*Note: This contains a correction from the original report, which incorrectly stated that Germany issues an official terrorism threat level.
European governments are warning of a heightened threat of terrorism around Christmas. We have not seen any specific calls from groups such as Islamic State or Al-Qaeda for attacks on Christmas-related targets issued through their official channels. But there are multiple signs that Islamist extremists see this as a symbolic time to mount attacks, and one when they can cause widespread disruption and gain press coverage.
An attack on a Christmas market in Berlin on 19 December is the clearest indication of this. IS claimed responsibility for that incident a day later. As with many such claims, it is unclear how much involvement the group had in directing or planning the operation. There is also little clarity about the identity of the perpetrator, his background or his motivation. But IS has increasingly been encouraging its supporters to mount attacks in the West.
Since the beginning of the Mosul offensive in October, we have observed a shift in IS propaganda away from the recruitment of supporters to join IS in Iraq and Syria. Instead, there is more emphasis on encouraging sympathisers to attack ‘the enemies of Islam’ where they live. In its Rumiyah magazine released on 7 December, IS said ‘attack them in their homes, markets, streets, clubs, and wherever they least expect it’. We expect such incitements to continue as IS loses further territory in Iraq and Syria.
Recent IS media output has suggested a broad range of possible tactics and targets. These have ranged from guides on carrying out stabbings against crowds or individuals, using a vehicle as a weapon, and detailed instructions on how to make an IED using household products. A recurring theme in this messaging is that almost any target is legitimate, and that civilian deaths are likely to have a greater impact than deaths of members of the security forces. A review of IS-claimed and inspired attacks in Europe gives a similar picture to this messaging. Civilians in crowded shopping and entertainment venues as well as on public transport have been the main targets.
The French and UK authorities have recently foiled plots to targets civilians, and jihadists and sympathisers online have been encouraging each other to target Christmas events. The official threat level for many countries in Western Europe is at either the highest or second highest level. This is the case for France, Netherlands, UK, Belgium, and Italy, for example. Comments from the German authorities suggests that they have a similar assessment of the threat, despite not publishing an official threat level.
The most recent of the foiled plots was in the UK, when police on 10 and 11 December arrested six people in connection with what they called ‘a significant plot to attack the UK’. The suspects were detained in Derby and nearby Burton upon Trent, as well as in London. It appears that there was some level of organisation to the cell, which differs from a separate trend of lone actors seeking to mount comparatively crude attacks.
Police statements have described the plot as ‘international related terrorism’. From the wording of these statements, it is unclear if the police think the suspects had direct links to a foreign terrorist group or were acting under the influence of an international group’s messaging and propaganda. But in many of the attacks in Europe this year, the authorities have said that there has been some level of direction from IS, including in what have appeared to be lone-actor incidents.
The suspects arrested in the UK reportedly planned to build an explosive device and detonate it in an unnamed shopping centre, presumably targeting Christmas shoppers. Police have said that they had already obtained some materials that can be used as components of a bomb. And it seems from the police statements, that the authorities had become aware of the plot through intelligence about the group obtaining these materials.
Based on statements from the authorities in several European states and on comments from our contacts working on counter-terrorism, a point when terrorist plots in Europe are particularly vulnerable to detection is when the militants try to get hold of restricted or controlled materials.
The foiled plot in France occurred in late November. The seven arrested suspects in that case reportedly had direct links to Islamic State, with some allegedly having fought in Iraq and Syria. The authorities said that their plan was to use firearms to attack multiple sites simultaneously, including Disneyland in Paris and the Christmas market on the Champs Elysees. A state of emergency is still in place in France, and the country remains the primary focus for much of the IS propaganda and vitriol.
The difference in tactics between the UK and France plots – explosive devices or firearms – is in line with our understanding of how the threat differs between the two countries. Firearms are harder to obtain in the UK than on mainland Europe, and so such tactics are less likely in the UK.
By: Risk Advisory’s Security Intelligence & Analysis Service