Abstract: In May 2019, Syrian refugee Moyed el-Zoebi was sentenced to 12 years in prison and (to be followed by) deportation from Denmark. El-Zoebi, who had previously fought alongside jihadis in Syria, was found guilty of planning a terrorist attack in Copenhagen while living in Sweden and in cooperation with another Syrian refugee living in southern Germany. The two were directed by an Islamic State ‘virtual planner’ based in Syria. Their plan, which eventually failed, was to construct several bombs using a large number of matches and strike a political target. An examination of the so-called ‘matchstick plot’ provides important insights into contemporary Western terrorism, its international character, and the methods of coordination.
In 2015, Moyed el-Zoebi, a Syrian national then in his 20s (and now 32), came to Sweden seeking asylum together with his wife and their one-year-old son. Having been acquitted for an attack he was alleged to have carried out on a Shi`a community center in Malmö on October 11, 2016, claimed by the Islamic State,1 el-Zoebi proceeded to plot a terrorist attack on a political target in Copenhagen in cooperation with another Syrian refugee living in southern Germany. The first part of the article looks at el-Zoebi’s trajectory. The valuable insights this provides into the terrorist threat Western countries now face is discussed in the article’s second part. Almost all information about el-Zoebi and the plot comes from court documents from el-Zoebi’s trial in Denmark, which includes testimonies from his accomplice’s court case in Germany.2 Unless otherwise noted, the information provided here comes from these documents.
Moyed el-Zoebi’s time in Sweden started with tragedy. Having arrived on September 14, 2015, less than two months later on November 10, his infant son died in a car accident. Less than a year later, el-Zoebi’s wife left him, thus cementing his personal tragedy. It was around the same time (October 2016) that he was alleged to have carried out an attack against a Shi`a community center in the Rosengården neighborhood in Malmö with Molotov cocktails. Although the attack was during the Ashura, a day of great religious significance for Shi`a, there were no casualties since it took place in the early morning hours. The building suffered extensive damage from a resulting fire, however. Due to a lack of technical evidence—a private video recording from a camera installed by a company on a building across the street capturing the actual attack was deleted before the police managed to seize it—el-Zoebi was acquitted, and he even received compensation (approximately $10,200) for his time spent in custody.3
El-Zoebi’s personal history is interesting. Born in Riyadh, he would move back and forth several times between Saudi Arabia and Syria, making him a national of both countries. Having completed two years of university studies in business and economy in Syria, he returned to Saudi Arabia to work as a make-up artist. But when the conflict broke out in Syria in 2011, he would help found the Free Syrian Army’s media office, although he remained in Saudi Arabia until the end of 2013 when he finally relocated to Syria. Most likely in 2014, he left the Free Syrian Army and joined al-Qa`ida’s Syrian affiliate Jabhat al-Nusra, participating on the frontlines near Aleppo, according to a video el-Zoebi posted to his Facebook profile on November 18, 2016, the day before traveling to Copenhagen in furtherance of the plot and which was presented at trial. When exactly he began to show sympathy for the Islamic State is not known, but when he arrived in Sweden in September 2015, residents at the Swedish asylum center testified that he regularly spoke positively about the group. It is not clear how he got to Sweden from Syria. Authorities were not aware of any of his past jihadi activity or jihadi sympathies before his Danish trial.
The Plot
Moyed el-Zoebi’s plan was to execute a terrorist attack in Copenhagen in December 2016 in cooperation with the 21-year-old Dieab Khadigah. The two Syrian refugees residing in Sweden and Germany, respectively, had never met but were connected through an Islamic State external operations planner in Syria that this author will refer to as the virtual planner.4 It is not clear how the two established contact with the virtual planner, and there was no information provided in court on the virtual planner’s identity. El-Zoebi and Khadigah were supposed to meet at Copenhagen’s main train station on November 19, 2016. El-Zoebi took the train from southern Sweden while Khadigah arrived by train and then ferry from the German city of Puttgarden.
Khadigah had been tasked by the virtual planner with acquiring the materials needed to construct explosives: several thousand matches, as well as batteries, fireworks, and walkie-talkies. To avoid suspicion, he followed the instructions of the virtual planner who told him to buy the materials in different places: one half in the German supermarket chain Kaufland in Laupheim, the other in Warthausen between November 16 and 19, 2016.
The first known time that al-Zoebi and Khadigah were in contact was on November 17, two days before they were supposed to meet in Copenhagen. Up until that point, the virtual planner had been in charge of communicating with each of them and giving instructions through the encrypted platforms WhatsApp and Telegram. After receiving el-Zoebi’s telephone number from the virtual planner, Khadigah sent a text message to al-Zoebi who immediately told him to acquire two large knives. The following day before his departure to Denmark, Khadigah bought two knives with 18-centimeter blades.
The plan was for the two Syrians to meet in Copenhagen and then to construct five bombs. According to the court documents, instructions for the bombs came from Inspire, an English-language online magazine published by al-Qa`ida in the Arabian Peninsula between 2010 and 2017. As part of the Danish trial, explosive experts constructed a model of the bomb that el-Zoebi and Khadigah planned to construct and concluded that it would be lethal to people within a range of 50 meters.5 A manual on how to construct these devices was found on el-Zoebi’s computer.
The exact target of the plot has never been revealed, but according to Khadigah, it was decided by the virtual planner and el-Zoebi. All that was revealed at the trial is that it was supposed to be a political target. Browsing history from al-Zoebi’s computer showed that he had done research on embassies in Copenhagen. Videos of Danish tourism attractions were also found. Once the bombs had been constructed, the plan was to use the knives to attack as many random people as possible before setting off the explosives.
Luckily, the two never got that far as things did not go according to plan. While el-Zoebi was at Copenhagen’s main train station on the afternoon of November 19, 2016, waiting to meet his accomplice, Khadigah found himself on a ferry on his way back to Germany. Having reached Denmark, he had been denied entry because he had no passport. With Denmark being part of Schengen,a Khadigah thought he could enter simply using his ID card, not knowing that passport control had been reinstated. Danish police checked his backpack and noticed the unusual materials—several thousand matches, knives, fireworks, and walkie-talkies—he was carrying. Allowing him to keep his backpack, they put him on a ferry back to Germany where he was arrested by the German police the following day. It is likely that Danish police contacted their German colleagues about Khadigah, but this has not been confirmed. On July 12, 2017, Khadigah was sentenced in Germany to six and a half years in prison for plotting a terrorist attack in Copenhagen with el-Zoebi.6
After waiting in vain for some hours on November 19, 2016, al-Zoebi returned by train to Sweden, resetting his phone to factory settings on the way and then changing its SIM card a few days later. Two weeks later, he was arrested in Sweden and charged with the attack on the Shi`a community center, for which he was later acquitted. At this point, authorities had no knowledge of his failed terror plans in Copenhagen. El-Zoebi was eventually arrested on November 7, 2017, on his way to board a plane from Copenhagen airport to Athens with a layover in Istanbul—possibly with Syria his true destination—because he used a fake passport. He was originally sentenced to 40 days in prison for forgery, but after only six days, he was charged with terrorism.b
Connection to the Islamic State
During el-Zoebi’s trial, the main challenge faced by prosecutors was to connect the plot to the Islamic State. El-Zoebi himself rejected the notion that he had any sympathy for the group, insisting that he had been part of the Free Syrian Army and that after migrating to Sweden, he had entirely abandoned militancy. On his confiscated computer and telephone, however, the police found large amounts of Islamic State propaganda including approximately 400 videos and more than 5,000 pictures. While possession of Islamic State material does not necessarily qualify as sympathy with the group or its ideology—a common mistaken inference in court cases and public opinion—in el-Zoebi’s case it did appear to be the case. He even had the flag so heavily associated with, albeit not exclusive to, the Islamic State as a background image on his computer.
Also, in a chat with a close family member on October 8, 2016, el-Zoebi declared that he wanted to “die as a Shaheed [martyr].”7 In another chat with his mother just a month before his planned meeting with Khadigah, el-Zoebi wrote that he would “kill the whole world until God is worshipped 100 percent.”8 It is also noteworthy that el-Zoebi’s first alleged act of militancy in the West, the Molotov cocktail attack against the Shi`a community center in Malmö, was claimed by the Islamic State in its Al Naba newspaper issued on October 20, 2016. A Germany-based Syrian man working for the group’s Amaq news agency was in contact with el-Zoebi in October after the attack through WhatsApp to confirm his sympathy for the Islamic State.9 The Amaq official told el-Zoebi to send him a voice message documenting the attack in detail as proof. El-Zoebi told him he would soon send him something, but there was no information presented at trial indicating whether he actually did. What is known is that el-Zoebi took a picture of the fire and sent it to one of his friends in Sweden who administered the Facebook page of a salafi mosque in the Swedish town of Hässleholm, which regularly posted militant propaganda material.10
The problem for el-Zoebi was that although he pleaded innocent and refused all accusations that he supported the Islamic State, Khadigah had confessed to everything during his own trial in Germany and as part of the Danish trial against el-Zoebi—including the role of his accomplice. Khadigah admitted to supporting the Islamic State and that the plan was to carry out an attack in Copenhagen with the materials he acquired. He explained the role of the virtual planner, who was in charge of organizing the attack and who instructed el-Zoebi and Khadigah. He also admitted that he initially wanted to join the Islamic State in Syria, but his father prevented his departure, thus highlighting the potential danger of “frustrated travelers.”11
The plot is testimony to one of several methods the Islamic State uses to instigate terrorist attacks outside of its main areas of conflict. While most jihadi terrorist attacks in the West in the period 2014-2019 were inspired rather than guided,12 the matchstick plot is illustrative of how the Islamic State used virtual planners not just to influence potential attackers but to plan and organize the specific attack, including identification of the target and connecting people. El-Zoebi’s case is also an example of how the group appears in certain instances to work to determine the veracity of the linkage between attacks in the West and sympathy for the group. In the West, the Islamic State’s claims of responsibility in the wake of a terrorist attack are typically questioned and considered opportunistic. This is certainly the case with some terrorist attacks like the Las Vegas shooting.13 But in the case of el-Zoebi’s first alleged attack in Malmö, it is noteworthy that the Islamic State managed to establish a link when a media operative reached out to the attacker to verify his motive.14
Transnational Terrorism
The jihadi terrorism threat to the West has evolved considerably over the decades. Initially stemming from militants living outside the targeted country, it would later become dominated by homegrownsc who spent time in jihadi training camps in places such as the Afghanistan-Pakistan border region. More recently, a significant part of the threat has come from numerous people acting without any physical exposure to militancy and training.
Yet, the matchstick plot is unusual because it was planned to be executed by two men not living in the target country, with no prior knowledge of each otherd and directed from Syria by a third (the virtual planner).e Not only does it highlight the challenge for national intelligence agencies and stresses the importance of international collaboration, but it illustrates that the motive of such attacks is not always connected to retribution against a plotter’s home country or country of residence. A further takeaway is how little say the attackers had in the planning of the attack, which appears to have been largely planned and coordinated from Syria. El-Zoebi’s role was arguably more central than Khadigah’s, but neither of the two refugees appears to have been the mastermind behind the plot.
The plot presented obvious challenges for Western security institutions. Central to its planning and execution were the virtual plannerf and the availability of instructions on how to construct explosives. In recent years, the online circulation of instructions on how to plan terrorist attacks, including recipes on how to construct weapons and explosives, has grown greatly, thus offering would-be terrorists an abundant range of options—from the really simple to more advanced weapons.
Inspire magazine helped shape a decade of terrorist attacks in the West. For instance, its suggestion to use vehicles as a weapon has been followed on several occasions since the rise of the Islamic State’s terrorist campaign in the West. While the simpler methods appear to be the preferred choice for militant Islamists these days15—the November 2019 terrorist stabbing attack in the vicinity of London Bridge being an example—far more complex recipes for terror are in circulation; a December 2019 jihadi terror plot uncovered in Denmark involving the production of TATP, or the intention to produce it, is the most recent example of how jihadi sympathizers attempt to produce relatively more advanced explosives.16 The more complex the method, the harder they typically are to execute, but it nonetheless increases the potential danger posed by jihadi sympathizers in the West with little to no experience from battlefields or training camps.17 CTC
Tore Hamming is a Ph.D. candidate at the European University Institute, studying inter-group dynamics within Sunni jihadism with a special focus on the al-Qa`ida-Islamic State relationship. Follow @Torerhamming
Substantive Notes
[a] Schengen is a union of 26 European states that in 1995 abolished border control and the need for passports when traveling between the countries. A few of these countries, among them Denmark, have reinstated temporary border control as a result of the 2015 migration crisis.
[b] It is not known publicly, but the information about el-Zoebi’s terror plot likely came from the German police investigation into Khadigah.
[c] Homegrowns refer to plotters born or raised in the country of the terror plot or attack.
[d] It is worth noting the example of the French Islamic State virtual planner Rachid Kassim who linked together the two men, Adel Kermiche and Abdelmalik Petitjean, with no prior connection to collaborate in the killing of the priest Jacques Hamel in Saint-Étienne-du-Rouvray. See “Attentat de St Etienne-du-Rouvray : le portrait d’Abdel Malik Petitjean, le complice savoyard d’Adel Kermiche,” FranceInfo, October 22, 2016.
[e] In its Strategic Framework for Countering Terrorism and Targeted Violence, the Department of Homeland Security in September 2019 warned about the role of virtual plotters. See “Strategic Framework for Countering Terrorism and Targeted Violence,” Department of Homeland Security, September 2019.
[f] The military campaign against the Islamic State in Syria and Iraq has targeted the group’s external operations structure. It should therefore be expected that many virtual planners have been killed in recent years, which likely reduces the group’s ability to orchestrate attacks outside its main theaters of operation.
Citations
[1] Emma Löfgren, “Malmö ‘Isis member’ accused of terrorism for fire at Islamic centre,” Local, March 27, 2017.
[2] “Court’s record: adv. DP 0100-70242-00002-17,” Copenhagen city court, May 2019.
[4] For more on the role of Islamic State ‘virtual planners,’ see Daveed Gartenstein-Ross and Madeleine Blackman, “ISIL’s Virtual Planners: A Critical Terrorist Innovation,” War on the Rocks, January 4, 2017; Alexander Meleagrou-Hitchens and Seamus Hughes, “The Threat to the United States from the Islamic State’s Virtual Entrepreneurs,” CTC Sentinel 10:3 (2017).
[5] “Københavns Byret har afsagt skyldkendelse i ‘Tændstik-sagen,’” domstol.dk, April 11, 2019.
[6] “Denmark: Syrian Man Gets Jail for Terror Planning,” Voice of America, May 20, 2019.
[7] “Fængslet for terror i København gemte farlig manual,” TV2, December 23, 2017.
[9] Rukmini Callimachi, “Syrian Accused of Working for ISIS News Agency Is Arrested in Germany,” New York Times, June 8, 2017; Abrahamsen.
[10] Abrahamsen.
[13] Graeme Woods, “Why Did the Islamic State Claim the Las Vegas Shooting?” Atlantic, October 2, 2017.
[14] Callimachi; Abrahamsen.
[16] “Kvinde og to mænd sigtes for bombeplaner med TATP,” Jyllands-Posten, December 12, 2019.
[17] The existence and circulation of devastating explosive recipes within militant Islamist circles is well-described in the book Aimen Dean, Paul Cruickshank, and Tim Lister, Nine Lives: My Time as MI6’s Top Spy inside al-Qaeda (London: Oneworld Publications, 2018). See also Hillary A. Sarat-St. Peter, “‘Make a Bomb in the Kitchen of Your Mom’: Jihadist Tactical Technical Communication and the Everyday Practice of Cooking,” Technical Communication Quarterly 26:1 (2017): pp. 76-91; Maura Conway, Jodie Parker, and Sean Looney, “Online jihadi instructional content: the role of magazines,” in Maura Conway, Lee Jarvis, Orla Lehane, Stuart Macdonald, and Lella Nouri eds. Terrorists’ Use of the Internet: Assessment and Response, NATO Science for Peace and Security – E: Human and Societal Dynamics 136 (Amsterdam: IOS Press, 2017), pp. 182-193; Bennett Clifford, “‘Trucks, Knives, Bombs, Whatever:’ Exploring Pro-Islamic State Instructional Material on Telegram,” CTC Sentinel 11:5 (2018).
