One Year of the Islamic State Worldwide Activity Map

On March 21, 2023, The Washington Institute launched the Islamic State Select Worldwide Activity Map as a way to better track and understand the global jihadist organization’s status. The ongoing project includes data on IS propaganda, claims of responsibility, financial sanctions, arrests, and other factors, providing a more holistic view of the group than attack data alone.

A year later, the data collectively paints a sobering picture. Although the core IS “provinces” in Iraq and Syria remain degraded, the group has been able to diversify at the periphery, with the Khorasan province in Afghanistan (aka IS-K) spearheading external operations while various other provinces establish territorial control in Africa. IS supporters continue to plot major terrorist attacks as well, especially in Turkey, though most of these have been thwarted by law enforcement (with the notable exception of the January 2024 bombings in Kerman, Iran). Given these evolving threats, it is worthwhile to explore the findings of the IS Activity Map project in greater detail, since they can provide a clearer picture of where the organization stands today amid growing calls to dissolve the global coalition tasked with fighting IS.

Claims of Responsibility

Since March 2023, the IS central media administration has claimed responsibility for 1,121 attacks. According to data released by the group, these attacks killed or injured around 4,770 people.

Open image

Most of these claims were issued by the “West Africa province” (ISWAP, based primarily in Nigeria and southeast Niger), followed by IS provinces in Syria, Iraq, Central Africa (based in the Democratic Republic of Congo), and Mozambique. The Khorasan province had the most damaging attacks on average, claiming around 14 casualties per incident.

Open image

The number of attacks claimed in each province remained broadly consistent with the previous year—with the notable exception of Khorasan, which claimed substantially fewer attacks than in the previous two years (see figure below). This trend likely stems from escalating Taliban military measures against the group, which have decreased IS attacks inside Afghanistan—while doing nothing to stem the increase in IS terrorist plots abroad, as discussed later in this article.

Open image

IS-Mozambique’s claims declined somewhat due to leadership attrition, which temporarily deterred its insurgency for much of last year. In the past few months, however, the province has been on the offensive again with little government response, suggesting that its claim numbers will rise again by year’s end. ISWAP likewise witnessed a slight downturn in claims, though this trend is partially attributable to the fact that IS elevated its Mali affiliate into a separate Sahel “province” in March 2022, meaning that its attacks no longer contribute to ISWAP’s count.

The Iraq and Syria provinces both continued their longer-term trends of declining attack claims. This is partly due to the IS policy of underreporting attacks in Syria, though robust Iraqi counterterrorism efforts played a role as well, as did extortion and ethnic cleansing activity by Iraqi Shia militias.

Open image

Designations and Sanctions

Since March 2023, the U.S. government has issued four designations sanctioning a total of twenty-four people for IS-related activities.  The first designation, issued June 8, 2023, targeted the organization’s intra-province governance network, the General Directorate of Provinces. The designees included Abdullah al-Rufayi, the “emir” of the directorate’s Bilad al-Rafidayn office in Iraq, and Abu Bakr al-Mainuki, a Sahel-based official with the IS media organ al-Furqan.

On July 27, the Treasury Department sanctioned Abdiweli Mohammed Yusuf, the IS-Somalia financial chief who facilitated money transfers with other African affiliates. Four days later, Treasury sanctioned eighteen people from the Maldives who were involved in local attack plots, recruitment, and criminal fundraising. The designation also targeted a Maldivian recruiter for IS-K and other individuals who facilitated the flow of foreign fighters to Afghanistan, Pakistan, and Syria.

The most recent designation, on January 30, 2024, targeted three IS financiers. Two of them—Egyptian husband-wife team Moamen al-Mawji Mahmoud Salim and Sarah Jamal Muhammad al-Sayyid—facilitated cryptocurrency donations for IS and provided technical advice to the group’s leaders and supporters. The third financier—Turkey-based Faruk Guzel—transferred donations to IS operatives in Syria.

Although these sanctions span a wide variety of locations and entities, they are all linked to the Islamic State’s intra-province funding and recruitment networks. The January designation also stemmed from a wider Treasury Department enforcement effort against illicit cryptocurrency flows. In general, however, Russia, China, Iran, and other geopolitical challenges have moved to the forefront of U.S. policy in recent years, decreasing the focus on designating IS networks—this despite the fact that the group has expanded its presence in various locales and replaced officials killed by counterterrorism operations.

Arrests

Since March 2023, the IS Activity Map has tracked 470 relevant legal cases in forty-nine different countries. Of these, 103 cases featured some type of IS-related attack plot, 88 involved social media activity or other propaganda, 55 involved financial transfers or fundraising, 42 were related to foreign fighters, and 38 involved recruitment activities. In addition, teenagers or minors were involved in at least 30 cases, and this number may be significantly higher given that many nations do not release age data for arrestees.

The locales with the most cases were Turkey (80), Iraq (63, including 8 in the Kurdistan Region), and the Autonomous Administration of North and East Syria (54), followed by India (29), Germany (26), Russia (20), Spain (12), Afghanistan (12), Canada (11), and Morocco (11). Although Turkey tends to publish sparse information about its operations against IS, the data shows that 15 of its cases since March 2023 involved financial activities benefiting IS, while 17 involved foreign nationals. In Iraq and Syria, the majority of cases involved active IS cell members or financial/logistical facilitators working on the group’s behalf. In India, the presence of local IS cells was particularly notable, comprising 18 of the country’s 29 reported cases. And in Russia, 6 of the reported 20 cases involved incidents of prisoner radicalization.

Policy Implications

Collating data in the IS Worldwide Activity Map and analyzing information beyond raw statistics has enabled the authors to identify broader trends that merit greater policy attention. This holds true even in the current environment of intense competition for U.S. government resources and time.

IS-K plots should be considered the organization’s biggest global threat today. In the past year, the Afghan affiliate has planned twenty-one external plots or attacks in nine countries, compared to eight plots or attacks in the previous year and just three between 2018 and March 2022. This trend undermines the Taliban’s repeated claims that it would prevent transnational terrorist threats emanating from its territory—a pledge it first made in the 2020 Agreement for Bringing Peace to Afghanistan, brokered by Qatar and Washington. Moreover, operatives from Tajikistan have become key nodes in IS-K’s terrorist nexus; in the past year alone, they were involved in six of the organization’s twenty-one reported plots/attacks. From a global perspective, law enforcement has been relatively good at stopping plots from turning into attacks so far. Yet if the current trends continue, regional and Western countries will need to prepare for the likelihood of more sophisticated and deadly attacks coming to fruition.

Another troubling trend is the increase in IS territorial control after years of dormancy. These gains have occurred in parts of Africa where the organization appears strongest on the ground nowadays—specifically, portions of Mali, Mozambique, and Somalia. The rise of these “provinces” as potent militant forces, coupled with the fact that holding territory will enable them to extract more resources, should push the U.S. Treasury Department to designate more leaders and operatives within these affiliates. This would not only help curb dangerous activities, but also put a bigger public spotlight on who these shadowy new figures are.

Historically, territorial control also tends to spur new foreign fighter mobilizations, and the current signs point in this direction. For example:

• Six of the IS-related legal cases in Morocco and Spain over the past year have involved networks recruiting fighters for Mali
• Sweden is reportedly becoming a recruitment node for foreign fighters headed to Somalia
• Somali authorities have arrested various Moroccans and Syrians affiliated with IS
• Filipino authorities have arrested Belgian, Egyptian, and Indonesian suspects affiliated with IS
• A number of Indian suspects have reportedly tried to travel to IS-K hotspots in Afghanistan.

In turn, new foreign fighter mobilizations create the possibility of new external operations networks down the road. If such planning hubs proliferate, they could help IS diversify how it conducts terrorist plots abroad instead of centralizing that function as it has long done (in Iraq and Syria during the territorial “caliphate” years; in Afghanistan under IS-K today).

Finally, policymakers need to keep in mind that any prospective changes to the U.S. military presence in Syria or Iraq could have far-reaching implications for global counterterrorism efforts and regional security. For example, officials are currently debating whether to transition the U.S. security relationship with Iraq from one based on the “Global Coalition to Defeat ISIS” to a true bilateral relationship, in part because the IS threat inside Iraq is deemed manageable. Yet doing so would have consequences for the counter-IS mission next door in Syria, where U.S. forces would likely lose their legal cover to conduct operations or maintain a military presence.

A U.S. withdrawal from Syria could in turn create a cascade of other security issues. For one, it would give IS a platform to return to local power—not necessarily to the same level as 2013-17, but almost certainly enough to replenish its forces, seize bits of territory in Syria (moving beyond its current “shadow governance” activity), and rebuild its operations in Iraq, thereby undermining the counterterrorism successes achieved in the past five years. This resurgence would be partly fueled by the large population of IS detainees in northeast Syria, who have not been returned to their home countries quickly enough to defuse the risk of mass escapes and breakouts. Moreover, the absence of U.S. forces would likely spur Turkey to accelerate its campaign against Washington’s main local partner on the ground, the Kurdish-led Syrian Democratic Forces (SDF), who would be compelled to pull even more resources away from the counter-IS mission. Iran and the Assad regime would also have more space to take territory in eastern Syria. In light of these scenarios, it is no surprise that IS has apparently been underreporting its attacks in Syria to lull U.S. and coalition forces into leaving.

Whatever happens in the coming year, the Institute’s IS Activity Map can help policymakers and researchers stay up to date on the latest developments as they occur—whether driven by the organization itself or by the countries fighting it.

Aaron Y. Zelin is the Levy Fellow at The Washington Institute and founder of Jihadology.net. Ilana Winter is a research assistant in the Institute’s Reinhard Program on Counterterrorism and Intelligence.