Aaron Y. Zelin is the Gloria and Ken Levy Senior Fellow at the Washington Institute for Near East Policy where his research focuses on Sunni Arab jihadi groups in North Africa and Syria as well as the trend of foreign fighting and online jihadism.
Brief Analysis
The latest attack will hopefully be an aberration in Ankara’s otherwise strong record of disrupting terrorist plots at home, though policymakers should not be lulled into complacency given the group’s proven record of evading elimination.
On January 28, two Islamic State (IS) gunmen attacked the Roman Catholic Church of Santa Maria in Istanbul, killing one person and injuring another. It was the group’s first successful attack in Turkey since January 1, 2017, when thirty-nine people were killed and seventy-nine injured in a shooting at the Reina nightclub. The toll of the church incident would likely have been much higher if the perpetrators’ guns had not jammed, averting an even worse tragedy.
The long gap between these IS attacks was not for lack of trying, however. IS external operations networks from Syria and Afghanistan had tried and failed to strike Turkey for the previous seven years, and many homegrown plots had been disrupted as well. Indeed, the scale of this plotting has been voluminous, illustrating Ankara’s ability to thwart the group’s goal of undermining security in Turkey.
IS Activity, Turkish Enforcement
Between March 2014 and January 2017, IS carried out twenty attacks inside Turkey, killing 308 people and injuring 1,167. In response, local authorities have worked aggressively to combat the group’s activities for years, conducting at least 7,726 operations against IS from 2014 to 2023. They have also deported more than 9,000 foreigners from 102 countries since 2011, on charges of being linked to IS and living in Turkey illegally.
These enforcement efforts faced steep obstacles in 2012-2015, when foreign fighters were mobilizing to and from Syria by the thousands and Ankara was unable to stop jihadist operatives from crossing its borders. Yet once Turkey built a border wall and obtained intelligence on these individuals from other governments, it was able to deal with this flow more effectively. Between 2016 and 2023, it detained 20,631 individuals and arrested 5,678.
The difference between detentions and arrests is significant. Detentions are based on intelligence data but may not meet the legal threshold for prosecution in Turkey’s judicial system, resulting in suspects being released after a short time. In contrast, arrests are made when the evidence is deemed prosecutable, and these individuals are eventually put on trial. Detentions might appear frivolous at times, but they provide authorities with opportunities to gather biometric data and gain a better understanding of jihadist networks, all of which can improve future intelligence-led investigations. Without this tactic, it is uncertain whether Turkey could have prevented so many attacks over the past seven years.
Enter Wilayat Turkiya
Although IS operatives had been plotting and conducting attacks in Turkey since 2014, it was not until April 2019 that they revealed the existence of Wilayat Turkiya, the group’s official Turkish “province.” The revelation came in a video featuring the late IS leader Abu Bakr al-Baghdadi—he was shown receiving reports from various IS “provinces” around the world, and one of the folders handed to him came from the previously unknown Wilayat Turkiya.
Besides that video, little was heard from this branch until it claimed responsibility for the latest shooting. During past waves of attacks in Turkey, IS would simply designate them as emanating from “Turkiya” without any provincial status, similar to how it handles attack claims in Western states that lack formal “provinces.” Just one other Wilayat Turkiya video is known to exist: a July 2019 production released as part of a series showing various province leaders renewing their pledges of allegiance to Baghdadi after the group lost its last bit of territorial control in Syria earlier that year. In Wilayat Turkiya’s installment, an operative named Abu Qatada al-Turki was flanked by two other IS members in a scene adorned with AK-47s, rocket-propelled grenades, and the IS flag. His message included a direct threat to Turkish president Recep Tayyip Erdogan: “Do not think that the swords of the soldiers of the caliphate are far from you and those in your camp.” Yet that was the branch’s last known public declaration prior to this week.
Interestingly, Ankara announced on May 10, 2023, that it had arrested the leader of Wilayat Turkiya, Sahap Varis, accusing him of involvement in multiple domestic plots. The announcement suggested that although the branch had gone quiet on the propaganda front for years, it continued to operate clandestinely. And now it has finally broken through with a successful attack despite being repeatedly thwarted by Turkish authorities. The question is whether this breakthrough was an aberration or part of a developing pattern (see next section).
The statement claiming the new attack was telling as well. It noted that gunmen had targeted the church in response to a January 4 audio message from IS spokesman Abu Hudhayfah al-Ansari, who called for attacks against Jews and Christians worldwide by any means possible, “without distinguishing between civilian and military apostates.”
Potential Connection to ISKP?
After the church attackers were arrested, Ankara revealed that they hailed from Tajikistan and Russia, raising questions about whether they are also connected to Wilayat Khorasan (ISKP), the Islamic State’s main external operations network these days, based in Afghanistan. Although the Interior Ministry has not disclosed any such links so far, Turkish authorities broke up several plots related to ISKP last year, and most of the foreign nationals captured in those raids were from Tajikistan (thirty detained, twenty-one arrested) or Russia (six detained, three arrested). Most notably, an ISKP-connected plot targeting Turkish churches and synagogues was broken up in late December, suggesting that this week’s attack might have been part of a broader network plan.
Moreover, Turkey is not the only country to implicate Tajik operatives in recent ISKP activities:
In April 2020, Germany arrested an attack cell led by a Tajik ISKP operative.
In October 2022, Tajik operatives assisted with an ISKP attack on Shah Cheragh Shrine in Shiraz, Iran.
In January 2023, Iran broke up another plot involving two Tajik ISKP operatives.
In February 2023, Turkey arrested Abdulmusair Gulboev (aka Mahmoud al-Tajiki), the Tajik-named head of ISKP’s alleged Transoxiana division.
In June 2023, Turkey arrested Tajik national Shamil Hukumatov (aka Abu Miskin) for recruiting people to fight alongside ISKP in Afghanistan.
In August 2023, Tajik operatives assisted with another ISKP attack on Iran’s Shah Cheragh Shrine.
In December 2023, Austria and Germany prevented an ISKP network from bombing churches; the cell included at least two Tajik operatives.
Beyond potential operational links, the ISKP propaganda arm al-Azaim Media and its multilingual magazine Khorasan Ghag (Voice of Khorasan) have been targeting Turkey for years. Much of ISKP’s hostility is rooted in Ankara’s recent diplomatic engagement with the Taliban. Historically, IS has also gone after Turkey due to the country’s secular constitution, democracy, Western ties, and cooperation with the Kurdish Peshmerga in northern Iraq, among other supposed “infidelities” to the jihadist cause.
Going Forward
IS will no doubt continue plotting inside Turkey for the foreseeable future. Yet if authorities are able to continue breaking up these plots, this week’s church attack—as tragic as it is—may be remembered as an aberration in an otherwise successful Turkish campaign against the group. Ankara appears to have a pretty firm grasp on the threat, even if the scope of its detentions and arrests is rather wide—likely a residual effect from the unprecedented domestic and foreign fighter mobilization to Iraq and Syria in the last decade.
That said, the United States can still help by providing any relevant intelligence from abroad. It should also consider pushing foreign countries to repatriate citizens accused of IS-related crimes, bringing them back home to face justice rather than letting them languish in Turkish detention facilities. Yet while this outcome would have numerous benefits for all parties, it does not seem like an emergency issue for Ankara either. Unlike the Syrian Democratic Forces (SDF)—whose detention facilities in northeast Syria are under constant threat of IS attack amid growing questions about the area’s political future—Turkey is a strong, capable state that can handle most counterterrorism challenges regardless of America’s presence or withdrawal from the region. At the same time, the church attack should serve as a sober reminder to Washington, since IS will continue the fight against the West no matter how much it may want to be done with the fight against IS.
