ISIS: An Adaptive Hybrid Threat in Transition

ISIS: An Adaptive Hybrid Threat in Transition

Scott Jasper and Scott Moreland

Even as coalition forces mass on the suburbs of Mosul and prepare their assault on the last major ISIS stronghold in Iraq, strategic planners are far from declaring victory. After all, only two years ago the Islamic State of Iraq and Syria (ISIS) or ISIL, captured the Middle East and the world by storm when they launched their bold and brutal offensive across broad swathes of Iraq and Syria.  Major cities from Ramadi to Aleppo were toppled like dominoes, and for a time even Baghdad appeared vulnerable.  Today, as ISIS begrudgingly withdraws from occupied territories, they are re-inventing themselves as a transnational threat, as evidenced by horrific ISIS-affiliated or inspired terror attacks in Brussels, Paris, Jakarta, San Bernardino, and Manhattan.[i]  US ground commander Lieutenant General Sean McFarland’s grave warning is already proving prophetic:  “Military success in Iraq and Syria will not necessarily mean the end of [ISIS]. We can expect the enemy to adapt, to morph into a true insurgent force and terrorist organization capable of horrific attacks.”[ii]

Since its inception, ISIS has distinguished itself from other terror organizations in its ambition and tactics, which many defense analysts have characterized as a hybrid threat.  To be certain, the ISIS of 2016 looks and acts very differently than it did two years ago, a testament to their ability to rapidly transition from a position of relative strength and adapt to face an overmatching adversary and persevere for the long-term.  Despite the loss of ground, ISIS will continue to use multivariant activities to target vulnerabilities and achieve synergistic effects. This article re-visits the authors’ assertion in a previous SWJ publication[iii] that ISIS is indeed a hybrid threat, and that this characterization has implications for decision-makers and planners.  The authors propose a conceptual framework for countering ISIS based upon an analysis of their key characteristics and use of a model for understanding and predicting likely transitions and adaptations that hybrid threats employ in response to fluid operational conditions.

Hybrid Threat Characteristics

Hybrid threats are broadly recognized as a distinct form of adversary that requires new countering strategies and approaches.  The United States Army was one of the early proponents of a hybrid threat concept, and has devoted considerable study and doctrinal development to adjust to the reality of hybrid threats.  As early as 2010, an Army Training Circular described the hybrid threat as a “diverse and dynamic combination of regular forces, irregular forces, and/or criminal elements all unified to achieve mutually benefiting effects.”[iv]  The Army’s work appeared to be influenced by Frank Hoffman’s seminal discussions that identified Hezbollah as a ‘hybrid threat’ in the wake of the 2006 Second Lebanon War.  Hoffman was among the first to propose a set of hybrid threat characteristics, which included[v]:

• Blended modalities.  Hybrid threats use a combination of conventional and non-conventional tactics combined with terrorism and criminal activities.
• Simultaneity.  Hybrid adversaries can employ different modes of conflict simultaneously in a coherent way.
• Fusion.  Hybrid threats are comprised of a mix of professional soldiers, terrorists, guerrilla fighters, and criminal thugs.
• Criminality.  Hybrid threats use criminal activity to sustain operations and, in some cases, as a deliberate mode of conflict.

NATO was likewise an early proponent of a concept for Alliance participation in a comprehensive approach to countering hybrid threats.  Beginning in 2010, the Alliance embarked on an experiment to better appreciate whether hybrid threats represented a sufficient variation in adversary tactics that would require NATO to adapt in response.  Ultimately, NATO determined that hybrid threats represented a departure from the current threat categories.   Unlike NATO’s historically conventional adversaries or even the Taliban-led insurgency in Afghanistan, the emerging hybrid threat possessed  ‘the ability to simultaneously employ conventional and non-conventional means adaptively in pursuit of their objectives.’[vi]

More recently, the European Union commissioned a 2015 ‘food-for-thought’ paper titled “Countering Hybrid Threats.”[vii]  This paper asserted that hybrid threats had dramatically changed Europe’s security environment.  The paper highlighted Russia’s aggression in the Ukraine and ISIS’ global ideological appeal and their operational successes in the Middle East.  The paper led to the adoption of the recent EU Joint Framework on Countering Hybrid Threats.  The EU Framework recognizes that definitions of hybrid threats vary but aims to capture “the mixture of coercive and subversive activity, conventional and unconventional methods (i.e. diplomatic, military, economic, technological), which can be used in a coordinated manner by state or non-state actors to achieve specific objectives while remaining below the threshold of formally declared warfare.”[viii]

In their previous SWJ article, the authors offered a consolidated interpretation of hybrid threat characteristics based on Hoffman’s original list and subsequent study and experimentation.  For the past two years, this reprised list of characteristics has been applied and vetted in various postgraduate level forums.  Based on an analysis of ISIS operations, the authors propose this list of recurrent hybrid threat characteristics[ix]:

• Blended Tactics.  Hybrid threats combine conventional military capabilities with small unit guerrilla tactics and highly mobile standoff engagement systems.  
• Flexible structures.  Hybrid threats organize in conventional formations or distributed cells.  Governance components assert control and sustain operations.
• Terrorism.  Hybrid threats utilize terror campaigns to proliferate hate and strike fear.  They target cultural icons, identities and beliefs that oppose their ideologies.
• Disregard for International Law.  Hybrid threats cynically view international laws as a constraint upon their adversaries that can be exploited. 
• Information warfare.  Hybrid threats exploit global information access and tools to spread jihadist schemes, raise funds, recruit, train and operate.
• Organized criminal activity. Hybrid threats use crime and fundraising to generate revenue to fight, govern, and sustain operations.

For much of 2014, ISIS imposed their dystopian version of a regional caliphate across occupied territories.  In their inexorable march, ISIS captured major cities, terrorized communities, and asserted their ruthless brand of authority as the Iraqi government and international community stood by in bewilderment.  Since 2015, a more coherent international counter-offensive has slowly re-claimed much of the seized territory.  Now in 2016, ISIS is about to lose its stronghold in Mosul and maybe Raqqa.  While accepting regional losses, ISIS has modified its objectives, composition, and tactics as it aims to sustain longer-term aspirations.

An Adaptive Threat

The U.S. Army’s under-appreciated early work on hybrid threats may hold the key understanding of how hybrid threats like ISIS transition and adapt to changing conditions in their operational space.  Army TC 7-100, Hybrid Threats, suggests that while a hybrid threat’s strategic aspirations are enduring, their wartime operations are phased in time and space.  The Army identifies three distinct operational designs:  regional operations, transitional operations, and adaptive operations, as illustrated in the figure below.

Regional Operations

Hybrid threats seek opportunities where and when there are vacuums in governance and rule of law.  Regional operations take place when a hybrid threat determines that it has a viable opportunity to seize local or regional power through decisive military action.   Generally, the conditions are ripe for regional operations when there is a weak state government, a malleable or sympathetic population base, access to illicit finances and arms, and limited likelihood of direct intervention from extra-regional adversaries.  Regional operations are primarily offensive actions using all available hybrid threat components to paralyze opponents. 

ISIS recognized this opportunity in mid 2013 in the cross-border region that encompasses eastern Syria and northwestern Iraq.  At that time, an embattled Bashir al Assad struggled to hold on to power in Syria in the face of externally enabled rebel factions.  Meanwhile, the new government in neighboring Iraq was riven by factional infighting as U.S. and coalition forces withdrew from the region.  ISIS liberated itself from a contested bid to supplant al Assad, focusing instead on vulnerable, resource rich cross-border targets, starting with the town of Raqqa in March 2013.[x]

The 2014 ISIS march into Iraq sought objectives using networks of ideological sympathizers, black market commerce, and defensible terrain that would form the nucleus of an “Islamic State.”  ISIS quickly amassed a potent conventional army through alignment with dissident military leaders and seizure of military equipment.  By June of 2014, ISIS held sway over a broad swathe of Iraq and Syria, including the cities of Fallujah, Mosul, and Tikrit.  It took the capture of Mosul Dam in August 2014 to galvanize Western forces to intervene with air strikes in an attempt to avert an imminent humanitarian catastrophe and stall the ISIS advance before it reached Baghdad.  

Transition Operations

Hybrid threats are highly responsive to changes in the battle space.  The hybrid threat will shift to transition operations to deal with other regional and/or extra regional actors that contemplate intervention.  The immediate goal is preservation of instruments of power. Transition operations are characterized as a mixture of offensive and defensive actions that aim to change the conditions of the conflict to regain competitive advantage and control of the operational tempo.  Transition operations overlap regional and adaptive operations, and therefore tend to be short duration.  However, some of the changes initiated during transition operations, including shifts in organizational structures and tactics, may be reflective of a longer-term hybrid threat adaptation.[xi]

After Western intervention in late summer of 2014, ISIS was able to sustain their regional operations by shifting tactics to reduce vulnerability to foreign air strikes. However by the winter, the ISIS offensive was stalled in the Iraq-Turkey border town of Kobani.  Militants were mired in urban combat against an entrenched Kurdish Peshmerga force that was reinforced by coalition air power and airdropped supplies.  By early 2015, coalition forces had finally coordinated a semi-coherent counter-offensive, slowly forcing ISIS to shift tactics and fight more asymmetrically.  The transitional ISIS playbook featured more cellular operations, terrorist tactics such as suicide bombers and vehicle-borne explosives, and passive defenses including barriers, mines, and booby traps.[xii]

Through 2015 and into early 2016, coalition forces gained momentum and moved to retake ISIS-held cities and choke supply lines. ISIS transitioned to an organized withdrawal and re-consolidation in their centers of gravity in Raqqa and Mosul.  As they withdrew, ISIS left a wake of destruction in their path.  For example when Iraqi Army forces liberated Fallujah in June 2016, they found a shell of a city plagued with a gutted infrastructure, littered with booby traps, and populated by traumatized civilians who had been trapped in the midst of the fighting. [xiii]

Adaptive Operations

When hybrid threats are no longer able to control terrain or decisively shape battlefield conditions as a consequence of intervention from outside the region, they may be forced to engage in adaptive operations.  These are primarily defensive operations that degrade the enemy’s will and capability to fight.  The immediate goal is survival, while, the long-term goal is still the expansion of influence. The aim of adaptive operations is to find sanctuary and preserve power while gaining time for aggressive strategic operations to succeed. 

Today, as ISIS struggles to maintain a grip on Mosul, it seems likely that they will be forced into a period of consolidation and adaption to operate from sanctuary.  They will attempt to sustain their center of gravity in Raqqa and control of Syrian oil fields, which comprise as much as a third of Syria’s total oil production.[xiv] As they lose ground and associated financing, ISIS will seek to expand their global presence through disbursed regional cells, loosely aligned affiliates, aggressive cyber propaganda and recruiting campaigns, and spectacular terror attacks.  ISIS terror cells are already wracking Western Europe from Paris to Brussels, and cropping up across the globe, as evidenced by the January Jakarta bombing.[xv]  FBI Director James Comey recently stated “the threat I think will dominate the next five years... will be the crushing of the caliphate.”  That is because “hundreds of hardened killers, who are not going to die on the battlefield...are going to flow out.”[xvi]  Many will head into Western Europe to attack and maintain ISIS credibility.

There is no doubt ISIS has shifted in composition and tactics over the past two years.  Any recommendations for offsetting strategies to defeat them in future operations should start with an understanding of how ISIS fits the six characteristics of a hybrid threat in each operational design in order to predict persistent threats and risks. 

Blended Tactics

Regional:  In the assault on Mosul in June 2014, ISIS forces numbered between 500 and 800 fighters traveling in 150 vehicles in conventional formations.[xvii] After the seizure of three divisions and three depots of Iraqi equipment near Mosul, military experts remarked their arsenal more closely resembled a conventional army than an insurgency.[xviii] Victories followed immediately in Baiji and Tikrit, where ISIS deployed over sixty tactical vehicles.  The ISIS movement was reinforced by thousands of insurgents freed from Baiji prisons and emboldened by the capture of an important military base in Tikrit, prompting the Iraqi government to declare the ISIS advance as a “strategic disaster.”[xix]

Transition:  In May 2015, ISIS changed its battle plan in the seizure of Ramadi.  They displayed admirable operational security by silencing social media and converging in nondescript sedans. Over a three day assault, ISIS used at least 27 vehicle-borne improvised explosive devices built on the chassis of stolen armored vehicles to destroy Iraqi security force defensive perimeters and collapse buildings.[xx]   Six months later in their defense of Ramadi against 10,000 Iraqi troops, ISIS constructed elaborate defenses and covered them with sniper, machine-gun and mortar fire in an attempt to hold terrain.[xxi]

Adaptive: ISIS has also employed asymmetric weapons in the form of FN-6 man-portable air-defense systems. Militants have shot down at least one Mi-35M attack helicopter and one Bell 407 scout helicopter.[xxii]  They have also used cheap drones for everything from propaganda videos, to surveillance and fire spotting, and even weapons delivery.   For example ISIS used a drone strapped with an explosive to attack a checkpoint. [xxiii]  Even more concerning is their use of standoff engagement systems to deliver chemical weapons.  For instance militants fired rockets carrying mustard gas in a powered form in an attempt to recapture Deir ez-Zor military airport in Syria in April 2016.[xxiv]

Flexible Structures

Regional:  As ISIS fighters seized territory in Iraq and Syria in 2014, they built an effective management structure overseeing departments of finance, arms, governance, operations and recruitment.  Many of their leadership team included military officers from Saddam Hussein’s disbanded Baathist army imprisoned by American forces.  Not only did ISIS fight like an army in this period, but they also concentrated on holding ground and asserting control.  In seized cities, such as Palmyra, ISIS initially carried out summary executions but then acted like municipal functionaries, fixing power plants and water pumps, while hosting their black flag.[xxv]

Transition:  As coalition forces intervened and ISIS withdrew from occupied towns and bases they left devastation behind.  For example, when families finally returned to Fallujah after a year and half occupation by ISIS that ended in June 2016, they found an empty city with destroyed buildings and no electricity or running water.  Likewise after Iraqi forces seized back the Qayara air base south of Mosul in July 2016, they discovered the base was almost completely destroyed by retreating ISIS militants.  From the moment they took it over, militants stripped wire from buildings, flattened blast walls, razed airplane hangars, and mined runways.[xxvi]       

Adaptive:  Although the territorial expansion of ISIS in Iraq and Syria is being reversed, their influence has expanded into new regions through a series of franchises.[xxvii]  For example ISIS claimed responsibility in Tunisia for the deadly attack on the Bardo National Museum in the capital in March 2015.  In Yemen, that same week, a group claiming affiliation with ISIS bombed two mosques in San’a killing more than 100 people.  In a more visible presence, ISIS took control of Sirte, Libya in November 2015.  And in West Africa, ISIS bombed an African Union vehicle in Mogadishu in March 2016 and is now attempting to lure away al-Shabaab operatives.  Finally, ISIS claimed responsibility for a recent attack on a police training center in Pakistan in October 2016.

Terrorism

Regional:  As ISIS seized towns in 2014 they used cruel acts of terrorism to subdue local populations and promulgate hate propaganda.  Their brutal method of conquest consisted of destroying Shiite shrines, executing resisters, overrunning security forces, and hoisting their black flag above government buildings, while posting photos online of militants patrolling the city.^[xxviii]  They also attempted to scare Westerners with highly publicized beheadings.^[xxix]  Meanwhile ISIS committed genocide in an effort to exterminate the Yazidi religious minority in Syria and Iraq according to United Nations investigators.  

Transition:  Not content with mass killings, ISIS also targeted cultural icons and religious centers with an aim to eradicate entire societies. Over a two year period the militants have destroyed ancient sites and artifacts which they say promote idolatry.  Among the demolished sites are the ancient Assyrian city of Nimrud in Iraq and artifacts at Hatra and in a museum in Mosul.  ISIS even beheaded a prominent antiquities scholar in Palmyra in August 2015.[xxx]    

Adaptive:  The main shift in terror attacks has of course been to extra-regional targets, with the most sensational in the Paris suburbs in November 2015 and at the Brussels international airport in March 2016.   The sending of operatives abroad is coordinated by the Emni, a core part of ISIS operations. Emni trainees led the Paris attacks and built the suitcase bombs used at the terminal in Brussels. The group has sent “hundreds of operatives” back to the European Union.[xxxi]  Still many recruits are told not to come to Syria for training but to stay put and carry out jihad at home, such as the knife attacker did at a Minnesota mall in September 2016 as a “soldier of the Islamic State.”[xxxii]

Disregard for International Law

Regional:  ISIS has demonstrated disregard for internationally accepted laws and universal humanitarian rights.  Starting in 2014, they have conducted mass executions of minority groups and captured soldiers, marching them off into the desert to mass graves to be shot at close range.  A UN Panel report affirmed that ISIS fighters has raped, sexually mutilated and sterilized Yazidi women to prevent the birth of their children.  The rape of non-Muslim women and children as young as 9-12 is a common practice and seen as a religious duty, believing the Quran not only gives the right but encourages it.[xxxiii]

Transition:  ISIS has also shown distain for life in a scorched-earth withdrawal strategy.  Since 2015 at least a million acres of prime arable land near Sinjar has been ruined, greenhouses shattered and generators taken, and pumps for artesian wells broken or stolen.[xxxiv]  This philosophy of annihilation extends even to hospitals in liberated towns that have been booby-trapped with explosives.[xxxv] ISIS will exploit nonbelievers in any manner to their advantage, as seen in the placement of civilians in a convoy of 500 vehicles in an escape from Manbij in northern Syria.[xxxvi]  ISIS has even turn to children, the so called “cubs of the caliphate” to fill gaps in fighters and suicide bombers.

Adaptive:  As ISIS has shifted focus toward attacks in Europe, the group has exploited refugee routes to move operatives.  For example two of the 2015 Paris attackers posed as Syrian refugees and made the crossing from Izmir, Turkey into Greece in a boat filled with dozens of refugees. They made it to Paris to strike the stadium but other operatives in the team along the route ended up in Salzburg, Austria, applied for asylum and waited in a refugee center before being arrested. The later two carried fake Syrian passports.[xxxvii]  Europol director Rob Wainwright says the “flow of terrorists into Europe is well under way” and highlights the connection of organized crime in providing fake passports.[xxxviii]

Information Warfare

Regional: The Islamic State uses professionally developed propaganda films to illustrate their resolve and paint their fighters as heroes.  As early as 2014 in Kobane, footage of well-trained ISIS fire teams in tactical formations gaining ground house-by-house with coordinated artillery support cast doubts on the effectiveness of coalition air strikes and aim to weaken the resolve of Kurdish defenders.^[xxxix]  Later in 2015, high-definition footage shot from a drone flying over the Baiji oil refinery heralded an ISIS assault.  Military analyst were impressed by militants moving in concert and showing discipline in their use of firepower, indicating ISIS forces have progressed well beyond guerilla tactics to a more conventional military posture.[xl]

Transition:  Most of the early ISIS produced videos depicted ruthless military tactics, brutal mass executions and gory punishments to incite fear, often broadcast on Twitter. However in 2015 the ISIS media machine pivoted to a different pitch.  During a single summer month, ISIS produced nearly 900 pieces of Arab-language propaganda and nearly half focused on quality of life issues such food, utilities and schools in an attempt to portray a utopian view of life under the caliphate.[xli]  In the same year, ISIS decided to not just exploit the internet for propaganda purposes but use it as a weapon.  ISIS sympathizers hacked the Twitter and YouTube feeds at US Central Command to publish lists of generals and addresses along with videos including the title “Flames of War.”[xlii]      

Adaptive: By the Paris attacks of late 2015, ISIS was demonstrating sophisticated use of not just mass media outlets but also devices and applications. ISIS accomplices located in Syria tricked Western Intelligence agencies by using phones and WhatsApp accounts belonging to Abdelhamid Abaaoud, the leader of the attack, and others to mask the team’s travel to Europe.  Communications by ISIS that were routinely conducted on phones and social media accounts have evolved into encrypted chat-app messages over WhatsApp and Telegram.  ISIS related propaganda outlets provide methods to avoid detection, including switch mobile phones often, use temporary phone numbers and jump between chat apps.[xliii]  Many of the seemingly lone wolf attacks near Paris in 2016 have been guided by instructions issued over encrypted Telegram chat apps.[xliv]

Organized Criminal Activity

Regional: At the height of its power in 2014, ISIS raked in over $2 billion from seized oil fields, looted banks, and extortion of populations under its control.  ISIS proved alarmingly capable of extorting taxes from the millions of civilians who lived and worked within their ‘protectorate.’ Their sophisticated tariff system taxed everything from income to bank transactions to education of schoolchildren to generate over $300 million a year.  In addition to taxes, ISIS controlled essential resources, including food staples such as wheat and barley, mines and cement factories, and of course oil, which accounted for over $500 million a year in revenue at peak production in 2014.  ISIS regional operations thrived because they were able to make conquest profitable.  As one military scholar noted, “ISIS’ most valuable asset and center of gravity is the terrain it holds in Iraq and Syria.  Taking that territory away…is the most vital thing we can do.”[xlv]

Transition: In 2015 the loss of key sources of illicit revenue, including Ramadi, Fallujah, and the Kirkuk oil fields forced ISIS to increase taxes and impose religious tithes on the populations still under control.  ISIS also started to supplement its dwindling coffers by looting cities it is forced to abandon and plundering priceless artifacts from museums and archeological sites.  ISIS developed an extensive antiquities smuggling enterprise, which it screens by focusing the world’s attention on their wanton destruction of historical treasures.  While statues, tombs, and temples are destroyed with sledgehammers and bulldozers, they smuggle smaller items such as figurines, masks, and cuneiform tablets to European buyers via black market transit routes.  Iraq’s State Board for Antiquities and Heritage estimated income from looting in the millions of dollars.[xlvi]

Adaptive: As investigators examine ISIS-affiliated cells in the wake of terror attacks across Europe, a connection has emerged between organized crime and Islamic extremism.  Abdelhamid Abaaoud, the aforementioned ringleader of the Paris attacks in November of 2015, was linked to a den of radicalized thieves that robbed tourists and shoplifted for their cause.  Proceeds went to cover the costs of sending him and at least 30 to 40 recruits from Europe to the training camps and battlefields of the Middle East.[xlvii]  Similarly, the Bakraoui brothers who carried out the Brussels airport bombings were also notorious gangsters with extensive criminal records.[xlviii]

Broad Recommendations

Admiral Michael Rodgers told the Senate Armed Services Committee in September 2016 that “ISIL remains the most adaptive target I’ve ever worked in 35 years as an Intelligence professional.”[xlix]  An understanding of how ISIS has operated as a hybrid threat in each operational design will lead to more effective strategies to counter them.  All of the recent ISIS activity regarding the Iraqi offensive to retake Mosul is reminiscent of previous tactics.  For example to prepare for defense of the city, ISIS built concrete T-walls, placed booby traps, dug trenches and tunnels, recruited children, and prepared car bombs and suicide attackers.[l]  Since the offensive to retake Mosul began, Iraqi soldiers have destroyed at least 95 suicide car-bombs being used to fend off their advance. Also ISIS appears to be using thousands of civilians as human shields to block entry points.[li] Fears abound that ISIS fighters could resort to “rudimentary chemical weapons,”[lii] justified as ISIS has polluted the air with oil fires and set afire a sulfur plant.

While any of the above could be predicted from an intelligence analysis, what is most important is the reality that ISIS has and will continue to act as a hybrid threat despite impending defeat on the battlefield.  ISIS has achieved and sustained their so called ‘caliphate’ by blending modes of warfare, including use of conventional weapons, irregular tactics, terrorist acts, and criminal disorder. Whatever happens on the ground in Mosul, or even Raqqa, in the next few weeks or months is significant, but for the international community, the transition of ISIS is of the most concern as fighters return or arrive in their backyards.  There is no reason to believe that ISIS will not continue to employ aspects of the six characteristics of a hybrid threat to undermine their opponents.

Hence a broad set of recommendations can be formulated with the details left to defense planners to develop based on the insights and observations of this article.  They are:

• Appreciate and plan for the inherently long-term nature of the ISIS campaign.
• Anticipate shifts in operations and preempt instead of just preventing events.
• Develop multiple options for each characteristic at all levels of war.
• Identify the military contribution to a comprehensive approach in the next phase of ISIS operations.

Canadian Brigadier General Anderson, who directs training of Iraqi security forces, has told reporters that he is certain Iraqis will prevail in Mosul. “But the fall of Mosul does not mean that Daesh is defeated by any stretch of the imagination,” says Anderson, using the Arabic phrase for ISIS, “it just means in its current format.”[liii]  That means the fighters will morph into a pure insurgency force and formidable terrorist group.  As ISIS makes this transition, coalition security forces and international security organizations have the benefit of knowing how this hybrid threat thinks, believes and operates and thus an opportunity to capitalize on that understanding.  

End Notes