Abstract: Nearly three years ago, Australian counterterrorism investigators arrested two men in Sydney who had plotted, under instructions from Islamic State operatives in Syria, to bomb an international flight and create a chemical weapon. It remains one of the most innovative of the Islamic State’s external operations and the most ambitious jihadi plot that Australia has faced. Newly available information resulting from the successful prosecution of the Sydney-based plotters reveals how the plot developed, shedding light on the evolution of the Islamic State’s external operations. The Syria-based Islamic State operatives possessed several advantages that, combined with their approach to providing logistical support, allowed them to bring the plot close to completion. Fortunately, the plotters failed to overcome the inherent difficulties involved in long-distance terrorist plots and were impeded by years of investment in airport security, international intelligence cooperation, and counterterrorism capabilities.
On July 29, 2017, an Australian counterterrorism operation foiled the most serious Islamic State plot the country has ever faced. Two brothers in Sydney, guided by Islamic State operatives in Syria, had tried to bomb an Etihad plane flying from Sydney to Abu Dhabi carrying 400 passengers. They also tried to build a chemical weapon to disperse lethal gas against members of the public.a
It was not only the ambitions to murder hundreds of people that made the plot so serious, but how close it came to completion. The plot had begun in January 2017 and progressed undetected for over six months before Australian authorities were alerted to it by an international intelligence partner on July 26, 2017. In response, the New South Wales Joint Counter Terrorism Team began an investigation named Operation Silves, leading to the arrests of four suspects three days later. Two of the suspects, Khaled Khayat and Mahmoud Khayat, were charged with conspiracy “to do acts in preparation for a terrorist act” and would later be convicted.1
The plot gained international attention. Terrorist plots remotely guided by instructions from Islamic State operatives in Syria (often referred to as virtual planning or cybercoaching) were not new, but this time, there was a new element.2 The Islamic State had provided direct logistical support by mailing the Khayat brothers a partially constructed bomb, something not seen in earlier plots. Moreover, the Islamic State had rarely targeted aviation in Western countries and was not known to have used chemical weapons outside of Syria and Iraq.b Security agencies across the world took notice of the plot’s innovations.
Khaled Khayat and Mahmoud Khayat’s trials came to an end on December 17, 2019, resulting in the release of detailed new information. This article draws on the newly available information to revisit Operation Silves.3 The article first provides background on the four key plotters, before providing a detailed account of the plot’s development. It then details the plot’s disruption and aftermath, before identifying where the plot sits in relation to the broader jihadi terror threat facing Australia. The article then identifies what the 2017 Sydney plane plot reveals about the evolution of the Islamic State’s external operations in light of information about subsequent plots, by contextualizing three of its distinctive features: the targeting of aviation, the attempted creation of a chemical weapon, and remote guidance combined with the direct provision of logistical support.
Background to the Plot
There were four key plotters behind the planned attack, two based in Sydney and two based in Syria. The Sydney-based plotters were the brothers Khaled Khayat and Mahmoud Khayat, who were born in the northern Lebanese city of Tripoli. They grew up in a large family—their parents had three daughters and nine sons—before migrating to Australia many years before the plot began.4
Khaled, the eldest of the 12 Khayat siblings, was born on November 29, 1967.5 At a young age, he fought in the Lebanese army during the civil war, which he later said was because he “hated the Shia.”6 He also worked as a builder in Tripoli before migrating to Australia in 1988 where he worked in various jobs requiring manual labour and practical skills, including as a “panel beater, spray painter, meat wholesaler, butcher and … handyman.”c By the time the plot began, Khaled was married and had fathered four children who were in their 20s. Mahmoud, the youngest of the 12 Khayat siblings, was born in 1985.7 He migrated to Australia in the mid-2000s8 and similarly worked in several different jobs, including as a spray-painter and a meat worker.9 Mahmoud married the sister of Khaled’s wife and fathered two children.10
The other two plotters were based in Syria. One was Tarek Khayat, another brother of Khaled and Mahmoud. Tarek was born in Tripoli, Lebanon, around 1970d and worked in the family construction business like many of the Khayat siblings.11 On top of this work, he also became a sheikh and by the 2010s was regarded as a significant jihadi figure in Lebanon.12
Throughout 2013 and 2014, Tripoli experienced violent clashes tied to the civil war in Syria, particularly between residents of the Alawite neighborhood of Jebel Mohsen and the Sunni neighborhood of Bab al-Tabbaneh where the Khayat family lived.13 These clashes often involved local branches of Syria-based groups, including Jabhat al-Nusra and the Islamic State.14 On several occasions, Sunni jihadis directly confronted the Lebanese military, and Tarek Khayat took part in one such confrontation in October 2014 that resulted in three days of violence and dozens of deaths.15 Tarek Khayat’s precise role, or what group he was part of, is unclear, though some reports say he was already a senior Islamic State commander.16 He avoided being killed or captured in the battle, and soon fled to Syria. He took his three sons—Abdulla, Mohamed and Abdul-Rahman—with him as well as his nephew Ziad.17
Tarek Khayat spent several years fighting in Syria for the Islamic State, and by 2017, he was based in Raqqa alongside the man who would become the most important figure in the Sydney plane plot.18 This man, the fourth plotter, was never referred to by name during the trials in Australia. He was only referred to as the “Controller,” and the Sydney-based plotters do not appear to have known his real name. However, investigative reporting in Denmark revealed his identity as Basil Hassan, a jihadi figure wanted by international authorities since 2013.e
According to reporting by the Danish public broadcaster DR, Basil Hassan was born in the Danish town of Askerod on May 24, 1987, shortly after his family migrated from Lebanon.f In high school, he mixed with people who would later become known as members of Denmark’s jihadi circles. In 2007, a friend of his was convicted for his involvement in what was known as the “Glostrup cell,” a suspected bomb plot that developed as part of a wide jihadi network straddling Denmark, Sweden, and Bosnia, which was sometimes referred to as “al-Qaida in Northern Europe.”g That same year, Hassan was admitted into an engineering degree program, which he graduated from in 2010, then undertook further courses that developed his technical skills.19 By 2011, he had become increasingly active in Denmark’s jihadi networks and was under attention from the Danish Security and Intelligence Service (DSIS).h
On February 5, 2013, Basil Hassan allegedly attempted an act of violence himself. The target was Lars Hedegaard, a 70-year-old Danish author and vocal critic of Islam. Wearing a postman’s jacket, a man believed to be Hassan knocked on Hedegaard’s front door, armed with a handgun. The assailant fired at Hedegaard’s head, but missed, and then fled after the gun malfunctioned.20 Hassan fled Denmark afterward and was soon being hunted by Danish and international intelligence services.21
Details on Hassan’s movements after this point are unclear, but it appears he traveled to Lebanon, Turkey, and Syria.22 He was soon working for the Islamic State and was believed to be playing a major part in their international drone acquisition program.i Through several supporters in Denmark, including an old school friend, Hassan allegedly arranged the purchase of commercial drones and equipment.23
Turkish Police arrested Basil Hassan at Istanbul Airport on April 14, 2014, on his way back to Denmark.24 The Danish government requested his extradition, but were informed in October 2014 that he had been released.25 Danish authorities feared that his release had been part of a prisoner swap with the Islamic State, in exchange for 49 Turkish hostages, which Turkey denied.26 Hassan returned to Syria and allegedly continued to use his engineering skills and Danish contacts to help develop the Islamic State’s drone program.
Operating from the Islamic State’s capital Raqqa, Hassan had ambitions for large-scale international attacks. According to reporting by Danish public broadcaster DR, Hassan had a particular interest in targeting aircraft and was part of a team that used operatives in Turkey and the Maldives to ship packages containing hidden explosives to countries across the world, including Qatar, Germany, the United Kingdom, and the United States, as an experiment to test their screening systems.27 On November 22, 2016, the U.S. State Department listed Basil Hassan as a Specially Designated Global Terrorist, describing him as an “external operations plotter for ISIL.”28 Jason Blazakis, the Director of the Counterterrorism Finance and Designations Office at the time, later stated that, “Hassan is one of the most dangerous people we’ve ever designated at the Department of State.”29
Basil Hassan was able to engineer the plot in Australia through the family connections of Tarek Khayat who, as noted above, was by 2017 also based in Raqqa. Just as Hassan had allegedly reached back to associates in Denmark to help acquire drone components for the Islamic State, Tarek Khayat reached out to two of his brothers who had had migrated to Sydney years earlier, Khaled and Mahmoud.
There was also a third Khayat brother living in Sydney, Amer Khayat, but the family had little contact with him.30 Amer had struggled with alcohol and drug abuse, using methamphetamines from 2011 to 2016.31 He had been married and had two daughters, but the marriage had fallen apart some years before the plot.32 Khaled and Mahmoud “disapproved of him because he drank, went clubbing, gambled and was gay which they regarded as bringing shame on the family.”33 Amer initially had no connection to the plot, but Khaled and Mahmoud would reach out to him in mid-2017 and manipulate him into playing an unwitting role.
While Amer was estranged, Khaled and Mahmoud remained in close contact with their family in Tripoli. They moved back and forth between Australia and Lebanon, and would send money to pay workers in the family construction business.34 They closely followed the Syrian civil war after it broke out, and they became committed supporters of the Islamic State. When the Khayat brothers were later sentenced, the judge stated that Mahmoud’s wife’s laptop contained photographs of their children wearing Islamic State symbols and holding toy firearms and, in one case, a real firearm.35
Khaled and Mahmoud also remained in close contact with Tarek as he was fighting in Syria with his three sons and nephew. After Tarek’s son Abdul-Rahman was killed in Syria in September 2016,j Mahmoud, Khaled, and Khaled’s son-in-law took photos of themselves making Islamic State gestures to send as a message of solidarity.36 It was through their communications with Tarek that Khaled and Mahmoud became part of Basil Hassan’s efforts to carry out external operations for the Islamic State.
Preparing the Attack
The Sydney plane plot effectively began on January 21, 2017, when Tarek asked Mahmoud to tell Khaled to contact him immediately. Khaled soon contacted Tarek, and they began arranging for the delivery of a parcel to Sydney. From this point on, Khaled took the lead in communicating with Tarek Khayat and then Basil Hassan, while Mahmoud assisted Khaled with various parts of the plot over the next six months.k
Tarek Khayat and Basil Hassan’s decision to reach out to Tarek’s brothers, rather than to individuals they only knew online, offered several advantages. A key advantage was that Tarek, and through him Hassan, was in a position to know that Khaled and Mahmoud were genuinely committed Islamic State supporters.l Another advantage was that the Sydney brothers were not under close attention from authorities. The Australian Security Intelligence Organisation (ASIO) interviewed Khaled in 2015, after Tarek had traveled to Syria and joined the Islamic State, but otherwise the Sydney-based brothers do not appear to have been of active interest to security agencies.37
An additional advantage was that Khaled and Mahmoud were already security conscious about their communications. They had the Telegram app installed on separate phones from their everyday phones.38 They regularly used these second phones to communicate with their family members in Lebanon and Syria, including Tarek. To communicate with each other, Khaled and Mahmoud used WhatsApp. The use of encrypted communication platforms helped the Khayat brothers hide evidence of their actions and would later cause difficulties for the prosecution’s case against them.m
Both Khaled and Mahmoud also made sure to not reveal the plot to anybody, including other family members, and made no known missteps that drew the attention of Australia’s counterterrorism authorities. This is evident from the plot’s earliest stages, as Khaled made sure that the package was not delivered to his own house. Instead, Khaled gave Tarek the address of their cousin, who was also Mahmoud’s brother-in-law.39
The package was sent by airmail from Turkey on April 13, 2017.40 It contained a welding machine with an explosive substance hidden inside a copper coil. The package was reportedly first put together in Syria and taken to Turkey, where an Islamic State operative posted it to Australia, consistent with the Danish public broadcaster DR’s reporting that Basil Hassan had Islamic State supporters in Turkey posting explosives to multiple countries.41 On April 16, 2017, the package was delivered to the Khayats’ cousin’s house by the international couriering service DHL, but the cousin was unaware of the impending parcel and was not there to receive it.42 The next day, Mahmoud Khayat visited the DHL website and learned that they had attempted to deliver the package.43 The following day, Mahmoud called DHL pretending to be his cousin to ask them to deliver it again. That same day, Khaled and Mahmoud told their cousin to expect a parcel, which they would pick up.n The next day, Wednesday, April 19, they drove to their cousin’s house and picked up the successfully delivered parcel.44
Khaled Khayat opened the parcel on April 21, 2017, in Mahmoud’s presence.45 He took out the welding machine and removed the copper coil containing the explosive substance. The type of explosive is not publicly known, though media reports suggested that it may have been pentaerythritol tetranitrate (PETN).46 Khaled sent a photo of the coil to either Tarek Khayat or Basil Hassan to show that he had received it.47 The coil almost amounted to a functioning bomb, but required batteries, wiring, and a timer. By sending the package, Tarek and Hassan overcame an obstacle that the Islamic State had often struggled with, as al-Qa`ida had before it: how to enable untrained operatives to construct working explosives.
Completing construction of the bomb nonetheless required close tutelage. On April 22, 2017, Basil Hassan sent Khaled Khayat an audio message through Telegram with instructions for how to wire the bomb.48 Khaled repeatedly sent photos to both Tarek and Hassan to demonstrate his progress and seek feedback. Mahmoud assisted Khaled in conducting research on timers, ordering one through his wife’s eBay account.49 This timer did not prove effective, so on May 23, Khaled purchased another one that turned out to be more suitable.50
Although the plotters’ priority was to prepare the bomb to destroy an international airliner, they worked on multiple attack plans at the same time, demonstrating the plot’s ambitions. The second plan was the chemical weapon attack. On May 6, 2017, Khaled was sent instructions on how to create a chemical compound that could be dispersed as a lethal gas.51 The public court material provides few details about the intended chemical weapon, but in a press conference on August 4, 2017, the Australian Federal Police described it as a plan to build an “improvised chemical dispersion device” that would release “highly toxic hydrogen sulfide” in “crowded closed spaces, such as public transport.”52 Khaled began by gathering the precursor chemicals and again kept Tarek Khayat and Basil Hassan updated on his progress by sending photos.53 On May 21, 2017, either Tarek or Hassan via Telegram sent Khaled a video showing how to turn the chemical compound, which they had not yet created, into a poisonous gas.54
There was also a third attack plan, which was for Khaled Khayat and Mahmoud Khayat to produce explosives themselves. The intended target, if any was chosen, is unclear. On July 1, 2017, Basil Hassan sent Khaled a video explaining how to develop an explosive substance.55 Khaled attempted to follow the instructions, but decided it was too difficult and dangerous.56 This demonstrated the difficulty of creating homemade explosives, even with remote oversight, and the importance of the earlier innovation of delivering a nearly completed bomb through an international courier service.
Khaled and Mahmoud’s main focus was on getting the copper coil bomb on board a plane. By June 2017, an opportunity presented itself. Khaled learnt that his estranged brother Amer Khayat was planning to fly to Lebanon.57 Khaled consulted with Tarek Khayat and Basil Hassan, and they decided to use this as their chance to bomb an international airliner.58 Khaled and Mahmoud would offer to drive Amer to the airport and provide him with extra luggage as gifts to take to family members.59 Without Amer’s knowledge, the extra luggage would include the bomb.
Amer Khayat’s flight, from Sydney to Beirut via Abu Dhabi, was booked for July 15, 2017, so Khaled and Mahmoud needed to have the bomb ready in time.60 In early July, Tarek asked Khaled to purchase some sort of machinery to hide the bomb inside. Khaled decided to use a meat grinder that he already owned. He removed the meat grinder’s internal components and used the space to hide the explosive coil, timer, batteries, and unspecified attachments, though they were not yet connected, and held them in place with silicon.61 On July 11, 2017, Khaled sent Tarek a picture to show that the bomb components could fit inside the meat grinder.62
On July 14, 2017, the day before the planned flight, Basil Hassan advised Khaled on how to set the timer to ensure that the bomb would explode mid-flight. Hassan instructed Khaled to write down the calculations and to send a picture of his work. Khaled sent Hassan a photo, but it included the meat grinder, which was sitting on his desk. Hassan rebuked Khaled, messaging him that, “You should not have sent me a picture of the item you want to send brother.”63 This was one of the few signs of Hassan showing concern that the Khayats were not being sufficiently security-conscious.
The next morning, July 15, 2017, Khaled drove to Amer’s house to take him to the airport. The plane was scheduled to leave at 3:00 PM, which provided time for Khaled and Mahmoud to carry out their plan.64 On the way to the airport, Khaled and Amer stopped at Mahmoud’s mother-in-law’s house in the Sydney suburb of Surry Hills, where Mahmoud was waiting. While Amer was inside talking to his aunt, Khaled and Mahmoud stayed in the courtyard. Khaled connected the batteries and timer to the coil and other attachments.65 With their functioning bomb concealed inside the meat grinder, Khaled, Mahmoud, and Amer Khayat traveled to the airport, arriving shortly after 1:00 PM.66
The plotters now faced what turned out to be their most serious obstacle yet. A passenger service agent at the Etihad Airways check-in objected to the amount of luggage Amer was carrying. Amer had checked in a suitcase as cabin baggage but was still carrying a black wheeled bag, a black backpack, and a white Toys R Us bag. The meat grinder was inside either the wheeled bag or the backpack, but Amer was unable to proceed further. The passenger service agent told Amer that these bags would exceed the 7kg weight limit for hand luggage and that he would have to either pay to check in some of these bags as cabin baggage or would need to repack his hand luggage. She diligently made a note in the system, suspecting that Amer might try to sneak past, and advised him to see her once he had repacked.67
Khaled and Amer returned to the car, where Mahmoud was waiting. Khaled put the White Toys R Us bag into the car and, concerned that the interactions with the passenger service agent had increased the risk of the bomb being discovered, removed the meat grinder from one of the black bags. He then gave the black bags back to Amer, who returned to the terminal and boarded the flight without the bomb.68
After failing to place the bomb as hand luggage on the plane, Khaled and Mahmoud returned to their family residence in Surry Hills. They disassembled the bomb by disconnecting the batteries and timer, and then disposed of the meat grinder.69 Khaled took the coil back to his house in the suburb of Lakemba and placed it in his garage.70 That evening, Khaled messaged Basil Hassan to tell him that the plan had gone wrong. The next day, July 16, 2017, Hassan asked for details to explain the failure. In response, Khaled lied to Hassan. Rather than revealing that he was at the airport and had removed the meat grinder from Amer’s hand luggage, Khaled claimed that Amer had taken it upon himself to return the hand luggage and that he had not found out about it until 5:00 PM.71
The judge later described Khaled’s actions, removing the bomb from the bag and then lying to Hassan about it, as being motivated by self-preservation.72 Khaled’s cautiousness had initially been an advantage to the Islamic State throughout the plot, as it reinforced their security precautions. Now Khaled’s sense of self-preservation served as a hinderance, resulting in him preventing Hassan from receiving truthful information about a crucial part of the plot. However, had Khaled not removed the bomb from the bag, it would not necessarily have made it to the plane as the airport security systems would have posed a formidable obstacle. Although the bomb was intended to pass through undetected, the Australian Federal Police later stated that they tested a replica of the device at multiple airports and that it was detected each time.73 Khaled’s decision to remove the bomb may therefore have prevented the plot from being discovered on July 15, 2017.
Following this failed attempt to bomb the Etihad flight, the plotters took some time to decide on their next steps. Khaled proposed to Basil Hassan that they try again and offered to take the bomb on board a plane himself. However, Hassan said that he needed him to remain inside Australia for an attack.74 It is not clear how serious Khaled’s offer was, given that he had otherwise shown a strong sense of self-preservation. Mahmoud had been planning to fly to Lebanon in September that year and at one point spoke with Khaled about taking the bomb with him, but the conversation had an apparently humorous tone and it is similarly unclear that Mahmoud was genuinely willing to sacrifice himself.75
Instead, the plane bombing plan was put to the side. Khaled consulted with Basil Hassan and returned to the plan of developing a new explosive substance. Hassan began to convey a sense of urgency, telling Khaled that “we should be a bit fast.”76 The plotters also discussed returning to the poisonous gas attack as their next best option. On July 24, 2017, Hassan sent instructions to prepare and test the gas within a week.77 He also provided instructions on how much of the gas would be needed to create a lethal effect in the sorts of public spaces where they were planning to use it. On July 27, 2017, Hassan clarified to Khaled that this meant the homemade explosives plan should be postponed, as the chemical weapon attack was now the top priority.78
On July 29, 2017, Khaled and Mahmoud took a bag containing the required chemicals to a barbecue in the parking space of Mahmoud’s apartment block. Khaled burnt the chemicals together to create a single substance, which he placed in a plastic bag. At around 3:00 PM, he sent two photos to Hassan with the message, “This is during combustion and after combustion.”79 Khaled was unsure if he had done it correctly, telling Hassan, “But brother after mixing them I only got 94 grams.”80 Forensic evidence later confirmed that Khaled had not combined the chemicals correctly. He would not get another chance, because he and Mahmoud were arrested about an hour later, as a result of Australian counterterrorism authorities becoming aware of the plot three days earlier.
Disrupting the Plot
For over six months after the plot began on January 21, 2017, Khaled and Mahmoud Khayat had proceeded with their plans undetected by Australian counterterrorism authorities. This changed on July 26, 2017, 11 days after the Khayats had tried to bomb the Etihad flight, when an international intelligence partner alerted Australian security agencies to the threat.81 By several accounts, it was Israel that provided the crucial information.82 Australian political leaders have confirmed that they received information from Israel about the plot,83 but not necessarily that Israel was the first or only source. Other accounts suggested that British, American, Danish, and Lebanese intelligence also provided Australian counterterrorism authorities with information about the plot.84
After becoming aware of the Khayat brothers’ activities, security agencies needed to move quickly. As the plotters were based in Sydney, the appropriate mechanism was the New South Wales Joint Counter Terrorism Team. This was a combined federal and state counterterrorism unit established in the early 2000s, which includes members of the Australian Security Intelligence Organisation, the Australian Federal Police, the New South Wales Police, and the New South Wales Crime Commission.
The Joint Counter Terrorism Team established an investigation with the codename Operation Silves and immediately began investigating the Khayat brothers and their associates. This involved the use of rare powers such as covert search warrants.85 The Australian Federal Police later stated that they “used nearly every counter-terrorism power that’s available to us under Commonwealth and New South Wales legislation, in this investigation.”86
On the afternoon of July 29, 2017, the Joint Counter Terrorism Team searched the houses and vehicles of all the suspects in a series of high-profile raids.87 At around 4:00 PM, they arrested Khaled and Mahmoud as well as two of their cousins, including the cousin whose address Khaled had provided to Tarek so that the package would be delivered there. Police questioned the suspects for several days. Khaled Khayat admitted his role in the plot, while firmly denying that Mahmoud was involved. His admissions did not stop him from later pleading not guilty and seeking, unsuccessfully, to have his interviews ruled as inadmissible.88 Unlike Khaled, Mahmoud Khayat was not forthcoming under questioning. He claimed he had not spoken to Tarek Khayat for two years, but the police evidence showed that he had often communicated with Tarek through Telegram.89
Police charged Khaled and Mahmoud under federal legislation with “conspiracy between 20 January 2017 and about 29 July 2017 to do acts in preparation for a terrorist act.”90 Their two cousins were released without being charged with terrorism offences; one was charged for allegedly possessing an illegal weapon (the charge was later dismissed), but neither was accused of being part of the plot.91
Khaled Khayat and Mahmoud Khayat both pleaded not guilty, and they faced a joint trial, which began on March 18, 2019.92 On May 1, 2019, the jury found Khaled guilty.93 However, they were unable to come to a verdict on Mahmoud, so the jury was discharged on May 3.94 Mahmoud’s retrial began on August 5,95 but on August 9, the judge decided to discharge the jury for reasons that are not publicly known.96 Sometime afterward, Mahmoud underwent a second retrial and was found guilty on September 19, 2019.97
On December 17, 2019, Khaled Khayat and Mahmoud Khayat were both sentenced. Khaled was sentenced to a term of 40 years in prison and Mahmoud was sentenced to 36 years.98 Khaled will be eligible for parole in 2047 and Mahmoud will be eligible in 2044.99 These are the longest sentences that have ever been given in Australia to participants in a foiled terrorist plot.
The Syria-based plotters had little chance to continue their operations. Tarek Khayat was wounded in an airstrike in August 2017 shortly after the plot was foiled. Tarek’s leg was amputated, but he managed to flee before Raqqa fell to the Syrian Democratic Forces, only to be captured near the Syrian-Iraqi border by Iraqi forces on December 27, 2017.100 In October 2018, an Iraqi court sentenced him to death, not specifically over the plane plot but over his broader role in the Islamic State.101 o It is currently unclear if the sentence has been carried out. There is little to no information available on what has since happened to Basil Hassan. By some accounts, he was killed in Syria at some point after the plot was foiled.102 Danish authorities managed to dismantle the drone procurement network he allegedly helped establish in Denmark.103
The plot’s unwitting participant, Amer Khayat, also faced prosecution. In late August 2017, Lebanese authorities announced that they had arrested Amer Khayat and considered him to have been a co-conspirator in the plot. He was charged with terrorism offenses and faced the death penalty. Under interrogation, Amer wrote a statement declaring that he had knowingly been part of the plot. However, this purported confession was tainted by allegations of torture and Australian authorities had always stated that they viewed Amer as an unwilling dupe.104 Moreover, the prosecution’s allegations in Amer’s trial were often inconsistent with the evidence presented in Khaled and Mahmoud’s trials. In September 2019, Amer was acquitted and returned to live in Australia.105
Amer Khayat’s ordeal resulted in serious discrepancies in the reporting of what the plane bombing attempt involved. In Amer’s trial in Lebanon, the prosecution alleged that a second bomb was taken to the airport on July 15, hidden inside a Barbie doll. This allegation has been widely reported, with the result that the plot is often referred to in the media as the “Barbie doll bomb plot.”106 However, the court material from Khaled and Mahmoud’s trials provide no evidence to support the claim that a bomb was taken to the airport inside a doll.
There is one reference to a doll in the publicly available Australian court material, which potentially sheds light on how the claim originated. After Mahmoud Khayat was arrested, he tried to imply that a bomb might be hidden in a doll in the Toys R Us bag that was taken to the airport, to distract the police from the real explosive hidden in Khaled’s garage. When sentencing, the judge stated that there “was no evidence, apart from Mahmoud’s self-serving speculation, that indicated that the doll contained in the Toys R Us bag had ever contained a bomb…. Mahmoud raised the doll to mislead police about the location of the explosive device.”107
This shows that Amer did indeed take a doll to the airport but undermines the widely reported claim that it contained a bomb. The information derived from the prosecutions of Khaled and Mahmoud in Australia should be treated as more authoritative than information derived from Amer’s prosecutions in Lebanon, for multiple reasons. Unlike Amer’s prosecution, the prosecutions of Khaled and Mahmoud resulted in convictions and were not tainted by allegations of torture. Furthermore, the Australian authorities were closer to the events in question and had the necessary forensic evidence at hand, and the court material contains no suggestion that a second bomb (or any components thereof) was unaccounted for.
Operation Silves in the Context of the Islamic State Threat in Australia
The 2017 Sydney plane plot was part of the unprecedented wave of jihadi plots Australia experienced after the Islamic State’s global call to arms in September 2014.108 Between September 2014 and April 2020, Australia experienced up to 24 jihadi plots. Seven of these plots managed to kill or injure people, while up to 17 were foiled by counterterrorism operations.p
These plots were inspired by the Islamic State but tended not to involve direct instructions, with the exceptions of five virtually planned plots. Four of these occurred relatively early (in September 2014, February 2015, April 2015, and May 2015) and the fifth was the 2017 Sydney plane plot.109
The overwhelming majority of Australia’s jihadi plots since September 2014 were relatively simple, but sometimes deadly, and tragically managed to kill five people and injure several more. In most plots, the perpetrators were armed with blades or firearms and often sought to kill one or more police officers.110 These plots tended not to involve attempted bombings, with the key exceptions being a Melbourne teenager who built pipe bombs under instructions from Islamic State cybercoach Junaid Hussain in May 2015, four men who planned to bomb Melbourne’s central business district in December 2016, and the Melbourne Bourke Street attacker in November 2018 who unsuccessfully attempted to ignite gas canisters before stabbing members of the public.111 The 2017 Sydney plane plot was another of these exceptions.q
It was also an exception because of how far the plotters progressed. Most Australian jihadi bomb plots were foiled before the plotters finished building their explosives, well before they were able to take them near the target, yet the Khayat brothers managed to take a functioning bomb to the airport. Another difference was that Khaled and Mahmoud were 49 and 32 years old, respectively, at the time of their arrests, making them older than the majority of Australia’s Islamic State supporters (whose average age has been estimated as 25).112 With military experience and practical skills, they would also prove to be more competent than many.
In short, the plot foiled by Operation Silves differed from many other Australian jihadi plots during the Islamic State era by being relatively sophisticated, virtually planned, involving a bomb, and coming close to completion. However, it was the plot’s targeting of aviation and attempted development of a chemical weapon that made it so unusual among the Islamic State’s external operations elsewhere in the world.
Operation Silves in the Context of the Islamic State’s External Operations: Targeting Aviation
Aviation has long been a favored target for terrorists, due to its symbolic value, economic importance, and the prospect of causing so many deaths in a single attack. Since the 1970s, and more so after 9/11, aviation has also been one of the most heavily protected targets. Airports, particularly in developed countries, commonly feature sophisticated security systems with combinations of X-ray machines, sniffer dogs, explosive trace detectors, and well-trained staff.113 Perhaps due to these difficulties, the Islamic State has not often targeted aviation, with some major exceptions being the bombing of the Russian airliner Metrojet 8968 in Egypt in October 2015 and reports in 2017 that the group was trying to create laptop bombs that could pass through airport security.114 r The attempt to bomb an international airliner in this Sydney plot, despite the security measures in place, points to the continuing importance of aviation as a target.
The decision to target aviation could also have been influenced by Basil Hassan’s own priorities. The reporting by Danish public broadcaster DR suggested that he had a particular interest in targeting aviation, hence the efforts to test cargo security in multiple countries. The court material also raises the possibility that he was connected to the bombing of Metrojet 9268. The notes from a police interrogation of Khaled Khayat after his arrest state that he claimed that “there was a plane blown up over Egypt” and that “it was done by these same people offshore, using the same methodology.”s
The 2017 Sydney plot raised new concerns about aviation security, particularly because the Islamic State had managed to send the explosive through air cargo to Australia without detection. Michael Outram, acting Commissioner of the Australian Border Force, described the plot as:
“…a game-changer for us in the way we look at the border … we cannot just look at the border in terms of the physical border when things arrive here … we need to understand what happens at the various airports and choke points in the supply chain that, say, DHL, UPS, TNT or FedEx use and what are the arrangements at the various airports at which these parcels are being embarked onto aeroplanes.”115
These concerns were also held internationally. In late 2017, Nicholas Rasmussen, then Director of the United States National Counterterrorism Center, stated that “we were certainly quite struck by what our Australian colleagues uncovered in the course of that investigation. It revealed to us a broader vulnerability than we perhaps had earlier appreciated.”116 Kevin McAleenan, while serving as Commissioner of U.S. Customs and Border Protection, stated that the Sydney plane plot “galvanized international attention in partner agencies in Europe and elsewhere to focus on this threat.”117
In response to Operation Silves, the Australian government announced the “New Policy Initiative (NPI) – Strengthening Aviation Precinct Security” in the next federal budget. This allocated AU$107 million (around US$68 million) over four years to boost security at the major airports in Sydney, Canberra, Melbourne, Adelaide, Brisbane, Darwin, Cairns, Gold Coast, and Perth. The initiative increased the Australian Federal Police presence at these airports and sought to improving staff training, forensic capabilities, and intelligence efforts.118 AU$50.1 million (around US$32 million) was also allocated to assist other airports across the country.119
The Sydney plane plot does not appear to represent a broader shift by the Islamic State to a greater focus on aviation. There is little evidence of the Islamic State targeting aviation since. The most important exception is a reported plot in the Maldives that resembles the Sydney plot. On December 2019, the Commissioner of the Maldives Police Service announced that a group of jihadis in the Maldivian capital city Malé had plotted to build an improvised explosive device to bomb an airliner in 2017, again under instructions from Islamic State operatives, in this case via a Maldivian militant in Syria.120 However, in general, the Islamic State threat toward aviation does not appear to have escalated since the 2017 Sydney plane plot.
Operation Silves in the Context of the Islamic State’s External Operations: Chemical Weapon Use
Another defining feature of the plot foiled by Operation Silves was the attempted development of a chemical weapon. This was an extension of the Islamic State’s use of chemical weapons such as chlorine and sulfar mustard agents inside Syria and Iraq, and had been anticipated by some scholars.t This aspect of the plot similarly gained international attention. Rebecca Weiner, Assistant Commissioner for Intelligence Analysis at the NYPD, described the attempted development of a chemical device as “one of those outliers that might be an augury of things to come … you have skilled folks out there who are able to take on this much more specialized knowledge, perhaps with the help of people overseas, and this poses a significant concern.”121
The Khayats’ attempt to create a chemical weapon has fortunately remained an outlier among the Islamic State’s external operations. As Markus Binder et al. have argued, the Islamic State had shown little other interest in using chemical weapons outside of Syria and Iraq.122 For example, there were no instructions for such weapons in Dabiq or Rumiyah magazine.123 This argument holds up well, as subsequent Islamic State plots outside the region have not involved chemical weapons.
There has, however, been a parallel emergence of jihadi plots involving biological weapons. In 2018, Europe experienced three alleged jihadi plots involving the potential use of ricin.124 The most prominent of these was the Cologne ricin plot in Germany foiled in June 2018, which appears to have similarly been a virtually planned plot. According to German authorities, the key plotter was in contact via Telegram with at least two people suspected of being associated with the Islamic State. An assessment of the plot in this publication noted that “one of these persons allegedly gave him advice on the ricin production and the other one sent him information on how to build an explosive device.”125 There was also an alleged ricin plot in France in May 2018126 and an alleged plot involving both ricin and anthrax in Italy in November 2018.127 The alleged Italian plotter was accused of having joined the Islamic State, but there is little public information about whether the alleged French plotter had Islamic State connections.128
There have also been tentative reports of Islamic State plots involving other CBRN (chemical, biological, radiological, and nuclear) approaches. An alleged plot foiled in Indonesia in August 2017 reportedly involved plans to make a radiological “dirty bomb.”129 A prominent Indonesian Islamic State cybercoach, Bahrun Naim, had published instructions on his website for making such a device.130 That these CBRN efforts came to light after the 2017 Sydney plane plot could suggest that the plot was partly a sign of things to come, but not dramatically so.u The bulk of Islamic State plots have remained more conventional, using bombs, firearms, knives, and cars.131
While the chemical weapons component of the 2017 Sydney plane plot does not demonstrate a broader shift, it does suggest that the Islamic State’s cybercoaches were granted considerable freedom to innovate. They did not need to stick to the sorts of approaches recommended in official Islamic State publications like Rumiyah; they could instead adapt and experiment in their efforts to cause mass casualties inside target countries.
Operation Silves in the Context of the Islamic State’s External Operations: Virtual Planning
This leads to the key development behind the 2017 Sydney plane plot: the Islamic State’s need to innovate in its approach to external operations. By 2016, a series of territorial setbacks prompted the Islamic State to rely more on inciting self-starting attacksv and on the operational approach known as virtual planning.132 Neither approach was new. Since 2014, the Islamic State had used a wide range of attack methods, including efforts to inspire self-starting attacks, engaging in virtually planned attacks, and sending foreign fighters to return to their home countries to directly carry out attacks.
However, by 2016, the Kurdish-led Syrian Democratic Forces, backed by the U.S.-led Global Coalition Against Daesh, had seized territory along the Syrian-Turkish border. Turkish forces seized additional territory along the border through Operation Euphrates Shield.w Turkey had been the core point of transit for people trying to join the Islamic State, so these losses made it more difficult for the group to both receive and dispatch foreign fighters for the sorts of attacks seen in Paris in November 2015 and in Brussels in March 2016.x
Instead, virtual planning allowed Islamic State operatives, usually based in Raqqa, to provide detailed instructions to aspiring attackers inside the target countries without having to send anybody to physically assist the attack. Sometimes these plots proved deadly, such as the shooting attack against a Jakarta mall that killed four people in January 2016 and the murder of a priest in Normandy in July 2016.133 However, virtually planned plots had a high failure rate.y These failures resulted from the inherent difficulties of instigating attacks over long geographic distances, combined with the challenge of remotely screening recruits who could sometimes turn out to be “naïve, voluble, incautious, gullible, incapable, and/or troubled.”134
To achieve greater impact, the Islamic State’s cybercoaches continued to experiment with virtual planning by making greater use of encrypted communications technology.z They also began to remotely orchestrate the provision of logistical support, by introducing plotters to each other, arranging for sympathizers in the same country to give firearms and explosives to the plotters, and transferring money electronically.135
These innovations were built on by Basil Hassan and Tarek Khayat, who overcame some of the obstacles faced by earlier cybercoaches by instead recruiting through family connections and reducing how much they needed to depend on the skills of their in-country plotters.aa By sending a bomb-making kit and providing close tutelage for the assembly, they removed the need for Khaled Khayat and Mahmoud Khayat to develop skills that they did not already have. Described as an “IKEA model of terrorism,” this direct provision of materials over a long distance, combined with the instructions necessary to use them, was their key innovation.136 Meghann Teubner, Director of Counterterrorism Intelligence Analysis at the NYPD, stated that the:
“Australia plot in particular forced us to shift our thought on the threat of an external operation from ISIS, or any terrorist group; in this case a directed plot that does not involve deployed operatives but is instead extremists based in country receiving parts from overseas and possible online, remote communications. This could potentially increase an individual’s capabilities and lethality, and further challenges law enforcement capabilities to detect and disrupt by obfuscating some of the indicators of an advancing plot.”137
Virtually planned plots have continued after Operation Silves, though their frequency is unclear. Robin Simcox found 18 plots in Europe between the fall of 2017 and summer of 2019 where the plotters “had some form of contact” with the Islamic State.138 These would not necessarily have all been virtually planned plots, but some were, even as the Islamic State’s strongholds in Syria and Iraq collapsed. One Islamic State cybercoach in the Philippines directed a planned truck attack in the United Kingdom.139 A group of alleged bomb plotters arrested in Germany in April 2020 were reportedly in communication with Islamic State operatives in Syria and Afghanistan.140 Virtually planned plots also continued in other parts of the world, and in at least one case involved direct logistical support similar to the 2017 Sydney plane plot. For example, in 2018, an Islamic State cybercoach based in Idlib reportedly sent a supposed sympathizer in Lebanon (in reality, an intelligence agent) two bombs hidden inside buckets of cheese and provided the agent with instructions on how to assemble them.141
This raises the question of why there did not turn out to be many more Islamic State plots using this approach. One reason could be that the 2017 Sydney plane plot represented the personal preferences of figures like Basil Hassan more than the Islamic State’s broader priorities. This is consistent with the broader evidence that the Islamic State’s cybercoaches have considerable freedom to innovate. For example, some virtually planned plots involved female perpetrators at times when the Islamic State’s public material generally eschewed combat roles for women.142
Another reason, compatible with the first, is that the Islamic State simply did not get the chance to carry out many more ambitious and innovative plots like the Sydney plane plot because they soon faced devastating military losses. Raqqa, where the plot was directed from, fell to the Syrian Democratic Forces in October 2017. By 2018, the Global Coalition Against Daesh and its local partners had inflicted further territorial losses, killed many of the Islamic State’s prominent cybercoaches, and damaged the organization’s command and control structures.143 Furthermore, the Islamic State’s online presence deteriorated due to crackdowns by social media companies and cyber offensives such as Operation Glowing Symphony.144 The Islamic State has since lost even more momentum, as shown by a global decline in attacks, the death of its leader Abu Bakr al-Baghdadi, and the November 2019 Europol disruption campaign against the Islamic State’s Telegram channels.145 These setbacks impeded the Islamic State’s external operations and reduced the prospects of further plots of the sort foiled by Operation Silves.
Conclusion
The 2017 Sydney plane plot was a virtually planned plot characterized by the targeting of aviation, the attempted development of a chemical weapon, and the direct provision of logistical support over a long distance by mailing bomb components and providing instructions on bomb assembly. These characteristics made it unusual among the Islamic State’s external operations, which is what gained the plot widespread international attention after it was foiled by Operation Silves in July 2017.
At the individual level, the 2017 Sydney plane plot resulted from Basil Hassan and Tarek Khayat joining forces in Raqqa. They grew up in Denmark and Lebanon, respectively, and each man became involved in local jihadi networks with international connections and reportedly engaged in violence against local targets (a Danish public figure and the Lebanese military) before fleeing to Syria and playing important roles in the Islamic State. At the organizational level, the plot resulted from the evolution of the Islamic State’s external operations. The group’s territorial losses, particularly along the Syrian-Turkish border, disrupted the movement of foreign fighters and increased the relative importance of virtually planned attacks. Yet these plots often failed, rarely causing mass deaths, creating the need for adaptation.
By early 2017, Basil Hassan, who had already been designated by the United States as a key “external operations plotter,” was playing an active role in these attempts to innovate.146 Tarek Khayat was able to assist by reaching out to two of his brothers in Australia who were firm Islamic State supporters. Khaled Khayat and Mahmoud Khayat accepted their guidance and prepared to murder hundreds of plane passengers and to use poison gas to murder more members of the public.
Despite seeking to attack harder targets than most other Islamic State plots in the West, Tarek Khayat and Basil Hassan possessed many advantages that helped the plot progress. By recruiting through family connections, they ensured that they chose plotters who were competent enough to follow instructions and proceed with their plans without drawing attention to themselves. This had not been the case for some of the Islamic State’s other virtually planned plots.147 Another advantage was that Khaled Khayat and Mahmoud Khayat were not already under close security attention. An additional advantage was that by providing direct logistical support by mailing bomb components and providing instructions on bomb assembly, the Islamic State did not need to rely on the Sydney brothers’ own bomb-making skills.
However, these advantages were not enough to overcome all the obstacles the plot faced. These obstacles included dilemmas that were familiar to many of the Islamic State’s virtually planned plots, such as Khaled Khayat and Mahmoud Khayat struggling when required to create their own weapons. Furthermore, they were not always compliant, as shown when Khaled lied to Hassan by pretending that it was not he who removed the bomb from Amer’s bag.
The security environment posed the biggest obstacles. Australia’s airport security measures made it unlikely that the bomb would have actually made it onto the plane. International intelligence cooperation meant that Australian authorities were able to become aware of the plot without first detecting it themselves. Counterterrorism measures, which had been in place for years and were being used repeatedly after September 2014, meant that Australia’s police and security agencies were able to rapidly act on this information and arrest the plotters three days later.
Looking back nearly three years later, the plot remains largely an outlier. Its distinctive characteristics—targeting aviation, attempting to develop a chemical weapon, and direct logistical support over a long geographic distance—may have been due to the Islamic State’s cybercoaches having space to innovate rather than larger shifts in the group’s priorities. The subsequent degradation of the Islamic State’s external operations capability reduced the opportunities for further plots featuring these characteristics.
The 2017 Sydney plane plot therefore remains one of the most ambitious and innovative of the Islamic State’s external operations in the West, and the most serious jihadi plot that Australia has faced. The plotters possessed several advantages that enabled their plans to come closer to completion than many comparable Islamic State plots, particularly its other virtually planned attacks. However, these advantages were not enough to overcome the obstacles posed by the inherent difficulties involved in long-distance terrorist plots and by Australia’s years of investment in airport security, international intelligence cooperation, and counterterrorism capabilities. CTC
Andrew Zammit is completing a Ph.D. in political science at Monash University’s School of Social Sciences, examining roles and agency in transnational support for armed movements. He also works as a research officer at Victoria University’s Institute for Sustainable Industries and Liveable Cities, and has published widely on terrorism and security issues. His website can be found at andrewzammit.org. Follow @andrew_zammit
The author would like to thank Sean Rubinsztein-Dunlop for his helpful comments; Mette Mayli Albæk from the Danish public broadcaster DR for sending English translations of some of the excellent reporting on Basil Hassan by herself and her colleagues; Petter Nesser for helpful advice on CBRN plots in Europe; and Katrina Zorzi for her valuable help throughout the process of writing this article.
Substantive Notes
[a] In this article, the word ‘plot’ is used to describe the totality of the terrorist plans of the two brothers in Sydney, rather than to describe each of their distinct attack plans as a separate plot. As will be outlined in detail, these attack plans involved the attempted bombing of the passenger jet (which was aborted before authorities became aware of it), the attempt to create a chemical weapon, and also a short-lived attempt to construct their own explosive substance.
[b] As will be discussed throughout the article, this is not to suggest that the Islamic State never targeted aviation. Most importantly, its bombing of the Russian airliner Metrojet 8968 in October 2015 resulted in the murder of 224 people. Other examples include the reported attempts to create laptop bombs to pass through airport security and a reported plot to bomb an airliner in the Maldives in 2017. Lizzie Dearden, “Isis plane attack: Egypt admits ‘terrorists’ downed Russian Metrojet flight from Sharm el-Sheikh for first time,” Independent, February 24, 2016; David E. Sanger and Eric Schmitt, “U.S. Cyberweapons, Used Against Iran and North Korea, Are a Disappointment Against ISIS,” New York Times, June 12, 2017; Callum Paton, “Israel Hacked ISIS Cell to Uncover Laptop-Bomb Plot to Down International Flights,” Newsweek, June 12, 2017; Mariyam Afaaf Adam, “ISIS attempted to carry out an airliner bombing in the Maldives, says Police,” Raajje Mv, December 16, 2019; Shahudha Mohamed, “Police confirm 2017 terrorist bomb attempt in Maldives,” Edition, December 16, 2019.
[c] The details on Khaled’s date of migration are unclear. The sentencing document states that he migrated to Australia in “1987 or 1988,” while a document from the National Archives of Australia suggests he was granted a visa by the Australian Embassy in Damascus in February 1988. See “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 34; “Khayat, Khaled,” National Archives of Australia, series no: A8299, control symbol: 1987/5326, item barcode: 21008788, p. 16.
[d] Tarek Khayat’s date of birth is unclear, so 1970 is an inference based on reports that he was 48 years old when sentenced to death by an Iraqi court in October 2018. However, there have also been reports that he was born in 1972. See Adam Harvey, “Tarek Khayat: Islamic State commander and suspected Etihad plane bomb plot leader sentenced to death,” ABC News, October 11, 2018, and Ellen Whinnett, “20 minutes to terror,” Advertiser, June 5, 2018.
[e] Based on this investigative reporting, this article will refer to “Basil Hassan” instead of “the Controller.” However, it should be kept in mind that Hassan, believed to be dead, has not faced a judicial process in relation to this plot and that further information could come to light, which complicates the current understanding that he was “the Controller.” Mette Mayli Abaek, Sara Munck Aabenhus, Troels Kingo, Puk Damsgard, and Jens Vithner, “Basil Hassan bag omfattende terrorplan: Passagerfly skulle sprænges i luften,” DR, April 15, 2019; Mette Mayli Abaek, Jens Vithner, and Troels Kingo, “Dømt australsk terrorist: Basil Hassan bag bombe på russisk fly,” DR, November 6, 2019.
[f] There is contradictory information about Hassan’s precise date and place of birth. In 2016, the U.S. Department of the Treasury listed his place of birth as Lebanon and his date of birth as “1986 to 1988,” and the U.S. Department of State similarly listed his place of birth as Lebanon and his date of birth as “circa 1987.” However, Danish reporting in 2019 stated that Hassan was born in Askerod on May 24, 1987. The Danish reporting is more recent and specific than the U.S. designations, so for this article, it is being treated as a more reliable source on Hassan’s biographic details. See “Counter Terrorism Designations; Kingpin Act Designations Updates,” U.S. Department of the Treasury, November 22, 2016; “State Department Terrorist Designations of Abdullah Ahmed al-Meshedani, Basil Hassan, and Abdelilah Himich,” U.S. Department of State, November 22, 2016; “Hvem er den Danske Topterrorist Basila Hassan?” DR, 2019.
[g] The “Glostrup cell” refers specifically to four people in the Copenhagen suburb of Glostrup charged with terrorism offenses in late 2005. “Al-Qaeda in Northern Europe” refers to the broader network, of which the “Glostrup cell” was a part, centered on a group of Scandinavian jihadis hiding out in Bosnia who released an online statement with the title “Declaration of the Establishment of the al-Qaida Organization in Northern Europe.” For more detail, see Petter Nesser, Islamist Terrorism in Europe: A History (London: Hurst & Company, 2016), pp. 202-213; “Terrorism Defendants Sentenced in Atlanta,” U.S. Department of Justice, December 14, 2009; Sebastian Rotella, “Taking Jihad to the internet,” South Coast Today, April 17, 2007; “Hvem erden Danske Topterrorist Basila Hassan?”
[h] The Danish Security and Intelligence Service (DSIS) is the official English name of Denmark’s police intelligence service. In Danish, it is called the Politiets Efterretningstjeneste (PET). See “Politiets Efterretningstjeneste – Danish Security and Intelligence Service: English.”
[i] Basil Hassan has been charged in absentia over the Lars Hedegaard murder attempt and the drone procurement network, and was implicated in the prosecutions of the Denmark-based members of the drone network. However, the allegations against him have not been tested in court as the Danish authorities have had no opportunity to bring him to trial and he is currently believed to be dead. Borzou Daragahi, “Terror cell busts in Denmark and Holland spark fears of homegrown attackers with Isis links,” Independent, September 29, 2018; Mette Mayli Abaek, “Analyse: Heldigvis for PET handler terrorsager ikke kun om straf,” DR, December 7, 2019.
[j] Some media reports suggest that the deaths of Tarek’s sons served as a motivating factor for this plot. This is highly plausible, but the public court material provides no new information as to whether this was part of plotters’ motivation. However, the court material does clarify the dates of these deaths, stating that Abdul-Rahman was killed in September 2016 and that another of Tarek’s sons, Mohamed, was killed in March 2017, while media reports previously stated that both were killed in December 2016. “R v Khaled Khayat; “R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” pp. 8-9; Jacquelin Magnay, “‘Barbie’ plotters face death sentence,” Weekend Australian, March 24, 2018.
[k] The precise point at which Hassan directly participated in these communications is unclear, but it is clear that by April 2017, Khaled was in regular contact with Basil Hassan. Tarek Khayat did not step aside after putting Khaled in contact with Hassan, as both Tarek Khayat and Hassan were involved in the planning. The allegations against them referred to a “conspiracy between Tarek, the Controller and Khaled.” At some points in the court material, it is not clear whether the instructions came from Hassan or Tarek, though the most technical instructions do come from Hassan, whose close tutelage guided their efforts to build the devices. “R v Khayat (No 11) [2019] NSWSC 1320 (6 June 2019),” p. 6; “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019).”
[l] In several of the Islamic State’s virtually planned plots, the cybercoaches reached out to individuals they had never met, who sometimes proved unreliable. See John Mueller, “The Cybercoaching of Terrorists: Cause for Alarm?” CTC Sentinel 10:9 (2017): pp. 29-35; Daveed Gartenstein-Ross, Matt Shear, and David Jones, “Virtual Plotters. Drones. Weaponized AI?: Violent Non-State Actors as Deadly Early Adopters,” Valens Global, November 2019.
[m] During the trial, the prosecution was unable to present the Telegram exchanges between Khaled and Tarek Khayat, but was able to present some of Khaled’s exchanges with Hassan. “R v Khayat (No 4) [2019] NSWSC 1317 (14 March 2019),” p. 8.
[n] There is no suggestion in the available material that the cousin was aware the package contained a bomb. Police later questioned him and did not charge him over any role in the plot, and they later stated at a press conference that they were confident they had charged all the people involved. It is also unclear how close Khaled was to this cousin, as Khaled had to ask Mahmoud for the cousin’s full name and address, and Mahmoud then had to ask his wife. “R v Khayat (No 11) [2019] NSWSC 1320 (6 June 2019),” p. 5; “R v Khayat (No 6) [2019] NSWSC 1318 (16 April 2019),” p. 5; “AFP and NSWP Discuss the Two Sydney Men Charged over Alleged Terrorist Acts,” Australian Federal Police National Media, August 4, 2017, https://twitter.com/ausfedpolice/status/893244987315331072.
[o] However, Human Rights Watch and similar organizations have credibly accused the Iraqi government of unfair trial processes and routine abuses in its dealings with suspected Islamic State members. See “Flawed Justice: Accountability for ISIS Crimes in Iraq,” Human Rights Watch, December 5, 2017.
[p] At the time of writing, 14 foiled jihadi plots have been proven in court, while the individuals accused over the remaining three alleged plots are yet to face trial. Combining these 17 incidents with the seven violent attacks makes for the total of 24 jihadi plots (though three are currently unproven). For details on each of these incidents, see Andrew Zammit, “Proven and alleged terrorist plots in Australia since September 2014,” Murphy Raid blog, last updated April 16, 2020.
[q] There had also been several jihadi bomb plots in Australia before the Islamic State’s rise, such as the plot foiled in 2005 when two terrorist cells in Melbourne and Sydney were disrupted by an investigation called Operation Pendennis, a Lashkar-e-Taiba bomb plot in Sydney foiled in 2003, and an al-Qa`ida bomb plot that fell apart in 2000. See Andrew Zammit, “Explaining a turning point in Australian jihadism,” Studies in Conflict & Terrorism 36:9 (2013): pp. 739-755.
[r] Another potential exception is the Brussels airport bombing in March 2016, though this targeted an unsecured part of the airport rather than a plane flight.
[s] These are not Khaled Khayat’s exact words, but the police notes paraphrasing his comments. “R v Khayat (No 3) [2019] NSWSC 1316 (14 March 2019),” p. 21; Mette Mayli Abaek, Jens Vithner, and Troels Kingo, “Dømt australsk terrorist: Basil Hassan bag bombe på russisk fly,” DR, November 6, 2019.
[t] In 2016, Petter Nesser, Anne Stenerson, and Emilie Oftedal argued that the Islamic State’s use of chemical weapons in Syria and Iraq could foreshadow the use of such weapons in Europe. Noting the difficulty of smuggling chemical weapons into Europe, they suggested it was more likely that “that IS bomb-makers devise a way to make improvised chemical bombs from available materials.” Though this plot was in Australia rather than Europe, Nesser, Stenerson, and Oftedal’s warning proved prescient. See Petter Nesser, Anne Stenersen, and Emilie Oftedal, “Jihadi Terrorism in Europe: The IS-Effect,” Perspectives on Terrorism 10:6 (2016): pp. 19-20. For more on the Islamic State’s chemical weapon use, see Eric Schmitt, “ISIS Used Chemical Arms at Least 52 Times in Syria and Iraq, Report Says,” New York Times, November 21, 2016.
[u] There were some possible CBRN efforts in the Islamic State’s external operations before July 2017, but there is less evidence for this than later. For example, see Dominic Casciani, “Derby terror plot: The online Casanova and his lover,” BBC, January 8, 2018.
[v] This is demonstrated by then Islamic State spokesman Abu Muhammad al-Adnani’s May 2016 speech telling the Islamic State’s transnational supporters to prioritize preparing attacks rather than trying to travel to Syria or Iraq; changes in its online publications, which now provided more detailed instructions on attack methods (such as the “Just Terror Tactics” sections in Rumiyah magazine); and the group’s increased willingness to claim credit for self-starting plots. See Haroro Ingram, “Islamic State’s English-language magazines, 2014-2017: Trends & implications for CT-CVE strategic communications,” ICCT Research Paper, March 2018; Alastair Reed and Haroro J. Ingram, “Exploring the Role of Instructional Material in AQAP’s Inspire and ISIS’ Rumiyah,” Europol Public Information, June 2017; and “Caliphate Soldiers and Lone Actors: What to Make of IS Claims for Attacks in the West 2016-2018,” ICCT Research Paper, April 2019.
[w] Operation Euphrates Shield was a Turkish military offensive launched in August 2016 to deny both the Islamic State and Kurdish military forces access to the Syrian-Turkish border. Can Kasapoglu, “Operation Euphrates Shield: Progress and scope,” Al Jazeera, February 3, 2017; Metin Gurcan, “Assessing the Post–July 15 Turkish Military: Operations Euphrates Shield and Olive Branch,” Washington Institute for Near East Policy, March 2019.
[x] Sometimes, the Islamic State had to use operatives in Turkey to assist with the logistical dimensions of external operations because it was too difficult to bring the plotters to Syria. See Nuno Tiago Pinto, “The Portugal Connection in the Strasbourg-Marseille Islamic State Terrorist Network,” CTC Sentinel 11:10 (2018): pp. 20-21.
[y] Kim Cragin and Ari Weil found that the Islamic State’s virtually planned plots were less likely to succeed in causing deaths than either their centrally planned plots or self-starting plots. See Kim Cragin and Ari Weil, “‘Virtual Planners’ in the Arsenal of Islamic State External Operations,” Orbis 62:2 (2018).
[z] At first, the Islamic State’s virtually planned plots tended not to make use of encrypted platforms. For example, Junaid Hussain tried to direct several plots through Twitter Direct Messages, Amedy Coulibaly was guided through emails, and the September 2014 Operation Appleby plot in Sydney was guided through the telephone. See Gartenstein-Ross, Shear, and Jones, p. 34; “Paris attacks: Coulibaly ‘given orders by email,’” BBC, October 13, 2015; “R v Azari (No 12) [2019] NSWSC 314 (29 March 2019).”
[aa] This is an example of kinship recruitment, which is not rare in jihadi plots. For example, Fernando Reinares and Carola García-Calvo noted that four pairs of brothers were involved in the August 2017 Catalonia attacks, and that “the 2013 Boston bombings, the January 2015 Charlie Hedbo attacks, and the November 2015 Paris attacks” similarly involved siblings. Australian jihadi plots have also often involved family connections among the perpetrators. However, the kinship recruitment seen in the 2017 Sydney plane plot (where one of the Islamic State’s cybercoaches in Syria helped guide a plot by their siblings who lived in another country) appears to be unusual among the Islamic State’s virtually planned plots, as these plots often involved cybercoaches reaching out to individuals to whom they had no previous connections. Fernando Reinares and Carola García-Calvo, “’Spaniards, You Are Going to Suffer:’ The Inside Story of the August 2017 Attacks in Barcelona and Cambrils,” CTC Sentinel 11:1 (2018): p. 7; Mohammed M. Hafez, “The Ties that Bind: How Terrorists Exploit Family Bonds,” CTC Sentinel 9:2 (2016); Shandon Harris-Hogan, “The Importance of Family – The Key to Understanding the Evolution of Jihadism in Australia,” Security Challenges 10:1 (2014).
Citations
[1] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” http://www.austlii.edu.au/cgi-bin/sign.cgi/au/cases/nsw/NSWSC/2019/1817. The date listed in the titles of all court documents cited in this article refers to the date of the proceeding covered by the document, which will not always be the same as the date of publication.
[2] On the concept of “virtual planning,” also called “virtual plotting,” “virtual entrepreneurs,” “cybercoaching,” “remote contact with directives,” and “remote-controlled,” see Thomas Hegghammer and Petter Nesser, “Assessing the Islamic State’s Commitment to Attacking the West,” Perspectives on Terrorism 9:4 (2015): p. 22; Bridget Moreng, “‘ISIS’ Virtual Puppeteers: How They Recruit and Train ‘Lone Wolves,’” Foreign Affairs, September 21, 2016; Thomas Joscelyn, “Terror plots in Germany, France were ‘remote-controlled’ by Islamic State operatives,” Long War Journal, September 24, 2016; Daveed Gartenstein-Ross and Madeleine Blackman, “ISIL’s Virtual Planners: A Critical Terrorist Innovation,” War on the Rocks, January 4, 2017; Rukmini Callimachi, “Not ‘Lone Wolves’ After All: How ISIS Guides World’s Terror Plots From Afar,” New York Times, February 4, 2017; Seamus Hughes and Alexander Meleagrou-Hitchens, “The Threat to the United States from the Islamic State’s Virtual Entrepreneurs,” CTC Sentinel 10:3 (2017); Andrew Zammit, “The Role of Virtual Planners in the 2015 Anzac Day Terror Plot,” Security Challenges 13: 1 (2017): pp. 42-47; Kim Cragin and Ari Weil, “‘Virtual Planners’ in the Arsenal of Islamic State External Operations,” Orbis 62:2 (2018); John Mueller, “The Cybercoaching of Terrorists: Cause for Alarm?” CTC Sentinel 10:9 (2017): pp. 29-35; Andrew Zammit, “Islamic State’s virtually planned terror plots: a note on current and future research,” VOX-Pol Blog, November 21, 2018; Michael Shkolnik and Alexander Corbeil, “Hezbollah’s ‘Virtual Entrepreneurs:’ How Hezbollah is Using the Internet to Incite Violence in Israel,” CTC Sentinel 12:9 (2019): pp. 28-37; Daveed Gartenstein-Ross, Matt Shear, and David Jones, “Virtual Plotters. Drones. Weaponized AI?: Violent Non-State Actors as Deadly Early Adopters,” Valens Global, November 2019.
[3] This article also builds on, and updates, the author’s previous article on this operation which was written shortly after the plotters’ arrests. Andrew Zammit, “New Developments in the Islamic State’s External Operations: The 2017 Sydney Plane Plot,” CTC Sentinel 10:9 (2017): pp. 13-18.
[4] Ellen Whinnett, “Dark past of Khayat family,” Herald Sun, September 7, 2018.
[5] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” pp. 6, 34; “Khayat, Khaled,” National Archives of Australia, series no: A8299, control symbol: 1987/5326, item barcode: 21008788, p. 16.
[6] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 34.
[7] Ibid., p. 6.
[8] Ibid., p. 36.
[9] Ibid., p. 36.
[10] Ibid., pp. 6, 36.
[11] Paul Maley and Jacquelin Magnay, “Terror Brother Who didn’t Fit in,” Australian, September 21, 2019.
[12] Whinnett, “Dark past of Khayat family;” Jacquelin Magnay, “Alleged bomb plotters sent cash to Lebanon, court told,” Australian, September 7, 2018.
[13] Loveday Morris, “Young Lebanese fighters leaving Syria for battle closer to home,” Washington Post, May 21, 2013; Stefan Simanowitz, “A Syrian Proxy War Is Being Fought in Tripoli,” Vice, May 29, 2013; “Lebanon: Sectarian Attacks in Tripoli,” Human Rights Watch, December 19, 2013; “Khayat, Khaled,” National Archives of Australia, series no: A8299, control symbol: 1987/5326, item barcode: 21008788, p. 16.
[15] “Lebanon army back in control of Tripoli,” Al Jazeera, October 29, 2014.
[17] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 8.
[18] Harvey.
[19] “Hvem er den Danske Topterrorist Basila Hassan?” DR, 2019.
[20] Petter Nesser, Islamist Terrorism in Europe: A History (London: Hurst & Company), p. 284.
[21] Ibid.
[22] Mette Mayli Albaek and Louise Dalsgaard, “PET: Basil Hassan steg hurtigt i graderne hos Islamisk Stat,” DR, September 19, 2019.
[23] Ibid.
[24] Nesser, Islamist Terrorism in Europe: A History, p. 204.
[27] Mette Mayli Abaek, Sara Munck Aabenhus, Troels Kingo, Puk Damsgard, and Jens Vithner, “Basil Hassan bag omfattende terrorplan: Passagerfly skulle sprænges i luften,” DR, April 15, 2019.
[29] “Dronekrigeren – Danmarks farligste terrorist,” Part 1, DR, April 7, 2019.
[30] Maley and Magnay.
[32] Maley and Magnay.
[33] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 7.
[34] Ibid., p. 6; Whinnett, “Dark past of Khayat family.”
[35] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 8.
[36] Ibid., p. 8.
[38] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” pp. 7-8.
[39] Ibid., p. 9.
[40] Ibid., p. 9.
[41] Paul Maley, “From Syria to Sydney: How the Scheme Unfolded,” Australian, August 5, 2017; Ellen Whinnett, “Evil Engineer,” Herald Sun, September 21, 2019; Abaek, Aabenhus, Kingo, Damsgard, and Vithner.
[42] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 9.
[44] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” pp. 9-10.
[45] Ibid., p. 11.
[46] Maley.
[47] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 11.
[48] Ibid., p. 11.
[50] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 12.
[51] Ibid., p. 12.
[53] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 12.
[54] Ibid., pp. 12-13.
[55] Ibid., p. 14.
[56] Ibid., p. 14.
[57] Ibid., p. 13.
[58] Ibid., p. 13.
[59] Ibid., pp. 13-18.
[60] Ibid., p. 13.
[61] Ibid., p. 14.
[62] Ibid., p. 14.
[63] Ibid., p. 14.
[64] “R v Khayat (No 6) [2019] NSWSC 1318 (16 April 2019),” p. 6.
[65] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 16.
[66] Ibid., p. 17.
[67] Ibid., p. 17.
[68] Ibid., p. 18.
[70] Ibid., p. 8.
[71] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 16.
[73] “AFP and NSWP Discuss the Two Sydney Men Charged over Alleged Terrorist Acts.”
[74] “R v Khayat (No 4) [2019] NSWSC 1317 (14 March 2019),” p. 10.
[75] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 20.
[76] Ibid., p. 20.
[77] Ibid., p. 21.
[78] Ibid., p. 21.
[79] Ibid., p. 23.
[80] Ibid., p. 23.
[81] “AFP and NSWP Discuss the Two Sydney Men Charged over Alleged Terrorist Acts.”
[84] Riley Stuart and Louise Hall, “Sydney Terror Plot: How Police Dismantled Alleged Islamic State Plan Hatched on Home Soil,” ABC News, August 3, 2017; Abaek, Aabenhus, Kingo, Damsgard, and Vithner; Rachel Olding, “Lebanese Authorities Monitored Australian Bomb Plot Suspects: Minister,” Sydney Morning Herald, August 22, 2017.
[85] “R v Khayat (No 3) [2019] NSWSC 1316 (14 March 2019),” p. 8.
[86] “AFP and NSWP Discuss the Two Sydney Men Charged over Alleged Terrorist Acts.”
[87] “R v Khayat (No 3) [2019] NSWSC 1316 (14 March 2019),” p. 8.
[88] Ibid.
[89] “R v Khayat (No 6) [2019] NSWSC 1318 (16 April 2019),” p. 3.
[90] Ibid., p. 2.
[91] Jodie Stephens, “NSW court dismisses man’s weapons charge,” Bendigo Advertiser, May 30, 2018.
[92] “R v Khayat (No 11) [2019] NSWSC 1320 (6 June 2019),” p. 2.
[93] Ibid., p. 2.
[94] Ibid., p. 2; Jonathan Hair, “Jury discharged in meat grinder bomb plot case, fails to reach verdict on Mahmoud Khayat,” ABC News, May 3, 2019.
[95] “R v Khayat (No 11) [2019] NSWSC 1320 (6 June 2019),” p. 2.
[97] “Second Sydney brother found guilty of Etihad meat grinder bomb plot,” Guardian, September 20, 2019.
[98] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 1.
[99] Ibid., p. 1.
[101] Harvey.
[102] Abaek, Aabenhus, Kingo, Damsgard, and Vithner.
[103] Mette Mayli Abaek, “Analyse: Heldigvis for PET handler terrorsager ikke kun om straf,” DR, December 7, 2019.
[105] Harvey and Yazbeck, “Amer Khayat freed from Lebanese prison.”
[106] See, for example, Jack Moore, “Lebanon Foiled ISIS Barbie Doll Bomb Plot on Flight From Australia to Abu Dhabi,” Newsweek, August 21, 2017, and Ellen Whinnett, “Tarek Khayat: Alleged Barbie doll bomb plot ringleader revealed,” Daily Telegraph, September 6, 2018.
[107] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019),” p. 25.
[109] For these other four virtually planned plots in Australia, see “R v Azari (No 12) [2019] NSWSC 314 (29 March 2019),” http://www.austlii.edu.au/cgi-bin/viewdoc/au/cases/nsw/NSWSC/2019/314.html; “R v Al-Kutobi; R v Kiad [2016] NSWSC 1760 (9 December 2016),” http://www.austlii.edu.au/cgi-bin/viewdoc/au/cases/nsw/NSWSC/2016/1760.html; “The Queen v Besim [2016] VSC 537 (5 September 2016),” http://www.austlii.edu.au/cgi-bin/viewdoc/au/cases/vic/VSC/2016/537.html; “The Queen v M H K [2016] VSC 742 (7 December 2016),” http://www.austlii.edu.au/cgi-bin/viewdoc/au/cases/vic/VSC/2016/742.html.
[111] “The Queen v M H K [2016] VSC 742 (7 December 2016);” “The Queen v Abbas [2018] VSC 553 (20 September 2018),” http://www.austlii.edu.au/cgi-bin/viewdoc/au/cases/vic/VSC/2018/553.html; “The Queen v Abbas, Chaarani & Mohamed [2019] VSC 775 (29 November 2019);” “Bourke Street attacker ‘failed in his plan to cause explosion,’” SBS News, November 12, 2018.
[112] “R v Khaled Khayat; R v Mahmoud Khayat (No 14) [2019] NSWSC 1817 (17 December 2019);” Rodger Shanahan, “Typology of Terror — The Backgrounds of Australian Jihadis,” Lowy Institute for International Policy, November 21, 2019, p. 5.
[114] David E. Sanger and Eric Schmitt, “U.S. Cyberweapons, Used Against Iran and North Korea, Are a Disappointment Against ISIS,” New York Times, June 12, 2017; Callum Paton, “Israel Hacked ISIS Cell to Uncover Laptop-Bomb Plot to Down International Flights,” Newsweek, June 12, 2017.
[118] “Aviation Security Enhancement Program,” Australian Federal Police, December 12, 2019.
[119] “Air cargo and aviation,” Department of Home Affairs, March 17, 2020.
[120] Mariyam Afaaf Adam, “ISIS attempted to carry out an airliner bombing in the Maldives, says Police,” Raajje Mv, December 16, 2019; Shahudha Mohamed, “Police confirm 2017 terrorist bomb attempt in Maldives,” Edition, December 16, 2019.
[123] Ibid., p. 29.
[124] Robin Simcox, “The Post-Caliphate Terror Threat in Europe—and the Need for Continuing U.S. Assistance,” Heritage Foundation, August 19, 2019, p. 5.
[126] “France foils possible ricin plot by Egyptian-born student,” Reuters, May 18, 2018.
[128] “Italy arrests IS suspect over poison plot,” France 24, November 28, 2018.
[130] Ibid.
[132] Cragin and Weil.
[133] Gartenstein-Ross, Shear, and Jones, pp. 37-38.
[134] Mueller, p. 29.
[135] Callimachi; Cragin and Weil; “The Failed Solo Suicide Bombing and Bahrun Naim’s Network,” Institute for the Policy Analysis of Conflict, July 2016.
[136] Paul Cruickshank described it as such. See “Mueller Exploring Financials of Trump; Starr on Fishing Expedition; Grand Jury Subpoenas in Russia Probe; McMaster At War with Trump’s Base; Sydney Police Foil Terror Plan. Aired 2-2:30p ET,” CNN Newsroom, August 4, 2017.
[138] Simcox, p. 10.
[139] “Oxford Street terror plotter Lewis Ludlow jailed,” BBC, March 6, 2019.
[143] Adam Goldman and Eric Schmitt, “One by One, ISIS Social Media Experts Are Killed as Result of F.B.I. Program,” New York Times, November 24, 2016; Thomas Gibbons-Neff, “Rachid Kassim, ISIS recruiter and failed rapper, targeted in U.S. airstrike,” Washington Post, February 11, 2017; “Letter dated 16 July 2018 from the Chair of the Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015) concerning Islamic State in Iraq and the Levant (Da’esh), Al-Qaida and associated individuals, groups, undertakings and entities addressed to the President of the Security Council,” United Nations Security Council, July 27, 2018, p. 6.
[144] Audrey Alexander, “Digital Decay? Tracing Change Over Time Among English-Language Islamic State Sympathizers on Twitter,” Program on Extremism, George Washington University, October 2017; Michael Martelle, “USCYBERCOM After Action Assessments of Operation GLOWING SYMPHONY,” National Security Archive Briefing Book, January 21, 2020.
[147] Mueller, pp. 29-35.
