The Islamic State’s External Operations Are More Than Just ISKP

Since the beginning of the year, counterterrorism and law enforcement efforts have zeroed in on the Islamic State’s Khorasan “province” (ISKP). This is unsurprising given that governments have connected ISKP to recent large-scale attacks and plots in Iran, Turkey, Russia, and Europe. Yet other provinces in the IS global network have also been involved in external operations planning—albeit unsuccessfully until the July 15 mass shooting against Shia worshippers in Oman, the first jihadist attack in that country’s history. For this reason, it is more important than ever to understand that IS today has a multipronged strategy to target its enemies, and this strategy is coordinated via its General Directorate of Provinces—individual “provinces” do not have independent strategies.

In the first half of 2024, there have been eight IS external plots and attacks unrelated to ISKP and seventeen related to ISKP. Regarding the successful attacks in Iran, Turkey, and Russia, governments disclosed the ISKP connection, but IS itself did not claim any of them for ISKP. The Turkish incident was designated as a Turkey “province” attack. Of the plots not related to ISKP, three have been connected to the IS province in Iraq (two in Germany, one in Kuwait), two were connected to the Syria province (in Israel and France), and the others were connected to the Somalia and Pakistan provinces (in Sweden and India, respectively). Given the frequency of such plots since January, more can be expected by year’s end.

With the Oman attack, it is still too early to know how it unfolded or what planning was behind it. Most likely, however, it was connected to IS-Yemen. From 2017 to 2019, IS leaders in Iraq and Syria asked the Yemen province to plan attacks in Oman targeting the embassies of countries that participated in the global coalition fighting the organization in Iraq and Syria. Hopefully, the Omani government will be transparent in its investigation and enable a better understanding of the network behind the incident, with Washington providing any necessary assistance based on its strong signals intelligence capabilities. Either way, the foiled plots not related to ISKP can help shed light on the Islamic State’s global plans.

IS Iraq External Operations

The first of these plots was broken up by Kuwaiti authorities in late January when two citizens returned from training in Iraq, where they were tasked by a Kuwaiti IS operative called “al-Shatri” with conducting an attack at home. Once in Kuwait, they recruited two friends and remained in touch with al-Shatri. After an Iraqi government interrogation of a captured IS operative, Kuwaiti security services were informed of the connection and broke up the plot.

The two German plots were disclosed in mid-May and mid-June. In the former, an Iraqi national identified as “Najem A. M.” was arrested in the Bavarian town of Kaufbeuren for belonging to IS. He had joined the organization in Iraq no later than December 2016 and worked in its “police force” when it controlled territory there. After entering Germany in early 2023, he maintained his connections with IS in Iraq and was prepared to carry out operations on its behalf. That fall, he received $2,500 from the group, likely related to his attack plot, which was eventually thwarted by German security services.

In the second case, an Iraqi identified as “Mahmoud A.” was arrested in the town of Esslingen southeast of Stuttgart for plotting to carry out IS attacks in Germany. He had joined IS in Iraq in May 2016 while the organization controlled territory there and also fought on its behalf. He arrived in Germany in October 2022 and awaited orders to conduct attacks, but was arrested by local authorities before he could actualize any plans.

IS Syria External Operations

This year’s first thwarted operation related to the IS province in Syria came to light in late February, when Israeli security services arrested four Palestinians for manufacturing around one hundred explosive devices. Murad Marqatan, who headed the cell, had made the explosives using online guides as well as instructions he received from IS operatives in Syria. The cell also possessed assault rifles and submachine guns and was planning to attack Israeli troops in the West Bank.

In late May, an eighteen-year-old Russian national from Chechnya was arrested for plotting to attack a stadium in Saint-Etienne, France, during the Olympics. He had communicated online with a Chechen IS operative in Syria and surveilled the stadium ahead of his arrest.

IS Somalia and Pakistan External Operations

Two additional IS plots were uncovered this year in Sweden and India. In early March, four people were arrested in Stockholm on weapons charges and accused of preparing an unspecified terrorist attack. According to Swedish police, the suspects were in contact with the IS province in Somalia.

In late May, four Sri Lankan nationals were arrested at the Sardar Vallabhbhai Patel International Airport in Ahmedabad, India, after traveling there from Colombo. According to local investigators, they were in contact with IS handlers from Pakistan who directed them to target Jewish sites and Hindu leaders in India; they were also instructed to retrieve three pistols hidden in Ahmedabad’s Nana Chiloda neighborhood.

The Future of IS External Operations

All of these cases and the attack in Oman illustrate that IS external operations must be understood in a global sense across the organization’s various provinces, and not in the same discrete ways as previously. Gone are the days when IS only plotted abroad from Iraq and Syria (and, to a lesser extent, Libya). Rather, its General Directorate of Provinces helps coordinate this external operations campaign across its various branches; this is why one now sees pan-provincial plots. In turn, this strategy creates more resilience for IS as a whole, since it can continue operating abroad even if individual branches face separate law enforcement or military challenges.

Accordingly, the U.S. government should provide additional budgets and personnel to those tracking and attempting to thwart the Islamic State’s global aims. It is better to invest more now than to wait until a future crisis in which much more will be needed. Prompt action would enable the government to balance other national security priorities such as China, Russia, and the Hamas-Israel conflict. Officials should also investigate ways to better manage or increase interagency resources for these endeavors, striking a more effective balance between the under-resourcing of the pre-9/11 era and the higher resourcing of the post-9/11 era. This process should be based on lessons learned about what is necessary, without degrading capabilities.

As for Oman, this month’s attack is likely an outlier and therefore should not transform how the United States looks at its current policies toward IS. There is very little history of Omani involvement in jihadism over the past three decades, and this attack is probably not a harbinger of more to come. Yet the incident does highlight the organization’s continued efforts to hatch plots in locales that seem outside its normal areas of operation, and thus to surprise authorities when it pulls off attacks there (e.g., the Sri Lanka bombings a few years ago).

For the U.S. government, the Oman attack makes clear that while the ISKP external operations threat is important, more attention should be devoted to plotting by the entire IS global network, including how these plots are interlinked. If Washington focuses on just one province at the expense of others—or without considering the coordination between them through the General Directorate of Provinces—key signals will be missed.

Given how IS has reorganized its external operations over the past five years, this fall’s meeting of the Global Coalition to Defeat ISIS is a perfect place to address this issue so that coalition countries can better coordinate their efforts with Washington and fill in any intelligence gaps. This will help expand the coalition’s focus from the future of IS in Iraq and Syria (which remain important) to newer and more immediate threats from more distant “provinces.” Coalition meetings also provide an opportunity for Washington to press other countries to follow the U.S. Treasury in designating IS operatives and facilitators globally.

Prompt action is important because the challenge is only becoming tougher. Today, the United States and its coalition partners cannot exert as much influence in certain theaters as they have in Iraq and Syria due to adversaries controlling the counterterrorism space, such as Russia in the Sahel or the Taliban in Afghanistan. Therefore, policymakers should be aware that greater risks will emerge in the coming phase of counter-IS operations due to competition with these and other actors.

Aaron Zelin is the Levy Senior Fellow at The Washington Institute and creator of its interactive Islamic State Worldwide Activity Map.