, therefore, excluded from the visualization. Where there was a high concentration of events, geo-coordinates were dispersed so all would be visible; activity includes attacks, plots, and arrests for support of the organization. [Back]

8. JI has had a historical presence in Malaysia as well, but the organization's network has been degraded in that country. The author thanks Dr. Shashi Jayakumar for this point. [Back]

9. Zachary Abuza, "The Strategic and Tactical Implications of the Islamic State on Southeast Asia's Militant Groups," Asian Studies at Georgetown University, Fall 2016, p. 23; Joseph Chinyong Liow, "ISIS in the Pacific: Assessing terrorism in Southeast Asia and the threat to the homeland," Brookings Institution, April 2016. [Back]

10. For a historical overview of other types of terrorism activity in the region, to include that not perpetrated by or linked to the Islamic State, see the Global Terrorism Database. [Back]

11. According to Malaysian authorities, Jedi was killed in late April 2017. "Top Malaysian ISIS Terrorist Muhammad Wanndy Mohamed Jedi is Dead: Police Chief," Straits Times, May 8, 2017. [Back]

12. Francis Chan, "Another Suspect held over plot to attack Marina Bay," Straits Times, September 6, 2016; Fergus Jensen, "Indonesia arrests six suspected of plotting Singapore 'rocket attack,'" Reuters, August 5, 2016. [Back]

13. Rukmini Callimachi, "Not 'Lone Wolves' After all: How ISIS Guides World's Terror Plots from Afar," New York Times, February 4, 2017; "Indonesia police say arrest of woman in bomb plot points to new militant tactic,'" Reuters, December 11, 2016; Muh Taufiqurrohman and Ardi Putra Prasetya, "A Rising Indonesian Jihadist Plotter; Bahrun Naim," Counter Terrorist Trends and Analysis 8:11 (2016): p. 8. [Back]

14. Some secondary sources have reported that foreign fighters in Syria, specifically Jedi, are under pressure from Islamic State leadership to foment attacks in their home region. For background, see "ISIS' Malaysian Leader 'Has deadline to Stage Attacks,'" Straits Times, April 27, 2017. The author would like to thank Dr. Shashi Jayakumar for this point and for providing the source. [Back]

15. "The Solid Structure." [Back]

16. "Isnilon Totoni Hapilon," Most Wanted, Federal Bureau of Investigation. [Back]

17. "Chapter 6. Foreign Terrorist Organizations," Country Reports on Terrorism 2015, U.S. Department of State Bureau of Counterterrorism and Countering Violent Extremism, 2015. [Back]

18. Marc Sageman, Understanding Terror Networks (Philadelphia: Penn Press, 2004), p. 113. [Back]

19. Marc Sageman cites this as a social affiliation of discipleship. See Sageman, p. 114. [Back]

20. Abuza, p. 21. [Back]

21. For more information, see "State Department Terrorist Designation of Jamaah Ansharut Daulah," U.S. Department of State Bureau of Counterterrorism and Countering Violent Extremism, January 10, 2017. [Back]

22. For more information, see "Philippines 2017 Crime & Safety Report," U.S. Department of State Bureau of Diplomatic Security, 2017. [Back]

23. Felipe Villamor, "Philippine Police Arrest 2 More in September Bombing of Night Market," New York Times, January 13, 2017. [Back]

24. The Maute Group is operationally linked to JI. It also has familial and marital ties to the Moro Islamic Liberation Front. For more information, see Alex Ho, "AFP overruns extremists' camp in Lanao, 45 killed since fighting erupted," CNN Philippines, February 26, 2016, and Chiara Zambrano, "The ties that bind MILF and Maute Group," ABS CBN News, March 3, 2016. [Back]

25. "Nineteenth report of the Analytical Support and Sanctions Monitoring Team concerning Islamic State in Iraq and the Levant (Da'esh), Al-Qaida and associated individuals, groups, undertakings and entities," United Nations Security Council Counter-Terrorism Committee, January 13, 2017, p. 19. [Back]

26. Maricris Faderugao, "Abu Sayyaf Threatens To Kill Canadian Hostage on June 13 If S16 Million Ransom Is Not Paid," International Business Times, May 16, 2016; "South Korean and Filipino hostages released by Abu Sayyaf," Deutsche Welle, January 14, 2017. [Back]

27. John Unson, "Maute Group Beheads 2 Captive Sawmill Workers," Philistar, April 13, 2016. [Back]

28. Felipe Villamor, "Mindanao, a Philippines Island, is Placed Under Martial Law," New York Times, May 23, 2017. [Back]

29. For background, see "Pro-ISIS Groups in Mindanao and their Links to Indonesia and Malaysia," IPAC Report No. 33, October 25, 2016. [Back]

30. Ibid. [Back]

31. Max Siollun, "ISIS replaced Boko Haram's leader for being too bloodthirsty - now the group's splintering," Business Insider, October 4, 2016. [Back]

32. Explosive device is defined as anything that combusts, including but not limited to suicide vests, suicide vehicles, IEDs, and grenades. [Back]

33. For background on Islamic State attacks in the region, see Shashi Jayakumar, "The Islamic State looks East," CTC Sentinel 10:2 (2017): pp. 28-29. [Back]

34. Abu Musab al-Zarqawi, the former leader of the Islamic State's predecessor group, al-Qa'ida in Iraq, dispatched female suicide bomber Sajida al-Rishawi to Jordan in the mid-2000s. Al-Rishawi's failed in her attempt, was detained, and was later executed by the Jordanian government. For more information, see Rod Nordland and Ranya Kadri, "All-but-Forgotten Prisoner in Jordan Is at Center of Swap Demanded by ISIS," New York Times, January 28, 2015, and Umm Sumayyah al-Muhajirah, "A Jihad Without Fighting," Dabiq, September 2015, pp. 40-45. [Back]

35. This outlier event was the attack by Jamaah Ansharut Daulah and directed by Naim that occurred on January 14, 2016, in Jakarta, where perpetrators targeted multiple locations across the city. [Back]

36. Rozanna Latiff, "Myanmar faces danger from Islamic State militants, Malaysian police say," Reuters, January 4, 2017. [Back]

37. "Indonesian Police Arrest 4 NearJakarta as Terrorist Plot is Foiled," New York Times, December 10, 2016; "Indonesia police make more arrests in foiled Jakarta bomb plot," Reuters, November 27, 2016. [Back]

Information
Bookshop \| Donate Derechos \| Equipo Nizkor

Country	Attacks	Plots	Support	Total
Philippines	10	5	9	24
Malaysia	1	15	42	58
Indonesia	9	13	29	51
Myanmar	0	1	0	1
Brunei	0	0	1	1
Singapore	0	1	7	8

Jan18

Beyond the Caliphate: Islamic State activity outside the group's defined Wilayat Southeast Asia

[Source: By Marielle Ness, Combating Terrorism Center, West Point Militar Academy, Jan18]

Beyond the Caliphate: Islamic State activity outside the group's defined Wilayat
Southeast Asia