October 5, 2018

IntelBrief: The High Operational Tempo of European Counterterrorism Operations

Police officers walk outside an apartment building cordoned off, in Brondby Strand, Copenhagen, Denmark (Jens Dresling/Ritzau Foto via AP).
  • On September 26, Danish police arrested two men on charges of trying to send money and drones to the Islamic State in Syria.
  • On September 27, police in the Netherlands arrested seven men in the central Dutch city of Arnhem and accused them of planning a mass-casualty terrorist attack involving guns and explosives.
  • The terror threat level across Europe remains elevated and law enforcement agencies are working at a high operational tempo.
  • The half-life of terrorism and its progeny, generated and inspired by the Islamic State and al-Qaeda, might be most accurately measured in generations, not years.


The September 27, 2018 arrest of seven men in the Netherlands accused of planning what would have been a mass-casualty attack is a significant accomplishment for the Dutch law enforcement and intelligence agencies. Authorities became aware of the plot in April 2018, and then spent five months determining the operational details and the identities of the assailants. As is common in terrorism cases, some of the suspects were well-known to authorities; in most crime, not just terrorism, ‘the usual suspects’ are the usual suspects for a reason. The alleged leader of the Dutch cell is a 34-year old Iraqi native, a ‘frustrated foreign fighter,’ who was arrested and prevented from travelling to Iraq and Syria in 2017 to join the so-called Islamic State.

Of note, none of the seven aspiring terrorists had fought in Syria or Iraq. This cell was not made up of any of the estimated 5000 people from Europe who have made their way back from the battlefield. Those returning foreign fighters who are intent on continuing the fight back home in their respective countries of origin, or third-party nations, pose an enormous and well-publicized security risk, even as the threat from localized cells intensifies. The Dutch cell featured several individuals who tried to become foreign fighters but were detected before they could travel abroad. This may have helped investigators learn of the plot in the first place, since some of those seven were likely under some form of surveillance. Without monitoring part of the cell, it would have been exceedingly difficult to detect such a plot by a tight-knit group. These relatively small cells are often bound by kinship ties or close friendships, making the conspiracies surreptitious and the groups difficult to penetrate with informants, as any newcomers would be greeted with suspicion.

In Denmark, authorities arrested two men on September 26, in a case unrelated specifically to the Dutch plot, but connected by the persistence of the Islamic State’s call to terror. Among several counts, the two men were charged with attempting to send money, as well as commercially available drones, to individuals with the Islamic State in Syria. Like the seven members of the Dutch cell, neither of the two men in Denmark were returning foreign fighters. This dual-track threat of returning foreign fighters and home-grown radicalized local cells is the greatest counterterrorism challenge facing Europe (and elsewhere in the West, given the reach of the Islamic State and al-Qaeda’s ideology).

The arrests in the Netherlands and Denmark clearly show that the operational tempo of European intelligence and law enforcement agencies has not slowed down. If anything, that tempo has increased as agencies desperately try to stay ahead of the protean threat. Countries like France are dealing with terror watch lists with tens of thousands of names on them, all of which need to be properly vetted, assessed and categorized in terms of threat level and the resources needed to address those threats. Following the Paris attacks these agencies have moved, belatedly perhaps, from a detect-and-monitor strategy to a detect-and-disrupt approach that involves a consistent ‘raid early, raid often’ mission. The Dutch arrests are remarkable for the length of time from detection of a possible plot to the arrests, since there is always a risk of monitoring, losing partial visibility, and then having an attack happen by a cell that was under surveillance, followed by the inevitable hand-wringing and accusations of an intelligence failure.


For tailored research and analysis, please contact:


[video width="960" height="540" mp4="" poster=""][/video]