The devolution

As originally conceived, al Qaeda’s 2001 “planes operation” was to involve the simultaneous hijackings of 10 aircraft departing from both the East and West Coasts of the United States. Nine of the aircraft were to be either blown up in-flight or slammed into targeted buildings. The 10th plane was to be landed at a U.S. airport and, after all the adult male passengers were killed, a speech was to be delivered outlining al Qaeda’s grievances with the United States. Al Qaeda’s apex leaders — Osama bin Laden, Ayman al-Zawahiri and Mohammed Atef — eventually agreed to a scaled-down version of the planes operation involving four aircraft, which was carried out Sept. 11, 2001.

The West Coast portion of the plan was spun off as a separate operation that was to have occurred in October 2001, but which reportedly was postponed several times for various reasons. This operation, also known as the Library Tower Plot, was compromised and disrupted in 2002.

These themes also were evidenced in the plot to bomb American Airlines Flight 63 in December 2001. In that plan, Richard Reid successfully smuggled his “shoe bomb” aboard the aircraft. The attempt failed only because Reid tried to light the bomb’s fuse in the passenger cabin (rather than a more secluded area, such as a restroom) and was stopped by a flight attendant and passengers.

The 2006 Heathrow plot, however, bears the strongest resemblance to Operation Bojinka, which Khalid Sheikh Mohammed, along with his nephew Abdel Basit, helped to plan and finance while living in Manila, the Philippines, in the mid-1990s. The tactical similarities include the targeting of multiple U.S.-flagged aircraft traveling to the United States, the use of modular explosive devices — which were to be assembled in-flight after operatives accessed their carry-on baggage — and the use of liquid explosives.

The scope of the Heathrow plot also highlights another theme common in al Qaeda plots: a tendency to think big. This theme, which was reflected in the original planes operation and in Bojinka, was also the undoing of al Qaeda attacks such as the 1993 World Trade Center bombing, the Millennium Bomb Plot and an attempted strike against the USS The Sullivans off the coast of Yemen in January 2000. Indeed, the scope of the Heathrow plot and the need to include many people in its execution is likely what opened the door for a British government informant to penetrate the group and learn of the plans.

As seen in past cases involving operational commanders such as Basit and Ahmed Ressam, it is fairly common for operational commanders to commit passport fraud. In fact, recovered al Qaeda operation manuals encourage using fraudulent documents to hide one’s identity, enter a country illegally or continue to stay in a country after a legitimate visa has expired. Basit had more than a dozen aliases that we know of, including the well-known fraudulent Iraqi passport in the name of Ramzi Yousef — the name by which many people still mistakenly refer to him. Gulzar’s use of South Africa as a source of fraudulent documents and a transit point to Europe also exemplifies a trend we have been watching for some time now.

When British police arrested Gulzar on Aug. 9, 2006, he told them his name was Altaf Ravat and produced his South African documents. It was only after running fingerprint checks that they determined — two days after his arrest — that he really was a British citizen named Mohammed Gulzar. When questioned by police, Gulzar admitted he was not on his honeymoon, though he then said he was a missionary with the Tablighi Jamaat and was in the United Kingdom on a proselytizing mission.
As seen in past attacks — the 1993 World Trade Center bombing, the attack on the USS Cole, the East Africa embassy bombings and others that followed the al Qaeda 1.0 operational model — the operational planner does not intend to be killed or captured. He flees and lives to fight another day. In operations in which an operative plans to be killed, such as 9/11 and the July 7, 2005 London attacks, there is no need for him to hide his true identity. Gulzar’s use of a fraudulent identity suggests he intended to flee after the attack. This theory is supported by the fact that British authorities recovered a number of videotapes containing the wills and suicide declarations of various members of the alleged cell, but they did not recover such a video featuring Gulzar.
Fitting the Pieces Together
Hindsight is a wonderful thing and when we use it to plug the 2006 Heathrow plot into the big picture of al Qaeda behavior during that time, we can begin to make some assumptions as to the extent of the core leadership’s involvement.

According to court testimony, the British government began to monitor many of the men allegedly involved in the plot shortly after the July 7, 2005 London attacks. It also has been reported that, like Mohammed Siddique Khan, several of the men involved in the 2006 plot had traveled to Pakistan and received training at jihadist camps. It also appears that Gulzar was sent by the core al Qaeda leadership to London in July 2006 to supervise the execution of this plot. Judging from past cases, Gulzar’s preparation for the travel to London likely began several months prior to his actual arrival in the United Kingdom. Also judging from past cases, a plan of this magnitude, involving so many aircraft, almost certainly would have to have been approved by the al Qaeda apex leadership. The leadership probably also provided the funding for the operation, including the more than $271,000 in cash the group reportedly paid for the flat they purchased in London, where the improvised explosive mixtures were to be manufactured.

If those assumptions are indeed true, then this plot may very well be one of the operations Osama bin Laden was referencing in his Jan. 19, 2006, message when he said, “The delay in similar operations happening in America has not been because of failure to break through your security measures. The operations are under preparation and you will see them in your homes the minute they are through (with preparations), with God’s permission.”

The preparations for this attack also had picked up momentum by mid-2006 when the al Qaeda core leadership was undertaking what we referred to at the time as a media blitz. Indeed, just as the traffic from this blitz was beginning to slow down, As-Sahab released a video titled, “Will of the Knights of the London Raid (Part 2),” which contained the last will of London bomber Shehzad Tanweer. This video was released one day before the anniversary of the July 7 attacks and 12 days before Gulzar arrived in the United Kingdom.

Nine days after Gulzar’s arrival, and two weeks before the arrests were made, As-Sahab released a video featuring al-Zawahiri. The backdrop featured three large photographs: one of Mohammed Atef (al Qaeda’s senior military chief who was killed in Afghanistan in late 2001), one of 9/11 operational commander Mohammed Atta and one of the burning World Trade Center towers.

In the video, al-Zawahiri discussed a lecture Atef gave in 2000 to al Qaeda trainees about Palestine. According to his recounting, Atta — who was among the trainees — asked, “What is the way to defeat the attack on Palestine?” Al-Zawahiri supplied his own answer in the video, saying the nation that produced the 19 “who shook America” is “capable of producing double that number.”

It could be a coincidence that a large plot involving aircraft — nearly twice as many as were hijacked on 9/11 — was thwarted only two weeks after this video surfaced. But we are not big believers in coincidence — nor do we believe there are obvious (or even hidden) messages in every al Qaeda message. However, to our minds the July 27 tape was a clear message meant to be viewed in retrospect — that al Qaeda was behind the Heathrow airline plot.
The Continuing Fixation
More than anything, the current trial is a reminder of three things. First, had the first wave of attacks successfully taken down the planes, it would have been very difficult to determine how the explosive devices had been smuggled aboard the aircraft. This means it is entirely possible the same tactic would have been used in subsequent waves of attacks.

Second, for some reason in 2006 the al Qaeda leadership’s eagerness for a spectacular attack appears to have trumped their perceived need for moderation. It was the moderation of people like Mohammed Atef that reined in the enthusiasm of the group’s idealists (men such as Khalid Sheikh Mohammed) and caused them to scale down the 2001 planes operation to less than half its original size — a measure that improved operational security and assisted in the 9/11 plot’s eventual success.

Finally, al Qaeda remains fixated on aircraft as targets and, in spite of changes in security procedures since 9/11, aircraft remain vulnerable to attack.

Yemen: Al Qaeda's Resurgence

With a recent increase in violence in Yemen, al Qaeda appears to be resurging under the leadership of Nasir al-Wahayshi, an ethnic Yemeni who spent time in Afghanistan while serving as a lieutenant under Osama Bin Laden. He returned to Yemen in 2003 through an extradition deal with the Iranian government and subsequently escaped from a high-security prison outside of Sanaa in 2006 along with Jamal al-Badawi (leader of the cell that carried out the suicide bombing of the USS Cole). Al-Wahayshi also maintains close ties with Qasim al-Rami, who was suspected of having been involved with the operational planning of the suicide attack on a group of Spanish tourists in Marib in July 2007.

While a drastic increase in operational sophistication has not been seen yet — the group is concentrating on small-scale attacks while avoiding suicide operations and large bombings — the node has demonstrated the ability to launch multiple attacks in different locations within a short period of time. These attacks show that the group has adopted a fairly traditional jihadist target set, concentrating its efforts on symbolic Western targets (recently the U.S. Embassy in Sanaa and a Western housing compound), the energy sector (French, Chinese and Canadian interests) and elements of the security apparatus (small-scale attacks on security forces in the Marib province).

An element of the group’s resurgence is evident in the release of public statements, recently in the form of a publication entitled Sada al-Malahim (The Echo of Battle). It has appeared on radical Islamist Web sites, with the first issue surfacing in January. While that first issue was fairly simplistic, the second included a statement by a fighter who explained his rationale for choosing to stay and fight in Yemen instead of traveling to Iraq: He stayed in order to attack the oil and energy sectors in Yemen that are helping to fuel Western operations in Iraq and elsewhere. This statement is in line with the attacks on the Chinese oil field and the French pipeline in early April.

With the production of Sada al-Malahim, parallels between al Qaeda in Yemen and other al Qaeda nodes begin to appear. The most notable parallel is with the Saudi al Qaeda node, which, at its peak, was issuing statements and publications (including its magazine Sawt Al Jihad). The ability to produce statements and launch attacks simultaneously signifies a fairly competent and capable node. One secondary element to this comparison that warrants attention is the fact that while al Qaeda prime and various other nodes often release statements filled with threats, they rarely follow through on those specific threats and do not attack in the immediate aftermath; in contrast, al Qaeda in Yemen has proven that it not only follows through on the threats within its statements, it does so in a timely manner:

• 
  June 2007: Al Qaeda in Yemen issues a statement demanding that the Yemeni government release a number of prisoners being held on terrorism-related charges.
  
• 
  July 2007: No prisoners are released, and a suicide bomber strikes a group of Spanish tourists near an archaeological site near Marib. In a video released on the Internet, the bomber claims he carried out the attacks in the name of the Yemen Soldiers Brigade, a group that is directly linked to al Qaeda in Yemen.
  
• 
  January 2008: The first issue of Sada al-Malahim is released. The publication includes a demand for the release of prisoners being held by the Yemeni government on terrorism-related charges. No prisoners are released.
  
• 
  Jan. 18: A group of Belgian tourists is attacked in the Hadramout region; two tourists are killed.
  
• 
  March 13: The second issue of Sada al-Malahim is released and includes an interview with an alleged fighter who claims he chose to stay in Yemen in order to attack oil and energy interests that are fueling Western operations in Iraq.
  
• 
  March 18: Mortars are fired at the U.S. Embassy in Sanaa, although they miss the embassy compound and hit a local girl’s school. Shortly thereafter, there were a series of attacks on targets related to the energy sector, following through on the threats made in the second Sada al-Malahim statement.
  

The close timing between the releases of the Sada al-Malahim issues and the subsequent attacks indicate that the group has regained the ability to launch orchestrated attacks. Although the scope and sophistication of these attacks is somewhat limited at this time, the group indicated in their second issue of Sada al-Malahim that the new operational doctrine includes a campaign of continuous low-level attacks — a break from the large-scale attacks that have become symbolic of al Qaeda prime. While this could be interpreted as an indication of the group’s current operational capability, it can also be seen as an evolution in strategy. As the group’s history in Yemen has shown, launching a few large-scale operations does not achieve the desired effect. After the USS Cole was attacked, the Western presence in the Arab Peninsula did not dissolve, and the attack certainly did not drive away Western energy corporations. Thus, the group is adopting an operational doctrine somewhat similar to that seen in Iraq: a continuous flow of attacks designed to wear down the target’s resolve.

This evolution in strategy shows that not only has al Qaeda in Yemen been able to learn from its own failures, it has also recognized the operational effectiveness of the tactics employed by al Qaeda nodes elsewhere and adjusted accordingly. This development — along with the apparent increase in organization and leadership quality within the group — does not indicate that the group will diminish or that their attacks will cease in the near future.

Yet the increased organization within the group and the resultant release of statements prior to attacks are apparently making the group’s operations slightly more predictable. While the current operational doctrine calls for a continuous flow of low-level attacks, which are nearly impossible to anticipate, the flow has been punctuated by numerous higher-level operations associated with the release of these statements. As a result, future releases of Sada al-Malahim and other statements by the group can serve as indicators that a significant attack (or attacks) on Western targets in either the political realm or the energy sector is coming soon.

The high rate of attacks in recent weeks would appear to demonstrate that the group is devoted to its new operational doctrine and will continue to follow it until they are confronted. But if the Yemeni government’s long-term record of counterterrorism operations is any indication, the node will remain largely unmolested by security forces. One of the main reasons for this is the presence of a small, but fairly powerful, Salafist minority within the Yemeni military and intelligence apparatus. This presence makes openly condemning and actively addressing the al Qaeda threat a difficult task for the government. It is likely that the attacks will continue and the scope of the attacks will continue to broaden as al Qaeda in Yemen continues growing in organizational strength and sophistication.

Somalia: Al Qaeda and Al Shabaab

With the U.S. government reporting recently that the al Qaeda node along the Afghan/Pakistani border is reorganizing, and with evidence surfacing recently that the al Qaeda node in Yemen is reorganizing as well, it seems that a select few al Qaeda groups have been undergoing a period of rebuilding. The same situation could be playing out in Somalia with al Shabaab. Although there have been some small-scale successes in targeting elements of al Shabaab’s command and control structure, the link between the Somalian group and al Qaeda prime has been established, and al Shabaab’s expansion in the near future is a very real threat.

The group of al Qaeda operatives sent to aid the Somalian militias in 1993, which likely included Fazul Abdullah Mohamed is credited with instructing the Somalis on how to disable military helicopters by targeting them with rocket-propelled grenades as they flew low over the city. This tactic was what allowed the Somalis to disrupt U.S. operations and ultimately contributed to the U.S. pullout in late 1993. This serves as the first known example of al Qaeda providing direct material support to the Somalian cause. Al Qaeda’s motivation for supporting the militias at this time came partly from Somalis within al Qaeda prime’s ranks wanting to support their brethren in Somalia and partly from the group’s desire to take advantage of an opportunity to strike at the United States at a point of vulnerability.

As a predominantly Sunni country, Somalia has been a source of al Qaeda fighters over the years, with a number of ethnic Somalis traveling to Afghanistan to train with al Qaeda prime and then returning to organize and command local al Qaeda nodes. Al Qaeda prime was known to have sent numerous operatives to East Africa in the early to mid-1990s to locate potential targets. In more recent years, there have been numerous reports of Somalis fighting alongside members of the local al Qaeda nodes in Iraq, Afghanistan and Pakistan.

The group’s core leadership comprises senior militants, some of whom trained directly and fought with al Qaeda prime in Afghanistan, while its rank-and-file membership is largely untrained Somalian youths. Al Shabaab is estimated to have 6,000 to 7,000 members, with cells having several hundred members. As a result of Somalia’s turbulent past, the group’s members have had no shortage of practice in asymmetrical warfare and small unit tactics, as well as experience using a wide array of weaponry.

Helping to speed al Shabaab’s growth is the fact that when it was SICC’s militant wing, it had an organized command and control structure and many rank-and-file members already in place. The group was able to transfer that structure, and many of its members, to its new incarnation as al Shabaab. This — coupled with the leadership’s operational experience and links to al Qaeda prime — has helped create a capable and fairly strong group.

From a tactical standpoint al Shabaab does not yet exhibit any of the trademarks commonly associated with al Qaeda prime. The group employs a tactical doctrine that places a strong emphasis on small-unit, hit-and-run-style assaults, mainly targeting lightly guarded towns and villages and subsequently retreating to the countryside before reinforcements arrive. While they have begun to employ more traditional tactics such as improvised explosive devices in more urban environments, the militants have been operating more as a traditional insurgent force than as a traditional terrorist organization as commonly defined.

Somalia: Al Shabaab's Leadership Links to Al Qaeda