- Well-trained or lone wolves? ISIS "brand" is covering the spectrum
- Group's focus is on its caliphate, but it has ties to groups with other priorities
(CNN)The map of ISIS "activity" makes for frightening reading.
The group or its affiliates claim conspiracies and attacks on four continents; its self-declared "provinces" cut a swath across the Middle East and Africa; and it has begun to take the war to its enemies with the bombing of the Russian Metrojet airliner over Sinai and the Paris attacks.
There's still a huge difference between the "ISIS core" carrying out mass murder in Iraq and Syria or seizing a city the size of Ramadi, and an infatuated follower in Boston or London picking up a carving knife. At one end of the spectrum, there are well-trained fighting units and bomb factories operating in ISIS' heartland. At the other are lone wolves who adopt the group's moniker and language in the solitude of their apartments, and who adopt the ISIS "brand" because it has a dynamism and cachet that al Qaeda no longer possesses.
But there also are many shades in between these poles.
A CNN "map of ISIS" shows the group's rapid geographical spread, but also seeks to distinguish between what it and its affiliates direct, what they support and what is done in their name without their even being aware. The recent gun attack in San Bernardino, California, is the most striking example of this last category.
The group's focus very much remains on its caliphate -- the land it holds from Fallujah in Iraq to Raqqa in Syria and beyond, and the estimated 11 million people who live in areas it controls. But it has accepted the allegiance of groups from Ansar Beit al-Maqdis in Egypt to Boko Haram in Nigeria. And it clearly sees opportunities in Libya -- where it has declared three wilayat, or provinces -- in Yemen, Afghanistan and even Somalia.
Now it appears that ISIS' Shura Council -- which sets the group's strategy -- may have given its blessing to al Qaeda-style terror attacks in Europe, opening a new front in the "Far Abroad" in retaliation for the thousands of airstrikes aimed at its leadership and fighters since August 2014.
The ISIS affiliates
In each case, the relationships between ISIS and its affiliates are difficult to pin down. In Libya, militants in the town of Derna pledged allegiance to ISIS leader Abu Bakr al-Baghdadi in November 2014 -- a pledge that was immediately accepted. And it appears that leading figures from Iraq have been sent to Libya to help run operations there.
Regional sources told CNN some months ago that Abu Ali al-Anbari, a senior ISIS official in Syria, had been dispatched to Libya. Recent Libyan reports -- which cannot be confirmed -- say al-Anbari is now in Sirte, one of the few places beyond Iraq and Syria held by an ISIS affiliate. Another al-Anbari (Abu Nabil) was sent to Derna from Iraq last year.
The Islamic State in North Sinai (ISNS) -- a large and sparsely populated part of Egypt -- is a largely homegrown group, and there has been scant evidence to date that its operations are shaped by ISIS core. The group was known as Ansar Beit al-Maqdis before declaring its affiliation to ISIS in November 2014. But since then, both the scale and frequency of its attacks on the Egyptian military have grown exponentially. It has for the first time beheaded a Western hostage.
But the downing of the Metrojet flight was a game-changer for both ISNS and ISIS. ISNS made the initial claim of responsibility, saying: "We are the ones with God's blessing who brought it down. And God willing one day we will reveal how at the time we desire."
ISIS followed up with publication of a photograph of the alleged device (a soda can and detonator) in its online magazine Dabiq. What is unknown: whether the affiliate was instructed or helped by ISIS' "head office" to carry out the attack.
It is difficult to imagine that ISIS' fast-evolving footprint in Yemen could have been achieved without some assistance from the central leadership. In a crowded jihadist landscape, and apparently with the help of some defections from the al Qaeda franchise, ISIS in Yemen has claimed responsibility for devastating attacks on both the Houthi minority and the Saudi-led military coalition this year, often eclipsing the longer-established al Qaeda in the Arabian Peninsula (AQAP.)
Boko Haram's pledge of allegiance to ISIS in March coincided with a revamp of the Nigerian group's media activity, as it adopted the sharper production values of ISIS and boasted ISIS-style punishments, such as beheadings.
ISIS accepted the pledge and congratulated its "jihadi brothers" in West Africa. But there are no indications that ISIS has any say in the mercurial brutality that continues to be Boko Haram's hallmark. The leadership of the two groups could not be more different. ISIS makes few references to its West African affiliate's operations and Boko Haram rarely mentions al-Baghdadi or the Islamic State.
ISIS has not declared a wilayat in Turkey but has shown that it has the capability to strike there with devastating effect, exploiting the porous border with Syria and a network of safe houses inside Turkey.
Turkish officials have blamed ISIS for the suicide bombings in Suruc in July and the double bombing in Ankara in October, though the organization itself has not claimed responsibility for either. ISIS also managed to track down and kill deep inside Turkey two Syrian activists who had exposed its brutality in Raqqa.
Now add Lebanon to ISIS' regional reach, even if its presence there had been widely suspected before the suicide bombings in November that targeted its arch enemy, the Lebanese Shia militia Hezbollah.
Jihadists to and from the caliphate
Even before the Paris attacks, evidence was emerging that some of those plotting or carrying out attacks in Europe had spent time in ISIS territory in Syria or Iraq -- demonstrating a direct link between the hierarchy and conspiracies far from its heartland.
In France, a 24-year old IT student, Sid Ahmed Ghlam, was arrested in April and charged with the killing of a woman. He had spent time in Turkey and possibly Syria in 2014. The Paris prosecutor, Francois Molins, alleged Ghlam was planning terror attacks against one or more churches and had "acted following instructions given to him, in all likelihood, from Syria, on behalf of terrorist organizations."
The man accused of carrying out a gun attack against a Jewish museum in Brussels, Mehdi Nemmouche, was known to have traveled to Syria; an ISIS flag was discovered in his belongings. A French journalist who had been held hostage in Syria alleged Nemmouche had been among his jailers. Nemmouche awaits trial in Belgium.
Belgian authorities moved against a cell in Verviers last January that had stocked weapons and explosives in a safe house. Three of the cell members had spent time in Syria. Two were killed in a gunbattle; Belgian investigators believe they and a third man arrested were in contact with a Belgian ISIS operative in Syria called Abdelhamid Abaaoud.
Abaaoud, of course, later smuggled himself into France, as had several others who had been to Syria, to plan and carry out the Paris attacks on November 13 -- the deadliest terror attack in French history. It was the starkest example of yet of ISIS' ambitions and capabilities, of its exploitation both of migrant flows into Europe and existing jihadist networks.
In response to the growing evidence of jihadists returning to Europe, the U.S. House of Representatives passed legislation that would oblige anyone who had visited Syria, Iraq, Iran or Sudan to obtain a visa before traveling to the United States.
Social media help ISIS go global
ISIS' intensive use of social media and even online gaming platforms to recruit and communicate sets it apart from other terror groups. It also makes it more difficult to distinguish between plots that are directed, encouraged or simply inspired. Online recruitment has been especially active in Saudi Arabia, which has -- like other Gulf states -- seen an uptick in attacks claimed by ISIS.
More difficult to categorize are many of the conspiracies claimed by (or blamed on) ISIS in both Europe and the United States. In the United States, that's sometimes because authorities prefer prompt arrests to extended monitoring. The ultimate intentions and capabilities of suspects (not to mention their contacts) therefore go undiscovered.
Some of those charged with aiding ISIS or plotting in its name have been radicalized online, thanks to the multilingual, multiplatform onslaught by the group, and the effort it puts in to recruiting sympathizers. On Twitter, Facebook and other social media, these individuals are encouraged or prodded toward joining the cause with their own act of jihad.
Terror groups do not order or direct 'do-it-yourself' acts, nor even have advance knowledge of them. Rather, their supporters keep up a constant drumbeat of incitement via social media.
Elton Simpson and Nadir Soofi were two examples of this phenomenon. They launched an abortive gun attack on an exhibition of cartoons of the Prophet Mohammed in Garland, Texas, this year. Both were killed by police.
Simpson's Twitter feed included associations with known ISIS supporters.
"He followed more than 400 users, ranging from pro-IS supporters to hardcore IS fighters from around the world," wrote Rita Katz, director of the SITE Intelligence Group. Simpson was serious in his commitment: In just three weeks he changed his handle and username at least three times.
U.S. officials believe that Usaamah Rahim -- who this past summer was shot dead in Boston as he planned to attack police with a military-style knife --may also have had contacts with individuals associated with ISIS. They found no specific direction from the group, but a well-known ISIS propagandist -- Junaid Hussein -- claimed on Twitter that he had urged Rahim to carry a knife in case anyone attempted to arrest him. There is no way to confirm that contact.
Another example is Amedy Coulibaly, who carried out an attack on a Jewish store in Paris in January. In a video filmed days before the attack, Coulibaly pledged allegiance to al-Baghdadi -- but he had no known contact with ISIS.
Such individuals are bent on violence -- acquiring weapons and planning an attack in ISIS' name -- even if ISIS entities thousands of miles away are unaware of, much less directing their plans. So it was with the attack on a clinic in San Bernardino.
Syed Rizwan Farook and his wife Tashfeen Malik had made multiple attempts to reach out to militant groups overseas, but eventually pledged allegiance to ISIS before carrying out their attack.
Challenge of tracking lone wolves
There are others whose plans seem more vague and aspirational. Nader Saadeh, 20, was arrested in New Jersey in August and charged with seeking to provide material support for terrorism. In 2013, he allegedly discussed with a friend building a "small army... it will probably be like 2-4 yrs from now, we will be in the prime of our lives." He had also discussed going to Syria. Saadeh pleaded guilty to conspiring with others to provide material support to ISIS.
Also in August, a newlywed couple from Mississippi were arrested as they planned to travel to Syria. They had discussed their travel plans with undercover federal agents -- mistaking them for ISIS recruiters, according to the criminal complaint.
In July, two men were arrested in Italy after posting online messages that appeared to threaten attacks on targets in Milan. But the prosecutor said they had not yet moved "into an active phase."
Monitoring and ultimately prosecuting such individuals requires considerable resources. But whether they should be described as ISIS-inspired, apparently having no contact with the group and only vaguely aware of its ideology, is debatable. Some might be described as gullible fantasists. Others may indeed be on the verge of committing an attack such as that in San Bernardino.
The map of ISIS
The map of ISIS' global reach can be read in many ways. There is no doubting its lure to a fringe of extremist Muslims and Muslim converts, but there is also the risk of overstating its current capabilities.
The group is not beyond opportunism in taking credit for attacks in which it may have had no role.
Within its heartland, it has shown itself capable of a sophisticated mix of conventional military action and classic terror tactics such as suicide bombings. It has demonstrated remarkable expertise with explosives and can offer training in everything from encryption to weapons handling. It has money and even the ability to forge highly convincing Syrian passports.
Perhaps the greatest anxiety is that as ISIS comes under greater pressure in its heartland, it will export terror attacks with greater frequency and intensity -- seeking to open new fronts in Europe and North America, stepping up its encouragement of "lone wolf" attacks, and trying to provoke a backlash against Muslims.