Attributing the Erbil Attack: The Role of Open-Source Monitoring

The February 15 rocket attack on Erbil International Airport was the second such strike on the city and the fourth major rocket attack on coalition facilities in Iraq since September 2020. Following these and other attacks, the propaganda arms of Iran-backed militias have sought to trumpet their successes against the coalition while obfuscating who carried them out. The United States and other coalition partners should therefore invest more effort in forensically linking the online “facade groups” that publicize attacks to major fasail (militias) such as Kataib Hezbollah (KH), Asaib Ahl al-Haq (AAH), Harakat Hezbollah al-Nujaba, and Kataib Sayyid al-Shuhada (KSS). Even using non-classified means, it is possible to generate strong attribution evidence through careful online analysis of each group’s makeup, language, and interactions with one another.

Attributing Erbil Using Online Evidence

The ample open-source evidence surrounding the Erbil attack strongly suggests that it was undertaken and publicized by AAH, potentially with other groups providing assistance. Anonymous media accounts and facade groups have tried to muddy attribution, slow their adversaries’ decisionmaking, and introduce enough uncertainty to make decisive retaliation politically unpalatable. Overall, however, even open-source analysis alone generates a “preponderance of evidence” (the U.S. civil standard of evidence) or a “balance of probabilities” (the British equivalent) that AAH undertook the attack.

Before reviewing this evidence, it is important to define the dramatis personae in the case, since the interconnections between the facade groups and AAH are valuable evidence in their own right. A standout feature of the Erbil attack was the prominent role of three players: Sabereen News, Ashab al-Kahf, and Saraya Awliya al-Dam (the only group to officially claim the attack):

• Sabereen. A major militia media channel with 80,000 Telegram subscribers as well as Facebook, Twitter, and YouTube accounts, Sabereen has consistently demonstrated a deep affinity with AAH and its leader, Qais al-Khazali. In its first days of operation, it signaled obedience to Khazali with the symbolic phrase “we have answered your call,” and since then it has made more special references to him than to any other militia leaders—an unusual pattern for an Iraqi militia channel. This close connection was demonstrated in November 2020, when Sabereen took AAH’s side in a public quarrel over vigilante violence in Baghdad, spurring KH to distance itself from the channel. A month later, Sabereen led calls for the release of an imprisoned AAH operative, posting “we are Asaib Ahl al-Haq.”
• Ashab al-Kahf. The links between this prominent facade group and AAH became evident when militias disagreed over the wisdom of the November 17, 2020, rocket attack on the U.S. embassy in Baghdad. Ashab al-Kahf and AAH supported the strike, while KH officials and media channels criticized it for violating a ceasefire intended to last until the Trump administration left office. Ashab al-Kahf also went further than other militia entities in subordinating itself to Khazali and seeking the release of an AAH prisoner, whereas KH entities (e.g., Unit 10,000 and affiliated channels) were muted on that issue. It is perhaps not a coincidence that one of AAH’s names around the time of its founding as a Sadrist breakaway was “Ashab al-Kahf.”
• Saraya Awliya al-Dam. Prior to the Erbil strike, this facade group had only been used to claim four minor roadside bombings of Iraqi convoys carrying coalition materiel. Notably, its statements have always been posted first on Sabereen, and while AAH-affiliated channels have mentioned the group by name many times, prominent KH insider channels have never done so. The group also claimed the August 26, 2020, roadside bombing of a UN World Food Programme vehicle in the exact area from which the September 30 rocketing of Erbil was launched: an AAH stronghold near Bartella in the Nineveh Plains.

In combination with this background knowledge, the facts of the Erbil attack provide persuasive evidence that AAH was responsible:

• Foreshadowing by Ashab al-Kahf. At 21:02 hours local time, thirteen minutes before the attack, Ashab al-Kahf posted a statement criticizing the Iraqi Kurdish leadership and threatening that “misery in Erbil is easy to bring about.” The statement was reposted one minute later by Sabereen, with other channels following suit afterward.
• Preferential early reporting by Sabereen. At 00.11 hours local time, Sabereen broke the news that Saraya Awliya al-Dam had claimed the attack. One minute later, Sabereen was again first to post the group’s 113-word statement about the attack, before all other militia channels. From then on, Sabereen and other AAH-affiliated channels led the coverage. The following day at 17.33 hours, Sabereen was also the first to post an official statement on the incident branded as Saraya Awliya al-Dam material. That statement, which criticized the United States, Turkey, and Kurdish leaders, was later reposted on the group’s Telegram account. No other group disputed or duplicated these claims, suggesting strong AAH ownership and deconfliction with other Iran-backed militias.

AAH’s involvement should not be surprising, since it closely matches the group’s well-established patterns. As noted above, AAH twice broke the militia truce with the United States by launching rockets at the U.S. embassy in Baghdad. Both attacks were heavily criticized by KH, leading to hostile messaging with AAH and a December 31 statement by Ashab al-Kahf that appeared to criticize KH strategy against the coalition and call the group “trembling hypocrites.” AAH also seemed frustrated with Iran’s perceived restraint, firing one rocket at the U.S. embassy at the very same time that Islamic Revolutionary Guard Corps-Qods Force chief Esmail Qaani was landing in Iraq for goodwill talks, embarrassing the general.

In the wake of the Erbil attack and a smaller February 22 attack on the U.S. embassy, AAH-affiliated channels resumed their squabbling with KH and other accounts, once again criticizing perceived restraint against the coalition after KH publicly distanced itself from these attacks. This came despite a KH spokesman praising an attack on Saudi Arabia last month, suggesting the group’s outward posture is not one of blanket restraint.

None of this open-source information definitively rules out the possibility that Erbil was a joint operation between AAH and smaller militias such as KSS or Kataib al-Imam Ali, nor does it spell out Iran’s precise level of involvement. Yet it does go far in peeling back the layers of obfuscation, potentially enabling authorities to impose consequences on those involved and, eventually, help victims seek redress for their injuries.

Attribution Means Accountability and Deterrence

There are many downsides when the United States and its partners cannot quickly and accurately attribute attacks to specific perpetrators: the culprits suffer no cost for their action and may conclude they can attack again without fear of retaliation; the United States looks weak, the greatest military force on earth brought low by a handful of online propagandists running Telegram, Twitter, and Facebook channels; and other adversaries in China, Russia, and North Korea take note.

The good news is that U.S. authorities can generate a preponderance of evidence for attribution using open sources and classified intelligence reporting. Although top-secret intelligence (e.g., classified signal intercepts) can provide even clearer proof of enemy actions and intentions, access to such data is limited to certain officials and is very difficult to use in policy or legal contexts for fear of comprising intelligence sources and methods. Moreover, during the COVID-19 pandemic, many U.S. government desk officers have been forced to work from home, where they lack access to classified intelligence and have learned to appreciate the “open-source revolution” of publicly accessible, if hard-to-find, information. U.S. agencies should not fall back into the habit of believing that only highly classified intelligence can provide vital clues in cases like the Erbil attack.

Indeed, to prevent militias from creating a “post-truth” environment where they are not accountable for their terrorist attacks or human rights abuses, relevant authorities in Washington and Europe will need to implement powerful intelligence collection methods that incorporate social media monitoring, artificial intelligence tools, and subject expert analysis. In the Erbil attack, strong evidence points to AAH being the lead perpetrator, but if another militia such as KSS were instead leading, this would pose complex questions about the manner in which media networks like Sabereen and facade groups like Saraya Alwiya al-Dam may be permitted to claim attacks undertaken by more shadowy cells, or may fluctuate in their alignment with different militias.

Extensive evidence gathering is particularly important due to the rising prevalence of offensive and defensive “lawfare.” Knowing that they bear legal responsibility for their actions, Iran-backed militias are now quick to blame the coalition for civilian casualties when rocket attacks go awry, and they have threatened spurious lawsuits against Iraqi and Western entities.

The ability to attribute responsibility is the first step for Iraqi and coalition victims seeking redress for injuries and unlawful deaths caused by militia bombs and rockets. The Iraqi state may bear some liability as well, since groups like AAH and KSS are legally incorporated into the state-funded Popular Mobilization Forces (PMF). Following this logic, residents of the Kurdistan Region of Iraq who were harmed in the February 15 attack could file lawsuits seeking damages against the Iraqi government, as could Baghdad residents hurt by past militia rocket strikes there.

Meanwhile, U.S. citizens harmed by these attacks may be able to recover damages under U.S. laws related to foreign sponsors of terrorism, such as the Antiterrorism and Effective Death Penalty Act (AEDPA, 1996) and the Justice Against Sponsors of Terrorism Act (JASTA, 2016). Iraq is not currently designated as a state sponsor of terrorism, but Iran is, and Washington has applied terrorism designations to AAH and KH as well. U.S. persons have successfully brought many legal cases against Iran and its proxies, including large monetary judgments against Tehran for illegal AAH acts targeting Americans in Iraq (e.g., the 2018 case Fritz v. Islamic Republic of Iran).

Crispin Smith is an associate at a Washington national security law group; his research focuses on Iraqi security, human rights, and law of armed conflict issues. Michael Knights, the Bernstein Fellow with The Washington Institute, has profiled Iran-backed militias and politicians in Iraq since 2003. Hamdi Malik is an associate fellow with the Institute, specializing in Shia militias.