The Islamic State’s Acolytes and the Challenges They Pose to U.S. Law Enforcement
Released: 2016-06-13T00:00:00

Summary:
Analysis of publicly available information on homegrown violent jihadist activity in the United States since September 11, 2001, suggests that the Islamic State (IS) and its acolytes may pose broad challenges to domestic law enforcement and homeland security efforts. Homegrown IS-inspired plots can be broken into three rough categories based on the goals of the individuals involved. The first two focus on foreign fighters, the last on people willing to do harm in the United States:
The Departed—Americans, often described as foreign fighters, who plan to leave or have left the United States to fight for the Islamic State. The Returned—American foreign fighters who trained with or fought in the ranks of the Islamic State and come back to the United States, where they can potentially plan and execute attacks at home. The Inspired—Americans lured—in part—by IS propaganda to participate in terrorist plots within the United States.
At least two other categories of IS foreign fighters pose some threat to U.S. interests:
The Lost—Unknown Americans who fight in the ranks of the Islamic State but do not plot terrorist attacks against the United States. Such individuals may come home after fighting abroad and remain unknown to U.S. law enforcement. Additionally, some American IS fighters will never book a trip back to the United States. Finally, some American IS supporters will perish abroad. The Others—Foreign IS adherents who radicalize in and originate from places outside of the United States or non-American foreign fighters active in the ranks of the Islamic State. These persons could try to enter the United States when done fighting abroad.
Federal law enforcement has numerous approaches to go after each of these categories of terrorist actors. These include the following:
Watchlisting—the federal counterterrorism watchlisting regimen effectively attempts to shrink "the lost" category described above. Preemption—efforts geared toward preemption of terrorist activity can be broadly described in terms of interdiction (stopping a suspected terrorist from entering the United States, for example), law enforcement investigation, and government activities aimed at keeping radicalized individuals from morphing into terrorists, also known as countering violent extremism.

paragraphs: S ince 2014, the Islamic State (IS) has become the focal point for the bulk of homegrown violent jihadist terrorist plots. This includes instances in which people in the United States wanted to travel to Syria to fight with extremist groups in the nation's civil war as well as plots to strike domestic targets. Regarding the former, in early 2016, U.S. government officials estimated that about 250 Americans had traveled (or tried to travel) to Syria to fight in the civil war—about 25 had been killed. Regarding the latter, in recent congressional testimony, the Director of National Intelligence, James R. Clapper noted that homegrown actors "will probably continue to pose the most significant Sunni terrorist threat to the U.S. homeland in 2016." 
Most homegrown IS acolytes have attempted to travel to Syria to join the terrorist group. The ideological goals undergirding the Islamic State's efforts to violently impose a caliphate in Iraq and Syria have attracted many of them. Some have sought adventure. Others have appeared to crave escape, camaraderie, even marriage. The Islamic State entices supporters via the Internet and social media. 
subsections: section_title: Broad Challenges for Federal Law Enforcement
paragraphs: According to CRS analysis of publicly available information, IS supporters have accounted for 67 homegrown violent jihadist plots between 2014 and early June 2016. In the same time period, IS-linked plots have dominated the homegrown violent jihadist landscape, accounting for 67 of 76 total plots. In November 2015, the Federal Bureau of Investigation (FBI) reportedly had more than 900 investigations of IS suspects in the United States. Coping with the comparative size of this threat is one of the challenges domestic law enforcement agencies face. This is complicated by the varied courses of action chosen by IS supporters as they engage with the terrorist group. 
subsections: section_title: Departed, Returned, Inspired
paragraphs: The 67 homegrown IS-plots can be broken into three rough categories based on the courses of action that plotters pursued as they attempted to support the terrorist group. (See Figure 1 .) The first two categories focus on foreign fighters, the last on people willing to do harm in the United States: 
The Departed — American foreign fighters who plan to leave or have left the United States to fight for the Islamic State. This group includes suspects scheming to travel but who are caught before they arrive in IS territory. The Returned — American foreign fighters who trained with or fought in the ranks of the Islamic State and return to the United States, where they can potentially plan and execute attacks at home. The Inspired — Americans lured—in part—by IS propaganda to participate in terrorist plots within the United States.
The desire to become a foreign fighter (captured in either the departed or the returned category) played a role in 41 of the 67 IS-related plots. Almost all of the 41 had people either departing the United States for Syria or considering such a trip. Two of the 41 cases involved investigations of people who had returned from the conflict zone. Together, the 41 plots accounted for more than two-thirds of homegrown IS acolytes. In other words, it seems more often than not, the allure of the Islamic State has encouraged would-be violent jihadists to journey to Syria rather than strike a domestic target. However, this is not to suggest that the Islamic State discourages Americans from staying put and committing acts of terrorism.
To the contrary, the Islamic State has incited would-be followers to stay in their home countries to commit terrorist acts. For example, in May 2016, the group issued an audio recording, particularly encouraging American and European sympathizers to commit attacks in their home countries during the holy month of Ramadan (early June to early July). The January 2016 issue of Dābiq , the Islamic State's English language magazine, praises the married couple reportedly involved in the San Bernardino shooting in December 2015. In 28 cases since the start of 2014, people inspired by the terrorist group's propaganda considered striking targets in the United States. Five of these succeeded.
section_title: Attacks in the United States "Inspired" by the Islamic State
paragraphs: According to CRS estimates, 5 of the 13 homegrown violent jihadist attacks that have occurred since 9/11 involved people inspired by the Islamic State. It does not appear that any of the suspects in either the five IS-inspired attacks or the eight others had sustained, substantive, in-person contact with foreign terrorist organizations. In essence, these attacks involved do-it-yourself—DIY—terrorists. Largely isolated from the operational support of terrorist organizations, they acquired violent skills (however rudimentary) by themselves or relied on abilities that they had developed prior to becoming violent jihadists. Such DIY-ers often scraped together ideological justification for their deeds from online or social media sources aligned with terrorist organizations. Some drew inspiration from charismatic figures like now-dead radical U.S.-born imam Anwar al-Awlaki, who was affiliated with the terrorist group Al Qaeda in the Arabian Peninsula. Awlaki died in a widely reported U.S. strike in Yemen in 2011.
As mentioned above, five attacks involved people who reportedly supported the Islamic State.
On June 12, 2016, Omar Mateen reportedly shot and killed at least 49 people in a gay nightclub in Orlando, FL. He allegedly wounded more than 50 others. Mateen was killed by police. He claimed allegiance with the Islamic State during a 911 phone call he purportedly made during the attack. His immediate motives remain unclear. On January 7, 2016, Edward Archer allegedly shot an on-duty Philadelphia, PA police officer three times in the arm. The wounded man survived. Archer reportedly assaulted the officer while the latter was in his patrol vehicle. The FBI is investigating the incident as an act of terrorism. After the attack, the reputed assailant confessed to the crime and mentioned the Islamic State. On December 2, 2015, husband and wife Syed Rizwan Farook and Tashfeen Malik reportedly killed 14 people and injured 22 others in a shooting incident at the Inland Regional Center, a social services facility in San Bernardino, CA. The couple appeared to have targeted employees attending a holiday lunch and training session for San Bernardino County's health department, where Farook worked. Both died in a shootout with police after the attack on the Inland Regional Center. The FBI has noted that the day of the shooting, "a post on a Facebook page associated with Malik" pledged allegiance to Abu Bakr al Baghdadi, the leader of the Islamic State. In 2011, Farook allegedly began to plot a terrorist attack with a neighbor, Enrique Marquez, Jr., a U.S. citizen. They purportedly targeted a stretch of State Route 91 and the Riverside Community College in California, and "planned to use firearms and explosives to carry out the terrorist attacks." Two rifles Farook and Marquez obtained for their planned attack were used in the San Bernardino shooting. The neighbors did not carry out their highway and college plot, in part, because arrests in an unrelated FBI counterterrorism investigation in Southern California made them wary. Their scheme was never detected by law enforcement. Additionally, it appears that Farook helped to radicalize Marquez by introducing him to extremist ideology and the work of Anwar al-Awlaki. In November 2015, Faisal Mohammad, an 18-year-old, stabbed a fellow student and attacked three others at the University of California, Merced campus. In March 2016, the FBI announced that its investigation of the incident uncovered evidence that Mohammad may have been inspired by Islamic State propaganda. In May 2015, Elton Simpson and Nadir Soofi were shot and killed by local law enforcement in Garland, TX, as they tried to attack an exhibition of cartoons depicting the prophet Muhammad. A security guard was wounded in the altercation. Simpson purportedly had a pro-Islamic State social media account and claimed Awlaki as an inspiration. A third individual, U.S. citizen Abdul Malik Abdul Kareem, conspired with Simpson and Soofi but was not directly involved in the shootout in Garland. In March 2016, Kareem was found guilty of attempting to provide material support to the Islamic State as well as other charges. 
section_title: Beyond the Departed, Returned, and Inspired
paragraphs: Aside from the three categories based on the courses of action that IS supporters follow, at least two other sorts of IS foreign fighters pose some threat to U.S. interests. 
The Lost: unidentified Americans who fight in the ranks of the Islamic State. Such individuals may come home after fighting abroad and remain unknown to U.S. law enforcement. Some American IS fighters will never book a trip back to the United States. (The post 9/11 record of U.S. counterterrorism investigations suggests this prospect. None of the Americans who have fought for al-Shabaab, a terrorist group based in Somalia, are known to have come home to plot attacks.) Finally, some American IS supporters will perish abroad. The Others: foreign IS adherents who radicalize in and originate from places outside of the United States or non-American foreign fighters active in the ranks of the Islamic State. These persons could try to enter the United States from abroad.
section_title: Confronting the Challenges
paragraphs: In the broadest of senses, confronting the threats posed by IS acolytes categorized as the departed, returned, inspired, lost, and others requires U.S. law enforcement to identify individuals who present a danger as terrorists and preempt their efforts to do harm. All of this draws on resources, strategies, and programs developed largely in response to 9/11. Beyond these established programs, additional law enforcement efforts specifically targeting the Islamic State have been made. 
The following discussion is not intended as an exhaustive analysis of federal law enforcement counterterrorism efforts in the homeland. It is meant to broadly inform policy makers on such activity.
subsections: section_title: Identifying Potential Terrorists
paragraphs: For the United States, systematically identifying potential terrorists involves the country's watchlisting regimen. The datasets in the regimen include identities linked to the Islamic State. Maintaining and enhancing the datasets can 
Help identify and stop known or suspected terrorists who plan to or depart the United States for IS territory. Assist U.S. authorities in spotting IS foreign fighters trying to return to the homeland. Help authorities track the travel and activities of homegrown IS acolytes inspired to do harm domestically. Shrink "the lost" and "the others" categories described above. 
The National Counterterrorism Center (NCTC) keeps a classified database known as the Terrorist Identities Datamart Environment (TIDE). TIDE is the U.S. government's "central repository of information on international terrorist identities." TIDE includes: 
to the extent permitted by law, all information the [U.S. government] possesses related to the identities of individuals known or appropriately suspected to be or to have been involved in activities constituting, in preparation for, in aid of, or related to terrorism (with the exception of purely domestic terrorism information). 
In late 2013, TIDE held the identities of approximately 1.1 million people. Of this number, about 25,000 were U.S. citizens and lawful permanent residents. Since 2014, NCTC particularly has worked with European partners to identify, track, and disrupt the violent activities of foreign fighters engaged in the Syrian conflict.
Within TIDE, NCTC "aggregates information" on known or suspected terrorists who travel to Syria. TIDE is not just a list but serves as an "analytic tool" and "valuable forum" for "identifying, tracking, and sharing information" about terrorists. NCTC also has a Pursuit Group that partly relies on such information to develop leads for "partner agencies to pursue." The group is specifically "working to identify foreign fighters entering Syria who have potential access or connections to the Homeland, so they can be watchlisted."
On March 10, 2016, several news outlets received a cache of documents from a reputedly disgruntled IS member. The cache purportedly included what amounts to personnel files containing information about more than 22,000 alleged IS members. If authenticated, this may assist the efforts of U.S. and foreign intelligence and law enforcement agencies to identify heretofore unknown IS fighters.
subsections: section_title: Watchlisting
paragraphs: The Terrorist Screening Database (TSDB, commonly referred to as the Terrorist Watchlist) lies at the heart of federal efforts to identify and share information about identified people who may pose terrorism-related threats to the United States. It includes biographic identifiers for those either known to have or suspected of having ties to terrorism. In some instances it also includes biometric information on such people. It stores hundreds of thousands of unique identities. Some of the entries in TIDE get into the TSDB, which held approximately 800,000 people in November 2014. The Terrorist Screening Center (TSC), a multi-agency organization administered by the FBI, maintains the TSDB. Information from the Terrorist Watchlist populates a number of other lists that play important roles in screening individuals such as travelers entering the United States.
section_title: Preempting Terrorists
paragraphs: Preemption of terrorist activity by U.S. law enforcement can be broadly described in terms of screening and interdiction (stopping a suspected terrorist from entering the United States, for example), law enforcement investigation, and government activities aimed at keeping radicalized individuals from morphing into terrorists . Of course, much of this work is predicated on identifying dangerous actors. 
subsections: section_title: Screening and Interdiction
paragraphs: Portions of the TSDB are exported to data systems in federal agencies that perform screening activities such as background checks, reviewing the records of passport and visa applicants, and official encounters with travelers at U.S. border crossings. As suggested above, screening processes are crucial to stopping terrorists—interdicting them—before they can harm the homeland. Interdiction conceivably involves at least two wide categories of IS acolytes who may intend to travel to the United States—" the returned " and " the others ." 
subsections: section_title: "The Returned"
paragraphs: Within the Department of Homeland Security (DHS), components such as Customs and Border Protection (CBP) and the Transportation Security Administration (TSA) draw on the TSDB for information regarding known or suspected terrorists, including any Americans entered into the TSDB for joining the Islamic State. For example, battle-hardened American IS members who choose to return to the United States run the risk of being spotted at U.S. borders by CBP officials who routinely test the identities of travelers against information drawn from the TSDB. 
CBP, charged with the mission of preventing terrorists and their weapons from entering the United States, has described its efforts as intelligence-driven and layered, geared toward mitigating the risk posed by travelers destined for the United States. As this suggests, the agency is at the forefront in identifying Americans who fought with the Islamic State attempting to come home—" the returned ." CBP "detect[s], assess[es] and, if necessary, mitigate[s] the risk posed by travelers throughout the international travel continuum. CBP and its partners work to address risk at each stage in the process: (1) the time of application to travel; (2) ticket purchase or reservation; (3) check in at a foreign airport; and (4) arrival in the United States." Additionally, DHS Secretary Jeh Johnson and other DHS officials have broadly alluded to U.S. efforts to coordinate with allies on foreign fighters. DHS has expanded its liaison with international officials regarding foreign fighters involved in conflict in Syria and Iraq.
section_title: "The Others"... The Ones Who Require Visas and ...
paragraphs: The State Department and DHS play important roles in visa security. These feature prominently in the effort to identify IS fighters not from the United States who try to get U.S. visas—" the others ." For example, the State Department Bureau of Consular Affairs is responsible for issuing visas and uses a number of tools to conduct national security and public safety reviews of visa applicants. One tool, implemented in partnership with NCTC, is dubbed "Kingfisher Expansion" (KFE) and began operations in June 2013. 
KFE examines 100 percent of the approximately 11 million visa applicants each year to identify any connections to terrorism by comparing applicant data to the classified data holdings [of NCTC].... KFE is an interagency program with a secure on-line vetting platform that allows FBI, DHS, and the Terrorist Screening Center to participate in the applicant reviews. This allows for a more comprehensive and coordinated response back to State Department.
Additionally, Immigration and Customs Enforcement (ICE), an agency within DHS, operates the department's Visa Security Program. The program is responsible for stopping terrorists and criminals who may try to use the legal visa process to enter the United States. ICE agents are stationed at 20 Visa Security Units located in U.S. embassies and consulates abroad. ICE notes that such visa security efforts include examining visa applications for fraud, initiating investigations, coordinating with law enforcement partners, and providing law enforcement training and advice to State Department officials.
section_title: ... Those Who Don't
paragraphs: What about IS fighters from countries where their citizens do not need visas to travel to the United States, that is, countries participating in the U.S. Visa Waiver Program (VWP)? In 2014, DHS responded to concerns regarding IS foreign fighters from VWP countries by expanding the information collected from VWP travelers through the Electronic System for Travel Authorization (ESTA). Customs and Border Protection (CBP) uses ESTA to review prospective travelers from visa waiver countries "to determine if they pose a law enforcement or security risk before they board aircraft destined for the United States." DHS has stated that ESTA has been a "highly effective security and vetting tool" enabling "DHS to deny travel under the [VWP] to thousands of prospective travelers who may pose a risk to the United States [presumably endangering national security or public safety], prior to those individuals boarding a U.S. bound aircraft." However, since ESTA is a biographic and not a biometric security check, and there is no interview by a consular officer, some contend that ESTA does not provide the same level of screening as applying for a visa. 
In addition to the enhancements of ESTA data elements discussed above, in 2015, DHS boosted the security criteria that countries "must meet to participate in the VWP." Also, in December 2015, Congress passed legislation requiring changes to the U.S. visa waiver program. Among other changes, the legislation established new eligibility requirements for the VWP which, as implemented, modified what data were to be collected from travelers via ESTA. Furthermore, as of April 2016, all foreign travelers participating in the Visa Waiver Program will have to use e-Passports. 
section_title: Investigation: Targeting "the Departed," "the Returned," and "the Inspired"
paragraphs: The FBI is the lead agency for investigating the federal crime of terrorism, and its IS-related cases largely have targeted suspects that this report describes as "the departed," "the returned," and "the inspired." Aside from its own investigative work, the Bureau relies on other U.S. federal agencies (such as DHS, the State Department, the Central Intelligence Agency, and NCTC) as well as state, local, and foreign governments for assistance and investigative leads. Specifically, in 2015 media reporting suggested that local police were enlisted in some locations to help with surveillance of possible terrorism suspects tied to the Islamic State.
Joint Terrorism Task Forces (JTTFs) led by the FBI play the chief role in coordinating federal counterterrorism investigations across the United States, bringing together federal, state, and local participants in the process. There are more than 100 JTTFs across the country in the FBI's field offices and resident agencies. JTTFs are locally based, multiagency teams of investigators, analysts, linguists, special weapons and tactics (SWAT) experts, and other specialists who investigate terrorism and terrorism-related crimes. Among their many roles, the agents, task force officers, and analysts working on JTTFs gather leads, evidence, and information related to these cases. They analyze this information and help develop cases for prosecution, most often pursued in federal court. JTTF members share leads and information from counterterrorism cases with federal, state, and local partners to coordinate counterterrorism investigations and broaden U.S. counterterrorism efforts. Over 4,100 federal, state, and local law enforcement officers and agents work on them (including more than 1,500 people from more than 600 partner agencies), more than four times the total prior to 9/11. 
subsections: section_title: Fusion Centers and Information Sharing
paragraphs: During the past decade, law enforcement cooperation has increased in the area of information sharing, particularly the exchange of material tied to terrorist threats. A hallmark of this has been the development of state and major urban area fusion centers, designed not to investigate people or crimes but to share threat information. The more than 70 federally recognized fusion centers in operation are not federally led. Rather they are controlled by state and local entities and supported by the federal government. They play a notable role in information and intelligence sharing, bringing together federal, state, and local law enforcement and security professionals working on counterterrorism and crime issues. Sharing can involve the reporting of suspicious activity to generate investigative leads for JTTFs to pursue. It can also include the exchange of more finished intelligence analysis discussing the evolution and nature of existing threats.
section_title: Stopping Radicalized Individuals from Morphing into Terrorists
paragraphs: Thwarting terrorist plotters also involves understanding the intricacies of radicalization—especially determining when individuals move from radical activity involving First Amendment-protected behavior to violent extremism (i.e., terrorism). Thus, the U.S. government faces the difficult task of finding ways to keep people who are radicalizing or radicalized from morphing into terrorists. Regarding the Islamic State, the FBI, DHS, and NCTC are working to understand the motivations driving people to radicalize and join terrorist groups in Syria. Ideally, this work prevents people from ever falling into the "departed," "returned," "inspired," "others," or "lost" categories described above. 
More generally, American counter-radicalization approaches favor government engagement with communities affected by terrorism. The U.S. government has a strategy aimed at countering violent extremism (CVE), much of which is focused on the domestic arena. The Administration's CVE strategy revolves around countering the radicalization of all types of potential terrorists. As such, the radicalization of violent jihadists falls under its purview and is the key focus. The Administration held a CVE summit in February 2015, and in January 2016, announced the creation of a Countering Violent Extremism Task Force to coordinate "federal efforts and partnerships" in the CVE arena. The task force, a permanent interagency body, emerged after "representatives from 11 departments and agencies" reviewed federal CVE efforts. The task force is to "organize federal efforts" at 
Research and Analysis. The Task Force will coordinate federal support for ongoing and future CVE research and establish feedback mechanisms for CVE findings, thus cultivating CVE programming that incorporates sound results. 
Engagements and Technical Assistance. The Task Force will synchronize Federal Government outreach to and engagement with CVE stakeholders and will coordinate technical assistance to CVE practitioners. 
Communications. The Task Force will manage CVE communications, including media inquiries, and leverage digital technologies to engage, empower, and connect CVE stakeholders.
Interventions. The Task Force will work with CVE stakeholders to develop multidisciplinary intervention programs.
Examples of interagency efforts at CVE afoot prior to the Task Force's creation include the following:
The National Security Council has coordinated an interagency "effort to work with Boston, Los Angeles, and Minneapolis/St. Paul to facilitate and support the development of locally based, and driven, violent extremism prevention and intervention pilot frameworks." The Community Resilience Exercise, developed and presented by DHS and NCTC, brings together local law enforcement and community leaders in a specific locale to work through "a hypothetical violent extremist or foreign fighter-related scenario, including a hypothetical attack. The goal of the exercise is to build capacity within municipalities to mitigate the terrorist threat." The Community Awareness Briefing, developed by DHS and NCTC, is "a key tool [the agencies] use to convey information to local communities and authorities on the terrorist recruitment threat. The CAB now also includes information on the recruitment efforts of violent extremist groups based in Syria and Iraq." As of June 2015, the CAB had been presented in 15 U.S. cities. Community engagement efforts pursued by the office of Civil Rights and Civil Liberties in DHS, including June 2014 meetings in Los Angeles that covered topics concerning Syria and World Refugee Day.