UNCLASSIFIED

COUNTERTERRORISM DIGEST

SPOTLIGHT

Indicators of Mobilization to Violence: McVeigh and his co-conspirators exhibited multiple behaviors that could indicate a
mobilization to violence.
Attempting to Mobilize Others to Violence, Particularly Family Members and Peers: McVeigh conspired with Nichols
and Fortier to conduct the bombing together.
Promoting Violent Extremist Narratives: FBI investigations revealed McVeigh started to discuss his hatred of the
government when he was discharged from the military. It is commonly speculated that McVeigh wanted to encourage
others to attack government institutions because, in his eyes, the government was not held accountable for the Ruby
Ridge incident with USPERRandy Weaver; the Branch Davidian cult raid in Waco, TX; or the passing of the 1994 Omnibus

McVeigh viewed the federal government shoot-out with Randy Weaver, where two members of the Weaver
family (Randy’s wife and 14-year-old son) were killed by federal agents in 1992, as evidence the US government
wanted to take away Americans’ Second Amendment rights. In a letter published by the Union-Sun & Journal in
1992, McVeigh wrote, “Is a civil war imminent? Do we have to shed blood to reform the current system? I hope it
doesn’t come to that! But it might.”
McVeigh conducted the 1995 attack on the Murrah Building on the second anniversary of the deadly 1993 law
USPER
David Koresh on the Branch Davidian compound in Waco, where 70+ people
were killed. McVeigh considered the federal law enforcement responses in Ruby Ridge and Waco to be

warning signs.”

semiautomatic assault weapons.

White Supremacist Views: In interviews before his execution, McVeigh described members of the white power
movement as his “brothers in arms.” He also hoped to inspire the spread of racial divisions with a mix of racism and
anti-government views.
Suspiciously Obtaining (Illegally or Otherwise) Explosives: In 1994, McVeigh and Nichols started stealing dynamite
and detonator caps from a Kansas quarry and buying fertilizer for explosives.
Consuming or Sharing Violent Extremist Videos, Media, and/or Messaging:
following the bombing, authorities found in the vehicle excerpts of the Turner Diaries, a 1978 dystopian novel depicting

Organization.” The novel was introduced as evidence by FBI agents in his trial to suggest inspiration for his attack.
One of the clippings had the phrases highlighted, “But the real value of all of our attacks today lies in the

McVeigh’s target of the FBI Murrah building.

an improvised truck bomb powered by 4,400 pounds of ammonium nitrate, a volatile substance used as a
commercial fertilizer. McVeigh’s bomb was made from ammonium nitrate and was similar in size and design.
Turner emphasized the idea of terrorism as the “propaganda of the deed,” suggesting terrorism is not just about
blowing things up, but it is about setting an example for others. McVeigh likely wanted to start a movement, and
inspire others to revolt against the government, similar to what is depicted in the Turner Diaries.

UNCLASSIFIED
 UNCLASSIFIED

COUNTERTERRORISM DIGEST

SPOTLIGHT

Aftermath: Others Continue to be Inspired by McVeigh

McVeigh possibly continues to inspire many violent extremists and illegal militia groups since the 1995 attack.
USPER
Wesley David Gilreath, 30, of Colorado was sentenced on 4 September to serve 15.5 years in federal prison followed

he “wanted the white race to win at life,” and when his house was searched, they found a tee-shirt bearing McVeigh’s face
and a book titled, “American Terrorist: Timothy McVeigh and the Oklahoma City Bombing,” indicating Gilreath supported

associated with white supremacy, a book titled “National Anarchism,” and a book titled “In Bad Company: America’s
Terrorist Underground. Agents also found hand-written notes bearing the names and addresses of 15 Mosques,
Synagogues, religious centers and other locations, all less than 35 miles from the defendant’s apartment.
USPER
Jerry Drake Varnell, 26, of Oklahoma was convicted on 25 February 2019 for attempting to use a weapon of mass

by a lifetime of supervised release. In court documents, the FBI said Varnell “initially wanted to blow up the Federal
Reserve Building in Washington, D.C., with a device similar to the 1995 Oklahoma City bombing because he was upset
with the government.” His anti- government ideologies closely mirror things McVeigh espoused and he attempted to use
explosives, “the okc bomber used.” However, the attempted explosion was orchestrated by the FBI to not detonate and
culminated in Varnell’s arrest.
As threats from violent extremists continue to evolve after the Oklahoma City bombing, many of the
risk factors and mobilization indicators remain consistent. (GUARDIAN, FBI, LA TIMES, BUREAU OF
PRISONS, NYT, NYT, ESQUIRE, USA TODAY, TRIBUNE NEW SERVICE, NBC, DOJ, CNN, ABC, NYT, US DISTRICT
COURT, US DISTRICT COURT, DOJ, DOJ, DHS, THE ATLANTIC, HISTORY CHANNEL)

McVeigh selling bumper-stickers in Waco, TX in 1993 Murrah building after the 1995 explosion (FBI)
(WSJ)

UNCLASSIFIED
 UNCLASSIFIED

COUNTERTERRORISM DIGEST

SPOTLIGHT
First Responder’s Toolbox - Natural Gas and Propane Terrorist Tactics
This Toolbox is designed to highlight the importance of recognizing potential suspicious
activity during responses or service calls to incidents involving “odors of gas.”

to create explosions inside buildings. Because many residential and commercial buildings
use natural gas and propane for heat and power, they are widely available. Utility companies
routinely inform the public about the importance of reporting odors and suspicious activity
related to tampering with or theft around meters, pipelines, and retail facilities they support.
Law enforcement and utility company representatives have teamed up to investigate reports

mitigate, and prevent terrorist attacks involving natural gas and propane.
Metering and gas sensor technology will assist in identifying the gas, determining the
response, and assessing the need for and type of additional resources (hazmat, bomb
squad) required for mitigation, investigation, and recovery. Following departmental
hazardous materials protocols, procedures, and guidance, and notifying the appropriate
“Destroying Buildings,” an article
at the scene, take steps to make the premise/area safe. For incident investigation signs of in the fourth issue of AQAP’s
suspicious activity may include, but not limited to: Inspire magazine, encourages using

Incident occurs when building occupancy is highest.

Apartment from which gas is emanating is vacant. SAFETY: If a gas smell
is present or if gas is
detected, even without an
odor, evacuate and notify
911 from a safe location.
pressure to build. Coordinate with local gas
utility or propane gas supplier
Interior doors are open to allow distribution of gas within the building. for additional information or
Ventilation system is turned on to assist with natural gas distribution. guidance.

Gas appliances are disconnected from supply lines. Odors are supposed to be
detectable at 1/5 of the
lower explosive limit of the

Damage is evident to interior supply lines. or determining the actual

concentration levels of the
Gas cylinders are found in unusual areas—such as entryways, storage areas,
and stairwells. discernible by odor alone and
Gas cylinders are adjacent to a heat source, potentially to increase internal pressure, exposure over time will result
in “odor fatigue.”
triggering the safety relief valve to release contents.

prevention device.

enhancements as potential shrapnel (nails, nuts, bolts, coins, metal disks).

Combustible gas monitors are disabled, damaged, or removed.
Physical symptoms of natural gas poisoning from inhalation are evident—such as headaches, dizziness, fatigue, nausea,
and irregular breathing.
6

UNCLASSIFIED
 UNCLASSIFIED

COUNTERTERRORISM DIGEST

SPOTLIGHT
IMPORTANT:
alternative explanation for further investigation.

CHARACTERISTIC NATURAL GAS PROPANE

Weight of gas compared to air Lighter than air Heavier than air
Lower Explosive Limit 4.4% methane 2.1% propane
(% by volume air)

Upper Explosive Limit 16.4% methane 9.6% propane

(% by volume air)

Stored in gas cylinders? no yes

Transported by pipeline yes yes

Characteristic of gases (AMERICAN GAS ASSOCIATION)

The entire product is available on the Special Interest Group (SIG) on FBI’s Law Enforcement Enterprise
Portal (LEEP) https://www.cjis.gov/, the JCAT tab on the Emergency Services (ES) and Intelligence COI on
Homeland Security Information Network (HSIN) https://hsin.dhs.gov/, and on the ODNI website https://www.
JCAT)

UNCLASSIFIED
 UNCLASSIFIED

COUNTERTERRORISM DIGEST

ON POINT

3 NORTH CAROLINA: Authorities Arrest Three

Men on Firearms Charges
On 20 October, USPERLiam Montgomery Collins*, 21;
USPER
Paul James Kryscuk*, 35; and USPERJordan Duncan*,
25, from Boise, ID, were arrested on the federal charge
of conspiracy to unlawfully manufacture, possess, and
distribute various weapons, ammunition, and suppressors.
Collins and Kryscuk were charged via an indictment, while
Duncan was charged via a complaint. Collins and Duncan,
both “former US Marines”, were previously assigned to
Camp Lejeune in Jacksonville, NC.
According to court documents, Collins and Kryscuk
used the conspiracy to enrich themselves and others
purchases from the federal government.
From May 2019 to October 2020, Collins made multiple
money transfers through his personal account to
4 TEXAS: Self-Proclaimed ‘Boogaloo Bois’ Member
Arrested and Charged With Illegally Possessing
a Firearm
On 28 October, a self-proclaimed “Boogaloo Bois” member
USPER
Cameron Emerson Casey Rankin*, 21, was charged
by a federal criminal complaint in San Antoino, TX, with
one count of being a prohibited person in possession of a
institution. According to the criminal complaint, Rankin
and has expressed a desire to overthrow the government,
and IRS.
On 23 March 2018, Rankin attempted to purchase
two weapons from a San Antonio retail outlet but was
denied, according to the complaint.
After being warned by ATF agents that he was a
prohibited person, Rankin posted pictures of himself

purchased items from vendors to manufacture the

In furtherance of the crime, Kryscuk, using an alias,
mailed the manufactured weapons from Idaho to
Jacksonville, NC. Kryscuk also shipped the short
government, to Collins. Duncan was aware of and
participated in the conspiracy.
Collins and Kryscuk are charged with violating
and ship them interstate; 18 U.S.C. § 922(a) (3) and 2,
and 26 U.S.C. § 5841, 5861(j), 5871, and 2, interstate
convicted, they could face up to 20 years in prison.
Duncan is charged with violating 18 U.S.C. § 371,
interstate (18 U.S.C. § 922(a) (3)). If convicted, he
DOJ)
* The charges listed are currently allegations. As
in any criminal case, the defendant is presumed
innocent until proven guilty in a court of law.
Alamo in San Antonio to attend a protest in reaction
to the death of USPERGeorge Floyd. The next day,
Rankin posted on his Facebook account photos of
as well as comments about his disdain for police
“I’m BOOGALOO we hate police.” Additionally, on
4 August, Rankin posted a photo on Facebook showing
the trigger. Rankin posted other photos which included
a quote, stating, “Diligently Plotting to Take Over the
World in order to Leave You Alone.”
On 11 August, Rankin arrived at the airport in
Manchester, NH. Rankin checked a semiautomatic
handgun in his luggage while at the ticket counter, but
arrival in Manchester, Rankin received a written notice
agents then seized the handgun and ammunition from
inside Rankin’s luggage.
Rankin is scheduled for a detention hearing on
4 November. If convicted, he could face up to 10 years
in federal prison. (DOJ)

UNCLASSIFIED
 UNCLASSIFIED
ON POINT
5 NEW YORK: Convicted Al-Qa‘ida Supporter
Released From Prison
On 27 October, a Manhattan federal judge ordered
convicted al-Qa‘ida supporter and dual US and Australian
citizen USPER
to surveilling the New York Stock Exchange (NYSE) for
al-Qa‘ida but was re-sentenced under a “compassionate
release” law.
“extraordinary and compelling” reasons for being
re-sentenced to time served under a law allowing
the early “compassionate release” of some prison
inmates. He was the only available caregiver for his
to rehabilitate himself since his April 2010 arrest,
according to the judge.
2007 to 2009 by conducting surveillance on the NYSE
and sending remote-control devices that could be used
pleaded guilty in June 2012 to supporting al-Qa‘ida and
conspiring with other people.
health problems, also had his sentence reduced,
according to the judge. (REUTERS)
10
UNCLASSIFIED
COUNTERTERRORISM DIGEST
6 UNITED STATES: Afghan National Extradited
and Charged for 2008 Abduction of American
Journalist
On 28 October, the DOJ unsealed a federal indictment
for Haji Najibullah, 44,—a.k.a. Najibullah Naim—of
Afghanistan, with six counts related to the 2008 kidnapping
of an American journalist and two Afghan nationals.
Najibullah was arrested and transferred to the US from
Ukraine to face charges in the indictment.
On or about 10 November 2008, Najibullah and his
co-conspirators, armed with machine guns, kidnapped
an American journalist and two Afghan nationals who
were assisting the journalist, at gunpoint in Afghanistan.
On or about 15 November 2008, Najibullah and his
co-conspirators forced the three hostages to hike
across the border from Afghanistan to Pakistan,
where Najibullah and his co-conspirators detained
the hostages. For the next seven months, Najibullah
and his co-conspirators held the hostages captive
in Pakistan.
During their captivity, Najibullah and his co-conspirators
forced the victims to make numerous calls and videos
seeking help. On or about 19 November 2008, while in
Pakistan, Najibullah and a co-conspirator directed the
journalist to call his wife in New York. Additionally, they
made the victims create at least three videos in which
they begged for help while surrounded by masked
guards armed with machine guns. In one of the videos,
the journalist was forced to beg for his life while a guard
pointed a machine gun at his face.
Najibullah was charged with hostage taking, conspiracy
to commit hostage taking, kidnapping, conspiracy
to commit kidnapping, and two counts of using and
possessing a machine gun in furtherance of crimes
of violence. Each of the six counts of the indictment
carry a maximum sentence of life in prison. (DOJ, US
DISTRICT COURT)
 UNCLASSIFIED

COUNTERTERRORISM DIGEST

ON POINT

7 UNITED KINGDOM: Leicester-Based ISIS

Member Charged With Seven Terrorism Offenses 8 UNITED KINGDOM: ‘Right-Wing’ Extremist
Sentenced to Prison After Pleading Guilty to
14 Terrorism Offenses
On 29 October, the Westminster Magistrates Court
charged ISIS member UKPERHisham Chaudhary, 27, with On 2 November, UKPERHarry Vaughan, 18, was sentenced to
two years imprisonment, suspended for two years, given a
joined ISIS in 2016, allegedly conducted fundraising and
propaganda work on ISIS’ behalf. attend a number of programs including a deradicalization
On 22 October, Chaudhary was arrested in Leicester,
UK, and detained under the Terrorism Act, following
an investigation by Counter Terrorism Policing North On 19 June 2019, UK MET PD CT Command arrested
East, Counter Terrorism Policing East Midlands, and Vaughan after a national counterterrorism operation
Leicestershire Police.
messages on an extremist website.
Chaudhary allegedly gathered funds and transferred
money abroad—using the cryptocurrency

detained in Kurdish-controlled prisons in Syria. category A—the most serious type. In order to share his
Additionally, he was accused of compiling and propaganda, Vaughan applied to become a member of
disseminating a terrorist publication via social media. two extremist websites. In his application form for a site,
he stated his ideology was “extremism” and that his
intended accomplishments were to “share propaganda/
disseminating a terrorist publication, contrary to
archives/resources etc.”
of membership of a proscribed organization [ISIS], Digital forensic specialists retrieved 4,200 images and
contrary to section 11(1) of the Terrorism Act 2000,
“right-wing” terrorist book and documents relating
contrary to section 17 of the Terrorism Act 2000. to Satanism, neo-Nazism, and anti-Semitism. The
Chaudhary was remanded in custody to appear before
of terrorism in the name of the proscribed organization
the Central Criminal Court on 6 November. (UK CT
(Sonnenkrieg Division), a guide to killing people, and
POLICING, INDEPENDENT)
bomb-making manuals.
JCAT: Understanding how terrorists raise and move funds
Commander UKPERRichard Smith from the UK MET PD
CT Command stated Vaughan “was an intelligent young
activity. The rapid development, increased functionality,
man but online, he was an enthusiastic participant of
and growing use of virtual currencies, such as bitcoin,
‘right-wing’ terrorist forums. He made and published
creates challenges for law enforcement and private
vitriolic graphics encouraging terrorism and signposted
sector. In addition, online communications continue to
people to violent terrorist guidebooks online.”
play a critical role in terrorists’ modus operandi. Public
(UK METPD)
terrorist social media messaging by keeping abreast of new
For previous reporting on UKPERHarry Vaughan, please see
application capabilities, and the latest tactics, techniques,
the 21 October 2020 edition of this publication.
and procedures related to operational security. The ability
to recognize and report observable online indicators of

observable behavioral indicators and activities.

11

UNCLASSIFIED
 UNCLASSIFIED

COUNTERTERRORISM DIGEST

ON POINT

9 AUSTRIA: Terrorist Attack Across Six Locations

Leaves at Least Four Civilians Dead
On 2 November, at least 22 people were wounded,

after a gunmen, Austrian national Kujtim Fejzulai, 20,

Seitenstettengasse Stadttempel synagogue, but it was

unclear if it was a target. Austrian Chancellor Sebastian
described the incident as a “hideous terrorist attack.”
On 3 November, ISIS claimed responsibility for the
Vienna attack.

being an ISIS supporter. In April 2019, he was arrested

for trying to cross the Turkish border into Syria to join
ISIS and was sentenced to 22 months in prison, but
released in December 2019. The attacker was also
wearing a fake explosive belt.

As of 3 November, Austrian authorities arrested several

people in connection to the attacks, and conducted a
search of Kujtim’s residence. (GUARDIAN, NYT, BBC)

ISIS claim in Amaq (AMAQ)

12

UNCLASSIFIED
 UNCLASSIFIED

COUNTERTERRORISM DIGEST

ON POINT

10 FRANCE: Knife Attack in Nice, Three Killed

On 29 October, French authorities reported three people

were killed, one of whom was decapitated, in a knife
attack during morning mass at the Notre-Dame basilica
Brahim Aouissaoui, 21, who was shot and detained
shortly after the attack. France’s anti-terrorism prosecutor
acknowledged Aouissaoui was not known to intelligence
services, and opened an investigation for “assassination”
and “attempted assassination.”
The anti-terrorism prosecutor stated Aouissaoui carried
a document from the Italian Red Cross with him
showing he entered Europe through the Italian island
of Lampedusa at the end of September. He traveled to
Paris on 9 October. In addition to the blade used in the
attack, police found two other knives in a bag belonging
to the suspect. Two phones were also recovered.
being treated as a terrorist attack. French President
Emmanuel Macron announced additional soldiers would
be deployed to protect key French sites, such as places
of worship and schools.
On 29 October, a group calling itself Ansar Al-Mahdi in
Tunisia claimed responsibility for the Nice attack.
As of 1 November, French authorities arrested at least
six men suspected of being in contact with Aouissaoui
prior to the attack. (BBC, BBC, AP, LAMONDE,
NYT, AA)
JCAT: First responders may observe indications that
an edged-weapon attack is terrorism-related during the
course of an incident. An attacker’s actions or statements
during an operation may provide responders with insight
into potential motivations and possible follow-on tactics,
techniques, and procedures used by the attacker(s).
Also important for consideration is that an incident may
be part of a larger, complex and coordinated attack,
possibly entailing additional attackers who may target
highly aware of their surroundings and the nature of
the call for service, which may provide indications of an
follow-on attack. For more information, refer to the First
Responder’s Toolbox “Terrorist Messaging Urges Use of
Edged-Weapons” (2 November 2020) that is located on the
Special Interest Group (SIG) on FBI’s Law Enforcement
Enterprise Portal (LEEP) https://www.cjis.gov, the JCAT
tab on the Emergency Services (ES) and Intelligence COI
on Homeland Security Information Network (HSIN) https://
hsin.dhs.gov/, and on the ODNI website https://www.odni.
gov/index.php/nctc-how-we-work/joint-ct-assessment-team/

13

UNCLASSIFIED
 UNCLASSIFIED

COUNTERTERRORISM DIGEST

ON POINT

11 SPAIN: Authorities Dismantle Terrorist Cell

Recruiting for ISIS Online
On 28 October, Spanish National Police, supported by
Europol’s European Counter Terrorism Centre, arrested
three suspects linked to a terrorist cell actively recruiting
and indoctrinating young people. The suspects, which
included the alleged leaders of the cell, were arrested
during raids conducted in San Sebastian and Pasaia,
Spain. They were believed to have created the terrorist
structure to conduct acts of terrorism to support ISIS.
The cell disseminated large quantities of jihadist
propaganda through social media networks, with the
purpose of recruiting and indoctrinating young people.
The content included media which displayed minors
12 SWITZERLAND: Two Al-Qa‘ida Supporters
Convicted for Spreading Propaganda
On 27 October, a Swiss court sentenced Nicolas Blancho,
president of the Islamic Central Council of Switzerland
(ICCS), and media spokesman Abdel Azziz Qaasim Illi
to 15 months and 18 months in prison respectively, for
spreading propaganda supporting al-Qa‘ida in a retrial
following their previous acquittal.
Prosecutors originally charged the two Swiss nationals
online in 2015 that included interviews with leaders of
Jabbat al-Nusra (now Hayat Tharir al-Sham) at the time
al-Qa‘ida’s branch in Syria.
subsequently used online as propaganda for al-Qa‘ida.

networks, two of which had over 10,000 followers.
During planned meetings, the youngest members
allegedly received physical training and mental
conditioning to conduct terrorist acts. The cell reportedly
provided its members handbooks detailing the use and
distance themselves from al-Qa‘ida activities in Syria in
the 2015 videos.
The charges were made under a Swiss law that bans
al-Qa‘ida and ISIS. Blancho and Illi were found not guilty
in the earlier trial because the court stated prosecutors

The arrests were a result of a two year investigation

and an exhaustive analysis of information gathered (REUTERS)
throughout multiple operations conducted in Guipuzcoa
Province, Span. (EUROPOL)
JCAT: Terrorist inspired individuals often use social

join their cause. With this in mind, law enforcement and

private sector stakeholders should continue to encourage
community members to report suspicious or concerning
online activity for further investigation. Building and
sustaining strong partnerships between law enforcement
and the communities is vital in identifying those most at
risk for early intervention and the mitigation of terrorist
attack plotting.

14

UNCLASSIFIED
 UNCLASSIFIED
ON POINT
13 NETHERLANDS: Two Men Convicted in Terrorist
Plot Against Rotterdam Police Station
On 29 October, Ahmed B. and Mouad M. were convicted
and sentenced to prison for plotting a terrorist attack
against a police station in Rotterdam, Netherlands. Ahmed
B. was sentenced to eight years in prison while his alleged
accomplice Mouad M. was ordered to seven years and
nine months in prison.
Both men, originally from Morocco, were convicted on
accusations that “they intended to use weapons and
explosives to carry out attacks on arbitrary civilians and/
or a police station,” according to the court. Preparations
for the alleged attacks occurred between April and
mid-June 2018 in the Netherlands, but also possibly
in France and Germany. Both men were arrested on
17 June 2018 in Rotterdam.
The General Intelligence and Security Service (AIVD)
stated at least one of the suspects also wanted to
conduct an attack in France, and that he had a source
bomb vests.
The court stated, “During their arrest and during
a search of the house where they were staying in
Rotterdam, a total of four mobile phones were seized
and searched.” On the phones, a video shot of the
Erasmus Bridge was found. The video states that
nothing in their lives was more important than carrying
out the attack and dying like a martyr, according to
the court.
A search of the web browser histories on their phones
revealed sites with jihadist videos, propaganda, and
instruction manuals to create explosives. One phone
was used to visit 1,722 such web pages, the evidence
showed. (NL TIMES)
15
UNCLASSIFIED
COUNTERTERRORISM DIGEST
14 MALI: Court Sentences Two Men to Death Over
2015 La Terrace Restaurant Attack
On 28 October, a court sentenced Fawaz Ould Ahmed to
death after Ahmed pleaded guilty to shooting and killing
Bamako, Mali, in March 2015. Additionally, Sadou Chaka,
Ahmed’s co-defendant, was also sentenced to death for his
participation in the restaurant attack.
Ahmed described taking a taxi to the La Terrasse
restaurant and conducting the shooting. “On arrival
I went to the toilets, put on a balaclava, took out my
Kalashnikov, and shot those unbelievers,” he said.
He claimed “I regret nothing,” adding he was seeking
revenge for cartoons of the Prophet Mohammad printed
in the French satirical magazine Charlie Hebdo.
Ahmed claimed he was also involved in planning the
August 2015 attack on Hotel Byblos in Sevare, Mali,
which killed 17 people, as well as the November
2015 attack on the Radisson Blu Hotel in Bamako
which killed 20 people.
At the time of the attacks, AQIM and violent extremist
group, al-Murabitun, claimed responsibility for
the attacks.
Ahmed was captured in Bamako in 2016 as he was
preparing to conduct another attack, armed with
of al-Murabitun. (REUTERS)
JCAT: Perceived soft targets, including restaurants
and hotels, remain targets of interest to terrorists likely
because they are open and accessible to the public.
First responders can help improve security protocols,
increase awareness of suspicious activity indicators and
ultimately improve the ability to detect, deter, and disrupt
potential plots through community outreach. To promote
situational awareness, refer to the First Responder’s
Toolbox “Complex Operating Environment—Soft Targets”
(18 August 2017) can assist with outreach. According to
the First Responder’s Toolbox “Taxi Cab and Ride-Sharing
Service Partnerships – Potential Public Safety Force
Multiplier” (9 March 2018), drivers may have valuable
information to report in advance of an attack or evidence
to assist in an investigation after an attack. The products
are available on the ODNI website https://www.odni.gov/
index.php/nctc-how-we-work/joint-ct-assessment-team/
 UNCLASSIFIED
ON POINT
15 SAUDI ARABIA: Security Guard Attacked
Outside French Consulate
On 29 October, a Saudi man was arrested in Jeddah,
Saudi Arabia, after attacking and wounding a security
guard with a “sharp tool” at the French consulate.
The Saudi Foreign Ministry said the Kingdom “rejects
any attempt to link Islam and terrorism, and denounces
also condemned the caricatures, but have also cited the
prophet’s “mercy, justice, tolerance.”
France urged its citizens in Saudi Arabia to be on
maximum alert. (AP, REUTERS)
16 KENYA: Court Sentences Two Men to Prison for
Involvement in 2013 Westgate Mall Attack
On 30 October, a Kenyan court sentenced Mohamed
Ahmed Abdi and Hussein Hassan Mustafah to 26 and
11 years in prison, respectively, for their involvement in the
September 2013 Westgate Mall attack in Nairobi, Kenya,
which killed 67 people.
On 7 October, Abdi and Mustafah were found guilty of
charges including conspiracy to commit terrorism by
Chief Magistrate Francis Andayi said although there
support to the attackers, constant communication with
the gunmen “was giving support to their endeavors.”
On 13 September 2013, four al-Shabaab gunmen
grenades, leading to a four-day siege. The attack
the attack, al-Shabaab vowed retribution on Kenya for
in 2011. (AP, AP, BBC)
For previous reporting on Mohamed Ahmed Abdi and
Hussein Hassan Mustafah, please see the 14 October
2020 and 16 January 2019 editions of this publication.
16
UNCLASSIFIED
COUNTERTERRORISM DIGEST
JCAT: This incident highlights the importance of information
private-sector partnerships to create a common operating
picture. The First Responder’s Toolbox “Complex Operating
Environment – Shopping Malls” (23 May 2018) can assist
in identifying gaps and developing mitigation strategies
which will strengthen security measures and ensure a rapid
and adequate emergency response. The product may be
found on the on the ODNI website https://www.odni.gov/
index.php/nctc-how-we-work/joint-ct-assessment-team/
17 INDIA: Authorities Kill Hizbul Mujahideen Leader
in Kashmir
On 1 November, the Inspector General of Police
announced Saiful Islam Mir, a.k.a. Saifullah–the chief of
the Hizbul Mujahideen in Kashmir–was killed in Rangreth,
Srinagar District, Jammu and Kashmir.
Following his announcement in May, as the new
commander in Kashmir, Hizbul Mujahideen ordered Mir
to escalate activities and conduct a major attack in the
Valley as soon as possible.
In August 2017, the US Department of State designated
Hizbul Mujahideen as a foreign terrorist organization.
(REUTERS, HINDUSTAN TIMES)
18 INDIA: Authorities Arrest Al-Qa‘ida Supporter
On 2 November, India’s National Investigative Agency
(NIA) arrested Indian national Abdul Momin Mondal, 32, on
suspicion of being an al-Qa‘ida conspirator.
Mondal was allegedly part of a group of individuals
inspired by al-Qa‘ida and planning to conduct attacks
Delhi, and Kerala.
According to the NIA, Mondal was “involved in a series
of conspiratorial meetings convened by the members
of the al-Qa‘ida module. He was also trying to recruit
new members for the group and was raising funds for
furthering its terrorist activities.”
As of 2 November, the NIA had previously arrested
10 members of the group. (INDIA TODAY)
 UNCLASSIFIED

COUNTERTERRORISM DIGEST

TRENDS, TACTICS, & PROCEDURES

Hiraal Institute Releases Al-

Shabaab’s Financial System
Findings
In October, the Hiraal Institute, a research institute

collection system has improved, making it the only Somaliy

polity that has gained substantial money reserves.
Al-Shabaab collects non-voluntary payments of at
least $15 million a month using fear tactics towards
“taxpayers,” more than half of which comes from
Mogadishu. Al-Shabaab even collects revenue in rural
areas through levies on livestock, crops, and water.
All major businesses in Somalia give al-Shabaab
money, in the form of monthly payments and a yearly

In Mogadishu, imports are taxed by al-Shabaab based

on manifests from cargo ships.
Government and state employees give some of their
salaries to al-Shabaab to leave them alone.
If individuals refuse to pay, they are either killed or are
forced to shut down their businesses and leave the
country. Some, say paying al-Shabaab brings safety,
solves business disputes, and regulates production of
export items. (HIRAAL INSTITUTE, BBC, REUTERS)

Al-Shabaab funding methods (HIRAAL INSTITUTE)

18

UNCLASSIFIED
 UNCLASSIFIED
TRENDS, TACTICS, & PROCEDURES
Finnish Security and Intelligence
Service (Supo) Publishes 2020
National Security Overview
On 29 October, Supo published its latest National Security
Overview, highlighting foreign and domestic terrorism
threats in Finland. Supo assessed the likely short-term
threat of terrorism in Finland remained at level two
[elevated] on a four-point scale, and claims the principal
threats to the nation are by lone actors or small groups
who support radical Islamist or “far-right” ideology, and are
motivated by terrorist propaganda.
remained unchanged as Supo continued to identify
groups and individuals with the motivation and capacity
to conduct terrorist attacks in Finland.
links to foreign terrorist operators and networks. Some
participating in the operations of armed groups and
otherwise promoting such activities in those zones.
The report indicated ISIS, al-Qa’ida, and their
supporters remained a global threat. It is likely that
group members and supporters were seeking to
develop new tactics for mounting attacks, and will
continue to encourage attacks in Western nations.
The threat of “far-right” terrorism grew in the
West, with an increase in terrorist attack projects
seeking to maximize casualties over the past
18 months. Supporters and sympathizers of
in Finland. International “far-right” online groups and
communication over social media platforms reinforce
the transnational character of the “extreme right.”
(SUPO)
19
UNCLASSIFIED
COUNTERTERRORISM DIGEST
JCAT: The Finnish National Security Overview highlights
is a multi-agency, multidisciplinary, proactive, approach
against the many forms of terrorist ideology. Public
safety professionals from state, local, tribal and territorial
government agencies as well as private and public sector
stakeholders, are critical partners in preventing violence,
because they usually have initial contact with individuals
contemplating violence. For additional information, refer
to the First Responder’s Toolbox “Terrorism Prevention -
A Form of Violence Reduction” (30 October 2017). This
product can be found on the ODNI website https://www.
odni.gov/index.php/nctc-how-we-work/joint-ct-assessment-
India Designates 18 Pakistan-Based
Individuals as Terrorists
On 27 October, India designated 18 Pakistan-based
individuals as terrorists, including those involved in the
2019 Pulwama bombing, the 2016 Pathankot Indian Air
Force base attack, the 26 November 2008 Mumbai attack,
the 1999 IC-814 Indian Airlines hijacking, the 1993 Mumbai
attack, and other attacks over the years.
Among those declared, under the amended Unlawful
Activities Prevention Act (UAPA) that allows the seizure
of properties of these persons, are Sajid Mir, Syed
Salahuddin, Abdur Rehman Makki, Abdul Rauf Asghar,
Riyaz Bhatkal and his brother Iqbal Bhatkal, Chhota
Shakeel, Tiger Memon, and Javed Chikna, as well
as others.
The Indian Central Government amended UAPA
1967 in August 2019, to include the provision of
designating an individual as a terrorist. Prior to this
amendment, only organizations could be designated as
terrorist organizations.
According to a statement by the Ministry of Home
of terrorism from across the border and have been
country.” (HINDUSTAN TIMES)
 UNCLASSIFIED

COUNTERTERRORISM DIGEST

PARTING SHOTS

7 TANZANIA: ISIS Claims Arson Attack on Three

Christian Towns
On 30 October, ISIS Central-Africa in Tanzania claimed
Commissioner, and burning three Christian towns in
Mtwara, Tanzania. This was ISIS’s second-ever claimed
attack in the country. The previous attack occurred on
14 October. (ISIS)
9 SOMALIA: Military Court Convicts 11 Linked to
Prison Break by Al-Shabaab
In late October, a Somali military court convicted 11 people
over links to a 12 August prison attack where al-Qa‘ida
on duty during the 12 August prison attack were sentenced
being convicted of working with collaborators in the attack.
Mohamed Nur Isaq, who delivered food to the inmates, was
convicted of smuggling weapons into the prison before the

authorities established a task force to investigate the attack

and discovered it was an inside job. (GAROWE)

ISIS-Central Africa attack claim (ISIS-CENTRAL AFRICA)

JCAT: A variety of terrorist organizations and their

attack tactic, as its use requires little to no specialized
skills or training and its precursors are inexpensive,
legal, and readily available. The First Responder’s
Toolbox “Recognizing Arson With a Nexus To Terrorism”
(14 April 2017) provides situational awareness as well
10 MALI: French Forces Kill More Than 50 Terrorists
During an Operation in Central Mali
On 2 November, French Defense Minister Florence
Parly announced French military forces killed more than
50 terrorists and detained four during an operation in
the weapons and equipment belonging to the terrorists.
The Defense Minister went on to state this operation dealt

responders who may be required to discern criminal (AP, REUTERS)

arson from terrorist arson. The aforementioned product
may be found on the ODNI website https://www.odni.gov/
index.php/nctc-how-we-work/joint-ct-assessment-team/

8 NIGERIA: ISIS-West Africa Claims Killing

12 Christians and 10 Nigerian Troops in Two
Attacks
On 2 November, ISIS-West Africa claimed killing
10 Nigerian troops and 12 Christians in two separate
attacks, one between Bosso and Mallam Fatorni, Nigeria,

ISIS-West Africa used IEDs on Nigerian army vehicles

and in the second, they used automatic weapons.
(ISIS-WEST AFRICA)

21

UNCLASSIFIED
 UNCLASSIFIED

COUNTERTERRORISM DIGEST

PARTING SHOTS

15 WORLDWIDE: ISIS Continues to Incite Attacks

Against France in New Issue of Al Naba 258
On 29 October, ISIS published Al Naba 258, which
highlighted a photo from the aftermath of the knife attack
in Nice, France, earlier that day. ISIS argued that the

cause harm, and also “to target major French companies

operating in Muslim countries, and threaten their interests,
as this will prompt the governments and companies to call
on the people not to instigate Muslims.” ISIS also criticized
the Muslim Brotherhood, who they deem hypocrites for
asking France and the US to intervene in overthrowing
Arab tyrants. Al-Naba 258 also included a statement
on, in their words, statistics from its “Answer the Call”
military campaign, part of its “prominent operations,”
and highlighted the attack in which it booby-trapped the
body of a killed Shi’ite used to strike Iraqi intelligence
personnel. The statistics included 339 killed and wounded
in 75 attacks across eight provinces. (ISIS)

Al-Naba 258 article (ISIS)

23

UNCLASSIFIED