Sleeper Cell Report: ISIS begins to claim more attacks amidst steady drumbeat of raids and arrests

Key Points

– 13 sleeper cell attacks documented, 6 claimed by ISIS

– The attacks resulted in 11 deaths, including assassinations of SDF, Asayish and AANES members

– 4 people died in Al-Hol camp. Al-Hol also saw 3 raids leading to at least 6 arrests.

– Across NES, SDF/Asayish (Internal Security Forces) conducted 22 raids resulting in 80 arrests, continuing the high number of raids and arrests from last month

In-depth

In past months, ISIS has not regularly used their establishment media channels to claim attacks. This trend reversed in September; the group claimed three attacks through their al-Naba newspaper and three more through Amaq News Agency. That said, security officials on the ground tell RIC that the more worrying trend has been on non-official ISIS social media pages, where ISIS affiliates post ‘hit lists’, including the names, faces and (if available) addresses of local security officials. The ‘hit lists’ are posted on non-official ISIS Facebook groups with names like, ‘The Ghost of Heseke’. ISIS also sometimes uses these pages to claim attacks, but they are often taken down by companies’ security protocols within minutes (which is also what makes them hard to find and confirm). The ‘hit list’ posts on the other hand, can stay up for hours or days. 

Given that many of ISIS’ claimed attacks this month and the months prior have been targeted assassinations, this is a grave security concern. In September, the assassinations included a member of Asayish Deir ez-Zor’s organized crime department, three members of AANES institutions, and a failed attempt on SDF leader Abdul Karim al-Jedaa, who sustained two bullet wounds to the leg.  Deir ez-Zor in particular is struggling with sleeper cells; all of the attacks last month except for those in Al-Hol and one in Raqqa took place in Deir ez-Zor. In recent months, the eastern countryside of Deir ez-Zor in particular has seen an escalation in assassinations on SDF members, AANES employees, and notable tribal members and civilians.  

Given this trend, it is not surprising that the SDF tells RIC ISIS sleeper cells are particularly active in Deir ez-Zor and Heseke regions. SDF tells RIC that according to their latest estimate 12,000 ISIS affiliates remain in North and East Syria (out of a population of ~3 million), many of them are in these two regions.

In addition to assassinations, ISIS affiliates arrested in raids this month admitted to planning prisons breaks for other ex-ISIS fighters, and extorting civilians for zakat (a corruption of the Islamic practice of almsgiving to the needy).

However, ISIS is far from the only concern for AANES security forces. In September, a raid in Tabqa led to the arrest of 20 people from a Turkish intelligence sleeper cell. Some of those arrested were found to have impersonated SDF and Asayish members, during which they are known to have attacked people and their property in the city of Tabqa. As with last month, many of the raids resulting in the arrest of ISIS members also brought to light documents showing links to Turkish intelligence, suggesting that at this point, the difference between the two has become minimal.

In Al-Hol, attacks and deaths dropped since last month. There were four murders in Al-Hol in September, and at least two of the victims were Iraqi women, one of whom was 18 years old. It’s important to note that in 2018, Iraq agreed to take back 5000 individuals. However, to date only 868 have been repatriated. The latest batch was 467 individuals who were returned this September. Three hundred more families that have been cleared for return are still waiting in the camp, facing dangerous conditions in the meantime.

The raids in Al-Hol this month resulted in the arrest of three people connected with a Hawala money exchange network within the camp (called Al-Farouk’s), as well as a smuggler who was planning to help people leave the camp. The smuggler and others who were arrested in two thwarted escape attempts, confirmed the existence of smuggling routes running from Al-Hol through Turkish-occupied Sere Kaniye.

Also notable is an escalation of hostilities between ISIS and Iranian backed Liwa al-Quds militia. This month only one attack took place within the boundaries of NES, in the countryside of Deir ez-Zor. The attack resulted in the deaths of two Liwa militia members. Not counted in our numbers are two additional attacks ISIS carried out against NDF forces in the Syrian desert, between Palmyra and Deir ez-Zor, directly outside the lines of AANES territory, as well as a shelling of Liwa al-Quds headquarters which resulted in the death of 8 militants. These attacks all represent a notable escalation of hostilities between Iranian-backed forces and ISIS affiliates, and preliminary data from October suggests this trend is continuing.

Please contact us for the fully sourced data-set sortable by incident type and location, the live map showing all ISIS and other sleeper-cell attacks since the start of the year, and further analysis. This data was produced in collaboration with OSINT researcher Caki, and can be partially explored on the live map here.