BOTTOM LINE UP FRONT — Two utterly different events, in two very different parts of the world, have raised fresh concerns about a return to strength for the Islamic State terror group: the New Year’s Day attack in New Orleans which killed 14 people and wounded 35 more, and which was clearly inspired by the Islamic State; and a power vacuum in Syria in the wake of the ousting of longtime dictator Bashar al-Assad from power last month, which some experts believe may allow ISIS – the Islamic State in Iraq and Syria – to find new safe havens and gain new momentum.
Taken together, these events have raised concerns about the growing threat from ISIS — and what may follow what longtime terrorism expert Bruce Hoffman called 2024 the “Year of ISIS’ resurgence.” More broadly, the 2023 Hamas attacks against Israel and the war in Gaza that followed have mobilized terrorist groups and inspired new recruits. As former senior FBI official Jill Sanborn said, “The terrorists are swimming in the chaos that the world is in right now.” Against this backdrop, The Cipher Brief spoke with several experts about the specter of a looming major terrorist attack. They warned that the world may see an ISIS resurgence, made more daunting by the rise of lone-wolf operations, as the New Orleans attack appeared to be.
THE CONTEXT
- U.S. authorities in 2024 warned repeatedly of escalating terrorism threats. FBI Director Christopher Wray said in April, "The foreign terrorist threat and the potential for a coordinated attack here in the homeland... is now increasing." Brett Holmgren, acting Director of the U.S. National Counterterrorism Center, told The Cipher Brief's 2024 Threat Conference in October that the war in Gaza had caused a “reenergized global terrorism movement."
- The Islamic State said that its online propaganda inspired the car-ramming attack in New Orleans on New Year's Day that killed 14 people. The group did not claim to have carried out the attack, saying it was "influenced by [its] discourse and messaging." Officials said the attack underscores the threat from "lone wolf" actors.
- The United States led an effort a decade ago to defeat ISIS in Iraq and Syria, a mission that was largely successful and led both the Trump and Biden administrations to tout the defeat of the organization.
- There is heightened concern that Islamic State may find a foothold in Syria following the fall of President Bashar al-Assad. There are doubts that Hayat Tahrir al-Sham (HTS), the group that led the ouster of Assad, can be relied on to deal with an ISIS resurgence.
- Conflict between Turkey and Western-backed Syrian Kurdish groups is also an issue, as it may impact those groups' ability to support the campaign against Islamic State, which includes control of camps holding thousands of ISIS fighters.
- Islamic State has seen a rise in operations across the world in the past year. In January 2024, the Afghan branch ISIS-K carried out bombings targeting commemorations marking the killing of General Qassem Soleimani, killing at least 95 people. In March, ISIS-K gunmen killed 130 people in an attack at the Crocus Music Hall in Moscow.
The Cipher Brief spoke about the terrorist threat in this new year with Bruce Hoffman, who served on the Independent Commission to Review the FBI’s Post-9/11 Response to Terrorism and Radicalization; Jill Sanborn, former Executive Assistant Director at the FBI; and Colin Clarke, Director of Policy and Research at The Soufan Group.
Expert comments on this issue have been edited for length and clarity.
THE EXPERTS
The New Orleans attack - and beyond
The Cipher Brief: When you heard news of this latest ISIS-inspired attack in New Orleans, what went through your mind?
Hoffman: I hate to say it, but I wasn't surprised. The reason is that 2024 was really the year of ISIS's resurrection, at least in international terrorist terms. There were five significant attacks or derailed attacks.
Exactly a year ago in Iran – a police state – ISIS-K, [the Islamic State’s] branch in Afghanistan, carried out an attack on the fourth anniversary of the killing of Qassem Soleimani, the Islamic Revolutionary Guards Corps commander. Two suicide bombers killed over 90 people. That to me was a wake-up call. The fact that the group could pierce a very secure environment completely embarrassed and humiliated the Iranian government. Then there was an attempted attack on a church in Istanbul that was foiled by a very alert police officer who lost his life. And then last March, we had that terrible attack at the Crocus Music Hall in Moscow, where four gunmen killed 130 people.
What worries me the most about ISIS is they've shown a proclivity over the past decade to attack what I would call celebratory events — concerts, sports events, major national events that were high visibility, but also where there were lots of people, there was public access, which meant they had a way of getting in. Just think about last August, when a Taylor Swift concert had to be canceled in Vienna [due to an alleged Islamic State plot]. You can go back to the attack at Nice on Bastille Day in 2016, when people are out on a national holiday, and 80 persons are killed when a truck mows them down; the terrible attacks in November 2015 at the Bataclan [in Paris], where there was a heavy metal concert; and then at the National Sports Stadium where France and Germany were playing a very important soccer game. You see this pattern.
The other reason I wasn't surprised is that last October, the FBI, fortunately, forwarded a plot by someone connected with ISIS living in Oklahoma City who was planning to stage an attack on Election Day. So this ability of ISIS in the past year to project terrorist threats overseas had come to the United States.
Clarke: Looking at the attack in New Orleans, I think of the power that this group still retains to put out violent propaganda that resonates with Westerners, including Americans, including former military veterans. Many have asked me: Are we on the surge of a new wave of homegrown terrorism in the West? I've been warning about this. And as you know, the threat ebbs and flows with different factors and variables, the big ones being geopolitical events — October 7th in Israel, for example, and the fall of the Assad regime [in Syria]. And the other being our counterterrorism pressure. Do we keep pressure on these groups? Or do we take our foot off the gas? Do we get distracted by Russia and Ukraine, the rise of China, all these other issues that demand attention and bandwidth? I'm concerned that we're going to lose focus on the counterterrorism issues.
Sanborn: As we saw with the events in New Orleans, the most complicated threat when you think about counterterrorism is the lone offender and that homegrown, violent extremist. It’s the most complicated and probably the hardest for law enforcement and the intelligence community. Where do you find those indicators and warnings? You have fewer dots to connect when you have somebody who in a very insular manner can become radicalized and mobilized from their own home, without any indicators and warnings. It's very challenging, it's a no-fail mission. The expectation is you detect and prevent, not hold them accountable after the fact.
The Cipher Brief: Those lone wolves have been really difficult to find. Is that still the case, and do you see any possibility of making something like that easier?
Sanborn: I think the things that law enforcement and the intelligence community need the most when it comes to that insular, homegrown, violent extremist, lone-offender threat is that statement: See something, say something. What we have found is when you go back and you look at an attack and you dissect all the things that happen leading up to the attack — you do a timeline, you interview family, you look at social media — almost every single time, somebody close to the individual knew something was happening, something was changing about it. They call it the bystander effect, and NCTC and DHS and FBI have done great work in putting out those things that people should look for as far as behavior changes are concerned. You really do need the community, and for people to look for signs that somebody who is normal is changing, and maybe they're radicalizing and mobilizing.
Hoffman: ISIS and other terrorist groups proceed on parallel tracks. On the one hand, they'll organize or orchestrate terrorist operations. In the attack last March at the Russian concert venue, four men trained, prepared, and were deployed by ISIS. But then you have the tragedy in New Orleans, where an individual is somehow – and we still don't know how – inspired, motivated, and ultimately animated to carry out an act of violence. That is clearly situated within the context of ISIS. Otherwise, he wouldn't have had the ISIS flag. We now know that he made two reconnaissance visits to Bourbon Street, to New Orleans, and also had traveled to Cairo. Maybe that's where he got the flag. We don't know. But this is quite interesting.
Immense resources of intelligence and law enforcement are consumed in attempting to identify these “lone wolves” who don't have the footprint or don't have the logistical or operational tail of an actual terrorist organization, planning and plotting an act of violence.
The Syria factor
The Cipher Brief: Let's talk about Syria. There’s a lot of concern and nervousness about what might happen there. What would you be looking for right now that will give us some indicator as to what this new government is going to be able to control in Syria, and the opportunity that any kind of vacuum might present for these groups to really thrive there?
Hoffman: I think that is a real danger. In Syria, ISIS's raison d'etre, apart from creating this transnational caliphate that was ruled by Sharia law, was also to overthrow the regime of Bashar al-Assad, to wipe away all of the anti-Islamic apostate dictatorial regimes, precisely like the Assads. They didn't do it. They failed. Hayat Tahrir al-Sham (HTS) succeeded. Well, no terrorist group will willingly ever go into oblivion, will ever become irrelevant. I was very concerned that because of what's going on in Syria, ISIS was out to reassert itself, probably in another corner of the world, to show that it's still relevant, to show that it's still there, and to try to steal some of that limelight or thunder from Hayat Tahrir al-Sham.
Clarke: I have a number of concerns. First, this is Hayat Tahrir al-Sham. It's formerly al-Qaeda in Syria. I know there's a lot of fanfare around Abu Muhammad al-Jolani [the HTS leader], or now Ahmad al-Sharaa, as he goes by, and he's receiving diplomats from all over the world. I would just urge a bit of caution and say, What if the former leader of al-Qaeda in Syria doesn't turn out to be Thomas Jefferson? To me, there's a lot still to be determined here. And yes, he's saying the right things. He's doing the right things. But we're in early days here. And I think that's one of my concerns.
The other is, even if Jolani is good to his word of preventing Syria from becoming a launching pad for transnational terrorism — that's his goal, it’s what he's saying — does he have the capability to do that? I question whether HTS, or whatever the new Syrian government looks like, has the propensity to establish a monopoly on the use of force over all of Syria's territory. We know ISIS still operates there. The Kurds are in the northeast. There's going to be factions that likely break off from HTS because they don't want to govern. There's still some pretty hardline jihadists in that group, including Uighur militants. We're just in such nascent stages of what's likely to happen next. I'm rooting for Syria to remain stable, but I'm also saying let's proceed with caution. And I do see quite a few parallels to Afghanistan.
Hoffman: From my perspective, Hayat Tahrir al-Sham is going to experience considerable difficulties in gaining control over Syria. There are a number of different armed factions there that are backed by various states that aren't going to necessarily subordinate themselves to HTS. HTS's pedigree suggests a more nefarious intention than they might be admitting. They say some of the right things, but we still have to remember that the core leadership of HTS were all former al-Qaeda. These were all people that swore allegiance to al-Qaeda, that went off to Iraq to fight, including Jolani, who has the blood of U.S. service personnel on his hands, because he fought with al-Qaeda in Iraq in the 2000s. So have they really changed? I'm skeptical, and there are signs there that their tolerance for minorities and for other religions only goes so far, especially for women. We do have to be very cautious. We've sort of seen this movie before.
Global catalysts for jihadists
The Cipher Brief: A lot of people were very concerned at the beginning of the Gaza war that we were seeing a prime opportunity for the radicalization of a whole new tranche of terrorists. Both the former and current director of the National Counterterrorism Center have said that we are now in a new era of global terrorism.
Clarke: I think that assessment is correct. If you look at the impact that October 7th [2023] has had on the terrorist threat landscape, we're talking about how transformative that event has been, that singular event. You layer on top of that the collapse of the Assad regime, going back to his father, Hafez al-Assad, that's five decades of rule by one family.
There’s a lot of second- and third-order consequences of what's likely to come next. For me, the biggest one, maybe it's the opposite of a black swan in terms of black swans being really difficult to predict: I look at the prisons and detention centers in Northeast Syria. I see the Kurds being challenged there. If the Turks go after them, ISIS is going to be eyeing those prisons for a breaking-the-walls type prison break campaign. Probably more intense than what we saw in [the ISIS prison attack in] Al-Hasakah in January, 2022. [It’s] kind of a slow-motion train wreck that we're all watching. I think few would be surprised if that happened. Not only would it help bolster ISIS manpower, but it would be a huge boon to the group's propaganda. These are all day-one issues for the Trump administration.
Hoffman: There's plenty of reasons and justification for terrorism worldwide. I think it is curious but also beneficial that we haven't seen, at least in the United States, a lot of fallout in terms of terrorist attacks from Gaza. We've seen a lot of protests. We've seen a lot of activity on campuses. We've seen various public action groups mobilizing, closing down traffic. But we haven't seen that much terrorism.
The Cipher Brief: After 9-11 happened, the FBI really changed dramatically in terms of its overseas footprint and focus overseas in areas where a lot of these terrorist attacks may be being planned. How do you see that changing in 2025 or the years ahead?
Sanborn: I think it's incredibly important. I spent a vast majority of my time on what [former FBI] Director [Robert] Mueller stood up back then, which was the counterterrorism fly team to deploy all over the world to try to be ahead of the threat. When you think about the international threat, the more we can do work overseas before it emanates here in the United States, the safer we're going to be.
But going into 2025, that landscape has changed too. We don't have the same international footprint that we had in 2002 and 2004, and so we really need to leverage — maybe a more creative way, a more partnered way — and rely on our international partners to do some of that “eyes and ears” overseas work, versus our physical presence.
The Cipher Brief: Those allies and partnerships are so critical for information-sharing purposes. Between the United States and Russia, when it came to sharing information on terrorism, that was one part of that relationship that some people considered actually pretty solid, but it's a very different world now. How much does the changing dynamic of the global environment concern you when it comes to being able to detect these threats?
Sanborn: I do think the terrorists are swimming in the chaos that the world is in right now. All these different events that are happening, and relationships among countries who used to be allies that are now adversaries. Terrorists look for places where they have a) opportunity and b) fractures. The more the world gives them to edge their way into those fractures and opportunities, it makes it harder for those of us that are trying to detect and prevent. So 100%, all the things that are going on in the world are giving them an opportunity to seize on a fracture in a relationship and a potential opportunity.
Hoffman: One of the biggest success stories of the war on terror was the international cooperation that mobilized in the aftermath of the September 11th, 2001 attacks, including with Syria, including with Iran at the time as well. Without that international cooperation, it becomes easier for terrorists to navigate the seams or the gaps and to engage in acts of violence that affect all of us wherever it occurs.
The threat in 2025
The Cipher Brief: If I asked you to put on the predictive glasses here and you were looking to in 2025, what do you see happening?
Sanborn: I think it's a more complex terrorism landscape than it's been in the past 10 years, and I say that for a couple reasons. There’s the complexity of the threat in and of itself, at a time where the U.S. government and other governments are having to focus on so many other things going on. Director Mueller used the term “urgency” when he was talking about why terrorism needed to be the Bureau's number one priority post-9/11. I had the luxury of going almost my whole career with terrorism being the only thing that was urgent, and I think in today's world, we have a lot of threats that are urgent, and so resources are scarce. We have a counterintelligence threat, cyber threat, violent crime problem, and so I think trying to divide the resources across those threats is difficult.
Add in the complexity of the CT [counterterrorism] threat. We don't have the collection we used to have in places where we used to have it. Post-withdrawal in Afghanistan, we're not exactly sure who all came in [to the U.S.]. Vetting is only as good as the collection you have going into vetting. Add in all these world events and fractures and allied relationships. The threat has evolved quite a bit and probably for the first time in the last 10 years, I'm as worried about directed or coordinated attacks as I would be about the homegrown violent extremist threat.
Hoffman: The nature of the terrorist threat is that it ebbs and flows, like most phenomena. The problem is that when it ebbs, we become complacent. And for many people, the ISIS threat was in the rear-view mirror. How many times [had] President-elect Trump and President Biden said that we defeated the caliphate, that we eliminated the threat from ISIS in the Levant, in Syria and Iraq? But what we've seen is this ability of a group like ISIS to regroup and reorganize. What alarms me is, while I expect them to be active in the venues they historically have been active, in the Middle East or in Africa or South Asia, the fact that they've been able to operate in two police states, Iran and Russia, for example, that they've been able to strike in Turkey, nearly succeed in carrying out an attack in Vienna, and now in the United States shows that we can't afford to be complacent. We have to be vigilant.
The Cipher Brief: Do you think there's going to be another 9/11 in your lifetime?
Sanborn: I hope not. I spent my whole career working hard and hoping not. Those are hard [for terrorist groups] because they require coordination that needs to be compartmentalized and secure, and you hope nobody talks about it and that governments aren't collecting on it. There's a lot of things that play against a foreign terrorist organization pursuing that type of attack, when multiple small-scale attacks can be just as effective in their eyes. Their playbook has probably moved away from that because of the complexities and the ability to potentially identify it and disrupt it, and that would be what I would hope.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
