Terror plots in Germany, France were ‘remote-controlled’ by Islamic State operatives

On July 18, an Afghan refugee named Riaz Khan (also known as “Muhammad Riyad”) assaulted passengers on a train in Würzburg, Germany with an ax and a knife. Nearly one week later, on July 24, a Syrian refugee identified as Mohammad Daleel blew himself up outside of a music festival in the German city of Ansbach. Approximately 20 people were wounded in the incidents.

Amaq News Agency, a propaganda arm of the Islamic State, quickly issued claims of responsibility for the operations. Amaq also released videos from Khan and Daleel in which they swore allegiance to Abu Bakr al Baghdadi.

As The Long War Journal reported at the time, the fact that Amaq was able to release the videos so soon after the attacks suggested that both were in touch with the Islamic State’s media operatives, or at least knew someone in the Islamic State’s network who could send the clips to Amaq. Therefore, they each had at least one tie to the Islamic State, even if it was only digital. [See LWJ reports: Teenager who terrorized German train appears in Islamic State video and Attacks in France and Germany claimed by Islamic State propaganda arm.]

German authorities discovered that there was much more to the story. Islamic State operatives provided specific direction to both Khan and Daleel via messaging applications. The jihadists did the same for a teenage girl who stabbed a police officer at the train station in Hannover, Germany in February. After the bombing in Ansbach, Bavaria’s Interior Minister, Joachim Herrmann, said that Daleel had been involved in an “intensive chat” that ended “immediately before the attack.”

“There was apparently an immediate contact with someone who had a significant influence on this attack,” Herrmann said, according to the Associated Press.

The evidence that has been uncovered in Germany and elsewhere in Europe shows that the Islamic State’s external operations arm has devised a new method for orchestrating terror. The group’s assistance goes far beyond mere inspiration in at least some cases.

In both Würzburg and Ansbach, the Islamic State’s external operations network guided the terrorists through their day of terror. The electronic fingerprints uncovered in these cases recently prompted Germany’s Interior Minister, Thomas de Maiziere, to say that the jihadists were guided by “remote control.” French prosecutor Francois Molins has used the same phrase, “remote-controlled,” to describe a group of women who were plotting terrorism in Paris.

Transcripts published by German press

On Sept. 14, Süddeutsche Zeitung, a newspaper based in Munich, published transcripts of the conversations Khan and Daleel had with their Islamic State handlers. The Long War Journal has obtained a translation of Süddeutsche Zeitung’s report. (Another translation has been published at Worldcrunch, a website that aggregates and translates news stories from around the globe.)

The Islamic State operatives tasked with directing Khan and Daleel are not identified and it is not clear if the same man chatted with both of them.

The details revealed in the transcripts are chilling. Khan and Daleel may have acted alone, in the sense that no other terrorist was physically with them when they struck. But they were certainly not “lone wolves” in any meaningful sense.

During a digital chat with Khan, the Islamic State’s man asked: “What kind of weapons do you intend to use to kill people?”

“My knife and ax are ready for use,” Khan replied.

“Brother, would it not be better to do it with a car?” the Islamic State plotter asked, before suggesting that Khan learn how to operate an automobile. “The damage would be much greater,” he told Khan.

But Khan was impatient, saying he “cannot drive” and “learning takes time.”

“I want to enter paradise tonight,” Khan explained.

16-07-19 Muhammad Riyad

As Khan inched closer to assaulting the train’s passengers, he had an “important thing” to tell the jihadist on the other end of the conversation. “Brother, I am sending you my video,” Khan typed. “I will carry out an attack with an ax in Germany today.” (A screen shot from the video, which was released by Amaq, can be seen on the right.)

The handler was pleased, but insisted that Khan should use his ax, not a knife. “If you’re going to commit the attack, Allah willing, the Islamic State will claim responsibility for it.”

Khan said he was sending his video. The man on the other end told Khan to make sure he had created a backup.

“Pray that I become a martyr,” Khan wrote. “I am now waiting for the train.” Not long after, according to the transcript published by Süddeutsche Zeitung, Khan added: “I am starting now.”

“Now you will attain paradise,” Khan’s guide responded.

Süddeutsche Zeitung has also published a partial transcript of Mohammad Daleel’s chats with his Islamic State instructor as he scoped out the prospective target, as well as their discussions on the day of the bombing. The Islamic State’s Naba magazine subsequently identified Daleel as a veteran of the jihad in Syria, meaning he likely developed a rolodex of contacts.

“This area will be full of people,” Daleel wrote as he sent a photo of the venue where the music festival was to be held. “Kill them all in a wide open space,” the Islamic State’s man replied, “where they will lie on the ground.”

Screen Shot 2016-07-26 at 12.57.52 PM

The unnamed operative told Daleel (seen on the right) to look for an appropriate place to put his bomb and then try to “disappear into the crowd.” The jihadist egged Daleel on, saying the asylum-seeker should “break through police cordons,” run away and “do it.”

“Pray for me,” Daleel wrote at one point. “You do not know what is happening with me right now,” Daleel typed, in an apparent moment of doubt.

“Forget the festival and go over to the restaurant,” the handler responded. “Hey man, what is going on with you? Even if just two people were killed, I would do it. Trust in Allah and walk straight up to the restaurant.”

It appears that Daleel may not have intended to detonate his explosives at that time. Der Spiegel previously reported that he intended to remotely detonate his backpack bomb, but it went off accidentally. Daleel may have also been planning additional attacks.

The German press has reported on a third instance of “remote-controlled” terror that took place on Feb. 26 at the train station in Hannover. A German-Moroccan girl in her teens, identified as “Safia S.,” assaulted a police officer with a knife. Authorities found that Safia had been in contact via a messaging app with an instructor known only as “Leyla,” who coached Safia as she planned the stabbing.

Part of the Islamic State’s external operations strategy

It is not a coincidence that both Khan and Daleel were “remote-controlled.” This is a deliberate part of the Islamic State external operation arm’s strategy, which aims to both direct and inspire smaller-scale attacks in Western nations. These operations are in addition to larger plots, such as the assault on Paris in November 2015.

Writing in Foreign Affairs, Bridget Moreng provided a comprehensive look at the role played by Rachid Kassim, who is one of the Islamic State’s “most dangerous virtual planners.” Kassim has been tied to a web of terror plots. For instance, as Moreng explains, investigators have found ties between Kassim and the two young jihadists who murdered a priest in Saint-Etienne-du-Rouvray, Normandy in July.

Screen Shot 2016-07-27 at 2.16.06 PM

As The Long War Journal reported at the time, Amaq News released a video from the two terrorists in which they swore allegiance to Baghdadi. A screen shot can be seen on the right. The video was produced in the same format and style as Amaq’s releases after the attacks in Würzburg and Ansbach. [See LWJ report, Terrorists in Normandy swore allegiance to Baghdadi before attacking church.]

As Daveed Gartenstein-Ross and Nathaniel Barr explained in a piece at War on the Rocks, the Islamic State’s virtual planning network has digital tentacles around the globe.

This network extends into the US. Earlier this year, Munir Abdulkader pleaded guilty to terrorism charges after he admitted to communicating with Junaid Hussain, an Islamic State operative based in Syria who played a key role in the group’s digital strategy. According to the Department of Justice, Hussain “directed and encouraged Abdulkader,” who lived in Ohio, “to plan and execute a violent attack within the United States.” It is likely that Hussain was also in contact with the two gunmen who opened fire at an event dedicated to drawing images of the Prophet Mohammed in Garland, Texas on May 3, 2015. Hussain was killed in an American airstrike in Raqqa on Aug. 24, 2015.

[For more on Hussain, see LWJ reports: Ohio man conspired with Islamic State recruiter, Justice Department says and Prime Minister says 2 British nationals killed in airstrikes were plotting attacks.]

There is a debate in counterterrorism circles over how much credibility should be given to the Islamic State’s propaganda machine, including the Amaq News Agency. Each claim should be subjected to scrutiny. Some statements will be false and others exaggerated. But as the attacks in Würzburg, Ansbach and Saint-Etienne-du-Rouvray show, Amaq’s claims cannot be dismissed out of hand. There is often at least some truth to Amaq’s claims. And, on multiple occasions, the terrorists acting in the Islamic State’s name have been anything but “lone wolves.” Instead, a virtual network guides them along the way.


*There have been conflicting reports concerning Riaz Khan’s country of origin. But most accounts agree that he was originally from Afghanistan.

**Daveed Gartenstein-Ross, Nathaniel Barr, and Bridget Moreng are all colleagues of the author.

Thomas Joscelyn is a Senior Fellow at the Foundation for Defense of Democracies and the Senior Editor for FDD's Long War Journal.

Tags: , , , , , , , , , , , , , ,



Islamic state



Al shabaab

Boko Haram