A text dump on European Union terrorism analysis

Reproduction is authorised provided the source is acknowledged. For any use or reproduction of individual photos, permission must be sought directly from the copyright holders.

This publication and more information on Europol are available on the Internet.

www.europol.europa.eu

Shutterstock: pages 9, 14, 17, 25, 27, 28, 31,32, 39, 41,42, 45, 47, 48 and 57.

ISBN 978-92-95200-79-1

DOI 10.2813/237471

QL-AJ-17-001-EN-N

FOREWORD OF THE DIRECTOR

Since 1 July 1999 - the date of taking up its activities - Europol has had the authority to deal with terrorist activities. Over recent years the organisation’s involvement in this area has seen a steep increase. The number of Europeans travelling as foreign terrorist fighters (FTFs) to the conflict areas in Syria and Iraq, the intensive use of the internet and social media in propaganda and recruitment activities, and the terrorist attacks in EU Member States directed or inspired by jihadist terrorist organisations, have caused a major increase in the number of cases at Europol concerning “crimes committed or likely to be committed in the course of terrorist activities against life, limb, personal freedom or property” - a development that is not expected to come to a halt soon.

In order to remain up to par in cooperating with Member States in counter-terrorism activities and to improve the quality of Europol’s services where possible, the European Counter Terrorism Centre (ECTC) was established, and started its activities in January 2016. The ECTC is developing into a pan-European centre of counterterrorism expertise and provides direct operational support for ongoing investigations, such as the case of “Taskforce Fraternite”, following the 13 November 2015 Paris attacks. The team consisting of Europol experts and analysts has, along with the French and Belgian investigating teams, processed and analysed more than 14 terabytes (TB) of information, resulting in several investigative leads. Another example of Europol’s operational support is delivered on a daily basis by the EU Internet Referral Unit (EU IRU), to detect and investigate malicious content on the internet and in social media. This not only produces strategic insights into jihadist terrorism, but also provides information for use in criminal investigations. Meanwhile, the ECTC also works to track the flow of terrorist finance and links between terrorist suspects and criminal sources of (illegal) firearms and counterfeit documents.

At the cornerstone of its work Europol provides a well-functioning apparatus for the swift and secure exchange of information. Never before has the need for information sharing become more evident as it has in the past two years, with its unprecedented number of failed, foiled, but also completed jihadist terrorist attacks across Europe. In contrast to ethno-nationalist and separatist terrorism, and most manifestations of both right-wing and left-wing violent extremism, is jihadist terrorism an international issue.

This new edition of the yearly EU

Terrorism Situation and

Trend Report (TE-SAT), which Europol has produced since 2007, provides a concise overview of the nature of terrorism that the EU faced in 2016. In this report you will find information on terrorist attacks that occurred in 2016 and the numbers of arrests and convictions for terrorist offences. Also included is a brief overview of the terrorist situation outside the EU.

I would like to thank all EU Member States and Eurojust for their contributions to the TE-SAT2017. I would also like to express my gratitude to authorities in Switzerland and Turkey for the information they provided.

Finally, I would like to recognise the work of the members of the Advisory Board, consisting of the ‘Troika’ (Presidencies of the Council of the EU; Slovakia, Malta and Estonia), France, Spain, Eurojust, the EU Intelligence Analysis Centre (INTCEN) and the Office of the EU CounterTerrorism Coordinator. Their valuable contributions were indispensable for the production of this 2017 edition of the TE-SAT.

Rob Wainwright

Executive Director of Europol

TRENDS

The EU is facing a range of terrorist threats and attacks of a violent jihadist nature, from both networked groups and lone actors. The attacks in Brussels, Nice and Berlin in particular, with explosives (Brussels) and vehicles (Nice and Berlin) used to randomly kill and wound as many people as possible, again demonstrated the harm jihadist militants are able and willing to inflict upon EU citizens, legitimised by the interpretation they adopted of selectively sampled religious texts.

Attacks can be both carefully prepared and carried out spontaneously. Terrorists acting in the name of IS have proven to be able to plan relatively complex attacks - including those on multiple targets - quickly and effectively.

Jihadist actors can be both directed by Islamic State (IS) or merely inspired by IS ideology and rhetoric. Jihadist terrorists have been found to use a range of weapons to include bladed weapons, automatic rifles, explosives and vehicles, and are expected to continue to do so.

Jihadist terrorists are expected to continue using mostly low-tech smaller improvised explosive devices (IEDs) and improvised incendiary devices (IIDs) consisting of readily available products.

Violent jihadists target individuals, as well as small groups of people who represent values considered by them to be non-Islamic, and large unsuspecting crowds. Individuals or small groups targeted by terrorists can be both hard targets (police, the military) or soft targets (a church, synagogue, mosque). Large unsuspecting crowds, chosen with the intent on causing mass casualties are regarded to be soft targets by definition.

Attacks carried out in locations with international character, such as the metro station in Brussels (close to EU institutions), and Zaventem airport (an international airport), have a multiplier effect with guaranteed worldwide media attention.

Perpetrators of terrorist attacks in the EU include both foreigners, of whom a number may have resided in the EU for a long time, and nationals who have grown up in the countries they attacked.

The influx of refugees and migrants to Europe from existing and new conflict zones is expected to continue. IS has already exploited the flow of refugees and migrants to send individuals to Europe to commit acts of terrorism, which became evident in the 2015 Paris attacks. IS and possibly other jihadist terrorist organisations may continue to do so.

Terrorist groups continue to exploit the socio-economic grievances of Muslim immigrants to the EU, in order to recruit and incite them to engage in terrorist activities. IS ideology has a certain appeal amongst segments of the Muslim population in the EU, sometimes expressing admiration for “martyrdom”.

Motivations may generally include a belief that Islam is under attack from the West.

Women and young adults, and also children, are playing increasingly operational roles in committing terrorist activities in the EU independently, not only facilitating other operatives in various ways, but in the (attempted) execution of terrorist attacks themselves. Female militant jihadists in the West perceive fewer obstacles to playing an operative role in a terrorist attack than men, and successful or prevented attacks carried out by women in western countries may act as an inspiration to others.

There is a decrease in the numbers of individuals travelling to the conflict zones in Syria/ Iraq to join the jihadist terrorist groups as foreign terrorist fighters. The number of returnees is expected to rise, if IS, as seems likely, is defeated militarily or collapses. An increasing number of returnees will likely strengthen domestic jihadist movements and consequently magnify the threat

In overall terms the level of activity in the EU attributed to jihadist terrorism remains high, with indications of it continuing to rise. 718 arrests related to jihadist terrorism were made in 2016, a number that has sharply increased in each of the last three years.

they pose to the EU.

Refugees and ethnic minorities in the EU are facing increased violence. These crimes are arguably intended to seriously intimidate sections of the population however, despite showing some similarities, do not qualify as terrorism or violent extremism and are therefore not reported by Member States and consequently not included in the figures.

The deadly attack on a Labour Party MP in the UK in June 2016 demonstrated once again the threat coming also from lone actors who might be inspired by right-wing ideology but do not necessarily have a close connection with extremist groups. Based on this attack and various physical assaults against politicians that happened across the EU in 2016[1], public figures, political parties, civic action groups and media that take a critical view of right-wing extremism, or advocate promigration policies, have to be considered as potential targets of right-wing extremist agitation. Anarchist and left-wing extremists, on the other hand, take advantage of peaceful demonstrations to carry out attacks on government property and law enforcement personnel.

1. GENERAL OVERVIEW

1.1. TERRORIST ATTACKS AND SUSPECTS ARRESTED

Member States reported that 142 victims died in terrorist attacks and 379 people were injured.

In 2016, a total of 142 failed, foiled and completed attacks were reported.

In 2016 a total of 142 failed, foiled and completed attacks were reported by eight Member States. More than half (76) of them were by the UK[2]. France reported 23 attacks, Italy 17, Spain 10, Greece 6, Germany 5, Belgium 4 and Netherlands 1. Of the 142 attacks, less than half (47) were completed. Member States reported that 142 victims died as a result of terrorist attacks and 379 people were injured.

Nearly all reported fatalities[3] and most of the casualties were the result ofjihadist terrorist attacks.

The total number of 142 attacks is a continuation of a downward trend that started in 2014 when there were 226 attacks, followed by 211 in 2015.

The largest number of attacks in which the terrorist affiliation could be identified were carried out by ethno-nationalist and separatist extremists (99). Attacks carried out by left-wing violent extremists have been on the rise since 2014; they reached a total of 27 in 2016, of which most (16) were reported by Italy. The number of jihadist terrorist attacks decreased from 17 in 2015 to 13 in 2016, of which 6 were linked to the so-called Islamic State (IS). However, a precise ranking amongst and within terrorist affiliations across the EU cannot be established because the UK does not provide disaggregated data on attacks.

Explosives were used in 40% of the attacks, with similar numbers to 2015. The use of firearms dropped considerably from 57 in 2015 to 6 in 2016.

Apart from jihadist, ethno-nationalist and left-wing extremist attacks, an increasing stream of violent assaults by right-wing extremist individuals and groups was noted across Europe, in particular over the past two years, targeting asylum seekers and ethnic minorities in general[4]. These assaults however do not generally qualify as terrorism[5] and are therefore not included in the numbers of terrorist attacks being reported by Member States, with only one exception in 2016, reported by the Netherlands.

The number of arrests for terrorist offences in 2016 (1002) is lower than that of 2015 (1077). Most arrests were related to jihadist terrorism, for which the numbers rose for the third consecutive year: 395 in 2014, 687 in 2015 and 718 in 2016. Numbers of arrests for left-wing and separatist terrorist offences dropped to half of what they were in 2015 (from 67 and 168 in 2015 to 31 and 84 in 2016 respectively). Numbers of arrests for rightwing terrorism remained low at 12 in 2016 compared to 11 in 2015.

France is the only Member State in which the overall numbers of arrests continue to increase: from 238 in 2014, to 424 in 2015 and to 456 in 2016.

Almost one-third of arrestees (291) were 25 years old or younger. Only one in ten arrestees (9%) in 2016 was older than 40 years.

Arrests for terrorist activities (preparing, financing, assisting, attempting or executing attacks) decreased from 209 in 2015 to 169 in 2016. Arrests for travelling to conflict zones for terrorist purposes also decreased: from 141 in 2015 to 77 in 2016. This was similar to the decrease in numbers of arrests of people returning from the conflict zones in Syria and Iraq: from 41 in 2015 to 22 in 2016.

FIGURE 1

FIGURE 2

Attacks and arrests by EU Member State in 2016.

ATTACKS

ARRESTS

1.2. TERRORIST AND VIOLENT EXTREMIST ACTIVITIES

Financing of terrorism

Recent EU terrorist attacks have been funded by an opportunistic mix of licit and illicit sources. Up to 40% of terrorist plots in Europe are believed to be at least partly financed through crime, especially drug dealing, theft, robberies, the sale of counterfeit goods, loan fraud, and burglaries. Using funds raised through criminality is regarded an ideologically correct and legitimate way of financing ‘jihad’ in the ‘lands of war’[6].

Terrorists in 2016 were agile in the diversity of their funding mechanisms, both from legal and illegal sources. The young ages of a large proportion of jihadists, the majority of whom are computer literate, has caused an increase in the use of modern technological financial services. These financial services and applications, including financial low transfer apps, are fluid, encrypted and partially anonymised, allowing a desirable financial conduit for terrorists who seek a borderless, reliable and shielded financial mechanism, optimised and readily accessible for real-time small value transfers.

2016 has seen lower amounts of funds moved regularly through the financial sector. These small denomination values sent by supporters and family members are transferred to support FTFs and their organisational expenses[7].

Travel for terrorist purposes

More than 5000 individuals emanating from the EU are believed to have travelled to conflict areas in Syria and Iraq. As was observed in 2015, individuals from Belgium, France, Germany and the UK account for the majority of this total. On a per capita basis, Belgium appears to have the highest numbers. In addition, more than 800 persons are believed to have travelled to Syria and Iraq from the Western Balkan countries, predominantly joining IS. There is also likely to be a ‘dark number’ of travellers to and from Syria and Iraq that have not yet been detected. Turkey reported that, as of November 2016, it had approximately 7670 individuals from EU MS on a suspected FTF no-entry list. A number of countries, including the Netherlands, France, Denmark, Sweden, Austria, Germany and Switzerland reported that, since the beginning of 2016, the flow of jihadists travelling to conflict zones abroad - especially Syria and Iraq - has apparently continued to decline. Nonetheless, Germany and Italy for example, maintain that the level of departures remains high or constant.

The sustained pressure facing IS in Syria and Iraq due to the air strikes and ground offensive of the anti-IS coalition is likely to be the main reason for the general decline in outgoing travellers. The air assaults have also targeted IS’s financial structures, which has led to decreased incomes for FTFs. Moreover, it has become increasingly difficult to cross the Turkish border to Syria. Neighbouring countries have improved their border security and, since IS does not control the border area anymore, it is now more difficult to reach the territory it does control. Furthermore, IS leadership and messaging has indicated that their sympathisers should no longer go to Syria and Iraq, but should instead join IS branches in other countries or focus on attacks in their homelands.

Attack planning against the EU and the West in general continues in Syria and Iraq. Groups including IS and al-Qaeda have both the intent and capability to mount complex, mass-casualty attacks. It is believed that there is not a lack of volunteers for such operations. The 2016 attacks in Brussels in March, then in Istanbul in June, appeared to demonstrate the ongoing effectiveness of IS’s external operations capability. The Paris and Brussels attacks again showed that terrorist networks directed from Syria can rely on the help of sympathisers in Europe who have never been to Syria themselves.

According to the Netherlands for example, it is possible that there are still dozens of IS operatives (attackers sent by IS, and their accomplices) in Europe. Italy reported concerns of potential sleeper cells from the external operations unit of IS or al-Qaeda operatives and affiliated organisations inspired by jihadist ideology.

Germany asserted that there is no doubt about the firm determination of all internationally focused jihadist groups to seize every opportunity to carry out an attack in a Western country, but that despite this determination, in recent years, the planning and execution of such attacks has shifted mainly to lone actors or small groups without direct links to an organisation - modifying the threat situation accordingly. Furthermore, Germany assessed that individuals who have either been prevented from travelling abroad or failed to travel for other reasons should be regarded as particularly dangerous in view of the fact that their ideological delusion and propensity for violence are strongest at the time of the planned departure.

Ongoing contact on social media between combatants in Syria/Iraq and ‘stay-at-home jihadists’ fuels the enduring potential threat posed by jihadist networks; now that leaving the country to take part in jihad has become more difficult, would-be attackers may indeed shift their focus to their countries of residence. IS also supports the interactions between some of its fighters in the region and individuals recruited back in the EU (for example, in the jihadist milieu in France) in order to carry out violent actions on home soil. These recruitments are made via encrypted social networks such as Telegram.

Several countries, including Italy and Switzerland, stated that one of the greatest risks to their domestic security is posed by lone actors or small groups, be they self-radicalised individuals or returning FTFs.

TRAVELLING OF WOMEN AND CHILDREN RETURNING FIGHTERS

The UK were amongst countries that reported an increase in the number of women, families and minors engaging in the conflict in Syria/Iraq, although they remain a small proportion of overall travellers. They also reported that the average age at time of travel of those engaging in the conflict has reduced significantly; nearly half of those travelling aged 18 and under have departed since the declaration of IS’s ‘caliphate’ in July 2014. Poland stated that its citizens who travelled are all less than 22 years old. Although overall figures for the EU are not available, of further concern is that by the end of 2016 the Netherlands recorded a total of over 40 children (age 0-12 years) that have travelled to Syria or Iraq with their parents. Austria noted that women, including minors, leave or want to leave for the conflict zones and that some women married FTFs in Syria under Islamic law, partly via social media.

Denmark stipulated that only very few persons departed in 2016. The vast majority of these travellers were young women. In general, women account for nearly one eighth of the total number of travellers from Denmark. They also noted that more women play an active and independent role within jihadist circles in Denmark, and may consequently have an increasingly radicalising effect on their associates and families.

Belgium reported that returning women (and children) are of concern, due to the apparent involvement of female activists in the preparation of attacks. Some may also have received military training. In addition, IS propaganda has repeatedly depicted the training and indoctrination of minors.

However, Spain reported a decrease in the number of women arrested in 2016, and that only one was willing to travel to the conflict zone. The average age of arrestees in Spain was 31 (an increase of 2 years from the previous reporting period). A minor was taken into care due to his parents’ arrest, after they attempted to travel to the conflict zone.

RETURNING FIGHTERS

Most of the FTFs appear to return to Europe through the same route they used for their outbound travel, i.e. mainly taking indirect flights from Turkey and through other European countries. Portugal, for example, reported that those on their way to the conflict areas used not only Lisbon airport, but also more recently the airport in Porto (taking advantage of the new connection to Istanbul). Travel also occurred via the so-called Balkan route. Hungary and Poland reported that they were used as transit countries for FTFs travelling to or from Syria/Iraq. Romania was transited by a limited number of FTFs on their way to and from the conflict areas, the country not being positioned on the route most often used by them. Cases of individuals transiting through Switzerland were also reported, highlighting the risk of Switzerland serving as a logistical base to prepare attacks elsewhere.

Facilitation activity continued in 2016. In Italy for example, investigations led to the arrest of 19 people involved in recruitment for IS and facilitating the movement of FTFs to combat zones. In Switzerland, police operations led to the discovery of a recruiting cell composed of a number of individuals involved in facilitating the travel of Swiss and Italian residents to Syria. This cell also benefited from the logistical support of associates located in Turkey; the main suspect in this case was a Swiss-Turkish dual citizen who supported the ideology of Jabhat Fath al-Sham (former al-Qaeda affiliate Jabhat al-Nusra). Denmark reported that recruitment, radicalisation and facilitation of people and resources to the conflict zone takes place in circles that are less visible and organised than previously observed.

It appears to have become increasingly harder to leave IS territory. Italy reported only one returnee to Europe in 2016 and Denmark reported that the number of returnees from Syria/ Iraq has been declining since mid-2014. The Netherlands also stated that there have been only a few new returnees in the past two years (four in 2016), but that there have recently been indications that a number of Dutch men and women would like to leave Syria.

It is important to emphasise that a particularly strong security threat is posed by individuals who have received prolonged ideological indoctrination, military training in the use of weapons and explosives, or have gained combat experience during their stay in a conflict region. They may also have established links to other FTFs abroad and become part of capable transnational networks. These returning fighters will have increased proficiency in terms of carrying out attacks, either under direction or independently. In addition it is assessed that individuals who have joined terrorist groups like IS will be more brutalised and prone to violence; the influence being greater if their stay was lengthy. They may also have developed a high degree of security awareness. Moreover, some returnees will perpetuate the terrorist threat to the EU through radicalising, fundraising and facilitation activities.

The first groups of returnees were often disappointed with their situation in the ‘caliphate’. The motivations of the more recent ones are not yet entirely clear. The subsequent activities of the returnees from the conflict regions are reported to be diverse. They range from followers, who reduce their involvement in the jihadist milieu (even to the point where such activities are no longer noticeable), to persons prone to violence. However, it has been suggested (by Germany for example) that a disposition to jihadist ideology is likely to prevail, which, under certain conditions, allows the subject’s mobilisation at short notice. Denmark also noted that the threat from returning fighters may become apparent within a very short time frame, but may remain dormant and not appear until a triggering event.

As reported in the 2016 TE-SAT, the irregular migrant flow was exploited in order to dispatch terrorist operatives clandestinely to Europe (in regards to the November 2015 Paris attacks). The procurement and use of high quality false administrative documents was also successfully applied by terrorist operatives (for example by those involved in the March 2016 Brussels attacks). Over this reporting period, the Netherlands stated that in some cases IS operatives have applied for asylum in European countries.

A case in Switzerland involved three suspects purporting to be Syrian refugees and asylum-seekers. Two of them arrived in Switzerland with humanitarian visas and at the time of writing were being investigated as potential IS members.

Italy also stated they have had cases of refugees with previous jihadist backgrounds; and Austria reported it had several cases of individuals suspected of terrorism among the migrants staying in, or travelling through, its territory.

Explosives

Even though terrorists use a wide range of readily available weapons, explosive devices continue to be used in terrorist attacks, due to their high impact and symbolic power.

In 2016, the transfer of terrorist tactics, techniques and procedures (TTPs) from the current conflict zones and illicit spread of bomb-making knowledge and instructions has been observed. The availability of explosive precursors has facilitated the use of Home-Made Explosives (HMEs). Of particular concern are improvised explosive device (IED) attacks on soft targets and the use of suicide person-borne IEDs (PBIEDs).

IMPROVISED EXPLOSIVE DEVICES (IEDS)

Jihadist terrorist IED attacks generally aimed at soft targets, with the main intention of causing a large number of civilian casualties. In recent years, targets included air and rail transport facilities, commercial premises and major sports events.

Two distinct trends have been observed with regards to jihadist terrorists’ use of IEDs in the EU. Firstly, IEDs have been reported to show similarities in design and construction with IEDs used in conflict zones. Some elements of these IEDs appeared to have been modified based on available resources and circumstances in the EU. For example, HMEs and improvised components were used in place of military components that are difficult to procure. Such devices have been more prevalent in attacks by terrorist groups and lone-actors directed by IS. These incidents commonly required additional logistical support and specific knowledge in the manufacturing of larger amounts of HMEs. Nonetheless, these IEDs were not particularly sophisticated but relatively reliable and simple to use. Bomb-making knowledge, in some cases, was transferred to the attackers through direct contact and experience (facilitated by foreign terrorist fighters and returnees). In other cases, knowledge and guided instructions have been transferred via ‘remote assistance’ using various social media and online communication channels.

Secondly, more rudimentary IEDs have been used by jihadist terrorists recently. These mostly consisted of readily available explosive components, such as gas cylinders, pyrotechnic articles and ammonium nitrate-based products. Such IEDs can be constructed without any specific expertise, preparation, extensive planning or logistical support. They have been primarily used by small terrorist groups or self-radicalised lone-actor terrorists inspired by IS. It is also notable that IS has started to promote the use of readily available flammable products to construct basic improvised incendiary devices (IIDs) and commit arson attacks - a new simple terrorist tactic recommended for lone-actors.

Regarding the potential use of alternative and more sophisticated types of IEDs, the current trend in using weaponised unmanned aerial vehicles (UAVs) in the Syria/Iraq conflict zone might also inspire other jihadist supporters and expand the use of this kind of tactic outside this area of operation.

Additionally, as seen in recent attacks in Egypt and Somalia, threats posed to civil aviation by IED attacks are still present. Main threats emanate from the use of concealed and hardly detectable IEDs and facilitation by affiliates working as airport employees to bypass security checks.

Groups and individuals belonging to the extreme right-wing scene maintained their affinity to weapons and explosives. This was illustrated by the significant increase in the number of incidents involving arson and explosives, as well as seized explosive devices. In addition to common types of IIDs/IEDs such as Molotov cocktails and improvised pipe bombs, these groups tend to use military-grade explosive devices.

Left-wing and anarchist groups have predominantly carried out arson attacks using flammable liquids and IIDs, such as Molotov cocktails and gas cylinders. Nevertheless, an increase has been noted in the number of terrorist attacks in which perpetrators constructed and delivered postal IEDs/IIDs filled with incendiary or low-explosive charges, such as gunpowder. In general, all devices have been constructed from improvised material readily available on the open market.

The attack methodologies and capabilities used by Dissident Republican (DR) groups in Northern Ireland (UK) varied across groups. Many attacks involved firearms or small IEDs such as pipe bombs but they have also employed larger and/or potentially more destructive devices such as vehicle-borne IEDs (VBIEDs) and explosively formed projectiles (EFPs). There have been four DR IED attacks in 2016 including a fatal IED attack on a prison officer. All groups retain access to a range of firearms and explosives and there is an ever-present threat of under-vehicle IED attacks.

HOME-MADE EXPLOSIVES

HMEs have been the most common type of explosive used in recent terrorist IED attacks. The explosive used in most of the attacks was triacetone triperoxide (TATP), a home-made explosive that remains the explosive of choice for terrorists. The internet continues to be a crucial resource for lone-actor terrorists to gain bomb-making skills. Internet websites, forums, social networks and the Darknet facilitate access to bomb-making knowledge and information.

MILITARY EXPLOSIVES

The availability of explosives in current and former conflict areas such as the Western Balkans and Ukraine, and the illicit trafficking of explosives into the EU, is believed to present a significant threat. Terrorists are known to have acquired hand grenades, rocket launchers and high-grade plastic explosives and detonators from organised crime groups (OCGs).

In addition to trafficking explosives, other methods of obtaining military explosive ordnance include thefts from military explosives storage facilities and the illegal collection of explosive remnants of war (ERW) and unexploded ordnance (UXO) from former battle zones.

COMMERCIAL EXPLOSIVES

Commercial pyrotechnic articles and gunpowder continue to be misused for terrorist purposes as a source of explosive compounds for constructing IEDs. These pyrotechnics are widely available, and the use of pyrotechnic mixtures in lEDs is promoted in jihadist terrorist publications. This threat might increase in the future.

Misuse of pyrotechnics has been observed in most EU countries. The pyrotechnic articles have been used in various forms: in the original state; modified; or by extracting the pyrotechnic mixture and utilising it in IEDs. Pyrotechnics have largely been used in small-scale bomb attacks. The most frequently used types have been the categories F3 and F2, which are sold to the general public. However, it appears that the misuse of professional category F4 flash bangers has increased in the recent period.

Chemical, biological, radiological, nuclear (CBRN)

To date, no large-scale CBRN attacks in the EU by any terrorist group have been reported. However, IS has significantly improved its capacity to produce explosives and improvised explosive devices through the adaptation of existing military ordnance stolen or retrieved from abandoned or conquered military facilities. There is concern that they have also accumulated knowledge to develop CBRN weapons that could later be used in attacks. In territories under its control, IS might have gained control of CBRN facilities (abandoned military and industrial facilities, laboratories or stockpiles) allowing access to chemical agents. In addition, the group might have recruited, voluntarily or by force, scientists previously working in the chemical, biological or radio-nuclear sectors. The Organisation for the Prohibition of Chemical Weapons-United Nations (OPCW-UN) Joint Investigative Mechanism confirmed that IS has used chemical weapons in Syria.

Furthermore, in 2016, CBRN-related topics continued to appear in terrorist propaganda. Various jihadist media outlets used social media channels, in particular Telegram, to express intentions to commit CBRN attacks, share possible tactics for attacks and suggest targets. For example, in May 2016, a jihadist tutorial on ricin toxin extraction, addressing lone actors, was published online.

Food contamination threats

Threats to intentionally contaminate food or water occurred in 2016, both in criminal and extremist contexts. In two cases, anarchists threatened to use toxic chemicals. In June, Italian anarchists threatened to poison foodstuff in supermarkets in Lombardy using herbicide. The campaign aimed to protest against the use of toxic chemicals in the agriculture, engineering and food production industries. Those anarchists posted a technical description of the methods to be used and a list of potential targets on their website. In December, Greek anarchists published a warning claiming that they had contaminated several food and drink products of multinational companies. Their operation, “Green Nemesis #2”, was planned to take place between Christmas and New Year in Athens, Greece. The warning message posted on the anarchist website explained how to introduce chlorine and hydrochloric acid into products while leaving packaging intact. Similar threats to contaminate beverages were also expressed in December 2013.

Use of radioactive materials

In November 2016, several Slovak institutions including the Ministry of Justice, district courts and a regional police office, received suspicious envelopes containing anonymous letters. The letters expressed dissatisfaction with the judicial system and mentioned a lost court trial. One letter referred to radioactive contamination and incidents in 2015 and 2016 when employees of various judicial institutions were exposed to radioactive material emitting alpha-particles. Further laboratory expertise confirmed the presence of small amounts of radioactive Americium-241 in the envelopes. The case was investigated by the Slovak authorities as an act of terrorism. This incident demonstrated that certain CBRN materials that are commonly used in various civilian applications, in particular radioactive substances, can be acquired by criminals or terrorists due to inadequate security measures.

1.3. COURT PROCEEDINGS, VERDICTS AND IndIvIDUals IN CONCLUDED COURT PROCEEDINGS

In 2016, 17 EU Member States reported to have concluded a total of 275 court proceedings in relation to terrorism[* 8]. The concluded court proceedings concerned 580 individuals, 53 of which were female[9].

In 2016, Spain reported the highest number of concluded court proceedings and the highest number of individuals convicted or acquitted of terrorist offences. Among those, three individuals appeared before the court twice in 2016 in different criminal proceedings. In Belgium, the cases against two individuals were annulled on the basis of the ne bis in idem principle, as the court ruled the two had been convicted of the same facts earlier in 2015 and 2016. In France, two individuals appeared before the juvenile court and the criminal court. As a result, the total number of verdicts pronounced for terrorism-related offences in 2016 was 587.

Some of the verdicts reported in 2016 are final while others are pending judicial remedy, as appeals have been submitted.[10] A number of defendants in Belgium, France and the Netherlands did not appear before the court and were sentenced in absentia.

In case a verdict pronounced in 2016 was appealed and the appeal was concluded before the end of the year, Eurojust counted the proceeding as one and reported only on the latest/final verdict.

The data provided by the United Kingdom did not distinguish between final verdicts and verdicts pending judicial remedy. As reported, all convictions in the United Kingdom are effective from the moment of their being pronounced, even if an appeal is made.

FIGURE 3

Number of individuals in concluded court proceedings for terrorist offences in 2014, 2015 and 2016, as reported to Eurojust*.

INDIVIDUALS TRIED

* The data for the previous years corresponds to the data reported in the respective TE-SAT reports.

Type of terrorism

The vast majority of verdicts in the Member States in 2016 were pronounced in relation to jihadist terrorism.[11] This confirms the findings in 2015 when, for the first time since 2008, the concluded court proceedings in the EU resulted in a higher number of verdicts for jihadist terrorism offences than for separatist terrorist offences.

As evidenced in the past couple of years, the majority of the verdicts for jihadist terrorism concerned offences related to the conflict in Syria and Iraq. They involved persons who had prepared to leave for or have returned from the conflict zone, as well as persons who have recruited, indoctrinated, financed or facilitated others to travel to Syria and/or Iraq to join the terrorist groups fighting there. Individuals and cells preparing attacks in Europe and beyond were also brought before courts.

Similar to 2015, courts in Belgium rendered the highest number of verdicts concerning jihadist terrorism in 2016 (138). A large number of such verdicts were also rendered in Germany and the Netherlands. In Belgium, as well as in seven other Member States, only verdicts concerning jihadist terrorism were pronounced in 2016. Those include Austria, Estonia, Finland, France, Italy, Portugal and Sweden.

The Brussels Criminal Court, for example, sentenced 15 men - with nine in absentia - to prison sentences of up to 15 years for membership in a terrorist organisation and planning of terrorist attacks. The defendants formed the so-called Verviers cell, which had ties with persons involved in the November 2015 terrorist attacks in Paris. Three of the defendants present at trial were considered to be the leaders of the cell, each receiving a 16 year sentence. The court found that one of them had travelled to Syria to receive instructions on targets, while the others had been responsible for arranging the logistics, including securing a safe house in Verviers and obtaining weapons and chemicals needed for the planned attacks. Another defendant received a sentence of 30 months in prison for helping a radicalised family member to travel to Syria in order to fight for IS. Similarly, another cell member received a 3 year sentence on probation for having attempted to join IS in Syria. The defendants convicted in absentia received sentences of 5 to 7 years in prison. Most are considered foreign terrorist fighters who left for Syria to fight in the ranks of IS.

Also in Belgium, the Court of Appeal of Brussels confirmed the guilty verdict pronounced in July 2015 by the Court of First Instance of Brussels against a leader of a terrorist group that had recruited and sent fighters to Syria. The Court of Appeal handed down a 15 year prison sentence, which is 3 years longer than the one given in first instance. The same sentence of 15 years was ordered for another person, who had received a penalty of 8 years’ imprisonment in July 2015. The prison terms of two other group members were also increased. All four were part of an organised network that had recruited, indoctrinated and facilitated the travel to Syria of potential fighters. One of the group members sentenced in absentia is believed to have played a major role in the attacks that took place in Paris on 13 November 2015. He was reported dead following a police action in the aftermath of the attacks. Another one, also sentenced in absentia and suspected to have been plotting terrorist acts, was arrested in March 2016 in France.

In France, seven men including the brother of one of the 13 November 2015 Paris attackers, were convicted by the Paris Criminal Court on 6 July 2016 to sentences of 6 to 9 years for participating in a criminal conspiracy to carry out terrorist attacks. They had travelled to Syria, where they had been trained by IS and fought in the ranks of the terrorist organisation. The men were part of a larger group that had travelled to Syria at the end of 2013. After two of the initial members had been killed, the rest - except one of the 13 November attackers - returned to France in April 2014, to be arrested a month later. The prosecutor in this case used wiretaps and various jihadi-inspired materials taken from the defendants’ devices as evidence. However, this conviction is not final as the public prosecutor has appealed.

In another case against a terrorist group with international ties in Italy, four members of the Merano cell of the Rawti Shax group were convicted by the Court of Assizes in Trento of planning terrorist attacks throughout Europe. The leader of the group was sentenced to 6 years in prison, while the other three members of the cell to 4 years respectively.

The defendants had as their stated aim the establishment of a theocratic state and the overthrow of the government of Kurdistan. The prosecution built its case on intercepted communications which showed that, despite the transnational nature of the Rawti Shax group, the Merano cell operated to a large extent independently. Its members were able to engage in fundraising and were theoretically capable of carrying out the attacks referred to in their communications. The Merano cell members were arrested as part of a big multinational operation coordinated by Eurojust in November 2015.

With regards to evidence, an interesting precedent was set by the District Court of Glostrup in Denmark, which was the first court in Europe to refer to a questionnaire/form used by IS. The form offered the possibility to indicate one’s role for IS and was made available by foreign authorities. It contained information on a Danish citizen charged with terrorist offences. In the form, he had been registered as a fighter. Reference to the form was made when questioning the accused about his role within the terrorist organisation. The court held that his statement about his tasks, mainly cooking and serving food, was not reliable. Based on this and other evidence, the accused was found guilty, amongst other charges, of joining a terrorist organisation and sentenced to 6 years’ imprisonment.

The intense propaganda, recruitment and indoctrination strategy applied by jihadist terrorist groups is also evident in the verdicts pronounced in the EU. In Spain, for example, the Audiencia Nacional found seven Spanish and Moroccan nationals guilty of terrorist indoctrination. Directed by IS, the seven had formed a terrorist cell that managed a number of social media accounts used to disseminate terrorist propaganda, glorify the jihad and praise IS. The accounts were also used to recruit persons who would later join IS in Syria and Iraq or commit terrorist acts in Spain. The accounts attracted a lot of followers who sympathised with IS and its terrorist activities. Some of those followers were selected as ‘most suitable’ and were brought in contact with a cell member located in Turkey who would help them reach Syria or Iraq or collaborate with IS in another manner. All seven cell members were handed down prison sentences of 3% to 7% years. In another case, one defendant was sentenced to 3% years’ imprisonment after the court found him guilty of self-indoctrination.

Further to verdicts concerning jihadist terrorism, Spanish courts dealt with the highest number of separatist terrorism cases in the EU in 2016. The vast majority of those cases concerned the terrorist organisation ETA. Individuals charged with offences related to other separatist terrorist groups (e.g. the PKK and LTTE) were tried in Denmark, Germany and the Netherlands. Greece was the only Member State that reported verdicts for left-wing terrorist offences, while courts in Hungary, the Netherlands and Spain also tried right-wing terrorism cases. The highest number of female defendants in the concluded proceedings in 2016 were tried for separatist terrorist offences (22) and for jihadist terrorist offences (also 22).

Convictions and acquittals

In 2016, Austria, Estonia, France, Germany, Greece and Hungary reported successful prosecutions resulting in no acquittals for terrorist offences[12]. Germany remains the only Member State where prosecutions for terrorist offences led to guilty verdicts and no acquittals in the period 2010-2016.

The year 2016 registered a record high conviction rate in the concluded court proceedings (89%). The acquittal rate of 11% is significantly lower than that in 2015 (21%) and in 2014 (24%) and continues the downward trend compared to the years before[13]. In some cases, defendants were acquitted of terrorist offences but convicted of other offences such as illegal possession of firearms, document forgery, preparing an armed robbery, manufacturing drugs, inciting racial hatred, etc[14].

All prosecutions for left-wing and right-wing terrorist offences resulted in convictions in 2016. The concluded jihadist terrorism cases also had a very high conviction rate (92%), similar to that in 2015 (94%). The acquittal rate among the verdicts related to separatist terrorism decreased significantly in 2016 (18%), compared to 2015 (47%)[15].

Penalties

The guilty verdicts pronounced by courts in the EU in 2016 resulted in various penalties including imprisonment, fines, treatment in mental health care facilities, community service and restraining orders. In some cases the court also imposed restrictions on civil rights and bans on entering the national territory on completion of the prison term, or revoked the citizenship of those convicted of terrorist offences.

FIGURE 4

Average sentences (excluding non-prison penalties) per Member State in 2016, as reported to Eurojust.

Average sentence in years 28 28

The prison sentences ordered by the courts in 2016 ranged between 6 weeks and 397 years. In some cases (part of) the sentence was suspended or made conditional for a certain period of time. In other cases guilty verdicts were handed down but no penalty was yet ordered at the time of reporting.

In several cases in Greece, Sweden and the United Kingdom the court ordered life sentences. In another case in the Netherlands the court pronounced a guilty verdict but imposed no penalty based on Article 9a of the Criminal Code. The court considered the defendant’s acts as a onetime misstep and recognised the efforts he had made to re-integrate into Dutch society.

The average prison sentence for terrorist offences in the EU in 2016 was 5 years. This is lower than the reported average in 2015 (7 years) and in 2014 (6 years)[16].The majority (67%) of the penalties handed down with the guilty verdicts in 2016 were of up to 5 years’ imprisonment, which is slightly higher than in 2015 (61%) and less than in 2014 (70%). The number of sentences of 10 and more years’ imprisonment decreased to 12%, compared to 20% in 2015.

Similar to 2015, in 2016 the average prison sentence for left-wing terrorist offences was the highest, increasing from 12 to 28 years. Jihadist and separatist terrorist offences were punished with an average prison sentence of 5 years, and right-wing terrorist offences with 4 years[17].

It should, however, be taken into consideration that the severity of the penalty in each case would depend on the respective offence and cannot serve any comparative purposes. Also, in some Member States the average sentence is calculated on the basis of one conviction, while in others it is based on a considerably higher number of convictions.IB

2. Jihadist Terrorism

2.1. TERRORIST ATTACKS AND SUSPECTS ARRESTED IN THE EU

135 A

people killed in jihadist terrorist attacks

718 &

people arrested on suspicion of jihadist terrorism related offence

2016, 135 people were killed in jihadist terrorist attacks in the EU. In total 13 terrorist attacks were reported: France 5, Belgium 4 and Germany 4. Out of these 13 attacks, 10 were completed.

A total of 718 people were arrested on suspicion of jihadist terrorism related offences. Numbers of arrests increased in particular in France: from 188 in 2014 and 377 in 2015 to 429 in 2016. There was also an increase in the Netherlands to 36 in 2016 compared to 20 in 2015. In the other Member States the numbers of arrests stayed at approximately the same level, or showed a (slight) decrease. Women have increasingly assumed more operational roles in jihadist terrorism activities, as have minors and young adults, as demonstrated in recent (primarily) failed and foiled attacks in Member States. One in four (26%) of the arrestees in 2016 were women, a significant increase compared to 2015 (18%).

Attack planning against the West continues in Syria and Iraq. Groups including IS and al-Qaeda are believed to have both the intent and capabilities to mount complex, mass casualty attacks. IS is training operatives in Syria/Iraq to carry out terrorist acts in the West and has no shortage of volunteers to be part of teams to be sent abroad for this purpose. Al-Qaeda, despite decreased operational capabilities of its core organisation, has maintained its ambition to carry out large-scale operations against Western targets.

The terrorist threat in the EU in 2016 emanated from remotely directed individuals operating alone or in small groups, and those that may have been inspired by terrorist propaganda, but not directed. The former are receiving direction and personal instruction from, and are possibly being facilitated by, a terrorist organisation. The latter are individual attackers, possibly but not necessarily being helped by family and/ or friends as accomplices. They are inspired by jihadist propaganda and messaging, but not necessarily receiving personal direction or instruction from any group.

On 7 January a man wearing what appeared to be a suicide vest and wielding a meat cleaver outside the Goutte d’Or police station in Paris, was shot and killed as he tried to force his way in. Also in January a Jewish teacher, wearing traditional dress and kippa, was attacked and wounded with a machete in Marseille while walking to work. The attacker was a 15-year-old boy who had arrived in France in 2010.

On 13 June a French police commander and his wife were stabbed to death by a former convict of terrorism-related offences. The police officer was attacked on arriving at his home in Magnanville, near Paris. The attacker subsequently entered the house, where he held the officer’s wife and their 3-year-old son hostage. After the police had ended the siege they found the mother of the child dead. The boy survived. After killing the woman, the attacker broadcast a statement live from the scene via social media in which he pledged allegiance to IS and called for more attacks. The IS related A’maq News Agency posted the video online and a statement that the attack was carried out by an IS fighter.

On 26 July two attackers armed with knives entered the church of Saint-Etienne-du-Rouvray (near Rouen) during morning prayers and murdered an 86-year-old priest and seriously wounded a nun. She was one of five hostages taken by the perpetrators (the others escaped), while the two attackers, both aged 19, filmed themselves in front of the altar. They were shot dead by police as they came out of the church. One of them had tried to travel to Syria twice in 2015.

In the evening of 14 July, a 31-year-old Tunisian, living in France, attacked Bastille Day celebrations in Nice by driving a truck for two kilometres through the crowds of people who had attended a firework display on the Promenade des Anglais. He killed 85 people, including 10 children, and injured 201, a number of them critically. The attacker fired a handgun at police before being shot dead. Evidence from mobile phones and computer records suggest that he may have planned his attack for up to a year. On 16 July, after 36 hours, IS claimed responsibility for the attack, however, at the time of writing no actual links had been confirmed. Vehicles have been used as weapons for attacks in France before, including the one in Valence in January and those in Dijon and Nantes in December 2014. These previous attacks however were relatively small scale compared to the Nice attack.

A similar soft target attack as in Nice took place on 19 December in Berlin, Germany. A truck was driven into a Christmas market in the city centre, killing 12 and injuring 56 people. The incident took place next to the Kaiser Wilhelm Memorial Church, an area heavily frequented by both tourists and locals. IS claimed responsibility for the attack through the A’maq News media outlet one day later, calling the attacker a “soldier”, who “carried out the attack in response to calls to target citizens of the international coalition”. The perpetrator, a 24-year-old Tunisian national, with a criminal record in Tunisia and Italy, had arrived in Europe 5 years earlier on the Italian island of Lampedusa and later travelled to Germany where he applied for political asylum. Prior to the attack, he made a video in which he pledged allegiance to IS and provided it to A’maq News. Three days later, he was shot dead after he attacked a police officer in Sesto San Giovanni, a suburb of Milan (Italy), during a routine check. Prior to that, he had passed the Dutch, Belgian and French borders on his way to Italy.

The attack in Berlin was preceded by a number of other completed, failed and foiled attacks in Germany in 2016. The first incident with a violent jihadist signature occurred on 26 February when a 15-year-old German girl of Moroccan descent stabbed and seriously wounded a police officer with a kitchen knife in Hanover. The incident occurred at the main train station, after two police officers had approached the girl and had asked her to present her identification papers. After her arrest police found that she was also carrying a second - larger - knife. The girl had travelled to the Turkish-Syrian border in November 2015 to join IS, but had returned to Germany on 28 January 2016.

On 18 July a 17-year-old Afghan refugee attacked passengers with an axe and a knife on board a train heading to Wurzburg in southern Germany. Five persons were seriously wounded. The attacker fled the train but was chased by officers who shot him dead. The perpetrator appeared to have travelled to Germany as

FIGURE 6

Number of suspects arrested for religiously inspired/jihadist terrorism in EU Member States in 2016

JIHA

429

an unaccompanied minor in 2015. A video released by IS claims to show him delivering a speech in Pashto to the camera while holding a knife. The video calls him “a soldier of the Islamic State who carried out the Wurzburg attack”.

On 24 July a 27-year-old Syrian killed himself and injured 12 people - three seriously - by detonating a backpack bomb in Ansbach, near Nuremberg. It appears that the Ansbach Open Music Festival was the intended target. The perpetrator entered Germany in 2014 and applied for asylum but his request was turned down a year later; he was allowed to stay in Germany because of the ongoing war in Syria. He was known to police, had tried to kill himself twice before and had been in psychiatric care. The IS-linked A’maq News agency stated that the attacker was an IS soldier, responding to the group’s calls to target countries of the US-led coalition against IS in Syria and Iraq.

On 22 March Belgium was struck by two large-scale terrorist attacks. Both attacks were coordinated and carefully prepared with a high level of sophistication and logistical support. In the first attack two suicide bombers detonated improvised explosive devices in the check-in area of Brussels Zaventem Airport, causing the death of 11 people. In the second attack, approximately one hour later, an improvised explosive device was detonated by a third suicide bomber in the middle carriage of a metro train at Maelbeek station (close to several European Union institutions). Two surviving attackers were subsequently arrested.

One of the suicide bombers at the airport had been involved in an earlier attempted robbery at a currency exchange office and a subsequent shootout with police that left one officer injured, for which he was sentenced to 10 years in prison but was paroled in 2014 under the condition that he did not leave the country. The suicide bomber in the metro train was earlier convicted of several carjackings, possessing a number of Kalashnikov rifles, and a 2009 bank robbery and kidnapping. All five were connected to the network that organised and executed the November 2015 Paris attacks. A total of 32 people were killed and 340 people injured in the attacks.

Later in the year Belgium faced two other terrorist attacks that were carried out without the impact and sophistication of the Brussels attacks (international travel, safe houses, use of false documents, manufacturing of explosives), but were nevertheless serious. In August in Charleroi, two police officers, both female, were attacked with a machete outside a police station. Both officers were wounded severely, but not life-threatening. The suspect was a 33-year-old Algerian, who had been living in Belgium since 2012 and was known to the police for criminal offences, but had not been linked to terror activities before. He was shot by a third officer who was nearby and subsequently died of his wounds. On 7 August IS claimed responsibility for the attack, calling it a reprisal carried out by one of its ‘soldiers’. In October two police officers were stabbed in Schaerbeek, north-east of Brussels, by a 43-year-old Belgian national. The assailant was stopped by a second group of police officers. He broke the nose of one officer, who shot him in the leg.

Apart from completed attacks there were a number of failed and foiled terrorist attacks and arrests on suspicion of terrorist activities. Two plots that could have had a significant impact in terms of loss of life if they had not been stopped in time are included here by way of examples. One was thwarted In France, the other in Germany.

In March a French national was arrested in the Argenteuil suburb of Paris, in what was believed to be the advanced stages of preparation for a terrorist attack. The arrested individual was believed to be part of a terrorist network that planned to commit an attack in France. The suspect had already been found guilty in absentia by a Belgian court and sentenced to 10 years in prison for ties to a jihadist network in 2015. Police seized 2 kilograms of the explosive TATP and a Kalashnikov rifle, and also found materials to make more explosives.

of terrorism suspects, indicate a continued threat towards countries of the EU, and those Member States of the EU that are part of a coalition against IS in Syria/Iraq in particular. Therefore the threat ofjihadist terrorism is not perceived equally amongst Member States, of which the majority have not been confronted with jihadist terrorist activities at all in 2016, nor in one of the preceding years. These countries might be used for transiting of foreign terrorist fighters, (potential) jihadists or returnees, or unintentionally providing for a safe haven for them. These and other factors, however, including perceived insults to Islam, may influence potential risks. Switzerland for instance, not being an EU Member State and not being part of a coalition against IS, is aware of its vulnerability to jihadist terrorism by association with other Western countries and its international profile.

In June German police arrested three alleged IS members of Syrian nationality, on suspicion of plotting a terror attack in Germany. The three were caught separately in different cities. It was believed that the men had received orders from IS leadership to attack the city of Dusseldorf using suicide vests, explosives and rifles. The plan was allegedly for two men to blow themselves up in central Dusseldorf before other attackers would kill as many people as possible with firearms and explosives.

In 2016 EU citizens were killed in IS attacks outside the EU. On 12 January, 10 German tourists were killed in a suicide bomb attack in Istanbul (Turkey). This was one of seven fatal attacks in Turkey attributed to IS in 2016. On 1 July nine Italian citizens were amongst the victims who lost their lives in Dhaka (Bangladesh) in an attack on a bakery located in an area near embassies, for which IS claimed responsibility (this was later disputed by Bangladesh’s minister of home affairs, who stated that the perpetrators belonged to Jamaat-ul-Mujahideen).

The high numbers of failed, foiled and completed jihadist attacks in 2016, and the equally high numbers of arrests

Incitement of lone actor attacks in the West

Since the IS announcement in June 2014 that it had re-established the caliphate, the group claimed that all Muslims were under the religious obligation to join it. It was alleged that, by doing so, they would re-enact the historical migration (Hijrah) of Prophet Muhammad to Medina in 622 AD to evade persecution in Mecca. The group declared that refusal to join it was proof of apostasy from Islam. In 2015 IS insisted that the only excuse for Muslims for not joining the group in the territories under its control was to perpetrate a terrorist attack in their places of residence.

As military pressure on IS increased and measures to prevent potential recruits from reaching IS-controlled territory became more effective, IS adapted its recruitment tactics. It now declared that perpetrating a terrorist attack in the West was even preferable to travelling to join IS. < In a speech released on 21 May 2016, IS spokesman Abu

Muhammad al-Adnani, who was subsequently killed in August 2016 near Aleppo, urged volunteers that were prevented from travelling to join IS to perpetrate attacks in their places of residence. IS supporters, in particular in the United States and Europe, should carry out attacks with any means available during the month of Ramadan (6 June to 5 July 2016). Al-Adnani stressed that even the smallest attack in the West would have a great impact, as it would terrorise the enemy.

The increased efforts to incite IS sympathisers in the West to perpetrate attacks were reflected in practical guidance for lone actor attacks provided in IS publications. The IS multi-language magazine Rumiyah[18] contained a series of articles under the title “Just Terror Tactics”, which suggested terrorist attacks using knives, vehicles or arson, and gave tips on how to maximise the numbers of victims and impact. Perpetrators were admonished to leave some kind of evidence stating the motivation of the attack and allegiance to IS, such as a note attached to the victim’s body or a last will.

In 2016 IS preferred to claim lone actor attacks through its A’maq News Agency[19]. Starting with the 12 June 2016 attack on a nightclub in Orlando, Florida, (US), A’maq News issued short messages labelling the perpetrators of lone actor attacks outside IS-controlled territory as “soldiers of the Islamic State”, generally adding that they acted in response to IS’s calls to attack citizens of anti-IS coalition countries. As a precautionary measure, most of these claims pointed out that the information was received by A’maq News from a “security [read intelligence] source”. The public tribute paid by IS to lone actor terrorists was a way to give incentives to other potential attackers, while placing responsibility for the success of the attack entirely on the perpetrator. A’maq News‘ claims for attacks were mainly released within 24 hours after the attack, except in the case of the 14 July 2016 attack in Nice, when the claim came two days later. It has been speculated that the IS leadership had no prior knowledge of the attack or that the delay was a deliberate strategy to create confusion and maximise media coverage.

In addition to the short statements by A’maq News, in several lone actor attacks in EU Member States in 2016, the perpetrators sent previously recorded video statements in which they justified their attacks and pledged allegiance to IS, which were published on the A’maq News website. The precedent for this strategy was set during the 13 June 2016 murder of a police officer and his wife in Magnanville near Paris. After killing his two victims, the perpetrator broadcast a video message live from the location of the crime through a social media service. The video was later re-published on the A’maq News website. In subsequent attacks, prior to the commission of the crime, the perpetrators recorded videos in which they announced and justified their attacks. These videos were published on A’maq News following the attack as proof of the attackers’ motivation. This strategy was used in the 18 July stabbing attack in a train headed to Wurzburg, Germany; the 24

July bomb attack in Ansbach, Germany; the 26 July murder of a priest in St-Etienne-du-Rouvray, France; and the 19 December 2016 attack on a Christmas market in Berlin.

The increased efforts by IS to directly recruit vulnerable people via social media and incite them to perpetrate terrorist acts in their country of residence, seem to not be limited to male targets. Media reporting suggests that women were also targeted, as in the 26 February knife attack in Hanover by a 15-year-old girl. In addition, in early September, a cell consisting of three women was dismantled in Paris. They were suspected of having planted a car containing five gas bottles and a rudimentary ignition mechanism close to Notre Dame cathedral and planning further attacks. At least one of the suspects was reportedly in contact with a French male IS member thought to be in IS-controlled territory at the time. An attack on a police station by three women in Mombasa, Kenya, on 11 September was claimed by IS. Another cell of 10 women was arrested in Morocco in early October. In all cases, there are reports that the suspects were in contact with IS operatives.

IS ideology, as that of other jihadist groups, exempts women from the obligation to participate in armed action except for self-defence, but does not explicitly prohibit them from engaging in fighting. By implication, women may, if they so wish, carry out attacks on perceived enemies. At first glance, however, self-organised terrorist activities by women seem to be at variance with the strict gender segregation, the conscription of women to the closed circles of the family home and the extremely limited areas of activity outside of it, propagated in IS propaganda[20]. As a result, IS propaganda does not address women directly, but does not explicitly exclude them from the obligation to fight either. The attack in Mombasa was commented upon in an article in the IS Arabic newsletter al-Naba’,[21] which described the attackers as “sisters supporting the Islamic State”, not as “soldiers”. The known cells seem to have consisted only of women, which might be linked to the obligation of gender segregation.

Resurgent al-Qaeda

In 2012, already before the emergence of IS, al-Qaeda had redesigned its strategy to ensure its survival under the changed political circumstances following the Arab rebellions: al-Qaeda would merge with the population to the extent possible; cooperate with other Muslim groups based on common interests; and administer territories that fell under its control in a way so as not to alienate the population. The aim was to create safe havens from which al-Qaeda could plan and execute attacks on Western targets. The intransigent behaviour of IS toward local populations made the implementation of this new strategy even more pressing for al-Qaeda in an effort to mark the difference to its opponent.

In 2016, al-Qaeda spent great efforts to refute the legitimacy of IS’s claim to leadership of all Muslims. Al-Qaeda ‘s nominal head, Ayman al-Zawahiri, disputed in several audio and video messages the legitimacy of IS’s declaration of the caliphate. In a May audio speech, he urged Muslims in Syria to unite and build a true caliphate. He asked Muslims and the different fighting factions in Syria to trust its local affiliate Jabhat al-Nusra with the future of

the Levant.[22] He exhorted opposition groups in Syria not to let the country fall into the hands of Shi’is, secularists or IS.

At times, the new rhetoric adopted by al-Qaeda seemed to pick up on demands for representative government formulated during the Arab rebellions. In a video message commemorating the 15^th anniversary of the 11 September 2001 attacks, for example, Ayman al-Zawahiri stated that the 2001 attacks were meant to “restore the equilibrium” between Muslims and the West. The attacks were claimed to be a reaction to the West’s alleged crimes in the Muslim world. With al-Qaeda‘s support, he claimed, the Arab revolutions would acquire an Islamic character and form the nucleus of an assembly that would be able to elect a caliph in the future. He said that the Muslim community had the right to choose, hold responsible and depose its leader. At the same time, he rejected negotiations; only armed struggle could bring a solution.

In most of its material published in Arabic language, al-Qaeda tends to downplay its international aspirations. By contrast, al-Qaeda communication targeting audiences in the West contains views and calls for action very similar to those of IS. This is likely to be an attempt to benefit from the gradual decline of IS communication with the aim of again gaining ascendency in the global jihadist movement. Interestingly, in doing so al-Qaeda copied successful propaganda formats developed by IS.

The competition with IS for leadership in the global jihadist movement was apparent in the 2016 publication of a new issue of al-Qaeda in the Arabian Peninsula’s (AQAP) Inspire magazine. The 16^th issue of Inspire, released on 12 November, praised three lone actor attacks in the US on 17 September 2016 (one of which was claimed by IS), likening them to the 11 September 2001 attacks. It provided instructions on how to build IEDs, justified lone actor attacks in the West, and incited minorities (African Americans) to act.

In addition to the continuation of the Inspire magazine, AQAP introduced a new format, the Inspire Guides - short commentaries on completed and foiled attacks in the West with recommendations for future attacks. The first such document was released on 23 June 2016 and analysed the 12 June 2016 attack on a nightclub in Orlando, Florida, US. While praising the attack for the good planning and execution, it advised that future attacks should target places mainly frequented by white Anglo-Saxon people, who allegedly hold power in the US, rather than places that are popular with sexual or ethnic minorities. A second edition on 21 July 2016 praised the IS-linked attack in Nice, France, a week earlier. It recommended that the perpetrator should send a message so that the people may know and understand his motives. In a comment on the arrest of a female IS-linked terrorist cell in Paris in early September, Inspire Guide insisted that women be prevented from conducting terrorist attacks. By contrast, with regard to the three 17 September attacks in the US, an article labelled as an Inspire Guide in the November issue of Inspire gave practical instructions on how to maximise the impact of lone actor attacks in the West.

EU citizens kidnapped or killed

Terrorist and armed criminal groups continue to consider citizens of the EU and other western countries as high-value targets for kidnapping. This is because ransom money is a significant source of revenue for some groups; the extensive media attention attracted by western hostages can be exploited for propaganda and political pressure; and hostages can be used in prisoner swaps. It is assessed that militant groups do not select individuals of specific nationalities but target their victims opportunistically.

The total number of abducted EU citizens is difficult to estimate due to the fact that not all the kidnapping incidents are reported for reasons related to the security of the hostages. In 2016, the kidnap threat remained very high in and around conflict zones, as well as in areas with little or no governmental control. Incidents involving the kidnapping of westerners occurred in Libya, Mali, Afghanistan and the Philippines. In addition, Syria, Iraq and Yemen remained high-risk countries, although no abductions were reported in their territories in 2016.

Al-Qaeda in the Islamic Maghreb (AQIM) has been very active the regions of Maghreb and the Sahel. In January, AQIM militants abducted a Swiss female missionary in Timbuktu (Mali). Shortly after, the group posted a video online demanding, inter alia, the release of its fighters held in Malian prisons, as well as of a member of Ansar Dine (supporters of the religion), who was at that time standing trial at the International Criminal Court in The Hague. A second video was released in June as proof of life. The hostage was still in the hands of AQIM at the time of writing. AQIM also continued to hold a British-South African and a Swedish hostage, who were kidnapped from a restaurant in Timbuktu in November 2011.

In the same region, a Romanian citizen that was abducted in April 2015 in the border area between Burkina Faso, Mali and Niger, remained in the hands of his captors in 2016. The kidnapping was claimed, in May 2015, by a faction of al-Murabitun, which at the same time pledged allegiance to IS. In October 2016, al-Qaeda in the Islamic Maghreb (AQIM), with which the rest of al-Murabitun had merged in late 2015, posted a video statement online, said to have been recorded in late September, in which the hostage stated that he was in good health and pleaded to the Romanian government to do everything for his release. The release of the video by AQIM coincided with the faction responsible for the kidnapping reiterating its pledge to IS. Thus, the hostage seems to have become an object of dispute in the conflict between IS and al-Qaeda in the region. Romania reported that the Burkina Faso government did not receive a request for ransom.

In Libya, IS and other militant groups continued to take advantage of the instability of the country and carried on with their terrorist and criminal activities. In March 2016, two Italian employees of a construction company were killed in the area of Sabratha, during a fight between Libyan security forces and their captors. They had been abducted by IS in July 2015 near the towns of Zwara and Mellitah, along with two other Italians who were held in a different location and managed to escape, also in March 2016. IS militants still hold an Austrian and a Czech national, who were abducted in March 2015 from an oilfield in Zalla, along with seven more people from Ghana and the Philippines. In Ghat, south-western Libya, a local armed group kidnapped two Italian employees of a construction company in September 2016 and released them in November. No details regarding their abduction or release have been disclosed.

In the Philippines, the terrorist group Abu Sayyaf continued to carry out kidnappings. In April, its members killed a British-Canadian and in June a Canadian hostage. Both men had been abducted in September 2015, along with a Norwegian and a Filipino, from a resort in the southern Philippines. The Norwegian man remained captive at the time of writing, whereas the Filipino was released in June 2016. Abu Sayyaf militants were also behind the kidnapping of a German man and the murder of his wife while they were sailing off the southern Filipino coast in November. They demanded a ransom of PHP 30 million (EUR 565 000) but consequently killed the hostage. In February 2017, a video was posted online that appeared to show the execution. An Italian citizen abducted by Abu Sayyaf militants in October 2015 in the city of Dipolog was released in April 2016. The hostage was held on the island of Jolo, the stronghold of the terrorist group, where he spent his captivity with other hostages.

In Syria in May, Jabhat Fath al-Sham (former Jabhat al-Nusra) released three Spanish journalists that were abducted near Aleppo in July 2015. The group also claimed it freed a German woman and her baby in September 2016, denying it was responsible for her kidnapping. The woman had been abducted in October 2015. These releases are assessed to be part of the group’s attempts to distance itself from IS practices.

A British journalist held hostage by IS since November 2012 continued to appear in propaganda material. He featured in two IS videos released in December 2016.

2.2. COMMUNICATIONS

The quantity of

IS propaganda decreased in 2016 due to lower production rates and containment of dissemination

IS messages shifted from the rhetoric of victorious Islam, to calls for retaliation for alleged attacks on Islam

Terrorists have an interest in ensuring that their messages reach the audiences that they want to address. As they perceive themselves to be fighting for a legitimate cause, they need to justify their violent actions to supporters and opponents. Public communication is used to attract potential recruits, procure material and financial support, and intimidate opponents. At present, large volumes of people use online services to communicate. Terrorists are compelled to maintain an online presence and compete for visibility with other actors in public communications, including individuals, civil movements, governments, political opponents, and competing terrorist groups.

In 2016 terrorist groups continued to use online services for communication in targeted and diverse ways. Terrorist propaganda was spread primarily through social media platforms and file sharing sites. Encryption and anonymisation technologies freely available online, and a multitude of platforms, enable terrorists to spread propaganda while maintaining their anonymity. However, measures taken by some social media platforms[23] started to have a disruptive effect, in particular on IS communication, with the volume of messaging gradually decreasing in the course of the year. In 2015 IS had devised a strategy to counter the increased suspension of accounts, which relied on posting identical messages through a multitude of accounts[24]. In 2016 this strategy reached its limits as detection capabilities increased.

At the same time, IS and other terrorist groups increased their use of other encrypted social media platforms, most notably Telegram. IS used the platform for networking and dissemination of information among its community of supporters. Telegram is a closed communication space; its contents are not indexed in search engines. As such, it is not suited for outreach to individuals that are yet to be initiated into terrorist ideology. IS supporters use Telegram as a space for preparation, discussion and collaboration as well as a virtual training camp and Massive Open Online Course (MOOC) platform[25]. However, supporters are enjoined by IS to use it as a starting point to move to platforms that have a stronger impact, in particular Twitter and, to a lesser extent, Facebook. IS praised its supporters on Telegram for being part of its propaganda apparatus.

To reach out to audiences beyond closed circles, IS supporters on Telegram organised coordinated campaigns that aimed to flood Twitter and other major social media platforms with messages within minutes of new propaganda items being released. Before the release, IS supporters were told to create Twitter accounts to advertise the new propaganda production. Once published, the item was spread in a great number of messages. To achieve wide dissemination, the messages contained hashtags referring to current events unrelated to terrorism, such as political rallies or sports matches, in languages of regions of interest, including Europe and other Western countries, but also hashtags used by IS opponents in the Middle East. Simultaneously, the original files were replicated from their original source of publication to a great number of download sites to ensure continued availability despite containment efforts made by online service providers.

In addition to the increased difficulties in dissemination, the volume of IS

propaganda production also experienced a setback in 2016. After a peak in mid-2015, the number of new videos produced by IS slowly decreased. In the second half of 2016, the frequency of new releases dropped even further. This seems to indicate that IS’s propaganda apparatus was severely degraded due to the increased pressure on the group in its areas of activity; leading figures in its propaganda apparatus and media production infrastructure in areas under IS control were targeted. The group struggled to counter the loss of iconic leadership figures, propaganda officials and production capabilities, and to maintain the reach of its messages by adapting its communication strategies to use remaining capacities more efficiently.

These losses notwithstanding, IS’s propaganda apparatus remained highly stratified. Its central media outlets continued to be mainly reserved for messages from the central leadership. Their statements were amplified by a second layer of media outlets named after IS’s purported “provinces”. These “provincial” media offices issued videos but also “urgent” messages, generally in picture format, claiming military victories in their area of operation. Starting in 2015, IS’s Arabic weekly news bulletin al-Naba’ (“the news”) acquired increasing importance in 2016 in IS’s attempt to maintain a continued flow of propaganda messages. Initially unattributed, starting in October 2016, al-Naba’ was labelled as an official production of IS’s central media office. The publication focussed on military successes of IS and contained some moralistic or ideological articles. Its primary audience was IS fighters on the ground, and IS published pictures of al-Naba’ being disseminated to and consumed by these. Its subsequent wide dissemination on the internet is likely to be an attempt to create synergies in order to counter diminishing production capacities.

In addition to the officially acknowledged media outlets, IS had several outlets pretending to be journalistic organs, most prominently the A’maq News Agency and al-Bayan Radio. Within IS’s propaganda machinery, these entities have the role of acting as purportedly independent media entities providing information from IS territory. Al-Bayan Radio is an online radio station that issues daily news bulletins in several languages. The A’maq News Agency was created in 2014 to counter reporting by mainstream media opposed to IS, and broadcasts from the conflict area through short media-style messages and videos proclaiming IS military successes. To maintain the appearance of independence, IS did not acknowledge A’maq News as an official media outlet. Official IS publications referred to it as a source, in an effort to elevate A’maq News to the status of an independent information provider. For example, al-Naba’ articles combined information taken from mainstream media with information spread by A’maq News.

Efforts by IS to reach out to non-Arab audiences continued in 2016. During the first half of the year, the al-Hayat Media Centre, an officially recognised IS media outlet specialising in propaganda in languages other than Arabic, continued to publish glossy magazines in English (Dabiq), French (Dar al-Islam), Turkish (Konstantiniyye) and Russian (Istok). These elaborate publications were produced separately, with contents that specifically targeted the respective language community. In mid-2016, these formats were abandoned and seemingly replaced with a new publication named Rumiyah, in reference to the city of Rome which, according to a Prophetic tradition, would be conquered by Islam after Constantinople. Starting in September, Rumiyah was issued in eight, and later 10, languages including English, French, German, Russian and Turkish, on a monthly basis for the rest of 2016 and into 2017. While the magazine perpetuated the glossy style of its predecessors, Rumiyah‘s texts were for the most part translations of articles published previously in Arabic in al-Naba’. To these are added a small number of articles that occur only in one or a few language versions and that serve to adjust the magazine to particular audiences.

Around this network of propaganda entities acknowledged by IS or acting as purportedly independent news outlets reporting from IS areas of operation, there are a number of IS-supporting entities which are not officially recognised as mouthpieces by IS but are left to represent the base of IS supporters. These translate IS propaganda into different languages and produce additional material in different formats, including videos, graphics and texts, with a view to multiplying the messages of the official IS propaganda entities and creating the impression of a large global following. In 2016, it appeared that these IS-supporting media outlets are not as independent or autonomous as the IS leadership would like the general public to believe; they apparently have access to raw footage from IS’s areas of operation and respond to official releases in a speed that suggests central coordination, for example by publishing a video in support of an official publication within less than a day’s interval. In addition, production from these purportedly independent media outlets decreased in 2016 at the same rate as official IS propaganda. To a significant extent, therefore, these entities are part of the centrally coordinated IS propaganda machinery.

As the volume of IS propaganda diminished, al-Qaeda and its affiliates attempted to take advantage of the situation and increased their efforts to reach new audiences. The nominal head of al-Qaeda, Ayman al-Zawahiri, appeared in several video messages in 2016, trying to position al-Qaeda as a credible alternative to IS. This was supported by a multitude of written material published online. Al-Qaeda and its affiliates published new issues of established English glossy magazines, such as Inspire and Al Risalah, with justifications and practical advice for terrorist attacks. Like IS, al-Qaeda also moved increasingly to Telegram to avoid suspension. Some ideologues effectively restricted their activity to the encrypted chat platform.

Jihadist terrorist propaganda

The origins of practically all major jihadist terrorist groups can be traced to regions outside the EU. Consequently, online propaganda is an essential part of their attempts to reach out to audiences in EU Member States, as it enables them to make the link between the grievances of potentially vulnerable people living in the EU with the armed struggle that they conduct in their areas of operation.

Jihadist online propaganda has developed over some two decades. The methods used today are tested and optimised to achieve the greatest possible impact. They have been tailored for specific audiences. This long experience notwithstanding, jihadist propaganda has adapted quickly to new forms of communication and design, most recently incorporating graphical elements and styles copied from youth culture and online gaming, in an attempt to attract younger audiences in particular.

Likewise, the contents of jihadist propaganda vary over time, always aiming to achieve the greatest impact at any given point. Following the claim by IS that it re-established the caliphate, IS propaganda in 2014 and 2015 aimed to create the impression that the group represented victorious Islam. Its main topics were the purported defence of Islam, the creation of an Islamic state under IS leader Abu Bakr al-Baghdadi in his arrogated function of caliph of all Muslims. IS’s claim to success in this endeavour was supported with the display of IS policies that ostensibly guaranteed justice, welfare and services for the population under its control. Videos showed the implementation of social policies, consumer protection, religious education, but also military victories and the execution of enemies.

In 2016 the topics dominating IS propaganda shifted. The most remarkable change was the replacement of the narrative of a victorious Islam, embodied by IS, with one that depicted Sunni Muslims as being under attack by an alleged Western-Jewish-Shi’i alliance that aimed to eradicate Sunni Islam. The IS leadership claims that its fight against its enemies is part of the final battle, detailed in the sources of Islam, in which Islam will prevail on the Day of Judgement. In August 2016, the Dabiq magazine, whose name refers to the location in which Islamic tradition locates the last battle between Good and Evil, claimed that IS was not fighting the West due to its policies but on account of its “unbelief”.

In an effort to suppress and deter any attempt of dissension in territories under its control, IS published a large number of videos showing individuals labelled as traitors and spies for the anti-IS coalition. Other videos showed the killing of members of armed opposition groups fighting against IS. The victims were made to confess deeds that were alleged to be crimes against Muslims and then assassinated, generally by beheading or shooting from a close range. Videos showing these killings used repetition, multiple cameras and slow motion to increase the impact of the killings. In one video published in late 2016, two Turkish soldiers captured by IS in Syria were burnt alive. With regard to the West, IS told its supporters that they were obliged to seek “retributive justice” for attacks perpetrated by the international anti-IS alliance. Muslim scholars opposed to IS were also identified as targets of lone actor attacks. IS also called for the killing of prominent representatives of Sunni Muslims in Europe, including Salafist preachers opposed to it.

In an attempt to restrict access to independent information in areas under its control, in early June 2016 IS conducted a media campaign, including a series of videos, urging people to destroy their satellite dishes and receivers.

IS tried to compensate reports about military setbacks by continuously projecting a propaganda image characterised by a combination of military victories and utopian views of orderly daily life and undisturbed functioning of the administration and services provided under IS rule. That the situation did change, and with it IS’s priorities with regard to recruits, is illustrated by its attitude towards women. In 2016, as in previous years, IS formulated rules for women’s behaviour in areas under its control that aim to give men control over every aspect of their lives. IS expected women to marry IS fighters. They were obliged to obey their husbands, a duty that, IS insisted, also applied to foreign women, who cannot pretend to be privileged because of their travelling to join IS (Hijrah). Women have no right to question their husbands’ decisions in their or their children’s regard. Their principle role under IS is to bear children, keep the household and educate the children to become fighters in line with IS ideology. Women are enjoined to stay at home and not go out without their husbands’ permission. If they do go out, they must cover their body entirely, including face and hands.

Despite this puritanical code of behaviour, IS used the possibility to acquire women as an incentive to attract male fighters. To this end, in 2014 IS declared the re-introduction of slavery, so that IS members could capture or purchase women from the Yazidi community, which had been declared pagans by IS for that purpose. Possibly after the expansion of IS came to a halt in 2015, the supply of women for enslavement decreased. In 2016 IS publications tried to persuade women that polygamy, i.e. the marriage of a man with up to four Muslim women, was the right of men, probably as a means to maintain the sexual stimulus for IS fighters. Another new aspect in IS propaganda targeting women was the request to provide material support to IS from their private property which, contrary to fighting, it described as a form ofjihad that is obligatory for women. In the past, IS had tried to attract recruits with the promise that all their housing and salary needs would be catered for.

Propaganda targeting Western women in principle contained the same messages as for Arab audiences. In addition, however, it tried to give the impression that under IS rule women were able to play more active roles, which is at odds with the proclaimed restrictions on women’s freedom. At the same time, IS propaganda portrayed life in the West as corrupted, denigrating for women and contrary to human nature.

In late 2016, IS added a new topic to its messages to ensure the organisation’s survival: in case of defeat in Syria and Iraq, IS affiliates in other geographical areas should continue the struggle. For example, in a 3 November 2016 speech following the launch of the military campaign to end IS control of Mosul in Iraq, IS leader Abu Bakr al-Baghdadi called upon IS members to be steadfast in the face of the attacks of the anti-IS coalition, describing its members as enemies of Sunni Muslims. He urged IS fighters in areas outside Iraq and Syria to continue the fight, even if the IS leadership was killed, and asked IS sympathisers to move to these regions rather than trying to join the group in Iraq and Syria. In 2016 the most active IS affiliates outside Syria and Iraq with regard to video production were in Libya, Egypt and Afghanistan.

2.3. DEVELOPMENTS

IS under increasing military pressure, losing territory that it used to control in Syria and Iraq

Western Balkan countries

Turkey faced a number of large-scale terrorist attacks

Political instability and insecurity in Lybia continued in 2016

AQIM carried out a series of attacks on hotels popular with Western citizens in Mali, Burkina Faso and Ivory Coast. Jihadist terrorists also attacked Western citizens in the Middle-East and North-Africa (MENA) region, including in Egypt, Jordan and Lybia

The conflict in Syria has had an enormous resonance in Albania, Bosnia and Herzegovina, Kosovo, the former Yugoslav Republic of Macedonia and Serbia. More than 800 FTFs have so far travelled to Syria to join the armed conflict from the countries of the Western Balkans. In some parts of the Western Balkan region, radical Islamist ideology promoted by radical preachers and/or leaders of some salafist groups, challenging the traditional dominance of moderate Islam in the region, has gained considerable ground. Bosnia and Herzegovina, the so-called Sandzak region (between Serbia and Montenegro), Albanian-speaking territories in Serbia and the former Yugoslav Republic of Macedonia, Kosovo, and Albania until recently were considered the main hotspots for radicalisation, recruitment, and facilitation activities of FTFs destined for Syria. The region has also been a well-established and recognised travel route to and from conflict zones in the Middle East.

Common battle experiences amongst Western-Balkan FTF returnees may cross-cut ethnic and national boundaries after their return home and may pose a significant threat to the region.

The presence of illegal weapons, especially small and light weapons, as well as mines and explosive devices is a significant security issue in the Western Balkans. Available data do not corroborate media reports on the existence of so-called “training camps” in the region similar to those allegedly present in Syria, aimed at providing combat training.

The number of arrests made across the region in recent years attest to the fact that the primary terror threat to the region has been, and will continue to be, jihadist terrorism - represented by both returnees from the conflict zone in Syria and Iraq, and home-grown radicalised and inspired individuals. In November 2016 competent authorities of Albania, Kosovo and the former Yugoslav Republic of Macedonia prevented the occurrence of two terrorist attacks planned to be committed on their territories, with 19 arrests in Kosovo and six in Albania and the former Yugoslav Republic of Macedonia. The attacks, allegedly intended to simultaneously target a football match in Albania (between Albania and Israel) and a target in Kosovo, are believed to have been planned and directed from Syria. TATP, firearms and electronic equipment were seized in police raids.

The level of threat posed by extreme leftwing, anarchist and extreme right-wing terrorism in Western Balkan countries appears to be insignificant compared to religiously motivated terrorism (primary threat) and ethno-nationalist and separatist terrorism (secondary threat) in the region.

Caucasus

IS claimed responsibility for several attacks in Dagestan in 2016.

IS Caucasus province tried to persuade people to fight in the Caucasus, rather than travel to Syria.

IS claimed an attack by two individuals on

17 August in Balashikha near Moscow on a Russian traffic police outpost. They had sent a video to A’maq News in which they explained that they were acting on IS orders to strike with whatever means available. They claimed to act in revenge for the killing of Muslims in Syria and Iraq.

North America and Australia

The US faced a number of lone actor attacks in 2016. The most severe attack took place on 12 June, when the perpetrator stormed a nightclub in Orlando, Florida, killing 49 people and taking hostages. In telephone calls to the emergency number, the attacker, who was subsequently killed by police, is reported to have pledged allegiance to IS. While questions about his motivations persist, A’maq News described him as an “Islamic State fighter”.

Two other attacks in the USA were claimed by IS. On 17 September, a man stabbed and injured 10 people in a shopping mall in St Cloud, Minnesota. The attack was claimed by IS through A’maq News. On 28 November, an attacker rammed a car into a group of students at Ohio University, Columbus, Ohio, before attacking them with a knife. A total of 13 people were injured. The attack was claimed by IS through A’maq News.

Additional attacks that were not claimed by IS included two bomb attacks on 17 September in Seaside Park, New Jersey, and New York City, respectively. Whereas the first attack did not cause casualties, in the New York attack, 29 people were injured when a pressure cooker bomb exploded in a busy street. Another device was found nearby unexploded. On 18 September, an explosive device found in a train station in Elizabeth, New Jersey, exploded during an attempt to disarm it, causing no injuries. The individual believed to have carried out these attacks was arrested. This series of attacks was not commented on by IS, but it was praised, together with the St Cloud attack, in AQAP’s Inspire magazine, published in November 2016. Another lone actor attack was carried out on

7 January, when a police officer in Philadelphia was shot and injured by an individual pledging allegiance to IS. IS did not claim the attack. In addition to the attacks in the US, on 27 October, a security officer was stabbed outside the US embassy in Nairobi (Kenya). This attack was also claimed by IS through A’maq News.

In Canada, police in Strathroy, Ontario, killed a man planning to carry out a suicide attack using an IED on 10 August.

In November, a prominent Islamic State militant of Australian origin, who was thought to have been killed in an air strike in Iraq, was arrested in Turkey. In December, police arrested five men suspected of planning a terrorist attack in Melbourne on Christmas Day.

Syria/Iraq

In 2016 IS came under increasing military pressure, losing territory that it used to control in Syria and Iraq.

In Syria, the city and historic sites of Palmyra (or Tadmur in Arabic), which were captured by IS in 2015, were re-taken by the Syrian regime in March 2016 before briefly being re-captured by IS in December. An IS attack in December at a Crusader castle in the town of Karak in Jordan killed 10 people, including a Canadian tourist.

In Iraq, IS lost strategic towns such as Ramadi in February and al-Falluja in June. The campaign to expel IS from Mosul was launched in October.

Several high-ranking IS leaders and propaganda officials were killed in 2016, including the official IS spokesman Abu Muhammad al-Adnani in August. IS media production infrastructure was reportedly destroyed in Mosul.

Both in Syria and Iraq, IS continued destroying cultural heritage. Further destruction was reported from Palmyra. In June 2016, IS destroyed the 2800-year-old Nabu temple at the archaeological site of Nimrud near Mosul.

In Syria, the civil war entered its sixth year in 2016. Several attempts by the UN and other international actors to reach a lasting ceasefire, all of which excluded IS and Jabhat al-Nusra (“support front”), al-Qaeda’s official affiliate in Syria, were unsuccessful. The regime continued to receive military support from Shi’i militias, Iran and Russia. IS, while on the defensive, continued to fight the regime and armed opposition forces. Thus, the Syrian armed opposition is locked in a two-front war against the regime on one side and IS on the other. Turkey sent troops into Syria in August to push back IS militants and Kurdish-led rebels from a section of the two countries’ border, in cooperation with a number of Arab opposition factions.

Syrian opposition forces consist of a multitude of groups of different orientations with varying degrees of cooperation. The core of the Free Syrian Army (FSA) still seems committed to a secular model of society. It cooperates with groups of Islamist orientation, but rarely with jihadist factions. This notwithstanding, in the course of the escalating conflict, in particular in the wake of Russia’s military intervention in support of the Syrian regime, the armed opposition in general has increasingly referred to Sunni concepts related to jihad and, in light of the support by Iran and Shi’i militias, adopted anti-Shi’i rhetoric.

In late July, Jabhat al-Nusra changed its name to Jabhat Fath al-Sham (“Levant conquest front”), declaring that it was an organisation without ties to any external organisation. This disassociation from al-Qaeda was likely done to eschew being labelled as a proscribed terrorist organisation. In addition, the move was designed to facilitate the group’s cooperation and integration within the Syrian armed opposition. In a speech in late August 2016, the nominal head of al-Qaeda, Ayman al-Zawahiri, promoted the idea of creating a unified council in Syria that would decide disputes among “mujahidin”. A model for such a council was Jaysh al-Fath (“conquest army”), a coalition of fighting groups including the former Jabhat al-Nusra, which took control of Idlib in northern Syria in 2015. In 2016 jihadist ideologues and Jabhat Fath al-Sham promoted, with some success, the creation of Jaysh al-Fath in Aleppo, which acted alongside an FSA alliance in the opposition-controlled sections of the city during the siege by regime forces. In mid-

December, however, regime troops and militias took control of the last sections of the city that had remained under opposition control. The defeat led to new efforts to unite the Syrian armed opposition. The main point of contention was whether a merged opposition force should include Jabhat Fath al-Sham[26].

Turkey

Turkey faced a number of large-scale terrorist attacks in 2016, several of them attributed to jihadist groups, thereby continuing a series of attacks that started in mid-2015. On 12 January, a suicide attacker detonated an IED in the central historic district of Istanbul, killing 13 tourists, 12 of them German citizens. Turkish government sources attributed the attack to IS. In March, another suicide attack using an IED in a central shopping street in Istanbul killed four, including three Israeli citizens. In June, three suicide attackers killed 45 people at Istanbul airport. Another attack targeted a wedding in Gaziantep on 20 August, killing at least 50, including many children. The attack was attributed to IS. On 31 December, an attack targeted a nightclub in Istanbul, killing 39. The attack was claimed by IS. The perpetrator, reportedly an ethnic Kyrgyz with links to IS, was arrested.

Following Turkey’s military intervention in Syria in August, IS propaganda increasingly singled out Turkey as a major enemy of Islam and an ally of the West. IS insisted that dominant Muslim currents in Turkey deviated from true Islam and, consequently, have become legitimate attack targets.

Whereas in 2016 IS propaganda activity in the Turkish language faced the same challenges as that in Arabic, several internet sites in Turkish, which acted as news portals, were openly supportive of jihadist groups in Syria, including Jabhat Fath al-Sham, and al-Qaeda in general.

On 19 December, the Russian ambassador to Turkey was murdered by a Turkish national in Ankara. Jabhat Fath al-Sham denied responsibility, saying that the murder was a “natural reaction” to Russia’s interference in the Syrian war.

Other attacks, including a 10 December attack using a car bomb in Istanbul killing 38 people and a November attack by car bomb in Adana killing two, were not claimed or attributed.

Egypt

In 2016, IS “Sinai province”, the IS affiliate in Egypt’s Sinai Peninsula, continued perpetrating terrorist attacks mainly targeting Egyptian security forces. In addition, IS tried to expand its area of operation beyond Sinai. For example, in January, a series of small-scale attacks targeted Egypt’s tourism industry. On 7 January a tourist bus was shot at in front of a hotel in Cairo without casualties. The following day, two men armed with knives attacked a tourist hotel in Hurghada, injuring three people. On 9 January, two policemen were killed in Giza. The attacks in Cairo and Giza were claimed by IS.

A suicide attack on a Coptic cathedral in Cairo on 11 December was claimed by an Egypt-based affiliate of IS, however without explicit reference to its Sinai branch. The attack killed 25 people, mainly women and children.

The cause of the crash of an Egyptian aeroplane travelling from Paris to

Cairo with 66 people on board on 19 May remained unknown at the time of writing.

Libya

In North Africa the continued instability in Libya and the prospect of a large number of IS fighters of North African origin returning to their home countries remained a source of concern. The region witnessed the competition for dominance between al-Qaeda-linked groups and IS. This was illustrated in a series of videos published simultaneously in January 2016 by “provincial” media outlets, including IS Algeria province which emerged from a splinter group of al-Qaeda in the Islamic Maghreb (AQIM)[27]. In the videos IS tried to specifically attract people from North Africa, with several of the videos targeting al-Qaeda followers in the region, calling on them to pledge allegiance to IS.

In Libya, political instability and insecurity continued in 2016 despite the creation of a joint Presidency Council in the Libyan capital Tripoli in March 2016, which was tasked with forming a unity government comprising the two existing governments in Tripoli in western Libya, and Tobruk and al-Bayda in eastern Libya. In addition, the forces of General Khalifa Haftar, who rejected the agreement, extended the territories under their control beyond Benghazi, seizing much of the oil-rich Gulf of Sirte in September. The competition for control over Libya’s natural resources is expected to continue fuelling tensions between the different competing factions.

Meanwhile, in early December, forces loyal to the unity government took complete control of Sirte. IS had seized the city in early 2015, at one point controlling some 300 km of the Mediterranean coastline. The campaign against IS started in May 2016, supported by US airstrikes starting in August. IS had already lost the eastern Libyan coastal town of Darna in 2015. It was able to maintain a presence in suburbs of Benghazi for much of 2016, before being defeated there by Haftar forces.

The number of IS fighters in Libya reportedly increased twofold from 2015 to 2016, reaching between 4000 and 6000 by April 2016. However, the forces were described as less successful in seizing territory and apparently comprised very few local fighters. IS carried out several large-scale terrorist attacks in Libya in 2016. These included a lorry bomb attack on 7 January, which killed dozens at a police training centre in Zliten. The attack was claimed by IS Tripoli province. On 21 January IS attacked Ras Lanuf oil terminal, setting oil storage tanks ablaze.

After the decline of its affiliate Ansar al-Shari’a (“shari’a supporters”) in Libya, parts of which had joined IS, al-Qaeda tried to maintain its influence in Libya. For example, in January 2016, al-Qaeda in the Islamic Maghreb (AQIM) released a recording in which it accused Italy of occupying the Libyan capital Tripoli (referring to an Italian general, who is the senior military advisor for UNSMIL in Libya). In an audio statement released on 9 October, AQIM’s leader Abu Mus’ab Abdulwadud called upon Muslims in Libya to unite against secular forces. In particular, he exhorted all Muslims to oppose Khalifa Haftar’s aggression in Benghazi. The group denounced the alliance between local secular groups, including Haftar’s Libyan National Army, and international actors (Egypt and UAE).

The Libyan crisis continued to affect neighbouring countries, in particular Tunisia. On 7 March, a massive attack on Tunisian police and military in Ben Guerdane on the Libyan border killed 45 people, including 28 attackers. IS was suspected to have carried out the attack. Tunisia fears that the return of thousands of foreign fighters from conflict areas, and extraditions from Europe, will have a destabilising effect on the country.

Sahel

In late 2015 and 2016, AQIM carried out a series of attacks on hotels popular with Western citizens in Mali, Burkina Faso and Ivory Coast. AQIM claimed that the attacks targeted locations used for espionage and conspiracies against Muslims. This string of attacks from north to south in West Africa likely aimed to increase the group’s relevance in the region in the face of the IS challenge. After an attack on a hotel in the Malian capital Bamako on 20 November 2015, which was claimed by al-Murabitun in cooperation with AQIM[28], a similar attack on a hotel took place in Ouagadougou, capital of Burkina Faso, on 16 January 2016. The attack was claimed by AQIM in a 17 January statement. On Telegram, the attack had earlier been attributed to al-Murabitun, which had joined AQIM in December 2015. On 13 March 2016, another group of terrorists attacked a tourist resort near Abidjan, capital of Ivory Coast, killing 19. The attack was claimed by AQIM in a statement issued the same day.

AQIM increased its propaganda output targeting Sahel countries in 2016. It adopted propaganda styles developed by IS. For example, AQIM issued videos showing the killing of alleged spies, accused of working for France, albeit without the same amount of graphic detail.

Its messages to local populations, however, differ notably from those of IS. Rather than threatening Muslims with accusations of unbelief if they fail to join the group, AQIM purported to defend the interests and lives of the Muslim population, while punishing “corrupt” governments for their collusion with foreign powers against Muslims. Western companies were labelled as legitimate targets for their alleged exploitation of the Muslim population and the pollution of Muslim land. For example, in March, AQIM claimed responsibility for a rocket attack on a gas plant in Algeria jointly run by BP and Statoil, saying it was part of its “war on the interests of the Crusaders”. In a May statement, AQIM claimed an attack on the uranium mine in Arlit, Niger, operated by French company Areva. It then reaffirmed its intention to strike French targets.

In Mali, AQIM continued to claim attacks on Malian, French and MINUSMA[29] troops in 2016 and to incite people to fight or support the fight against the Malian government, alleging that the latter brought French troops to the country. In an 8 July audio message, the head of AQIM’s Sahara division called upon Muslims in Mali to fight against France. He referred to the powerful role France still played in its former colonies. Several Western hostages were held by AQIM in Mali in 2016, including a Swedish and a South African citizen and a Swiss woman.

Since late 2015, the enemies of the UN mission in Mali, including AQIM and Ansar al-Din (“supporters of the religion”, Ansar Dine), increased their cooperation, for example by exchanging expertise in IED production and modus operandi. In several attacks in 2016, UN troops and Mauritanian soldiers were killed. These included a joint attack by AQIM, Ansar al-Din and another local group on 21 July on a military post in Nampala near the Mauritanian border, which killed at least 17 Mauritanian soldiers.

The competition between AQIM and IS, which in 2015 led to a split within al-Murabitun[30], continued in 2016. In late October, IS’s A’maq News publicised a repetition of the pledge of allegiance by al-Murabitun’s IS-leaning faction to the IS leadership. As mentioned above, immediately after this, AQIM released a video showing a Romanian hostage supposedly held by the IS faction. Whereas the faction was not officially integrated into IS’s system of “provinces”, several attacks in the Sahel region in the last quarter of 2016 were attributed to this IS branch. In Nigeria, jihadist militia Boko Haram, which had pledged allegiance to IS in March 2015, changing its name into IS’s “West Africa province”[31], split in early August 2016 when IS’s al-Naba’ newsletter introduced Boko Haram’s former spokesman as the new “governor” of

the “province”. The leader of Boko Haram, Abubakar Shekau, rejected the appointment, insisting that he remained in charge. In late December, the Nigerian army claimed having defeated Boko Haram militarily. In a reply, Abubakar Shekau denied that the group had been driven from its stronghold in the Sambisa Forest in north-eastern Nigeria.

Arabian Peninsula comprising local dignitaries. Despite being driven from al-Mukalla in May 2016, AQAP continued its activities in the region, often blending into the local population.

Compared with AQAP, IS has a rather small following in Yemen. Being primarily present in urban areas, in particular Aden which was occupied by Houthi forces in 2015, it claimed a number of attacks on Houthi and Hadi government targets, including several suicide attacks by VBIEDs in Aden in May, June and December 2016.

In Saudi Arabia, IS was accused of being behind a series of bomb attacks in early July. On 4 July a suicide attacker detonated his explosive belt near the US consulate in Jeddah, when approached by police. The affiliation of the individual remained unknown at the time of writing. On the same day, a similar attack took place near the Prophet’s Mosque in Medina, in which the attacker and four security staff were killed. A third bomb attack in the eastern majority Shi’i city of Katif killed only the attacker.

Somalia/Kenya

Harakat al-Shabab al-Mujahidin (HSM, “mujahid youth movement”) continued activities in Somalia and reaching out to Kenya. Although it had previously lost control of urban centres, in 2016 it perpetrated at least seven large-scale terrorist attacks on restaurants, hotels and markets in Mogadishu, several of which combined the explosion of an IED with a subsequent ambush using firearms. Similar attacks were perpetrated in other cities. On 14 January, HSM attacked AMISOM troops in southern Somalia, killing a large number of soldiers. A 27 July HSM suicide attack on the AMISOM headquarters in Mogadishu killed at least seven people. In addition, HSM perpetrated two attacks on residential compounds in Mandera, north-east Kenya on 6 and 15 October, killing 6 and 12 people respectively. In January HSM published a video showing the killing of a Ugandan soldier.

A faction that split from HSM in Somalia in October 2015 and pledged allegiance to IS[32] continued its activities despite attempts by HSM to suppress it. The group, whose numbers probably do not exceed 200, has not been officially recognised by IS. Nevertheless, in late October 2016 it succeeded in taking control of the coastal town of Qandala in Puntland, from which it was expelled in late December. Another split-off from HSM, using the name Jahba East Africa and reportedly consisting of former HSM members from Kenya, Tanzania and Uganda, pledged allegiance to IS in April 2016. The same month, the group attacked an AMISOM convoy in Somalia.

An IED exploded in an aeroplane of a local airline during a flight from Mogadishu to Djibouti on 2 February. The detonation ripped a hole in the skin of the aircraft; the alleged perpetrator died when he was sucked out of the passenger compartment. The pilot managed to perform an emergency landing. Reportedly, the individual was originally booked on a Turkish Airlines flight. The attack was not claimed by any group.

South-east Asia

In Afghanistan, since NATO forces withdrew from Afghanistan by the end of 2014, the Taleban have expanded the territory that they control. In 2016, their offensives were focused on the provinces of Baghlan in the north and Helmand and Uruzgan in the south. In March, the Taleban announced that they were preparing to capture major cities in Afghanistan. In mid-April and again in October, they started offensives to retake Kunduz, which they had briefly captured in late September 2015. In late October, they blocked the connection between Kabul and the southern city of Kandahar. In addition, the Taleban claimed a significant number of large-scale terrorist attacks, many of which targeted military and security forces. Several attacks combined the use of VBIEDs with an ambush using firearms. By contrast, the Taleban denied responsibility for the explosion of an

IED hidden in a motorcycle on a market in Badakhshan province on 20 June.

Several attacks on Western targets were claimed by the Taleban. On 20 June, a suicide attack by a PBIED targeted Nepalese security personnel working for the Canadian Embassy in Kabul. The attack, which killed 14 people, was claimed by the Taleban. On 1 August, the Taleban carried out a lorry bomb attack on a hotel in Kabul popular with Western citizens. One policeman and three attackers were killed. On 24 August, the American University of Afghanistan was attacked by several armed fighters, some reportedly wearing suicide vests. Hundreds of students and foreign teachers were taken hostage for 10 hours. Seven students, two university security guards and three policemen were reportedly killed. The attack was attributed to the Taleban but not claimed by the group. On 10 November, the Taleban attacked the German consulate in Mazar-e-Sharif in northern Afghanistan with a VBIED and possibly firearms. The German consulate personnel remained unharmed, but six people were killed and many injured, most of them civilians present at the site. The Taleban claimed the attack, saying that it was revenge for a US attack on Kunduz. On 12 November, a PBIED suicide attack targeted a sports event inside the US military base on Bagram Airfield near Kabul on 12 November.

The attack killed a total of 5 US citizens. The attack was claimed by the Taleban.

In 2016, the IS affiliate in Afghanistan (“Khorasan province”) increased its attacks in particular in the east of the country. On 23 July, two simultaneous IED explosions killed around 100 people in Kabul, mainly of the Shi’i Hazara ethnic minority. The attack was claimed by IS through A’maq News. On 11 October, three armed individuals attacked a Shi’i shrine in Kabul during a religious ceremony, killing 14 people. The attack was attributed to IS. Responsibility for a suicide attack on 19 April, on the headquarters of the Afghan intelligence service in Kabul which killed at least 64 people, was disputed between the Taleban and IS.

Three Australians and one US citizen were kidnapped in Afghanistan in 2016. In April, an Australian charity worker was abducted by unknown militants in Jalalabad and was released 4 months later. In August, the Taleban abducted a US and an Australian citizen in Kabul. The two victims were academics working at the American University of Afghanistan. In November, another Australian, working at a non-governmental organisation, was kidnapped in Kabul. The three hostages remained in captivity at the time of writing.

The Taleban leader was killed in Pakistan’s Baluchistan province in May 2016. A successor was appointed by the Taleban’s Shura Council within days.

Pakistan continued to suffer terrorist attacks in 2016, which targeted universities, security forces and religious minorities. These were carried out by local jihadist groups, Taleban offshoots or alleged IS affiliates. In Bangladesh, 20 people, including 18 foreigners, were killed in an attack on a bakery located near diplomatic representations in Dhaka on 1 July. A claim of responsibility by IS was dismissed by government sources, which attributed the attack to Jamaat-ul-Mujhaideen. Nevertheless, the attack was celebrated by IS in the October issue of Rumiyah. In Indonesia, IS claimed an attack on “a gathering of citizens of the Crusader coalition, which fights the Islamic State” in Jakarta on 14 January. The attack, which was carried out using several simultaneously-detonated IEDs and firearms, killed at least eight people. One Dutch UN employee was injured.

3. ETHNO-NATIONALIST AND SEPARATIST TERRORISM

foiled, failed and completed attacks carried out labeled as ethno-nationalist and seperatist terrorism.

Dissident Republican groups

In 2016 Dissident Republicans were involved in 76 failed, foiled and completed attacks, of which four were carried out using improvised explosive devices, including one in March in which a prison officer was killed. The police, prison officers and members of the armed forces in North Ireland remain the primary targets.

There are three main violent Dissident Republican groups in Northern Ireland: the Continuity IRA (CIRA), the new IRA and Oglaigh na hEireann (ONH). All mentioned groups retain access to a range of firearms and explosive devices, including undervehicle IEDs. A total of 123 people were arrested in 2016 for terrorism-related offences.

In May 2016, the threat level in the UK for terrorism related to Northern Ireland was raised from ‘moderate’ to ‘substantial’, which means an attack is a strong possibility.

PKK (Kongra Gel)/KCK

A number of incidents targeting Turkish institutions, cultural premises and properties occurred in several EU Member States.

Five IED attacks against Turkish government buildings and cultural associations were reported by France. Belgium also reported incidents between Turkish and Kurdish groups involving the use of arson and explosives.

Germany reported various incidents. A significant number occurred in the context of demonstrations for or against the PKK. Turkish properties and institutions were damaged by incendiary devices. In one arson incident, the damage amounted to at least EUR 2 million. In August in Nuremberg, three participants were injured during a fight, in which at least one was stabbed.

Belgium, France, Germany*, Italy, Romania and Switzerland reported that the PKK continued its fundraising, propaganda and recruitment activities. In France it operated a legal front, which includes the Conseil Kurde de France (CDK-F) and the Centre d’information du Kurdistan (CIK); and a clandestine branch aimed at collecting funds, using violence in some cases. In France alone, the fundraising campaign is believed to have yielded EUR 5.3 million. Italy reported recruitment among Kurdish migrants to join Kurdish militia in conflict zones or to become PKK activists in Europe.

In addition, Switzerland stated that the PKK were maybe running a number of ideological training camps for its youth in remote pre-Alpine areas during the second half of 2016.

FIGURE 8

Number of suspects arrested for etno-nationalist and separatist terrorism in EU

Member States in 2016

ARRESTS

ATTACKS

18 36

5 31

Euskadi ta askatasuna (ETA)

Liberation Tigers of Tamil Eelam

Since ETA announced its ceasefire in October 2011, it released a series of communiques to confirm its separatist objectives, aligned with the strategy of the Basque separatist left-wing Izquierda Abertzale movement; its activities were focused on propaganda and controlling the sealing of its arsenals.

Five separatist terrorist actions of sabotage were reported in 2016 by Spain, compared to 18 in 2015; these actions are attributed not only to Izquierda Abertzale, namely the youth group Ernai, but also to dissident groups within this movement. In 2016, a senior ETA leader was arrested and a significant amount of weapons and explosives were seized in Spain. France and neighbouring countries continue to be used by ETA for hiding operatives and weaponry.

Switzerland reported that, in July 2016, 13 defendants associated with the Liberation Tigers of Tamil Eelam (LTTE) were indicted on charges of supporting and/or being members of a criminal organisation, fraud, false certification and money laundering. The suspects are accused of having provided financial support to the LTTE through a sophisticated credit system. Members of the community were persuaded to enter into credit contracts and pass on the funds to the LTTE’s Swiss branch and front organisations. This systematic and rapid scheme allowed them to obtain money from the Tamil diaspora in Switzerland. Investigations showed that substantial sums (around CHF 15 million) were obtained using this system as well as through donations and extortion. These funds, together with money collected abroad through similar schemes and transported to Switzerland by couriers, were to be later funnelled abroad to fund the purchase of weapons in Sri Lanka.

4. LEFT-WING AND ANARCHIST TERRORISM

Numbers of attacks of left-wing and anarchist terrorists increased in 2016 compared to 2015

Left-wing and anarchist activities included riots, arson attacks and attacks with explosives, criminal damage and spreading propaganda

Terrorist attacks and suspects arrested

In 2016, left-wing and anarchist terrorist groups or individuals in the EU carried out 27 attacks. This was a sharp increase, compared to the number of attacks that occurred in 2015. EU Member State authorities arrested 31 people related to left-wing and anarchist terrorism in 2016, most of them in Spain.

Italy, Greece and Spain were again the only EU Member States to experience left-wing and anarchist terrorist attacks. Over the past two decades, anarchist terrorist groups in these three countries have developed similar characteristics, used the same modi operandi and endorsed similar agendas. In 2016, there were no coordinated terrorist campaigns across the three countries. However, it is assessed that some attacks in Italy were carried out in response to a call for action by imprisoned anarchist terrorists in Greece.

In Italy in 2016, a total of 16 attacks were carried out by leftwing and anarchist terrorist groups. Although the incidents increased in number compared to 2015, it appeared that the operational capabilities of the groups remained low. The majority of the attacks in 2016 were carried out using unsophisticated improvised incendiary/explosive devices (IID/IEDs), containing flammable liquids or gunpowder and crude ignition mechanisms, some of which failed to operate. Eight people were arrested on charges related to left-wing and anarchist terrorism.

Italian anarchist terrorist groups targeted facilities related to the management of migration-related issues in general; and to the function of the Identification and Deportation Centres (CIE) in particular. Five victim-operated improvised explosive devices (VOIEDs, parcel bombs) were sent between February and September to travel agencies and companies related to the CIEs, without causing injuries or damage.

Italy also experienced the re-emergence of Federazione An-archica Informale/Fronte Rivoluzionario Internazionale (FAI/ FRI, Informal Anarchist Federation/International Revolutionary Front). In January for example, its Pyrotechnical Committee for an Extraordinary Year cell placed an IID outside the Courthouse of Civitavecchia in Rome, causing damage.

In June, two VOIEDs were sent by the Danaus Plexippus FAI/ FRI cell: one was addressed to the European Food Safety Authority in Parma and was detected by security personnel; the other was sent to a private biotechnology company and caused minor injuries to the firm’s owner. A FAI/FRI cell is also believed to have placed an IED outside a Carabinieri Station in Bologna that caused damage to the building.

In Greece, it appears that left-wing and anarchist terrorist groups have retained their operational capabilities as well as their access to weapons. In 2016 they carried out six attacks involving the use of IEDs, firearms and grenades. In October, Synomosia Pyirnon tis Fotias (Conspiracy Cells of Fire) placed an IED outside the residence of a prosecutor in Athens. The powerful explosion caused significant damage. The Organosi Epanastatikis Aftoamynas (Revolutionary Self-Defence Organisation) adopted a more international scope in its attacks. It targeted two foreign embassies in Athens: in July, its members carried out a drive-by shooting against the Embassy of Mexico and caused minor damage to the building; in November, they threw a hand grenade at the Embassy of France, slightly injuring the police officer guarding the premises.

In Spain, left-wing and anarchist terrorist activities remained at low levels. Five attacks occurred in 2016 but did not involve extensive operational planning or the use of sophisticated IEDs or firearms. Notwithstanding this, 19 people were arrested in relation to left-wing and anarchist terrorism. The number of arrests in the country has remained consistently high, with a total of 100 people arrested since 2013. This has apparently had an impact on operational capabilities, mainly of the anarchist terrorist groups, causing a decrease in the number of attacks over the same period of time.

Of interest is that members of Spanish extremist groups adhering to communist ideologies joined Kurdish militias in Syria and Iraq, and were actively involved in combat activities against the so-called Islamic State (IS). It remains to be seen how their participation in the conflict will affect their activities on Spanish soil.

Marxist-Leninist terrorist groups in the EU have ceased to be operational and limit their activities to propaganda. However, the Turkish Devrimci Halk Kutrulus Partisi/Cephesi (DHK-P/C, Revolutionary People’s Liberation Party/Front) remained active in Turkey and carried out five attacks, targeting police, judicial and government employees. The DHKP/C has never conducted attacks in the EU but retains a network in several EU Member States that provides financial and logistical support to operatives in Turkey. Its structures in the EU operate partially under the cover of legally established associations. In 2016, one Dutch citizen was arrested in Germany on charges of terrorism financing connected to the DHKP/C.

Violent extremist activities

In 2016, left-wing and anarchist extremist groups and individuals remained a public order threat in a number of EU Member States. Their activities included riots, arson attacks, criminal damage and spreading propaganda. Left-wing and anarchist extremists continued to take advantage of lawful demonstrations to launch violent attacks against governmental property and law enforcement. Anarchist groups and individuals tended to be more violent than those belonging to left-wing extremist movements.

Anarchist and left-wing extremist activities largely take place in urban milieu. In several cities in the EU, anarchists and left-wing extremists prefer to reside in specific areas. In these zones, they have established squats and “community centres”, where they plan and organise actions. Extremists are also very active in and around universities, where they can find opportunities for recruitment.

Arson campaigns continued to occur in EU Member States with active anarchist communities. Groups and individuals employed unsophisticated IIDs or flammable liquids to torch their targets. In Germany, for example, anarchist extremists carried out numerous arson attacks in 2016, mainly targeting police and private vehicles on the streets. Belgium experienced similar problems with arsons of cars and cell-phone masts. In Greece and Italy, anarchists are believed to be behind a number of incendiary attacks on vehicles and property as well as on banks.

Apart from traditional means of propaganda, such as graffiti and leaflets, anarchist and left-wing extremists have extensively made use of the internet. Numerous websites, blogs and social media accounts provided “alternative news”, translated communiques, conveyed messages of imprisoned extremists and disseminated propaganda material. There were no changes in the themes of anarchist and left-wing extremist propaganda in 2016. The main subjects remained the criminal justice system, politicians and political parties, the refugee crisis, socio-economic issues and the activities of right-wing extremists.

In 2016, left-wing and anarchist extremists continued to travel around Europe to participate in violent and non-violent acts. For example, the “No Border Camp” which took place in Thessaloniki (Greece) in July, attracted left-wing and anarchist extremists from all over the continent. Their actions included violent riots and clashes with police forces in the city of Thessaloniki, as well as in rural areas in northern Greece. In addition, anarchists from Belgium were arrested in Germany, France, Finland and Switzerland for participating in riots and arson attacks. A French extremist was arrested in Germany, in execution of an international arrest warrant on charges related to participation in violent riots.

FIGURE 9

FIGURE 10

Number of suspects arrested for left-wing and anarchist terrorism in EU Member States in 2016

ARRESTS

ATTACKS

5. RIGHT-WINGTERRORISM

PQft Right-wing extremist activities primarily carried out by i ‘ individuals, or loosely coordinated networks or groups .£^1 Migration and the perceived threat from Islamisation are key topics on the agenda of right-wing extremists

Terrorist attacks and suspects arrested

For 2016 the Netherlands reported an incident which was classed as an act of right-wing terrorism. This marks a significant decrease compared to 2015, when a total of nine right-wing terrorist attacks were reported by France and Greece. Poland, Germany and the Netherlands reported a total of 12 arrests related to right-wing terrorism.

In February 2016 six individuals were arrested in connection to an arson attack on a mosque in the Dutch city of Enschede. At the time of the attack several people were inside the mosque. They detected the fire which was extinguished quickly and nobody was injured. The group was charged with attempted arson with terrorist intent. The court later decided this was a terrorist attack. Four attackers were sentenced to prison terms of several years. This decision marked the first (failed) right-wing terrorist attack in the Netherlands and the first terrorist attack in 12 years.

Germany stated that after the investigation into the National-Sozialistischer Untergrund (NSU, National Socialist Underground) in 2011, additional investigations into groups such as the Old School Society in 2015 and Gruppe Freital (Freital Group) in April 2016 demonstrated that the formation of right-wing terrorist structures cannot be excluded. With regard to Gruppe Freital, police searched 20 houses in the federal states of Saxony and Mecklenburg-West Pomerania in April. Five suspects were arrested and charged with membership of a terrorist organisation, attempted murder and the detonation of two explosive devices at two asylum seeker homes in Freital, as well as another one at an ‘alternative living project’ (commune) in Dresden.

Violent right-wing extremism

Similar to previous years a majority of EU Member States have no indication that terrorist methodologies or tactics have been adopted by their right-wing scenes and considered the threat from (violent) right-wing extremism (RWE) to be low. The scene is described by most Member States as fragmented, lacking consistent leadership and organisation, and suffering from internal conflict. However, in some EU Member States the right-wing extremist scene increased its activities to a level causing concern to authorities. Confrontations with political opponents continued and xenophobic offences became more violent.

Numerous RWE-motivated attacks have been committed by loosely coordinated networks/groups or individuals not necessarily linked to a known RWE group or party. This underlines the threat from lone actors and small groups in or outside the scene.

According to national statistics for 2016, almost 50% of all known RWE individuals in Germany are prone to violence. This is mirrored in the increased numbers of attempted murder offences[33] as well as the use of incendiary and explosive devices[34] against migrants and migrant shelters throughout the reporting period[35]. In addition, it was stated that Germany faces an increasing amount of first-time offenders who were previously unknown to authorities as extremists[36].

The crimes against asylum accommodation have at times shown the modus operandi of a well-organised group, however they have predominantly been committed by individuals and small groups. A high number of perpetrators of these attacks remain unknown.

Migration and Islamophobia

The migration phenomenon affecting the European continent and the perceived threat from Islamisation remain key topics on the RWE agenda and have been used by the right-wing scene to induce public opinion to adopt its xenophobic and Islamophobic position. These topics are exploited to spread fear and concern. Events such as the Paris attacks in 2015, Brussels and Berlin in 2016, as well as the sexual assaults during New Year’s Eve 2015/2016 in Cologne, serve as justification for xenophobic offences. In addition, the Netherlands and Germany reported cases of vigilantes (showing affinity with the right-wing scene) who claimed that the authorities were unable to protect society from these threats. These vigilantes appear at times in ‘civil patrols’ in their local districts. This phenomenon was previously observed in Finland in 2015.

Germany, among other EU Member States, has reportedly experienced high numbers of attacks on refugee shelters since the start of the migration crisis in 2015. Resumption of border controls and improved checks led to decreasing numbers of newly arriving migrants in 2016. Nonetheless, xenophobic and racist criminal acts increased both in number and level of violence.

In June 2016, the UK voted to leave the EU and as a result, a significant number of Brexit-inspired events were held across the country in the run up to the voting date of 23 June. There was a sharp increase in the number of racially or religiously aggravated offences recorded by the police following the EU Referendum. The number of racially or religiously aggravated offences recorded by the police in July 2016 was 41% higher than in July 2015[37]. Negative online commentary towards migrants, refugees and foreign workers has increased and continues at a higher level than previously seen.

Threat to politicians

The threat from extremists in the UK was realised on 16 June, when a British Labour Party Member of Parliament was murdered by a lone actor, shortly before she was due to hold a constituency surgery for the UK to remain a member of the EU.

In Germany politicians continue to be the target of an increasing amount of harassment and threats[38]. According to figures collated by the German government in regard to current members in the German national parliament (Bundestag), incidents against politicians reached an all-time high in 2016. These included physical attacks, but also non-violent incidents such as damaged offices, spray-painting of unconstitutional signs on politicians’ houses/offices, or harassment via the internet. Politicians advocating pro-refugee policies and active against rightwing extremism were more likely to fall victim to such attacks.

Nationalist groups

In 2016, in addition to existing far-right or extremist groups, a number of new ones were founded and several others banned.

In Germany in October 2016, one police officer was shot and killed and three others injured by a member of the Reichsburger movement[39] in the federal state of Bavaria when they attended his premises to confiscate his weapons. Already in August, a member of the same movement shot and injured a police officer during a house eviction.

The German anti-Islam movement Patriotische Europaer gegen die Islamisierung des Abendlandes (PEGIDA, Patriotic Europeans against the Islamisation of the West) appears to have lost momentum, having previously attracted thousands of people to its demonstrations. In 2016 EU MS noticed a decrease in people identifying themselves with PEGIDA.

In December the UK proscribed the group National Action

(NA), the most active and well organised RWE group in the country. This is the first time a RWE group has been proscribed in the UK. In 2016 the group increased its recruitment campaigns and attendance at other RWE groups’ events, compared to previous year.

Weapons and IIDs/IEDs

MS investigations throughout the last few years have consistently confirmed that the RWE scene has access to weapons. Although the majority of these weapons appear to be knives and other cut-and-thrust bladed weapons, at times firearms were also seized.

A few EU MS mentioned the use of improvised incendiary devices (IIDs) and improvised explosive devices (IEDs) to commit an attack.

In Germany the significant increase of such attacks, as well as of seized precursors for these devices, came in conjunction with a continued escalation in violence connected to the migration phenomenon.

Internet

The use of the internet has maintained its importance to the right-wing scene with regards to radicalisation, recruitment, mobilisation and networking. The migration phenomenon and the jihadist terrorist threat have dominated social media and forum conversations within the right-wing scene. Most hate postings are on the edge of lawful expression of opinion and criminal incitement.

Language is becoming more aggressive and hate crimes such as sedition, encouragement of crimes on minorities and migrants as well as disparagement up to threats towards representatives of the state, have significantly increased. These xenophobic and racist comments have even caused the closure of comment sections attached to articles of news and TV outlets.

RWEs urge their peers to protect themselves or their organisation online so as not to jeopardise their activities. Several RWE websites have published guidelines giving advice on how to protect personal data and directions on how to communicate on the internet.[40] On social media, RWEs have increasingly made use of closed or hidden groups.

SINGLE-ISSUE TERRORISM -------------------------48

6. SINGLE-ISSUE TERRORISM*

Single-issue movements remain currently largely peaceful and within the boundaries of law

Environmental issues and animal rights remain the main themes of single-issue activism

In 2016, no attack related to single-issue terrorism occurred in EU Member States. Single-issue movements in the EU remained largely peaceful and within the boundaries of law, pursuing their goals via demonstrations and online activities. Nevertheless, a number of violent incidents linked to single-issue activism took place in several EU Member States. This is due to anarchist and left-wing extremist groups and individuals consistently attempting to impose their ideology and modus operandi in the single-issue arena. The role of extremists in single-issue movements varied: on some occasions, extremist groups constituted the actual movement; on others, single-issue movements marginalised radical elements.

In 2016, there were no thematic changes in the single-issue agenda, with environmental and animal rights subjects remaining the main themes. Activists opposed, among others, the construction of large infrastructure projects, animal testing, animal exploitation, nuclear energy and oil drilling. Modi operandi also remained unchanged: demonstrations were the predominant mode of action.

In Belgium, for example, animal rights activists organised numerous protests against animal testing and slaughtering of animals without anaesthesia. Their acts were lawful with the exception of a few cases of trespassing in fur farms that aimed to record the conditions of the animals and denounce their abuse. In Germany, extremists sabotaged railways and cable connections related to the railway system. They also targeted a vehicle belonging to an electric power company related to open-cast mining.

In Italy, the movement opposing the construction and function of the Treno ad Alta Velocita (TAV) largely marginalised its anarchist elements and was comprised of left-wing groups operating under the umbrella of the Bussoleno Comitato di Lotta Popolare (People’s Struggle Committee) that promoted a less violent strategy. This led to a decrease in the number of unlawful actions against TAV-related infrastructure. However, anarchist extremists appeared to be willing to continue their violent activities without the support of the wider movement, embedding their opposition to the construction of the TAV in a broader anarchist agenda. An arson attack on a TAV building site in Bologna in January and another one on the railway traffic control system in Rome in May are assessed to be part of this campaign. The ‘No Tav’ movement has inspired the creation of a number of similar -issue initiatives in Italy, such as the No Grandi Navi, against the arrival of large cruise ships in Venice; the No Ponte, against the construction of a bridge over the Messina strait; and the No Ombrina, against the construction of offshore oil drilling platforms in the Adriatic Sea.

Annexes

Annex 1. OVERVIEW OF THE FAILED, FOILED

AND COMPLETED ATTACKS IN 2016 PER EU MEMBER STATE AND

PER AFFILIATION

Member State	Jihadist	Left-wing	Right-wing	Separatist	Single issue	Not specified	Total
Belgium	4	0	0	0	0	0	4	France	5	0	0	18	0	0	23	Germany	4	0	0	0	0	1	5	Greece	0	6	0	0	0	0	6	Italy	0	16	0	0	0	1	17	Netherlands	0	0	1	0	0	0	1	Spain	0	5	0	5	0	0	10	UK	0	0	0	76	0	0	76	Total	13	27	1	99	0	2	142

In 2016, 142 terrorist attacks occurred in eight Member States. The United Kingdom reported more than half of the total number of attacks (76). The total number of terrorist

For the majority of the attacks the affiliation was separatism (99).
Italy, Greece and Spain together reported 27 terrorist attacks by left-wing and anarchist groups. Despite the continued decrease of the total number of attacks, the number of attacks by anarchist and left-wing groups increased by more than 100% (from 13 in 2015 to 27 attacks in 2016).
The countries reporting terrorist attacks linked to separatist terrorism are the UK (76), France (18) and Spain (5).

attacks dropped by 33% in 2016 (142) compared to 2015 (211). 379 casualties and 142 fatalities were reported as a result of terrorist attacks.

The 13 attacks classified as religiously-inspired terrorism were reported by France (5), Belgium (4 ) and Germany (4). This category is the one causing the most casualties (374 out of 379) and 135 out of 142 fatalities).
The Netherlands reported one right-wing terrorist attack.
No attack related to single-issue terrorism was reported in 2016.
Attacks in which firearms were used dropped from 57 in 2015 to 6 in 2016

Annex 2. ARRESTS IN 2016 PER EU MEMBER STATE AND PER AFFILIATION

Member State	Jihadist	Left-wing	Right-wing	Separatist	Single issue	Not specified	Total
Austria	30	0	0	4	0	0	34	Belgium	62	0	0	0	0	3	65	Bulgaria	5	0	0	0	0	0	5	Czech Republic	1	1	0	0	0	0	2	Denmark	8	0	0	0	0	0	8	France	429	1	0	26	0	0	456	Germany	25	1	5	4	0	0	35	Greece	15	1	0	0	0	1	17	Ireland	1	0	0	16	0	0	17	Italy	28	8	0	1	0	1	38	Netherlands	36	0	6	1	0	2	45	Poland	5	0	1	0	0	0	6	Romania	1	0	0	0	0	0	1	Slovenia	1	0	0	0	0	0	1	Spain	69	19	0	31	0	1	120	Sweden	2	0	0	1	0	0	3	UK	-	-	-	-	-	149	149	Total	718	31	12	84	0	157	1002

In 2016, 1002 individuals were arrested for terrorism-related offences in 17 EU Member States. This was a decrease of 7% compared to 2015, from 1077 to 1002. Most arrests were reported by France (456), United Kingdom (149) and Spain (120). There is a decrease of 50% in the number of individuals arrested for separatist terrorism, and a continued increase for the third consecutive year of those arrested for religiously-inspired terrorism, from 395 in 2014, to 687 in 2015 and to 718 in 2016.

Most of the countries registered a decrease or a similar number of arrests in 2016, apart from France where the arrests number continued to increase from 238 in 2014, to 424 in 2015, and to 456 in 2016, and Belgium from 61 to 65, but still under the level of 2014 (72).

Arrests for religiously-inspired terrorism continue to represent the largest proportion of the total arrests in the EU.
The arrests for ethno-nationalist and separatist terrorism dropped from 168 in 2015 to 84 in 2016.
The number of individuals arrested for anarchist and leftwing terrorism offences dropped from 67 in 2015 to 31 in 2016.
The number of arrests for right-wing terrorism in 2016 (12) is quite stable compared with 2015 (11).
No arrests were reported in relation to single-issue terrorism.

The number of EU citizens amongst the arrestees decreased by 25% in 2016 compared to 2015, from 592 in 2015 to 437 in 2016.

Annex 3. CONVICTIONS AND PENALTIES (EUROJUST)

This annex contains statistical information on the concluded court proceedings for terrorist offences in 2016, as reported to Eurojust. It highlights some key figures and, where relevant, compares those with the figures for previous years. The key figures are supplemented by further details and clarifications, as needed.

TABLE / Number of individuals in concluded court proceedings for terrorist offences per EU Member State in 2014, 2015[41] and 2016[42], as reported to Eurojust.

In case a verdict pronounced in 2016 was appealed and the appeal was concluded before the end ofthe year, Eurojust counted the proceeding as one and reported only on the latest/final verdict.

Member State	2014	2015	2016
Austria	2	29	26
Belgium	46	120	136
Denmark	13	1	8
Estonia	0	0	2
Finland	4	0	4
France	36	14	66
Germany	11	17	30
Greece	10	38	3
Hungary	0	0	2
Italy	4	0	11
Lithuania	4	1	1
Netherlands	5	18	42
Portugal	0	0	1
Slovenia	0	1	1
Spain	191	166	154
Sweden	0	2	4
United Kingdom	115	106	89*
Total	441	513	580

The figures included in the UK submission to the TE0SAT differ from those reported by Eurojust. The UK submission included a figure of 68, consisting of 56 convictions and 12 acquittals. The TE0SAT is using the Eurojust figures for consistency.

In 2016, 17 EU Member States reported to have concluded a total of 275 court proceedings in relation to terrorism.

The concluded court proceedings concerned 580 individuals. Seven of those individuals appeared before the court more than once in 2016 in the framework of different criminal proceedings[43]. As a result, the total number of verdicts pronounced for terrorism-related offences in 2016 was 587.
In 2016 there were 53 female defendants in the concluded court proceedings for terrorist offences.
In 2016, Spain reported the highest number of concluded court proceedings and the highest number of individuals convicted or acquitted of terrorist offences.
The vast majority of verdicts in the Member States in 2016 were pronounced in relation to jihadist terrorism. Similar to 2015, courts in Belgium rendered the highest number of verdicts concerning jihadist terrorism in 2016 (138).
All verdicts pronounced in Austria, Belgium, Estonia, Finland, France, Italy, Portugal and Sweden in 2016 related to jihadist terrorism. A large number of such verdicts were also rendered in Germany and the Netherlands. The Spanish courts dealt with the highest number of separatist terrorism cases in the EU in 2016. Individuals charged with offences related to separatist terrorist groups were also tried in Denmark, Germany and the Netherlands. Greece was the only Member State that reported verdicts for left-wing terrorist offences, while courts in Hungary, the Netherlands and Spain also tried right-wing terrorism cases.
The highest number of female defendants in the concluded proceedings in 2016 were tried for separatist terrorist offences (22) and for jihadist terrorist offences (also 22).
The average prison sentence for left-wing terrorist offences was the highest, increasing from 12 years in 2015 to 28 years in 2016. Jihadist and separatist terrorist offences were punished with an average prison sentence of 5 years, and right-wing terrorist offences with 4 years.

TABLE / Number of verdicts in 2016 per EU Member State and per type of terrorism, as reported to Eurojust.

Member State	Jihadist	Separatist	Left-wing	Right-wing	Not specified	Total
Austria	26	0	0	0	0	26	Belgium	138	0	0	0	0	138
Denmark	6	2	0	0	0	8	Estonia	2	0	0	0	0	2	Finland	4	0	0	0	0	4	France	68	0	0	0	0	68
Germany	28	2	0	0	0	30	Greece	0	0	3	0	0	3	Hungary	0	0	0	1	1	2	Italy	11	0	0	0	0	11	Lithuania	0	0	0	0	1	1	Netherlands	32	5	0	5	0	42
Portugal	1	0	0	0	0	1	Slovenia	0	0	0	0	1	1	Spain	38	116	0	3	0	157	Sweden	4	0	0	0	0	4
United Kingdom[*]	0	0	0	0	89[**]	89	Total	358	125	3	9	92	587

The data provided by the United Kingdom was not broken down by type of terrorism and is therefore included under the category ‘Not specified’.

The figures included in the UK submission to the TE-SAT differ from those reported by Eurojust. The UK submission included a figure of 68, consisting of 56 convictions and 12 acquittals. The TE-SAT is using the Eurojust figures for consistency.

Member State	Convictions	Acquittals	Total	Acquittals In %
Austria	26	0	26	0%	TABLE / Number
Belgium*	127	11	138	8%	of verdicts, convictions and
Denmark	4	4	8	50%	acquittals per EU Member State in 2016, as reported to Eurojust.
Estonia	2	0	2	0%
Finland	0	4	4	100%
France	68	0	68	0%
Germany	30	0	30	0%
Greece	3	0	3	0%
Hungary	2	0	2	0%
Italy	6	5	11	45%
Lithuania	0	1	1	100%
Netherlands	39	3	42	7%
Portugal	0	1	1	100%
Slovenia	0	1	1	100%
Spain	134	23	157	15%
Sweden	3	1	4	25%
United Kingdom{3}	89	-	89{4}	-

The number of acquittals in 2016 includes the annulled cases against two individuals in Belgium, in which the court referred to the ne bis in idem principle.

In 2016, Austria, Estonia, France, Germany, Greece and Hungary reported successful prosecutions resulting in no acquittals for terrorist offences.
Germany remains the only Member State where prosecutions for terrorist offences led to guilty verdicts and no acquittals in the period 2010-2016[44].
The year 2016 registered a record high conviction rate in concluded court proceedings (89%). The acquittal rate of 11% is significantly lower than those in 2015 (21%) and in 2014 (24%) and continues the downward trend compared to the years before.

All prosecutions for left-wing and right-wing terrorist offences resulted in convictions in 2016. Also the concluded jihadist terrorism cases had a very high conviction rate (92%), similar to that in 2015 (94%)[45]. The acquittal rate among the verdicts related to separatist terrorism decreased significantly in 2016 (18%), compared to 2015 (47%).

Annex 4. METHODOLOGY

The EU Terrorism Situation and Trend Report (TE-SAT) was established in the aftermath of the 11 September 2001 attacks in the United States of America (USA), as a reporting mechanism from the Terrorism Working Party (TWP) of the Council of the EU to the European Parliament. In 2006 Europol replaced the TWP. The methodology for producing this annual report was developed by Europol and endorsed by the Justice and Home Affairs (JHA) Council on 1 and 2 June 2006.

The content of the TE-SAT is based on information supplied by EU Member States, some third states and partner organisation Eurojust, as well as information gained from open sources.

In accordance with ENFOPOL 65 (8196/2/06), the TE-SAT is produced annually to provide an overview of the terrorism phenomenon in the EU, from a law enforcement perspective. It seeks to record basic facts and assemble figures regarding terrorist attacks and arrests in the EU. The report also aims to present trends and new developments identified from the information available to Europol.

The TE-SAT is a situation report which describes and analyses the outward manifestations of terrorism, i.e. terrorist attacks and activities. It does not seek to analyse the root causes of terrorism, neither does it attempt to assess the impact or effectiveness of counter-terrorism policies and law enforcement measures taken, although it can serve to illustrate some of these.

This edition of the TE-SAT has been produced by Europol in consultation with the 2017 TE-SAT Advisory Board, composed of representatives of the past, present, and future Presidencies of the Council of the EU, i.e. Slovakia, Malta and Estonia (the ‘Troika’), along with permanent members, representatives from France and Spain, the EU Intelligence Analysis Centre (INTCEN), Eurojust, the office of the EU Counter Terrorism Coordinator, and Europol staff.

For the preparation of this report, Europol collected qualitative and quantitative data on terrorist offences in the EU, and data on arrests of people suspected of involvement in those offences, provided or confirmed by Member States. As in previous years, Eurojust collected data on the number of court proceedings in each Member State, the number of individuals in concluded court proceedings, the number of convictions and acquittals, the type of terrorism, the gender of defendants, the penalties imposed, as well as the type of verdicts - final or pending judicial remedy. Similar data were collected, when available, of offences in which EU interests were affected outside of the EU.

Eurojust contributed data on convictions and penalties for terrorist offences in EU Member States and relevant amendments in national legislation on terrorism.

Included as ‘arrests’ are those judicial arrests warranted by a prosecutor or investigating judge, whereby a person is detained for questioning on suspicion of committing a criminal offence for which detention is permitted by national law. The fact that the person may subsequently be provisionally released or placed under house arrest does not impact the calculation of the number of arrests.

The definition of the term ‘terrorist offences’ is indicated in Article 1 of the Council Framework Decision of 13 June 2002 on combating terrorism (2002/475/JHA), which all EU Member States have implemented in their national legislation. This Framework Decision specifies that terrorist offences are intentional acts which, given their nature or context, may seriously damage a country or an international organisation when committed with the aim of: seriously intimidating a population, or unduly compelling a government or international organisation to perform or abstain from performing an act, or seriously destabilising or destroying the fundamental political, constitutional, economic or social structures of a country or an international organisation.

In cases in which the wording of Article 1 of the Framework Decision leaves room for interpretation, the TE-SAT 2017 respects Member States’ definitions of terrorist offences on their territories. At times, it can be difficult to assess whether a criminal event should be regarded as an act of ‘terrorism’ or as an act of ‘extremism’. Contrary to terrorism, not all forms of extremism sanction the use of violence. Nevertheless, extremism as a phenomenon may be related to terrorism and exhibit similar behavioural patterns. Therefore, the TE-SAT 2017 mentions criminal acts with the potential to seriously destabilise or destroy the fundamental political, constitutional, economic or social structures of a country, when they were reported by the Member States as extremism, in an effort to provide a clearer picture of the phenomenon and its relation to terrorism. However, these cases were not considered in the statistical data of this report, which exclusively reflect incidents reported as terrorism by EU Member States.

The EU Council Decision of 20 September 2005 (2005/671/ JHA), on the exchange of information and cooperation concerning terrorist offences[46], obliges Member States to collect all relevant information concerning and resulting from criminal investigations conducted by their law enforcement authorities with respect to terrorist offences, and sets out the conditions under which this information should be sent to Europol. Europol processed the data and the results were cross-checked with the Member States. In cases of divergences or gaps, the results were corrected, complemented, and then validated by the Member States.

Eurojust also collected data on prosecutions and convictions for terrorist offences on the basis of the aforementioned EU Council Decision. The data used in this report concerns relevant court decisions and legislation amendments in 2016. Due to the specifics of reporting, Member States submit information on both final and nonfinal decisions. Therefore, reference is also made to those decisions pending judicial remedy. Verdicts from 2016 on which an appeal is pending are included in the reporting as pending judicial remedy. In cases where a verdict pronounced in 2016 was appealed, and the appeal was concluded before the end of the year, Eurojust counted the proceeding as one. Eurojust’s contribution was verified with the Member States that provided relevant data.

Types of terrorism

The TE-SAT categorises terrorist organisations by their source of motivation. However, many groups have a mixture of motivating ideologies, although usually one ideology or motivation dominates. It is worth noting that a categorisation of individuals and terrorist groups based on the ideology or goals they espouse should not be confused with motivating factors and the paths to radicalisation. The underlying causes that lead people to radicalisation and terrorism must be sought in the surroundings (structural factors) and personal interpretations (psychological factors) of the individual. The choice of categories used in the TE-SAT reflects the current situation in the EU, as reported by Member States. The categories are not necessarily mutually exclusive.

JIHADIST

Jihadist terrorist acts are those that are committed out of a mindset that rejects democracy on religious grounds and uses the historical comparison with the Crusades of the Middle Ages to describe current situations, in which it is believed that Sunni Islam is facing a “Crusader alliance” composed of Shi’is, Christians and Jews.

natural right to rule over the rest of the population. Racist behaviour, authoritarianism, xenophobia and hostility to immigration are commonly found attitudes in rightwing extremists. Right-wing terrorism refers to the use of terrorist violence by right-wing groups. Variants of rightwing extremist groups are the neo-Nazi, neo-fascist, and ultra-nationalist formations.

LEFT-WING AND ANARCHIST TERRORISM

Left-wing terrorist groups seek to replace the entire political, social and economic system of a state by introducing a communist or socialist structure and a classless society. Their ideology is often Marxist-Leninist. A sub-category of left-wing extremism is anarchist terrorism which promotes a revolutionary, anti-capitalist and antiauthoritarian agenda. Examples of left-wing terrorist groups are the Italian Brigate Rosse (Red Brigades) and the Greek Revolutionary Organisation 17th of November.

ETHNO-NATIONALISM AND SEPARATISM

Ethno-nationalist and separatist terrorist groups are motivated by nationalism, ethnicity and/or religion. Separatist groups seek to carve out a state for themselves from a larger country, or annex a territory from one country to that of another. Left-or right-wing ideological elements are not uncommon in these types of groups. The Irish Republican Army (IRA), the Basque ETA, and the Kurdish PKK organisations fall into this category.

SINGLE-ISSUE

Single-issue extremist groups aim to change a specific policy or practice, as opposed to replacing the whole political, social, and economic system in a society. The groups within this category are usually concerned with animal rights, environmental protection, anti-abortion campaigns, etc. Examples of groups in this category are the Earth Liberation Front (ELF), and the Animal Liberation Front (ALF).

RIGHT-WING

Right-wing terrorist organisations seek to change the entire political, social and economic system on an extremist right-wing model. A core concept in right-wing extremism is supremacism, or the idea that a certain group of people sharing a common element (nation, race, culture, etc.) is superior to all other people. Seeing themselves in a supreme position, the particular group considers it is their

Annex 5. ACRONYMS

AMISOM

African Union Mission in Somalia

AQAP

al-Qaeda in the Arabian Peninsula

Tanzim qa’idat al-jihad fi jazirat al-’arab

AQIM

al-Qaeda in the Islamic Maghreb

Tanzim al-qa’ida bi-bilad al-Maghrib al-Islami

BNP

British National Party

CBRN

Chemical, Biological, Radiological, Nuclear

CDK-F

Conseil Kurde de France

CIK

Centre d’information du Kurdistan

CIRA

Continuity Irish Republican Army

DHKP/C

Devrimci Halk Kurtulu^ Partisi/Cephesi Revolutionary People’s Liberation Party/ Front

Dissident Republican

EDL

English Defence League

ERW

Explosive remnants of war

ETA

Euskadi ta Askatasuna

Basque Fatherland and Liberty

European Union

EU MS

European Union Member States

FAI

Federazione Anarchica Informale

Informal Anarchist Federation

Federazione Anarchica Informale

FAI/IRF

Informal Anarchist Federation/International

Revolutionary Front

FSA

Free Syrian Army

FTF

foreign terrorist fighter

HME

home-made explosive

HSM

Harakat al-Shabab al-Mujahidin mujahid youth movement

IBIL

Irautzaleen Bilguneak

Revolutionary Assemblies

IED

improvised explosive device

IID

improvised incendiary device

INTCEN

EU Intelligence Analysis Centre

Islamic State

ISIL

Islamic State in Iraq and the Levant

Al-Dawla al-Islamiyya fi al-Iraq wal-Sham

JHA

Justice and Home Affairs

KGK

Kongra Gel

LTTE

Liberation Tigers of Tamil Eelam

National Action

NSU

National-Sozialistischer Untergrund

National Socialist Underground

ONH

Oglaigh na h’Eireann

Warriors of Ireland

OPCW

Organisation for the Prohibition of Chemical Weapons

PBIED

person-borne improvised explosive device

PEGIDA

Patriotische Europaer gegen die Islamisierung des Abenlandes

Patriotic Europeans against the Islamisation of the Occident

PKK

Partiya Karkeren Kurdistan Kurdistan Workers’ Party

Resistencia Galega

Galician Resistance

TATP

triacetone triperoxide

TAV

Treno ad Alta Velocita

high speed train

TE-SAT

European Union Terrorism Situation and Trend Report

TTP

terrorist tactics, techniques and procedures

TWP

Terrorism Working Party

UAV

Unmanned aerial vehicle

United Kingdom

United Nations

United States (of America)

UXO

unexploded ordnance

VBIED

vehicle-borne improvised explosive device

VOIED

victim-operated improvised explosive device

Annex 6. AMENDMENTS IN NATIONAL

LEGISLATION ON TERRORISM IN 2016

Belgium

By virtue of the Law of 27 April 2016, the Belgian legislation was amended to allow house searches and arrests to take place between 9 p.m. and 5 a.m. in case of a terrorist offence or a planned attack. Furthermore, the Law of 5 August 1992 on the Police Service was amended to provide for the establishment of common databases aimed at the prevention and suppression of terrorism or of extremism that can lead to terrorism, as well as for the possibility to share information from such databases with foreign law enforcement and intelligence services and international organisations for police and judicial cooperation. The existing provisions of the Belgian Criminal Code were extended by the Law of 3 August 2016 to include the incitement (Article 140bis) and the recruitment (Article 140ter) to travel to or from Belgium for terrorist purposes (Article 140sexies).

Furthermore, the Law of 3 August 2016 extended the Belgian extraterritorial jurisdiction to allow the prosecution of those who commit terrorist offences, provided for in Book II, Title Iter of the Criminal Code, against a Belgian national or a Belgian or European institution abroad. The Law also specified the powers of the Federal Prosecutor’s Office in relation to terrorist offences. The Law of 14 December 2016 introduced further amendments to the Criminal Code, concerning: (i) the participation in an activity of a terrorist group, making it sufficient to know or could have known that such participation could contribute to the commission of a crime by the terrorist group (Article 140, § 1), (ii) the preparation of terrorist acts by the so-called ‘lone wolves’ (Article 140septies), and (iii) the provision or collection of direct or indirect material support, including financial means, for the commission of a terrorist offence (Article 141).

Denmark

Amendments concerning Article 114j of the Danish Criminal Code came into force on 30 September 2016. They criminalise the travel to certain areas in Syria and Iraq without a permit from the Danish authorities. The amendments envisage a penalty of up to six years of imprisonment for Danish nationals or persons with a permanent residence in Denmark, who travel into or stay in the designated areas.

Finland

As of December 2016, new legislation entered into force in Finland. The new legislation criminalises travel to a State other than the State of residence or nationality of the traveller, if the purpose of the travel is to commit, plan or prepare a terrorist act or to give or to receive terrorist training. The new legislation also criminalises funding of travel for the aforementioned purposes. The new legislation is based on United Nations Security Council Resolution 2178 (2014) of 14 September 2014.

France

By Law n° 2016-731 of 3 June 2016, the French Criminal Code was amended and supplemented by criminalising: (i) the trafficking of cultural goods coming from areas in which terrorist groups are operating and (ii) the regular consultation of online content with messages, pictures or other material that can lead to or provoke someone to commit a terrorist act or that promotes or glorifies those acts. This last incrimination has been censored by the French Constitutional Court in Decision n° 2016-611 of 10 February 2017 and as a consequence has been redrafted by the new Law n° 2017-258 of 28 February 2017.

Law n° 2016-731 of 3 June 2016 also extended the powers of magistrates and investigators, making it possible to conduct night-time house searches and use new investigation techniques for data collection. Furthermore, the law reinforced arms and ammunition control, created provisions aimed at protecting witnesses, and strengthened the efficiency of administrative controls to avert terrorist acts and to allow for the surveillance of those coming back to France after travelling abroad to participate in terrorist activities.

Hungary

In 2016, the Hungarian Parliament amended the regulation of acts of terrorism, provided for in Articles 314316 of the Criminal Code of Hungary. The amendment criminalises the travel through or from Hungary with the intention to join to a terrorist group, and envisages a penalty of between 2 and 8 years’ imprisonment. Furthermore, the ‘organisation of a terrorist group’ has also become punishable. The amendment entered into force on 17 July 2016.

Italy

A new provision was added to the Italian Criminal Code (Article 270quinquies), which criminalises any conduct consisting of gathering funds or goods with the objective of committing terrorist offences, even without a link to a criminal association or a conspiracy to commit terrorist offences. Therefore, any conduct for the purpose of procuring means to finance terrorist activities is criminalised as such. Furthermore, by Law No. 153 of 28 July 2016, Italy ratified several conventions in the field of counter-terrorism, including the Council of Europe Convention on the Prevention of Terrorism, the International Convention for the Suppression of Acts of Nuclear Terrorism, the Protocol amending the European Convention on the Suppression of Terrorism, the Council of Europe Convention on Laundering, Search, Seizure and Confiscation of Proceeds from Crime and on the Financing of Terrorism, and the Additional Protocol to the Council of Europe Convention on the Prevention of Terrorism.

Latvia

In February 2016 the Latvian Saeima adopted amendments to the Law on the Prevention of Money Laundering and Terrorism Financing. The amendments concern, among others, the government regulations on the lists, compiled by certain countries or international organisations, of persons suspected of being involved in terrorist activities or of the manufacturing, keeping, transporting, using or distribution of weapons of mass destruction, as well as the sanctions lists compiled by the Latvian government with the aim of combating the involvement in terrorist activities or the manufacturing, keeping, transporting, using or distribution of weapons of mass destruction. The Law on the Prevention of Money Laundering and Terrorism Financing was further amended in May 2016. The amendments envisage a number of measures to be taken by legal persons to ensure compliance with the law.

The Netherlands

On 1 April 2016, the legal possibility to take away Dutch citizenship in case of dual citizenship and final conviction for terrorist offences was extended to preparatory offences (including training for terrorism). Such a measure would require the decision of the Minister of Security and Justice.

In March 2016, Article 57 (2) of the Law 135/2010 on the Code of Criminal Procedure was amended. The article concerns the criminal investigation acts carried out by special criminal investigation bodies. In conformity with the amendment, these bodies may, upon the prosecutor’s order, enforce technical surveillance warrants in case of terrorist offences and of offences against the national security, as provided for in Title X of the Criminal Code. Also in March 2016, Articles 8 and 13 of the Law no. 14/1992 on the organisation and functioning of the Romanian Intelligence Service were amended to designate the National Centre for Interception of Communications of the Romanian Intelligence Service as a competent authority to obtain, process and store information on national security retrieved from providers of publicly available electronic communications. It was established that, for the purpose of enforcing technical surveillance (as a special investigative technique), the Centre has to allow the criminal investigation bodies to have direct and independent access to its technical systems. The possibility, by way of exception, to designate the bodies of the Romanian Intelligence Service as special criminal investigation bodies in accordance with Article 55 paragraphs 5 and 6 of the Romanian Criminal Procedure Code, is also envisaged. Furthermore, in November 2016 Law no. 535/2004 on the prevention and fighting against terrorism was amended to define travel abroad for terrorist purposes. The amendment criminalises the (attempt to) travel to a state, other than the state of nationality or residence, for the purpose of committing, planning or preparing a terrorist offence, participating in or providing or receiving instruction or training for the purpose of committing terrorism, or for the purpose of supporting in any way a terrorist entity. The law envisages a custodial sentence between 5 and 12 years’ imprisonment and restriction of rights.

Slovakia

At the end of 2015 the Slovak Parliament adopted the so-called ‘anti-terror package’ in response to the November 2015 terrorist attacks in Paris. As part of the package, police, prosecution offices, courts and intelligence services received new powers in the fight against terrorism. Prison sentences for those convicted of conspiracy to commit a terrorist act were extended, as the offence was included in the category of ‘particularly serious crimes’. A new criminal offence of ‘participating in combat operation within an organised armed group abroad’ was introduced into the Criminal Code also in response to the phenomenon of foreign terrorist fighters. All changes and amendments came into force in January 2016.

Sweden

Further amendments to the Swedish Criminal Code were made to counter the phenomenon of foreign terrorist fighters. On 1 April 2016, new provisions came into force criminalising travelling to a country other than the country of which the suspect is a citizen, with the purpose of committing or preparing serious crimes, particularly terrorist crimes, gathering, supplying or receiving money or other property with the purpose of supporting such travel and also passive training for terrorism.

EU TERI

ANNEX 7. EUROPOL ACTIVITIES IN COUNTERTERRORISM

FIRST-LINE INVESTIGATIVE SUPPORT: THE EUROPEAN COUNTER-TERRORISM CENTRE (ECTC)

Recent developments that include the terrorist attacks in Brussels and Berlin, a number of failed, foiled and also completed other attacks, the propaganda videos that have been produced in European languages by IS to call for attacks, and a high number of arrests on suspicion of terrorist activities, show that the terrorist threat towards the EU is high. Even though a further military defeat of IS in Syria and Iraq is expected, the severity of the threat in the EU may even increase. The videos indeed give the impression that IS is increasingly under strain in Syria and Iraq, but at the same time they show a strategy of mobilising lone actors to commit attacks against citizens in countries of the anti-IS coalition .

To ensure an effective response to the constant changing developments in terrorism, the European Counter Terrorism Centre (ECTC) has been established at Europol, under the authority and direction of the European Council. It builds further on the already established tools and counter terrorism (CT) networks of Europol, but includes a number of new features. These aim at enhancing the CT capabilities and at better facilitating information exchange among CT authorities, to bring cross-border cooperation in this field to a new level.

The ECTC is designed as a central hub in the EU in the fight against terrorism. In fact, it is the single point in the EU where CT operational information from law enforcement from all EU MS, but also from third parties, is brought together for analytical purposes. Specialised teams of CT analysts and experts work on this information to establish the wider EU perspective on CT phenomena for both operational and strategic goals. To ensure efficient information exchange, the ECTC benefits from an excellent network of CT officers throughout the EU and beyond.

The principal task of the ECTC is to provide operational support upon MS’s request for ongoing investigations, such as those following the Paris attacks. The ECTC can assist by cross-checking live operational data with the already available data at Europol, quickly bringing financial leads to light, and by analysing all available investigative details to assist in compiling a structured picture of the terrorist network. In case of a major terrorist event, the ECTC can contribute to the coordinated response. For this purpose different teams are available, often combined with CT experts temporarily seconded from MS, depending on the nature of the event.

EUROPOL INFORMATION SYSTEM (EIS)

One of Europol’s core databases is the Europol Information System (EIS). Through this system, Member States directly share and retrieve information on suspects, convicted persons, events and devices connected with serious and organised crime and terrorism. The EIS offers first-line investigative support as this reference system allows MS to quickly identify whether or not information they are looking for is available in one of the EU MS, with cooperation partners or Europol. In case of a positive hit, more information may then be requested through the user’s Europol National Unit. In December 2016 the EIS held information on over 7800 foreign terrorist fighters, contributed by 24 countries.

FURTHER IN-DEPTH ANALYSIS: THE COUNTER TERRORISM ANALYSIS WORK FILE (AWF) AND THE FOCAL POINTS for CT authorities. This means that CT authorities now have the possibility to send information directly to Europol or other CT authorities. Until very recently, countries could only use SIENA for sending their contributions on terrorism to Europol indirectly, through the Europol National Units and Liaison Bureaux. The extended infrastructure now also allows CT authorities from different countries to directly exchange information amongst themselves, and the involvement of Europol is optional. However, it is recommended that Europol is involved, otherwise possible links to other MS and third partners may remain undiscovered as well as potential links between organised crime and terrorism.

In practice, this means that every CT officer in the Member States can check the EIS from their own computers, or can directly send information to, or receive information, from the focal points. The options described for sharing information are at the discretion of the Member State. The dedicated SIENA CT environment is already operational with 90% of all MS, and in total 46 CT authorities, now connected to the system.

For a more in-depth analysis, the ECTC works with the counter terrorism analysis work file (AWF). This file provides the framework for operational analytical support with the MS and third partners. As a result, the number of data categories that are permitted to be stored and processed is broader than in the EIS (within the CT AWF, there is focused analysis on certain CT phenomena). Existing and emerging terrorist phenomena are handled within separate focal points. In these highly secure environments the information is collected, cross-matched and analysed. This is done by dedicated teams of CT analysts and CT experts. Within CT, a major focal point is ‘Travellers’, which deals with foreign terrorist fighters. In response to the concerted efforts of Member States with the assistance of Europol the amount of data on foreign terrorist fighters within Focal Point Travellers increased substantially in 2016, reflecting the increase of entries on foreign terrorist fighters in the EIS.

The ECTC uses an integrated approach, meaning that data inserted in one system is automatically cross-checked against all other databases at Europol, to close intelligence gaps. In addition regular manual checks are carried out.

INTERNET REFERRAL UNIT (IRU)

Terrorists’ use of the internet and social media has increased enormously over the course of recent years. Jihadist groups, in particular, have demonstrated a sophisticated understanding of how social networks operate and have launched well-organised, concerted social media campaigns to recruit followers and to promote or glorify acts of terrorism and violent extremism.

As this is a problem that spans multiple linguistic audiences and jurisdictions, a common EU response was necessary, hence the establishment of an Internet Referral Unit (IRU) at the ECTC. The IRU has the following core tasks:

>To coordinate and share the identification tasks (flagging) of terrorist and violent extremist online content with relevant partners;

>To carry out and support referrals quickly, efficiently and effectively, in close cooperation with industry;

>To support competent authorities, by providing strategic analysis and operational analysis.

INFORMATION EXCHANGE: SIENA

In an organisation like Europol, with its main focus on information exchange, secure and swift transmission of data is essential, especially when it comes to CT data. Information from a Member State must reach Europol, and vice versa, without the risk of interception. To facilitate this information exchange, the Secure Information Exchange Network Application (SIENA) was designed and has been in use for a number of years by MS, Europol and third parties that have operational cooperation agreements with Europol.

A dedicated area has been created within SIENA especially

TERRORISM FINANCE TRACKING PROGRAMME (TFTP)

The ECTC uses a number of tools to help detect financing of terrorism, of which one of the most known is TFTP - the Terrorism Finance Tracking Programme. In 2010, the European Parliament adopted the EU-US Terrorist Finance Tracking Programme (TFTP) Agreement.

Relevant information obtained through the TFTP is provided by the US Treasury Department to Europol, competent authorities of EU Member States and Eurojust (either spontaneously by the US, pursuant to Article 9, or upon request, Article 10), with the aim of combating terrorism and terrorist financing.

The TFTP has proven to be a valuable tool in terrorism-related investigations - it enhances the ability to map out terrorist networks, often filling in missing links in an investigative chain. It is used to track terrorist money flows, allowing authorities to identify and locate operatives and their financiers, and assists in broader efforts to uncover terrorist cells.

EXPLOSIVES AND CBRN THREATS

The bomb-making process, potential recipes for the harmful use of explosives precursors as well as potential new threats using chemical, biological, radiological and nuclear (CBRN) materials are monitored daily and crosschecked by Europol specialists at the ECTC. Europol also facilitates cooperation between CBRN and explosives specialists through the European Explosive Ordnance Disposal Network (EEODN). The agency provides seminars and training where responses to potential and realistic scenarios of terrorist attacks can be rehearsed.

DIRECT OPERATIONAL SUPPORT FOR CT

CASES

The ECTC’s core business is to support MS in ongoing investigations, for which it has several teams and analysts available to produce analytical products, ranging from cross-check reports to intelligence notifications, and risk and threat assessments. To provide direct operational support, and to also contribute to a coordinated response in cases of major terrorist attacks or threats, the ECTC applies a scalable approach where other teams can be activated depending on the need. For example, the Europol Emergency Response Team (EMRT). This team exists of Europol experts and analysts with relevant backgrounds and experience, to support emerging investigations on a 24/7 basis.

THE CT JOINT LIAISON TEAM

European Union Member States have recently established the Counter Terrorism Joint Liaison Team (CT JLT) for closer cooperation on cross-border investigations. The team consists of CT experts/analysts from the Member States and Europol.

EUROPEAN CYBERCRIME CENTRE (EC3)

TEAM OF ROTATING GUEST OFFICERS AT IMMIGRATION HOTSPOTS

Launched in January 2013, the European Cybercrime Centre (EC3) can deliver high-level technical, analytical and digital forensic expertise to support investigations of EU Member States and third parties in cases of convergence of cyber and terrorism.

Between January and December 2016, approximately 363 400 migrants entered Europe by sea, mainly in Greece and Italy. And still, every day, many people attempt to cross those borders to escape the atrocities in Syria and Iraq. There is no concrete evidence that terrorist travellers systematically use those flows of refugees to enter Europe unnoticed, but it is indisputable that some terrorists have entered the EU posing as a refugees, as was seen in the Paris attacks of 13 November 2015.

To counter this threat, Europol has recently approved the recruitment of up to 200 counter-terrorist and other investigators for deployment to migration hotspots in Greece and soon also to Italy. Up to 50 of these “guest officers” will be deployed on rotation at key points on the external borders of the EU to strengthen security checks on the inward flows of migrants, in order to identify suspected terrorists and criminals, establishing a second line of defence.

ISBN 978-92-95200-79-1

DOI 10.2813/237471 QL-AJ-17-001-EN-N

Eisenhoweriaan 73, 2517 KK The Hague, the Netherlands

www.europol.europa.eu

[1] In 2016 there were more than 800 attacks on public servants in Germany alone, including 18 direct physical assaults, according to an open source quoting the Federal Criminal Police Office (BKA). The most common crimes were coercion, threats, damage to property, inciting hatred, and arson. By September the count was 384 attacks by right-wing extremists, and 97 by left-wing extremists.

[2] All attacks reported by the UK were acts of Northern Irish-related terrorism and involved 49 shooting incidents and 27 bombing incidents. Of these, four involved attacks on National Security Targets.

[3] The exceptions are six victims of paramilitary violence in Northern Ireland and the murder of a UK Member of Parliament by what was reported as a domestic violent extremist.

[4] An average of nearly 10 attacks a day were carried out on refugees in Germany in 2016, according to Germany’s Interior Ministry, as reported in open source media.

[5] Please see the definition ofterrorist attacks, included in the Annex on Methodology.

[6] The International Centre for the Study of Radicalisation and Political Violence (ICSR), “Criminal Pasts, Terrorist Futures: European Jihadists and the New Crime-Terror Nexus”, 2016.

[7] http://www.bbc.com/news/uk-37508537

[9] Please refer to Annex III for additional information and clarification on the numbers mentioned in this section.

[10] According to Council Decision 2005/671/JHA, the information to be submitted to Eurojust is in relation to final convictions. Due to the specifics of reporting, Member States submit information on both final and not final decisions. Therefore, reference is also made to those decisions pending judicial remedy and they are included in the reported numbers.

[11] The data provided by the United Kingdom was not broken down by type of terrorism and is therefore not included in the numbers that follow.

[12] The UK data for 2016 refers only to convictions and is not included in the numbers in this section.

[13] The number of acquittals in 2016 includes the annulled cases against two individuals in Belgium, in which the court referred to the ne bis in idem principle.

[14] Eurojust considers it one verdict if an individual is convicted of more than one terrorist offence within the same proceeding, or convicted of a terrorist offence and acquitted of another offence. If an individual is acquitted of a terrorist offence and convicted of another offence, the verdict is included in the overview as acquittal of terrorism.

[15] The data provided by the United Kingdom was not broken down by type of terrorism and is therefore not included in the numbers.

[16] For the purpose of the calculation of the average prison sentence, penalties exceeding 40 years of imprisonment and life sentences were counted as 40 years. In the cases where the court ordered a minimum number of years of the life sentence to be served, the sentence was included in the overview with the minimum number of years indicated.

[17] The data provided by the United Kingdom was not broken down by type of terrorism and is therefore not included in the overview.

[19] Yemen’s civil war between the Houthi rebels and the internationally recognised government under Abd-Rabbu Mansour Hadi continued to undermine the security and political infrastructure of the country, which has suffered a humanitarian catastrophe as a result. After capturing the Yemeni capital Sana’a in September 2014, the Houthi rebels ousted the government in February 2015. In response, Saudi Arabia and a coalition of Sunni Arab countries, backed by Western powers, launched a military intervention with the aim of reinstating the Hadi government.

The conflict has a pronounced sectarian character: on the one side the Houthis, who belong to the Zaydi branch of Shi’i Islam, are accused of receiving support from Iran; on the other the government is supported internally by Sunni Islamist militias and tribal forces and externally by the Saudi Arabia-led coalition. In this climate, al-Qaeda in the Arabian Peninsula (AQAP), based on its Sunni extremist ideology, has been able to forge alliances with Sunni tribes and militias, which have enabled it to multiply its fighters and resources. The group took control of territory along the southern coast of Hadramawt province in April 2015, including the provincial capital al-Mukalla. In dealing with the local populations in territories under its control, it took lessons from an earlier attempt at governance in southern Yemen in 2011-12. It emphasised the provision of services, education and justice based on Islamic law to the population, while refraining from implementing severe punishments, except for alleged spies. Rather than exercising power directly, AQAP created a governing council

[22] For developments in Syria concerning Jabhat al-Nusra, see section below on Syria.

[23] For example, in late 2016, Facebook, Microsoft, Twitter and Google (YouTube) created a joint database to quickly identify and remove images and videos promoting terrorism from their platforms. When one company identifies and removes such a piece of content, the others will be able to use a unique digital fingerprint (hash) to identify and remove the same piece of content from their own network in accordance with their own policies. See “Partnering to Help Curb Spread of Online Terrorist Content”, Facebook Newsroom, 5 December 2016.

[24] TE-SAT 2015.

[25] A MOOC platform allows online learning and its content is accessible to any person who wants to take a course, with no limit on attendance.

[26] In January 2017 this dynamic led to the merger of several fighting factions, including Jabhat Fath al-Sham, into Hay’at Tahrir al-Sham (“Levant liberation committee”).

[27] Europol, EU Terrorism Situation and Trend Report (TE-SAT) 2016, p. 32.

[28] Europol, EU Terrorism Situation and Trend Report (TE-SAT) 2016, pp. 32-33.

[29] The United Nations Multidimensional Integrated Stabilization Mission in Mali.

[30] Europol, EU Terrorism Situation and Trend Report (TE-SAT) 2016, p. 32.

[31] Europol, EU Terrorism Situation and Trend Report (TE-SAT) 2016, p. 33.

[32] Europol, EU Terrorism Situation and Trend Report (TE-SAT) 2016, p. 33.

[33] 2016 = 11; 2015 = 7; 2014 = 1.

[34] 61 incendiary devices; 10 violations against the explosives law; 4 cases in which an IED detonated in or at an asylum shelter.

[35] http://www.zeit.de/gesellschaft/2016-10/asylunterkuenfte-angriffe-800-straftaten-fluechtlingsheime

[36] terrorist offence and convicted of another offence, the verdict is included in the overview as acquittal of terrorism.

[37] https://www.gov.uk/government/uploads/system/uploads/attachment_ data/file/559319/hate-crime-1516-hosb1116.pdf

[38] There was a near-fatal knife attack on a mayoral candidate in Cologne in 2015.

[39] The Reichsburger (Empire’s citizens) movement comprises an estimated 4500 supporters. It consists of either small groups or single individuals, who deny the legitimacy of the Federal Republic of Germany and assert that the German Reich continues to exist in its 1937 pre-WWII borders.

[40] “Leitfaden zur Dokumentation bei Spitzelei und Anquatschversuchen”/ Guidelines for documentation in case of spying efforts and approaches” - Rightwing extremists and their Internet Presence issued by the German Federal Office for the Protection of the Constitution/Bundesamt fur Verfassungsschutz (BfV).

[41] The data for the previous years corresponds to the data reported in the respective TE-SAT reports.

[42] Eurojust received contributions containing information on terrorism-related court decisions in 2016 from the following Member States: Austria, Belgium, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Lithuania, the Netherlands, Portugal, Slovenia, Spain, Sweden and the United Kingdom. As in 2014 and 2015, the UK contribution for 2016 covers England, Scotland, Wales and Northern Ireland. The UK contribution includes proceedings on offences under antiterrorism legislation, as well as other offences assessed to be terrorism related. Similar to 2014 and 2015, the UK data for 2016 refers only to convictions.

[43] In Spain, three individuals appeared before the court twice in 2016 in the framework of different criminal proceedings. In Belgium, the cases against two individuals were annulled on the basis of the ne bis in idem principle, as the court ruled the two had been convicted ofthe same facts earlier in 2015 and 2016. In France, two individuals appeared before the juvenile court and the criminal court.

[44] Eurojust considers it one verdict if an individual is convicted of more than one terrorist offence within the same proceeding, or convicted of a terrorist offence and acquitted of another offence. If an individual is acquitted of a

[45] The data provided by the United Kingdom was not broken down by type of terrorism and is therefore not included in the numbers.

[46] Amended by the Council Framework Decision 2008/919/JHA of 28 November 2008.