By Fred Burton
Canadian authorities recently arrested 17 men, accusing them of planning terrorist attacks, after some members of the group bought what they believed to be some 3 tons of ammonium nitrate fertilizer, which can be used to make explosives. The men allegedly were planning attacks against symbolic targets in Toronto and Ottawa in a plot that reportedly included bombings, armed assaults and beheadings. One of the things that make this case interesting is that the group — now dubbed by the media as the "Canada 17" — reportedly had connections to alleged jihadists in other countries, whose earlier arrests were widely reported. Those connections included two men from the United States — Ehsanul Islam Sadequee and Syed Haris Ahmed — who reportedly traveled from Georgia in March 2005 to meet with Islamist extremists in Toronto. Authorities have said they conspired to attend a militant training camp in Pakistan and discussed potential terrorist targets in the United States. There also is said to be a connection to a prominent computer hacker in Britain, who was arrested in October and charged with conspiring to commit murder and cause an explosion. The June 2 arrests certainly underscore the possibility that Canada
, which has a long history of liberal immigration and asylum policies, has been used by jihadists as a sanctuary for raising funds and planning attacks. But the most intriguing aspect of the Canada case is that it seems to encapsulate a trend that has been slowly evolving for some time. If the allegations in the Canada 17 case are at least mostly true, it might represent the emergence of a new operational model for jihadists — an "al Qaeda 4.0," if you will. In other words, the world might be witnessing the emergence of a grassroots jihadist network that both exists in and has the ability to strike in multiple countries — without support or oversight from the central al Qaeda leadership. A History of Operational Models
To understand what we mean by "al Qaeda 4.0," let's review the history of operational models that al Qaeda has used over the years. The first identifiable operational model — the 1.0 — was that used in the early 1990s. This model revolved around Osama bin Laden, the "Afghan Arabs" or veterans of the Soviet resistance in Afghanistan, and formal militant training camps. In this iteration, operational commanders
trained at camps in Afghanistan — most notably Khalden — received funding and logistical support from bin Laden and others, and conducted operations in various parts of the world. We do note that this is a rather controversial starting point for our history. It can be credibly argued (and indeed, we have had such arguments amongst ourselves) that this phase represents a kind of "proto-al Qaeda" — that al Qaeda had not been established as a formal organization in the early 1990s, and as a result, any attacks during that period were not carried out by a centralized organization that was controlled by bin Laden. The contrasting point of view is that al Qaeda actually did exist at that time, but because bin Laden was living as a guest in Sudan (and then, later, in Afghanistan), he did not claim responsibility for the attacks or plots that were carried out at that stage, so as not to bring political pressure (or military retaliation) against his host governments. Be that as it may, the model (which for purposes of this analysis will be called "1.0") was evident in many jihadist operations of the early 1990s: A succession of individuals who went forth from bin Laden-run training camps to plan and conduct attacks elsewhere. These men frequently connected with veterans of the Afghan jihad — or with others who had passed through the training camps in Afghanistan — once they arrived in the target country, and thus, operational cells were born. One prime example of this 1.0 model can be seen in the plots of Abdel Basit and Ahmed Ajaj, who left the Khalden training camp and flew to New York in September 1992. Ajaj was arrested for a passport violation, but Basit entered the country and went on to orchestrate the 1993 World Trade Center bombing. The operational model also applies in the 1992 strikes in Yemen against the U.S. Embassy in Sanaa and U.S. Air Force personnel in Aden, and in plots that did not come to fruition — for example, Operation Bojinka and Abdel Basit's plots to kill Pope John Paul II and U.S. President Bill Clinton. A slight variation on this model emerged in the later 1990s: Operational commanders with more obvious links to al Qaeda and bin Laden were dispatched to Yemen, Canada, Kenya and other countries to establish cells and carry out attacks. This 1.1 model could be seen in the 1998 bombings of U.S. embassies in Kenya and Tanzania, the disrupted "millennium bomb plot" and the attack on the USS Cole in 2000. At this stage, bin Laden was still denying involvement in such attacks. The 2.0 operational model is the easiest to recognize, but thus far appears to have been used only on 9/11: An al Qaeda "all-star team" was selected, trained and dispatched by the central leadership to the target country to carry out an attack. Bin Laden's stance on claims of responsibility shifted following that event. For months, he continued to deny al Qaeda's involvement, but over time came to acknowledge it and — quite recently — stated outright that he personally oversaw
all the details. The handpicked operatives used for 9/11 or any other attack under this model would be, by definition, better trained than the ad hoc operatives behind the version 1.0 and 1.1 attacks — and roughly equal in stature to the 1.0 commanders. For the most part, the all-star teams appear to have practiced better operational security than their forebears as well — though, not being supermen, they did make some tradecraft mistakes
. This model provides both tactical advantages and disadvantages for the host organization. On the upside, it allows for excellent command and control of the operation. On the downside, it is a resource-intensive model; numerous operatives are required, as is a facility for training, and a command structure capable of staying in communication with the agents in the field and providing them with logistical support. Given the clues uncovered after 9/11 and the efforts of the United States and other countries to disrupt such infrastructure, it is currently very difficult for al Qaeda to employ this model. This, in turn, led to a devolution
of sorts for the organization and the adoption of a third operational model. The 3.0 model — which applies to most of the attacks attributed to al Qaeda since 9/11 — involves "grassroots jihadists." By this, we mean cells with a local leadership carrying out attacks in a country with which they have a long association — rather than commanders or groups of operatives who are deployed by the central al Qaeda command for purposes of conducting a strike in a foreign country. In some cases, it appears that members or leaders of these cells have been trained at terrorist camps or fought in a jihad somewhere, but they are for the most part citizens who have been inspired by al Qaeda, and the cells have done their recruiting locally. Moreover, they choose targets and conduct operations only in the countries where they live. Examples of this model might be found with al Qaeda in the Arabian Peninsula
and Egypt's Tawhid wa al-Jihad, the group that has claimed recent attacks against tourist targets in the Sinai Peninsula
. It appears al Qaeda 3.0 operatives lack the skill and operational savvy of their 2.0 counterparts; they have a tendency to make operational errors
that lead to thwarted plots and arrests. It is possible, but not a prerequisite, within the 3.0 model that operatives have contact with the central organization. Mohammed Siddique Khan
, believed to have been the leader of the cell that carried out multiple bombings in London in July 2005, apparently had some contact with al Qaeda in Pakistan. Nevertheless, this organizational structure differs significantly from the 1.0 and 2.0 models in that the operational commander and/or attack team is not dispatched by the al Qaeda leadership to another country for purposes of an operation. Interestingly enough, al Qaeda has claimed many, if not most, of the attacks that fall under the 3.0 model — even though the leadership was, by definition, far less involved in the planning and execution of such operations than of others that it denied. Al Qaeda 4.0?
It is within this context that the unfolding case in Canada is most significant. As details emerge, it is becoming apparent that those arrested would — if the allegations are true — represent a grassroots cell. Authorities say they have found no evidence linking the suspects to the central al Qaeda leadership. However, it also would seem that the men went beyond the 3.0 model of thinking and acting locally. Given the links to suspects in the United States (Sadequee and Ahmed) and to operatives in Britain, there is reason to believe that they might have been part of an international network of local cells — or grassroots groups that "think globally and act locally," to borrow a phrase. The implication here is one of expanded capabilities. A 3.0 operation would be, for all intents and purposes, fairly isolated: jihadists striking at local targets within their reach, with existing means. A 4.0 operation could entail more sophisticated levels of coordination — and the possibility of simultaneous strikes against geographically diverse targets (for instance, London, Toronto and New York). Previously, such a feat could only have been accomplished by the core al Qaeda organization. For a grassroots network to accomplish that feat, without direct involvement from the central leadership, would represent a generational leap forward in jihadist operations. The Internet seems to be an important factor that is fostering the emergence of such a loose, but cohesive, structure. Of course, personal relationships are still important. In the case in question, Sadequee — who lived in Canada before moving to the United States — is the pivotal figure. He and Ahmed — who are charged with having videotaped potential targets in the Washington, D.C., area — are said to have met during 2005 with men he knew from his time in Canada, and three of those men were among the 17 rounded up last week. But the Internet is a great facilitator of communications as well. Since 9/11, chatrooms and Web sites have experienced a surge in popularity among jihadists. They provide a great forum for like-minded people to connect. Indeed, technology is not necessarily verboten for the current generation of jihadists, Islamist principles notwithstanding; another of the suspects connected to the Canada case is a computer hacker and "cyberwarrior" from Britain, Younis Tsouli, who goes by the handle "Irhabi007." Significantly, the Internet can be an Achilles' heel for jihadist networks. It gives authorities a way of identifying people who may have become radicalized and a means to monitor their behavior — both virtual and physical — and communications. Authorities also can establish and nurture relationships with suspected militants online, much as they frequently impersonate children on the Internet in efforts to catch pedophiles. Law enforcement and intelligence agencies also might find it possible to infiltrate militant cells or recruit sources within certain communities in order to disrupt attack plans. This option is particularly viable when a cell is extremely large, like the 17-man group in Canada. That said, it also can be difficult to identify and target cells effectively, particularly when authorities are dealing with a large universe of potential suspects. Case Study Notes
As a tactical case study, the events in Canada offer up several other operational lessons. One intriguing point is that, according to the allegations, the cell continued to move ahead with plans for attacks, even after contacts in other countries had been arrested. Tsouli and some of his associates were taken into custody in October 2005; the arrests of Ahmed (in the United States) and Sadequee (in Bangladesh) followed in March and April of this year. Moreover, the indictments in the U.S. case, which were widely reported in the U.S. and Canadian press, noted that Ahmed and Sadequee had traveled to Canada in March 2005 to meet with suspects who were being actively investigated at that time. Now, conventional wisdom would dictate that any cells in operational mode would go underground when their associates started getting rounded up, and attempt to keep their noses clean until after the heat was off. But the allegations in the Canada case would indicate that conventional wisdom held no sway: The cell members kept plugging right along with their plans regardless. From a law-enforcement and intelligence standpoint, this underscores the need for continued vigilance after a plot seemingly has been thwarted; Letting down one's guard and assuming the danger has passed is not an option, since other plots in the pipeline might not necessarily have been shelved. This, however, is not an entirely new lesson. Similar cycles were evident in 1993 — a group of conspirators who had been tied to the World Trade Center bombing cell attempted to attack other targets in New York City a few months afterward — and in 2005, with the botched public transit bombings only two weeks after the July 7 attacks. Separately, one must note that most of the suspects in the Canada 17 case were very young — too young to have fought jihad in places like Afghanistan or Bosnia, as had many of the Version 1.0 operatives. Thus, the emerging 4.0 structure, with its affinity for the Internet, might be a natural result of "Generation Y" jihadists seeking to create an infrastructure. As a follow-on to that, many of the Canadian suspects reportedly became radicalized in a short time, following 9/11. This radicalization process also has been observed with grassroots operatives in London and elsewhere in the recent past. We are reminded here that al Qaeda, like the violent anarchists of the 19th century, aptly might refer to its attacks as "propaganda of the deed." Among its primary objectives in carrying out the 9/11 attacks was sending a message of empowerment to the Muslim people and sparking a general uprising that would culminate in the rebirth of the Caliphate. While the envisioned uprising did not materialize, it has become increasingly obvious that al Qaeda's message of empowerment and the call to jihad has resonated strongly with some people. Another objective of 9/11 was to spark an American retaliation — a goal in which al Qaeda obviously succeeded. The U.S. invasions of Afghanistan and Iraq have been viewed by many in the Muslim world as aggression against Islam, and for grassroots militants (especially those of Generation Y) this is reason enough to act. The passions of these young jihadists have been further enflamed by their views of the Israeli/Palestinian dynamic and events in other parts of the Muslim world. They feel a driving need to do something about perceived aggression against fellow Muslims, even if they do not care about the goal of re-establishing the Caliphate. This is a different genre of rational actors. They realize that their attacks are not likely to contribute to the revival of Muslim political power; they act instead out of anger and vengeance. Thus far, operational security (OPSEC) has been the bane of the grassroots jihadists. Many suspected cells, including the one in Canada, have been disrupted as a result of poor OPSEC. However, due to the sheer numbers of fish in the pond, and the many ways of blending in or escaping notice, it is hard for authorities to identify and monitor all of these individuals, even when they make mistakes. Some inevitably will slip through the cracks. It also must be remembered that, controversial ideologies aside, many of these people are highly intelligent and well educated. Some are bound to study and learn from the mistakes made by their predecessors — and evolve into smarter fish. At the very least, the evolutionary cycle — catching up ever-younger generations of jihadists — is yet another solid indication that jihadism will linger even if the leadership of the al Qaeda organization should be located and destroyed. Ideology is much harder to kill than individuals, and this particular ideology now appears to have taken root among Muslim populations stretching from London, Ontario, to London, England, to Lahore. The emergence of Generation Y militants indicates that the problem is not likely to disappear completely in the future. Finally, the ability of grassroots cells to network across international boundaries, and even across oceans, presents the possibility that al Qaeda 4.0 cells could, now or in the future, pose a significant threat even without a central leadership structure — meaning, a structure that can be identified, monitored and attacked. If these grassroots organizations begin to improve their OPSEC practices, the risk they represent will increase. This very well could become the dominant operational model for the foreseeable future.