Where Do We Stand with Al-Qaeda and ISIS? International Salafi Networks in 2024

Where Do We Stand with Al-Qaeda and ISIS? International Salafi Networks in 2024

By Andrew Byers

The June 2024 arrest of eight Tajiks inside the United States who are believed to have ties to ISIS-Khorasan (ISIS-K) highlights both the vulnerability of the current open borders of the United States and the persistence of the threat by several international Salafist terror organizations capable of attacking the U.S. homeland.

In the Director of National Intelligence (DNI)’s annual threat assessment published in February 2024, Al-Qaeda is described as having “reached an operational nadir in Afghanistan and Pakistan.”[1] Its affiliates in Yemen and Africa, particularly Al-Shabaab in Somalia and elsewhere in East Africa, we are told, “will sustain the global network as the group maintains its strategic intent to target the United States and U.S. citizens.” There remains no announced replacement for Ayman al-Zawahiri, though the assessed leader is Saif al Adel, an Egyptian former army officer said to reside in Iran. Until one is named and accepted by Al-Qaeda’s affiliates, Al-Qaeda will remain more of a brand to which regional terror organizations will associate themselves. The report also makes note of ISIS’ “cascading leadership losses in Iraq and Syria,” and states that ISIS’ “regional affiliates will continue to expand,” which, the DNI predicts, reflects a “shift of the center of gravity in the Sunni global jihad to Africa.”[2]

Rough estimates of each of the major regional affiliates, indicating whether the group is assessed as strengthening/weakening, its establishment, and approximate number of personnel is as follows:[3]

Al-Qaeda and Affiliates[4]

Al-Qaeda: strengthening, est. 1988, 400 personnel[5]

Al-Shabaab: maintaining, est. 2006, 7000-12,000 personnel

AQIM: maintaining, est. 2007, 1000 personnel

Al-Qaeda in the Arabian Peninsula (AQAP): strengthening, est. 2009, 3000-4000 personnel

Al-Qaeda in the Indian Subcontinent (AQIS): strengthening, est. 2014, 180-200 personnel

Jama'at Nasr al-Islam wal Muslimin (JNIM): strengthening, est. 2014, 2000 personnel

Hurras al-Din (HAD): weakening, est. 2018, 1500-2000 personnel

Islamic State and Affiliates:

ISIS: maintaining, est. 2013, 5000-7000 personnel

ISSP (Sinai Province): weakening, est. 2014, 100-500 personnel

ISGS (Greater Sahara): rapidly strengthening, est. 2015, unknown personnel

ISWAP (West Africa Province): strengthening, est. 2015, 3500 personnel

ISKP or ISIS-K (Khorasan Province): strengthening, est. 2015, 4000-6000 personnel

ISEA (East Asia): maintaining, est. 2016, 200 personnel

ISCAP (Central Africa Province): strengthening, est. 2018, 1500-2000 personnel

ISM (Mozambique): weakening, est. 2022, 180-220 personnel

It is clear that for both organizations, Al-Qaeda and ISIS, leadership losses from U.S. counterterror operations have meant that the central organizations must rely on regional affiliates to conduct operations while their parent organizations focus on maintaining their existence and slowly rebuilding over time. These regional affiliates have highly variable capabilities and interests. While the central Al-Qaeda and ISIS organizations remain interested in attacking the West—the U.S. homeland remains the holy grail for targets of attack—they can only inspire such attacks rather than directly sponsor them.

In terms of ISIS affiliates, two of its chief sub-organizations, ISIS–Greater Sahara and ISIS–West Africa continue to seek to capitalize on weak local governance and societal divides in sub-Saharan Africa. This is bad news for Nigeria and the countries of the Sahel, because these groups will continue to destabilize the region, but good news for the West. Far better to have such organizations embroiled in creating chaos and destruction in Africa than in the West. ISIS-Khorasan (ISIS-K)’s capabilities for acting outside Afghanistan and surrounding areas are of much greater concern. The group as a whole remains primarily focused on undermining the Taliban in Afghanistan and attacking foreign interests and infrastructure within Afghanistan, but ISIS-K’s leadership has greater ambitions and may very well seek to conduct one or more significant attacks within the West in order to assume a more prominent role in global Salafist circles.

While most of ISIS-K’s attacks have taken place inside Afghanistan and Pakistan (including the 2021 Kabul airport attack that killed thirteen U.S. servicemembers), ISIS-K has also staged attacks inside Uzbekistan, Tajikistan, and Iran. Most recently, in March 2024, four ISIK-K operatives, all ethnic Tajiks, attacked a Russian concert hall that killed close to 150 civilians. This recent out-of-area attack is highly worrisome because it suggests larger aspirations for ISIS-K, providing the context for why the recent arrests of eight ethnic Tajiks said to have connections to ISIS-K inside the United States are so concerning. The eight entered the United States illegally, coming across the Southwest border at various times in 2023. After they were taken into custody by U.S. Customs and Border Protection (CBP), they were nominally “vetted” and subsequently released inside the United States by U.S. law enforcement with notices to appear before a U.S. immigration court at a later date.[6] Only later were they re-arrested by U.S. Immigration and Customs Enforcement (ICE) in Los Angeles, New York, and Philadelphia after the individuals in question had scattered. This particular group of Tajiks is said to have ties with a larger ISIS-K cell operating in Central Europe, but it remains unclear if this was an ISIS-K operational cell being sent to conduct one or more attacks within the United States.[7] This comes on the heels of a April 2024 arrest of an Uzbek national with ISIS-K ties who had been living illegally inside the United States for two years in Baltimore.[8]

Since September 11, 2001, the United States has suffered more than forty attacks by Salafist jihadis.[9] These attacks have typically either failed altogether or have inflicted relatively small numbers of casualties. All told, these attacks have led to the deaths of just over 100 people and more than 500 injuries. Attacks inflicting the most casualties have included the Ft. Hood mass shooting (2009), the Boston Marathon bombing (2013), the San Bernardino shooting (2015), the Pulse nightclub shooting (2016), the truck ramming attack in Lower Manhattan (2017), and the Pensacola shooting (2019).

In almost all cases, the attacks were carried out by individuals legally present in the United States at the time of their attack. Most were lawful immigrants to the United States, naturalized U.S. citizens, or U.S. citizens from birth. Most were individuals who became radicalized once they were in the United States, rather than individuals already radicalized who then sought lawful entry into the United States in the way that the September 11 hijackers did. There are a small number of exceptions. Umar Farouk Abdulmutallab, the Nigerian “Underwear Bomber” who attempted to blow up a passenger aircraft as it approached Detroit in 2009, was likely radicalized while in Yemen and dispatched to the United States by Al-Qaida in the Arabian Peninsula (AQAP). Mohammed Saeed Alshamrani, the Saudi Arabian Air Force officer who opened fire on a classroom at the Naval Air Base in Pensacola in 2019, seems to have been radicalized in Saudi Arabia and dispatched by AQAP to the United States for the explicit purpose of carrying out the attack. Dzenan Camovic, a Bosnian national and supporter of ISIS who carried out a knife and gun attack against police in Brooklyn in 2020, was present in the country illegally.

This does not mean that Salafist jihadi organizations could not shift their operations to focus on sending operational cells into the United States illegally to carry out attacks inside the homeland. The number of individuals attempting to illegally enter the United States who are present in the Terrorist Screening Data Set (TSDS) has increased dramatically in the last few years. U.S. Customs and Border Protection (CBP) reports that in FY2023, there were 80 such encounters on the Southwest border and 484 such encounters on the Northern border at land ports of entry.[10] In FY2024 (Year-to-Date), there were 27 such encounters on the Southwest border and 198 on the Northern border. There were many more such encounters between ports of entry. In FY2023, there were 169 such encounters on the Southwest border and 3 on the Northern border. In FY2024 (Year-to-Date), there have been 90 on the Southwest border and 1 on the Northern border. This is not to suggest that in each case the individual in question is a known terrorist, but in each case there is enough potentially derogatory information about the individual to further screen them. The total number of potential terrorists attempting to enter the United States is unknown, because since 2021 there have been at least 1.7 million gotaways at the Southwest border (illegal entrants detected but not detained)[11] and then-U.S. Border Patrol Chief Raul Ortiz testified in March 2023 that the total number of gotaways was likely 10-20 percent higher than the publicly reported numbers.[12] We simply cannot know how many of these two million gotaways were also present in the TSDS.

In December 2023, FBI Director Christopher Wray testified before Congress that the number of warning signs of possible terror attacks inside the United States has increased dramatically since the October 7, 2023 attack by Hamas inside Israel. “What I would say that is unique about the environment that we're in right now in my career is that while there may have been times over the years where individual threats could have been higher here or there than where they may be right now, I've never seen a time where all the threats or so many of the threats are all elevated, all at exactly the same time.”[13] This is troubling, to say the least, and suggests that much more must be done to head off the possibility of one or more major terrorist attacks inside the homeland.

We have clearly entered a dangerous period for potential attacks against the U.S. homeland by international Salafist jihadis. What can be done about this problem?

1. Counterterrorism at home: The United States can begin to address its own vulnerabilities. Protecting the U.S. homeland is of paramount importance. The key is to not focus on adding additional counterterror window dressing—adding additional layers of security theater at U.S. airports, for example, is not the answer—but rather to address the real vulnerabilities that exist. Filling the gaping holes in U.S. border security is an obvious first step; the problem is that while it can be done operationally with additional resources, it requires the political will to do so. Addressing the problems with vetting those seeking asylum in the United States will likewise be a tough nut to crack, because vetting of would-be refugees can only be accomplished with sufficient data. Asylum seekers can only be properly vetted if their data can be compared with a preexisting and comprehensive set of trustworthy data. Are we confident, for example, that the U.S. intelligence community has access to reliable and complete data on all bad actors originating in, say, Tajikistan? This is especially challenging when dealing with individuals originating in those parts of the world—including the greater Middle East and almost all of Africa—where corruption is rampant and where public records for citizens are incomplete at best.
2. Focused counterterrorism: The United States can focus its counterterror efforts outside the United States on those organizations with the will and the capabilities to attack the U.S. homeland. While there are a great many terrorist organizations in the world, most of them are either concerned with strictly local issues or simply do not have the operational capabilities to attack the U.S. homeland. By focusing on those organizations that do have such interest and ability, like Al-Qaeda and ISIS and their affiliates, the United States can concentrate its finite resources on those problems most relevant to it. It is very easy to get drawn into lengthy counterterror and security assistance missions by partners in peripheral areas against adversaries of local relevance, but the United States must resist this tendency and preserve its attention and resources on those threats most relevant to direct U.S. interests.
3. Over-the-Horizon counterterrorism: The United States can use its withdrawal from Niger and Chad as inspiration to further develop its over-the-horizon counterterrorism capabilities. The July 2022 killing of Ayman al-Zawahiri after U.S. withdrawal from Afghanistan is the quintessential successful demonstration of this type of capability. The United States will never have all the capabilities in place to conduct significant counterterror operations everywhere in the world it might like to, but by meaningfully developing additional over-the-horizon capabilities it can still achieve disproportionate successes even in the absence of significant U.S. forces in country.
4. Cyber counterterrorism: While U.S. counterterror organizations have significant funding and technological advantages in hunting Salafist jihadis, there remain critical shortfalls in Western ability to penetrate these organizations and monitor their online activities except in the most superficial ways (such as monitoring the outermost recruiting and communications channels in social media).[14] It remains unclear the extent to which new tools like artificial intelligence and large language models can be leveraged to help monitor and penetrate these organizations’ more important communications channels.[15] This is clearly a need for more investigation and resources. Investing in additional capabilities today will continue to pay dividends tomorrow in penetrating, monitoring, and learning to understand how international terror organizations proselytize, recruit, and communicate.