Islamic State Messaging on Counter-espionage Operations

ISIS media allocates considerable effort towards magnifying its ongoing fight against anti-ISIS intelligence workers—intelligence officers and secret agents or spies. The way in which these efforts amplify its messaging can be seen through a statistical analysis of ISIS operations as published by the main ISIS weekly newsletter, al-Nabaa, in 2020. While the group’s self-reported attacks should not necessarily be taken at face value, the emphasis on these operations demonstrates a clear attempt to send a message towards those seeking to perform espionage activities on the group. One very striking finding is that a single district in Syria, Deir ez-Zor province or ISIS’s al-Khair sector of al-Sham wilaya, accounts for an exceptionally high proportion of these claimed operations, suggesting that the contest between ISIS and its enemies is particularly intense in that highly volatile sector where the Syrian Democratic Forces' intelligence workers are the main target of ISIS counter-espionage operations.

Based on “Soldier Harvest” analytics data gathered from the ISIS weekly newsletter al-Nabaa in 2020, ISIS claimed 3,033 violent operations that left 9,555 people dead and wounded globally. In the 52 issues of the newsletter published last year, ISIS claimed 182 operations against intelligence workers and reported that it had killed and wounded 250 intelligence workers. This means that in 2020, ISIS claimed it carried out an operation against intelligence workers almost every day—two operations in three days to be more precise—while it carried out 8.3 other violent operations a day.

While counter-espionage operations and their victims constitute only a small percentage of ISIS's overall claimed operations and their victims—6 percent and 2.6 percent respectively—elaborating on ISIS's strict counter-espionage efforts is a major task of ISIS media. Stories of killing spies and intelligence officers are highlighted in al-Nabaa's front-page, and wherever possible, al-Nabaa refers to earlier operations against spies and intelligence members.

Additionally, al-Nabaa refers to media coverage of such operations by its A'maq News Agency, where pictures, videos and debriefing of the victims are regularly published. Given that the newsletter addresses the ISIS members and sympathizers first, such stories are aimed to discourage espionage through intimidation, provide a sense of security to its members, and provide legitimacy to operations such as kidnapping and decapitation of hostages, particularly members of other jihadi groups. Alleged female spies were also reported killed, but only in Iraq and Syria (three in Syria and one in Iraq) as ISIS normally avoids claiming the killing of women. This is likely aimed to discourage the huge number of ISIS widows in Syria and Iraq from cooperating with anti-ISIS organizations.

In 2020, counter-espionage actions were claimed by ISIS security teams across seven wilayas. Ordered by most to least operations, the wilayas are: al-Sham (90), Iraq (58), Sinai (12), West Africa (8), Khorasan (7), Central Africa (4), and Pakistan (3). While most of the wilayas targeted both intelligence officers and spies in their violent counter-espionage campaign, the wilayas of West Africa and Sinai claimed operations against spies only, and the Pakistan wilaya targeted intelligence officers exclusively. This could be the result of different local counter-intelligence capabilities of ISIS, and the varying degrees of intelligence workers' vulnerability in these different areas.

Hunting intelligence workers is not a new venture for ISIS, but new wilayas started appearing on this list in 2020. In the issues of al-Nabaa newsletter, ISIS operations against intelligence workers were recorded in the wilayas of Iraq, al-Sham, Sinai, and West Africa in January; Central Africa in February; Pakistan in June; and Khorasan in July 2020. While these operations continue in al-Sham, Iraq, Sinai, and Khorasan throughout the year, they stopped in Central Africa in May 2020, and in Pakistan and West Africa in August 2020. This suggests that targeting intelligence workers was conducted for seven months in West Africa, three months in Central Africa and only two months in Pakistan.

Of the total 182 claimed operations, the wilaya of Syria, or al-Sham, saw 90 operations against intelligence workers, making it the most active ISIS wilaya in this regard. And within the al-Sham wilaya, the al-Khayr sector, or the Syrian province of Deir ez-Zor, sees the most operations against intelligence workers, accounting for 72 out of the 90 operations in the wilaya. Al-Baraka, Aleppo and al-Raqqa each saw four operations, and Homs and Horan saw three.

The Iraq wilaya, with 58 operations against intelligence workers, comes second overall and has a more homogenous distribution of operations across its 11 sectors: Dijla sector saw 11 operations and is the most active. On the other end, Ninawa saw two operations, and was the least active sector for such operations. The other five, more remote ISIS wilayas account for just 19 percent of these operations. Thus, with nearly 40 percent of the total ISIS operations against intelligence workers globally, al-Khayr sector of al-Sham wilaya seems to be the worst place for anti-ISIS intelligence workers and is twice as active as the five distant wilayas of ISIS combined. This volume of ISIS counter-espionage operations in al-Khayr can be explained by the ability of ISIS elements to penetrate into the Syrian Democratic Forces (SDF) by exploiting tribal relationships, the SDF's heterogeneous makeup, under-protected intelligence activities, ethnic and ideological tensions, and the ideological and operational strength of ISIS operatives in al-Khayr knowing that the sector was the last pocket of the ISIS territorial caliphate to fall.  

Although al-Nabaa provides only limited details on these liquidation operations, it is clear that direct fire with rifles is the most frequently used attack method. Thirty-six intelligence workers were kidnapped before being executed, most of whom were spies, and the four abductees reported decapitated were all spies. Not only their lives, but also their belongings are at risk, and sometimes where they were personally unreachable, ISIS targeted their belongings instead. Of the 182 operations, 32 were the burning or blowing up of houses, cars, and farms of the alleged spies and intelligence elements using firearms, grenades, IEDs, or sticky IED operations. Targeting the homes, cars and farms of intelligence workers is another way to make them an example and discourage the population from cooperating with anti-ISIS parties.

In sum, despite accounting for only 6 percent of the overall claimed ISIS armed operations, ISIS media highlights such efforts to ensure that ISIS's strict response against espionage is delivered to its audience: ISIS members, sympathizers, and the public. Analyzing the stories published by al-Nabaa newsletter on targeting intelligence workers in 2020, it is evident that al-Sham wilaya and its al-Khayr sector are the most active counter-espionage entities of ISIS. Other distant wilayas joined the campaign in lesser measure, and some abandoned it for unidentified reasons.

ISIS's counter-espionage operations are intended to discourage anti-ISIS espionage, provide a sense of security for its members, and provide legitimacy to its violent operations, and the ISIS media highlights these operations to ensure the message is effectively delivered. But analysis of this messaging also provides insight into where the many opponents of ISIS could usefully focus their attention. The anti-ISIS intelligence services are suggested to regularly make vulnerability assessment and commit to the very basics of intelligence operation security measures. Meanwhile, through highlighting successful intelligence operations against the Islamic State, publishing interviews with ISIS detainees and defectors, and magnifying ISIS security weaknesses, the anti-ISIS media can counter-balance and nullify ISIS counter-espionage media operations.