On 11 September 2001, a group of operatives dispatched by al Qaeda leadership hijacked four planes and conducted a series of attacks targeting symbols of America’s economy, military, and government. Although passengers on one of the planes heroically diverted it from the intended target of the U.S. Capitol by crashing it in a Pennsylvania field, the successful attacks against the World Trade Center and the Pentagon shook the United States—and the world—to the core.

The 9/11 attacks—and the oft-repeated threats by al Qaeda to conduct subsequent attacks—sparked a visceral U.S. response that led to the invasion of Afghanistan in 2001, the invasion of Iraq in 2003, and a wide-ranging global war on terror that resulted in American military and intelligence activity in scores of countries around the world. Some estimate that since 2001, the war on terror has cost the United States $6.4 trillion.

Anniversaries, whether personal or public, are often a time to reflect on what has happened, and to ponder what the future may bring. While much attention has been paid of late to homegrown far-right and far-left extremists, jihadist terrorism has not disappeared—it merely evolved. So, as the world marks the 20th anniversary of the 9/11 attacks, it behooves security professionals to take stock of the jihadist movement today, forecast where the movement is headed, and consider the implications of ongoing terrorist activity.

Defining the Movement

Before one can properly gauge the status of the jihadist movement, it is necessary to define it. Jihadism is an ideological movement through which militant Islamists seek to establish a global Islamic polity via jihad. While jihad simply means “struggle” in Arabic, when used in this context, militant Islamists are clearly referring to an armed struggle or, as some have termed it, a “holy war.” Thus, jihadists are those who seek to topple current regimes through armed struggle and replace them with an Islamic government run in accordance with their austere interpretation of Islam.

Modern jihadism is not a monolith. It has always been a movement composed of a variety of distinct groups and individuals. For example, al Qaeda leader Osama bin Laden’s famous 1998 “Declaration of War against the Jews and Crusaders” was not only signed by bin Laden, but also by Ayman al-Zawahiri (leader of the Egyptian Islamic Jihad), Refa’i Ahmed Taha Musa (leader of the Egyptian Islamic Group), Shaykh Mir Hamzah (secretary of the Jamiat Ulema-e-Pakistan), and Fazlur Rahman (leader of the jihad movement of Bangladesh).

Following the 9/11 attacks and the tremendous amount of publicity they generated, that notoriety helped al Qaeda quickly rise to the forefront of the global jihadist movement, leading many other jihadist groups and individuals to swear allegiance to bin Laden. Some did this out of sincere admiration, while others did it more pragmatically to capitalize on al Qaeda’s fame to help recruit fighters and raise funds to support their own local struggles.

Al Qaeda’s rise to prominence resulted in the group evolving from a small vanguard group into a much larger, though loosely organized, network composed of three distinct components: bin Laden and the core al Qaeda group; other franchise jihadist groups that pledged allegiance to bin Laden and assumed the al Qaeda mantle; and individual grassroots jihadists inspired by al Qaeda but not formally a member of the core or a franchise group.

Some of the al Qaeda franchise groups were closer than others to the core group in terms of personal relationships, ideology, and military doctrine. Among the groups that maintained close links with bin Laden and the core leadership were the jihadists in Yemen and Saudi Arabia who would later form al Qaeda in the Arabian Peninsula (AQAP).

The relationships with other franchise groups were fraught and less collaborative. For example, the tension between al Qaeda and Abu Musab al-Zarqawi’s Jama’at al-Tawhid wal-Jihad (Organization for Monotheism and Jihad or JTJ) over both ideology and military doctrine resurfaced repeatedly, even after al-Zarqawi pledged allegiance to bin Laden and changed his group’s name to al Qaeda in the Land of the Two Rivers (also known as al Qaeda in Iraq or AQI).

These tensions would later boil over and lead to AQI’s successor group, the Islamic State in Iraq and al Sham (ISIS), breaking away from al Qaeda in 2013—two years after the death of Osama bin Laden. The new group referred to itself simply as the Islamic State, and due to its successes on the battlefield in Iraq and Syria, it quickly rose in prominence and became a second powerful pole within the jihadist movement.

The Islamic State also attracted an array of franchise groups and grassroots jihadists to its orbit. Many of the Islamic State franchise groups had formerly been al Qaeda franchise groups, such as Ansar Beit al-Maqdis in Egypt, which became known as the Islamic State’s Sinai Province. Other Islamic State franchises were formed by splinters that broke away from powerful al Qaeda franchise groups in places like Yemen and Somalia. Boko Haram in Nigeria, another Islamic State franchise, had previously attempted to formally join al Qaeda, but its entreaty was rejected by bin Laden and the al Qaeda core leadership due to their indiscriminate targeting of civilians and the mercurial nature of the group’s leadership. It later became the Islamic State West Africa Province—a franchise of ISIS.

 

The Current State of al Qaeda

While al Qaeda was able to surprise the U.S. government on 9/11, after those attacks every government agency focused on the group and al Qaeda’s core leadership has been under incredible pressure. The United States and its allies have pursued al Qaeda leaders across the globe, capturing some key leaders and killing a significant number of others. Efforts to neutralize the al Qaeda core leadership have even included going after those seeking refuge in sanctuaries such as Pakistan, Syria, and Iran.

In addition to capturing and killing leaders, the efforts to counter al Qaeda also concentrated on its finances, logistics, communications, and travel. This made it far more difficult for al Qaeda leaders and their terrorist operatives to function, and al Qaeda was never able to launch its long-threatened follow-up attack to 9/11.

The Islamic State’s 2013 defection hurt al Qaeda both in terms of image and operations. The damage was compounded by the fact that al Qaeda was still attempting to recover from the loss of the charismatic and famous bin Laden in 2011. Newly established Islamic State franchise groups began to compete with al Qaeda franchises for manpower, finances, and territory. In several places—including Syria, Yemen, Mali, and Somalia—this competition led to open warfare.

Al Qaeda’s leaders must take extreme measures to stay hidden, both from Western forces and jihadist competitors, and this impacts their ability to communicate, travel, and interact with other members of the core, as well as the franchise groups.

Despite setbacks and disruptions, al Qaeda has adapted and survived. Due to the addition of franchise groups to its ranks, the Council on Foreign Relations found that the al Qaeda network has more fighters under its banner today (more than 40,000 by some counts) than the core group did prior to September 2001, when it consisted of only a few hundred jihadists.

Based upon the experience of al Qaeda franchises in failed attempts to establish jihadist states in Iraq (2006), Yemen (2011 and 2015), and Mali (2012), the al Qaeda leadership learned that it is very difficult to impose jihadist rule on people who are not ready and willing to accept it. Because of this, they have adopted a more gradualist approach to establishing Islamist rule that requires a period of ideological preaching and preparation.

Under this approach, it is important for the jihadists to become closely integrated with the local population to gain influence. Because of this, the al Qaeda core and al Qaeda franchise groups have adapted their strategy and devote the bulk of their efforts to preaching and local integration, rather than focusing large amounts of resources on planning and executing attacks against the United States and the West. This change of strategy was also influenced by the difficulty al Qaeda has had in getting operatives to the West to conduct attacks.

In recent years, groups such as Al-Shabaab in Somalia and JTJ in Mali have attempted some external attacks and regional attacks focused on Westerners, but the bulk of al Qaeda franchise group efforts remain focused locally. AQAP was very involved in fomenting and conducting attacks attempting to target the United States, such as the attempt to bomb Northwest Airlines Flight 253 in 2009 and the printer cartridge bomb plot in 2010. But after suffering a series of devastating leadership losses in 2015 and 2016, AQAP was forced to redirect its focus to local jihad.

Today, the main threat posed by the al Qaeda pole of the jihadist movement outside of its primary areas of operation stems from grassroots jihadists who think globally but act locally, posing a far larger threat to the institutions and people of the countries its franchise groups are based in than to the West. In places like Somalia and Mali, al Qaeda franchise groups operate as insurgents that exert influence and control over large expanses of territory and the population that lives there. They attack the military and government to make their areas of operation ungovernable and thus more susceptible to their influence. They also seek to undercut anything that promotes stability or provides tax revenue to the government, so they attack business interests, tourist sites, and NGOs.

These groups also pose a persistent terrorist threat to the regions surrounding their primary areas of operation. For example, al-Shabaab has conducted terrorist attacks in Kenya and Uganda, and JNIM has conducted attacks in Ivory Coast.

The Current State of the Islamic State

After splitting from al Qaeda in 2013 and experiencing a series of dramatic battlefield victories in Syria and Iraq, the Islamic State of Iraq and al Sham declared in late June 2014 that it was establishing a global Islamic caliphate and renamed itself the Islamic State (IS). The group declared its leader, Abu Bakr al-Baghdadi, the Caliph—supreme global leader of all Muslims. Accordingly, al-Baghdadi demanded that all Muslims pledge allegiance to him, including all jihadists and jihadist groups. Many did so, which resulted in a period of dramatic growth of the Islamic State pole of the movement. The result was the creation of a global jihadist network that rivaled al Qaeda.

At the zenith of its power, the U.S.-led coalition fighting the IS estimated the group controlled some 30 percent of Syria and 40 percent of Iraq, including the cities of Mosul, Iraq, and Raqqa, Syria. They posed a direct threat to the governments of those two countries and the surrounding regions.

This threat brought IS to the attention of the rest of the world, and in June 2014 an American-led coalition of countries launched Operation Inherent Resolve (OIR) in Iraq to blunt the Islamic State’s offensive operations. In September 2014, OIR was expanded to Syria, and within a few months, the intense campaign of airstrikes coupled with local ground forces destroyed much of the Islamic State’s heavy weapons systems, targeted its economic system, and forced IS to go on the defensive.

By December 2017, the IS core had lost 95 percent of its once expansive proto-state, including Raqqa. On 27 October 2019, al-Baghdadi was killed after fleeing to Syria’s Idlib province. Today, the IS core is only a shadow of what it was in mid-2014 in terms of manpower, weaponry, and money. It does however retain the potential to conduct terrorist attacks, as well as hit-and-run insurgent attacks in Syria and Iraq.

The weakened IS core is in much the same condition as its predecessor organization, the Islamic State in Iraq, was in 2010. But just as the Islamic State in Iraq was able to rebound dramatically from 2011 to 2014 and eventually conquer large portions of Syria and Iraq, so the IS core could once again grow into a powerful force if it is provided the opportunity to recover and regroup.

In terms of franchise groups, which the Islamic State calls provinces, the IS core often provides direct financial support, weapons, and operational guidance. For example, the Islamic State franchises in Libya received considerable support from the core, including foreign fighters, money, and weapons. This support allowed a Libyan franchise to assert control over the city of Sirte and proclaim an Islamic polity there until it was uprooted by Libyan ground forces strongly supported by U.S. and allied airstrikes in December 2016.

Financial support from the IS core also played a critical role in providing IS supporters in Southeast Asia with the resources needed to seize the city of Marawi in the Philippines in May 2017. After a protracted and destructive battle, the country’s military reestablished control of Marawi in October 2017. Islamic State supporters had made a dramatic statement by seizing the city, but they paid a terrible price and lost a considerable number of fighters.

In areas where they must compete with stronger al Qaeda franchise groups, such as Somalia, Yemen, or Mali, the Islamic State’s provinces have struggled to gain much momentum. However, in areas where they faced no significant jihadist competition, the IS franchise groups are faring better. The franchises in Mozambique and Nigeria are among the most active IS franchises in 2021.

In August 2020, the Islamic State Central Africa Province seized the port of Mocimboa da Praia in Mozambique, which it still controls as of July 2021. In March 2021, the group sent hundreds of fighters to seize Palma, a key site for Mozambique’s offshore energy projects. While they only held Palma for 10 days, the seizure caused the French energy company Total to declare force majeure and suspend its operations, a move that has the potential to cost the government of Mozambique billions of dollars in lost energy royalties.

In northeastern Nigeria, the Islamic State West Africa Province—formerly known as Boko Haram—waged a brutal and bloody insurgency that the United Nations estimates has resulted in some 300,000 deaths in Nigeria. That violence has also spilled over into nearby Cameroon, Chad, and Niger.

Both of these African franchises pose a significant insurgent and terrorist threat to governments in the region, as well as to businesses and NGOs operating there. Although they do not yet pose a global threat, they could evolve into the role if their growth is left unchecked.

The IS core dispatched a cell of operatives to Europe to carry out terrorist attacks in 2015. Members of the cell traveled to Europe by hiding among the heavy flow of refugees from Syria’s civil war. Using skills they were taught by the Islamic State and funds the organization provided, the cell conducted a series of suicide bombings and armed assaults in Paris on 13 November 2015 that targeted the national stadium, restaurants, and a nightclub—killing 132 people. Members of the cell fled France and regrouped in Brussels to conduct a suicide attack targeting Zaventem International Airport that killed 32. The IS core was also able to send operatives to conduct attacks in Istanbul in June 2016 and January 2017.

However, the IS core has not been able to repeat that success in recent years. Today, the main terrorist threat posed by the IS network outside of the areas of operation of the core and franchise groups stems from grassroots jihadists, just as it does for al Qaeda. Because of this, it is important to take a deeper look at grassroots jihadists and the threat they pose.

Grassroots Jihadists

Al Qaeda’s original operational model was to train individual operatives and then send them abroad to conduct attacks. Sometimes these operatives worked with local sympathizers to organize attacks—this was the model used in the 1993 World Trade Center bombing and the 1998 East Africa Embassy bombings. In the 9/11 attacks, the core sent a team to conduct the attack.

In the wake of 9/11, intense pressure was placed on the al Qaeda core. The core leadership became so frustrated by its inability to get operatives into the United States and Europe to conduct attacks that by 2009 it began to embrace and promote the leaderless resistance model of terrorism. Al Qaeda figures such as Adam Gadahn and Anwar al-Awlaki began to encourage al Qaeda supporters in the West to conduct simple attacks using readily available weapons near where they live, rather than attempt to travel to fight with the core and franchises or receive training from them. This resulted in increased attacks by grassroots jihadists such as the Little Rock, Arkansas, shooting in June 2009 and the Fort Hood shooting in November 2009.

Encouraged by these attacks, al-Awlaki and his AQAP colleagues launched an English-language magazine in 2010 called Inspire that was intended to encourage jihadists living in the West to conduct attacks and provide them with rudimentary tutorials on how to conduct attacks. The bombmaking instructions in Inspire were used in several attacks, including the April 2013 Boston Marathon bombing.

Some grassroots jihadists are motivated and operationalized by a combination of al Qaeda and IS. It is not unusual to find grassroots jihadists who declare allegiance to the Islamic State but have watched sermons by Anwar al-Awlaki and read Inspire magazine. This makes grassroots terrorism somewhat nebulous. For example, in the January 2015 attacks in Paris, the brothers who attacked the offices of the satirical magazine Charlie Hebdo claimed allegiance to al Qaeda while their friend and co-conspirator who murdered a police officer and attacked a kosher grocery store claimed allegiance to the Islamic State.

Since the fall of the IS caliphate, a great deal of shine was taken off its appeal and its claim to be an inexorable force guided by divine power. Consequently, the number of IS-related grassroots jihadist terrorist attacks today outside of conflict zones is far lower than it was at the height of the Islamic State’s power and prestige. Still, grassroots jihadists will continue to pose a persistent threat for the foreseeable future.

There are several common elements to both al Qaeda and IS-inspired grassroots attackers (note that these same characteristics also apply to white supremacists, anarchists, and others who practice leaderless resistance). First, they tend to operate alone or in small groups to help escape detection by law enforcement and security forces. This isolation comes with a price, however, and they tend to possess very little in the way of sophisticated terrorist tradecraft or official training from the core group or franchises. These factors mean grassroots attackers often struggle to plan and execute attacks. It also leaves operatives quite vulnerable to detection as they progress through their attack cycle, especially during surveillance and weapons acquisition.

Many grassroots jihadists also lack the discipline required to be successful lone attackers and find themselves ensnared in government sting operations when they practice poor operational security by communicating with other extremists or reaching out for assistance with bombmaking or obtaining explosives and weapons. It is very rare that a lone attacker or small clandestine cell conducts a spectacular terrorist attack, regardless of the ideology.

The lack of terrorist tradecraft also makes it difficult for grassroots jihadists to attack hard targets, so they tend to focus their attacks on soft targets such as crowds of people on the street. This means that security measures can be implemented to harden facilities and deter would-be attackers.

There have been several examples of grassroots attackers who have been deterred from attacking a target due to the presence of video surveillance coverage and good access control. For example, a grassroots IS sympathizer who was arrested in Pittsburgh in 2019 and charged with plotting an attack on a church told an informant that he decided to attack the church rather than a Shiite mosque because the mosque locked its doors during services and had a video surveillance system. The IS sympathizer who attacked the Pulse Nightclub in Orlando in 2016 also passed up several potential targets he deemed as being too secure.

This is not to diminish the threat posed by grassroots jihadists; they do pose a very real and persistent threat and can be deadly. However, that threat is generally limited, and because of this, it is more accurate to say that grassroots jihadists pose the most likely threat in the West, but not as severe a threat as one posed by people possessing sophisticated terrorist tradecraft.

Implications for Security Practitioners

Jihadism is a phenomenon that is intrinsically both global and local, and the nature of the threat posed by jihadists varies depending on location. This makes jihadist terrorism an ongoing and dynamic challenge for security practitioners, especially those managing multinational footprints. First, for those with interests in the countries where jihadist insurgencies are raging, the threat is significant. These jihadists seek to overthrow governments and establish jihadist polities. They will seek to create instability and ultimately a vacuum of authority so they can step in and establish control. To achieve this, they will not only attack security forces and other government targets, but also any other entity they believe to be supporting the government or promoting stability. Jihadists in various theaters have attacked aid and development workers, as well as commercial targets such at hotels, restaurants, tourist sites, and energy and mining concerns.

With the jihadist core and franchise groups strapped for resources, they will also be seeking to raise money and acquire resources. This means that they are likely to continue to conduct kidnappings for ransom, extortion, cargo theft, and raids to acquire food, fuel, weapons, and other materials. Many of these insurgents are highly mobile and able to cover vast expanses of land or sea—for example in the Sahel region of Africa and the Sulu Archipelago in Asia—so the reach of these groups can extend beyond their core areas. Additionally, some groups are known to work with regional criminal gangs, who will help with smuggling or even sell captives to jihadist groups.

Organizations with interests in regions surrounding core jihadist areas can expect insurgencies to continue their efforts to lash out against regional enemies and western interests.

The frequency of jihadist terrorist attacks has been cyclical with discernable spikes and lulls. Key events have a large influence on the tempo of attacks, and there have been spikes in activity following events such as the 9/11 attacks, the publication of cartoons featuring the Prophet Mohammed, and the IS declaration of a caliphate. It is likely that the world will experience periods of increased jihadist activity in the future, and it will therefore be important to watch for events that resonate among the jihadist rank and file and that can serve as triggers for attacks.

The threat of jihadist terrorism outside of the main theaters of jihadist insurgency will persist for the foreseeable future, but the danger it poses will remain limited so long as jihadist core and franchise groups are kept from becoming strong enough and secure enough to devote significant resources once again toward projecting terrorist power abroad.

Scott Stewart is the vice president of intelligence at TorchStone Global. He was the lead diplomatic security service special agent assigned to the 1993 World Trade Center bombing investigation and has investigated and analyzed jihadist terrorist attacks and activity since 1990.