Which Australian terrorist plots have been directly connected to Islamic State, and how?
ANDREW ZAMMIT • October 17, 2018
Hello readers. I will be a regular blogger for AVERT, publishing one post here each month on a range of topics involving violent extremism. For this first post, I want to revisit a number of proven and alleged terrorist plots in Australia.
From September 2014 onwards Australia experienced a succession of violent attacks, along with failed attempts at attacks, carried out in the name of “Islamic State” (IS). There was often debate over the actual role IS did, or did not, play in these plots. With the dust more settled now, it is a good time to look back.
There have so far (as of October 2018) been six violent incidents inside Australia carried out in the name of IS, namely the September 2014 Endeavour Hills stabbing, the December 2014 Lindt Café Siege, the October 2015 murder of NSW Police employee Curtis Cheng, the September 2016 Minto stabbing, the May 2017 Brighton Siege and the February 2018 Mill Park stabbing. During that time at least eight failed terrorist plots have been proven in court and a number of alleged plots are still before the courts.
In the majority of these cases the perpetrators lacked a direct connection to IS. Instead, they tended to have been inspired by IS, heeding IS spokesperson Abu Muhammad al-Adnani's global call to arms at their own initiative. They often declared their allegiance to IS but also had a complex mix of motives, which inquiries such as the Lindt Cafe Inquest sought to disentangle.
However, at least five of these cases had a much more direct connection to IS than just inspiration, which is worth exploring for what it may tell us about the threat so far. I am first going to outline the five cases (three proven plots and two alleged plots) and then discuss the common features of their apparent IS connections.
The five cases
One plot involved a 17-year old boy in Melbourne known only as MHK (his name is suppressed due to his age). In early 2015 he dropped out of school and began engaging intensely with IS propaganda material, reaching out to IS members online. In April 2015 he made contact with Junaid Hussain, a notorious Syria-based British IS member who acted as a propagandist, recruiter, and plotter of international attacks. Hussain and MHK first communicated through Facebook but shifted to Surespot, a more secure messaging service. MHK told Hussain that he wanted to travel to Syria to fight for Islamic State, but believed his parents would not let him apply for a passport.
Instead, Hussain advised MHK to build explosive devices and sent instructions on how to do so. They planned to target Melbourne's Central Business District, or a police or train station. Hussain also advised him on computer encryption to better hide his activities. MHK gathered the material to make bombs, included pressure cookers, steel pipes, match heads, sugar, and screws. He did not finish building the bombs before the Victorian Joint Counter Terrorism Team arrested him on 8 May 2015 as part of Operation Amberd. MHK pleaded guilty and was sentenced to seven years’ imprisonment, later changed to eleven years’ imprisonment.
A second plot also involved a teenager in Melbourne. This was Sevdet Besim, whose friend Numan Haider was shot dead when stabbing two police officers in Endeavour Hills in September 2014. Catalysed by this incident, Sevdet Besim made contact with two IS members in Syria who he had earlier known in Melbourne, Irfaan Hussein and Neil Prakash. He initially wanted to join IS in the field, but the Australian Security Intelligence Organisation (ASIO) had cancelled his passport to prevent him from doing so. According to evidence presented in Besim’s prosecution, Prakash then advised him to carry out an attack and put him in contact with someone in the UK who took over the task of providing instructions. This UK contact was in fact a 14-year old child, but he pretended to be an experienced jihadist. He helped Besim develop a plan to carry out an attack for Anzac Day (April 25) in 2015. The plan was to run over a police officer with a car, grab their gun, and start shooting others. However, the Victorian Joint Counter Terrorism Team arrested Besim under Operation Rising on 18 April 2015. Besim pleaded guilty and was sentenced to ten years’ imprisonment, later changed to fourteen years’ imprisonment.
A third plot involved two Sydney-based IS supporters, Omar al-Kutobi and Mohammad Kiad. In October 2014, al-Kutobi tried to find IS members online, and made contact through Facebook with an IS recruiter in Syria known only as "Rahman". They then communicated through the messaging service WhatsApp, first to discuss how al-Kutobi and Kiad could travel to Syria, but then to plan an attack in Australia. In discussion with Rahman, al-Kutobi and Kiad formed a plan to build an explosive device to attack a Shia house of worship in Sydney, and then attack unknown people with a blade. They moved quickly, gathering the materials and recording a video to take credit, as "soldiers of the Caliphate", for the planned attack.
However, Rahman was not the committed jihadist that he purported to be. It instead appears that he was trying to defect from Islamic State and was passing information about the plot to another person who was then passing it to international security services. When the information reached Australian authorities they scrambled to respond. The New South Wales Joint Counter Terrorism Team arrested al-Kutobi and Kiad on 10 February 2015 as part of Operation Castrum. The two men pleaded guilty and were sentenced to twenty years’ imprisonment. When sentencing them, the judge stated that "the attack would have occurred within a few hours but for the offenders' arrest".
That covers the cases proven in court, but there are also indications of direct IS connections in at least two of the alleged plots that have not yet been through court.
For example, in September 2014 a man in Sydney was arrested under the New South Wales Joint Counter Terrorism Team’s Operation Appleby. The Sydney man, who had reportedly had his passport cancelled by ASIO, was allegedly in contact with Syria-based Australian IS member. Police alleged that the Syria-based Australian IS figure ordered the suspect to murder random members of the public in Sydney. I am being excessively vague about this one as the suspect is currently on trial. We will need to wait to see whether the allegations hold up in court.
A final example is an alleged plot involving two brothers in Sydney, Khaled Khayat and Mahmoud Khayat. According to the allegations, Khaled Khayat was contacted in April 2017 by one of his brothers fighting in Syria for the Islamic State, who connected him to a senior Islamic State figure described as the “controller”. The police alleged that, under the controller’s instructions, the suspects tried to place a bomb hidden in a meat grinder on an Etihad airplane flying from Sydney to Abu Dhabi. Police stated that IS used operatives in Turkey to simply mail the necessary explosive substance and other components for the two men to build the meat grinder bomb. After that failed, the suspects allegedly tried to build a chemical gas device to kill a large number of people, but were arrested in August 2017 under the New South Wales Joint Counter Terrorism Team’s Operation Silves. Again, we will have to wait to see if the allegations hold up in court. Their trial is due to start in March next year.
Therefore, several terrorist plots in Australia (three proven plots and potentially two alleged plots) had direct connections to IS. Several features of these cases stand out.
Six common features
First, none of these proven or alleged plots involved people training or fighting with IS and then returning to Australia. Ever since Australians began joining jihadist groups in Syria, many people wrote about the prospect of well-trained individuals carrying out terrorist attacks on return. Fortunately, this has not happened at all. While many countries in Europe, North Africa and elsewhere experienced terrorist plots by IS returnees (notably the November 2015 Paris massacre and the June 2015 Sousse massacre in Tunisia), Australia has so far avoided this.
Second, in all these cases the IS connection took the form of direct communication with IS figures, usually based in Syria. This communication occurred through services such as Telegram, Surespot and WhatsApp, but was often initiated through Facebook. This has resulted from a particular approach IS adopted from 2014 onwards, which has been described as "virtual planning". This refers to terror plots where the perpetrator is guided through sustained online communication with an Islamic State operative in another country (often Syria's Raqqa province) who instructs them on how to carry out an attack. This operational method has allowed IS to orchestrate violence in places where its capabilities are too limited for centrally planned attacks of the sort we saw in Paris, which makes it particularly relevant to countries like Australia.
Third, sometimes these IS virtual planners were people personally known to the perpetrator beforehand, or people put in contact with them by someone they had personally known, while other times they were strangers. MHK had never met British IS fighter Junaid Hussein before, nor had al-Kutobi or Kiad met Rahman. However, in other cases the IS planners were giving instructions to people they had known in Australia (as friends or relatives) before they joined IS. Besim had known Irfaan Hussein and Neil Prakash in Melbourne, who put him in contact with the UK child. The Khayat brothers were allegedly put in touch with an IS handler through another of their brothers. Therefore, sometimes the perpetrators inside Australia reached out to IS through online means, while in other occasions Australians joined IS and reached back to people they knew in Australia to carry out attacks.
Fourth, these Syria-based IS figures varied in how important they were for each given plot. For example, Al-Kutobi and Kiad did not appear to need much encouragement from Rahman, nor does he appear to have provided much technical advice to them. In contrast, Junaid Hussain gave MHK practical advice on bomb-making. The most substantial level of IS involvement, if the allegations prove true, was the Sydney plane plot. IS reportedly mailed the Khayat brothers a bomb-making kit and provided sufficient instructions for them to build it. This was a new development, which Paul Cruickshank described as an “IKEA model of terrorism". This represents the most direct and substantial involvement by IS in an alleged Australian terrorist plot yet. Indeed, this sort of direct support potentially makes it one of the Islamic State’s most ambitious virtually planned plots anywhere in the world.
Fifth, another common feature was that trust problems were often evident. Sometimes the perpetrators were in contact with people who were not what they seemed. The UK child involved in the Anzac plot pretended to be a grown man, with a wife and child, experienced in jihadist violence. Rahman, who advised al-Kutobi and Kiad, was reportedly an informant hoping to defect. MHK was not only in contact with a genuinely significant IS figure, Junaid Hussain, but also with someone who called themselves “Australi Witness”. This person pretended to be an Australian jihadist but turned out to be an internet troll, living in America, who adopted a range of online personas. Moreover, in two cases I have not included in this post (Tamim Khaja and AH) the Australian plotters thought they were in contact with IS but were actually communicating with undercover police officers abroad. To refer back to the third point, these trust problems were more likely to occur when the Australia-based perpetrators tried to reach out to random IS members online, and were less common when Australians who made it to Syria reached back to friends or relatives at home.
Sixth, many of the plotters were subjected to travel restrictions. In some cases they had wanted to join IS in Syria but had either had their passports cancelled by ASIO or simply perceived that travel would not be feasible. This is one reason why ASIO’s passport powers are controversial. They have potentially directed several IS supporters attention to attacks at home rather than violence abroad, though I would also argue that such travel restrictions are one reason (among several) that the threat from IS returnees has been far lower in Australia than in much of Europe.
Understanding IS’s role so far
Overall, we will have a greater understanding as more information comes out about a number of these cases, but the court processes so far reveal a lot about the role IS has played in the various acts of violence in Australia attempted in its name.
In the majority of Australian cases, IS’s role was primarily as a source of inspiration, sometimes for people who were already having violent inclinations for many reasons. In a small number of cases, namely the five discussed here, IS played a more direct role. So far, this was never through IS training Australians in Syria or Iraq and dispatching them to attack at home, but through online communication in a way that fits the virtual planner model seen elsewhere. This tended to involve Syria-based IS figures instructing supporters who had trouble leaving Australia to attack at home. These plots varied in the extent to which IS assisted the practical and technical elements of the attack, in whether they were cases of Australia-based perpetrators reaching out or Syria-based planners reaching back, and in the extent to which those involved were not always who they claimed to be. This last aspect turned out to be the downfall of many of these plots.