The head of America’s counterterrorism enterprise assesses which threats will demand the most attention over the next year, from racially motivated extremists in the homeland to ISIS and al-Qaeda offshoots in Africa.
On January 10, The Washington Institute hosted a virtual Policy Forum with Christine Abizaid, director of the National Counterterrorism Center (NCTC). The following is her statement for the record.
Happy New Year, and thank you for the invitation to speak to this distinguished group today about counterterrorism and the current threat landscape. Despite significant progress in diminishing the terrorist threat to the United States, the country continues to face a diversified, transnational, and in many ways unpredictable threat environment both at home and abroad. An array of actors, whether foreign terrorist organizations (FTOs), state sponsors of terrorism, or lone actors, are shaping the nature of today’s terrorism landscape. This persistent threat environment exists amid an ongoing transition for the CT community where CT, while still critical, is one of many competing priorities the U.S. national security community must be postured to address.
Internationally, Russia’s invasion of and war in Ukraine, China’s growing economic and security assertiveness, Iran’s destabilizing activities in the Middle East and beyond, North Korea’s confrontational behavior, and the growing capabilities of a number of cyberactors, for example, are among the most consequential challenges to U.S. national security. At the same time, violent extremism continues to fuel threats against the West in a growing swath of territory from the African Sahel to Southeast Asia, and contributes to worsening humanitarian conditions in regions like Afghanistan, Somalia, and Yemen. Notably, this diffusion of the threat, while challenging, has resulted in a less concentrated and effective terrorist capability directed inside the homeland.
Terrorist organizations such as ISIS and al-Qaeda and the violent extremists they inspire take advantage of developing nations, political instability, and undergoverned territory to entrench themselves in difficult operating environments and ingratiate themselves with local populations. These movements remain committed to attacking U.S. persons and facilities worldwide even as they balance those goals against local gains. These groups represent the most urgent threat to U.S. interests overseas.
In the homeland, we remain concerned about al-Qaeda and ISIS but assess that the threat they pose here is less acute than at any other time since 9/11, a judgment consistent with what we expressed last year. In fact, the most likely threat in the United States is from lone actors, including those inspired by foreign terrorist organizations and foreign racially and ethnically motivated violent extremists (REMVEs).
Against the backdrop of this threat landscape, whether overseas or at home, NCTC remains focused on uncovering and disrupting transnational networks from which threats to Americans and America are likely to emerge. Even as we monitor the threat, we also must evaluate the state of the CT community’s ability to address it. This role is even more critical as resources shift away from CT, and we need to account for the sustained ability to meet the threat, however it evolves.
The Main Threat Inside the United States
Unlike twenty-one years ago, the American public today is more likely to experience a terrorist attack by an individual attacker than a highly structured terrorist organization. Today’s lone-actor threats can mobilize in unpredictable ways based on a variety of motivations.
These individuals almost certainly mobilize to violence independently without direction from specific groups. Since 9/11, there have been thirty-seven attacks in the homeland inspired by al-Qaeda or ISIS, compared to eight that involved a direct connection to these groups. Similarly, during the last twelve years, all of the seventeen REMVE attacks by actors espousing the superiority of the white race were by individuals who radicalized at least in part online and who mobilized to violence as lone actors, many of whom were inspired by foreign REMVE attackers and their manifestos.
FTOs Inspiring Lone Actors
We remain concerned and vigilant regarding the threat from lone actors and small groups inspired by FTOs. Since 2001, the threat emanating from these individuals has evolved from one defined by complex, large-scale attacks directed by an FTO to mostly simple, self-initiated attacks inspired by an FTO. Messaging directed at these individuals to conduct attacks has decreased, although they continue to draw inspiration from historical publications such as Inspire magazine (published by al-Qaeda in the Arabian Peninsula, or AQAP) and ISIS messaging.
Domestic Violent Extremists
NCTC supports the FBI and the Department of Homeland Security in analyzing the threat in the homeland posed by violent extremists with international and transnational terrorism connections. The REMVE threat in particular has significant links to transnational actors whose plots and professed ideology encourage mobilization to violence by those vulnerable to their messaging. The transnational REMVE threat is largely fluid, fragmented, and lacking in hierarchical structures, with proponents framing actions around the concept of leaderless resistance.
The links between U.S.-based REMVEs and their foreign counterparts mostly involve the bidirectional sharing of violent extremist messaging, mutual grievances, manifestos of successful attackers, and encouragement for lone-actor violence, such as by the Buffalo shooter. As with other terrorism challenges, REMVEs anywhere can operate transnationally by exploiting a world connected by social media and other online platforms. Even as technology companies improve their capabilities to detect and respond to violent extremist content online, REMVEs and their supporters find new methods to spread their message.
Disrupting Terrorist Travel and Securing the Border
NCTC also supports efforts to prevent terrorist infiltration of the homeland. Identifying known or suspected terrorists or their affiliates who seek to infiltrate U.S. borders by land, sea, or air is central to the U.S. government’s CT strategy. NCTC collaborates regularly with its partners and, on their behalf, state and local partners to build a common threat picture to enable operating partners to protect the U.S. border. In particular, NCTC continues to support the U.S. government’s screening and vetting enterprise and plays a critical role in refugee and immigration processing by identifying any connections to international terrorism, not only for the applicant, but also for appropriate members of the applicant’s family.
The Terrorist Threat Overseas Continues to Evolve
Turning to the overseas environment, foreign terrorist movements worldwide continue to inspire followers and enable attack plotting against the United States, Americans, and other Western countries. ISIS and al-Qaeda, the two leading foreign terrorist threats to U.S. interests, continue to aspire to attack U.S. and other Western interests but have been more effective at pursuing operations against regional and local adversaries. CT pressure by the United States and foreign partners during the past fifteen years has been critical in degrading the capability of these groups, particularly in disrupting experienced leaders and operatives and exacting sustained pressure against key networks.
The ISIS Global Enterprise
In Iraq and Syria, ISIS remains an intact, centrally led organization that will most likely continue to pose a global threat to U.S. and other Western interests as well as local populations. Despite losing more than a dozen senior leaders during the past three years, it continues to wage a low-level insurgency in Iraq and Syria since its territorial defeat in 2018 and commands a cohesive global network that has allowed the group to sustain its influence—and in some areas such as Africa, expand its recruitment and operations. We assess that in February of last year, after a raid that killed its overall “emir,” ISIS transitioned seamlessly to a new emir. ISIS members readily accepted the new leader, and we see no signs of fissures or splintering by the branches and networks despite limitations the group faces in Iraq and Syria.
Even under new leadership, ISIS remains committed to its long-term goal of establishing an Islamic caliphate and continues to exploit undergoverned areas in Iraq and Syria, where it currently operates as a clandestine insurgency. This year, ISIS prioritized and attacked a detention facility in northeast Syria that housed key ISIS leaders and experienced fighters. While we assess most of the high-value detainees were either recaptured or killed as local forces responded to the attack, the operation itself signifies the organization’s ability to stage high-profile attacks and prioritize efforts to replenish its dwindling ranks. We have witnessed subsequent calls and efforts, including by ISIS branches as far away as West Africa, to free imprisoned members. The group’s capabilities and trajectory will remain dependent upon the level of counterterrorism pressure it faces, particularly by CT actors who continue to routinely disrupt ISIS facilitation networks and operations.
One of the primary mechanisms ISIS uses to threaten the West is its media outlets. Even as its overall media capabilities have declined compared to its early years, the most prolific ISIS threat to the United States or other Western countries is through inspired attackers who are vulnerable to influence by ISIS messaging. The group’s ability to inspire violence was most recently demonstrated by an ISIS supporter who carried out an attack in Oslo in June of last year, which killed two and injured twenty-one. Pro-ISIS supporter groups have also helped augment the organization’s media presence by creating, archiving, translating, and disseminating multilingual propaganda online. One such group supporting ISIS-Khorasan published English-language media focused on delegitimizing the United States and denigrating the Taliban.
While we have seen a decline in the number of ISIS-inspired attacks in the West since peaking in 2017, such operations remain a priority for the organization. The group also still aspires to deploy operatives to the West, and we continue to monitor for threats against high-visibility, attractive regional targets that would have similarly high impact and provide propaganda value and publicity, such as the recent World Cup in Qatar.
More broadly, ISIS has continued to grow its global enterprise, which now includes approximately twenty branches and networks, through which ISIS leaders project strength and dispel the narrative of its defeat. In March of last year, ISIS recognized its newest branch, ISIS in the Sahel. In July, the branch claimed responsibility for an attack on Nigeria’s Kuje prison—located just twenty-seven miles away from the U.S. embassy—in which almost 1,000 prisoners were released, including some terrorists.
ISIS has also used its branches and networks to choreograph global attack campaigns since 2019, the most recent of which was in April of last year to avenge the death of the group’s overall emir. ISIS elements in Iraq and Syria led in the number of attack claims and were boosted by ISIS-West Africa and ISIS-Khorasan, the branches we consider to be among the group’s most capable.
Last year, ISIS-Khorasan expanded its ambitions outside Afghanistan with a handful of cross-border rocket attacks against Tajikistan and Uzbekistan and a foiled plot in India. Its ambitions for attacking the West—possibly including the homeland—remains a top intelligence priority, notwithstanding the withdrawal of U.S. forces from Afghanistan in August 2021.
ISIS is also exploiting uneven local CT pressure in Central, East, and Southern Africa to expand its presence, increase connectivity, and develop new capabilities beyond its traditional strongholds in North and West Africa. The group’s expansion in Mozambique increasingly threatens Western-led energy projects there, while signs of ISIS influence in the Democratic Republic of Congo, South Africa, and elsewhere in the region demonstrate its growing appeal across the continent.
Al-Qaeda Post-Zawahiri
The death of al-Qaeda’s longtime leader Ayman al-Zawahiri last July in Kabul dealt an important strategic and symbolic blow to the al-Qaeda network, which he led from relative isolation for more than a decade. Zawahiri was a respected ideological leader among the al-Qaeda global network who strove to enhance interconnectivity across the organization’s dispersed regional affiliates.
Now months past the operation that killed him, the group has yet to publicly announce a successor. Among the remaining al-Qaeda veterans are several Iran-based senior leaders, most notably Saif al-Adel and Abd al-Rahman al-Maghrebi, who probably continue to provide ideological and strategic guidance to the global network. Other al-Qaeda leaders featured in globally and regionally focused media are in charge of the regional affiliates and likely consult across a distributed leadership team about the network’s direction.
Al-Qaeda’s Iran-based senior leaders oversee the global network, which includes regional affiliates in Africa, the Middle East, and South Asia as well as various local networks that support the affiliates. Starting in West Africa, al-Qaeda’s Jamaat Nusrat al-Islam wal-Muslimin (JNIM) is increasingly threatening capital cities in the Sahel while combating local militaries, operatives from ISIS in the Sahel, and Russian paramilitary forces in Mali. In July of last year, the group attacked Mali’s largest military camp located just outside Bamako, underscoring its capabilities and growing boldness in the region. JNIM probably hopes to exploit the departure of French forces from Mali earlier this year to accelerate its growth and entrenchment, including into littoral West African states such as Benin, Cote d’Ivoire, and Togo. CT concerns in the region have further led to instability fueling nondemocratic transitions of power, most recently in Burkina Faso.
In the Horn of Africa, we remain concerned about the continued threat that al-Shabab poses to U.S. citizens and Western interests. Al-Shabab is the wealthiest and most lethal of all al-Qaeda affiliates, controls large portions of southern Somalia, and has demonstrated the capability to carry out successful operations across the region, including against U.S. service members.
In North Africa, al-Qaeda in the Islamic Maghreb (AQIM) has experienced setbacks from CT pressure since early 2018, but probably provides guidance to other al-Qaeda elements in the region, particularly JNIM. Since 2020, Algerian Yazid Mebrak has been serving as AQIM’s leader and playing a key role in al-Qaeda’s management of global operations, including the abduction and killing of Americans.
Turning to the Middle East and Yemen, AQAP is intent on conducting operations in the West and against U.S. and allied regional interests. It has proven itself to be among the al-Qaeda network’s most creative branches but has faced significant CT pressure in recent years, creating hurdles for the group’s external operations planning. In June 2021, AQAP published its sixth issue of Inspire Guide, which provides operational guidance for would-be attackers in the homeland and suggests the group still maintains a viable media capability, despite the death of its key propagandist that year.
In Syria, al-Qaeda elements under the banner of Huras al-Din have struggled to stabilize their footing and experienced numerous leadership losses and pressure from rival group Hayat Tahrir al-Sham. However, these elements could use their traditional safe haven in opposition-controlled territory to target U.S. and other Western interests in the region.
Finally, in Afghanistan, al-Qaeda’s South Asia affiliate, al-Qaeda in the Indian Subcontinent (AQIS), is the weakest group in the organization’s global network. Al-Qaeda remains intent on striking U.S. interests and inspiring its followers to do so but currently lacks a capability to direct attacks against the United States from Afghanistan. Separate from AQIS, there are probably fewer than a dozen al-Qaeda legacy members with historical ties to the group located in Afghanistan, and some may have been there prior to the fall of Kabul; we have no indication that these legacy members remaining in Afghanistan are involved in external attack plotting.
Iranian Threat to the United States
Transitioning to threats emanating from Iran and its partners and proxies, Iran continues to encourage and support plots against the United States at home and abroad, especially in the Middle East. Iran and Lebanese Hezbollah have remained intent on retaliating for the death of Islamic Revolutionary Guard Corps-Qods Force (IRGC-QF) commander Qasem Soleimani, with Iran plotting attacks against former U.S. officials. Iran is pursuing a diverse campaign that employs legal, financial, and lethal action in pursuit of its revenge. Tehran has publicly threatened to conduct lethal operations including against former president Donald Trump and former secretary of state Mike Pompeo, and has recently increased its threats of lethal action in the homeland. This past August, an Iran-based IRGC member was charged with attempting to arrange the murder of former national security advisor John Bolton in the United States.
Iran also pursues a campaign against anti-Iranian regime dissidents around the world, including in the United States. In July 2021, U.S. law enforcement charged an Iranian intelligence official and four others with attempting to kidnap an Iranian American journalist in New York and forcibly returning her to Iran. And last July, a man with a loaded assault weapon was arrested after behaving suspiciously outside the same journalist’s home. Iran has also demonstrated its willingness to engage in terrorism in the Middle East, as evidenced last June when Turkish authorities arrested members of an Iranian cell planning to kidnap and assassinate Israeli citizens in Istanbul. The plot was intended as retaliation for an alleged Israeli operation in Tehran. Separately, Iran-backed militants in Iraq and Syria target U.S. forces with unmanned aircraft systems and indirect fire attacks as they try to compel their withdrawal from the region.
Evolving the CT Enterprise
The complexity of the threat just outlined continues to demand a collaborative, agile, and appropriately resourced CT effort to mitigate terrorist threats to the United States. In the twenty-one years since 9/11, the U.S. government has developed just that: a highly integrated, innovative, and successful CT enterprise that continues to adapt to the nature of the threat. CT practitioners work behind the scenes every day to ensure that interconnected CT operations and programs are effectively used and employ a wide range of tools, including identity intelligence, diplomatic security, sanctions, law enforcement investigations, high-value target operations, and partner capacity-building efforts.
Even as other priorities demand attention from the U.S. national security community, CT remains foundational to our national security. The CT enterprise must preserve CT fundamentals—such as collection, warning, analysis, disruption, information sharing, and key partnerships—that ultimately give the national security community the time and space to focus on non-CT priorities. NCTC and its CT partners throughout the U.S. government are working toward a sustainable and enduring level of support to this mission that maintains our strategic success and creates space for investments in other national security priorities.
Looking Ahead
Maintaining an efficient and effective CT architecture is an ongoing mission, and ourprogress during the past twenty-one years has been a whole-of-government effort. As we look to posture for evolving threats and national securitypriorities, we must ensure that we capitalize on the CT infrastructure and relationshipsbuilt since 9/11 in support of other national security efforts. An interconnected threatenvironment fueled by great power competition, regional conflicts, and humanitarianemergencies has the potential to escalate threats quickly. We must ensure that our CTenterprise, including our international and U.S.-based partners, retains the ability to stopthreats and stay abreast of a continually evolving threat picture.
Let me end by thanking the incredible community of intelligence, diplomatic, military, and law enforcement professionals whose dedication to the CT mission has done so much to protect this country and its citizens from a persistent and amorphous adversary. It is a privilege to be part of today’s CT enterprise and to work on behalf of the American people, and I look forward to a challenging, but rewarding, year ahead.
The Policy Forum series is made possible through the generosity of the Florence and Robert Kaufman Family.
