U.S. and European counterterrorism officials believe Islamic State has changed its operational tactics by borrowing from al Qaeda’s playbook, deploying trusted lieutenants to engineer larger, more coordinated plots against the West.
The attacks in Paris were the latest and most visible manifestation of this new approach, U.S. intelligence and law enforcement officials suspect. Intercepted communications and other intelligence analyzed after two other earlier large-scale attacks in Beirut and Ankara, Turkey, similarly suggest those plots were directed by Islamic State leaders in Syria and Iraq and carried out by local leaders empowered to take action in the group’s name, U.S. and European counterterrorism officials said.
While the goal of Islamic State hasn’t changed—build a caliphate in Syria and Iraq, and launch attacks against Western enemies on their own soil—the details of the Paris plot suggest it has moved beyond its early strategy of seeking to inspire plots from a distance, according to counterterrorism officials.
A shift toward the al Qaeda model could make Islamic State plots easier to detect, some officials say. The more people involved in a terror plot, the more likely investigators are to be able to learn about the group and penetrate it, either with electronic surveillance, an undercover operative, or both, those officials say.
Others cautioned that no matter the operational changes under way, Islamic State is still showing a degree of operational care, flexibility, and secrecy that makes it dangerously effective. That includes a heavy use of encrypted communications technologies.
For years, U.S. officials focused on Islamic State as a terror group born in the digital age using social media to inspire disgruntled individuals to carry out “lone wolf” attacks in their own countries. With no formal connections to the group, such suspects are difficult to identify and deter.
This approach was a significant departure from how al Qaeda operated. That group’s leader, Osama bin Laden, had a reputation among counterterrorism officials as something of a micromanager, so much so that for the attacks against U.S. embassies in 1998, he specified on a map precisely where he wanted a bomb-laden truck to approach the building, according to court testimony of a former al Qaeda conspirator.
Abdelhamid Abaaoud, the suspected ringleader of the Paris plot who was killed in a police raid Wednesday, had been a focus of French and U.S. intelligence agencies for more than a year.
This summer, using communications intercepts and other types of intelligence, they tracked him across Syria and Iraq, including in Islamic State’s self-declared capital of Raqqa in Syria. Then, suddenly, he disappeared from their view. Officials didn’t know it at the time, but now say they believe he had worked his way home to Belgium to plan and lead terror attacks, U.S. officials said.
A number of U.S. officials described Mr. Abaaoud as either a “trusted lieutenant” or a “field general.” He had the confidence of his superiors to return to Europe with general instructions to launch attacks and with significant leeway to choose the targets and timing, these people said.
Investigators say they believe Mr. Abaaoud was what counterterrorism officials call an “external operations” man: someone who plans and oversees terror attacks overseas. Officials say they believe Islamic State has deployed a number of similar field generals to other regions.
European radicals are slipping in and out of Syria along routes also used by organized-crime gangs to ship contraband such as drugs across the continent, European officials say, making it easier to deploy trusted lieutenants around the world. U.S. counterterrorism officials don’t believe Islamic State lieutenants have slipped into the U.S.
Officials are trying to see whether that operational model could help explain the alleged downing of a Russian passenger plane last month in Egypt, which Moscow said was caused by a bomb.
Islamic State’s affiliate in Egypt’s Sinai Peninsula claimed responsibility for bringing the plane down and U.S. intelligence agencies say the available evidence points to terrorism as the cause.
So far, however, U.S. intelligence agencies have yet to find evidence that Islamic State militants in Iraq and Syria directed the alleged plot, as appears to be the case in Paris. They suspect militants in the Sinai branch of Islamic State carried out that attack autonomously, though officials cautioned there is much they don’t know.
A more directed and dispersed Islamic State operation relies heavily on deploying a sophisticated communications network and techniques that can partly evade Western surveillance agencies.
According to an FBI analysis performed earlier this year, about a third of all Islamic State communications are transmitted through encrypted channels, which can frustrate investigators’ monitoring.
Almost as significantly, according to U.S. counterterrorism officials, is a practice by Islamic State militants of hopping between multiple communications methods.
It is a digital version of the way drug dealers try to evade police surveillance by repeatedly changing phones.
Often, officials say they see suspects skipping repeatedly between many different channels, leaving counterterrorism officials concerned that even when they are monitoring an individual, they are still missing key parts of those conversations, these people said.
Bruce Hoffman, a Georgetown University professor who has long studied terror networks, said Islamic State has “been anxious to make this shift for a long time,” to more sophisticated and coordinated terror attacks.
“It’s a learning curve.’’ The group has a large number of foreign fighters, whom Mr. Hoffman dubbed “cannon fodder” but also a cadre that can build a more sophisticated infrastructure.
Mr. Hoffman said Islamic State has long aspired to conduct larger, al Qaeda-like attacks, and they appear to be getting closer to that goal.
James Comey, director of the Federal Bureau of Investigation, says at a news conference Thursday that investigators have found no links between the Paris attackers and the U.S., but that the primary threat is from those inspired by ISIS. Photo: Associated Press
Islamic State for nearly a year has sent out highly selective recruitment notices through their network of supporters both in Europe and nations with large Muslim populations such as India and Sudan, according to the terror group’s own documents and officials monitoring its growth. It has been trying to hire petroleum engineers, telecom engineers, doctors and other white-collar professionals as it shifted focus from fighting for territory to ruling it.
The result has been an expanded coterie of foreigners, both from Arab and European nations whose technical knowledge could be used for civilian or military purposes, according to two European law-enforcement officials who monitor the exodus of their citizens to Syria.
Islamic State is clearly trying to feed the perception that the sophistication of its operations are growing.
In a video released after the Paris attacks, members of the group claim attacks like the one in Paris will soon be unleashed on Washington and Rome.
Another video suggests similar attacks will happen in New York, though officials said there is nothing particularly new about such threats. On Thursday, Federal Bureau of Investigations Director James Comey said he isn’t aware of any specific credible threats in the U.S.
_______________________
ByDEVLIN BARRETTand ADAM ENTOUSin Washington and BENOÎT FAUCON in Paris—Margaret Coker contributed to this article. http://www.wsj.com/articles/islamic-state-tactics-shift-borrowing-from-al-qaeda-1447980471