The South African public is presently confronted with the question of whether the Islamic State has evolved to begin executing attacks here. This course for concern emanates from:

• The case of the Thulsie twins — 23-year-old Brandon-Lee and Tony-Lee, who were arrested at their homes in Johannesburg on 9 July, 2016, and who stand accused of planning attacks on Jewish and American interests:
• The murder of Rodney and Rachel Saunders. Sayfydeen Del Vecchio (38) and Fatima Patel (27) were arrested on 16 February 2018 and face charges of kidnapping, murder, and robbery. A fourth suspect in the case, Ahmed Jackson Mussa (36), known as “Bazooka”, was arrested on 22 March 2018. Evidence before the court indicates discussions between Del Vecchio‚ Patel and Mussa of “preparing to kill the kuffar (non-believer);
• A recent spate of bomb scares in Durban (KwaZulu Natal); and
• Attacks at mosques (beginning with the Verulam attack on 10 May 2018).

But to answer this question, one requires an in-depth understanding of how the Islamic State operates after the collapse of the Caliphate in Iraq/Syria.

Islamic State attacks have proven to reflect an intricate system of associations, recruitment and networking. This does not happen in a standardised manner: Networking involves a complex mix of places, ranging from mosques and prisons to entire neighbourhoods in the suburbs of capital cities such as Paris and Brussels; of connections, be it family (siblings often – though not always – help radicalise one another), friends, mentors, and in certain cases, of connections with previously established jihadist networks which can then be used by larger terrorist groups as a kernel of recruitment.

A hallmark of the Islamic State is that it is a hybrid organisation comprised of a leadership and a lean core management structure, but which has developed a global network that is distinct in its nature and extent of presence. Its supporters refer to themselves as “soldiers of the Caliphate” and can be individuals, small cells and groups of associations.

More than this is its ability to use social media engagement to create a sense of belonging and membership that provides an ideal platform for final motivation for the execution of attacks or actions in support of the group, such as fund-raising and propaganda.

Islamic State recruiters are adept at staking out online forums, message boards and social media to identify prospective supporters. They are typically young men who feel alienated, disenfranchised and dissatisfied, or are looking for excitement and the kinship of a group with shared views.

From a security perspective, the internet is the ideal place to initiate and encourage action as real identities are elusive and communications hard to monitor and record.

The Islamic State inspires attacks with little leverage and even less control using a cyber jihad in which social media propaganda engagements serve the group’s purpose to reinforce its leadership position within the militant jihadist world.

David Patrikarakos’s book War In 140 Characters: How Social Media is Reshaping Conflict in the Twenty-first Century clarifies the cyber jihad brilliantly in stating that social media has “… given birth to a new type of hyper-empowered individual, networked, globally connected, and more potent than ever before… Homo digitalis”.

This is clearly evident in the most recent audio release by Abu Bakr al-Baghdadi (yes, the Caliphate is alive despite devastating setbacks in its backyard).

On 22 August 2018, al Furqan Foundation, the official Islamic State media outlet, released an audio message from al-Baghdadi entitled “Give Glad Tidings to the Patient”. This is the first message from the Islamic State’s leader since September 2017, and coincided with the celebrations of Eid Al Adha.

In the speech, supporters in the West are again urged to carry out lone wolf attacks in Western countries, including bombings, vehicle-ramming as well as gun and knife attacks in the West.

Similar calls have been made before in videos posted on online channels and glossy English-language magazines such as Dabiq and Rumiyah that are distributed in electronic formats. These publications blend concepts of theology, heroism, justice and fear to impress and convince potential supporters who may be looking for meaning and belonging to join the Islamic State’s worldwide struggle and act against the “enemy”.

Their strategy has advanced from attacks “directed” by a command structure, and those “enabled” through online communications that may include elements of training and planning, to attacks “inspired” by their propaganda. Thereby the group’s leadership and core membership are not proximally involved and can cover a greater area than otherwise possible.

The social environment, insofar as it creates a public atmosphere that encourages violence and creates a community of like-minded individuals that share a dislike of the West, do not demand direct physical contact, including traditional military command and control directives.

In a previous article I concluded that the Islamic State’s future will have at its core a propaganda campaign reliant on an imaginary world shared on social media, a conclusion that has proven itself to be correct.

This type of community is similar to a sect: If one wants to integrate, one has to adopt the same views and shared beliefs; if those views and beliefs revolve predominantly around extremist ideals, the individual is so to speak “peer-pressured” via social media platforms such as Telegram.

Scholars agree that marginalisation increases the likelihood of radicalisation towards terrorism, and can reinforce an individual’s relationship with a radical social environment.

The training camp is not one of physical training and shooting ranges, but social media propaganda, which includes self-indulged justifications, guidance on how to execute attacks and even advice on how to outwit law enforcement.

The Islamic State media operations are by far the most successful of all the Islamic State’s projects, including the takeover of vast swathes of land and the amassing of great wealth. Its media, from video to print, is so entrenched in modern-day society that it will take decades to eradicate the damage it has caused, if that is even possible.

Long after the fall of the Caliphate in ash Sham, the media department still operates and creates new material. It is this project that has led to three type of attackers:

• Groomed attacker: Known direct links with extremist groups either past or present. The group either trains, finances or plans the attack (or a combination of all three). Thus interaction with fighters and leaders “grooms” the assailant for the attack.
• Inspired attacker: This type of attacker has been exposed to extremist propaganda material as well as instructional advice and manuals. Though the assailant acts alone, if it were not for the exposure to the material the attack could not have taken place. Sometimes the inspired attacker will have a virtual “handler” that guides his actions. As such the inspired attacker can either be known by his umbrella group affiliation or unknown to his affiliated group.
• The copy-cat attacker: Exposure to extremist propaganda seems of little relevance to the actual act of terror except for the method being used. Often it is the overwhelming media coverage that inspires the copy-cat assailant, who longs for the fame and glory of the attack he is copying. Usually the copy-cat attacker is not previously known to law enforcement.

All three types have only one commonality: exposure to Islamic State propaganda available on various social media network channels. However, exposure is simply not enough to argue for Islamic State loyalty or acting in the name of the terror group, based on a conviction to its extreme ideology.

Training and propaganda material and Islamic State paraphernalia, such as flags and weapons, cannot be viewed as evidence of either a groomed or inspired attacker. At best the presence of Islamic State material is merely suggestive of an interest in extremist ideology, without exposing the depth of loyalty to the group.

The groomed and inspired attackers share not only a conviction, but a grievance directed against what is perceived as the enemy of the Islamic State. Hence, a general term used in claims of credit by the Islamic State for groomed or inspired attackers is important: The reference to “coalition state citizens” that made the attacks possible.

Islamic State claims credit for a knife attack at the intersection of Bourke & Swanston streets in Melbourne, Australia on 9 November 2018

Hence, determining the extent and content of engagements between an attacker(s) and Islamic State loyalists is of utmost importance, as this will point towards actual presence of the first two categories as a threat to South Africa. For now, the court case against the “Durban cell” will be at the centre of determining if it can indeed be referred to as an Islamic State cell. Relying on flags and propaganda material will not suffice.

The wannabe: South Africa’s Black Swan?

A black swan is a highly improbable event. There are three characteristics that define a black swan. First, it’s unpredictable. Second, it has a massive impact. And third, after it happens everyone comes up with some explanation for it that makes it seem as if it actually wasn’t random and could have been predicted.

The term was introduced by Nassim Nicholas Taleb in his 2007 book The Black Swan. The centrality of this concept is embedded in the uncertainty about an event occurring.

South Africa lacks a culture of violent terrorism. It is absent in propaganda material by the Islamic State and al-Qaeda as a “legitimate” target of attacks — a lack of grievances directed at developments on home soil that could inspire expanding an organised presence as well as a vulnerability to extremist ideologies of a small group of individuals and families. A terrorist attack will surely be a black swan incident with significant repercussions.

As explained in numerous articles published by Daily Maverick, an undesirable reality is exposure to Islamic State propaganda, individuals attracted to its propaganda messages and those willing to resettle in the Caliphate.

South Africa’s vulnerability to wannabe attacks remains a constant concern. The wannabe seeks instantaneous recognition, credentials and sometimes redemption. The wannabe might have missed out on a life presumed to be glorious and meaningful in the Caliphate or a training camp in Yemen or Somalia, but just because he/she is untrained, do not assume that he/she is not dangerous. Characteristics of the wannabe include:

• This new type of fighter does not need an in-depth, lengthy religious radicalisation process;
• This is a frustrated fighter — one that seeks redemption or executes attacks driven by personal problems;
• A fighter that is caught up in a mixture of personal problems, criminality, grievances and offered a quick solution for redemption;
• A fighter that only needs a computer, in which fake news out of chat rooms provides “facts” and encouragement; and
• A person who will gain recognition as a bona fide fighter simply by executing an attack: A medal of honour is offered via martyrdom.

All indicators point towards the absence of an organised Islamic State threat that is willing to execute attacks on home soil.

A concerning factor is a security sector responding to terrorism at two extreme levels, either under- or over-sensitiveness. The domestic intelligence act is clear in defining the State Security Agency’s mandate in identifying potential threats to national security.

Terrorism cannot be ignored — a terror attack will be nothing more than an intelligence failure. Over-sensitiveness by informing the public on what seems to be insubstantial evidence, and relying on flags and propaganda material, is nothing more than jumping to conclusions and instilling fear.

A middle ground is urgently required to counter stigmatisation and reduce panic. This requires an in-depth understanding of the threat of terrorism, vigorous foreign liaison as well as practised investigators and analysts. Does South Africa have such capacity? The outcome of the Durban case will speak for itself. The Thulsie case disconcertingly points to the absence of such capacities. DM

Jasmine Opperman is director at the Terrorism Research & Analysis Consortium – TRAC. Dr Joan Swart is a senior analyst – Psychology of Terrorism – Africa Desk (South Africa) at the Islamic Theology on Counter Terrorism – (ITCT).