Did ISIS Directly Threaten the United States?

For the counter-ISIS war to have been based in preventive war logic with regards to America’s homeland security, ISIS must have been seen as lacking the capability to direct major attacks inside the United States. This section reviews administration and government statements regarding the character of the ISIS threat and a variety of indicators of ISIS's capability to conduct attacks in the United States, and concludes that ISIS lacked the capability to direct major attacks inside the United States. This section also examines ISIS's capabilities in Europe, finding that ISIS did demonstrate a capability and intent to direct attacks in Europe, forming the basis for a justifiable European preemptive war logic. However, the comparison to Europe also illustrates how far the American case fell from matching the European level of threat.

One of the clearest signs that the ISIS threat was not imminent at the time the counter-ISIS war was initiated is that the government itself repeatedly and via various institutions assessed that there was no known evidence of a direct ISIS threat to the homeland. The government continued to share this assessment long after the decision to initiate the counter-ISIS war was made, suggesting that it did not view its initial assessment as incorrect.

Among those who made such comments are President Obama himself, who on September 10, while authorizing the escalation of the war into Syria stated that “we have not yet detected specific plotting against our homeland.”¹ National Counterterrorism Center Director Matt Olsen said that “we have no credible information that ISIL is planning to attack the United States” and described the threat as potential, adding there was no evidence of ISIS cell development inside the United States.² Also in September, Department of Homeland Security Secretary Jeh Johnson stated, “At present, we have no credible information that [ISIS] is planning to attack the homeland of the United States.”³ In August 2014, Pentagon Spokesperson Rear Admiral John Kirby stated that the Defense Department did not believe that ISIS had “the capability right now to conduct a major attack on the U.S. homeland.”⁴ Chairman of the Joint Chiefs of Staff General Martin Dempsey also stated in August that there had not yet been evidence that ISIS was engaged in “active plotting against the homeland, so it’s different than that which we see in Yemen.”⁵ Nor did officials change their assessment with the beginning of the military campaign. In February 2015, Department of Homeland Security Undersecretary for the Office of Intelligence and Analysis Francis X. Taylor said, “We are unaware of any specific, credible, imminent threat to the Homeland.”⁶

The Department of Homeland Security’s National Terrorism Advisory System (NTAS) provides another set of evidence of the government’s lack of knowledge of any direct ISIS threat to the homeland. In April 2011, the Department of Homeland Security replaced the infamous color-coded Homeland Security Advisory system with NTAS. Under the NTAS system, an alert would be sent out when there was important information distinguishing between either an “elevated” threat with no specific information on timing or location or an “imminent” threat otherwise.⁷ Even as ISIS spread across Iraq and the United States initiated its counter-ISIS war in 2014, NTAS provided no alerts until December 2015, when it issued its first bulletin.⁸

The first bulletin, released on December 16, 2015, read, “We know of no intelligence that is both specific and credible at this time of a plot by terrorist organizations to attack the homeland.”⁹ The first bulletin was replaced by a second bulletin issued on June 15, 2016 that stated the previous bulletin’s “basic assessment has not changed.”¹⁰ In the wake of the deadly ISIS-inspired attack in Orlando, the bulletin again repeated that “we know of no intelligence that is both specific and credible at this time of a plot by terrorist organizations to attack the homeland” while reiterating the threat of inspired violence, which was also described in the previous bulletin.¹¹

One of the clearest signs that the ISIS threat was not imminent is that the government repeatedly and via various institutions assessed that there was no known evidence of a direct ISIS threat to the homeland.

In November 2016 a new bulletin again reported no change in the basic assessment, emphasized inspired violence, and reiterated the lack of evidence of credible plots to attack the homeland by foreign terrorist organizations.¹²

In May 2017, five months before ISIS lost Raqqa, the self-declared capital of its caliphate, NTAS changed its bulletin language, dropping the lack of evidence of credible plots reference.¹³ Instead it stated, “We face one of the most serious terror threat environments since the 9/11 attacks as foreign terrorist organizations continue to exploit the Internet to inspire, enable, or direct individuals already here in the homeland to commit terrorist acts.”¹⁴ Further bulletins largely mirrored the May 2017 language.¹⁵

However, it seems unlikely that this change represented newfound organizational plots against the United States. The bulk of the bulletin remains focused on inspired and enabled violence, no alert was provided regarding an imminent threat, and the bulletin came as ISIS's territorial holdings crumbled.

Another set of sources for evaluating the government’s assessment of the ISIS threat to the homeland is the U.S. intelligence community’s Worldwide Threat Assessments. These assessments repeatedly stated that the most likely threat to the United States remained homegrown terrorism rather than ISIS-directed attacks.¹⁶ Though none of these assessments include language denying foreign terrorist organization plots, it would be odd if there was a major credible threat and the assessments failed to mention it while emphasizing homegrown, inspired violence.

Government statements are limited in their ability to measure whether there is in fact a direct threat. They can be incorrect in their assessments or the threat can grow rapidly after an assessment is made.¹⁷ It is therefore important to also look at the indicators themselves.

An examination of several indicators of threat suggests that while ISIS may at some point have come to pose a direct threat to the United States, it did not pose one at the time the United States decided to embark upon a military campaign.

The primary indicator of threat referenced in justifying the need for military action to respond to growing risks to the homeland was the large number of foreign fighters traveling to Syria and Iraq.¹⁸ Other oft-cited indicators included the extent of territory and money available to ISIS, which could allow it to be selective in recruiting for and preparing sophisticated elite-staffed attack plots from its safe haven and its ability to launch multiple attack plots without needing each one to succeed.¹⁹ These indicators are very real sources of concern, yet they do not constitute evidence of a direct threat that would turn America’s preventive logic into a preemptive logic.

There is a geographic split in the indicators. The above indicators of threat exist on the Syria and Iraq side of the ledger, describing how ISIS managed to build an unprecedented safe haven that could potentially pose a risk to the homeland and absolutely posed a threat to those living in or near ISIS's territory. In contrast, viewed from the United States’ side, the indicators did not show a substantial threat to the homeland. In the 18 years since 9/11, no jihadist foreign terrorist organization has carried out a deadly attack inside the United States and no foreign fighter or individual who received terrorist training²⁰ abroad has carried out a deadly attack, according to New America’s research.²¹

This geographic indicator split calls into question the validity of measuring the threat to the United States based on signs of ISIS strength abroad. Jihadist groups face substantial difficulties in projecting power from their safe havens into geographically distant areas, and doing so requires investments that tend to provide indicators of threat.²² One study of terrorist attacks, suggests that terrorism outside of conflict zones is declining while terrorism in conflict zones is increasing, further calling into question the extent to which a threat to the United States can be surmised from signs of jihadist strength abroad—at least in the short term.²³

ISIS's rise sparked fears that the United States’ record of success in avoiding attacks might change. Yet more than five years after the United States’ initiation of a counterterrorism war, and eight years into the Syrian conflict, there is little evidence that ISIS developed the capability to direct attacks inside the United States. Of course, it is possible that, absent intervention, ISIS would have developed the capability, but that is a preventive logic. If ISIS had the capability prior to the initiation of the war, it would be expected that there would be some evidence of that capability’s development by now.

With regards to foreign fighters, no returnee from Syria has conducted an attack inside the United States. In addition, there is only one case where a returnee from Syria is publicly known to have plotted an attack in the United States upon their return—that of Abdirahman Sheik Mohamud.²⁴ That attack plot was linked to Jabhat al-Nusra, al Qaeda’s Syrian affiliate, not ISIS. In addition, it appears that he was known to the FBI prior to his travel to Syria.²⁵ The case remains shrouded in mystery, but there is reason for skepticism that it demonstrates a significant al Qaeda—let alone ISIS—capability in the United States given these details.²⁶

More than five years after the United States’ initiation of a counterterrorism war, and eight years into the Syrian conflict, there is little evidence ISIS developed the capability to direct attacks inside the United States.

The number of Americans who joined ISIS or otherwise traveled to fight in Syria was relatively low compared to other countries. In August 2014, the government placed the number of Americans fighting with any faction in Syria at 100 people, and National Counterterrorism Center Director Matthew Olsen confirmed that the number fighting with ISIS was likely about a dozen individuals.²⁷ The United States’ latest updated count is that 300 Americans went or attempted to fight with any group in Syria.²⁸

Far from discussing an influx of returnees to the United States, Olsen portrayed it as a matter of individuals returning.²⁹ Public tracking of known returnees has identified relatively few who returned to the United States, many of whom came back under the supervision of law enforcement.³⁰ Whatever the true number, it is far from the feared wave of returnees.

While many pointed to the Afghan conflict as an example of the danger of foreign fighter flows, in the more recent foreign fighter mobilization to Somalia, no returnee to the United States was accused of plotting an attack.³¹ It is reasonable to suggest that ISIS was a different type of organization with more power and thus posed a greater threat of attacks on the homeland than al Shabaab.³² On the other hand, it is worth noting that prior to 9/11, the United States did very little to track jihadist foreign fighters, making the Afghanistan case a questionable comparison for post-9/11 threat assessments.³³

ISIS's wealth is not a strong indicator for the potential for attacks in the United States as most attacks require little funding.³⁴ ISIS sympathizers in the United States have proven themselves capable of self-funding, especially given that most attacks do not cost much.³⁵ In addition, while ISIS had access to lots of money, it also had substantial costs due to its need to defend and, to some extent, govern its large territorial holdings; this dynamic makes ISIS's wealth somewhat resilient to military action.³⁶

Generally, the flow of money, personnel, and other material involving the United States was from the United States to ISIS—not from ISIS into the United States. Based on two separate reviews of American terrorism court cases, there appears to be only one known exception to this assessment: the case of Mohamed Elshinawy.³⁷ According to the government, he had received $8,700 from abroad to help finance a terrorist attack in the United States.³⁸

The amount in question in the Elshinawy case is small and not dissimilar from what ISIS sympathizers are able to raise via means of self-financing.³⁹ Four men were able to raise that amount of funds in a case based out of San Diego to send to al Shabaab in 2007 and 2008.⁴⁰ In addition, the threat was not dependent on ISIS's territory in Syria, and could be more effective when conducted from outside of Syria in a dispersed network of the kind likely to be left after military action.⁴¹ The Elshinawy case provides a warning regarding jihadist innovations, but it does not demonstrate a great capability of ISIS to finance terror inside the United States.

There are three indicators of a potential ISIS threat to the homeland worth considering beyond ISIS's strength in the Middle East. However, none of these indicators provide a strong case to reject the conclusion that the war was justified on the basis of preventive rather than preemptive homeland security reasons. Hanging a case of preemptive war on these indicators carries substantial risks.

Inspired Plots

One indicator of ISIS threat in the United States that increased over the course of ISIS's rise is the number of attacks and attack plots where the perpetrators were inspired by ISIS as well as an increase in the number of jihadist terrorism cases generally being charged in the United States.

Since 2014, individuals inspired by jihadist ideology killed 83 people constituting more than three quarters of the 104 deaths in jihadist attacks since 9/11.⁴² Of the eight deadly attacks in this period, seven were ISIS inspired, and only one was not.⁴³ In addition, there were more than a dozen non-lethal attacks in the same period.⁴⁴ This level of attacks represents an unprecedented increase compared to the rest of the post-9/11 period.

The increase in attacks was matched by a spike in terrorism cases generally. In 2014, the United States charged⁴⁵ 32 people—an increase from the 17 people charged in 2013.⁴⁶ The rise from 2013 to 2014 was a leading indicator, and the number spiked to an unprecedented 80 cases in 2015.⁴⁷

While this rise in cases and inspired attacks shows a potential increased ability for ISIS to connect its efforts abroad with capabilities in the United States, that possibility remained a potential rather than a demonstrated, direct capability, as none of the deadly attackers were directed by ISIS.

Enabled Plots

While no deadly jihadist attacker in the United States since 9/11 is known to have had operational contact with ISIS militants based in Syria, there was one non-lethal attack and several plots in which the attacker or plotter communicated with ISIS militants abroad.⁴⁸ According to John Carlin, assistant attorney general for national security at the time, the government found itself challenged by centralized efforts by individuals like British ISIS militant Junaid Hussain to organize attacks over the Internet.⁴⁹ According to Carlin, Hussain posed an “imminent threat.”⁵⁰ Much of this activity occurred after the initiation of America’s counter-ISIS campaign, but at least some occurred earlier. A preemptive logic could theoretically be based on these plots. Indeed, the U.S. war included an effort to specifically target ISIS militants involved in such virtual enabling.⁵¹

However, hanging a case for the counter-ISIS war as preemption rather than prevention on ISIS's virtual recruiters poses serious concerns. Virtual recruitment activity was not limited to Syria.⁵² There is also little evidence that the presence of a virtual recruiter increases the threat of or lethality of jihadist attacks or otherwise meaningfully distinguishes them from inspired attacks.⁵³ In the case of the United States, several of these plots appear to have been in early stages and infiltrated by informants or otherwise detected by law enforcement methods.⁵⁴

There is little evidence that the presence of a virtual recruiter increases the threat of or lethality of jihadist attacks.

A case for preemption based on ISIS's virtual enablers risks a vision of preemption that is extraordinarily broad. Geographically, it would likely justify military strikes globally and with little clarity of what in practice distinguishes a virtual enabler from an enthusiastic individual promoting jihadist violence online but without any official title. ISIS's virtual enablers did not feature in the justification presented for initiating and escalating the war on ISIS by the Obama administration in the time period examined in this report. Even if policymakers determine that a case for preemption can justifiably be based on the existence of virtual recruiter plots, substantial work is required to bound the applicability of such logic and provide transparency and limits to its implementation.⁵⁵

Aviation Plotting

A third indicator that might support an argument that U.S. action was preemptive is ISIS's plotting against aviation. Aviation plots pose a particular risk for the United States because they allow jihadists to avoid many of the United States’ layered defenses that make it difficult to organize jihadist activity inside the country. Instead, jihadists are able to take advantage of worse security conditions in countries with flights to the United States, only needing to circumnavigate airport security.

In the post-9/11 era, attacks on aviation have constituted the closest foreign terrorist organizations have come to successfully directing a major deadly attack in the United States. Of the three attacks in the United States that had direction from a foreign terrorist organization in the post-9/11 era, two (the 2001 shoe bomb attack in which Richard Reid managed to get a bomb onto a transatlantic flight and the 2009 underwear bomb attack in which Umar Abdulmuttalab managed to get a bomb onto a flight over Detroit) targeted aviation.⁵⁶ In addition, there are multiple other foiled aviation plots that targeted the United States.⁵⁷

Over the course of the military campaign against ISIS, there were indications that ISIS has the intent and some capability—at least outside of the United States—to attempt aviation attacks. The most serious such indication came in December 2015, when ISIS's affiliate in Egypt bombed an airliner carrying Russian tourists home from Sinai, killing everyone aboard.⁵⁸ However, this plot involved an insider based in Egypt, so it is unclear to what extent it was reliant on ISIS's territory in Syria.⁵⁹ It also likely benefited from the weaker precautions in Egypt compared to most Western airports.

There have been other indications of ISIS's intent to conduct aviation attacks. In 2017, an ISIS virtual enabler attempted to organize an attack on aviation from Australia.⁶⁰ The Australia plot was a source of major concern, according to former National Counterterrorism Center Director Nicholas Rasmussen. Although, as Rasmussen noted, the effectiveness of military action to suppress the threat is limited: “Now we have to proceed from the assumption that this is a threat that could manifest itself literally anywhere in the world. And so that puts much more pressure on the global aviation community and the technological solutions rather than intelligence disruption solutions.”⁶¹ In 2017, an aviation threat from Syria gained attention, this time involving ISIS's development of laptop bombs capable of being smuggled on to planes, but according to the Department of Homeland Security (DHS) there was not an imminent threat.⁶²

There were also earlier indicators of a threat from Syria. In September 2014, administration officials cited a threat from Syria involving the development of sophisticated explosives that could be smuggled past airport security. However, the threat was connected to the so-called Khorasan group, a set of senior al Qaeda figures who relocated to Syria from South Asia, not ISIS. ⁶³ Despite initial claims that the threat was imminent, other later reporting suggested that it was more of an aspirational threat.⁶⁴ The Obama administration, however, certainly saw the Khorasan threat as serious.⁶⁵

Aviation attacks remain an important concern, one where indicators of security against jihadist attacks inside the United States are unlikely to identify threats because most of the activity occurs outside the United States until the attack itself. Yet, there is little evidence that ISIS demonstrated such a capability against the United States, and even less that there was a credible threat of such an attack at the time of the initiation of the military campaign. Even with the fall of ISIS's territory in Syria and Iraq, DHS continues to emphasize the threat of aviation attacks, suggesting that the threat is somewhat resilient to military action.⁶⁶ Moreover, as the bombing of the Egyptian flight shows, the threat is unlikely to be contained to any particular territorial location, limiting the ability of preventive war to change the threat.⁶⁷

In contrast to the United States, Europe suffered multiple sophisticated attacks carried out and directed by ISIS from its territory in Syria and Iraq. ISIS's attacks in Europe were preceded by clear evidence of ISIS's capability—that was known in many cases at the time—illustrating the meaningful difference between a potential European case for preemptive war and the United States’ preventive logic.

Europe had already seen an attack by a Syrian foreign fighter returnee who had joined ISIS, and may have been directed to conduct his attack by ISIS, in May 2014 prior to ISIS's taking of Mosul and the initiation of the war. On May 24, 2014, Mehdi Nemmouche shot and killed four people at a Jewish museum in Brussels, and was arrested six days later in Marseilles, France.⁶⁸ Nemmouche had an ISIS flag in his possession when he was arrested, and authorities (and the public) knew he had spent a year in Syria with jihadists.⁶⁹ At the time, it was not clear to what extent Nemmouche and his attack were tied to or directed by ISIS.⁷⁰

In contrast to the United States, Europe suffered multiple sophisticated attacks carried out and directed by ISIS from its territory in Syria and Iraq.

It is now clear that Nemmouche was deeply tied into the network that would produce the clearly directed Paris and Brussels attacks of November 2015 and March 2016, respectively.⁷¹ Nemmouche, on his arrival in Syria, joined a brigade connected to ISIS at the time.⁷² The sub-group Nemmouche joined was led by Abdelhamid Abaaoud, the key plotter behind the 2015 Paris attacks, and phone records show that Nemmouche conversed with Abaaoud after having left Syria in 2014.⁷³ Nemmouche also had connections to Ibrahim Boudina, another French national with preexisting ties to jihadist networks in France who had left to fight in Syria around the same time as Nemmouche.⁷⁴ Not merely another connection to Nemmouche, Boudina returned to France where he was arrested in August 2014 for plotting a bomb attack.⁷⁵ Once again, it is not entirely clear if Boudina was acting on ISIS's orders, but like Nemmouche, he represents a clear case of a returnee attack plot at least connected to ISIS's networks.⁷⁶

Whether or not these attacks had formal authorization from ISIS, they demonstrated that ISIS already had—through those who joined it—the proven capability to directly conduct attacks in Europe. This was combined with far greater indicators of threat than in the United States. According to Europol’s 2019 terrorism trend update, more than 5,000 Europeans traveled to Syria in Iraq over the course of the conflict—more than 16 times the number of Americans who traveled or attempted to travel to Syria.⁷⁷ Moreover, both the United Kingdom and France each had more foreign fighters who reached Syria than the total number of Americans who attempted to go or made it there.⁷⁸ A sample of more than 3,500 ISIS entry records from 2013 and 2014 examined by New America included 36 times more Western Europeans than it did Americans.⁷⁹

This vast difference in threat was also reflected in arrest numbers. Over the five years from 2014 to 2018, slightly fewer than 200 Americans were arrested for jihadist terrorism-related crimes.⁸⁰ In contrast, over the same period, according to EUROPOL’s 2019 terrorism trend report, more than 3,000 people were arrested for jihadist terrorism crimes; more were arrested every year than were arrested in the entire period in the United States (and these numbers do not include arrests in Britain).⁸¹ In addition to a larger number of arrests, Europe has a larger number of jihadists being monitored. France alone, for example, reportedly had 3-5,000 people under surveillance for jihadist terrorism reasons.⁸²

By the beginning of 2015, there was increasing evidence of an institutionalized ISIS effort to use its already demonstrated capability to conduct directed attacks.⁸³ In January 2015, Belgium foiled a major attack plot when it conducted a series of raids in Verviers.⁸⁴ Authorities found that multiple foreign fighters who had returned from Syria, weapons, and deep connections to European networks were all present in the plot.⁸⁵ The attackers were in contact with Abaaoud regarding detailed operational matters, and he signaled the official connection by celebrating the attack via official ISIS media channels a month later.⁸⁶

Whereas in the United States, there are no known cases of individuals who trained with ISIS in Syria and then returned to plot attacks in the United States, and only one case of a Syrian returnee attack plot (tied to Jabhat al Nusra), the New York Times counted 21 such fighters who returned to Europe with the intent to conduct attacks over 2014 and early 2015.⁸⁷

The comparison of the threat indicators in Europe to those in the United States suggests that Europe had a case for preemptive war as opposed to preventive war. ISIS did manage to directly reach out and attack Europe in November 2015 and then again in Brussels in March 2016 with teams of attackers deeply and undeniably tied to and explicitly directed by ISIS from its territory in Syria and Iraq.

The comparison also shows just how distinct the United States’ preventive logic was from the potential European preemptive logic. In addition, the repeated warning signs and indicators in the European case suggest that ISIS'sexternal attacks should not be seen as a surprise requiring vast preventive wars, but were identifiable as a direct manifestation of a threat well before ISIS carried out the Paris and Brussels attacks.