Jihadist Infiltration of Migrant Flows to Europe: Taking Stock of Recent Events

16.09.2019

Photo: Illustration

Author: Sam Mullins, Asia-Pacific Center for Security Studies

Last month, on 14 August, Swedish police arrested a man in the city of Östersund after receiving reports that he was driving around the town square in a suspicious manner. Initially detained due to probable cause of conspiracy to commit murder, this was changed the next day to conspiracy to commit “a terrorist crime”, based on evidence recovered from his vehicle. According to Swedish news services, he is a failed Uzbek asylum-seeker with possible links to Stockholm terrorist and fellow countryman, Rakhmat Akilov. On the same day that the Swedes arrested the as-yet unnamed suspect in Östersund, German authorities issued an indictment against three Iraqi nationals, who had also come to Europe as asylum-seekers, for planning a car-bomb attack inspired by jihadist ideology. Little more than two weeks later, Hungarian prosecutors charged 27-year-old F. Hassan—an alleged Islamic State (ISIS) commander from Syria, who had previously been granted refugee status in Greece—with crimes against humanity. He stands accused of having overseen the mass-murder of twenty-five people who refused to join ISIS, and having personally beheaded an imam in Homs in May 2015. Such cases seem to confirm now long-standing fears that terrorists have infiltrated migrant flows to Europe in order to conduct attacks. However, in order to understand the bigger picture we must place these events in context.

Suggestions that ISIS or similar groups might be infiltrating migrant flows date back to at least 2014 and still continue today. Many observers (including the current author) were initially skeptical. However, that began to change in November 2015 when it was discovered that two of the Paris attackers had indeed come to Europe posing as migrants. Later, it would emerge that almost the entire assault team had done the same, as had key members of the closely linked cell behind the March 2016 bombings in Brussels. We now know that these, and other well-known examples, such as the Berlin Christmas market attacker Anis Amri and the aforementioned Rakhmat Akilov, were just the tip of the iceberg. Even so, there is no need to panic.

In my recent book, Jihadist Infiltration of Migrant Flows to Europe: Perpetrators, Modus Operandi and Policy Implications, I identified and analyzed 144 alleged jihadist terrorists who infiltrated migrant flows to or within Europe from 2011 to 2018: who they were, how they traveled, what they did once inside European borders, and how they were captured or killed. Importantly, this number represents far less than 1% of the total number of recent migrants. Yet it is also much more than many might have guessed and as we have seen, they have already had a major impact. Moreover, there are numerous indications that the real number is considerably higher and —as recent developments have shown— the number of ‘terrorist asylum-seekers’ continues to grow. Fortunately, we now have a much clearer picture of the threat and of the vulnerabilities that terrorists were able to exploit. Security, both at the external borders and within Europe, is significantly tighter. Here’s what we now know.

To begin with, although more than a dozen European countries have played host to at least one terrorist asylum-seeker, Germany accounts for the lion’s share (just under half of the known total). Since Germany also took in the largest number of all recent asylum-seekers, it appears that this policy also placed the country at a heightened level of risk. Although this correlation is far from perfect—and is likely to be met with considerable unease—it is something that must be acknowledged nevertheless. The threat is roughly aligned with broader migrant flows in a number of other ways, including nationality, as well as routes, timing and methods of travel. Terrorist asylum-seekers have thus been dominated by Syrians (at 40%), followed by Iraqis, North Africans, and Afghans. Along with the bulk of recent irregular migrants coming to Europe, they mostly traveled by way of the Balkan route during 2015 and the vast majority appear to have utilized the same smugglers and been subject to the same hazardous traveling conditions as everyone else. Simply put, they tend to go with the flow.

Once inside Europe, 61% of terrorist asylum-seekers are known or alleged to have engaged in terrorist activities (others were members of terrorist organizations overseas but did not necessarily commit any offences after coming to Europe). Collectively, they have been responsible for at least a dozen attacks in six European countries (killing 182 people), as well as more than two-dozen thwarted or aborted plots directed against targets in Europe and four that were directed overseas. Notably, with one questionable exception, ISIS is the only terrorist organization to have invested in “external operations” against Europe by infiltrating the flow of migrants. Its greatest successes (Paris and Brussels) were largely organized and perpetrated by Europeans, for whom the throng of migrants provided the ideal cover to return home undetected. Most of the remaining attacks were committed by foreign nationals who appear to have radicalized after their arrival in Europe (as appears to have been the case for the three Iraqis recently indicted in Germany, and perhaps also the suspect arrested in Sweden). Indeed, it is important to differentiate between deliberate infiltration by existing members of terrorist organizations and radicalization of asylum-seekers within Europe, since there are quite different implications for counter-terrorism policy.

Besides planning and conducting attacks, almost a third of terrorist asylum-seekers have engaged in “non-violent” support activities, including promotion of jihadist ideology, recruitment, facilitation of travel and fundraising. A significant proportion of cases (58%) also showed some form of connections to, or involvement in, criminality, including smuggling, drug-dealing, and fraud. Abdesselam Tazi and Hicham El Hanafi, for example, allegedly acted as recruiters for ISIS after claiming asylum in Portugal in 2013. The two Moroccans also traveled extensively, using forty-seven different identities between them, and raised more than €70,000 using credit card fraud. Meanwhile, Syrian businessman Anwar Daadoue, who fraudulently claimed asylum in Sweden in 2012 and would later escape from a Danish prison, stands accused of being the head of a sophisticated network of smugglers and hawaladars. Daadoue’s gang is said to have moved more than €2 million, some of which it sent to Al-Qaeda’s then-branch in Syria, Jabhat al-Nusra. Al-Qaeda’s current declared presence in Syria, after Al-Nusra publicly severed relations with Al-Qaeda’s command structure, is Tanzim Hurras al-Deen.

Given that border controls had effectively broken down when most of these individuals came to Europe, it is not surprising to find that just nine terrorist asylum-seekers were stopped at external borders. The vast majority (85%) were detected within Europe itself (some having already committed attacks). Foreign partners—chief among them the United States—have assisted European counter-terrorism agencies in finding some of these operatives, for example through the use of signals intelligence (SIGINT). In the case of the recently detained Uzbek in Sweden, it seems to have been his own hesitancy and lack of trade-craft that led to his undoing. Meanwhile, the Iraqi car-bomb plotters in Germany were first detected by the domestic intelligence service, and Hassan was arrested at Liszt Ferenc Airport in Budapest while attempting to use false documents. Nevertheless, the single most important source of investigations into terrorist asylum-seekers (accounting for at least a fifth of all cases) has been tip-offs from people who were in contact with the offenders in question. This has included friends, family members, mosque officials, and people who work with migrants, but more often than not, tip-offs have originated from within the migrant community.

As encouraging as this is, this kind of assistance has not been without problems. According to German law enforcement and intelligence officials I spoke with, there were simply too many tip-offs about asylum-seekers, and too little evidence to back them up, that the vast majority led nowhere. Many, it seemed, came down to personal grudges and in fact were deliberately misleading or entirely false.

Investigations in this area frequently come up against the same, fundamental challenge that has plagued the attempted prosecution of returning “foreign” fighters—namely, lack of evidence from conflict zones. However, the problem is intensified when dealing with actual foreign nationals. As one federal investigator explained, “People who have never been to Europe usually don’t have criminal records here. People coming from countries with[out] … functioning state structures can’t be checked with their home country … [and] [p]eople with no legal documents may be checked, but may use false data, so that checks lead nowhere.” In other words, “We are dealing with people where we can’t prove their biography.” The result of this is that allegations rarely become charges, and even when they do, conviction is far from guaranteed.

Similarly, although information sharing between agencies tasked with counter-terrorism has long been recognized as one of, if not the central challenge in this field, it is exacerbated by the fact that a multitude of migration agencies—which have not traditionally been part of counter-terrorism strategies—are also involved and now have an important role to play. Commenting on this in 2017, an INTERPOL representative pointed out that “countries do not carry out systematic checks against INTERPOL’s databases as an integral part of their examination of refugee/asylum applications” and important information, such as a decision to deny asylum in relation to involvement in terrorism or crime, is not being systematically shared.

Fortunately, it is not all doom and gloom. Deals between the EU, Turkey, and Libya, though controversial, have dramatically reduced the number of migrants reaching European shores, making things far more manageable than they once were. At the same time, capacity at the external borders is vastly improved, thanks in part to additional manpower and expertise provided by the European Border and Coastguard Agency (better known as FRONTEX) and EUROPOL, meaning that all newly arriving migrants are properly registered and screened. Critically, this was not previously the case, meaning that many thousands of migrants were able to enter Europe without being subject to necessary security checks. As one border security official emphasized, the situation is now “much, much, much, much better … than it was at the height of the crisis in 2015”. This should make it much more difficult for known terrorists (those registered in databases) to penetrate external borders. FRONTEX and EUROPOL have also invested significant time and effort in developing a handbook of “common risk indicators” to assist frontline officers in detecting potential signs of involvement in terrorism that may then be used to refer suspects, who may not be registered in any databases, for second-line checks.

Within Europe, police and intelligence services are working more closely with migration agencies, as both parties now realize the importance of cooperation. In some places, counter-terrorism officials have also reached out to local reception centers and homes for asylum-seekers (many of which are run by non-governmental enterprises) in order to provide them with basic training, covering cultural awareness, potentially suspicious behavior worth reporting, and information about known extremists who are active in the area. Importantly, this kind of outreach helps to build trust and provides frontline migration workers with useful points of contact in case they have concerns.

These sorts of initiatives have been bolstered by important changes made to EU databases. To begin with, European national law enforcement agencies, as well as EUROPOL, were granted access to the EURODAC database, which is used to record the fingerprints of irregular migrants and asylum-seekers. By the same token, FRONTEX has been given access to the Schengen Information System (SIS II), which contains alerts in relation to people, vehicles and other objects for purposes of law enforcement and counter-terrorism. The SIS has also been updated to allow users to conduct searches using fingerprints, and it is now mandatory for EU member states to create alerts in SIS for all cases involving terrorism offences. In addition, a number of new alert categories have been created, including for return decisions and entry bans of foreign nationals. These, and other technical changes that are planned or underway, will further close the gaps that terrorists have been able to slip through.

In order to further restrict the possibilities for terrorists to infiltrate migration flows in future, there are a number of key areas that Europe must attend to. First and foremost is the need to improve information sharing with source countries and transit hubs outside of the EU. As a EUROPOL official explained, “What we need is intelligence … The better we can cooperate and exchange information and obtain this cooperation with these original countries [where terrorists are coming from] the more chances we have to detect … terrorists who come to the European Union through … illegal immigration flows.” Although the European Commission is pursuing exactly this kind of cooperation, it will no doubt take time to develop. There is also the added challenge of dealing with hostile or fractured states that are embroiled in conflict, which calls for enhanced military-to-law enforcement information exchange. Again, efforts are underway to address this, but there is still much that needs to be done.

Challenges of information sharing and cooperation within the EU must also be tackled. Counter-terrorism agencies must therefore continue to strive toward closer working relationships, both with each other as well as the various bodies responsible for migration and asylum-seekers. This might be facilitated by providing migration agencies with access to relevant law enforcement databases. For instance, INTERPOL has recommended expanding access to its databases “to all relevant authorities, including border control and authorities in charge of reviewing refugee/asylum applications”. At a more grass-roots level, outreach efforts—briefly described above—will be essential for enhancing “cross-phenomenon” cooperation and are likely to be key to cultivating improved human intelligence, which has shown to be crucial for detecting terrorists posing as asylum-seekers. Indeed, given that most of these individuals are detected not at the external borders, but within Europe itself (typically more than a year after they first arrive), this may be the most cost-effective option available.

Beyond measures aimed at improving detection of terrorist asylum-seekers in the first place, there is a need to find more efficient and effective ways of dealing with them. In the case of Anis Amri, for example, he was a well-known, violent extremist who had repeatedly expressed his desire to conduct attacks and was in contact with ISIS operatives in Libya. It is not unreasonable to suggest that the collective rights of European citizens should take priority over and above the rights of such individuals. Enhanced powers for preventive detention and deportation may be controversial, but there is growing recognition that in some cases they are necessary. The fact that Italy, a country that has made aggressive use of deportation, has not so far suffered a significant jihadist attack, suggests that this can be part of an effective strategy.

Of course, softer approaches are also necessary. Only 16% of terrorist asylum-seekers so far appear to have radicalized within Europe (the vast majority were already affiliated with terrorist organizations), but in-country mobilization to terrorism may grow over time. For this reason, it is important to try to reduce the vulnerability to radicalization before it can develop. In the context of asylum-seekers, this means improved opportunities for learning host country languages, as well as providing educational and job opportunities. As a staff member at a home for asylum-seekers observed, “People that come here are dying of boredom. … We have people that have been here for a year, eighteen months, that have nothing to do but look at the internet.” Naturally, efforts to improve the living conditions of recently arrived migrants and to enhance their chances of integration should not fall under the heading of counter-terrorism, but can nevertheless play an important role.

Although, according to the European Commission, the migration crisis is officially over, the effects, including the rise of populism and right-wing terrorism, in addition to jihadist extremism, are still being felt. Moreover, large-scale migration to Europe continues and there is ample reason to believe it will increase again in future. In the grand scheme of things, jihadist infiltration of these flows is relatively small and should not be the primary point of reference in approaching the issue of migration. It is nevertheless significant. Rather than blindly exaggerating the problem out of fear, or conversely denying that the problem exists, we must seek to continuously and dispassionately monitor and analyze it. Recent events in Sweden, Germany, and elsewhere in Europe, are a reminder that the threat persists, but at present, there are no indications that it is escalating. If anything, they provide additional evidence of Europe’s improving track-record in counter-terrorism. 

Author: Sam Mullins is a professor at the Asia-Pacific Center for Security Studies, Hawaii, and an honorary fellow at the University of Wollongong, Australia. At the time of conducting this research, he was a professor of counter-terrorism at the George C. Marshall European Center for Security Studies, Germany.

Note: The views expressed in this article are those of the author alone. They do not necessarily represent the position of the RCC specialized web site https://www.rcc.int/p-cve, which aims to provide a platform to a diversity of perspectives so that readers can make up their own minds in an informed way.

Source: Link