EUROPEAN UNION TERRORISM SITUATION AND TREND REPORT 2018

© European Union Agency for Law Enforcement Cooperation 2018.

Reproduction is authorised provided the source is acknowledged. For any use or
reproduction of individual photos, permission must be sought directly from the
copyright holders.
This publication and more information on Europol are available on the Internet.
ISBN 978-92-95200-91-3
www.europol.europa.eu DOI 10.2813/00041
QL-AJ-18-001-EN-N
CONTENTS 04
FOREWORD
05
TRENDS

08
GENERAL OVERVIEW
21
JIHADIST TERRORISM
Terrorist attacks and suspects arrested Terrorist attacks and suspects arrested
Terrorist and violent extremist activities in the EU

The convergence of cyber and terrorism Terrorist situation outside the EU

Convictions and Penalties Kidnappings

45
ETHNO-NATIONALIST AND
48
LEFT-WING AND
SEPARATIST TERRORISM ANARCHIST TERRORISM

51
RIGHT-WING TERRORISM
53
SINGLE-ISSUE TERRORISM

A1 Overview of the failed, foiled and completed attacks in 2017 per EU

54
Member State and per affiliation

A2 Arrests in 2017 per EU Member State and per affiliation 55

A3 Convictions and penalties (Eurojust) 57

annexes A4 Europol activities in counter-terrorism 60

A5 Methodology 63

A6 Acronyms 65

A7 Amendments in national legislation on terrorism in 2017 66

 TESAT 2018 4

FOREWORD

In 2017 European countries were ten-year period comprised the largest and volume of terrorism that the EU
again hit by terrorist attacks and there proportion of attacks reported by faced in 2017. Although the majority
were many innocent victims of this Member States. In contrast, the of Member States reported that they
indiscriminate violence. It therefore threat of jihadist terror has increased did not experience any terrorist attacks
goes without saying that combatting considerably since 2006, culminating during the reporting period, the human
terrorism remains a top priority for in large-scale attacks such as those suffering and the threat of attacks
Europol. in Paris in 2015 and in Brussels, Nice remains high. In this report you will
To fight terrorism, it is essential to and Berlin in 2016. Attacks committed not only find information about how
have optimal information exchange by right-wing extremists have rarely many terrorist attacks took place in
and accurate data. That is why the EU been reported by Member States over 2017, but also the number of arrests
Terrorism Situation and Trend Report the years and were therefore never and convictions for terrorist crimes. A
(TE-SAT) was created in 2007 so that the prominently covered in the TE-SAT. brief overview of the terrorist situation
European Parliament and all national The same applies to acts of single- outside the EU is also included.
governments and police forces have an issue terrorism, whereas left-wing
I would like to thank all EU Member
overview of the European situation on extremist terrorism appears to be a
States, Eurojust and our cooperation
an annual basis. Since the first report, constant in some Member States, as
partners outside the EU for their
which gave an overview of the situation reflected in the TE-SAT reports over the
contributions to the TE-SAT 2018.
in 2006, many things have changed. years. However, none of the reported
Finally, I would like to acknowledge
Although it already appeared that the activities in any terrorist category have
the work of the members of the
internet played an important role in the been as lethal and have had such an
Advisory Board, consisting of the
radicalisation of some perpetrators, impact on society as a whole as those
‘troika’ (Presidencies of the Council
and terrorists showed a preference committed by jihadist terrorists – such
of the EU, namely Estonia, Bulgaria
for improvised explosive devices, as those also committed in 2017 and
and Austria), France, Spain, Eurojust,
the terrorist landscape has further since the beginning of 2018.
the EU Intelligence and Situation
diversified and the threat has increased. This 2018 edition of the annual TE-SAT Centre (INTCEN) and the Office of the
In the years following the first edition provides an overview of the nature EU Counter-Terrorism Coordinator.
of the TE-SAT, the overall number Their valuable contributions were
of terrorist attacks in the European indispensable for the production of this
Union (EU) decreased, largely owing 2018 edition of the TE-SAT.
to a substantial drop in the number The numbers in this report are not
of separatist attacks, which over a just statistics. Behind every number is
human suffering. I therefore want to
close this foreword with a thought for
the victims of terrorist violence.
“We must never
forget that behind
every number there
is an innocent
victim.”

Catherine de Bolle
Executive Director of Europol
 TESAT 2018 5

TRENDS

#1
In recent years there has been an increase in the
frequency of jihadist attacks, but a decrease in the
sophistication of their preparation and execution.
Jihadist attacks, however, cause more deaths and
casualties than any other terrorist attacks.

#2
Recent attacks by jihadist terrorists have followed
three patterns: indiscriminate killings (London,
March and June 2017; and Barcelona, August
2017); attacks on symbols of Western lifestyle
(Manchester, May 2017); and attacks on symbols
of authority (Paris, February, June and August
2017). New attacks in the EU by jihadist terrorists
following one of these patterns or a combination
thereof are highly likely.

#3
Jihadist attacks are committed primarily by home-
grown terrorists, radicalised in their country of
residence without having travelled to join a terrorist
group abroad. This group of home-grown actors is
highly diverse, consisting of individuals who have
been born in the EU or have lived in the EU most of
their lives, may have been known to the police but
not for terrorist activities and often do not have
direct links to the Islamic State (IS) or any other
jihadist organisation.

#4
Recent attacks prove jihadist terrorists’ preference
for attacking people rather than other targets
provoking less of an emotional response from the
general public, such as damage to premises or loss
of capital.
TESAT 2018 6

#5
Jihadist terrorists may operate in groups, but
have often found to be lone actors. They may have
managed to keep their environment completely in
the dark about their intentions prior to the attack.
However they may have friends and relatives in their
environment who know of, sympathise with, facilitate
or even assist in the preparation of an attack.

#6
The number of individuals travelling to the conflict
zones in Iraq or Syria to join jihadist terrorist groups
as foreign terrorist fighters has dropped significantly
since 2015. The number of returnees was low in
2017.

#7
Online propaganda and networking via social media
are still essential to terrorist attempts to reach out
to EU audiences for recruitment, radicalisation
and fundraising. As IS’s capacities to produce new
propaganda material are severely affected by losses
of both operatives and infrastructure, the group
continues to spread its message to wide audiences,
by increasingly redistributing older material by new
means.

#8
The often rudimentary and fragmented knowledge
of Islam of (aspiring) jihadist terrorists makes them
vulnerable to being influenced and manipulated
by those who selectively use religious texts to fit a
violent ideology.
TRENDS 7

#9
The degradation of IS organisational structures may
reduce the attractiveness of the group. However,
this may not affect the threat of jihadist terrorism,
as disaffected IS members and sympathisers –
including those residing in EU Member States – will
likely continue to adhere to jihadist beliefs and might
be drawn to join other groups, such as al-Qaeda.
Al-Qaeda is still a powerful player and actively
encourages terrorist attacks in the EU. Near-future
terrorist activities in the EU ordered, guided or
inspired by al-Qaeda or other jihadist organisations
remain a realistic possibility.

#10
Ethno-nationalist and separatist terrorist attacks
continue to far outnumber attacks carried out by
violent extremists inspired by any other ideologies or
motivations.

#11
The violent right-wing extremist spectrum is
expanding, partly fuelled by fears of a perceived
Islamisation of society and anxiety over migration.

#12
There is no evidence of chemical, biological,
radiological or nuclear (CBRN) weaponry being used
by terrorists in the EU, despite indications of jihadist
terrorists taking an active interest in its possibilities.
Improvised explosive devices, firearms and
improvised weapon, such as knives and vehicles,
are the weapons of choice with which recent
attacks were carried out. These weapons, except for
explosive devices, do not require much preparation
or special skills to be employed in terrorist attacks,
which are either carefully prepared or carried out
spontaneously.
 TESAT 2018 8

1/ GENERAL
OVERVIEW
 GENERAL OVERVIEW 9

terrorist attacks and

suspects arrested

Attacks figure 1
(police and military forces). In terms
of weaponry, the use of firearms and
Number of failed, foiled or completed explosives were the most prevalent4.
In 2017 a total of 205 foiled, failed attacks from 2014 to 2017. However, compared to previous year,
and completed terrorist attacks were the use of explosives decreased from
reported by nine EU Member States. 40% to 30%. Firearms were used in
The United Kingdom (UK) experienced
226
41% of all attacks, a slight increase
the highest number of attacks (1071), compared to 2016 (38%). Hungary
followed by France (54), Spain (16), 205 mentions that because of the past
Italy (14), and Greece (8). Belgium and 193 conflicts between Western Balkan
Germany reported 2 attacks each; countries and the ongoing unrest in
Finland and Sweden noted 1 attack Ukraine, large amounts of small arms
each. Spain, Finland and Sweden are available on the market.
reported on jihadist terrorist attacks
after a long period of having been 142
unaffected by this phenomenon. In
2017 68 victims died as a result of
terrorist attacks and 844 people were
injured2. Similarly to 2016, nearly all figure 2
reported fatalities and casualties were Failed, foiled or completed attacks by
the result of jihadist terrorist attacks3. affiliation in 2017.

The total number of attacks (205) is 2014 2015 2016 2017

a deviation of the downward trend
that started in 2014 owing to a 45 %
compared to 2016 (99). The countries
67%
Separatist
increase in the number of attacks in
2017 compared to 2016 (142). reporting terrorist attacks linked
to separatist terrorism are the UK
Overall, attacks specifically classified (88), France (42) and Spain (7). The
as ethno-nationalist and separatist number of jihadist terrorist attacks
accounted for the largest proportion more than doubled, from 13 in 2016
(137) and represent an increase to 33 in 2017. Attacks carried out by
left-wing terrorists reached a total 16% 12% 2%
N/S
of 24, of which most were reported Jihadist Left-wing
1
88 attacks reported by the UK were acts of 3%
security-related incidents in Northern Ireland. Of by Greece (8) or performed by Greek Right-
these, five involved attacks on national security wing
perpetrators in other countries (2).
targets.
2
Data sourced from media reports and Terrorist attacks primarily targeted
contributions of EU Member States. Figures exclude
casualties of Northern Ireland security-related
civilians and private enterprises,
incidents. followed by public institutions and
3
62 people died and 819 were injured in jihadist representatives of law enforcement 4
88 security-related incidents in Northern Ireland
attacks in 2017. included 58 shooting incidents and 30 bombings.
 TESAT 2018 10

Arrests
In 2017 a total of 975 individuals 2015; 84 in 2016 and 30 in 2017).
figure 3 were arrested in the EU for terrorism-
Number of arrested suspects from 2014
In 2017 most arrests (660) were
related offences, which represents
to 2017. performed on suspicion of
a continuation of a downward trend
participating in activities of a terrorist
(1077 in 2015; 1002 in 2016). 18 EU
group; planning; and preparing attacks.
Member States reported arrests of
1077 73 persons were arrested on suspicion
suspects. Similarly to 2016, the overall
1002 of facilitating terrorism (dissemination
975 number of arrested persons remained
of propaganda, recruitment and
highest in France (411), the UK (168)
financing of terrorism). Arrests for
and Spain (91).
774 travelling to conflict zones for terrorist
Most arrests (705 out of 7915) were purposes continued to decrease for the
related to jihadist terrorism. This third year in a row (141 in 2015; 77 in
number does not follow the trend of a 2016 and 28 in 2017).
continuous increase in jihadist arrests
The average age of those arrested was
prevalent over the past three years
30, with 45% of the suspects falling
(395 in 2014; 687 in 2015; and 718 in
in the range of 20-30 years old; 25%
2016). Similar to 2016 the number of
in the range 30-40 years old. More
arrests for left-wing and right-wing
than 80% of the arrestees were male.
terrorism remained low (36 and 20
The number of EU citizens among
arrested persons in 2017 respectively;
the arrestees comprises 50% and is
31 and 12 – in 2016). The number of
between the proportions of previous
arrests for separatist terrorist offences
years (58% in 2015; 43% in 2016).
2014 2015 2016 2017 continued to decrease sharply (168 in

5
184 terrorism-related arrests for 2017 were
reported without differentiating between types of
terrorism, therefore they are not included in the
ranking.

1 9

figure 4
Attacks and arrests by EU Member State
1 1
in 2017.

17

11

35 2
107 168
2 58
2 50
1

48 2
54 411 2

14

1 16 91 14 39
8 15
 GENERAL OVERVIEW 11

terrorist and violent

extremist activities

Financing of terrorism ascertaining the origin and destination of

financial transactions. Value transfer systems
such as hawala are highly adaptable to
conditions such as war, economic sanctions
In 2017 Member States carried out several
and blockades, and are reliable alternative
investigations into financing of terrorism.
outside of the conventional banking system.
One major investigation focused on a large
They offer possibility to transfer money
network of Lebanese nationals offering
without direct money/value flows between
money laundering services to organised
sender and receiver thus tracing the money/
crime groups in the EU and using a share
value flow in a hawala network is virtually
of the profits to finance terrorism-related
impossible. Many prominent hawala
activities of the Lebanese Hezbollah’s military
operators are based in the United Arab
wing. The cooperation of these money
Emirates (UAE), which frequently serves as
launderers and Hezbollah’s military wing
the international platform for illicit finance
was a clear example of a nexus between
activities.
organised crime and terrorism. Another
such investigation dealt with the financial Money being transferred via the hawala
support of foreign terrorist fighters (FTFs) system generally moves from – and not to
in the conflict zones in the Middle East (Iraq – the EU. It is probable that hawala is used
and Syria) and North Africa (Libya). This more often by support networks that send
investigation uncovered the mechanism used money to terrorist organisations abroad than
by FTFs to obtain financial support from for plotting attacks within the EU.
their families in Europe through a network
Diaspora communities living in the EU
of facilitators and money collectors. The
play a significant role in financing and
monitoring of around 5 000 money transfers
procurement activities for conflicts in their
from around 2 000 senders to around 1 000
countries of origin. There is a high potential
recipients, for a total amount of more than
for mobilisation with regard to fundraising
EUR 2 million, provided proof of life of
among jihadist sympathisers. In most cases,
known FTFs and, interestingly, also identified
the calls for donations are made in mosques,
previously unknown FTFs and sympathisers
via websites and web fora. Non-profit
of IS.
organisations (NPO) may be used for money
The above investigations and other cases laundering and terrorism financing under the
of financing of terrorism together illustrate umbrella of humanitarian activities.
the diverse methods that the financing
The Partiya Karkeren Kurdistan (PKK,
of terrorism may employ, from very basic
Kurdistan Workers’ Party) is known to
to highly complex schemes. In terrorism
systematically and, if need be, forcibly collect
financing, cash transactions, in which
funds in the EU to finance its activities. The
couriers may be used, and unregulated and
organisation also uses front organisations
illegal financial networks take a prominent
and charities in the EU for this purpose and
role. The use of informal value transfer
is suspected of being involved in criminal
services6 adds significant complexities to
activities to supplement its income to cover
expenses in Turkey, the Middle East and
6
Hawala is an informal method of money transfer based on Europe.
trust and honour, operating outside the traditional banking
system, whereby money is paid to a network of brokers
(known as a hawaldars).
 TESAT 2018 12

Kidnapping remains a high-profile

form of jihadist terrorism impacting
on foreign nationals overseas. The
prospect of large ransom payments,
apart from prisoner exchanges or
increased notoriety via propaganda,
ensures terrorist groups continue to
view foreign hostages as valuable
commodities.
Most terrorist activities with which
the EU was confronted in recent
years, irrespective of affiliation,
were inexpensive and did not
require external sources of funding,
in particular attacks committed by
lone actors using weapons such as
cars and knives. For instance, micro-
financing of jihadist groups operating
in the EU usually works via the private
financial means of group members. In
addition to licit employment incomes,
state subsidies and social benefits,
funds provided from like-minded
individuals within the community are
the main sources of income. Dissident
Republicans in Northern Ireland
are associated with both minor and
serious criminality, including drug
dealing, extortion and fuel laundering7.
Anarchist and right-wing extremist
groups are mainly financed by their
members through contributions and
fundraising events (parties, concerts).
Members of the anarchist and left-wing
extremist milieus have been found to
sometimes revert to crime (robberies of interest; economic structures, such
banks and supermarkets). Explosives as banks, branches of multinational
Virtual currencies, among which companies; and law enforcement
Bitcoin is the most well-known, have targets. These anarchist groups either
Although the majority of attacks in sent parcels with explosive contents
gained popularity due to their key
2017 were committed using simple to their targets by postal services, left
characteristics that include ease of
means, the use of explosives remains improvised explosive devices (IEDs),
access, anonymity, safe transactions,
a preferred modus operandi for improvised incendiary devices (IIDs) at
low cost and high speed for
terrorists, because of their proven their target locations, or carried out
international transfers. Their expansion
effectiveness and, for jihadist terrorists attacks by throwing IEDs or IIDs while
among terrorist organisations, however,
in particular, their ability to create mass passing their targets.
seems to be slow and has not yet
casualties and high media impact. In
matched the use made of them by However, lacking the ability to acquire
a number of jihadist attacks in 2017,
organised crime groups, especially military-grade explosives and firearms,
the perpetrators wore person-borne
those involved in cybercrime. The or having no wish to do so (possibly
improvised explosive devices (PBIEDs)
number of known cases of virtual to evade the higher risk of detection)
in suicide vests or belts, although these
currencies related to terrorism has led terrorists to primarily use
mostly proved to be fake.
financing remains very low. rudimentary IEDs made of home-made
Anarchist groups have used explosives explosives (HMEs). The HME production
7
Fuel laundering is removing the dye from low-price against state structures, including undertaken by the cell responsible for
dyed fuel and selling it illegally at the higher price of public services and services of general the August 2017 attacks in Barcelona
undyed fuel.
 GENERAL OVERVIEW 13

special knowledge was required. The

attack methodologies and capabilities
used by Dissident Republican (DR)
groups in Northern Ireland vary. In
many attacks, firearms or small IEDs
such as pipe bombs were used, but
they also deployed larger and/or
potentially more destructive devices
such as vehicle-borne IEDs (VBIEDs) and
explosively formed projectiles (EFPs).
All groups retain access to a range of
firearms and explosives and there is an
ever-present threat of under-vehicle IED
attacks.
Explosive remnants of war (ERW) and
illicit trafficking of explosives from
former conflict areas still present a
significant threat to the EU. Hand
grenades, rocket launchers, high-grade
explosives and detonators are mostly
used by various organised crime groups.
However, some terrorist groups, such as
Northern Irish DR groups, are known to
have acquired and used these weapons
as well. Some of the military explosive
ordnance is sourced via thefts from
military explosive storage facilities
and the illegal collection of ERW and
unexploded ordnance (UXO).
The use of pyrotechnics in constructing
IEDs is mostly employed by left-wing
extremist and separatist groups.
However, there have also been cases
and Cambrils, for example, has shown conducting legitimate business. in which jihadists have misused
that jihadist individuals and groups may pyrotechnic articles (alone or in
With regard to HMEs used by jihadist
have the ambition to execute complex combination with HMEs) in preparing
terrorists, triacetone triperoxide (TATP)
plans and conduct large-scale IED IED attacks. This development might
continued to be predominant. It was
attacks. The acquisition of HME-making be explained, at least partially, by
noted however, that in some cases,
knowledge has mostly been facilitated the lack of success by some terrorists
terrorists used TATP in combination
by the internet and encrypted social with regard to producing and using
with other types of explosive materials,
networks, such as Telegram, WhatsApp TATP. In addition to legal pyrotechnics
in order to enhance the IED’s power
and Facebook. Even though content shops and illegal street markets, online
and aggravate their lethal effects. In
such as bomb-making instructions shops and vendors on various social
those instances TATP has mostly been
is continually removed from the networks have become the main
used as a booster, while the terrorists
internet, various sites persist where sources of illegal pyrotechnic articles.
used ammonium nitrate (AN)-based
such information can be retrieved. Their characteristics and availability
explosives and/or gas cylinders/
The internet is also increasingly used make pyrotechnics a viable alternative
cartridges as a main or additional
for online procurement of explosives to TATP and their use in IEDs has been
charge.
precursors through web shops located widely promoted in various online
in various EU Member States. The In 2017 IEDs used in anarchist attacks jihadist bomb-making instructions.
procurement of explosives precursors were made from an array of readily Using gas cylinders to cause explosions
from outside the EU is also facilitated available shop-bought materials. They in attacks is also promoted through
by legal companies apparently were simple devices for which no these media.
 TESAT 2018 14

Threats to
contaminate food by
anarchists

On 19 December 2017 anarchists

published threats on the internet to
contaminate food products in Athens
and Thessaloniki in Greece. An activist
group claimed to have deliberately
introduced hydrochloric acid in soft
drinks, milk, sausages and sauces. A
CBRN of Lone Jihad” series8, released by
Furat Wilayah Channel in English in
post by user Green-Black Commando
titled “Green Nemesis Act 3” on the
2017, specifically suggested CBRN Athens Indymedia website warned that
scenarios involving food and water the group had poisoned several drink
As in previous years, no terrorist
contamination as possible terrorist products of multinational companies
attacks using chemical, biological,
tactics for lone actors. The proposed with hydrochloric acid and that they
radiological or nuclear (CBRN)
simple methods with use of available would be replacing the items on
substances were recorded in the EU in
means allow untrained individuals, supermarket shelves shortly after. They
2017. No EU Member States reported
even lone actors, to put in practice also posted online photos showing the
that any of their investigations involved
attacks with CBRN materials. By poison being injected into the products.
planning or preparations for terrorist
suggesting simple methodologies, Similar threats of food contamination
attacks with a CBRN component, such
terrorist organisations make CBRN in Greece were published by anarchists
as recruitment of skilled individuals,
attacks more accessible with the in previous years, in 20169 and 201310.
attempts to access CBRN facilities or to
intention of increasing the number These plans usually involve targeting
acquire CBRN materials.
of attempts in the hope of carrying major multinational corporations in
CBRN-related topics recurrently out a successful attack regardless order to force them to withdraw their
appeared in the terrorist propaganda of the initial scientific knowledge or products, thereby generating significant
online. The number of online experience of the actor. loss of revenue, in particular during
jihadist propaganda messages and busy periods of the year.
A plot to create an improvised
tutorials addressed to lone actors
dispersal device to release toxic
and proposing easy-to-implement
hydrogen sulphide gas, which was
scenarios for small scale CBRN attacks
disrupted in Australia when the
increased compared to previous years.
suspects were arrested on 29 July
In particular, several jihadist media 9
In December 2016 Greek anarchists published a
2017, illustrates the intent of jihadist warning claiming they contaminated several food
outlets used social media channels and drink products produced by multinational
terrorists to use chemical weapons
to release knowledge about chemical companies. The operation called Green Nemesis #2
in a terrorist attack in the West. In was planned to take place during the Christmas and
weapons and related terror tactics in
this CBRN terrorist-related case, New Year period in the Attica region of Greece. The
2017. warning message posted on the anarchist website
the perpetrators had reached the explained how to introduce chlorine and hydrochloric
CBRN materials recommended as preparation phase, including procuring acid to products while leaving packaging intact.
terrorist weapons are usually toxic components and precursors, designing, 10
Similar threats to contaminate beverages produced
by the same multinational company were also
industrial chemicals accessible within and testing a device. expressed in December 2013.
the EU due to their dual use nature
and use in many peaceful applications.
Several documents from the “Knights 8
Series of articles published on social media.
 GENERAL OVERVIEW 15

the convergence of cyber

and terrorism

Recruitment and Cyber-attacks accounts on Facebook and Twitter.

More recently, in December 2017, the
propaganda Electronic Ghosts of the Caliphate (EGC)
threatened to conduct a global cyber-
While terrorist groups use the internet
attack. However no attack materialised.
to reach their followers and spread
By 2017 over 150 social media their message, their capability to launch Some studies12 suggest that, rather than
platforms were identified as being attacks via the internet appears to trying to develop their own capability
abused by terrorists for propaganda remain extremely limited. The absence and tools, some terrorist groups now
dissemination11. Additionally file sharing of any major cyber-attacks by terrorist turn to online criminal markets, using
sites are used to store and disseminate organisations can be interpreted as the the crime-as-a-service industry to buy
terrorist content, messaging and bot result of a lack of appropriate technical access to the capabilities that they
services advertise links to such content skills within the groups. A number of themselves are lacking. If this is true,
and social media aggregators store cyber-terrorist groups have come to it is likely that the effectiveness of
and stream content to other social light over the past few years. However cyber-terrorist groups will increase,
media platforms. Industry and law the overall threat from a cyber-attack of perhaps with short delay. Such attacks
enforcement action however have terrorist origin appears to remain low. are unlikely to create as much public
resulted in a reduction of the terrorist attention as a real-world attack.
abuse of mainstream platforms such The Islamic State Hacking Division,
However a cyber-attack may amplify
as Facebook, Twitter and YouTube, also known as the United Cyber
the impact of a real-world attack, if
but similar progress has yet to be Caliphate, incorporates any online
carried out in conjunction with the
made with start-up social media and group identifying itself as the digital
latter, in what may be called a hybrid
companies with limited resources. army for IS. To date, this has included
attack, for example, by disrupting
the Caliphate Cyber Army, which was
Most terrorist activity concerns the emergency or other essential public
largely responsible for a number of
surface web. Some terrorist activity services.
website defacements; the Islamic Cyber
however can also be found on the Army, which is believed to be focused
Darknet. This mostly relates to on gathering intelligence related to
fundraising campaigns, the use of illicit the energy industry and power grids,
markets and further advertisement purportedly in preparation of an attack;
of propaganda hosted on mainstream and the Sons of the Caliphate Army,
social media.
12
Wolf, K., Cyber jihadists dabble in DDOS: Assessing
which focuses on hacking social media the threat, 2017, https://www.flashpoint-intel.com/
blog/cyber-jihadists-ddos
11
Europol, Internet Organised Crime Threat
Assessment (IOCTA) 2017, 2017, p. 53.
 TESAT 2018 16

convictions and
penalties

In 2017 17 Member States reported (125), followed by France (120) and respect to defendants who were
a total of 565 individuals who were Belgium (85)15. In France and Spain believed to be in conflict zones or
convicted or acquitted of terrorist four individuals were tried twice were claimed to have died but were
offences13. This number is similar to during the year in different terrorism not officially declared dead. Some
the numbers submitted over the past proceedings. As a result, the total individuals sentenced for terrorist
two years14. number of verdicts pronounced for offences in 2017 had previously been
terrorism-related offences in 2017 was convicted of terrorism in the same
In 2017 the UK was the Member State
569. Member State or abroad.
that reported the highest number
of individuals in concluded court Some of the defendants who appeared The majority of the verdicts reported
proceedings for terrorist offences before courts in the EU Member in 2017 are final, while others are
States were minor of age at the time pending judicial remedy, as appeals
of trial and/or when the offences have been submitted16.
13
Eurojust received contributions containing
information on terrorism-related court decisions
were committed. The number of
in 2017 from the following Member States: Austria, female defendants judged in 2017 (66)
Belgium, Czech Republic, Denmark, Estonia, Finland, increased compared to 2016 (53). The
France, Germany, Greece, Italy, Lithuania, the
16
According to Council Decision 2005/671/JHA,
Netherlands, Poland, Portugal, Spain, Sweden and practice in some countries to render the information to be submitted to Eurojust is in
relation to final convictions. Due to the specifics of
the UK. sentences in absentia continued with reporting, some Member States submit information
If a verdict pronounced in 2017 was appealed and on final decisions only, while other Member
the appeal was concluded before the end of the States report also on not final decisions. The data
year, Eurojust reported only on the latest/final 15
The UK contribution includes proceedings on provided by the UK did not distinguish between final
verdict. offences under anti-terrorism legislation, as well decisions and decisions pending judicial remedy.
14
Please refer to Annex I for additional information as other offences assessed to be terrorism related. As reported, all convictions in the UK are effective
and clarification on the numbers mentioned in this Similar to previous years, the UK data for 2017 from the moment of their being pronounced, even if
section. refers only to convictions. an appeal is made.

figure 5 580
Number of individuals in concluded court
proceedings for terrorist offences in 2015, 565
2016 and 2017, as reported to Eurojust*. 513

* The data for the previous years

corresponds to the data reported in the
respective TE-SAT reports.

2015 2016 2017

 GENERAL OVERVIEW 17

Type of terrorism

In 2017 the vast majority of verdicts

(352) in the Member States concerned
jihadist terrorism confirming a trend
that started in 201517. Similar to
the recent years, the largest part of
the verdicts for jihadist terrorism
concerned offences related to the
conflict in Syria and Iraq; however of Antwerp in July 2017. The court four-year sentences given to the other
persons who had engaged with Al found them guilty of (attempted) three.
Qaeda, the Taliban or Al-Shabaab were participation in the activities of a
also tried in 2017. In one case in Austria In Spain six men were sentenced
terrorist group (ISIL). The court found
a member of Hamas was imprisoned to six years in prison each after
that three of the defendants had
for life after the Supreme Court found the National Court found them
formed the core of Way of Life – the
him guilty of membership in a terrorist guilty of membership in a terrorist
new jihadist group that adopted the
organisation and attempted incitement organisation. The six had supported
ideology of the banned Sharia4Belgium
to murder as terrorist crime. Muslim radical extremism, aiming to
– and had tried to recruit young men
recruit fighters for Al Qaeda in order
The highest number of verdicts for via a non-profit organisation. Four of
to carry out attacks in the Maghreb
jihadist terrorism in 2017 (114) were the defendants had unsuccessfully
or in the West. They had used several
rendered in France. Austria, Denmark, tried to reach Syria, while two others
networks, such as Blogger, Contactime,
Estonia, Finland, Italy, Poland, Portugal had succeeded and one already
Facebook, Flickr, Google+, Issuu,
and Sweden reported only verdicts returned. Some of the verdicts were
Paltalk, Scribd, Twitter and YouTube,
for jihadist terrorism in 2017. The vast appealed and upheld by the Court of
to spread propaganda, share their
majority of jihadist terrorism verdicts Appeal of Antwerp in December 2017.
strong disapproval of Western society,
rendered in 2017 was in relation to ISIL In Italy the Court of Appeal of Trento distribute combat manuals to train
or its affiliated groups. confirmed a sentence issued by a their followers for potential missions,
In Belgium, for example, seven lower court against four members and organise meetings. One of the
members of the Salafist group Way of of the Merano cell of the terrorist men had established Sharia4Spain,
Life were sentenced to prison terms of group Rawti Shax. Rawti Shax had cells the Spanish branch of the global
up to five years by the Criminal Court in Europe and the Middle East that Sharia4 movement. The group had also
communicated and operated via the established an independent system for
internet and had provided logistical financing its activities and had shown a
17
The data provided by the UK was not broken down and financial support to recruiting particular interest in the development
by type of terrorism and is therefore not included in foreign terrorist fighters to be sent of biological or chemical weapons.
the numbers that follow.
to Iraq and Syria. Their stated aim
In 2017 courts in the EU Member
was to establish a theocratic state
States continued to refer to the
and to overthrow the government of
so-called ISIL registration forms
Kurdistan. The Merano cell members
filled in upon entry into the terrorist
had been arrested as part of a big
organisation. In the Netherlands, for
multinational operation coordinated by
example, the authorities launched an
Eurojust in November 2015. The court
investigation into alleged participation
ruled that they were theoretically
in a terrorist organisation triggered
capable of carrying out attacks and
by information on such a registration
confirmed the six-year sentence given
form provided to the Dutch Military
to one of the group members and the
Intelligence and Security Service
 TESAT 2018 18

by the US Department of Defense. Dutch criminal law. In Lithuania a man A smaller number of the defendants
Corroborating it with other evidence, who had attempted to support and in 2017 were tried for glorification
the District Court of Rotterdam held finance the Real IRA was imprisoned by of terrorism, recruitment and (self-
that the registration form attributed to the Court of Appeal. ) training for terrorist purposes,
the defendant was authentic. Owing financing of terrorism, instigation
In 2017 courts in the Czech Republic,
to the nature of the information that to commit terrorist acts, or for
Greece and Spain heard left-wing
would have been primarily known to attempting to commit such crimes. In
terrorism cases, marking an increase
the defendant, the court considered some cases, terrorism charges were
in such cases compared to last year.
it proven that he had provided the filed in parallel with charges for other
Germany was the only Member State
information stated in the registration offences, e.g. murder, possession of
that reported verdicts for right-wing
form. The ISIL registration forms were weapons and explosives, war crimes,
terrorist offences. The majority of the
also introduced in evidence in two or forgery of official documents.
female defendants (42) were tried for
cases in Denmark.
jihadist terrorist offences confirming In Spain a 38-year old man was
As in previous years, Spanish courts an upward trend from the past couple sentenced to five years in prison for
tried the largest number of individuals of years. having used social platforms to spread
charged with separatist terrorism the word and symbols of ISIL and to
offences in the EU in 2017. One
of them belonged to the terrorist
Type of offences recruit female minors to travel to the
ISIL-controlled areas in Iraq and Syria
group Resistência Galega (RG, and marry fighters there. He contacted
Galician Resistance), while all others In a large number of cases concluded the girls at an Islamic cultural centre
belonged to or were affiliated with in 2017 the defendants were brought with the intention of indoctrinating
Euskadi ta Askatasuna (ETA, Basque to court on charges of participation in them and offering them the possibility
Fatherland and Liberty). In France, (the activities of) a terrorist group. In to travel to Syria.
Germany and the Netherlands, PKK May 2017 in Germany, for example, In a case that had no precedent
members were convicted of offences, the Higher Regional Court of Berlin in Sweden, the Court of Appeal of
including participation in a terrorist convicted a 20-year old Syrian man of Malmö confirmed the six month
organisation, financing of terrorism, membership in a terrorist organisation sentence issued earlier in 2017 by the
complicity in money laundering, and sentenced him to a five-year Malmö District Court against a man
recruitment and/or training of its juvenile sentence. Before moving to who had urged others to finance ISIL
members, while in Belgium four Germany in August 2015 and being via Facebook. The court admitted
people were acquitted for alleged fund recognised as a refugee, the defendant in evidence that he had posted a
raising for the PKK. In the Netherlands had been a member of ISIL in Syria. In message asking for help to supply
also five members of the Liberation 2013 he participated in the siege of weapons to those fighting “at the
Tigers of Tamil Eelam (LTTE) were an airport and in the spring of 2014 front”. The message also contained
sentenced by the Supreme Court to in a city siege eastern Syria. After the names of two people who could
serve prison terms for their role in the arriving in Germany, he became a be contacted in order to transfer the
terrorist group, after the court ruled contact person for ISIL in Germany. He money; one of them is on the United
that the claim that LTTE fighters could provided them with information about Nations (UN) and EU lists of terrorist
be defined as “combatants” cannot soft targets in Berlin, well aware that financiers. The court heard that the
be supported under international such information could be used to plan post could be accessed by anyone,
humanitarian law and they can be terrorist attacks. even without a Facebook account.
prosecuted and sentenced under
 GENERAL OVERVIEW 19

In the Netherlands the brother of a 15 years old when she committed the conviction rate registered in 2016
Dutch fighter in Syria was found guilty offence. (89%) continued in 2017. In some
of financing of terrorism, among cases defendants were acquitted of
In Spain the National Court sentenced
others, and given a two-year prison terrorist offences but convicted of
a 20-year-old Moroccan woman to five
sentence for sending approximately other offences, such as an attack on air
years in prison. The court found that
EUR 17 000 to his brother via a transport, drug trafficking, burglary,
she became radicalised since 2015 and
middleman in Turkey. The court held attempted extortion, preparation of an
shared her religious and political views
that the man was well aware of the explosion, theft, firearms offences, and
on social media. She posted messages
actions of his brother and those of ISIL abduction of a minor19.
supporting ISIL and the jihad and
in Syria. By providing financial support
planned to travel to the conflict zone All prosecutions for right-wing terrorist
to a person whose involvement in
controlled by ISIL and wished to marry offences resulted in convictions in
terrorism was known to him, the man
a mujahid. She posted photos and 2017. The concluded jihadist terrorism
consciously accepted the significant
videos of ISIL fighters and executions cases continued to have a very high
possibility that these funds be used for
via Facebook, Twitter and YouTube. conviction rate (89%), similar to 2016
the purpose of committing terrorist
She also accessed chat rooms used and (92%) and 2015 (94%). The acquittal
offences.
managed by ISIL members. The court rate among the verdicts related to
The female defendants in 2017 were found her guilty of collaboration with a separatist and left-wing terrorism was
tried for preparing to commit terrorist terrorist organisation. higher (29% and 28% respectively)20.
acts, participation in or collaboration In Spain, for example, the National
In the Netherlands the first female
with a terrorist organisation, financing Court acquitted an ETA member for
returnee to be sentenced for terrorist
of terrorism, glorification of terrorism, his alleged role in an attack on a local
offence was given a two-year prison
spreading messages inciting to commit government building in Guipuzcoa
term, of which one year on probation.
a terrorist offence. in July 1995. The attack had been
She was convicted for having helped
carried out by ETA’s Donosti command
In Denmark a teenage girl was found her husband travel to Syria and
in 1995, using a grenade launcher
guilty of attempted terrorism for participate in the fighting there.
and two grenades. The court ruled
having tried to make bombs to be
that the defendant was no longer
used in terrorist attacks against her
own former local school and against a
Convictions and criminally liable for the alleged acts,
Jewish school in Copenhagen. The first acquittals due to the application of the statute
of limitations. In Greece the criminal
attack was not carried out because
prosecution of some acts in a left-wing
she did not receive an order from ISIL/
terrorism case was definitively ended
jihadists with whom she corresponded In 2017 Denmark and Estonia were
due to the statute of limitations.
via the internet. The second attack the only two Member States that
was prevented as she was arrested had convictions and no acquittals for
by the police. The girl, who lived in terrorist offences18. Austria, Belgium,
19
Eurojust considers it as one verdict if an individual
a village in the countryside, became France, Germany, Italy and Spain also is convicted of more than one terrorist offence
radicalised via the internet and chat witnessed a vast majority of successful within the same proceeding, or convicted of a
contacts in just a few months after terrorist offence and acquitted of another offence.
prosecutions resulting in convictions
If an individual is acquitted of a terrorist offence and
having converted to Islam. She bought for terrorist offences. The record high convicted of another offence, the verdict is included
chemicals to produce TATP and started in the overview as acquittal of terrorism.
experiments with the substance in 20
The data provided by the UK was not broken
18
The UK data for 2017 refers only to convictions down by type of terrorism and is therefore not used
the basement of her house. She was and is not included in the numbers in this section. to calculate the conviction rate.
 TESAT 2018 20

Penalties figure 6
Average sentences (excluding non-prison
penalties) per Member State in 2017, as
The average prison sentence for terrorist offences in the
reported to Eurojust.
EU in 2017 was five years21, similar to that of 2016. The
lowest prison sentence ordered by courts in the EU Member
States in 2017 was 45 days. Sentences of up to five years of
Average sentence in years
imprisonment remained the majority of the penalties handed
down with the guilty verdicts in 2017 (61%); sentences of
ten or more years of imprisonment remained similar to 2016
(12%).
6
The most severe penalty – imprisonment of 158 years – was
handed to an ETA member in Spain convicted of 11 counts
of attempted assassination. As mentioned above, in Austria 5
a 27-year-old member of Hamas was sentenced to life-long
imprisonment for having used social media to call on others
to kill Jews in Jerusalem. The same sentence was pronounced
in Germany against a man who had attempted to attack Bonn 3
train station in December 2012 and planned the murder
of a political party leader. Courts in the UK also gave life
sentences to persons found guilty of preparing to commit 6
acts of terrorism.
It should, however, be taken into consideration that the
severity of the penalty in each case would depend on the 3
respective offence and cannot serve any comparative
purposes. Additionally, in some Member States the average
sentence is calculated on the basis of one conviction, while 6
in others it is based on a considerably higher number of
convictions.
Left-wing terrorist offences continued to bear the highest 6
average prison sentence (ten years). The average prison
sentence for jihadist terrorist offences remained five
years and four years for separatist and right-wing terrorist 17
offences22.
In addition to prison terms, several courts imposed fines,
restrictions on civil rights, travel bans and expulsion from the 5
national territory. In France some of the convicted persons
were written in the national judicial database for terrorist *
offenders. In some cases youth penalties were given or the
sentence was partially or fully suspended. In other cases
6
the sentencing or the execution of the prison sentence was
postponed upon certain conditions, or no penalty was yet
ordered at the time of reporting. 3
In the cases in which the guilty verdicts did not result in
prison sentences, the courts ruled on fines, community
service, rehabilitation, or community orders. Treatment 2
in a mental health institution was ordered in some cases,
in addition to or as an alternative to imprisonment. In one
occasion it was also ordered for a person declared insane and 5
acquitted of terrorist offences.
*

1
21
For the purpose of the calculation of the average prison sentence, penalties
exceeding 40 years of imprisonment and life sentences were counted as 40
years. In the cases where the court ordered a minimum number of years of the 5
life sentence to be served, the sentence was included in the overview with the
minimum number of years indicated. *The average sentence is based on one convic�on.
22
The data provided by the UK was not broken down by type of terrorism and is
therefore not included in the overview.
JIHADIST TERRORISM 21

2/
JIHADIST
TERRORISM
216
2013 2014 2015 2016 2017
TESAT 2018 22

9
figure 7
Number of suspects arrested for
religiously inspired/jihadist terrorism in
EU Member States in 2017.

1
14
28
3
2
50
52 1

46 2
373
2
14

26
1
78 3

figure 8
Number of suspects arrested for religiously
inspired/jihadist terrorism from 2013 to 2017.

718 705
687

395
216
2013 2014 2015 2016 2017
 JIHADIST TERRORISM 23

terrorist attacks and

suspects arrested in
the EU

EU Member States reported 33 foiled, Targets included the military, civilians driver’s cabin. The attacker ran from
failed and completed jihadist terrorist and the police. Among the deadliest the scene, but was later arrested. The
attacks in 2017, more than double attacks were when vehicles were used attack remained unclaimed; however
the figure of 2016 (13). Ten of the as weapons. the perpetrator had recorded and sent
33 attacks were assessed as having a video in which he pledged allegiance
been completed, i.e. perceived by EU to IS.
Member States as having reached the The ten attacks with fatalities24 in 2017
On 20 April a 39-year-old male opened
goals that the perpetrators may have were the following25:
fire on a police vehicle parked on the
had in mind, which invariably seems to
MARCH Champs Elysées in Paris (France) killing
be the killing of what the perpetrators
one police officer. Two other police
perceived as “enemies of Islam”, as On 22 March a 52-year-old male
officers and a tourist were seriously
legitimised by jihadist ideology. 12 drove his car into pedestrians walking
wounded. The attack was claimed by
attacks were assessed to have failed across Westminster Bridge in London
IS through a breaking news message
to reach their objectives in full, and 11 (UK). He subsequently stabbed a
issued by A’maq News. It was reported
were foiled – mostly in France and the policeman guarding the nearby Houses
in al-Naba’ and Rumiyah.
UK. of Parliament, before being shot dead
by police. Five people were killed and MAY
A total of 62 people were killed in
at least 50 injured. The attack was
ten of the 33 attacks. Reportedly On 22 May a 22-year-old suicide
claimed by the so-called IS (IS) through
most fatalities were in the UK (3523), bomber, born in the UK to Libyan
a breaking news message issued by
followed by Spain (16), Sweden (5), parents, killed 22 people and injured
A’maq News. It was reported in IS’s
France (3), Finland (2) and Germany (1). 512, including children, in an attack
Arabic weekly newsletter al-Naba’
In addition a total of 819 people were on a concert hall in Manchester (UK).
and in the monthly multi-language
injured in 14 attacks. The attack was claimed by IS through
magazine Rumiyah.
a breaking news message issued by
A total of 705 people were arrested
APRIL A’maq News. In addition IS issued a
in 18 EU Member States (373 of
statement from its central leadership;
those arrests took place in France) on On 7 April a 39-year-old male hijacked
it was also reported in al-Naba’ and
suspicion of involvement in jihadist a lorry transporting beer and drove
Rumiyah.
terrorist activities, roughly the same it into a busy pedestrian street in
number as in 2016. Most arrests (354) Stockholm (Sweden), killing five JUNE
were on suspicion of membership of people and injuring 14. He crashed
On 3 June eight people were killed
a terrorist organisation, followed by the vehicle into a department store.
and 48 injured in central London (UK),
arrests on suspicion of planning (120) A rudimentary improvised explosive
when three attackers drove a van into
or preparing (112) an attack. device (IED) was also found in the
pedestrians on London Bridge and
launched a knife attack after exiting
23
This figure is from open sources and does not
24
Excluding perpetrators. the vehicle. The attack was claimed by
contain casualties of Northern Ireland security- 25
Details about attacks in the UK are derived from IS through a breaking news message
related incidents. both Europol and open sources.
 TESAT 2018 24

issued by A’maq News. It was reported OC TOBER On 25 August one soldier was lightly
in al-Naba’ and Rumiyah. wounded, after a machete-wielding
On 1 October two women, aged
man attacked them in Brussels
JULY 17 and 20, were stabbed to death
(Belgium). The perpetrator was shot
On 28 July a 26-year-old unsuccessful at Marseille’s main railway station
dead at the scene. The attack was
asylum seeker in Hamburg (France). The attacker was shot dead
claimed by IS through a breaking news
(Germany) attacked several people by a soldier from a military patrol as
statement issued by A’maq News and
in a supermarket with a knife that part of the Sentinel Operation. The
later reported in al-Naba’.
he had taken from a shelf, killing one attack was claimed by IS through a
breaking news message issued by SEP TEMBER
and injuring six. The attack was not
immediately claimed by IS. However A’maq News and reported in al-Naba’. On 15 September an improvised
an article in al-Naba’, published on 4 explosive device (IED) was detonated
August, reported on the incident citing on a tube train at Parsons Green
In addition people were injured in the
Western media reports. While the station in south-west London (UK)
following attacks28 in 2017:
victims of the attack were identified during the morning rush hour. Thirty
as “crusaders”, the perpetrator, by JUNE people, including a young boy, were
contrast, was not described as an “IS injured, when the bomb partially
On 6 June a French soldier was
soldier”26. detonated and sent a fireball along
attacked and injured by a hammer-
a carriage. The attack was claimed
AUGUST wielding man while patrolling in front
by IS through a breaking news
of Notre-Dame Cathedral in Paris
On 17 August fifteen people were item by A’maq News, and the IS
(France).
killed and 131 injured, when a van sped leadership issued a separate claim of
into La Rambla promenade, a busy AUGUST responsibility. It was also reported in
downtown street in central Barcelona al-Naba’29.
On 9 August six French soldiers,
(Spain) packed with tourists.
patrolling as part of the Sentinel
Some eight hours later in Cambrils, Operation, were wounded, three
a city 120 km south of Barcelona, a of them seriously, when a driver
car drove into pedestrians, killing one deliberately drove into the patrol as
and injuring six civilians and a police they left their barracks in the western
officer. The attack in Barcelona was suburbs of Paris (France). The attack
immediately claimed by IS through was not immediately claimed by
a breaking news message issued IS, however, an article in al-Naba’,
by A’maq News. Both attacks were published on 11 August, reported on
subsequently claimed in a statement the incident, citing Western media
from the IS central leadership. The reports. While the victims of the
attacks were also reported in al-Naba’ attack were identified as “crusaders”,
and praised in Rumiyah. the perpetrator, by contrast, was not
described as an “IS soldier”.
On 18 August two people were killed
and eight injured in a knife attack in On 25 August three police officers
Turku (Finland). The main suspect is an suffered injuries, while arresting a
18-year-old male, who was arrested 26-year-old man in possession of a
just after the attack. The attack was sword in a car outside Buckingham
not immediately claimed by IS27. Palace in central London (UK),
reportedly shouting “Allahu Akbar”.
26
Alongside this incident, the article also referred
The attack remains unclaimed.
to a shooting incident at a nightclub in Constance
(Germany), which was not related to terrorism.
27
In an article in al-Naba’, published on 8 February 29
In the same article in al-Naba’, IS also claimed
2018 IS reports on the trial of the perpetrator, responsibility for an evacuation of Paris Charles de
28
including his statement that he was a “soldier of the Details about attacks in the UK are derived from Gaulle airport on 17 September, alleging that its
caliphate”. both Europol and open sources. “soldiers” had planted several IEDs.
 JIHADIST TERRORISM 25

Eleven attacks were foiled and seven London (Parsons Green) in the UK. In was shot dead by soldiers guarding
attacks did not result in fatalities or Barcelona, the driver of the van who the station. The Parsons Green
casualties. In these attacks the military drove into pedestrians was believed incident is another example of a failed
or police were targeted, mostly using to be part of a group that had planned detonation of an explosive device that
simple weapons, such as knives or a much larger operation that was could have caused mass casualties, if
hammers, without causing major thwarted by a massive explosion the manufactured and handled properly,
injuries. Two failed attacks were day before in the house occupied by which fortunately it was not.
claimed by IS. On 19 June a 31-year-old the group in Alcanar. Two members of
The attacks that were committed
perpetrator drove his car loaded with the cell were killed in the explosion,
in 2017 reflect the preferences of
gas canisters into a police van on the including a 40-year-old imam thought
terrorists driven by jihadist ideology
Champs Elysées in Paris. He was killed to be the cell’s mastermind. The
in selecting their targets and the
in his car by toxic fumes. The next explosives destroyed in the incident
goals they want to pursue, as seen
day a 36-year-old individual failed to were allegedly prepared for one or
also in attacks committed in previous
detonate an IED hidden in his luggage more other attacks using large vehicle-
years. They aim at indiscriminate
trolley at Brussels Central train station. borne IEDs (VBIEDs).
killings as well as on eliminating
Both attacks were not immediately
The Manchester attack was an symbols of Western “hedonistic”
claimed by IS, but were mentioned
exception because it was carried lifestyle and symbols of authority.
in an issue of Rumiyah (a multilingual
out successfully with an improvised These perpetrators attack people
magazine whose name referred to
explosive device (IED), requiring a rather than targets that provoke less
the city of Rome, which was to be
certain level of sophistication and of an emotional response from the
conquered by Muslims) published on
preparation to complete as intended. general public, such as damage to
13 July, where the perpetrators were
A total of 22 people were killed, which premises or loss of capital. The intent
described as “caliphate soldiers”.
made it the deadliest attack in the of indiscriminate killings was illustrated
Jihadists who carried out terrorist UK since the suicide bombings on – among others – by the attacks in
attacks in the EU in 2017 were mainly London’s transport system in 2005. London, Stockholm, Manchester,
home-grown, meaning that they Ostensibly the perpetrator acted Barcelona and Cambrils. The
were radicalised in their country of alone. However he had travelled back detonation of an explosive device in a
residence without having travelled to the UK from Libya shortly before concert hall in Manchester doubled as
to join a terrorist group abroad. A carrying out the attack. He may have both an attack on a symbol of Western
substantial number had a criminal received IED construction training lifestyle and as an attack to cause
past or had previously been known to while in Libya. indiscriminate mass casualties. In 2017
authorities, but were not considered a the police and military once again
In general however, the increase in the
major terrorist threat. remained a focus of attacks.
number of jihadist terrorist attacks
For attacks in the EU in 2017, no direct in 2017 ran in parallel to a decrease Not all EU Member States were
links to a terrorist group or previous in sophistication in their preparation affected equally by jihadist terrorism,
terrorism offences by the perpetrators and execution. In cases in which with a number reporting no such
were identified at the time of writing. more sophisticated methods were attacks over the course of 2017,
Most carried out their attacks alone or required, a lack of expertise led to despite some of them having been
in some cases with one or two others. failure in some cases. On 20 June a threatened in IS propaganda. Jihadists
However a number of people in their 36-year-old male tried to detonate a have proven to be able to radicalise
environment may have been aware of bomb in a luggage trolley in Brussels without raising suspicion and to
their plans and tolerated and possibly Central train station, but only the prepare attacks, while remaining
even facilitated or supported them. trolley caught fire, after which the undetected by law enforcement.
These lone actors’ use low-tech means suitcase exploded due to the gas Therefore, the threat of jihadist
to carry out an attack. bottles it contained. It is assumed attacks in the EU remains acute, as
that the device failed to function as demonstrated by the attacks which
This applies to all of the above-listed
intended, probably because of poor took place in 2017 and those that were
jihadist terrorist attacks, except for
manufacturing. No one was hurt in this prevented in time.
the attacks in Barcelona and Cambrils
incident except for the attacker, who
in Spain, and Manchester and
 TESAT 2018 26

Travel for terrorist Asia), potentially increasing the risk

of more organised spectacular-type
purposes attacks in Europe in the medium to
long term. Austria reported that the
number of FTFs started decreasing at
Around 5 000 individuals from the the beginning of 2015. Switzerland has
EU were believed to have travelled to not recorded any new departures to
conflict areas in Iraq and Iraq and Syria. conflict zones since 2016. The number
By late 2017 the number of people of departures from Belgium in 2017
from Europe fighting in IS may have was described as “limited or non-
been as low as 2 500. It was thought existent”.
that about 1 500 foreign terrorist The Netherlands reported that the
fighters (FTFs) returned home and decline in successful travellers was
1 000 were killed. Belgium, Germany, evident and steady. However in
France and the UK were the major June 2017 a Dutch man succeeded
source countries. Hungary asserts that in travelling to Syria to join IS (the
around 1 000 individuals from the first time since November 2016 that
Balkan states joined IS between 2014 someone was able to reach the conflict
and 2016 and expects a significant zone). Before his journey, there
number of them to return to their were no apparent indications of his
former home countries, facilitated by radicalisation. Spain also reported that
organised crime groups engaged in the flow of travellers had decreased
illegal migration. significantly. Over 2017 Poland did
In 2017 there were considerably fewer not note any departures or returns
EU-based FTFs travelling to conflict of Polish FTFs (however an FTF of
zones and a diminishing number of Chechen origin with refugee status in
returnees. Due to the military situation Poland was detained in 2017, charged
in Iraq and Syria, it appeared to have with participation in a foreign military
become even more difficult to leave organisation and illegal possession of
IS territory. After losing control of weapons and ammunition).
significant terrain, some IS members Despite this apparent reduction in
were however seeking to leave the travellers, it should be underlined that
combat zone, either to return home, IS, al-Qaeda and other jihadist groups,
or to travel to other conflict areas continue to pose a major threat. They
(for example to Afghanistan; within have the ongoing intent and capability
the Middle East and North and West to conduct terrorist attacks against the
Africa; Central, South or Southeast West.
 JIHADIST TERRORISM 27

RE TURNEES Although no concrete examples to action – including via propaganda

were available, Bulgaria reported its outlets – have comprised specifying
EU Member States reported that
concerns of being used as a transit attacks on civilian targets by means of
returnees to Europe may have a
route, i.e. the possibility of FTFs or new methods, including those tested
certain amount of combat and
linked individuals passing through in the conflict zones. This poses a
operational experience; gained an
Bulgaria on their way to and from significant challenge to the authorities
enhanced capability to commit acts
Syria, but due to entry bans for Turkey, in terms of setting up counter-
of terrorism; and be particularly
they were returned back to Bulgaria. measures. Moreover, IS sympathisers
dehumanised and prone to violence
Hungary reported that up to 2017, FTFs in Europe, in contact with individuals
upon their return. They also serve as
used their country mainly for transit in abroad who have the required skills
role models and might be involved
order to reach the conflict zones or to and mind-set to commit acts of
in recruiting and radicalising others.
travel back using the Balkan route to terrorism, may become involved in
Furthermore, returnees and other
their Western Europe-based contacts. planning or support activities. One
extremists in prison may encourage
They also stated that based on 2017 of the most significant threats posed
inmates to ultimately travel overseas
data, it was apparent that several by those who have travelled to the
to fight or conduct other terrorist
of these individuals or groups spent Syrian conflict zone comes from
activities.
considerable periods in Hungary. From jihadists in conflict zones that engage
Belgium, for example, reported that time to time Romania has been used in planning attacks against Europe or
the number of returnees was very as a transit area or secondary route incite others to do so. However, the
limited in 2017 (amounting to only five for FTFs travelling to and from Iraq ability of such individuals to continue
fighters, some of whom had already and Syria (albeit that they noted the this kind of activity in theatre is likely
been detained in prison in Turkey since descending trend as with the rest of to be reduced due to the impact of
2016). However, Belgium also reported Europe). Between January 2013 and increased military pressure, loss of
that currently the phenomenon of November 2017 Portugal asserted cohesion, lack of infrastructure and
home-grown terrorist fighters seemed that their territory was used as a reduced access to resources.
to be a greater threat than that transit platform by a total of 12 (non-
As noted above, recent attacks in
emanating from returnees. Denmark Portuguese) FTFs on their way to the
Europe have, for the main part, been
expected that only a limited number conflict areas (including nationals from
committed by lone individuals who
of its FTFs would return. Although in France, Morocco, Poland, Russia and
have not been to a conflict zone –
total Denmark observed approximately the UK). In addition Poland indicated
but who may have been inspired
50 returnees from Iraq and Syria, that in 2017 militants involved in
by terrorist propaganda and/or the
the number continued to decline in the conflict in the Middle East were
extremist narrative, as well as by other
2017. Denmark also reported that a examining the possibility of crossing
successful attacks worldwide. This was
number of travellers no longer had the Polish-Ukrainian border to reach
evidenced by several successful attacks
their passport or residence permit, other EU countries. Border pressure
in the UK during 2017, for example, the
and returning to Denmark became and logistical considerations have also
attack on Westminster Bridge, London,
less attractive given the prospect of made it more difficult for aspirant
in March. Furthermore, the attacks
criminal prosecution. Switzerland attack operatives to travel from Syria
in Barcelona and Cambrils in Spain in
reported only three returnees over via Turkey into Europe.
August 2017 – although not committed
the reporting period. Overall, the
by FTFs – were reported as being
Netherlands reported some 46
ideologically linked to IS. In addition,
returnees from 2012, but only four AC TIVITIES ON RE TURN TO
Spain also reported that in June 2017
in 2017, but also that returning from EUROPE
a Danish citizen – who had been in the
the conflict zones had become very As IS gets weaker, it has been urging its conflict zone between 2012 and 2015 –
difficult, and that they were aware of followers to carry out lone actor type was arrested in Spain, having travelled
Dutch men and women who had the attacks in their home countries, rather from Denmark, possibly in order to
intention to leave Syria, but who were than guiding them to attempt to travel purchase a weapon (presumably to
not actually able to do so. to the so-called caliphate. Exhortations carry out an attack). Italy, for example,
 TESAT 2018 28

stated that one of the main sources TR AVEL OF WOMEN AND

of terrorist threat to them included CHILDREN
potential sleeper cells from the external
Austria noted that a number of women
operations units of IS or al-Qaeda and
(including minors), left or wanted to
“affiliated” organisations inspired by
leave for the war zone. They reported
jihadist ideology. In 2017, investigations
that contacts were established via
in Italy led to 26 arrests for terrorist
the internet and by friends and
offences: including for recruitment (on
acquaintances. Some of the women
behalf of IS), sharing IS propaganda,
married foreign terrorist fighters under
providing logistic support to a terrorist
Islamic law, sometimes via social media.
organisation, and facilitating the
The UK also reiterated that there was
movement of FTFs to jihadist combat
an increase in the number of women,
zones.
families and minors engaging in the
Germany reported that on 12 April conflict, although they remained a small
police officers arrested a 31-year-old proportion of overall travellers.
Syrian member of IS. It was alleged
The Netherlands reported that there
that he travelled to Germany with the
were indications that Dutch jihadists
aim of recruiting members, as well
in Iraq or Syria – mainly women and
as coordinating terrorist cells already
minors – were in refugee camps or in
active in Europe to carry out attacks on
the hands of non-jihadist combatants.
unspecified targets.
The Netherlands assessed that in the
Furthermore, between February and near future a number of men, but
November 2017, the Swiss authorities mainly women and/or minors, would
arrested individuals on terrorism probably attempt to reach to the
charges for preparing and facilitating Netherlands (potentially also posing as
jihadist travel to the Iraqi-Syrian conflict victims in order to deflect authorities’
zone; for providing financial support to attention). Moreover, Belgium asserted to assess whether potential terrorists
IS; for the radicalisation of a number that the returning wives (and children) have been smuggled in systematically
of persons from Italy and Switzerland; of jihadists also caused concern, due via these flows. They did, however,
for travelling to the Iraqi-Syrian conflict to the reported involvement of female state that in several cases the
zone; as well as for association and activists in preparing attacks. suspicion that certain individuals were
support of terrorist organisations. members of a terrorist organisation
Consequently, the presence of both was substantiated, and that some
In 2017 various Dutch or Dutch returnee men and women, and to an individuals who came to Austria along
speaking jihadists, including members extent minors (who together with their with the migrant flows were arrested
of both al-Qaeda and IS, threatened to parents have stayed with FTFs/jihadists for suspicion of supporting, or being a
commit attacks against the Netherlands in the conflict zone, or have themselves member of, IS.
or called upon others to do so, both undergone indoctrination and military
online and offline. In a number of cases, training) are believed to comprise a Investigations in Greece and Italy also
the threats seem to have originated continuous threat to security. did not support the suggestion that
from Syria. The Netherlands reported terrorists were systematically using the
that IS in particular continued to make migrant flow in 2017 – but they could
full use of the network that foreign USE OF IRREGUL AR not rule out the possibility that these
jihadists in Iraq and Syria had access to, MIGR ANT FLOW flows and/or posing as refugees might
in their home countries. be used as a method in the future to
As previously reported, terrorist use of enter Europe. Romania reported that
Finally also of note, is that jihadists the migrant flow has been observed, the activities which facilitate (illegal)
located in different (non-European) but it is not deemed systematic. migration from the conflict areas do
locations may increasingly focus on Austria reported that it was particularly not appear to have ties to terrorist
attacking local Western targets, as it affected by migrant flows emanating organisations, and are mainly financially
becomes increasingly difficult to travel from the conflict areas of Africa and motivated.
to conflict zones such as Iraq and Syria. Asia, but there is not enough evidence
 JIHADIST TERRORISM 29

Numerous IS videos produced during

2017 reiterated the urgency of carrying
out retaliatory attacks against the West,
and their publications emphasised
the atmosphere of terror and panic in
the aftermath of attacks carried out
in Western countries. IS continued
to encourage individuals to carry out
terrorist attacks in countries of the
anti-IS coalition, with whatever means
they have at their disposal, including
bladed weapons, vehicles and arson,
which, were explicitly suggested in IS
propaganda, among other things.
For much of 2017 IS was quick to claim
that attacks had been committed in its
name and to take responsibility, despite
a lack of substantiating evidence.
In several cases the subsequent
investigations did not bring to light a
link to the group, such as with regard
to the mass shooting on 1 October
targeting an open air concert in Las
Vegas, USA, which killed 58 people and
injured several hundred. IS was quick to
describe the perpetrator as a “soldier of
Finally it has been assessed to be more as a natural reaction to the perceived the caliphate” in an official statement
difficult now for terrorists to exploit injustice suffered by Muslims. For and as an “IS soldier” in A’maq News
the migrant flow, owing to increased example, in an audio speech published releases, alleging that he converted
security measures, such as intensified on 7 May, Qasim al-Raymi, the leader to Islam several months before the
control of EU borders. Nonetheless, of al-Qaeda in the Arabian Peninsula attack. By the time of writing, however,
travel to Europe may still be possible, (AQAP), called for lone actor attacks no evidence of a jihadist motivation
for instance via third countries using in the West in retaliation to tragedies of the perpetrator or links to IS have
stolen or forged travel documents. suffered by Muslims around the world. come to light. IS also claimed an attack
Such attacks, he explained, would have on a casino in Manila, the Philippines,
a deterring effect on the West’s actions on 2 June 2017 which killed at least 36
INCITEMENT OF LONE AC TOR in Iraq, Syria, the Arabian Peninsula people. The Philippine National Police,
AT TACK S IN THE WEST (i.e. Saudi Arabia and Yemen) or Asia. however, stated that the attack more
The group also published a new issue likely had a criminal background.
A continuing point of similarity between
of its English-language electronic
al-Qaeda and IS is the explicit call for
magazine Inspire in August, in which it
lone offenders to target civilians in the
praised lone actor attacks in the USA
West. Over 2017, the two major jihadist
and suggested modus operandi for the
organisations disseminated operational
perpetration of attacks.
manuals with instructions on how to
carry out these attacks. The differences IS considerably more ruthless rhetoric
lie in the way in which they convey the purports to be embedded in Islamic
message and the justifications provided. eschatological tradition, the idea
Al-Qaeda bases its propaganda on that the final confrontation between
political grievances, uses a softer tone good and evil is approaching and
and justifies the lone actors’ attacks every individual must choose sides.
 TESAT 2018 30

TERRORIST USE OF THE

INTERNE T AND SOCIAL
MEDIA
Online propaganda continues to be
an essential part of jihadist terrorist
attempts to reach out to EU audiences
for recruitment, radicalisation and
fundraising. The often rudimentary
and fragmented knowledge of Islam of
aspiring jihadist terrorists, derived from
religious texts selected to fit a violent
ideology, makes them vulnerable to
being influenced and used by those
who misuse religion to incite violence.
The serious losses that IS sustained
in territory and human and material
resources in 2017 had a significant
impact on the organisation’s media
production capabilities. The IS media
department was forced to relocate
and restructure. The increased military
pressure resulted in a noticeable
disruption of its media activities
and a marked decline in the quality
and quantity of content production,
especially in the second half of 2017.
By December however, the IS media Since its creation in 2014, A’maq News 2017. Al-Naba’ and Rumiyah, although
network began showing signs of had acted as an independent news addressing different audiences, had
recovery and increased its content outlet, pretending to be a journalistic the similar goal of setting and adjusting
output slightly. organ. By 2016 it had become one of the organisation’s political discourse
the main tools for IS to claim attacks, and highlighting significant ideological
Nevertheless, IS media appeared to
including lone actor attacks in western developments. Additionally, al-
have remained centralised in 2017
countries30. IS officially endorsed A’maq Naba’ provided in-depth information
despite the evident damage caused to
News in July 2017. The Nashir Agency on military advances and practical
its media infrastructure. The weekly
is also suspected of belonging to the IS guidance on how to carry out terrorist
al-Naba’ newsletter, for example,
media apparatus, although it has not attacks. With the interruption of
continued to state on its front page
been formally or publically endorsed by Rumiyah, the organisation’s ability
that it was produced by IS’s “media
the IS. to reach out to non-Arabic speaking
Diwan [ministry]”. IS provincial media
audiences outside and inside Iraq and
outlets that generated higher media By the end of 2017, IS’s main publication
Syria significantly decreased.
output in 2017 appeared to match remained the weekly Arabic newsletter
with regions witnessing heightened IS al-Naba’ (“the news”). Starting in 2016 In addition to the decrease in
military activity. In these areas local IS the organisation launched Rumiyah). propaganda production, IS online
media staff likely maintained smoother In 2017, Rumiyah was published in dissemination capabilities were heavily
communication means with the various Bosnian, English, French, German, curtailed by the increasing disruption
central media mouthpieces. Apart Indonesian, Kurdish, Pashto, Russian, efforts led by social media companies
from al-Naba’, in 2017, IS officially Turkish, Urdu and Uyghur on a near working jointly with law enforcement
endorsed propaganda outlets were monthly basis. However, the publication agencies and government bodies. This
the A’maq News Agency, the al-Hayat however ceased after its 13th issue, clampdown resulted in further and
Media Centre, the al-Furqan Media which was released on 9 September more extensive disruption of IS activity
Production Company, the al-Ajnad on a number of major social media
Media Production Company, the al- platforms.
30
Europol, EU Terrorism Situation and Trend Report
Himma Library and al-Bayan Radio. (TE-SAT) 2017, 2017, pp. 26-30.
JIHADIST TERRORISM 31

In 2016 a large proportion of IS tools which ensure anonymisation of

sympathisers had already migrated communication (e.g. TOR Browser,
from their main hubs on Facebook TAILS OS) on specific IS propaganda
and Twitter to Telegram, an encrypted sites and some Darknet sites in order
messaging application perceived as to safeguard the interests of their
more secure and less law-enforcement sympathisers when accessing online
friendly. 2017 saw them move further terrorist propaganda. The need for
from public Telegram channels to increased secrecy also led online
private and closed chat groups, for sympathisers to revert to blogs and
which a link key – available for a traditional web forums, more adapted
short period of time and shared on for peer-to-peer mentoring, as well as
associated channels – is needed to to smaller platforms with less capacity
gain access. Due to this mechanism, for – or focus on – carrying out
combined with the fact that disruptive procedures.
information on Telegram can neither
At the same time, sympathisers of
be searched (without prior access to
terrorist organisations (IS and al-
the given channel) nor indexed by
Qaeda) continued to take advantage
search engines, Telegram remained
of cryptocurrency adoption. IS, for
a relatively safe haven, albeit with
example, triggered cryptocurrency
limited outreach and recruitment
donation campaigns (e.g. Bitcoin
potential. As a result Telegram is
donations) in IS-affiliated websites,
largely used for community-building,
as well as in chat environments (e.g.
discussing targets and methods of
Telegram), in order to raise funds.
attacks, advertising links to material
posted on more accessible platforms The decrease in official IS propaganda
and coordination of so-called media in the last quarter of 2017 spurred
raids (ghazawat i’lamiyya) to be IS supporters into producing more
launched on Twitter and other social user-generated – and translating
media platforms. For example, the pro- older – content (UGC), thereby
IS Nashir Telegram channel, stressing blurring the distinction between
the need to reach out to wider official and unofficial activism.
audiences, increased its calls to IS Indeed, despite retaining a close
supporters, starting in late March 2017, group of core sympathisers for
to occupy popular platforms such as reasons of authentication, IS has
Facebook, Instagram and Twitter and gone to great lengths to glorify
has itself repeatedly attempted to set information warfare and repeatedly
up accounts on these platforms. encourages sympathisers to become
more active online. The IS’s supple
In order to counter the large-scale
definition of media operatives – which
closure of IS supporter accounts
encompasses the organisation’s “war
on various platforms, dedicated
correspondents” as much as online
volunteers have been working for
propagandists – and the possibility of
the past few years on building a pool
taking part in active, yet lower-risk,
of accounts (Al-Ansar Bank or “bank
activism has encouraged many to join
of supporters”) on Facebook, Gmail,
the circle of these “martyrdom-seekers
Instagram and Twitter. These accounts
without a belt”. This strategy seems
enable IS sympathisers to bypass
to have been designed to bolster the
the registration process, thereby
resilience of IS’s online media model.
ensuring their anonymity, and to
Most of this UGC focuses on praising
retain an online presence when their
the attacks perpetrated by IS affiliates,
accounts are shut down. Similarly,
or on inciting Muslims in Western
IS sympathisers continued to invest
countries to take part in the struggle.
resources into promoting open source
 TESAT 2018 32

Other sympathisers focus on archiving

historical content (including on the
Darknet) and creating clearinghouses
and libraries, with some providing
bespoke services. The importance
of these archivists has grown as the
organisation lost the ability to dominate
the online space with large quantities of
new material. As a result, IS retains an
extensive archive of material across a
variety of online platforms.
In 2017 it became increasingly difficult
to locate terrorist content in English on
major social media platforms, such as
Facebook and Instagram. This is both
because English content was taken
down more quickly and less material
was produced in the English language.
Arabic content, by contrast, as well as
emotive chants (anashid) and non-
visual content, was still widely available
and accessible on Facebook and
YouTube. This may be because social
media companies have, in general, been is an integral part of the propaganda It is safe to say that the IS core
quicker to respond to videos containing message and is in many ways more narrative, namely the establishment
extreme violence than to speeches insidious. Indeed jihadist organisations of a functioning caliphate, failed in
or ideological treatises produced by have long realised the importance of 2017. Likewise its focus on apocalyptic
terrorist groups but which feature no garnering more followers and appealing eschatology (and the Dabiq discourse31)
explicit calls to violence. Similarly, social to those who would otherwise shy away lost much of its resonance. Instead
media companies’ focus on removing from these groups’ brutality, but who of conceding defeat, however, the
violent content produced mostly by are nevertheless moved by the idea of a organisation attempted to reframe
IS has led to material produced by its global Muslim community (umma) and how it defined victory. It professed the
rivals, such as al-Qaeda or Hay’at Tahrir caliphate. inconsequentiality of territorial control
al-Sham, becoming more visible. For and emphasised the prophetic nature
In terms of narrative, the discourse
instance, al-Qaeda released several of the “trials and tribulations” that it
promulgated by the major jihadist
recordings of Hamza bin Laden, a son faced, stressing that these were proof
groups (IS and al-Qaeda) remained
of al-Qaeda founder Osama bin Laden, that the group was on the right path
largely constant over 2017, although
in 2017, including a speech in May in and that victory was imminent. In a
a few changes were noted. IS
which he called for lone actor attacks further show of denialism, IS focused
propaganda, in particular, witnessed
in the West. The organisation might on documenting raids carried out by
a significant thematic shift since 2016.
want to attempt to exploit his name its fighters on remote army outposts
Idyllic depictions of governance and
in order to regain prominence on the in Iraq and Syria in an attempt to prove
civilian life in the caliphate dropped
international stage. that it still held sway over strategic
considerably. These were replaced by
areas and that mainstream media was
In this context, it is worth noting that a defensive and defiant discourse and
merely peddling fake news to damage
only a fraction of terrorist propaganda a stronger focus on victimhood and
sympathisers’ morale.
(both for al-Qaeda and IS) features resilience. Just as it does for al-Qaeda,
ultraviolent videos. The larger portion IS ideology rests on a strong sense Whereas IS propaganda continued
of propaganda material has focused of injustice. More than in previous to present the group’s choices as the
on community projects, religious years, propaganda released in 2017 only true interpretation of Islam, a
preaching or even poetry recitals. The told a story of existential conflict, in
promise is that of a culturally engaging which Sunni Muslims are portrayed as
31
Including the final battle between good and evil
environment where redemption is the primary victims of a coalition of which according to Islamic tradition will take place
possible. As such, non-violent material Christians, Jews and Shi’i Muslims. in Dabiq in northern Syria. IS lost Dabiq to Turkish
troops in 2016.
 JIHADIST TERRORISM 33

In contrast to al-Qaeda, which

conceded that women were allowed
to fight but never encouraged them
to do so, IS appeared to be openly
calling on women to take up arms.
An article published in al-Naba’ on 5
October, entitled “The duty of women
fragmentation on ideological grounds in [waging] jihad against the enemies”,
within IS also came to the fore in 2017. encouraged women to take part in
In May, the Delegated Committee32 armed action. This followed on from
issued a circular which attempted an article published in Rumiyah in July,
to set out the group’s approach to in which the “courage and sacrifice” of
takfir, the act of declaring other women who fought alongside Prophet
Muslims unbelievers, which for IS is a Muhammad are given as examples
justification for their killing. In addition, for today’s mujahidat to emulate. The
several doctrinal IS publications were 2011 and due to a failed experience call to take up arms came as IS was
declared void. The May circular argued in Yemen – not to alienate local haemorrhaging territory and marked
that takfir was a foundation and an populations and instead to embed a shift away from its earlier discourse
obligation of the Islamic faith and itself into local insurgencies in order to where women were described as
held the opinion that ignorance in this court local appeal and establish robust essential but in which their supportive
matter was not excusable (a principle support bases. Al-Qaeda leader Ayman role was emphasised (mainly providing
roughly equivalent to ignorantia al-Zawahiri in particular appeared to be financial support to jihad, taking care of
juris non excusat). In practice this conscious of the importance of popular their husbands and producing children).
interpretation means that anyone support and continuously advised Nevertheless, as is evident in Rumiyah
doubting the judgements of IS with against actions that would antagonise Issue 12, a woman’s default role is still
regard to the definition of the enemy Muslim masses. This was made obvious that of a home-maker and caretaker of
would himself be liable to be killed. in the code of conduct issued by her family.
A number of indications, including an al-Qaeda in the Indian Subcontinent
Moreover, IS promotes the idea that
article published in al-Naba’ in mid- (AQIS) in June 2017 – and drafted in
every Muslim, regardless of his/her
June, which hinted at the apostasy of IS consultation with al-Zawahiri – which
physical condition, can play a role in
leader Abu Bakr al-Baghdadi, suggest forbade carrying out operations that
jihad. It has issued at least three videos
that the memo exacerbated simmering have the potential to alienate the
in recent months featuring disabled
conflicts within IS, which ultimately masses. As such, it sees itself more as
fighters to reinforce this argument.
led to its repeal. A circular published a spiritual spearhead and recognises
in October 2017, supposedly after a advantages in letting locals take IS propaganda also continued to
shift in personnel within the Delegated command over issues of security and showcase minors and children,
Committee, revoked the earlier governance. thereby stressing the importance of
previous memo and reinstated the handing down the message to future
Another interesting element to note
earlier IS ideological guidelines. generations. Videos featured children
is the evident development in the
taking part in religious and military
A major contrast in narratives between way terrorist movements reach out
training. On a few occasions, they were
al-Qaeda and IS lies in the fact that the to – and attempt to engage and recruit
also filmed carrying out extra-judicial
former has taken great pains – since – women. IS female sympathisers in
executions of prisoners. IS teaches
particular have successfully made use
these children IS ideology to prepare
The al-Lajna al-Mufawwada (“Delegated
of the internet to mentor and mobilise
them for their role on the battlefield
32

Committee”) is the highest decision making body other women.

within IS after the caliph. and to reinforce their determination.
 TESAT 2018 34

Terrorist situation
outside the EU33
33
This section is largely based on open sources.

Members of Albanian, Bosnian and regarded a viable terrorist threat.

Roma minority communities are The same applies to jihadist groups
predominant in jihadist groups in in the country, although some of
Serbia. The country also reported their members, in particular returned
propaganda activities being recorded FTFs, possess knowledge and skills
in 2017, both through personal that could be used for terrorist
contacts in informal religious groups, purposes. Moderate groups oppose
from some informal religious venues violent methods and seek to distance
as well as via the internet and social themselves from radical elements in
networks. These propaganda activities their midst.
were aimed at the radicalisation and
Bosnia and Herzegovina asserts that
recruitment of new members for
up to December 2017 approximately
Western Balkan terrorist organisations. Increasingly
300 persons had travelled from the
women are being approached, as well
countries as members of the Roma population.
country to Iraq and Syria. As per 31
December 2017 an estimated 107 were
Spouses of radical Islamists are found
still in Syria, of whom 61 men and
to be very active in recruiting other
46 women. It is believed that by that
None of the Western Balkan countries women.
date 41 FTFs had returned to Bosnia
have reported acts of jihadist terrorism
However, in 2017 there was a and Herzegovina and that 71 FTFs
having taken place in their territories
significant decline in activities aimed had lost their lives. In 2017 only one
in 2017. Kosovo34 reported a decline
at recruiting persons for terrorist (failed) attempt has been recorded of
in jihadist propaganda activities and
organisations in Iraq and Syria. This an individual attempting to travel from
no apparent cases of financial or
decline was – apart from the military Bosnia and Herzegovina to the conflict
logistical support of terrorist groups.
defeats and territorial losses of areas. In Bosnia and Herzegovina
The country shares its concerns
IS – at least in part caused by the there is little reporting to indicate
about the possibility of returning FTFs
arrest of a group of people in 2014 that extremist groups susceptible
from the conflict areas with EU and
who participated in the recruitment to violence have an organised and
non-EU countries. In 2017 Kosovar
and dispatching FTFs to the Syrian systematic network structure. Indeed,
authorities initiated a total of 54
battlefield. No new cases of foreign there is evidence that within the
cases on suspicion of participation in
terrorist fighters were recorded in extremist groups there are factions
terrorist activities in Iraq and Syria.
2017. with different religious and ideological
These include cases in which there
beliefs, creating opportunities for
was no evidence of involvement of Montenegro reports the presence
internal disagreement and disputes.
its nationals in fighting in the conflict of several radical groups in its
areas. Arrests made in Kosovo were jurisdiction, of which two groups are
primarily based upon suspicion of most exposed: takfiris and jihadists.
engagement in propaganda activities. Takfiris are seen as being very rigid
in the interpretation of the basic
Islamic postulates and perform
34
This designation is without prejudice to positions religious rituals by strict Sharia rules.
on status, and is in line with UNSCR 1244 and They distribute various propaganda
the ICI Opinion on the Kosovo Declaration of
independence. materials via the internet but are not
 JIHADIST TERRORISM 35

statement by the IS leadership claiming a woman hostage in an apartment

responsibility for the attack was issued. building near Melbourne, after having
killed another person at the building
On 11 December a 27-year-old
entrance. The perpetrator was shot
Bangladeshi man legally residing in the
and killed by police. He reportedly
USA detonated, probably prematurely,
shouted “This is for IS. This is for al-
a person-borne IED (PBIED) in an
Qaeda”. IS claimed responsibility for
underground passage in Manhattan.
the attack through a message issued
The blast injured three people. The
by A’maq News, which described the
perpetrator was arrested and admitted
perpetrator as an “IS soldier”. In an
to carrying out the attack in support
article in al-Naba’, the group claimed
of IS and in protest against United
that the “caliphate soldier” killed one
States (US) policies, including in the
“crusader” and engaged in a fight
Middle East. He began his radicalisation
North America and process in 2014 and appeared to
with police officers, injuring three of
them before being killed. The attack
Australia have been influenced by IS calls on its
supporters to perpetrate attacks in
was also praised in Rumiyah. The
perpetrator had been charged in 2010
their countries of residence, should
over an alleged terrorist plot but was
they be prevented from travelling to
In 2017 the USA suffered a number acquitted. At the time of his death, he
join IS. The attack was mentioned by
of attacks for which IS claimed was on parole for offences unrelated to
IS in al-Naba’, but only by reference to
responsibility, without providing terrorism.
Western media reports according to
evidence of its direct involvement. Two which the perpetrator stated that he On 29 July 2017 two brothers of
attacks in New York City were clearly was an “IS soldier”. However, IS failed Lebanese origin were arrested on
inspired by IS. On 31 October a 29-year- to officially confirm this in any other suspicion of plotting a major attack.
old Uzbek citizen legally residing in way. They had planned to detonate an IED
the USA, drove a rented truck into a aboard an airliner flying from Sydney
walkway in Manhattan, killing eight In Canada, a 30-year-old refugee from
to Abu Dhabi in mid-July. The plot
people and injuring 12 others. After Somalia deliberately struck a police
failed because they failed to check in
crashing into a school bus, he exited officer on traffic duty in Edmonton,
a bag containing an explosive device
the vehicle brandishing imitation Alberta, with a van on 1 October,
for the targeted flight, on which a third
firearms, before being shot and before trying to stab him with a knife.
brother travelled. They had received
arrested. A note claiming the attack The perpetrator initially fled on foot,
the explosive device from an IS
on behalf of IS was found in the truck. then acquired another vehicle, with
contact via mail from Turkey. After the
The perpetrator, who was known for which he subsequently injured another
failure, the brothers started planning
minor offences, but not for terrorism, four people, before being arrested.
an attack using a chemical dispersal
deliberately chose the date in order The attack was not referred to in IS
device, which was disrupted by their
to target civilians during Halloween propaganda. However, reportedly, an
arrest. The brothers in Australia were
celebrations. In its weekly newsletter IS flag was found in the car used for the
in contact with a fourth brother, who
al-Naba’, IS described the perpetrator attack on the police officer.
allegedly was an IS commander in Syria.
as an “IS soldier”, however no separate In Australia, on 5 June, a man took

the perpetrator followed guidelines

Russia given by al-Qaeda leader Ayman al-
Zawahiri. The claim was denied by a
media outlet of the al-Qaeda-linked
On 3 April 2017 a suicide attacker Caucasus Emirate.
detonated a bomb on a train in Saint
Petersburg killing 14 people. The On 19 August a man stabbed several
suicide bomber was identified as a passers-by in the Russian city of
22-year-old naturalised Russian citizen Surgut. In an A’maq News statement,
born in Kyrgyzstan. The bomb was IS described the perpetrator as an “IS
reportedly an improvised explosive soldier”. A video published three days
device using commercially available after the attack by IS media outlet
to have had ties with radical Islamists. Furat showed the perpetrator pledging
explosives. Another device, planted The attack was claimed by a hitherto
at another metro station, allegedly allegiance to IS, stating that he was
unknown group using the name Imam happy to die as a martyr and calling for
by the same perpetrator, was found Shamil Battallion, which alleged that
and defused. The perpetrator is said more knife attacks.
 TESAT 2018 36

the man suspected of preparing a

Turkey bomb attack had been detained in a
counter-terrorism operation. During
his transfer to the police headquarters
After a series of attacks in Turkey he was able to attack and kill the
claimed by or attributed to IS in 2015 officer with a knife, before being shot
and 2016, which culminated in the 31 dead by a fellow policeman.
December 2016 attack on a nightclub
in Istanbul that killed 39 people, no IS propaganda in 2017 continued
major terrorist attack was carried out calling for the killing of members of
by IS in Turkey in 2017, although the the Turkish government, including
threat of lone actor attacks persists. Turkish President Receb Tayyip
Turkish security forces arrested Erdoğan, Turkish religious institutions
hundreds of suspected IS members in and Muslim groups which IS consider
Turkey, partly on suspicion of planning apostates. In addition IS accused
terrorist attacks throughout the year, Turkey of killing Muslim civilians,
including prior to the 2018 New Year including children, and of collaborating
celebrations. On 13 August 2017 a with the “enemies of Islam” in Syria.
Turkish policeman was stabbed to Official IS publications featured
death in Istanbul by an alleged IS pictures of Turkish soldiers killed in
member. According to Turkish media, Syria.

These included European nationals. carried out with unmanned aerial

Iraq and Syria They were said to have surrendered vehicles (UAV) commonly known as
with their husbands to Kurdish forces, drones. Footage allegedly taken by
who then handed over the women and these UAVs showed the apparently
Two years after it reached the limits of children to Iraqi authorities. Male IS successful dropping of explosive
its expansion in mid-2015, IS lost most fighters were said to have remained in devices on enemy targets.
of the territories that it controlled in captivity with the Kurdish forces.
Iraq and Syria. In Syria IS also lost most of its territory
In reaction to the offensive on Mosul, in the course of 2017. Control of IS’s
In Iraq, after a military campaign that IS increased the number of large scale main stronghold in Syria, al-Raqqa,
started in October 2016, Iraqi armed was achieved by the Syrian Democratic
forces and allied militias took full Forces (SDF)35 by October 2017. Prior
control of Mosul in July 2017. More to the conquest, hundreds of Syrian
than 800 000 inhabitants fled the IS fighters left the city according to
fighting, and it was reported that IS human rights activists, while foreign
was deliberately targeting civilians. fighters remained. Following an
Tal’afar, located between Mosul and agreement with the SDF, IS fighters
the Syrian border, was recaptured and their families left the city on 15
in late August 2017. Hawija, the last October, retreating south along the
significant town under IS control in Euphrates River. Between 200 and
Iraq, fell in early October. In December 300 IS fighters reportedly remained
2017 the Iraqi government declared in the city. On 17 November, the SDF
that it had achieved victory over IS in declared that they had complete
Iraq. terrorist attacks in Iraq, targeting in control of the city.
Several hundred foreign IS members, particular the Shi’i majority population
In early November the Syrian army
including large numbers of women and Iraqi security forces and militias
and its allies with Russian air support
and children, were captured after the allied with it. The attacks aimed to
reportedly expelled IS completely
fall of IS-held territory in Iraq. Some increase the tensions between Sunnis
from the Dayr al-Zawr province. On 9
foreign nationals were sentenced to and Shi’is in Iraq and to destabilise the
November, the city of Al-Bukamal on
death or imprisonment by Iraqi courts. fragile security situation in the country.
the Iraqi border was taken by Syrian
By September 2017 1 400 foreign By summer 2017 the rate of attacks in
regime troops. IS fighters evacuated
women and children of presumed IS Iraq seemed to have diminished, but
fighters were held in a camp south of large-scale attacks continued to occur.
35
The SDF is an alliance of Arab and Kurdish militias
Mosul, according to media reports In late January 2017 IS propaganda dominated by the Kurdish Yekineyen Parastina Gel
relying on sources in Iraqi intelligence. started showing attacks allegedly (YPG – People’s Protection Units) supported by the
USA and other Western countries.
 JIHADIST TERRORISM 37

the city. By the end of 2017 IS territory Levant Free Men Movement) for this integration within the Syrian armed
was reduced to a stretch of the purpose. Concurrently, other jihadist opposition. However, a significant
Euphrates valley and the adjacent groups opposing the merger rallied faction of al-Qaeda loyalists rejected
desert. around Harakat Ahrar al-Sham. This the break of relations with the mother
rearrangement led to the formation organisation.
On the Lebanese-Syrian border, the
of two competing jihadist coalitions in
Lebanese army launched an offensive In 2017, rumours continued to spread
northern Syria. that al-Qaeda leader Ayman al-Zawahiri
against an IS enclave in late August
2017, while Syrian army and Hezbollah Hay’at Tahrir al-Sham also experienced never gave his agreement to Jabhat al-
forces attacked IS from the east. As splits in the course of 2017. Several Nusra’s severing of ties with al-Qaeda.
part of the ceasefire agreement with factions declared that they left Apparently, the al-Qaeda loyalist
the Syrian regime and Hezbollah, on Hay’at Tahrir al-Sham in protest faction was planning to establish a
30 August 2017, a convoy of IS fighters at its aggressive attitudes towards new al-Qaeda affiliate in Syria since
other forces within the Syrian armed the declaration of Jabhat Fateh al-
left the Lebanese-Syrian border area
Sham. The tensions escalated after
in direction of al-Bukamal. The convoy, opposition. One of the most prominent
the deployment of Turkish military in
which was escorted by the Syrian army was Harakat Nour al-Din al-Zinki
Idlib province in mid-October 2017,
and Hezbollah, was stranded in the (Nuruddin al-Zinki Movement), which
to which Hay’at Tahrir al-Sham had
Syrian Desert after anti-IS coalition broke away in late July in opposition to agreed. On 26 November 2017, Hay’at
airstrikes attempted to prevent it from what it saw as unacceptable aggression Tahrir al-Sham launched a large-scale
against Harakat Ahrar al-Sham36. In detention campaign against al-Qaeda
early October former Jabhat al-Nusra loyalists in areas controlled by it in
and Jabhat Fateh al-Sham leader Abu the Idlib province, Syria. In an audio
Muhammad al-Jawlani succeeded Abu message published on 28 November
Jabir Hashim al-Shaykh as leader of 2017 in the context of the detentions,
Hay’at Tahrir al-Sham, showing Jabhat Ayman al-Zawahiri confirmed the
Fateh al-Sham’s predominant position rumours that he had not agreed to
within Hay’at Tahrir al-Sham. Jabhat Fateh al-Sham’s defection from
al-Qaeda and asked Jabhat al-Nusra to
Among jihadist ideologues, however, renew its pledge of allegiance to him.
opposition to Hay’at Tahrir al-Sham He emphasised that this “breaking of
also grew. Certain decisions taken by the pledge of allegiance” did not lead
Hay’at Tahrir al-Sham were deemed to the aspired unity of the “mujahidin”
to contradict jihadist principles. in Syria and did not stop the USA from
reaching its destination.
Abu Muhammad al-Maqdisi, a putting the new organisation on the
In speeches published on the internet, leading Jordanian jihadist ideologue, terrorist list. Finally, Hay’at Tahrir
the IS leadership called for supporters vehemently accused Hay’at Tahrir al-Sham had to stop its campaign
in Australia, Europe, Russia and the al-Sham of “diluting” jihad by against the al-Qaeda loyalists due to
USA and elsewhere to perpetrate compromising jihadist convictions, for heavy internal and external pressure,
attacks in order to deviate its enemies’ example, by collaborating with Turkey. with several factions suspending its
attention from the “caliphate lands”. activities within Hay’at Tahrir al-Sham
The relation between Hay’at Tahrir and threatening secession. The events
They also praised the achievements
al-Sham and al-Qaeda has been show the difficulty in accommodating
of IS affiliates in countries beyond Iraq
ambivalent since the beginning. global jihadist factions within a broader
and Syria, in particular the Philippines.
Jabhat Fath al-Sham is the successor framework, which would entail the
In Syria, relationships between organisation of Jabhat al-Nusra, which acceptance of compromise in rhetoric
al-Qaeda-linked factions and the publicly broke its ties with al-Qaeda and deed. The events also show the
rest of the Syrian armed opposition in late July 2016, declaring that it was continued influence of al-Qaeda leader
remained complex and, at times, an organisation without ties to any Ayman al-Zawahiri through trusted
tensions escalated into violence. In late external organisation. This public middlemen on the ground.
January 2017 several fighting factions, disassociation from al-Qaeda appears
including Jabhat Fateh al-Sham (the to have been accepted at the time by
Levant Conquest Front), merged to the al-Qaeda leadership under the
form Hay’at Tahrir al-Sham (the Levant promise that the relationship would
Liberation Committee). The merger be continued in secret. This was likely
was an attempt to unite al-Qaeda- done to eschew being labelled as a
linked factions and local groups of proscribed terrorist organisation and
jihadist orientation. Hay’at Tahrir facilitate the group’s cooperation and
al-Sham was initially headed by Abu
Jabir Hashim al-Shaykh, who defected 36
On 18 February 2018 Harakat Ahrar al-Sham
from his position as senior commander and Harakat Nour al-Din al-Zinki announced their
in Harakat Ahrar al-Sham (the merger under the name Jabhat Tahrir Suriya (Syrian
Liberation Front).
 TESAT 2018 38

targeted Egyptian military forces,

Egypt Christians and Sufi mosques. A series
of assassinations of Coptic Christians
in the northern Sinai led hundreds
In Egypt, two German female tourists of families to flee the peninsula. The
were stabbed to death and four other assassinations were not claimed,
people, including a Czech woman, but in propaganda messages IS Sinai
wounded in a hotel in Hurghada on 14 province had previously threatened
July. The Czech woman later died as to kill Christians. In addition, one
a result of her injuries. According to policeman was killed and three
media reports the attacker, a 28-year- others wounded in a shooting on St
old student from northern Egypt, was Catherine’s monastery in the Sinai the Coptic cathedral in Alexandria,
tasked to attack foreigners by online on 18 April, which was claimed by IS. where the service was led by the
contacts that claimed to belong to IS. In an attack on a Sufi mosque in the Coptic Pope who remained unharmed.
He swam to the hotel beach, sat with northern Sinai on 24 November, 305
the women and had a conversation people, including many children and The security situation in Egypt’s
in German, prior to the attack. He elderly people, were killed, according western desert remained of concern
then swam to an adjacent hotel, to the official count. The assailants to Egyptian authorities, due to its
where he also wounded two people, reportedly carried IS flags, but no claim proximity to Libya. For example, on
before being apprehended. According of responsibility was issued by the 26 May an attack claimed by IS on a
to German authorities, based upon group. bus carrying Coptic Christians near
information from the appropriate Minya caused the death of at least
Egyptian counterparts, there was no Christians were also targeted in 19 people. In response, Egypt carried
evidence for a religiously motivated several attacks claimed by IS in 2017 out airstrikes on targets in Libya, from
terrorist attack. in different parts of Egypt outside the where the attackers were said to have
Sinai. For example, in Tanta, a city come. On 20 October according to an
On the Sinai peninsula, the fight in the Nile Delta, a suicide attacker official statement, 16 policemen were
against the local IS affiliate, the IS detonated his IED in a Coptic church killed in a shootout following a raid
Sinai province, escalated in 2017, during Palm Sunday service on 9 April, on a supposed terrorist hideout in the
with terrorist attacks followed by killing 27 people. Hours later a second Bahariya Oasis.
violent repression. Numerous attacks attack which killed 17 people targeted

In particular the Libyan National Army

North Africa (LNA), led by Khalifa Haftar and linked
to the Bayda government, continued
to expand in 2017 its control over
In Libya the competition between rival territory to the south of Benghazi. After
governments continued in 2017 despite seizing much of the oil-rich Gulf of Sirte
the formation of the Government of in September 2016, it continued south
National Accord (GNA) in March 2016, taking control of the Jufra district in
based on a Libyan Political Agreement early June 2017. In addition, in July
signed in December 2015 in the 2017 the LNA announced that it had
Moroccan coastal town of Skhirat. achieved victory over the factions
The GNA, which is led by a Presidency controlling parts of Benghazi city.
Council and is the internationally
recognised government of Libya, Despite several attempts to
struggled to consolidate its position. international mediation to achieve
Powerful militias and local warlords a ceasefire between the parties, the
siding with either of the two other military confrontations between the
Libyan governments – the officially rival blocks increased in 2017 and were
dissolved Government of National accompanied by accusations of war
Salvation (GNS), mainly supported crimes committed by different parties.
by Islamist factions, in Tripoli in the The chaotic situation in Libya severely
west of the country, and the House of hampered counter-terrorism efforts.
Representatives and its government After the expulsion of IS from the
in Bayda in eastern Libya – continued coastal town of Sirte in December
competing for control of territory and 2016, which it had seized in early
resources.
 JIHADIST TERRORISM 39

2015 by forces linked to the GNA, In late May 2017 Ansar al-Shari’a in
remaining IS fighters retreated to Libya, a local ally of al-Qaeda, declared
desert areas. From there the group its dissolution, stating that others
continued perpetrating attacks in areas would need to continue the fight. The
south of Sirte and the Jurfa district. group’s decline, which had started
By late August IS had become more in 2015, was probably linked to the
assertive again, staging checkpoints growing influence of IS in the country.
in the LNA-controlled Jufra district It is likely that former members of
and perpetrating terrorist attacks in Ansar al-Shari’a joined jihadist factions
populated areas along the coast. These in western Libya. The low profile
terrorist activities continued for the adopted by al-Qaeda in Libya is in line
remainder of the year. with its official strategy of creating
alliances with local groups.

Sahel and Nigeria by the leader of Ansar al-Din, Iyyad Agh

Ghali, who in the foundational video
(MINUSMA) troops. These included two
attacks on UN camps in Douentza and
pledged allegiance to the leaders of Timbuktu on 14 August which killed at
The security situation in Mali remained AQIM, the al-Qaeda central leadership least 19 people.
precarious in 2017, with frequent and the leadership of the Taliban. The
Foreigners continued to be targets
attacks by jihadist groups targeting merger was subsequently endorsed
of attacks or hostage taking. On 18
Malian and foreign military forces in public statements by AQIM and
June JNIM attacked a tourist resort
present in the country. For example, on the al-Qaeda central leadership. In its
in Kangaba near the Malian capital
18 January 2017 77 people were killed statement, AQIM linked the approval of
Bamako, which was popular with
in a suicide attack using a vehicle-borne the merger with hopes for new attacks
Western citizens. Five people were
improvised explosive device (VBIED) on in France.
killed, including two French citizens and
a military camp in Gao during morning a Portuguese soldier working for the EU
assembly. The camp housed Malian Training Mission Mali.
government soldiers and former rebel
forces conducting mixed patrols under In a video published on 1 July albeit not
the Joint Operational Mechanism, a under the al-Zallaqa Media label, JNIM
UN-brokered peace agreement. On declared that at that moment in time it
the same day, a statement was issued held hostage six foreign nationals from
by the al-Andalus Media Production Australia, Colombia, France, Romania,
Company, the official media outlet South Africa and Switzerland. These
of al-Qaeda in the Islamic Maghreb included a Colombian nun, kidnapped
(AQIM), which specified that the on 7 February in southern Mali close
attack was conducted by a member to the border with Burkina Faso. She
of the al-Murabitun brigade of AQIM. To mark its autonomy and remained in captivity throughout the
Al-Murabitun (those who are lined up programmatic orientation, JNIM year.
[against the enemy]) had split in 2015 created a new online brand with a In addition, the faction of al-Murabitun
into a faction pledging allegiance to IS centralised media outlet, the al-Zallaqa that pledged allegiance to IS, now
and another one that remained loyal to Media Production Company, named commonly known as the Islamic State
AQIM. after the Battle of Sagrajas (al-Zallaqa in the Greater Sahara, continued to be
in Arabic) in Spain in 1086, in which active in the border region between
In early March 2017 Ansar al-Din (also
Christian forces were defeated by a Burkina Faso, Mali and Niger. On 4
known as Ansar Dine, “supporters of
Muslim army. October 2017 it attacked a unit of
the religion”), al-Murabitun and AQIM’s
Sahara division merged under the The merger led to improved Nigerien and US Army Special Forces,
name Jama’at Nusrat al-Islam wal- operational capacities and an increase killing five Nigerien and four US
Muslimin (JNIM, “group in support of in the number of casualties owing to soldiers38.
Islam and Muslims”). In addition, the terrorist attacks in the region. JNIM
Fulani-dominated Macina Liberation continued the violent activities of
Front joined the umbrella organisation. its predecessor organisations with
The main groups forming the alliance several attacks on military targets, 38
The attack was among a number of incidents
had already cooperated closely in the including the forces of French claimed in a statement signed by the group’s leader,
past37. The new formation was to be led military in Operation Barkhane and Abu al-Walid al-Sahrawi, which was sent to local
news outlets on 12 January 2018. In a video released
United Nations Multidimensional in early March 2018, the group presented footage
37
Europol, EU Terrorism Situation and Trend Report Integrated Stabilisation Mission in Mali taken from a camera on one of the US soldiers’
(TE-SAT) 2017, 2017, p. 36. helmets.
 TESAT 2018 40

In Nigeria, despite repeated army fatalities caused by terrorism in 2017. Sambisa Forest in southern Borno
claims to have defeated it militarily, Most attacks remained unclaimed. State and adjacent areas. Many
the different factions of the jihadist suicide attacks targeting mosques and
In August 2016 Boko Haram split
militia known as Boko Haram crowded places are attributed to this
into two main factions, one led by
(“Western education is unlawful [in faction.
Abubakar Shekau, who had pledged
Islam]”) continued to conduct large-
allegiance to IS in 2015, and another
scale violence and abductions in 2017.
one led by the son of Boko Haram
Numerous attacks across north-east
founder Muhammad Yusuf, using the
Nigeria and neighbouring countries
nom de guerre Abu Mus’ab al-Barnawi
Niger, Chad and Cameroon targeted
(“Abu Mus’ab from Borno”), who was
military and police forces, mosques,
recognised by the IS leadership as
markets and internally displaced
the head of its West Africa province
persons (IDP) fleeing Boko Haram.
in August 2016. In 2017 the two
In 2017 an increased use of women factions operated in largely separate
and children in suicide attacks using geographical areas. The IS West Africa
person-borne improvised explosive province under al-Barnawi was based
devices (PBIEDs) was noted. Many of in the Lake Chad region. It acquired
the women had been abducted by capabilities to conduct highly
Boko Haram in previous years. These organised attacks. Abubakar Shekau’s
attacks led to a significant increase of faction was mainly active around the

Arabian Peninsula The turmoil in Yemen allowed

al-Qaeda in the Arabian Peninsula
(AQAP) to continue building and
expanding its popular support base,
In Yemen, the civil war between the
after being forced to withdraw from
Houthi rebels, who refer to themselves
Mukalla in April 2016, by creating
as Ansar Allah (“servants of God”),
strong links with Sunni tribes, in
and the internationally recognised
particular in the eastern Hadramawt
government under President Abd-
governorate, without attracting public
Rabbu Mansour Hadi continued
attention. AQAP profited from the
unabated. The Hadi government
smuggling trade fuelled by the war
continued to receive support from an
economy.
alliance of Arab Sunni countries led
by Saudi Arabia, backed by Western Militarily, AQAP focussed its attacks
states, which started conducting on Houthi rebels and the Yemeni
airstrikes in the country in 2015. The military. In its propaganda, AQAP
conflict created one of the greatest portrayed its fight against the Yemeni
humanitarian catastrophes in Yemen’s army as an attempt to protect Sunni
history. tribes in Yemen against their enemies,
who in the group’s ideology comprise
The Houthi militias, whose members
Western countries, in particular the
belong to the Zaydi branch of Shi’i
USA, Arab countries involved in the
Islam, were allied with forces loyal to
war in Yemen, the Hadi government as
former Yemeni president Ali Abdullah
well as the Houthi rebels. For example,
Salih, who had been ousted in 2012
after a USA raid on an alleged AQAP
in the wake of popular protests. After
stronghold in Yemen’s Bayda province
Salih declared that he had withdrawn
on 31 January, AQAP’s leader Qasim
from the alliance with the Houthis, he
al-Raymi denounced the death of
was assassinated by Houthi fighters
women and children in the raid,
on 7 December 2017 when he tried to
including a daughter of late jihadist
flee the formal Yemeni capital Sana’a,
propagandist Anwar al-Awlaqi, and
which had been under Houthi control
expressed his sympathy with the Sunni
since 2014. The Houthis declared
tribe on whose territory the incident
that he was killed on account of his
had occurred. He alleged that the
treason.
USA was conspiring with the Houthi
 JIHADIST TERRORISM 41

rebels to fight the Sunnis in Yemen. On Contrary to AQAP, from late 2014 Saudi Arabia, which was among
several occasions in 2017 AQAP also armed factions in Yemen which pledged countries singled out in IS calls for lone
denounced Saudi Arabia and the United loyalty to IS sought integration into actor attacks, continued to witness
Arab Emirates (UAE) as deviating from the local tribal structure to a far lesser sporadic terrorist plots. For example,
Islam and collaborating with the USA degree and instead adopted a rhetoric two men blew themselves up on
in its alleged war on Muslims. The two aimed to deepen sectarian divisions 21 January 2017 when confronted
Arab countries were accused of trying in Yemen. Several bomb attacks by security forces in Jeddah. Their
to corrupt the Yemeni tribes by inciting and assassinations in Yemen were affiliation was not disclosed. On
them to fight one another. The high claimed by IS, mainly in the al-Bayda’ 23 June, according to authorities,
civilian death toll inflicted by the Saudi- governorate and Aden. Videos showed a terrorist plot allegedly targeting
led coalition and accusations of human training of fighters and idyllic scenes on security, pilgrims and worshippers at
rights violations perpetrated by both life with IS. In mid-October 2017, a US the Grand Mosque in Mecca was foiled.
the Houthi rebels and forces linked to airstrike targeted two IS training camps One of the suspects blew himself
the Saudi-led coalition, in particular in al-Bayda’ province, killing dozens of up when engaged in a fire fight with
the UAE, are likely to increase the IS members, according to the US army. security forces at a hideout. Saudi
effectiveness of such arguments. AQAP The camps were allegedly used to train authorities did not attribute the plot to
warned local populations that, in case fighters in the use of different weapons a specific group.
they joined the coalition side, they and rocket launchers. In November
would become attack targets. 2017 AQAP celebrated the defection of
IS members in Yemen.

landmine targeted the WFP convoy and

Somalia its escorting soldiers.
In 2017 HSM in particular targeted
Somalia witnessed continued conflict the capital Mogadishu, which suffered
and severe drought in 2017, the multiple attacks. These attacks were
effects of which compounded to carried out mainly by remotely
create the most severe famine in detonated VBIEDs, suicide attacks
the country since 2011 affecting half using VBIEDs or suicide assaults.
the population. Harakat al-Shabab They targeted military and police,
al-Mujahidin (HSM – “mujahid youth populated areas and hotels. In
movement”), which still controlled addition, numerous attempts on the
rural areas in southern Somalia, lives of Somali military, intelligence
continued launching assaults on troops and government personnel as well as
of the African Union Mission in Somalia Somali journalists occurred.
(AMISOM) and Somali forces. For Most but not all of these were claimed
example, on 27 January HSM fighters by HSM. In one of the deadliest attacks
attacked Kenyan AMISOM troops at in Somalia in decades, VBIEDs hidden in
Kulbiyow in Somalia near the Kenyan two lorries exploded on a busy junction
border. The attack started with two in central Mogadishu on 14 October.
VBIEDs driven into the military base, More than 350 people were killed. The
followed by a large number of HSM attack was attributed to HSM but no
fighters attacking it. HSM claimed claim of responsibility was published.
that they killed more than 50 Kenyan The group may have hesitated to claim
soldiers, a number denied by the the attack due to the risk of the high
Kenyan army. civilian death toll alienating Somali
Through such attacks and roadblocks citizens. Two weeks later, by contrast,
on major routes, HSM constituted the HSM claimed responsibility for an
greatest impediment to the delivery of attack in Mogadishu on 28 October
relief to drought victims, in particular in which 23 people were killed. The
in areas under its control in the target was a hotel scheduled to host a
country’s south. In April a roadside meeting between the Somali Federal
bomb exploded 100m behind a moving President and his five regional peers.
World Food Programme (WFP) convoy After two VBIEDs detonated nearby,
in the outskirts of Mogadishu. HSM armed fighters assaulted the hotel.
stated that the remotely controlled The attackers were reportedly killed
 TESAT 2018 42

during the ensuing siege. These and active in 2017. In October 2016 the when a PBIED detonated at a police
other attacks may have aimed to group had taken over the town of checkpoint near a hotel in Bosaso.
disprove speculations about the group Qandala in Puntland’s Bari region, In November the US military started
being weakened by the killing of an declaring it the seat of an “Islamic conducting airstrikes targeting the IS
HSM commander in a US drone strike caliphate in Somalia”, but was faction in Somalia.
in the Lower Shabelle region in early driven out in early December 2016.
In Kenya in 2017 HSM concentrated
August, who was believed to have Its recruitment efforts reportedly
its violent activities on the regions
been responsible for leading HSM targeted disaffected HSM members
bordering Somalia, conducting several
forces operating in the Mogadishu and in southern Somalia. Despite its more
attacks on Kenyan security forces and
Banaadir regions and planning and international orientation compared
local inhabitants.
executing attacks in Mogadishu. to HSM, the group has been able
to attract only a limited number of
An armed faction in Puntland which
foreign fighters. On 8 February 2017
split from HSM in October 2015 and
the group’s fighters stormed a hotel
pledged allegiance to IS39 remained
in Bosaso, the economic capital of
Puntland. On 23 May it carried out its
39
Europol, EU Terrorism Situation and Trend Report
(TE-SAT) 2016, 2016, p. 33.
first suicide attack, killing five people

filled with explosives detonated at the The Pakistan-based Taliban offshoot

entrance of the diplomatic quarter Jamaat-ul-Ahrar (“Group Of Free
in Kabul after being denied access; Men”) claimed responsibility for
more than 100 people died. The several attacks in in February 2017.
explosion took place near the German IS claimed several bomb attacks
embassy, which was severely damaged killing more than a hundred people
and had to be evacuated. IS claimed in Pakistan in 2017, targeting Sufi
responsibility for the attack, but shrines, Christians, politicians. On 16
Afghan authorities tended to attribute February an attacker detonated his
it to the Haqqani Network (HQN), PBIED at a Sufi shrine in Sehwan in
which is linked to the Taliban. southern Pakistan. According to the
authorities, 83 people died. IS claimed
IS targeted the Shi’i minority in
South Asia Afghanistan in several attacks. Among
responsibility.
other incidents, the group claimed A series of attacks on 23 June in
suicide attacks on Shi’i mosques in different regions of Pakistan, which
Afghanistan witnessed continued Herat on 1 August, which killed at least killed at least 42 people in Quetta,
violence throughout 2017 from both 29 people, and in Kabul on 25 August, Parachinar and Karachi, was claimed
the Taliban movement and IS Khorasan which killed some 40 people. by both Jamaat-ul-Ahrar and IS. Other
province. The Taliban claimed attacks remained unclaimed.
Presumed IS members killed six
responsibility mainly for attacks Afghan employees of the International
targeting security forces, including Committee of the Red Cross in
NATO troops. IS claimed a high number northern Afghanistan on 8 February.
of suicide attacks, often using PBIEDs
in combination with firearms, on Several attacks were claimed by both
religious and civilian targets, including the Taliban and IS, including an attack
foreign embassies. On 10 January with nearly 50 rockets fired on Kabul’s
a twin bomb attack targeting the main airport during a visit by the US
provincial governor’s office in Kabul Secretary of Defense and the NATO
killed 11 people, including five UAE Secretary General on 27 September.
diplomats, who were member of a On 26 July, al-Qaeda announced the
visiting delegation. The governor and creation of Ansar Ghazwat al-Hind as
the UAE ambassador to Afghanistan a new affiliate operating in the region
were among those injured. On the of Kashmir, which is disputed between
same day, a twin bomb attack targeted India and Pakistan. The new entity was
the Afghan parliament. Both attacks to be headed by a 23-year-old former
were claimed by the Taliban. Hizb al-Mujahidin (“Mujahidin Party”)
On 31 May 2017 a large water tanker member.
 JIHADIST TERRORISM 43

to consist of Abu Sayyaf and Maute threatened that “we will be in Rome,
members. According to a military God willing”. Muslims in East Asia,
spokesman, they were supported by especially in Brunei, Indonesia,
fighters from other Asian countries, Malaysia, Singapore and Thailand were
including Indonesia, Malaysia and asked to come to Marawi and join jihad
Singapore. there.
IS used the success in the Philippines In mid-October the Philippine army
to project an image of invincibility. announced that it had killed Isnilon
For example, in a comment on the Hapilon and another IS leader,
22 May bomb attack on a concert in Omarkhayam Maute, in Marawi. On
Manchester, an article in Rumiyah in 23 October the Philippine government
Southeast Asia early June stressed that the loss of
territory would only result in future
declared that the battle against the
terrorists in Marawi had ended.
expansion, citing as an example the
takeover of Marawi. In an IS video
In the Philippines in late May 2017
featuring the events in Marawi, which
at least 100 Islamist rebels attacked
was published on 20 August, the group
Marawi, a city of 200 000 inhabitants
stated that the city was “liberated”
Mindanao Island. The clashes
on 23 May, almost two years after
reportedly started when soldiers
the mujahidin in Indonesia pledged
tried in vain to arrest Isnilon Hapilon,
allegiance to Abubakr al-Baghdadi. The
the leader of Abu Sayyaf, which had
video showed armed men storming
pledged allegiance to IS in 2014 and
a church and destroying statues and
intended to unite all IS factions in
pictures of Pope Francis. A fighter
the region. The attackers were said

against Western targets in both in April 2015 in the border area of

Kidnappings Afghanistan and Pakistan. The arrest Burkina Faso, Niger and Mali remained
of the HQN leader’s brother in 2014, captive at the time of writing. He was
and his subsequent death sentence abducted by an IS-affiliated branch of
In 2017 Western citizens continued in Afghanistan, led to the HQN al-Murabitun and his last appearance
to become victims of terrorist attacks making considerable efforts to kidnap was in a video posted online by AQIM
and kidnappings, mainly in and around westerners for use in negotiations. in July 2017. Furthermore, a Swiss
conflict zones. During the reporting The rescue of an American-Canadian missionary has been held by AQIM
period, attacks and kidnap operations family in Pakistan in October, deprived since January 2016 when she was
against westerners occurred in the HQN of the opportunity to use abducted from her home in Timbuktu.
Afghanistan, Burkina Faso, Egypt, Mali, them in a prisoner exchange. The HQN This hostage has featured in a number
Nigeria and the Philippines. No such currently holds two Western hostages, of AQIM videos in which the terrorist
incidents were reported in Iraq, Libya, an American and an Australian, group demanded the release of its
Syria and Yemen but the risk of EU professors at the University of Kabul, imprisoned fighters in Mali and of a
citizens being attacked or kidnapped who were kidnapped in Kabul in August member of Ansar Dine that was facing
remained high. Moreover, a number of 2016. In October 2017, HQN released a trial at the International Criminal Court.
western citizens who were abducted in statement that the American hostage Her most recent appearance in one of
previous years by criminal or terrorist was in poor health and urged for a these videos was in June 2017.
groups remained in captivity. Hostages prisoner swap. In May 2017, an incident
have been used by their captors for During the reporting period, two
occurred in Kabul, in which unidentified
propaganda and political pressure on attacks targeting westerners also
militants attacked a guesthouse of
local and foreign governments; financial occurred in the same region. On 18
Operation Mercy (a Swedish NGO) and
gains via ransom payments; and June in a terror attack on a luxury
killed a German woman and an Afghan
prisoner exchanges. resort in Bamako (Mali), a Portuguese
guard and kidnapped a Finnish aid
soldier and two civilians with dual
In Afghanistan, terrorist and criminal worker, who was later released.
nationality (French-Malian and French-
groups continued to pose a grave In the Sahel region, militants of Gabonese) were killed. AQIM claimed
kidnapping threat for both locals and al-Qaeda in the Islamic Maghreb responsibility and its intention to target
foreigners. The Haqqani Network (AQIM) and IS continued their terrorist members of an EU military training
(HQN) maintained the intent and activities. A Romanian citizen kidnapped delegation in Mali. On 14 August one
capability to conduct kidnap operations
 TESAT 2018 44

French national was killed during an concerning the death of one Austrian, members in Bohol, a major tourist
attack at a Turkish restaurant popular one Czech, one Ghanaian and four destination. The provinces of Cebu and
with expatriates in Burkina Faso. Filipino hostages abducted by IS Palawan were also considered to be
militants at al-Ghani oil field in March within the reach of terrorists based in
A Swedish citizen and a British-
2015. the south of the country.
South African citizen held by AQIM
were released in June and July 2017 No kidnapping of EU citizens was Three EU citizens remained hostages
respectively. They had been abducted reported in the Philippines in 2017. in Syria in 2017: an Italian Jesuit priest
from a restaurant in Timbuktu in Nonetheless, in February the Abu kidnapped in July 2013 in Raqqa; an
November 2011 along with a Dutch Sayyaf Group (ASG) posted a video Italian businessman kidnapped in
citizen who was freed in 2015, and online showing the execution of May 2016, who appeared in a video
were held in different locations. In a German hostage that they had in November of the same year; and
October an Italian catholic priest who abducted in November 2016. Western a British journalist held by IS since
was kidnapped in Benin City (Nigeria) tourists in the Philippines continued to November 2012, who has featured
by a criminal group demanding a be an attractive target for kidnapping in numerous IS propaganda releases.
ransom was released having been held by local terrorist organisations, Their whereabouts and fate remain
for five days. especially the ASG. In 2017 militants unknown at the time of writing.
expanded their area of operation
Libya experienced no kidnapping
beyond the Mindanao province and
of EU citizens in 2017, but the
the Sulu Archipelago. In April Filipino
security situation in the country
security forces thwarted an attack,
has not changed; political instability
probably aiming at kidnapping tourists,
and violent conflicts continued. In
by a group of heavily armed ASG
September 2017, there were reports
 TESAT 2018 45

3/
ETHNO-NATIONALIST
AND SEPARATIST
TERRORISM

Most terrorist attacks carried out

in the EU in 2017 were specified as
UK / Dissident with many attacks involving firearms
or small improvised explosive devices
separatist attacks (137 out of 205).
France counted 42 attacks, Spain
Republican groups such as pipe bombs. They have,
however, also deployed larger and/or
experienced 7 attacks. There were 88 potentially more destructive devices
security-related incidents in Northern In 2017, included in the 88 security such as vehicle borne improvised
Ireland, of which 58 were shooting and incidents mentioned above, there were explosive devices (VBIED) and
30 were bombing incidents. five Dissident Republican (DR) attacks explosively formed projectiles.
The completed separatist attacks against national security targets41, Apart from attacks on the security
were aimed at businesses and critical including one in January in which a services, many dissident republicans
infrastructure, but also at civilians and police officer was seriously injured in a are also heavily involved in criminal
the military. A total of 30 individuals shooting in Belfast. activities for personal gain, including
were arrested in Germany, Spain, DR terrorist groups opposed to the smuggling and extortion. Their
France, the Netherlands and Austria40. peace process remain the most activities range from minor to serious
significant threat to national security criminality, including drug dealing,
in Northern Ireland. The UK lists four extortion, fuel laundering and murder.
DR groups: the new IRA; Óglaigh na
hÉireann (ONH); the Continuity IRA Spain / Euskadi ta
(CIRA); and Arm Na Poblachta (ANP),
who continue to consider violence a Askatasuna
legitimate means of achieving their
goal of a united Ireland. These groups
consider police, prison officers and No terrorist attacks were perpetrated
members of the armed forces in by the Basque nationalist and
Northern Ireland as their primary separatist organisation – Euskadi ta
targets. Askatasuna (ETA) during 2017. Indeed,
it has not carried out any attack since
Attack methodologies and capabilities announcing a ceasefire in October
used by DRs vary across the groups 2011. ETA’s activities have been
focused on “partial disarmament”
41
Attacks on national security targets is a measure
and on issuing communiqués aligned
used by the security service and includes those with the separatist strategy of the
targeted principally (but not exclusively) against left-wing Abertzale movement. Their
40
The arrests contributed by the UK were not the security forces, those who support them and
included in the ranking as not specified by type of premises and institutions associated with policing main demand is for the complete
terrorism. justice and security.
 TESAT 2018 46

amnesty for the ETA militants serving

prison who have been convicted and
Kurdistan / Partiya fuel and cigarette smuggling,
extortion, kidnapping and money
are currently in jail. In 2017 a series Karkeren Kurdistane laundering42. Austria, France, Romania
of criminal damages against bank and Switzerland reported activities of
offices and public transportation the annual kampanya to finance PKK
infrastructure were perpetrated by Prior to the constitutional referendum, and its armed branch Hêzên Parastina
members of the left-wing Abertzale held throughout Turkey on 16 April, Gel (HPG – People’s Defence Force)43.
movement. The senior members of the Belgium reported incidents between Most funds appear to come from
group reside in France; other militants Kurdish and Turkish militants. voluntary donations obtained, in some
have moved to different EU countries, France also reported attacks against cases, under intimidation. France
including Germany. Two members Turkish consulates, institutions and reports an estimate of EUR 6 million
of the group were arrested in Berlin, associations. In February the premises proceeds. In November 2017 eight PKK
Germany, in October 2017. of the Turkish newspaper Zaman militants were convicted of terrorist
in Seine-St-Denis, and the cultural financing.
association Millennium, in Marseille, The PKK is believed to use Europe as
both France, were also targeted. a base for logistics and procurement
During 2017 French counter terrorist of weapons and recruitment44, and
units arrested several militants, transporting the conflict into the
accused of criminal damages using at Kurdish diaspora. France reported the
times, incendiary improvised devices process of recruitment of militants
in 2016. through the organisation Komalen
Turkish authorities assess that the Ciwan (Kurdish Youth Organisation).
Partiya Karkeren Kurdistane (PKK – Kurdish youngsters residing in France
Kurdistan Workers’ Party) generates are lured to join the organisation.
income from many different types Subsequently, they are sent to
of crimes including drug trafficking, indoctrination camps scattered in
migrant smuggling, human trafficking, Europe, far from their families and
under the influence of PKK senior
ranks. Finally they are trained in
combat techniques in military camps
in Armenia, Iran and Iraq. However,
France estimates that only dozens of
Kurdish fighters are recruited annually
in Europe.

42
Based on figures provided by Turkey.
43
Belgium does not confirm direct financing of HPG.
44
Based on figures provided by Turkey.
 ETHNO-NATIONALIST AND SEPARATIST TERRORISM 47

figure 7
Number of failed, foiled, or completed
attacks and number of arrests for ethno-
nationalist and separatist terrorism
2013-2017.
180
168
154

137

99
84
84
67 65
30

2013 2014 2015 2016 2017

figure 8
Number of failed, foiled, or completed attacks and number of suspects arrested
for ethno-nationalist and separatist terrorism in EU Member States in 2017

UK France Spain

88 Not
specified
42 13 7 10

Germany Austria Netherlands

3 2 2
 TESAT 2018 48

4/
LEFT-WING
AND ANARCHIST
TERRORISM

Terrorist attacks be no operational cooperation or

coordination other than the exchange
Fund (IMF) in Paris and exploded in
the hands of an employee causing
and suspects of solidarity messages via a number of
anarchist websites.
light injury. Greek law enforcement
discovered eight more parcel bombs at
arrested On 1 January a bomb exploded in
the sorting centre of the Hellenic Post
Office in Athens. Synomosia Pyrinon
front of a bookshop with links to the
tis Fotias (Conspiracy of Cells of Fire)
The number of attacks carried out neo-fascist activist group Casa Pound
claimed responsibility merely for the
by left-wing and anarchist terrorist in Florence (Italy), seriously wounding
VOIED sent to Germany. In a similar
groups and individuals (24) decreased a bomb-squad officer. Open source
attack in May, a parcel bomb exploded
slightly in 2017 (27 in 2016). Left-wing media reported the arrest by police
in the car of a former prime minister
and anarchist terrorist activity occurs of five anarchists for “attempted
of Greece injuring him and two police
almost exclusively in Greece, Italy and manslaughter”.
officers.
Spain. Attacks reported by Germany In Greece left-wing and anarchist
and France were both related to Militants of Organosi Epanastatikis
terrorist groups and individuals
terrorists active in Greece. A slight Aftoamynas (Revolutionary Self-
continued to have enhanced
increase was observed in the number Defence Organisation) carried out
operational capabilities and access
of arrested people over 2017 with a two identical attacks against police
to military-grade weapons. In 2017
total of 36 arrests, compared to 31 in officers guarding the headquarters of
eight attacks were carried out: six with
2016. a Greek political party in the centre
the use of IEDs and two with the use
of Athens. On both occasions the
Consistently with previous years, of firearms. Furthermore, a total of
perpetrators shot at the police using
modi operandi employed by left- 12 people were arrested on charges
an assault rifle. The first took place on
wing and anarchist terrorist groups related to left-wing and anarchist
10 January and resulted in the injury of
included predominantly the use of terrorism.
one police officer and the second on 6
improvised explosive devices (IEDs). Terrorists from Greece were behind November without causing any injuries
Attacks were principally targeted two attacks that occurred in Germany or damage.
on government and police officials, and France. These were part of a
property and infrastructure and were Two terrorist attacks were claimed by
terrorist campaign involving the
carried out exclusively by groups and Omada Laikon Agoniston (Group of
sending of a total of ten victim-
individuals of anarchist ideological Popular Fighters) in 2017. On 19 April
operated improvised explosive devices
background. Groups in Greece and an IED exploded outside the central
(VOIEDs, specifically parcel bombs)
Italy continued to claim they comprise offices of a bank and on 22 December
occurred in March. One of the parcel
an international network they call another device detonated in front of
bombs was addressed to the German
Federazione Anarchica Informale/ the building of the Athens appeals
Minister of Finance and was discovered
Fronte Rivoluzionario Internazionale court. Both explosions were preceded
and dismantled by the authorities
(FAI/FRI, Informal Anarchist by a warning call to newspapers.
in Berlin. A second was sent to the
Federation/International Revolutionary director of the International Monetary In Italy anarchist terrorist activity
Front). However, there appears to
 LEFT-WING AND ANARCHIST TERRORISM 49

figure 9
Number of failed, foiled, or completed
attacks and number of arrests for left-wing
and anarchist terrorism from 2013 to 2017.
67

54
49

36

31
27
24 24

13 13

2013 2014 2015 2016 2017

declined in comparison with the 26 January in Milan and on 7 June terrorist attacks outside Turkey, its
previous year. A total of seven attacks in Rovereto; and an attack using members maintained a fixed structure
occurred in 2017, most of which Molotov cocktails against the offices on EU soil that provides logistical
were in expression of solidarity with of the Trans Adriatic Pipeline (TAP) in and financial support for terrorist
incarcerated members of anarchist Meledugno. activities in Turkey, under the guise
terrorist groups. For yet another year, of legally established associations. An
In Spain left-wing and anarchist
anarchist terrorists in Italy used IEDs, indication of this structure was the
terrorist activity continued its
VOIEDs and improvised incendiary arrested of nine DHKP/C operatives on
qualitative and quantitative decline of
devices (IIDs) in their attacks. Italian 28 November in Greece on terrorism-
the past three years. Seven anarchist
law enforcement arrested 11 people in related charges and the discovery
terrorist attacks were reported for
relation to anarchist terrorist activity. of weapons, explosives and forged
2017 out of which two were carried
documents in their possession.
The FAI/FRI was responsible for three out with the use of crude IIDs in a
attacks. On 7 June parcel bombs were parking lot of the Spanish National
sent to two Turin-based prosecutors Police on 25 May and a bank branch Violent extremist
in charge of several cases against
anarchist terrorists. The two devices
on 7 June respectively and five
were foiled. Spanish authorities also activities
were detected and dismantled at the arrested three people on charges
Turin Courthouse. A similar VOIED related to anarchist terrorism. Several EU Member States reported
was detected at the headquarters of that in 2017 left-wing and anarchist
In 2017 the Turkish Marxist-Leninist
the prison department in Rome on 12 extremism remained a threat to
terrorist group Devrimci Halk
June. The Santiago Malnonado Cell of the public order. It predominately
Kutrulus Partisi/Cephesi (DHKP/C,
the FAI/FRI also claimed responsibility derived from anarchist groups and
Revolutionary People’s Liberation
for the explosion of an IED outside the individuals that form loose collectives
Party/Front) remained active in both
Carabinieri Roma San Giovanni police without hierarchical structure and
Turkey and the EU. On 20 January in
station that caused moderate damage organized their actions largely in
Turkey, it carried out an attack against
to the building. squatted buildings and “social centres”.
a police station and the provincial
Anarchist terrorists in Italy were administration building of the Justice Marxist-Leninist groups and individuals
behind three arson attacks in the and Development Party in Istanbul appeared to be less violent in the
first half of 2017: two arsons of using a rocket launcher. Although the reporting period, although there
telecommunication transmitters, on organisation has never carried out appeared to be no change in their
rhetoric.
 TESAT 2018 50

figure 10
Number of failed, foiled, or completed France Germany
attacks and number of suspects arrested
for left-wing and anarchist terrorism in EU
Member States in 2017

1 10 1

Greece Italy Spain

8 10 12 7 11 7 3

In most of the EU Member States, attention (e.g. corruption scandals) and via solidarity events. Further
anarchist extremist activity remained continued to appear in the anarchist synergy was observed during large-
low in intensity. In Greece and Italy, rhetoric. scale international events with much
however, the anarchist extremist media attention. The Hamburg G20
Like in previous years, anarchist
milieu is considered to be an Summit, for example, attracted
extremist violence largely targeted
antechamber to terrorism, in the numerous extremists from around
police personnel and infrastructure,
sense that it provides fertile ground Europe: police arrested anarchists
government property, banks,
for radicalisation and recruitment. from the Czech Republic, the
migration-related private businesses
In addition, the anarchist movement Netherlands, Switzerland and the UK
and right-wing extremists. Modi
supports imprisoned anarchist and identified protesters from Italy
operandi included launching attacks
terrorists with solidarity and and Spain. Extremists in the EU also
during demonstrations, arson attacks,
fundraising activities. followed and reacted to developments
and vandalisms. Acts of arson were
on the international political stage.
The issue of migration remained carried out with the use of improvised
On two such occasions, anarchist
central in the anarchist extremist incendiary devices (IIDs) or with the
extremists in Greece vandalised the
agenda. Anarchists focused their throwing of Molotov cocktails in
Embassy of Israel and the Embassy of
activities on government migration hit-and-run operations. Such attacks
Saudi Arabia at the end of the year, in
policies and on the expression of were reported by Belgium, France,
reaction to the two countries’ policies
solidarity with migrants. The core Germany, Greece and Italy. Vandalism
on Palestine and Yemen respectively.
of their mobilisation, however, was occurred mainly during protests but
against right-wing political parties and also in surprise attacks by small groups
right-wing extremist groups. Other of extremists against police stations or
central issues were the support to other targets.
arrested or imprisoned terrorists and
In 2017 anarchist extremists in the
extremists; the eviction of squatted
EU maintained contacts with and
properties; and generic themes, such
continued to express their support
as the economy and the criminal
to each other. This was achieved via
justice system. Furthermore, emerging
references on their online propaganda
issues that attract the public’s
 TESAT 2018 51

5/
RIGHT-WING
TERRORISM

Five foiled, failed or completed There are RWE groups that are of RWE groups have targeted anarchist
terrorist attacks attributed to right- prepared to use violence to advance groups.
wing extremists (RWE) were reported their political agenda. In March 2017
Neo-Nazi groups reported by EU
for 2017: all of them by the UK. On EU Security Commissioner Sir Julian
Member States include the Generace
19 June one person died and 10 King highlighted the growing menace
Identity (Generation of Identity)
were injured after a van was driven of RWE. Sir King said that he was not
movement and the Pro-Vlast
deliberately into a crowd of Muslim aware of a single EU Member State
movement in the Czech Republic, the
worshippers in North London by a that is not affected in some way by the
group Soldiers of Odin in Belgium
man who had previously expressed phenomenon. However, he also noted
and the Blood & Honour organisation
hatred of Muslims. Four days later, that it tended to receive less media
in Portugal. Other RWE groups try
on 23 June, a known supporter of the coverage46. This may contribute to
to present themselves in a more
far-right party Britain First drove a underreporting on the subject.
widely accepted fashion. These
vehicle into an Indian restaurant in
The RWE scene is fragmented and groups sometimes publicly advertise
London, injuring several people. Prior
manifests itself in a variety of forms. populist views in a way to make them
to the attacks, he was caught on CCTV
In EU Member States, a myriad of socially acceptable within segments
making Nazi salutes.
often small RWE groups, including of the population, as reflected in the
In addition to attacks classified as National Socialist-oriented and existence and electoral successes of
terrorism, other violent incidents took neo-Nazi groups, exist. Germany legally constituted political parties in
place in 2017 motivated by RWE, for reported New Right factions, such as EU Member States that have adopted
example on 15 April two men with a the Identitäre Bewegung Deutschland elements of RWE agendas.
proven affinity with National Socialism (IBD, Identitarian Movement
An important trigger for the current
threw incendiary devices at an asylum Germany) and supporters of the
expansion of the RWE scene is the
hostel in Germany. Reich Citizen ideology, to be gaining
fear of an assumed Islamisation of
visibility. These RWE groups adopt a
The number of individuals arrested the Western world. A major and
variety of ideologies, ranging from
in relation to RWE offences almost active representative of the RWE
the condemnation of the political
doubled in 2017 (11 in 2015; 12 in scene motivated by fear of Muslim
establishment and the membership of
2016; 20 in 2017). The vast majority domination and the introduction of
international organisations (e.g. NATO
(15) were reported by France. Of Islamic law (shari’a) is the Identitäre
and the EU), to the rejection of asylum
the 20 people arrested45, 16 were Bewegung, which originated in
policies, migrants and individuals and
arrested for preparing an attack, 3 Germany and currently has branches
groups associated with a different
for committing an attack and one for in other EU Member States including
racial, ethnic (e.g. Roma), religious
inciting and/or praising terrorism. Austria (Identitäre Bewegung
(e.g. Jews and Muslims) or political
Österreich, Identitarian Movement
background. Furthermore, members
Austria) and the Netherlands (Identitair
Verzet, Identitarian Resistance). On
46
Tempest, M., “Commissioner warns of ‘growing its Facebook page the IBD has taken
menace’ of right-wing terrorism in EU”, Euractiv. up a video of the French Génération
com, accessed 31 January 2018, https://www.
45
The arrests contributed by the UK were not euractiv.com/section/politics/news/commissioner-
Identitaire and the intentions and
included in the ranking as not specified by type of warns-of-growing-menace-of-right-wing-terrorism- aims formulated therein, and has
terrorism. in-eu/
 TESAT 2018 52

obviously taken this as a reference and and hate speeches against migrants.
role model for its founding. In Belgium,
Activities sometimes included training
the group La Meute Belgique (Belgian
in self-defence, shooting and other
Pack), with an anti-Islam agenda, had its
combat skills. An example of such
first meeting in 2017 to commemorate
a group is the Slovenskí Branci in
the March 2016 attacks in Brussels on
Slovakia. This group believes that the
the airport and the Maelbeek metro
Slovak armed forces are insufficiently
station. The Dutch group Identitair
able to resist potential “outside
Verzet temporarily occupied buildings
threats”. In the UK, following the
associated with Islam, including a
proscription of National Action in
Salafist school and a mosque under
December 2016, two groups, Scottish
construction. The UK assessed that
Dawn and NS131, emerged and were
protest activity by RWE groups will
assessed to hold the same ideology
continue to target predominantly
and membership as National Action. In
Muslim areas, provoking racial hatred
September 2017, both groups were also
and harassment. Triggers cited for such
proscribed, it having been recognised
activities included new or expanded
that these groups were alternative
Muslim places of worship, media
names for National Action. Arrests
coverage of sex offences by refugees
against this group in October 2017
and (jihadist) terrorist incidents in the
included individuals that were serving
UK.
in the British army. National Action
In August 2017 two 36-year-old encourages its member to prepare for
German nationals were arrested for a “race war” in the UK. The group has
suspected preparation of a serious act held training camps in 2017, where
of violence endangering state security. fighting and weapon training was
Both suspects considered the German provided. Members also sought to join
refugee policy misguided and worried the army or develop links with serving
about a breakdown of state order. To personnel to give them the opportunity
this end, they were believed to stock of gaining military training and enhance
up on food and ammunition for their their individual capability. Other
weapons legally obtained before. In instances of RWE attack planning in the
their opinion, a crisis situation would UK, including the construction of viable
provide the opportunity to capture IEDs and acquisition of firearms were
and kill representatives of the left- identified and disrupted in 2017.
wing political spectrum. In April 2017 a
RWE groups have been found to foster
serving German soldier was arrested.
international contacts. Belgian RWE
In December 2015, he had posed as a
groups, for example, have developed
Syrian refugee and applied for asylum in Germany. Demonstrations held in
contacts with peer groups in Bulgaria,
in Germany, allegedly with the intention Slovakia against the influx of migrants,
Germany, Poland, Russia, the USA
to assassinate high-ranking German also attended by non-extremist right-
and Austria. The Identitäre Bewegung
politicians and blame it on migrants or wing participants, attracted supporters
Österreich participated in the “Save and
refugees. from Belgium, the Czech Republic,
Rescue” mission as part of the Defend
Germany, Hungary, and Poland.
The UK reported that the majority of Europe action in the Mediterranean
The Portuguese Blood & Honour
RWE activities were private meetings Sea to stop NGO ships from leaving
organisation sends delegations to major
and ticketed music events that can be Italian seaports to rescue migrants
RWE events abroad.
organised legally. This type of activity with Italian, French and German
has also been observed in other EU representatives of the movement. The Additionally, links have been found
Member States. In addition, protest Dutch branch of PEGIDA has contacts between some RWE groups and outlaw
activities included demonstrations with far-right organisations abroad, motorcycle gangs (OMCG). The groups
against temporary accommodation including Hooligans gegen Salafisten concerned are also associated with
centres for asylum seekers and refugees (HoGeSa, Hooligans against Salafists) arms and drug (steroids) trafficking.
TESAT 2018 53

6/
SINGLE-ISSUE
TERRORISM
No attacks classified as single issue terrorism were reported
by EU Member States for 2017. The influence of left-wing
and anarchist extremists in protest movements related to
environmental and animal rights issues and the opposition
to the building of large infrastructure projects appeared to
decline.
Almost all EU Member States reported no or minimal activism
related to animal rights. Nevertheless, the UK experienced
a revival in the animal rights movement that covered a
spectrum of activity from low level protest and direct action
through to more serious forms of criminality. The Animal
Liberation Front (ALF) was involved in over 66 violent actions
including trespass, criminal damage and arson.
 TESAT 2018 54

ANNEX 1

Overview of the failed, foiled and

completed attacks in 2017 per EU
Member State and per affiliation

Member State Jihadist Left-wing Right-wing Separatist Single issue Not specified Total

Belgium 2 - - - - - 2

Finland 1 - - - - - 1

France 11 1 - 42 - - 54

Germany 1 1 - - - - 2

Greece - 8 - - - - 8

Italy 1 7 - - - 6 14

Spain 2 7 - 7 - - 16

Sweden 1 - - - - - 1

United Kingdom 14 - 5 88 - - 107

Total 33 24 5 137 0 6 205

›› The number of foiled, failed and completed attacks ›› Jihadist attackers targeted mostly civilians in public
classified as jihadist terrorism (33) more than doubled, places and law enforcement personnel. However, the
compared to 2016 (13). However, less than one third of vast majority of attacks on soldiers and officers were not
the attacks (10) were completed. Nine jihadist attacks successful.
were claimed by IS. Four attacks were attributed to IS.
›› In 2017 left-wing and anarchist terrorist groups or
›› The UK and France reported the highest number of individuals in the EU carried out 24 attacks. This was a
jihadist attacks in total, together with the highest rate of downward movement after a sharp increase in 2016,
foiled and failed attacks – of 11 attacks in France, only 2 when 27 left-wing attributed attacks occurred in EU
were completed. The UK experienced 5 jihadist attacks Member States (13 attacks in 2015).
and reported 9 disrupted plots.
›› Greece (8), Spain (7) and Italy (7) experienced the highest
›› The category of jihadist terrorism caused the most number of left-wing attacks; also in terms of completed
casualties – 62 people dead (out of 68) and 819 injured acts (60%). Furthermore, 2 attacks that targeted France
(out of 844). and Germany were caused by Greek extremists. Left-wing
›› In terms of weaponry, knives and other bladed weapons attacks resulted in five injuries and no fatalities.
were used most frequently by jihadist attackers, often ›› Private enterprises and government institutions were
combined with the use of vehicles. However, stabbing among the most frequent targets for left-wing attacks. In
attacks also had the highest rate among foiled attacks, Italy, critical infrastructure was targeted in 3 attacks.
followed by attempted bombings.
 ANNEXES 55

›› The majority of the left-wing attacks in 2017 were carried ›› Similarly to 2016, the countries reporting terrorist attacks
out using unsophisticated improvised incendiary/explosive linked to separatism were the UK, France and Spain. The
devices, parcel/letter bombs containing gunpowder and total number of separatist attacks increased by 40 %
a crude ignition mechanism, and bottles with flammable (from 99 in 2016 to 137 in 2017), mainly due to increased
liquids. frequency of attacks reported by France (18 in 2016, 42 in
›› Although the number of right-wing attacks remained low 2017).
(1 in 2016; 5 in 2017), the attack attributed to right-wing
extremism in the UK caused the death of a person in 2017.

ANNEX 2

Arrests in 2017 per EU Member State

and per affiliation
Member State Jihadist Left-wing Separatist Right-wing Not specified Total
France 373 10 13 15 - 411
Spain 78 3 10 - - 91
Germany 52 - 3 3 - 58
Belgium 50 - - - - 50
Austria 46 - 2 - - 48
Netherlands 28 - 2 - 5 35
Italy 26 11 - 2 - 39
Denmark 14 -- -- - 3 17
Greece 3 12 - - - 15
Bulgaria 14 - - - - 14
Ireland 3 - - - 8 11
Finland 9 - - - - 9
Hungary 2 - - - - 2
Poland 2 - - -- - 2
Romania 2 - - - - 2
Czech Republic 1 - - - - 1
Portugal 1 - - - - 1
Sweden 1 - - - - 1
United Kingdom 168 168

Total 705 36 30 20 184 975

 TESAT 2018 56

A total of 97547 persons were arrested on suspicion of being ›› EU Member State authorities arrested 36 people related
involved in terrorism-related activities. Most arrestees (638) to left-wing and anarchist terrorism in 2017 (54 in 2014,
were male, against 123 female48. The most frequent offences 67 in 2015, 31 in 2016), most of them in France, Greece
were 1) membership of a terrorist group and 2) planning and/ and Italy. For the second consecutive year, the number
or preparing a terrorist act. of arrests related to left-wing and anarchist terrorism
›› A total number of 705 persons were arrested on suspicion continued to decrease.
of offences related to jihadist terrorism, similarly to 2016 ›› The number of individuals arrested in relation to right-
(718) and 2015 (687). Most arrests occurred in France wing terrorist offences almost doubled in 2017 (from 11
(373), Spain (78) and Germany (52). in 2015 and 12 in 2016 to 20 in 2017). The vast majority
›› Arrests for jihadist terrorism continued to represent the of them (15) were reported by France. The individuals
arrested with right-wing affiliation were mostly suspected
largest proportion of the total arrests for terrorism-related
of preparing a terrorist act.
offences in the EU.
›› The percentage of women arrested on suspicion of
offences related to jihadist terrorism decreased from 26%
in 2016 to 16%. The majority of arrested women (64%)
held the citizenship of an EU Member State and were born
in the EU. The average age of the suspects in jihadism-
related arrests is 29 years, similar to 2016.

47
184 terrorism-related arrests for 2017 were reported without differentiating by
types of terrorism.
48
The gender of more than 200 arrestees was not reported.
 ANNEXES 57

ANNEX 3
Convictions and penalties (Eurojust)

This annex contains statistical

information on the concluded court Member State 2015 2016 2017
proceedings for terrorist offences
Austria 29 26 18
in 2017, as reported to Eurojust. It
highlights some key figures and, where Belgium 120 136 85
relevant, compares those with the Czech Republic - - 8
figures for previous years.
Denmark 1 8 4
Estonia - 2 2
Finland - 4 2
France 14 66 120
table / Number of individuals in
Germany 17 30 34
concluded court proceedings for
terrorist offences per EU Member Greece 38 3 19
State in 2015, 2016 49 and 201750, as Hungary - 2 -
reported to Eurojust.
Italy - 11 23
Lithuania 1 1 2
49
The data for the previous years corresponds to the
data reported in the respective TE-SAT reports.
Netherlands 18 42 46
50
Eurojust received contributions containing Poland - - 4
information on terrorism-related court decisions
in 2017 from the following Member States: Austria, Portugal - 1 1
Belgium, Czech Republic, Denmark, Estonia, Finland,
France, Germany, Greece, Italy, Lithuania, The Slovenia 1 1 -
Netherlands, Poland, Portugal, Spain, Sweden and
the UK. Spain 166 154 69
If a verdict pronounced in 2017 was appealed and
the appeal was concluded before the end of the year, Sweden 2 4 3
Eurojust reported only on the latest/final verdict.
United Kingdom 106 89 125

Total 513 580 565

In 2017, 17 Member States reported a total of 565 individuals ›› In 2017 there were 66 female defendants in the concluded
who were convicted or acquitted of terrorist offences. Four of court proceedings for terrorist offences.
those individuals appeared twice before the court in 2017 in
the framework of different criminal proceedings51. As a result,
›› The UK reported the highest number of individuals in
concluded court proceedings for terrorist offences (125),
the total number of verdicts pronounced for terrorism-
followed by France (120) and Belgium (85)52.
related offences in 2017 was 569.

52
The UK contribution includes proceedings on offences under anti-terrorism
51
Two individuals in Spain and two others in France were each tried twice in 2017 legislation, as well as other offences assessed to be terrorism related. Similar to
in different proceedings. previous years, the UK data for 2017 refers only to convictions.
 TESAT 2018 58

table / Number of verdicts in 2017 per EU Member State

and per type of terrorism, as reported to Eurojust.

Member State Jihadist Separatist Left-wing Right-wing Not specified Total

Austria 18 - - - - 18
Belgium 81 4 - - - 85
Czech Republic 3 - 5 - - 8
Denmark 4 - - - - 4
Estonia 2 - - - - 2
Finland 2 - - - - 2
France 114 8 - - - 122
Germany 27 3 - 4 - 34
Greece 2 - 17 - - 19
Italy 23 - - - - 23
Lithuania - 1 - - 1 2
Netherlands 37 7 - - 2 46
Poland 4 - - - - 4
Portugal 1 - - - - 1
Spain 31 26 14 - - 71
Sweden 3 - - - - 3
United Kingdom* - - - - 125 125

Total 352 49 36 4 128 569

* The data provided by the United Kingdom was not broken down by type of terrorism and is therefore marked as ‘Not specified’ and not included in the numbers below.

›› In 2017 the vast majority of verdicts in the Member States ›› The majority of the female defendants (42) were tried
(352) concerned jihadist terrorism confirming a trend that for jihadist terrorist offences confirming an upward trend
started in 2015. from the past couple of years.
›› The highest number of verdicts concerning jihadist ›› Left-wing terrorist offences continued to bear the highest
terrorism in 2017 (114) were rendered in France. Austria, average prison sentence (ten years). The average prison
Denmark, Estonia, Finland, Italy, Poland, Portugal and sentence for jihadist terrorist offences remained five
Sweden reported only verdicts for jihadist terrorism in years, and for separatist and right-wing terrorist offences
2017. it was four years.
›› As in previous years, Spanish courts tried the largest
number of individuals charged with separatist terrorism
offences in the EU in 2017.
›› In 2017 courts in the Czech Republic, Greece and Spain
heard left-wing terrorism cases marking an increase
in such cases compared to last year. Germany was the
only Member State that reported verdicts for right-wing
terrorist offences.
 ANNEXES 59

table / Number of verdicts, convictions and acquittals per

EU Member State in 2017, as reported to Eurojust.

Member State Convictions Acquittals Total Acquittals In %

Austria 17 1 18 6%

Belgium 71 14 85 16%

Czech Republic 2 6 8 75%

Denmark 4 - 4 0%

Estonia 2 - 2 0%

Finland - 2 2 100%

France 117 5 122 4%

Germany 32 2 34 6%

Greece 15 4 19 21%

Italy 22 1 23 4%

Lithuania 1 1 2 50%

Netherlands 32 14 46 30%

Poland 3 1 4 25%

Portugal - 1 1 100%

Spain 60 11 71 15%

Sweden 1 2 3 67%

United Kingdom* 125 125

* The UK data for 2017 refers only to convictions and is not included in the calculations of percentages.

›› In 2017, Denmark and Estonia were the two Member ›› All prosecutions for right-wing terrorist offences resulted
States that had only convictions and no acquittals in convictions in 2017. The concluded jihadist terrorism
for terrorist offences. Also Austria, Belgium, France, cases continued to have a very high conviction rate (89%),
Germany, Italy and Spain witnessed a vast majority similar to 2016 (92%) and 2015 (94%). The acquittal rate
of successful prosecutions resulting in convictions for among the verdicts related to separatist and left-wing
terrorist offences. terrorism was higher (29% and 28% respectively)54.
›› The record high conviction rate registered in 2016 across
the EU (89%) continued also in 201753.

53
Eurojust considers it one verdict if an individual is convicted of more than one
terrorist offence within the same proceeding, or convicted of a terrorist offence
and acquitted of another offence. If an individual is acquitted of a terrorist
offence and convicted of another offence, the verdict is included in the overview 54
The data provided by the UK was not broken down by type of terrorism and is
as acquittal of terrorism. therefore not used to calculate the conviction rate.
 TESAT 2018 60

ANNEX 4

Europol activities in counter-terrorism

FIR ST-LINE INVESTIGATIVE terrorism capabilities and at better network. If a major terrorist event
SUPPORT: THE EUROPE AN facilitating information exchange were to occur, the ECTC can contribute
COUNTER TERRORISM among counter terrorism authorities, to a coordinated response. Different
CENTRE to bring cross-border cooperation in teams are available for this purpose,
this field to a new level. often combined with counter terrorism
Recent developments that include the
experts temporarily seconded from
terrorist attacks in Barcelona, and a The ECTC is designed as a central hub
Member States, depending on the
substantial number of failed and foiled in the EU in the fight against terrorism.
nature of the event.
attacks, combined with the existence In fact, it is the single point in the EU
of large numbers of potentially violent where counter terrorism operational To provide direct operational support,
jihadist extremists in the EU, indicate information from law enforcement and to also contribute to a coordinated
that the terrorist threat towards the from all EU Member States, but also response if major terrorist attacks or
EU is high. Despite the setback of IS in from third parties, is brought together threats were to occur, the ECTC applies
Iraq and Syria the severity of the threat for analytical purposes. Specialised a scalable approach where other teams
in the EU may even increase, in relation teams of counter terrorism analysts can be activated depending on the
to returning foreign terrorist fighters and experts work on this information need. For example: Europol Emergency
and their children and wives who to construct the wider EU perspective Response Team (EMRT): This team
may all pose a danger to the security on counter terrorism phenomena comprises Europol experts and
of Member States, but also as this for both operational and strategic analysts with relevant backgrounds
setback could mean that IS will focus goals. To ensure efficient information and experience to support emerging
even more on the West. Addressing exchange, the ECTC benefits from an investigations on a 24/7 basis.
the challenges and making full use excellent network of counter terrorism
of the available Counter Terrorism officers throughout the EU and
opportunities is key to countering beyond. EUROPOL INFORMATION
terrorism effectively. SYSTEM
The principal task of the ECTC is to
To ensure an effective response to the provide operational support upon One of Europol’s core databases is
constantly changing developments Member States’ request for ongoing the Europol Information System (EIS).
in terrorism, the European Counter investigations, such as those following Through this system, Member States
Terrorism Centre (ECTC) was the attacks in Paris in 2015. The ECTC directly share and retrieve information,
established at Europol, under the can assist by cross-checking live including on suspects, means of
authority and direction of the operational data with the already communication, financial accounts and
European Council. It builds further on available data at Europol, quickly firearms, etc. connected with serious
the already existing tools and counter bringing financial leads to light, and and organised crime and terrorism.
terrorism networks of Europol, but by analysing all available investigative
The EIS offers first-line investigative
includes a number of new features. details to assist in compiling a
support, as this reference system
These aim at enhancing the counter structured picture of the terrorist
allows Member States to quickly
 ANNEXES 61

identify whether or not information of data on foreign terrorist fighters the possibility to send information
relevant to them is available in one of within the AP Travellers increased directly to Europol or other counter
the EU Member States or with non-EU substantially in 2017 as a result of the terrorism authorities. Until very
countries or organisations. concerted efforts of Member States recently, countries could only use
with the assistance of Europol. In SIENA to send their contributions on
In cases of a positive hit, more
December 2017 the ECTC opened a terrorism to Europol indirectly, through
information may then be requested
new AP on Core International Crimes the Europol National Unit and Liaison
through the contributor’s Europol
which is related to war crimes, crimes Bureau. The extended infrastructure
National Unit.
against humanity and genocide55. now also allows counter terrorism
By the end of 2017 the EIS held authorities from different countries to
The ECTC uses an integrated approach
information on over 46 000 persons directly exchange information among
meaning that data inserted in one
linked to terrorism (the majority themselves, with optional involvement
system is automatically cross-checked
linked to the foreign terrorist fighter of Europol. Involvement of Europol
against all other databases at Europol
phenomenon), contributed by 37 is recommended to avoid possible
to close intelligence gaps. In addition,
countries. links to other Member States and
regular manual checks are carried out.
third partners to remain undiscovered
as well as potential links between
FURTHER IN-DEP TH organised crime and terrorism.
INFORMATION E XCHANGE:
ANALYSIS: THE COUNTER
SIENA In practice, this means that every
TERRORISM ANALYSIS
counter terrorism officer in the
WORK FILE AND THE In an organisation like Europol, with its
Member States can check the EIS from
ANALYSIS PROJECTS main focus on information exchange,
their own computers, and directly
secure and swift transmission of data
For a more in-depth analysis, send information to, or receive
is essential, especially when it comes
the ECTC works with the counter information from, the APs. The
to counter terrorism data. Information
terrorism analysis work file (AWF). options described for sharing
from a Member State must reach
This file provides the framework for information are at the discretion of
Europol and vice versa, without the
operational analytical support with the the Member State. The dedicated
risk of interception. To facilitate this
Member States and non-EU partners. SIENA counter terrorism environment
information exchange, the Secure
As a result, the number of data is already operational with 95% of all
Information Exchange Network
categories that are permitted to be Member States and 46 counter
Application (SIENA) was designed
stored and processed is broader than terrorism authorities are now
and has been in use for a number of
in the EIS (within the counter terrorism connected to the system in total.
years by Member States, Europol and
AWF, there is focused analysis on
third parties that have operational
certain counter terrorism phenomena).
cooperation agreements with Europol.
Existing and emerging terrorist INTERNE T REFERR AL UNIT
phenomena are handled within A dedicated area has been created
The Internet Referral Unit (IRU) has
separate, so called Analysis Projects within SIENA especially for counter
expanded its activities to counter
(AP). In these highly secure terrorism authorities. This means that
online radicalisation and recruitment
environments the information is counter terrorism authorities now have
by terrorists, by providing a core
collected, cross-matched and analysed.
internet investigation support
This is done by dedicated teams of 55
The AP on Core International Crimes works
capability and increasing partnerships
counter terrorism analysts and counter together closely with the Genocide Network,
also known as the European Union Network for (with the support of the European
terrorism experts. Within counter Investigation and Prosecution of Genocide, Crimes
Commission) towards online service
terrorism a major AP is the topic of Against Humanity and War Crimes, hosted by
Eurojust. companies (to promote self-regulation
“travellers”, which deals with foreign
activities).
terrorist fighters. The amount
 TESAT 2018 62

By the end of 2017 it has assessed in groups continuous to be facilitated TE AM OF ROTATING GUEST
total 51 805 pieces of content, which and actively supported by Europol. OFFICER S AT IMMIGR ATION
triggered 49 969 decisions for referral, This network is one of the main HOT SPOT S
with a success rate of removal of achievements stemming from the EU
The migration flows caused by the
84.8% since it was setup in July 2015. Action Plan on Enhancing the Security
situation in conflict zones, mainly in
of Explosives.
the Middle East and North Africa,
A new platform for the European declined over 2017 but significant
TERRORISM FINANCE
Explosives Ordnance Units Network on numbers of migrants and refugees
TR ACKING PROGR AMME
the Europol Platform of Experts (EPE) continued to attempt to enter the
The ECTC uses a number of tools to has become a main communication EU. The main entry points were the
help detect the financing of terrorism, channel enabling already more than sea areas in Greece and Italy. Europol
one of the best known being the 300 European bomb technicians and provided support to the two EU
Terrorist Finance Tracking Programme CBRN experts to swiftly, efficiently Member States by deploying short-
(TFTP). The TFTP has been established and directly share knowledge, best term Seconded National Experts
following an EU-US agreement practices and technical information on (Guest Officers) at hotspots on the
adopted by the European Parliament recent cases and incidents. eastern Aegean islands and in southern
in 2010. Italy. Up to 50 of these Guest Officers
The bomb-making process, potential
Relevant information obtained recipes for the harmful use of are deployed on rotation in order to
through the TFTP is provided by the explosives precursors, as well as strengthen the security checks on
US Department of the Treasury to potential new threats using CBRN the inward migration flow, in order
Europol, competent authorities of EU materials, are monitored daily and to identify suspected terrorists and
Member States and Eurojust either cross-checked by Europol’s ECTC criminals, thus providing additional
spontaneously by the US, or upon experts. Information is shared with security checks.
request, pursuant to Article 9 or Article experts and relevant units within There is no concrete evidence that
10 of the Agreement respectively, with the EU Member States and non-EU terrorist travellers systematically
the aim of combatting terrorism and countries. use those flows of refugees to enter
terrorist financing. Europe unnoticed, but it is indisputable
Europol assessments, strategic reports
TFTP has proven to be a valuable tool and expertise are also timely in that some terrorists have entered the
in terrorism-related investigations, detecting security gaps and feeding EU posing as a refugee56, as was seen
it enhances the ability to map out the EU Policy Cycle through effective in the Paris attacks of 13 November
terrorist networks, often by filling cooperation with the European 2015.
in missing links in an investigative Commission. To counter this threat, Europol has
chain. It is used to track terrorist recently approved the recruitment
In October 2017 the European
money flows, allowing authorities to of up to 200 counter terrorist and
Commission issued a new Action Plan
identify and locate operatives and other investigators for deployment to
to enhance preparedness against CBRN
their financiers, and assists in broader migration hotspots in Greece and Italy.
security risks, enhancing Europol’s role
efforts to uncover terrorist cells.
as a key player in CBRN security.
The ECTC – Strategy CBRN and EUROPE AN C YBERCRIME
CHEMIC AL, BIOLOGIC AL, Explosives Team also assists EU CENTRE
R ADIOLOGIC AL AND Member States operationally, both
NUCLE AR AND E XPLOSIVES Launched in January 2013 the
with counter terrorism and serious
European Cybercrime Centre (EC3)
and organised crime investigations.
Europol is a key partner in the delivers high-level technical, analytical
This includes having Europol staff
Chemical, Biological, Radiological and and digital forensic expertise to
appointed as court experts.
Nuclear (CBRN) and Explosives field, support investigations by EU Member
working together with the national States and non-EU countries in cases of
competent authorities (from EU convergence of cyber and terrorism.
THE COUNTER TERRORISM
Member States and non-EU countries),
JOINT LIAISON TE AM
and liaising, assisting and jointly
promoting activities and training with The EU Member States have 56
Europol, Changes in modus operandi of Islamic
the European Commission and other established the Counter Terrorism Joint State (IS) revisited, 2016.
relevant international organisations in Liaison Team (CT JLT) to work more
these areas of expertise. closely on cross-border investigations,
consisting of counter terrorism experts
The European Explosive Ordnance
and analysts from the Member States
Disposal (EOD) Units Network, with
and Europol counter terrorism experts
its EOD and CBRN expert working
and analysts.
 ANNEXES 63

ANNEX 5

Methodology

The EU Terrorism Situation and Trend representatives from France and Spain, terrorist offences are intentional acts
Report (TE-SAT) was established in the EU Intelligence Analysis Centre which, given their nature or context,
the aftermath of the 11 September (INTCEN), Eurojust, the office of the EU may seriously damage a country
2001 attacks in the USA, as a reporting Counter Terrorism Coordinator, and or an international organisation
mechanism from the Terrorism Europol staff. when committed with the aim of:
Working Party (TWP) of the Council of seriously intimidating a population,
For the preparation of this report,
the EU to the European Parliament. In or unduly compelling a government
Europol collected qualitative and
2006 Europol replaced the TWP. The or international organisation to
quantitative data on terrorist offences
methodology for producing this annual perform or abstain from performing
in the EU, and data on arrests of
report was developed by Europol and an act, or seriously destabilising
people suspected of involvement in
endorsed by the Justice and Home or destroying the fundamental
those offences, provided or confirmed
Affairs (JHA) Council on 1 and 2 June political, constitutional, economic or
by Member States. Similar data were
2006. social structures of a country or an
collected, when available, of offences
international organisation.
The content of the TE-SAT is based on in which EU interests were affected
information supplied by EU Member outside of the EU. As in previous years, In cases in which the wording of
States, some non-EU countries and Eurojust collected data on the number Article 1 of the Framework Decision
the partner organisation Eurojust, as of court proceedings in each Member leaves room for interpretation, the
well as information gained from open State, the number of individuals in TE-SAT 2018 respects Member States’
sources. concluded court proceedings, the definitions of terrorist offences on
number of convictions and acquittals, their territories. At times, it can be
In accordance with ENFOPOL 65
the type of terrorism, the gender of difficult to assess whether a criminal
(8196/2/06), the TE-SAT is produced
defendants, the penalties imposed, event should be regarded as an act of
annually to provide an overview of
as well as the type of verdicts – final terrorism or as an act of extremism.
the terrorism phenomenon in the EU,
or pending judicial remedy. Eurojust Contrary to terrorism, not all forms
from a law enforcement perspective.
contributed data on convictions of extremism sanction the use of
It seeks to record basic facts and
and penalties for terrorist offences violence. Nevertheless, extremism
assemble figures regarding terrorist
in EU Member States and relevant as a phenomenon may be related
attacks and arrests in the EU. The
amendments in national legislation on to terrorism and exhibit similar
report also aims to present trends and
terrorism. behavioural patterns. Therefore,
new developments identified from the
the TE-SAT 2018 mentions criminal
information available to Europol. Included as arrests are those judicial
acts with the potential to seriously
arrests warranted by a prosecutor
The TE-SAT is a situation report which destabilise or destroy the fundamental
or investigating judge, whereby a
describes and analyses the outward political, constitutional, economic
person is detained for questioning
manifestations of terrorism, i.e. or social structures of a country,
on suspicion of committing a criminal
terrorist attacks and activities. It does when they were reported by the
offence for which detention is
not seek to analyse the root causes Member States as extremism, in an
permitted by national law. The fact
of terrorism, neither does it attempt effort to provide a clearer picture of
that the person may subsequently be
to assess the impact or effectiveness the phenomenon and its relation to
provisionally released or placed under
of counter-terrorism policies and law terrorism. However, these cases were
house arrest does not impact the
enforcement measures taken, although not considered in the statistical data
calculation of the number of arrests.
it can serve to illustrate some of these. of this report, which exclusively reflect
The definition of the term terrorist incidents reported as terrorism by EU
This edition of the TE-SAT has been
offences is indicated in Article 1 of Member States.
produced by Europol in consultation
the Council Framework Decision
with the 2018 TE-SAT Advisory Board, The EU Council Decision of 20
of 13 June 2002 on combatting
composed of representatives of the September 2005 (2005/671/ JHA),
terrorism (2002/475/JHA), which all
past, present, and future Presidencies on the exchange of information and
EU Member States have implemented
of the Council of the EU, i.e. Estonia, cooperation concerning terrorist
in their national legislation. This
Bulgaria and Austria (the “Troika”), offences, obliges Member States
Framework Decision specifies that
along with permanent members, to collect all relevant information
 TESAT 2018 64

concerning and resulting from criminal

investigations conducted by their law
Types of terrorism right-wing groups. Variants of right-
wing extremist groups are the neo-
enforcement authorities with respect Nazi, neo-fascist and ultra-nationalist
to terrorist offences and sets out the formations.
The TE-SAT categorises terrorist
conditions under which this information organisations by their source of
should be sent to Europol. Europol motivation. However, many groups
processed the data and the results were have a mixture of motivating LEF T-WING AND ANARCHIST
cross-checked with the Member States. ideologies, although usually one TERRORISM
In cases of divergences or gaps, the ideology or motivation dominates. It is Left-wing terrorist groups seek to
results were corrected, complemented worth noting that a categorisation of replace the entire political, social
and then validated by the Member individuals and terrorist groups based and economic system of a state by
States. on the ideology or goals they espouse
introducing a communist or socialist
should not be confused with motivating
Eurojust also collected data on structure and a classless society. Their
factors and the paths to radicalisation.
prosecutions and convictions for ideology is often Marxist-Leninist. A
The underlying causes that lead people
terrorist offences on the basis of to radicalisation and terrorism must be sub-category of left-wing extremism
the aforementioned EU Council sought in the surroundings (structural is anarchist terrorism which promotes
Decision. The data used in this report factors) and personal interpretations a revolutionary, anti-capitalist and
concerns relevant court decisions (psychological factors) of the individual. anti-authoritarian agenda. Examples
and legislation amendments in 2017. The choice of categories used in the TE- of left-wing terrorist groups are the
Due to the specifics of reporting, SAT reflects the current situation in the Italian Brigate Rosse (Red Brigades) and
Member States submit information EU, as reported by Member States. The the Greek Revolutionary Organisation
on both final and non-final decisions. categories are not necessarily mutually 17 November.
Therefore, reference is also made exclusive.
to those decisions pending judicial
remedy. Verdicts from 2017 on which E THNO-NATIONALISM AND
an appeal is pending are included in the JIHADIST SEPAR ATISM
reporting as pending judicial remedy. Jihadist terrorist acts are those that Ethno-nationalist and separatist
In cases where a verdict pronounced are committed out of a mind-set that terrorist groups are motivated by
in 2017 was appealed, and the appeal rejects democracy on religious grounds nationalism, ethnicity and/or religion.
was concluded before the end of the and uses the historical comparison Separatist groups seek to carve out
year, Eurojust counted the proceeding with the crusades of the Middle Ages a state for themselves from a larger
as one. Eurojust’s contribution was to describe current situations, in which country, or annex a territory from one
verified with the Member States that it is believed that Sunni Islam is facing country to that of another. Left- or
provided relevant data. a crusader alliance composed of Shi’is, right-wing ideological elements are not
Christians and Jews. uncommon in these types of groups.
The Irish Republican Army (IRA), the
Basque ETA, and the Kurdish PKK
RIGHT-WING organisations fall into this category.
Right-wing terrorist organisations
seek to change the entire political,
SINGLE-ISSUE
social and economic system on an
extremist right-wing model. A core Single-issue extremist groups aim to
concept in right-wing extremism is change a specific policy or practice,
supremacism, or the idea that a certain as opposed to replacing the whole
group of people sharing a common political, social, and economic system
element (nation, race, culture, etc.) in a society. The groups within this
is superior to all other people. Seeing category are usually concerned
themselves in a supreme position, with animal rights, environmental
protection, anti-abortion campaigns,
the particular group considers it is
etc. Examples of groups in this category
their natural right to rule over the rest
are the Earth Liberation Front (ELF), and
of the population. Racist behaviour,
the Animal Liberation Front (ALF).
authoritarianism, xenophobia and
hostility to immigration are commonly
found attitudes in right-wing
extremists. Right-wing terrorism refers
to the use of terrorist violence by
 ANNEXES 65

ANNEX 6
Acronyms
AN ammonium nitrate IS so-called Islamic State
AMISOM African Union Mission in Somalia ISIL Islamic State in Iraq and the Levant
al-Dawla al-Islamiyya fi al-Iraq wal-Sham
ALF Animal Liberation Front
JHA Justice and Home Affairs
ANP Arm Na Poblachta
JNIM Jama’at Nusrat al-Islam wal-Muslimin
AQAP al-Qaeda in the Arabian Peninsula
Tanzim qa’idat al-jihad fi jazirat al-‘arab LNA Libyan National Army
AQIM al-Qaeda in the Islamic Maghreb LTTE Liberation Tigers of Tamil Eelam
Tanzim al-qa’ida bi-bilad al-Maghrib al-Islami
MINUSMA Multidimensional Integrated Stabilisation
ASG Abu Sayyaf Group Mission in Mali
CBRN chemical, biological, radiological and nuclear NGO non-governmental organisation
CIRA Continuity Irish Republican Army NPO non-profit organisation
DHKP/C Revolutionary People’s Liberation Party/Front OMCG outlaw motorcycle gang
Devrimci Halk Kurtuluş Partisi/Cephesi
ONH Warriors of Ireland / Óglaigh ná h’Éireann
DR Dissident Republican
PBIED person-borne improvised explosive device
EFP explosively formed projectile
PEGIDA Patriotische Europäer gegen die Islamisierung
EGC Electronic Ghosts of the Caliphate des Abendlandes
Patriotic Europeans against the Islamisation
ELF Earth Liberation Front of the Occident
ERW explosive remnants of war PKK Partiya Karkerên Kurdistan
ETA Basque Fatherland and Liberty Kurdistan Workers’ Party
Euskadi ta Askatasuna RG Resistência Galega / Galician Resistance
EU European Union RWE right-wing extremists
FAI/FRI Federazione Anarchica Informale/Fronte SDF Syrian Democratic Forces
Rivoluzionario Internazionale
Informal Anarchist Federation/International TAP Trans Adriatic Pipeline
Revolutionary Front
TATP triacetone triperoxide
FTF foreign terrorist fighter
TE-SAT European Union Terrorism Situation and
GNA Government of National Accord Trend Report
GNS Government of National Salvation TWP Terrorism Working Party
HME home-made explosive UAE United Arab Emirates
HoGeSa Hooligans gegen Salafisten UAV unmanned aerial vehicle
Hooligans against Salafists
UGC user generated content
HPG People’s Defence Force / Hêzên Parastina Gel
UK United Kingdom
HQN Haqqani Network
UN United Nations
HSM Mujahid youth movement / Harakat al-
Shabab al-Mujahidin US United States (of America)

IBD Identitäre Bewegung Deutschland UXO unexploded ordnance

Identitarian Movement Germany VBIED vehicle-borne improvised explosive device
IED improvised explosive device VOIED victim-operated improvised explosive device
IDP internally displaced person WFP World Food Programme
IID improvised incendiary device YPG Yekineyen Parastina Gel
INTCEN EU Intelligence Analysis Centre People’s Protection Units
 TESAT 2018 66

ANNEX 7
Amendments in national legislation
on terrorism in 2017

AUSTRIA November 2017. Furthermore, Law search, seizure and confiscation of

No.2017-1510 of 30 October 2017 the proceeds from crime and on the
An amendment of Section 278c of the
reinforced the internal security and financing of terrorism when certain
Austrian Criminal Code came into force
the fight against terrorism. It came into provisions of the Greek Criminal Code
on 1 September 2017. This provision
force on 31 October 2017, just before are applied.
lists the criminal offences which given
the end of the state of emergency. The
the respective intention can constitute
law strengthened the administrative
terrorist offences. The amendment ITALY
police measures (establishment of
also includes also bodily harm, not only
secure perimeters, possibility of
aggravated bodily harm as hitherto. Legislative Decree of 25 May 2017, n.
closing places of worship), created new
90 was adopted in Italy implementing
administrative control and surveillance
Directive (EU) 2015/849 Directive (EU)
measures and an administrative
FR ANCE 2015/849 of the European Parliament
regime for home visits upon
and of the Council of 20 May 2015
Law No.2017-258 of 28 February authorisation and under control of the
on the prevention of the use of the
2017 on public security introduced Judge of Liberties and Detention of the
financial system for the purposes
several amendments in terrorism- Court of Paris (former administrative
of money laundering or terrorist
related legal provisions. It restored house searches). The law introduced
financing, amending Regulation
the offence of regular consultation of also a new terrorist offence making
(EU) No 648/2012 of the European
terrorist websites (again censured by it a crime for a person with authority
Parliament and of the Council, and
decision of the Constitutional Council over a minor to involve the latter in a
repealing Directive 2005/60/EC of
of 15 December 2017), modified the terrorist criminal conspiracy.
the European Parliament and of the
composition of the Special Assize
Council and Commission Directive
Court in charge of terrorism cases
2006/70/EC. The Decree implemented
(number of assessors reduced from GREECE
also Regulation (EU) 2015/847 of
six to four at first instance and from
Article 6 paragraph 2 of the Greek Law the European Parliament and of the
eight to six on appeal) and established
4478/2017 (A’-91/23-6-2017) amended Council of 20 May 2015 on information
a possibility for the Public Prosecutor
paragraph 6 of Article 187A Terrorist accompanying transfers of funds
of the Republic of Paris (or for the
Acts of the Greek Criminal Code in and repealing Regulation (EC) No
investigative Judges of the Counter-
conformity with Directive 2014/42/EU 1781/2006. Among others, the Decree
Terrorism Section) to communicate
of the European Parliament and of the established specific rules concerning
elements from terrorist judicial
Council of 3 April 2014 on the freezing the cooperation between the National
proceedings to intelligence services
and confiscation of instrumentalities Antimafia and Counter-Terrorism
(Article 706-25-2 of the Code of
and proceeds of crime in the Directorate (Direzione nazionale
Criminal Procedure).
European Union. It provides for the antimafia e antiterrorism, DNA) and
Law No.2017-1154 of 11 July 2017 consideration of irrevocable conviction the Italian FIU in order to track any
extended the application of Law No. decisions, issued by courts of other suspicious transactions, including
55-385 of 3 April 1955 on the state states – members of the Council of those made with the purpose to fund
of emergency, which ended on 1 Europe Convention on laundering, terrorist activities.
 ANNEXES 67

LITHUANIA In June 2017 a new version of the Law adapts the Portuguese legislation to
on Money Laundering and Terrorist Council Decisions 2008/615/JHA and
Amendments of Article 250 of the
Financing Prevention was adopted to 2008/616/JHA regarding the sharing
Criminal Code of the Republic of
implement Directive (EU) 2015/849 of cross-border information about
Lithuania came into force on 4 May
of the European Parliament and the vehicles data bases.
2017. They amend the definition of
Council. The law foresees significant
financing and support of terrorist Furthermore, the Portuguese Criminal
changes in the regulation of prevention
activities (Article 250-4) to include also Code and the Industrial Property Code
of money laundering and terrorist
the preparatory stage and provision were amended by Law 83/2017 in
financing.
of support to one or several terrorists, relation to money laundering, terrorist
as well as to a group having the aim of financing and judicial cooperation on
committing terrorist crimes, including terrorism and cross-border crime,
MALTA
provision of support to persons or transposing also several EU Directives
groups which recruit, train terrorists Act No. XXVIII of 2017 was and Council Decision. Several other
or otherwise participate in terrorist promulgated in order to amend the acts were also adopted defining
activities. The existing Article 250-5 Prevention of Money Laundering terrorist cases as priority investigations
was extended to include provision Act, Cap.373, whereby Funding of (Law 96/2017), referring to approved
of special knowledge necessary for Terrorism is also covered. Moreover, UN and the EU restrictive measures
preparation for a terrorist crime, and the Asset Recovery Bureau Regulations (Law 96/2017), defining the new
the persons who with the view to (particular articles) came into force by legal regime and special procedures
use the acquired knowledge or skills virtue of Legal Notice 254 of 2017. on the intelligence officers’ access
for terrorist purposes systematically to telecommunications and internet
collect special knowledge or obtain data in terrorism cases (Law 96/2017),
special skills which are necessary PORTUGAL and regulating the granting of visas
for the preparation for, commission Between May and August 2017 to foreigners entering the national
of a terrorist crime or participation several laws entered into force in territory and forbidding those visas
in commission of a terrorist crime. Portugal. Law 30/2017 transposed when terrorist investigations or cases
Furthermore, a new offence was Directive 2014/42/EU of the European related to the applicant are pending
introduced by Article 250-6 (‘Travel for Parliament and of the Council of (Law 102/2017).
Terrorist Purposes’) to be applied to 3 April 2014 on the freezing and
those who go to another State seeking confiscation of instrumentalities and
to prepare for or commit a terrorist proceeds of crime in the European
crime, participate in the commission Union. Law 71/2017 determines
of a terrorist crime, participate in the restrictions concerning applications for
activities of a group having the aim of Portuguese nationality in cases when
committing terrorist crimes, or seeking the national security and defence are
to train terrorists or train for terrorist endangered as a result of a terrorist
purposes. act. Another act - Law 46/2017 -
 TESAT 2018 68

UNITED KINGDOM ›› the Act ensured that UN financial sanctions (including

those for the Al Qaeda and Taliban regimes) come into
On 27 April 2017, the Criminal Finances Act received Royal
effect in the United Kingdom immediately for a period
Assent. Among other measures, the Act provided law
of up to 30 days, while the EU adopts a regulation
enforcement agencies with further powers to tackle terrorist
to implement them, thereby avoiding delay and the
financing. It amended existing legislation to:
possibility of asset flight. The Act also gave powers for HM
›› introduce a disclosure order regime within the Terrorism Treasury to be able to impose a civil monetary penalty
Act (TACT) 2000 whereby a court may permit a constable for breaches of UN, EU or United Kingdom financial
or counter-terrorism financial investigator to answer sanctions; extended the maximum sentence for EU
questions, or produce information or documents, that financial sanctions from two to seven years, in line with
they consider likely to be of substantial value to the the domestic sanctions regime; and permitted deferred
terrorist financing investigation; prosecution agreements and serious crime prevention
›› permit greater information sharing within the regulated orders to be used in connection with breaches of financial
sanctions;
sector where several conditions are satisfied, including
that disclosing the information may assist in determining ›› the Act introduced a pre-charge bail limit of 28 days;
whether a person is involved in a terrorist financing
offence, or that funds are terrorist financing funds, and
›› Schedule 8 of TACT 2000 was amended by Section 71
of the Act to enable DNA profiles and fingerprints to
allow the court to grant an order to require the provision
be retained indefinitely where a person has a previous
of further information arising from such a disclosure;
conviction outside the UK (indefinite retention was
›› expand the definition of terrorist cash within the Anti- already provided for where the individual has a conviction
Terrorism Crime and Security Act 2001 (ATCSA) to also within the UK);
include gaming vouchers, fixed-value casino tokens and
betting receipts;
›› Section 68 of the 2017 Act creates a new offence of
breaching travel-related conditions of pre-charge bail
›› allow for the seizure and forfeiture of ‘listed assets’, (defined as ‘travel restriction conditions’) for those
including precious stones, watches and so forth; arrested on suspicion of committing a terrorist offence.
›› permit the forfeiture of terrorist cash by a suitably The Criminal Justice Act 1988 (Reviews of Sentencing) Order
authorised officer, without the need to go through the 2017 added 19 terrorism-related offences to schedule 1 of
courts; the Review of Sentencing 2006 Order. Part IV of the Order
›› allow the freezing, and forfeiting of the contents of, allows the Attorney General, with leave from the Court of
Appeal, to refer certain cases to the Court of Appeal where
terrorist money held in bank accounts;
he considers that a sentence imposed in the Crown Court
›› allow many terrorist financing powers to be exercised was unduly lenient, so that the sentence can be reviewed
not just by a police constable, but by counter terrorist (The Unduly Lenient Sentencing (ULS) scheme). A range of
financial investigators as well; terrorism-related offences were added to the list of specified
›› increase from two to seven years the maximum sentence offences for the ULS scheme in 2017.
for failure to comply with a direction not to enter into The Prison (Amendment) Rules 2017 allow for a separation
or continue to participate in transactions or business regime for extremist prisoners. It includes separation
relationships with designated individuals which was centres, to which the Secretary of State may direct that TACT
originally set out under the Counter-Terrorism Act 2008. prisoners be allocated for any of the following reasons:
Furthermore, the Money Laundering, Terrorist Financing ›› in the interests of national security;
and Transfer of Funds (information on the payer) Regulations
2017 implement the Fourth Money Laundering Directive
›› to prevent the commission, preparation or instigation
of an act of terrorism, a terrorism offence, or an offence
(2015/849/EU). The UK Regulations came into force
with a terrorist connection, whether in prison or
alongside the Funds Transfer Regulation (2015/847/EU) and
otherwise;
bring regulation of industries at risk of facilitating money
laundering and terrorist financing in line with international ›› to prevent the dissemination of views of beliefs that
standards. The Regulations also prevent categories encourage or induce others to commit any such act of
of individuals with criminal convictions from holding offence, whether in a prison or otherwise, or to protect or
management functions in or being beneficial owners of safeguard others from such views or beliefs, or;
regulated entities.
›› to prevent any political, religious, racial or other views or
The Policing and Crime Act 2017 introduced a number of beliefs being used to undermine good order and discipline
powers in relation to financial sanctions, including terrorism in a prison.
sanctions, and in relation to police bail:
PHOTO CREDITS

Europol: pages 4
and 60.

Shutterstock: pages
12, 14, 15, 17, 19,
21, 28, 30, 32, 44,
46, 52 and 67.
 ISBN 978-92-95200-91-3
DOI 10.2813/00041
QL-AJ-18-001-EN-N

Eisenhowerlaan 73, 2517 KK

The Hague, the Netherlands

www.europol.europa.eu