How did the Islamic State's rise reshape jihadist plots inside Australia? Part 1

My first AVERT post examined which Australian terrorist plots had been genuinely connected to Islamic State, and what forms these connections took. For this post, I look at the wider impact Islamic State had on Australia’s terrorist threat.

This post will show how the threat has changed since the Islamic State’s rise in 2014 while the next post, Part 2, will discuss why these changes came about.

This table presents nine distinct changes to jihadist plots inside Australia before and after 2014, which I will elaborate on below. Jihadism refers to the violent global movement associated with al-Qaeda, the Islamic State, and like-minded groups. It’s an imperfect term, as it disregards the many wider uses of the term “jihad” within Islam, but it’s a widely-recognised term and one used by these extremists themselves. Keep in mind that this does not represent the entirety of Australia’s terrorist threat. For example, there is also the threat of far-right violent extremism, which I will discuss more in a later AVERT post.

2014 was a clear turning point. This was the year that Islamic State seized the Iraqi city of Mosul, claimed to have recreated the Caliphate, and called on its supporters to carry out attacks in their home countries. The table demonstrates that there have been dramatic changes in the jihadist threat facing Australia since then.

More casualties

The most consequential change is that multiple attacks after 2014 managed to injure and kill people. From 2014- 2018 Australia had experienced seven violent attacks with apparent jihadist inspiration. These were the September 2014 Endeavour Hills stabbing, the December 2014 Lindt Café siege, the October 2015 murder of NSW Police employee Curtis Cheng, the September 2016 Minto stabbing, the May 2017 Brighton siege, the February 2018 Mill Park stabbing and the November 2018 Bourke Street attack. However, several of these attacks had a complex mix of motivations and there is plenty of reasonable debate to be had over how strong the jihadist element was. For example, there has been public debate over how to classify the Lindt Café siege. Similarly, I have only tentatively included the Minto stabbing, as the perpetrator admitted the attack and reportedly told the police he was an Islamic State sympathiser but pleaded not guilty on mental health grounds.

These seven attacks killed five people, and injured several more. Two hostages, Tori Johnson and Katrina Dawson, were killed in the Lindt Café Siege, NSW Police employee Curtis Cheng was killed in the Parramatta police station shooting, Hotel clerk Kai Hao was killed in the Brighton siege, and Melbourne restaurant icon Sisto Malaspina was killed in the Bourke Street attack. Five of the perpetrators also died in these attacks. In contrast, all of Australia’s jihadist plots before 2014 were foiled.

More plots

Another key change has been the sheer increase in the number of attempted attacks. During the Islamic State era, Australia not only experienced the seven violent attacks but also a range of unsuccessful plots. There have been eleven jihadist plots proven in court since 2014 and there are around four alleged jihadist plots yet to go through court. Therefore Australia has experienced up to twenty-two jihadist plots in the last five years.

In contrast, there were only four such plots from 2000-2013. These include the Jack Roche plot, instigated by al-Qaeda, to bomb Israeli and Jewish targets during the 2000 Sydney Olympics, Faheem Lodhi and Willie Brigitte’s plot to bomb targets in Sydney, two cells in Melbourne and Sydney disrupted by Operation Pendennis in 2005, and a plot by Melbourne-based supporters of the Somali jihadist movement al-Shabaab to attack Holsworthy army barracks in Sydney foiled by Operation Neath in 2009. This is a substantial change, from four plots over thirteen years to over four plots a year.

Simpler and smaller plots

The recent attacks proved more difficult to foil than the earlier plots, not only because they have been more frequent but because of their simpler methods. The Islamic State era plots have been less elaborate than the earlier plots and planned over shorter periods of times. They required much less planning and therefore had a lower chance of detection.

These simpler methods were reflected in the choice of weapons. The first three plots in Australia (the 2000 Roche plot, the 2003 Lodhi/Brigitte plot and the 2005 Pendennis plot) all involved plans to set off bombs, while the 2009 Operation Neath plotters sought to use automatic firearms. In contrast, the clear majority of the 2014-2018 plots did not involve explosives. Nine of these plots involved the use of knives, and several others involved handguns and shotguns.

Only four of the twenty-two recent plots have involved explosives. These were the May 2015 Melbourne plot, the December 2016 Federation Square plot, the alleged July 2017 Sydney plane plot, and the November 2018 Bourke Street attack. Some of these attempts were sophisticated, such as the alleged plane plot, but some were simple. The Bourke Street attacker’s attempt to cause an explosion by igniting gas canisters contrasts sharply with the 2005 Pendennis plotters’ elaborate attempts to use chemicals and laboratory equipment to manufacture their own explosives.

Similarly, the Islamic State era plots have involved much smaller groups. Only in four recent cases (the December 2014 Sydney plot, the December 2016 Melbourne plot, the alleged November 2018 Melbourne plot, and the plot to murder NSW Police employee Curtis Cheng) were more than two people charged with terrorism offences for a single plot. This contrasts with the twenty-two people charged (with eighteen convicted) under Operation Pendennis in 2005 and the five people charged (with three convicted) under Operation Neath in 2009. Instead, almost all the Islamic State era plots have involved either lone individuals or pairs.

Shifting targets

Another change has been the choice of targets. The pre-2014 plots had a wide range of targets, including Israeli diplomatic facilities, Holsworthy Army Barracks, and possibly electricity stations in Sydney and the Lucas Heights nuclear reactor. No single target stood out. In the Islamic State era, around eight of the plots have had one target in common: police officers.

Sometimes police were the only target, other times the police were one target among others. For example, in the 2015 Melbourne Anzac Day plot Sevdet Besim planned to drive his car over a police officer, steal their gun, and then shoot other people nearby, while in the October 2016 Sydney plot the individual was believed to have included a police station and a court house among their intended targets. This focus on police should not be overstated, as the range of targets among the 2014-2018 plots remains diverse, but police have clearly become a much more prominent target than they were before the rise of Islamic State.

Women and children as direct actors

Another change is that women have become directly involved in Australia’s jihadist plots. Female Bangladeshi student Momena Shoma pleaded guilty to an act of terrorism for her Islamic State -inspired stabbing of her Melbourne host, while Sydney woman Alo-Bridget Manoa has been found guilty of plotting a terrorist attack with her husband. In contrast, no women were charged over any of Australia’s pre-2014 jihadist plots.

Several children have also been involved in recent terror plots, the most well-known being fifteen-year old Farhad Jabar who murdered Curtis Cheng. Similarly the December 2014 Sydney plot, the May 2015 Melbourne plot, the April 2016 Sydney plot, and the October 2016 Sydney plot, all resulted in the convictions of people under eighteen years old. No children were charged over involvement in Australia’s earlier jihadist plots.

Lack of overseas training

Finally, most of Australia's pre-2014 plots involved some people who had returned from training with jihadist groups abroad. Jack Roche had trained with al-Qaeda in Afghanistan, Faheem Lodhi and Willie Brigitte had trained with Lashkar e-Toiba in Pakistan, Shane Kent from the Melbourne Pendennis cell had trained with al-Qaida and Moustafa Cheikho from the Sydney Pendennis cell (and reportedly others) had trained with Lashkar e-Toiba. Yacqub Khayre, who was charged over the 2009 Holsworthy Barracks plot but was acquitted, had briefly attended an al-Shabaab training camp in Somalia.

In contrast, none of the plots from 2014 onwards involved anybody who had returned to Australia after training with Islamic State. Only one recent plot involved someone who had attended any jihadist training camp abroad, and this was the same Yacqub Khayre mentioned above. In June 2017, around eight years after his brief involvement with al-Shabaab (he is believed to have fled the training program), he carried out the Brighton siege. Otherwise, none of the recent plotters in Australia had received any formal training overseas.

There had been widespread concerns that Australia would face attacks from terrorists trained by Islamic State, just as other countries have, but instead Islamic State ended up changing Australia's jihadist threat in quite different ways.

The Islamic State’s impact

In short, the Islamic State's rise and the unprecedented global reach of their influence have seen a dramatic escalation of jihadist plots in Australia. Compared to the 2000-2013 era, Australian jihadist plots have become much more frequent, been carried out by smaller cells using simpler methods, tended to use knives and firearms and often targeted police, involved more women and children among the perpetrators, and almost never involved individuals who had trained with jihadist groups abroad. The most unfortunate development is that the Islamic State era plots have been more likely to harm people, so far resulting in five deaths (not including the perpetrators) and many injuries.

Why the Islamic State's rise had such a transformative effect on Australian jihadism will be discussed in the next post.


What does Australian law say about possessing terrorist instructional material?

What does Australian law say about possessing terrorist instructional material?

In mid-October, the NSW Department of Public Prosecutions withdrew a terrorism charge against a 25-year old Sri Lankan student. The charge, "collecting or making a document which is connected with preparation for, the engagement of a person in, or assistance in a terrorist act", centred on writing found in a notebook reportedly listing targets for a potential terror attack. The charge was dropped after a forensic examination failed to conclude that the student had written these notes. The NSW Joint Counter Terrorism Team's investigation "shifted to focus on the possibility that the content of the notebook [was] created by other people".

The affair raises questions: where does this sort of material sit legally? Is it necessarily a crime, in Australia, to possess or produce written material that provides instructions for terrorism?

There isn't an immediately clear answer. This is not because of any lack of laws, but because of disagreement over how to interpret them. It has been one of the lower-profile legal controversies in Australian counter-terrorism.

In this post, I want to unpack the legal position of terrorist instructional material in Australia. I will outline how the courts have dealt with it so far, by looking back at past prosecutions and what they tell us about where such material sits legally.

Which Australian terrorist plots have been directly connected to Islamic State, and how?

Hello readers. I will be a regular blogger for AVERT, publishing one post here each month on a range of topics involving violent extremism. For this first post, I want to revisit a number of proven and alleged terrorist plots in Australia.

From September 2014 onwards Australia experienced a succession of violent attacks, along with failed attempts at attacks, carried out in the name of “Islamic State” (IS). There was often debate over the actual role IS did, or did not, play in these plots. With the dust more settled now, it is a good time to look back.

There have so far (as of October 2018) been six violent incidents inside Australia carried out in the name of IS, namely the September 2014 Endeavour Hills stabbing, the December 2014 Lindt Café Siege, the October 2015 murder of NSW Police employee Curtis Cheng, the September 2016 Minto stabbing, the May 2017 Brighton Siege and the February 2018 Mill Park stabbing. During that time at least eight failed terrorist plots have been proven in court and a number of alleged plots are still before the courts.

In the majority of these cases the perpetrators lacked a direct connection to IS. Instead, they tended to have been inspired by IS, heeding IS spokesperson Abu Muhammad al-Adnani's global call to arms at their own initiative. They often declared their allegiance to IS but also had a complex mix of motives, which inquiries such as the Lindt Cafe Inquest sought to disentangle.

However, at least five of these cases had a much more direct connection to IS than just inspiration, which is worth exploring for what it may tell us about the threat so far. I am first going to outline the five cases (three proven plots and two alleged plots) and then discuss the common features of their apparent IS connections.

The five cases

One plot involved a 17-year old boy in Melbourne known only as MHK (his name is suppressed due to his age). In early 2015 he dropped out of school and began engaging intensely with IS propaganda material, reaching out to IS members online. In April 2015 he made contact with Junaid Hussain, a notorious Syria-based British IS member who acted as a propagandist, recruiter, and plotter of international attacks. Hussain and MHK first communicated through Facebook but shifted to Surespot, a more secure messaging service. MHK told Hussain that he wanted to travel to Syria to fight for Islamic State, but believed his parents would not let him apply for a passport.

Instead, Hussain advised MHK to build explosive devices and sent instructions on how to do so. They planned to target Melbourne's Central Business District, or a police or train station. Hussain also advised him on computer encryption to better hide his activities.  MHK gathered the material to make bombs, included pressure cookers, steel pipes, match heads, sugar, and screws. He did not finish building the bombs before the Victorian Joint Counter Terrorism Team arrested him on 8 May 2015 as part of Operation Amberd. MHK pleaded guilty and was sentenced to seven years’ imprisonment, later changed to eleven years’ imprisonment.

A second plot also involved a teenager in Melbourne. This was Sevdet Besim, whose friend Numan Haider was shot dead when stabbing two police officers in Endeavour Hills in September 2014. Catalysed by this incident, Sevdet Besim made contact with two IS members in Syria who he had earlier known in Melbourne, Irfaan Hussein and Neil Prakash. He initially wanted to join IS in the field, but the Australian Security Intelligence Organisation (ASIO) had cancelled his passport to prevent him from doing so. According to evidence presented in Besim’s prosecution, Prakash then advised him to carry out an attack and put him in contact with someone in the UK who took over the task of providing instructions. This UK contact was in fact a 14-year old child, but he pretended to be an experienced jihadist. He helped Besim develop a plan to carry out an attack for Anzac Day (April 25) in 2015. The plan was to run over a police officer with a car, grab their gun, and start shooting others. However, the Victorian Joint Counter Terrorism Team arrested Besim under Operation Rising on 18 April 2015. Besim pleaded guilty and was sentenced to ten years’ imprisonment, later changed to fourteen years’ imprisonment.

A third plot involved two Sydney-based IS supporters, Omar al-Kutobi and Mohammad Kiad. In October 2014, al-Kutobi tried to find IS members online, and made contact through Facebook with an IS recruiter in Syria known only as "Rahman". They then communicated through the messaging service WhatsApp, first to discuss how al-Kutobi and Kiad could travel to Syria, but then to plan an attack in Australia. In discussion with Rahman, al-Kutobi and Kiad formed a plan to build an explosive device to  attack a Shia house of worship in Sydney, and then attack unknown people with a blade. They moved quickly, gathering the materials and recording a video to take credit, as "soldiers of the Caliphate", for the planned attack.

However, Rahman was not the committed jihadist that he purported to be. It instead appears that he was trying to defect from Islamic State and was passing information about the plot to another person who was then passing it to international security services. When the information reached Australian authorities they scrambled to respond. The New South Wales Joint Counter Terrorism Team arrested al-Kutobi and Kiad on 10 February 2015 as part of Operation Castrum. The two men pleaded guilty and were sentenced to twenty years’ imprisonment. When sentencing them, the judge stated that "the attack would have occurred within a few hours but for the offenders' arrest".

That covers the cases proven in court, but there are also indications of direct IS connections in at least two of the alleged plots that have not yet been through court.

For example, in September 2014 a man in Sydney was arrested under the New South Wales Joint Counter Terrorism Team’s Operation Appleby. The Sydney man, who had reportedly had his passport cancelled by ASIO, was allegedly in contact with Syria-based Australian IS member.  Police alleged that the Syria-based Australian IS figure ordered the suspect to murder random members of the public in Sydney. I am being excessively vague about this one as the suspect is currently on trial. We will need to wait to see whether the allegations hold up in court.

A final example is an alleged plot involving two brothers in Sydney, Khaled Khayat and Mahmoud Khayat. According to the allegations, Khaled Khayat was contacted in April 2017 by one of his brothers fighting in Syria for the Islamic State, who connected him to a senior Islamic State figure described as the “controller”. The police alleged that, under the controller’s instructions, the suspects tried to place a bomb hidden in a meat grinder on an Etihad airplane flying from Sydney to Abu Dhabi. Police stated that IS used operatives in Turkey to simply mail the necessary explosive substance and other components for the two men to build the meat grinder bomb. After that failed, the suspects allegedly tried to build a chemical gas device to kill a large number of people, but were arrested in August 2017 under the New South Wales Joint Counter Terrorism Team’s Operation Silves. Again, we will have to wait to see if the allegations hold up in court. Their trial is due to start in March next year.

Therefore, several terrorist plots in Australia (three proven plots and potentially two alleged plots) had direct connections to IS. Several features of these cases stand out.

Six common features

First, none of these proven or alleged plots involved people training or fighting with IS and then returning to Australia. Ever since Australians began joining jihadist groups in Syria, many people wrote about the prospect of well-trained individuals carrying out terrorist attacks on return. Fortunately, this has not happened at all. While many countries in Europe, North Africa and elsewhere experienced terrorist plots by IS returnees (notably the November 2015 Paris massacre and the June 2015 Sousse massacre in Tunisia), Australia has so far avoided this.

Second, in all these cases the IS connection took the form of direct communication with IS figures, usually based in Syria. This communication occurred through services such as Telegram, Surespot and WhatsApp, but was often initiated through Facebook. This has resulted from a particular approach IS adopted from 2014 onwards, which has been described as "virtual planning". This refers to terror plots where the perpetrator is guided through sustained online communication with an Islamic State operative in another country (often Syria's Raqqa province) who instructs them on how to carry out an attack. This operational method has allowed IS to orchestrate violence in places where its capabilities are too limited for centrally planned attacks of the sort we saw in Paris, which makes it particularly relevant to countries like Australia.

Third, sometimes these IS virtual planners were people personally known to the perpetrator beforehand, or people put in contact with them by someone they had personally known, while other times they were strangers. MHK had never met British IS fighter Junaid Hussein before, nor had al-Kutobi or Kiad met Rahman. However, in other cases the IS planners were giving instructions to people they had known in Australia (as friends or relatives) before they joined IS. Besim had known Irfaan Hussein and Neil Prakash in Melbourne, who put him in contact with the UK child. The Khayat brothers were allegedly put in touch with an IS handler through another of their brothers. Therefore, sometimes the perpetrators inside Australia reached out to IS through online means, while in other occasions Australians joined IS and reached back to people they knew in Australia to carry out attacks.

Fourth, these Syria-based IS figures varied in how important they were for each given plot. For example, Al-Kutobi and Kiad did not appear to need much encouragement from Rahman, nor does he appear to have provided much technical advice to them. In contrast, Junaid Hussain gave MHK practical advice on bomb-making. The most substantial level of IS involvement, if the allegations prove true, was the Sydney plane plot. IS reportedly mailed the Khayat brothers a bomb-making kit and provided sufficient instructions for them to build it. This was a new development, which Paul Cruickshank described as an “IKEA model of terrorism". This represents the most direct and substantial involvement by IS in an alleged Australian terrorist plot yet. Indeed, this sort of direct support potentially makes it one of the Islamic State’s most ambitious virtually planned plots anywhere in the world.

Fifth, another common feature was that trust problems were often evident. Sometimes the perpetrators were in contact with people who were not what they seemed. The UK child involved in the Anzac plot pretended to be a grown man, with a wife and child, experienced in jihadist violence. Rahman, who advised al-Kutobi and Kiad, was reportedly an informant hoping to defect. MHK was not only in contact with a genuinely significant IS figure, Junaid Hussain, but also with someone who called themselves “Australi Witness”. This person pretended to be an Australian jihadist but turned out to be an internet troll, living in America, who adopted a range of online personas. Moreover, in two cases I have not included in this post (Tamim Khaja and AH) the Australian plotters thought they were in contact with IS but were actually communicating with undercover police officers abroad. To refer back to the third point, these trust problems were more likely to occur when the Australia-based perpetrators tried to reach out to random IS members online, and were less common when Australians who made it to Syria reached back to friends or relatives at home.

Sixth, many of the plotters were subjected to travel restrictions. In some cases they had wanted to join IS in Syria but had either had their passports cancelled by ASIO or simply perceived that travel would not be feasible. This is one reason why ASIO’s passport powers are controversial. They have potentially directed several IS supporters attention to attacks at home rather than violence abroad, though I would also argue that such travel restrictions are one reason (among several) that the threat from IS returnees has been far lower in Australia than in much of Europe.

Understanding IS’s role so far

Overall, we will have a greater understanding as more information comes out about a number of these cases, but the court processes so far reveal a lot about the role IS has played in the various acts of violence in Australia attempted in its name.

In the majority of Australian cases, IS’s role was primarily as a source of inspiration, sometimes for people who were already having violent inclinations for many reasons. In a small number of cases, namely the five discussed here, IS played a more direct role. So far, this was never through IS training Australians in Syria or Iraq and dispatching them to attack at home, but through online communication in a way that fits the virtual planner model seen elsewhere. This tended to involve Syria-based IS figures instructing supporters who had trouble leaving Australia to attack at home. These plots varied in the extent to which IS assisted the practical and technical elements of the attack, in whether they were cases of Australia-based perpetrators reaching out or Syria-based planners reaching back, and in the extent to which those involved were not always who they claimed to be. This last aspect turned out to be the downfall of many of these plots.

View Andrew Zammit’s Profile.