Wave of arson attacks add to growing sleeper-cell threat in North and East Syria

In May, both joint SDF and Coalition raids and sleeper-cell raids increased.  Raids increased 86% (22 up to 41), even before the start of June’s massive anti-ISIS operation in Deir-ez-Zor. Total attacks increased 110% (40 up to 84), with the month seeing the year’s first arson attacks. Even when arson attacks are excluded, the month still saw a 44% increase in attacks.

Even though raids have nearly doubled this month, and are increasing in general, 41 raids are still less than the rate seen in September prior to the Turkish invasion (48). Nonetheless, SDF and the international Coalition are now close to restoring the level of security the region was seeing prior to operation ‘Peace Spring’.

Key findings

• In May, 30% of all attacks were field fires set by SNA factions or ISIS, particularly in Til Temir, Kobane, Heseke, Manbij, and Deir-ez-Zor
• May was the first month in 2020 where we documented sleeper-cell attacks in the cities within the 30km “security zone” along the border with Turkey, with 4 fires started by SNA elements in Kobane and a grenade attack in Qamishlo
• ISIS sleeper-cells claim 36 kills, target leader from Syria’s Future Party
• Arrests this month remained stable with a 5% increase. Most SDF, Internal Security (Asayish) and Coalition actions consisted of dismantling IEDs, preventing fires, or thwarting attacks

Of the 84 attacks this month, a majority (54%) were claimed by ISIS and 25% committed by the Turkish-controlled Syrian National Army, with 21% remaining unclaimed. Prior to April no attacks had been attributed to SNA in 2020, while in April 2 attacks were committed by SNA. This month SNA responsibility quickly rose to 25% as SNA started setting crop fires around the frontlines of the newly-occupied zone.

This month’s attacks resulted in 36 claimed deaths, and 12 injuries. 6 of these fatalities and 2 of these injuries were Mukhtars (village leaders), who ISIS continues to assassinate as part of a targeted campaign in Deir-ez-Zor. One of these assassination attempts targeted Syrian Future Party leader Hezbollah al-Ahmad, a member of the the same party as Hevrin Khalef, who was killed on 12 October 2019 by Turkish-backed faction Ahrar al-Sharqiya. 

Raids also increased this month by 86% (22 to 41), reaching the closest to pre – Operation Peace Spring levels since October 2019. Of these 41 actions, a majority consisted of dismantling IEDs or thwarting attacks. May saw 55 arrests, a 5% increase from April, including the arrest of a chief financial officer of ISIS.

As always, IED attacks comprise a large amount of sleeper-cell attacks as well as grenades, gunfire attacks and assassinations. Meanwhile, 30% of all the attacks this month were comprised of groups – primarily factions of the Syrian National Army – intentionally starting fires in fields, targeting not just the residents of North and East Syria but also their livelihoods. It is likely ISIS sleeper-cells are also responsibility for a number of the daily field fires hitting other areas of North and East Syria, though in many instances it is difficult to determine responsibility in areas away from the frontlines (see note on methodology below).

Another change documented this May is the re-emergence of attacks in cities along the border such as Qamisho, and Kobane. From January 2020 until these areas in the 30 km “safe-zone” had remained untouched by sleeper-cell attacks. Despite this the majority of attacks still took place in the regions of Deir-ez-Zor (42%) and Raqqa, (30%), followed by Heseke (12%), Til Temir (11%), Kobane (5%) and Manbij (1%).

Comment from Robin Fleming, a researcher with the Rojava Information Center:

“May was marked by near-daily arson attacks on the wheat crop, especially in areas near the Turkish occupied zone, destroying the fields, occasionally taking lives and destroying livelihoods. This could not be timed worse for the inhabitants of North and East Syria, already in the midst of an economic crisis, as the Syrian pound rapidly depreciates in value to reach 3000SYP to $1.

As we saw in April, following operation Peace Spring then Turkish proxy forces continue attacks outside of the occupied areas. A quarter of documented attacks this month were attributed to the Turkish-backed Syrian National Army. This is another way the stability of the region continues to suffer from the Turkish invasion of October 2019, even though raids have slowly begun to rise again.”

Case Study:

Ali Sheikho, member of Til Temir fire department and himself a victim of the crop fires, told Rojava Information Center:

“The Turkish-backed fighters fire bullets, and burn the earth, the crops, and homes. We come from the fire department, and we put the fires out. They burned my land, and the land of my friend who works in the municipality.

There are fires on a daily basis. Towards the frontlines with the Turkish-backed fighters, all the fields have been burned. And now, they have started to burn the homes of the population. They haven’t left anything. Whatever they seize, they destroy and burn. I’d estimate that 500 dunams (50 Hectares) of land are burned on a daily basis.

Last night they started a fire in Burj village. Turkish-backed fighters opened fire us and we had to turn back twice, we couldn’t extinguish the fire. We went twice but the Turkish-backed fighters opened fire on us…

The people are poor, they only have the harvests and the Turks are burning them. A normal person here might own 100 dunams (10 hectares) and their income is at least 10 million SYP. Those 10 million can be burned and gone in seconds. People in this area in general are helping each other. The Turkish forces shoot at any fire truck that tries to extinguish the fire. Stopping it or shooting it is forbidden by international law, but they still shoot at it.”

Please contact us for the fully sourced data-set sortable by incident type and location, live map showing all ISIS and other sleeper-cell attacks since the start of the year, the full interview with the fire-fighter, and further analysis. This data was produced in collaboration with OSINT researcher Caki, and can be explored on the live map here.

Note on methodology: North and East Syria’s wheat harvest are suffering daily fires for a number of reasons. Some are intentionally set by sleeper-cell agents, including ISIS, Turkish-backed cells and reportedly Syrian government-linked agents: some are caused by SNA factions firing into farmers’ fields: and some are caused by human error, dropped cigarettes and so on. We will include only those fires for which there is evidence of SNA or ISIS involvement: this may be a claim of responsibility, physical evidence of arson, or hostile SNA activity reported in the location in question around the break-out of the fire.