- The capture of weapons from opposing security forces is often the primary method of attaining access to arms for militant groups. Following the February 2011 uprising against Moammar Gadhafi in Libya, rebels and other militant and criminal groups looted the arsenals of the fallen state, creating a stockpile of weapons, from heavy machine guns and grenade launchers to antiaircraft missiles, that has fueled violence throughout the country and spilled out across the region. Similarly, following the fall of Mosul in June 2014, ISIS militants were able to seize military hardware en masse from fleeing Iraqi forces, including armored Humvees, rockets, artillery, rifles and ammunition.
- Foreign assistance also is a common way insurgent groups are able to access military hardware, when they capture it from proxy forces being trained by powerful international militaries. The Obama administration’s covert train-and-equip program created a checkered history as it sought to arm moderate Syrian rebel groups fighting the Assad regime until the program ended in July 2017 under President Donald Trump, with ISIS capturing some of the trained units or their weapons and brandishing them as trophies on social media.
- This flood of uncontrolled arms into conflict zones often creates an economic opportunity for criminal networks in the region, who then smuggle captured weapons across borders into neighboring states to sell to growing militant groups. Following the 2011 collapse of Libya, arms flowed along common smuggling routes into conflict zones in sub-Saharan Africa, fueling violence in Mali, Chad and the Central African Republic.
Would you like more of this type of expert insight? Become a Cipher Brief Member for access to premium content, special events and more.
Damien Spleeters, Head of Regional Operations (Iraq-Syria), Conflict Armament Research
“Different conflicts are defined by different mechanisms and dynamics. But we have observed that insurgent and terrorist groups usually armed themselves through battlefield capture – taking control of the arsenal of an enemy force – or through outside support – receiving weapons from a third party. Insurgent and terrorist groups can also manufacture their own weapons, such as improvised explosive devices, from commercial goods obtained locally or regionally.”
Doug Wise, former Deputy Director, Defense Intelligence Agency
“Based on the scale of ISIS and the infrequency of force-on-force conflict probably produced very few captured weapons. It wasn’t like it was a brigade of the Syrian army, Hezbollah or Syrian Kurds going against a brigade of ISIS. It was mostly pockets holding of little assaults and incursions. So I don’t think the scale of arms capture was sufficient to provide what ISIS needed. So they became the creators of their own arms.”
Giacomo Persi Paoli, Research Leader, RAND Corporation
“There is a difference between regions with ongoing, or recent, conflicts and the others. In the first case, armed groups can access weapons in many ways. International arms trafficking is one avenue, but most of the weapons used in the context of insurgencies or civil wars have been in the country or region for many years, circulating on the black market and used in previous conflicts. Many of these “local” illegal weapons are obtained by looting poorly secured military or law enforcement arms depots. In the second case, for those countries not affected by conflict, arms trafficking is mainly controlled by national and transnational organized criminal groups.”
Issue: Militant groups are increasingly turning to online marketplaces to connect with illicit arms dealers, enabling them to more easily access highly coveted military equipment, such as man-portable air-defense systems (MANPADS) that present a significant threat to commercial aviation. Such online avenues to purchase weapons and supplies also provide crowd-sourced expertise on explosives assembly, raising the risk that untrained, remotely inspired radicals could conduct destructive attacks outside of direct conflict zones, such as in Europe and the United States.
Damien Spleeters, Head of Regional Operations (Iraq-Syria), Conflict Armament Research
“In fragile or post-conflict states, it is not infrequent to find open-air weapon markets. In these cases, individuals willing to purchase weapons may do so without resorting to social media or 'dark web' marketplaces. Cracking down on these types of markets may prompt individuals to seek places – including virtual places – where they can connect to a seller and arrange a transaction.”
Alex Bolling, former Chief of Operations, CIA's Information Operations Center
"Terrorist groups are able to acquire weapons on the black market. In conflict zones and ungoverned spaces such as Somalia, Iraq and the Sahel the weapons markets are a vibrant part of the unofficial economy. The dark web is an extension of the black market and terrorist organizations will likely utilize all aspects of weapons acquisition that they can. Acquisition of weapons by groups or individuals from the dark web is more likely to circumvent a robust security structure like western Europe. Weapons are easily available in conflict zones such as Libya, Iraq and Syria. But terrorist organizations seek to modify the ordnance to defeat existing security measures."
- An April 2016 report documents militant groups in Libya engaging in a burgeoning online trade in captured arms over private forums on the social media platform Facebook. Much of the trade includes small arms and light weapons, a potential source of funding for groups that have a surplus. But it also includes much more specialized arms useful to militant groups embroiled in unconventional conflict, including heavy machine guns, rockets, anti-tank guided missiles, MANPADS and grenade launchers. Similar social media arms markets exist in Iraq, Syria and Yemen.
- Certain encrypted communications channels hosted on Telegram are dedicated to the illicit sale of military hardware, according to Foreign Policy. Telegram markets primarily based in the Syrian province of Idlib boast of over 5,000 users buying and selling everything from surface-to-air missiles, anti-tank weapons and armored vehicles, to suicide belt explosives, commercial hobby drones and small arms. The encrypted channels put aspiring bombmakers in touch with sellers of critical improvised explosives supplies such as blasting caps and detonation cords. Still, the “last mile” of the transaction continues to require a physical meeting between parties.
- Perhaps the most prominent implications of the online trade in weapons are for lone-wolf terrorism in developed countries with tight security controls, such as in Europe. The continent represents the largest market for arms trade on the dark web, which could enable access to weapons and ammunition for local radicalized individuals to engage in terrorist attacks modeled on the January 2015 Charlie Hebdo and November 2015 Paris attacks on a concert hall, a soccer stadium and cafes. In the United States, where controls over firearms are more lax, radicalized individuals could legally order weapons online.
Giacomo Persi Paoli, Research Leader, RAND Corporation
“Weapons are sold on dark web marketplaces, but not to a scale that would allow a large armed group to arm its fighters and sustain a prolonged conflict. It is likely that such groups would use other, more traditional, means of procuring weapons illegally (e.g. looting of government stockpiles). However, dark web marketplaces have the potential of becoming increasingly used by small criminal groups or terrorist cells (including lone wolves) due to the ease of access and perception of anonymity. While the evidence suggests that dark web marketplaces are mostly used to illegally trade weapons internationally…other online platforms like social media have been used more effectively at the local level, for example in Libya.”
Response: The shift of certain types of illicit arms trafficking to the virtual marketplace does not necessarily require new mechanisms to intercept arms and keep them from falling into the hands of nefarious groups. But as with the effort against terrorist-recruitment messaging, it will increasingly require vigilance on the part of social media providers.
Alex Bolling, former Chief of Operations, CIA's Information Operations Center
"Terrorist organizations will seek to modify and evolve their tactics to defeat existing defensive measures. Consequently, defensive measures need to be dynamic and proactive. Comprehensive intelligence collection is required to identify, mitigate and proactively defeat threats from terrorist organizations."
- While such illicit marketplaces will continue to re-emerge when taken down, social media providers likely will continue to remove content that violates their terms of service.
- To counter crypto-bazaars on the dark web, intelligence services and law enforcement likely will seek to penetrate chat forums that enable the illicit trade of military hardware and track and interdict the physical transfers of weapons when plausible.
Anticipation: While there are ways of combating the online illicit trade of weapons to militant groups and terrorists, it could become more difficult to stop the sharing of instruction manuals for craft — i.e. homemade — weapons, including designs for 3-D printing arms and explosives components.
Damien Spleeters, Head of Regional Operations (Iraq-Syria), Conflict Armament Research
“In Iraq, ISIS was producing their weapons because of a political ideology of self-sustainment (being a "state"), for logistical reasons (lack of certain weapons in large quantities), and for tactical reasons (dictated by urban warfare, mainly). In Germany, terrorists may have resorted to producing their weapons because of strict gun legislation. Studying the root causes – explaining why people might resort to craft production – will tell you whether or not they are likely to do it. Other insurgent groups or terrorist organizations did not follow this path because they are engaged in a lower-intensity conflict with a state actor that is indirectly providing them with the weapons and ammunition they need every time a position is overrun, which has been the prominent dynamic ever since insurgency existed.”
Doug Wise, former Deputy Director, Defense Intelligence Agency
“If you look at the ISIS of the battlefield and the ISIS of the lonely wolf – with an ideological connection but maybe not the physical connection – the resources available on the web, some of which are from ISIS, some of which are not, certainly provide enough information that any reasonably capable and motivated individual can self-manufacture a weapon of some kind, whether it is projectile or explosive. But one of the benefits that ISIS engineers in Syria and Iraq had was pooling the collective expertise. It was not just one guy who was producing all these weapons. It was an aggregation of expertise. It would be hard, even with the resources of the internet, for a lone-wolf terrorist to be able to gather from the internet, assimilate it, interpret it and actually build sophisticated weapons as ISIS did on a Syrian battlefield. The difference is that a lone-wolf terrorist doesn’t need a sophisticated weapon.”
- As an international pariah, ISIS in Iraq and Syria turned to crafting its own conventional munitions, such as mortars, rockets, grenades and even drones. This mass production of homemade arms was a result of ISIS’ unique position as a functioning state with access to industrial tools and engineers, but craft production of difficult-to-attain weaponry could occur at a smaller scale. During a police raid in Germany, officers discovered non-lethal guns converted into weapons for online sale to terrorists, similar to how the guns used in the Charlie Hebdo attack were procured and converted in Slovakia.
- Terrorist groups such as ISIS or al-Qaida already spread instructions on designing and deploying explosives through dark web forums, Telegram channels and glossy online publications such as Inspire, Dabiq or Rumiyah. The bombs used in the 2013 Boston Marathon attack were built in part following instructions featured in Inspire, al-Qaida’s English language magazine.
- With the maturation of 3-D printing technology, it is possible that terrorist weapons experts could share their knowledge with lone wolves remotely, not only through instruction manuals, but via ready-made weapons and explosives design files shared over the dark web. Coupled with the dual-use sale of bomb-making materials online, such a development could become a significant threat to the West.
Doug Wise, former Deputy Director, Defense Intelligence Agency
“3-D printing offers the greatest potential for imaginative uses by a single individual in terms of an engineering file that they upload to the printer, if you have the right material – which itself becomes difficult. But once the 3-D printer becomes even more sophisticated, and when explosive designers come up with precursors that aren’t in and of themselves alarming, but when combined in a 3-D printer could become quite lethal indeed, particularly if the 3-D printer creates something that looks like an innocuous common object that does attract attention from a surveillance standpoint. So the 3-D printer certainly represents the greatest innovation in terms of weaponization.”
Giacomo Persi Paoli, Research Leader, RAND Corporation
“The improvements of commercial 3-D printing technology, combined with the increased availability of ‘printable’ models, as well as the wealth of information made available on dark web marketplaces through manual and tutorials on explosives, lowers the barriers for accessing lethal technologies. This represents a threat for internal security, as it provides terrorist cells and criminal groups an additional channel to procure weapons by directly manufacturing them.”
The Cipher Brief is an in-depth, expert-driven, digital news site that reports on and analyzes issues for an audience that requires a more informed understanding of risk, whether it’s in the C-suite, the halls of Congress or the White House.
A membership to The Cipher Brief provides ongoing access to analysis and featured columns on thecipherbrief.com from any computer or device. Go here to sign up.
Cipher Brief analysis by Levi Maxey originally published in January, 2018.
