It has been five years since ISIS was defeated in the Syrian town of Baghuz, but the extremists are attempting a comeback in Europe.
This time is not a repeat of a decade ago, when the driving force of extremism emanated from the Middle East. Experts are witnessing a rapidly emerging threat that comes from the online radicalisation of teenagers, many with a family heritage from the Balkan or Caucasus diaspora, plus a parallel upsurge out of Central Asia, including battle-hardened veterans who once fought in Syria for ISIS.
Ken McCallum, the head of Britain's MI5 domestic intelligence agency, warned on Tuesday that the terrorist trend that concerned him most was the worsening threats from Al Qaeda, and more so from ISIS. “[ISIS] is not the force it was a decade ago,” he said. “But after a few years of being pinned well back, they’ve resumed efforts to export terrorism.”
He added that after a year of war in the Middle East, MI5 was “powerfully alive to the risk that events in the Middle East directly trigger terrorist action in the UK”.
The focus of attention for security services and law enforcement is the branch of ISIS that originated in Afghanistan, known as ISIS-K, and is named after the historical region of Khorasan that takes in parts of Central and South Asia.
The group has been proscribed as a terrorist organisation by governments across the world and it is feared it has ambitions to organise attacks in Europe as well as being the inspiration for young people to plot atrocities in its name.
In March, ISIS-K said it had carried out an attack on a Moscow concert hall that killed at least 137 people, for which four men from Central Asia have been charged. But this is not a threat limited to the former Soviet sphere.
Two 15-year-old girls and a 16-year-old boy suspected of planning an Islamist terrorist attack were arrested in Germany in April. They reportedly glorified ISIS and “declared themselves ready” to carry out the attack, say prosecutors. Their plan involved using knives and Molotov cocktails to attack worshippers in churches and police in their stations, with the cities of Dortmund, Dusseldorf and Cologne discussed as possible attack locations.
In August, three teenagers were arrested in connection with a planned terrorist attack on a concert hall in Vienna where Taylor Swift was due to perform. The main suspect pledged allegiance to ISIS-K.
Old school, new wave
Germany, Austria, France and the Nordic countries are witnessing the spread of a mixture of “old-school, more traditional” extremists with direct connections to ISIS-K, and young people radicalised via social media rather than in mosques or face-to-face conversations, said Lorenzo Vidino, a prominent extremism researcher. Led down dangerous paths by algorithms, they are sometimes indoctrinated in a matter of weeks.
“You have these young kids born and raised in Europe,” said Mr Vidino, who has appeared as a witness for the Austrian government in cases against the Muslim Brotherhood. “In many cases their ethnicity is almost irrelevant – they’re European kids, whether their parents are Macedonian, Moroccan, it doesn’t matter. The ethnic barrier is often meaningless to them and they are mostly online clusters, very independent.”
France, too, has seen arrests, this time with a common background based on their heritage. In April, a 16 year old from the Haute-Savoie region of eastern France was arrested for allegedly researching how to make an explosives belt and die as an ISIS operative, possibly targeting the Olympics. In May, an 18-year-old man was indicted for alleged plans to target spectators in the city of Saint-Etienne during the Games.
Alexandre Rodde, a terrorism and mass casualty incident analyst, explained that the threat to France comes from younger extremists with family ties to the Caucasus.
“The question of projected attacks from ISIS-K is a concern by the authorities,” said Mr Rodde, who is also a reserve officer in the Gendarmerie Nationale, and a visiting fellow at Coventry University's Protective Security Lab. “For France it was mostly from Chechnya, Ingushetia and Dagestan. What we’ve seen was a number of kids who took inspiration from ISIS-K and tried to organise attacks based on the motivation they got from that.”
Mr Rodde said there has been “an emulation effect” in which young extremists seek to be more extreme than their peers. Such fledging attackers do not communicate with each other or have access to the kind of network they used to, so they are harder to detect. “But that means they don’t have access to weapons that they used to, so they use weapons that are easier to buy and use, such as knives,” he said.
Central Asians
ISIS-K has been in existence for around nine years and has emerged as the main part of the organisation dedicated to attacking targets outside its stronghold. Its first leader, Hafiz Saeed, is believed to have been killed in a US drone strike in 2016, but ISIS-K has remained intact even while the core ISIS group diminished.
While the European and North Africa recruits perished in Syria and Iraq or found themselves on databases, the eastern recruits were filtering into Europe, unknown to the authorities.
Jerome Drevon, senior analyst at International Crisis Group, explained that when it comes to Islamic extremism in Europe “the people involved are very different from the past”.
“If you look at all the plots and if you speak to European security services, they will tell you that 90 per cent of the risks really come from ISIS-K,” he told The National. “Most of the foreign fighters in Syria were killed, and thousands remain in prison, but some managed to escape.”
Mr Drevon said in the case of Central Asians, there was little prospect of them being able to reintegrate into their homelands, so made their way to Ukraine, either by boat via Turkey or overland through Bulgaria. In the aftermath of the Russian invasion of Ukraine, these former ISIS fighters went to Western Europe as refugees and began to recruit among their communities, particularly in Germany where there is a Central Asian diaspora, he said.
Peter Neumann, professor of security studies at King’s College London, said the war in Ukraine is a key factor in them being in western Europe. “The rapid expansion of ISIS-K operations in western Europe is intrinsically linked – ironically and unintentionally – to the Russian invasion of Ukraine,” he said.
“Almost all of the people that have been arrested since 2022, in Europe, came to western Europe as Ukrainian refugees. If you speak to security agencies anywhere in Europe, they will confirm that many of them have come to Europe.”
Among the assorted foiled plots were a group of terrorist suspects arrested in Germany and the Netherlands in July last year who were accused of planning an ISIS-inspired attack. At least seven of them were said to have left Ukraine early in 2022. They came from Turkmenistan, Kyrgyzstan and Tajikistan.
Further arrests have been made over a plot to attack Cologne Cathedral, plus support for ISIS. In 2022, five Tajik men were imprisoned in Germany for membership of a local cell that received orders from ISIS-K in Afghanistan.
Long tail
These Central Asians represent the “long tail” of ISIS, say experts on the region Noah Tucker and Edward Lemon, in a recent paper for the Centre for Combating Terrorism at the West Point Military Academy in the US.
“What remains is a small but resilient contingent of individuals dedicated to the cause and still determined to carry out attacks,” they wrote. “There are now well-established networks of enablers to facilitate fake passports, safe houses and support for operations, including classic insurgency-style, network-based recruiting.”
The Balkans connection
Recent years have seen teenagers with family links to the Balkans either commit acts of ISIS-inspired violence or come on to the radar of law enforcement organisations for ties to the extremists.
The gunman who killed four people in Vienna in November 2020 was a dual citizen of Austria and North Macedonia, and a convicted ISIS supporter. Kujtim Fejzulai was shot dead by police nine minutes after the 20 year old opened fire with an AK-47 in the historic city centre. An inquiry found that Austrian intelligence agents should have raised the alarm about a known ISIS supporter. He had served 18 months in jail for trying to join ISIS in Syria in 2019, which said it was behind the murders.
A 14-year-old girl from Montenegro was arrested in May in the southern Austrian city of Graz after buying a knife and axe for an attack she was allegedly plotting. ISIS material was also found on her computer.
Detectives say the main suspect in the Taylor Swift concert plot is a 19-year-old Austrian with roots in North Macedonia, who had recently sworn loyalty to ISIS and changed his appearance to suit Islamist propaganda. It is alleged he was working with a 17-year-old accomplice, Luca K, who had Turkish and Croatian roots and was working at the Taylor Swift venue.
“Judging from data from recent cases of individuals involved in violent jihadist-motivated plots and attacks in western Europe it is clear that a new pattern is emerging,” said Adrian Shtuni, an expert on violent extremism and terrorism in the western Balkans.
He said an “important demographic feature of the emerging pattern relates to the background of these teenagers, increasingly described by law enforcement as nationals or residents with western Balkan family background or dual nationality”.
Mr Shtuni is a Washington DC-based foreign policy and security specialist who is chief executive of Shtuni Consulting. He said the western Balkans are home to the largest indigenous Muslim population in Europe and the Palestinian issue resonates significantly in the region, and with the diaspora.
“This is particularly the case with those from the diaspora who originate from countries like Bosnia, North Macedonia and Kosovo that experienced bloody interethnic conflicts with clear religious undertones during the dissolution of Yugoslavia,” he said.
He said that “while none of the teenagers in question have experienced those wars first hand, their family members’ experiences and narratives have marked their personal and social identity”. This makes them "particularly sensitive to current developments in Gaza and susceptible to manipulative interpretations that aim to incite, radicalise and elicit violent responses from them”.
Mr Shtuni said these young extremists make use of and rely on virtual communities of like-minded individuals and encrypted messaging apps for networking, logistics, and planning plots.
“These radicalised individuals are predominantly teenagers mostly unknown to the security services, who tend to go through an accelerated process of radicalisation via social media and other online resources,” he said.
Challenges ahead
Security services “need to fight terrorism in Europe, because we’re no longer doing it in Afghanistan or West Africa, or in the Middle East” believes Hans-Jakob Schindler, a former German diplomat who worked for a UN team monitoring ISIS and Al Qaeda.
But when it comes to dealing with teenagers who may – or may not – have become radicalised, the Austrian experience shows this is often easier said than done.
The country's security services, which had been shaken up since 2020, faced criticism for failing to detect the Taylor Swift plot, which was foiled reportedly thanks to a tip-off from the US. Despite the country having an extremism hotline, based in a counselling centre, which fields hundreds of calls, it appears nobody contacted it about the concert plot.
Werne Prinzjakowitsch, a youth worker who works at the centre, said “some part of the system failed”. He added: “That could have been a point where one of [the attacker's] colleagues or one of his family could have called the counselling centre. In this case, the system never started to work.”
