Report: 2019 review of sleeper cell attacks and anti-ISIS raids in North and East Syria

, ,

Key findings

• The months leading up to September saw a steady month-on-month decrease in ISIS sleeper cell attacks, and an increase in SDF anti-ISIS raids. Following the Turkish invasion in October, the number of attacks has consistently risen and the rate of SDF raids fallen
• The number of anti-ISIS raids fell 77% to 13 in December. This is the second-lowest rate in 2019, after January (10 raids)
• December saw the lowest number of arrests of sleeper-cell members in 2019, with only 12 reported arrests
• 84 total documented attacks occurred in the month of December, equal to the previous month but up 162% when compared to the beginning of the year
• We documented a total of 906 sleeper-cell attacks in 2019, 683 of which were claimed by ISIS, and 395 joint SDF and Coalition raids
• Our best estimate of fatalities* caused by sleeper-cell attacks is 406. At least 581 sleeper-cell agents were arrested in 2019
• Despite the significant decrease in attacks experienced in the month of September, prior to the Turkish invasion, from January to December the number of ISIS-claimed attacks has risen 722%.
• In the month of October, the start of the Turkish invasion, civilian fatalities rose 325%.

Annual Analysis

Robin Fleming, Rojava Information Center researcher, says:

“Looking back on 2019, it is clear that the political situation in the region affected the rate of monthly raids and attacks, with the SDF significantly reducing the rate of attacks and establishing stability across much of North and East Syria in the months prior to the Turkish invasion, while the number of fatalities and incidences of attacks spiked following the October 2019 operation.

During the war against ISIS, in the months of January, February and March, attacks and raids remained quite low as both the SDF and ISIS were putting the majority of their efforts and resources into the war itself. After the territorial defeat of ISIS we see an immediate rise in attacks, as ISIS was seeking revenge and striving to remain relevant, with ISIS elements dispersing into the Deir-ez-Zor countryside. May, two months after ISIS’s defeat, saw an all-time high of 139 documented attacks.

After May, the SDF responded to the threat and increased their level of raids. Due to the efforts of joint SDF and coalition raids, as well as the work of the Asayish (internal security forces), attacks and casualties slowly decreased. Both reached a low point in the month of September (only 12 deaths, and 51 attacks), the month prior to the Turkish invasion. We saw an exception to the general trend of decline, when the rate of attacks rose in August – the same month Erdogan was threatening North and East Syria with invasion, until the temporary agreement over the so-called “safe zone” was put in place.

During September, as this agreement was in place, attacks remained low – only to rise again immediately after the October invasion, as ISIS thrives in the instability caused by the Turkish invasion. In December, anti-ISIS raids dropped to the very low level they were at the start of the year, undoing much of the progress and stability gained throughout 2019 as ISIS continues to grow in strength.”

The Turkish invasion has precipitated a significant increase in sleeper-cell activity, though the situation is still slightly better than the height of the insurgency in July 2019

Month by month breakdown

2019 started with the lowest rates of both SDF raids (10) and total sleeper-cell attacks (32). These remain the lowest monthly rates documented in 2019. The 10 raids resulted in the arrest of 17 sleeper-cells. A large percentage of these attacks have remained unclaimed (23, 72%) by any group, with only 9 of the 32, (28%) attacks being confirmed as the work of ISIS.

As will remain true throughout the entire year, the majority (15, or 47%) of sleeper-cell attacks in January targeted the region of Deir-ez-Zor. ISIS still held territory in this region and would continue to do until the SDF’s territorial defeat of ISIS on 23 March 2019. After Deir-ez-Zor, Raqqa saw the most frequent attacks with 9 taking place in the month of January. Sleeper cells primarily used car and motorcycle bombs, or IEDs. Of particular note is an IED attack in Manbij which claimed the lives of 4 United States citizens. In total 24 fatalities were recorded*. Only 2 sleeper-cell attacks targeted the region of Manbij in January, and 6 in the Heseke region – including 2 attacks, one of which was thwarted by Asayish (internal security forces), in the de-facto capital of Qamishlo.

In the month of February, raids increased 220% with 32 documented raids, while there were 53 total attacks – a 66% increase from January. Contrary to the previous month, ISIS claimed all but 2 of the attacks. Deaths doubled, from 24 in January to 50. Arrests increased by 394%, reaching 84. Attacks in the regions of Manbij and Heseke remained low. The use of IEDs and VBIEDs remained constant. ISIS also stepped up its efforts to target people connected to the SDF and the Autonomous Administration, in a trend that would continue throughout the year, for example assassinating two members of the internal security units in Raqqa.

The rate of raids saw no significant change in March. 32 raids took place, but yielded only 16 arrests – a 80% decrease from the 84 arrests in the previous month. Attacks increased 19% (to 63). 41 of the 63 attacks are confirmed as having been carried out by ISIS. 54 deaths were claimed as a result of these 63 incidents. 70% of all attacks (44) took place in Deir-ez-Zor, including 15 armed attacks, 13 assassinations, and 16 car-bombs and IEDs.

The region of Deir-ez-Zor saw 72% (23) of March’s raids. The region of Heseke only saw 11% (7) attacks, 1 assassination, 1 armed attacked, and several Eids and car-bombs. Only 1 raid occurred in Heseke region. Manbij remained the safest region in North and East Syria, with only 2 documented explosions and 2 raids. Only 7 (11%) of the attacks took place in Raqqa, the majority of them being armed attacks, plus 1 assassination, and 2 explosions. The SDF, and internal security forces carried out 5 raids in Raqqa.

In April, raids increased by 29% (40), yielding 34 arrests – a 112% increase. April saw 89 total sleeper-cell attacks, up 41%, with 68 claimed by ISIS leaving 21 unclaimed by any group. The number of fatalities remained stable compared to March, with 55 compared to 54 in the previous month. ISIS claimed as many as 21 assassinations, including several SDF-affiliated individuals, 26 armed attacks, 39 explosions, and 2 kidnappings of SDF members.

Throughout 2019, the month of May saw the highest number of attacks – 139, a 56% increase compared to April and a 334% increase when compared to the beginning of the year. ISIS claimed 95 of these attacks, while 44 were unclaimed. Deaths increased 42% this month to reach 78, significantly more than any other month we were able to collect data for. Raids decreased in May with only 34 raids compared to 40 in April: a 15% decrease. Despite the low rate of raids, they were highly productive resulting in 100 arrests, increasing 194% (34 to 100) – the second-highest number of documented arrests through 2019.

87 attacks took place in Deir-ez-Zor in May, including 37 IEDs and car-bombs, 16 assassinations and executions, and 34 armed attacks. SDF and internal security forces conducted 22 raids in Deir-ez-Zor in May. The Heseke region saw 21 attacks, increasing 163%, including the killing of a local women’s activist and a tribal elder. 9 attacks and 2 raids took place in Manbij, 11 attacks and 3 raids occurred in Raqqa, and 3 attacks and 4 raids took place in Tabqa.

In June, the number of attacks decreased 40% (139 to 83) while the number of raids increased 70% (34 to 58) compared to the previous month. June saw the highest number of raids in 2019. 80% (66) of the total attacks were claimed by ISIS, 20% (17) going unclaimed. The number of deaths and arrests was not documented for the month of June.

There was a high rate of attacks in the previously peaceful Heseke region (15) with multiple incidents of VBIEDs targeting the de-facto capital Qamishlo. ISIS used execution of children, VBIEDs, and attacks in peaceful areas far from Deir ez-Zor to spread terror despite SDF crackdown. There were notable decreases in Deir-ez-Zor (87 down to 55) and Manbij (9 down to 4). The month saw 25 armed attacks and ambushes, 31 IED and explosive attacks, 9 assassinations, five kidnappings, four car bombs, four motorbike bombs, three RPG attacks, one decapitation and one execution of a child.

Though the number of deaths in sleeper-cell attacks is decreasing, the rate of SDF anti-ISIS raids has also plummeted

July saw little change in number of raids (58 down to 50) or attacks (83 up to 86). SDF raids continued to be productive this month, yielding the highest number of arrests in 2019 (136). There was no reliable number of fatalities for this month. ISIS claimed 70% (60 of 86) of the documented incidents, while 17 were unclaimed, leaving a remaining 9 attacks to be claimed by Ahrar al-Shaab**, a newly-active Turkish-linked sleeper-cell group.

The security situation continued to improve in Manbij (no attacks, only one IED deactivated) and Raqqa (2 attacks, both claimed by Ahrar al-Shaab). Deir-ez-Zor also saw a continued steady decrease in attacks (47 attacks, down from 55) as widespread SDF raids continued in the area, though it still experienced daily violence, including SVBIED and VBIEDs as well as assassinations and frontal assaults on checkpoints. However, there was an increase in attacks in Heseke region, with 10 in the city of Heseke alone, plus attacks in Qamishlo and Sere Kaniye. These have included car bombs in all three cities, and seven motorcycle bombings across the region.

95 total sleeper-cell attacks were recorded in August, a 10% increase (86 to 95) including attacks carried out by both ISIS (64) and Ahrar al-Shaab (14), resulting in 35 recorded deaths. August saw the second-highest rate of total attacks. Of 35 total deaths, 7 deaths were claimed by Ahrar al-Shaab and 18 by ISIS, with 10 left unclaimed. All 7 of Ahrar al-Shaab’s documented stabbings, beheadings and assassinations took place in the Jazeera region, close to the border regions where Turkey was threatening occupation.

Raqqa saw 4 attacks targeting village elders (mukhtars) – a trend that would continue throughout the year. The security situation in Deir Ez-Zor remained mostly unchanged: the majority of attacks (49 attacks, 20 fatalities) across North East Syria still occurred in the newly-liberated region, as well as the majority of SDF raids. Manbij remained stable, with only one SDF raid and no attacks. The city of Raqqa faced 7 attacks, plus more in the surrounding countryside. The Heseke region was the site of 7 motorcycle and car bombings, plus grenade, IED and armed attacks, as well as assassinations of SDF and internal security forces members.

Meanwhile, over 78 members of ISIS and other cells were arrested during 39 SDF and coalition raids of August, including a high ranking Isis member, Anwar Mohammad Hadoushi from Belgium, who is believed to have been involved in the Paris and Brussels attacks.

September was marked by a steep decrease in total attacks, down 46% (95 to 51). This was accompanied by an increase of 23% (39 to 48) in SDF raids resulting in 48 arrests. ISIS attacks also decreased 32% (64, 43), and attacks by Turkish-linked Ahrar al-Shaab almost completed ceased, as they only claimed one attack this month. 7 attacks were left unclaimed. Deaths also decreased to an all-time low when compared to August, dropping 65% (35 to 12). This marked an 85% decrease compared to the fatality peak in May when 78 deaths were claimed.
There were a total of 10 attacks in Raqqa this month, all claimed by ISIS. Manbij remained relatively secure with only 2 recorded attacks, while there were 5 attacks in Heseke and 31 attacks in Deir-ez-Zor, marking a 37% decrease (down from 49). The SDF and Coalition conducted 26 of their 48 raids in Deir-ez-Zor.

Overall, despite the Turkish invasion on 9 October, the rate of attacks remained stable (51 to 48). However, the week leading up to the Turkish invasion saw a little over 1 ISIS sleeper-cell attack a day (1.1/day), whereas the three weeks to the end of the month following the invasion saw 38 attacks in 21 days, or 1.8 attacks a day – an immediate 48% increase. 45 of the attacks were claimed by ISIS, leaving 3 unclaimed, and October saw the end of attacks claimed by Turkish-linked Ahrar al-Shaab.
All of North and East Syria saw a spike in death claims, with 51 documented deaths from sleeper-cells compared to 12 in September, or a 325% increase. ISIS continued its targeting of village elders (‘mukhtars’) working with the Autonomous Administration as well as SDF commanders, with Mahmoud Al-Mazyouz and Abdul Latif Abdul Rahman al-Huwaidi named locally as civilian victims of assassinations.
The partnership between SDF and the International Coalition against ISIS was disrupted by the Turkish invasion. The three months prior to the Turkish invasion saw an average of approximately 2 raids a day, while the October average was just a raid every two days – a 75% decrease. The total number of raids was only 17 in October compared to 48 the month before (down 65%).

Following the Turkish invasion, sleeper-cell attacks rose 63%, with 83 documented attacks in November compared to 51 in September – 85% of which were claimed by ISIS. November saw 38 claimed deaths, compared to 12 in September – a 216% increase, though down from the 51 fatality claims in October. Joint SDF and Coalition raids remained low since the beginning of the invasion, with November seeing only 23 recorded raids.
58% of November’s attacks occurred in Deir-ez-Zor, claiming 21 lives. The region of Heseke faced 21 total attacks and 15 deaths, 10 of which remained unclaimed by any group. ISIS continued to target village elders, or Muhktars, as well as council members, priests and a female member of the Syria’s Future Party, Lina Abdulwahid.

The large prevalence of unclaimed attacks in the Heseke region which bore the brunt of the Turkish invasion may point to the involvement of Turkish-backed sleeper cells, as ISIS typically issue swift claims for any attack they commit. In particular, a November 11 bombing in Qamishlo which killed five civilians was not claimed by ISIS, with local security forces reporting that the perpetrators had been arrested and confessed to receiving direction and payment from Turkey.

There was no significant change in attacks when comparing December to November, (83 to 84). 74 attacks were claimed by ISIS, with 10 unclaimed, and 18 lives lost. Raids declined in the shadow of the Turkish invasion; only 13 raids were documented in December, or a 43% decrease. Only January saw fewer raids (10) than December, and the number of documented arrests was at an all time low this month, only 12 were recorded, a 59% decrease (12 down from 29). 14 attacks took place in the region of Heseke, 49 in Deir-ez-Zor, 13 in Raqqa, 7 in Tabqa and only one in Manbij. The primary form of attack was IEDs, as 23 IED attacks were recorded this month. ISIS continued its campaign of assassinations, including at least 3 persons associated with the SDF and two Shaddadi civil council members.

*Note on fatalities: fatality figure is a comparative figure compiling both claimed and reported deaths in sleeper-cell attacks.

*Note on Ahrar al-Shaab’s links to Turkey-
Several factors indicate a high likelihood of Turkish intelligence involvement in Ahrar al-Shab’s activities, with the group operating in a similar fashion to previously-active Turkish-linked groups such as Harakat al-Qiyam: (1) focusing propaganda on the ‘PKK’ and ‘PYD’; (2) using the Turkish phrase “Zaytin Dali” to refer to Operation Olive Branch; (3) using its telegram channel to push Turkish propaganda lines over PKK links to SDF.
Most significantly, (4) Ahrar al-Shab have stated they are responding to “attacks on our people in the areas of Olive Branch and the Euphrates Shield”, clearly aligning themselves with the Turkish occupation in Afrin. We can provide further background and comment on the group if needed.

2 replies

Trackbacks & Pingbacks

  1. […] can see here for our month-by-month report on ISIS sleeper cell activity throughout 2019, and here for our report on the impact of the partial US/Coalition withdrawal on anti-ISIS […]

Comments are closed.