Financing of terrorism

Recent EU terrorist attacks have been funded by an opportunistic mix of licit and illicit sources. Up to 40% of terrorist plots in Europe are believed to be at least partly financed through crime, especially drug dealing, theft, robberies, the sale of counterfeit goods, loan fraud, and burglaries. Using funds raised through criminality is regarded an ideologically correct and legitimate way of financing ‘jihad’ in the ‘lands of war’ .

Terrorists in 2016 were agile in the diversity of their funding mechanisms, both from legal and illegal sources. The young ages of a large proportion of jihadists, the majority of whom are computer literate, has caused an increase in the use of modern technological financial services. These financial services and applications, including financial low transfer apps, are fluid, encrypted and partially anonymised, allowing a desirable financial conduit for terrorists who seek a borderless, reliable and shielded financial mechanism, optimised and readily accessible for real-time small value transfers.

2016 has seen lower amounts of funds moved regularly through the financial sector. These small denomination values sent by supporters and family members are transferred to support FTFs and their organisational expenses .

FThe Internatonal Centre for the Study of Radicalisaton and Politcal Violence (ICSR), “Criminal Pasts, Terrorist Futures: European Jihadists and the New Crime-Terror Nexus”, 2016.

Travel for terrorist purposes

More than 5000 individuals emanating from the EU are believed to have travelled to conflict areas in Syria and Iraq. As was observed in 2015, individuals from Belgium, France, Germany and the UK account for the majority of this total. On a per capita basis, Belgium appears to have the highest numbers. In addition, more than 800 persons are believed to have travelled to Syria and Iraq from the Western Balkan countries, predominantly joining IS. There is also likely to be a ‘dark number’ of travellers to and from Syria and Iraq that have not yet been detected. Turkey reported that, as of November 2016, it had approximately 7670 individuals from EU MS on a suspected FTF no-entry list. A number of countries, including the Netherlands, France, Denmark, Sweden, Austria, Germany and Switzerland reported that, since the beginning of 2016, the flow of jihadists travelling to conflict zones abroad - especially Syria and Iraq - has apparently continued to decline. Nonetheless, Germany and Italy for example, maintain that the level of departures remains high or constant.

The sustained pressure facing IS in Syria and Iraq due to the air strikes and ground offensive of the anti-IS coalition is likely to be the main reason for the general decline in outgoing travellers. The air assaults have also targeted IS’s financial structures, which has led to decreased incomes for FTFs. Moreover, it has become increasingly difficult to cross the Turkish border to Syria. Neighbouring countries have improved their border security and, since IS does not control the border area anymore, it is now more difficult to reach the territory it does control. Furthermore, IS leadership and messaging has indicated that their sympathisers should no longer go to Syria and Iraq, but should instead join IS branches in other countries or focus on attacks in their homelands.

Attack planning against the EU and the West in general continues in Syria and Iraq. Groups including IS and al-Qaeda have both the intent and capability to mount complex, mass-casualty attacks. It is believed that there is not a lack of volunteers for such operations. The 2016 attacks in Brussels in March, then in Istanbul in June, appeared to demonstrate the ongoing effectiveness of IS’s external operations capability. The Paris and Brussels attacks again showed that terrorist networks directed from Syria can rely on the help of sympathisers in Europe who have never been to Syria themselves.

According to the Netherlands for example, it is possible that there are still dozens of IS operatives (attackers sent by IS, and their accomplices) in Europe. Italy reported concerns of potential sleeper cells from the external operations unit of IS or al-Qaeda operatives and affiliated organisations inspired by jihadist ideology.

Germany asserted that there is no doubt about the firm determination of all internationally focused jihadist groups to seize every opportunity to carry out an attack in a Western country, but that despite this determination, in recent years, the planning and execution of such attacks has shifted mainly to lone actors or small groups without direct links to an organisation - modifying the threat situation accordingly. Furthermore, Germany assessed that individuals who have either been prevented from travelling abroad or failed to travel for other reasons should be regarded as particularly dangerous in view of the fact that their ideological delusion and propensity for violence are strongest at the time of the planned departure.

Ongoing contact on social media between combatants in Syria/Iraq and ‘stay-at-home jihadists’ fuels the enduring potential threat posed by jihadist networks; now that leaving the country to take part in jihad has become more difficult, would-be attackers may indeed shift their focus to their countries of residence. IS also supports the interactions between some of its fighters in the region and individuals recruited back in the EU (for example, in the jihadist milieu in France) in order to carry out violent actions on home soil. These recruitments are made via encrypted social networks such as Telegram.

Several countries, including Italy and Switzerland, stated that one of the greatest risks to their domestic security is posed by lone actors or small groups, be they self-radicalised individuals or returning FTFs.


The UK were amongst countries that reported an increase in the number of women, families and minors engaging in the conflict in Syria/Iraq, although they remain a small proportion of overall travellers. They also reported that the average age at time of travel of those engaging in the conflict has reduced significantly; nearly half of those travelling aged 18 and under have departed since the declaration of IS’s ‘caliphate’ in July 2014. Poland stated that its citizens who travelled are all less than 22 years old. Although overall figures for the EU are not available, of further concern is that by the end of 2016 the Netherlands recorded a total of over 40 children (age 0-12 years) that have travelled to Syria or Iraq with their parents. Austria noted that women, including minors, leave or want to leave for the conflict zones and that some women married FTFs in Syria under Islamic law, partly via social media.

Denmark stipulated that only very few persons departed in 2016. The vast majority of these travellers were young women. In general, women account for nearly one eighth of the total number of travellers from Denmark. They also noted that more women play an active and independent role within jihadist circles in Denmark, and may consequently have an increasingly radicalising effect on their associates and families.

Belgium reported that returning women (and children) are of concern, due to the apparent involvement of female activists in the preparation of attacks. Some may also have received military training. In addition, IS propaganda has repeatedly depicted the training and indoctrination of minors.

However, Spain reported a decrease in the number of women arrested in 2016, and that only one was willing to travel to the conflict zone. The average age of arrestees in Spain was 31 (an increase of 2 years from the previous reporting period). A minor was taken into care due to his parents’ arrest, after they attempted to travel to the conflict zone.


Most of the FTFs appear to return to Europe through the same route they used for their outbound travel, i.e. mainly taking indirect flights from Turkey and through other European countries. Portugal, for example, reported that those on their way to the conflict areas used not only Lisbon airport, but also more recently the airport in Porto (taking advantage of the new connection to Istanbul). Travel also occurred via the so-called Balkan route. Hungary and Poland reported that they were used as transit countries for FTFs travelling to or from Syria/Iraq. Romania was transited by a limited number of FTFs on their way to and from the conflict areas, the country not being positioned on the route most often used by them. Cases of individuals transiting through Switzerland were also reported, highlighting the risk of Switzerland serving as a logistical base to prepare attacks elsewhere.

Facilitation activity continued in 2016. In Italy for example, investigations led to the arrest of 19 people involved in recruitment for IS and facilitating the movement of FTFs to combat zones. In Switzerland, police operations led to the discovery of a recruiting cell composed of a number of individuals involved in facilitating the travel of Swiss and Italian residents to Syria. This cell also benefited from the logistical support of associates located in Turkey; the main suspect in this case was a Swiss-Turkish dual citizen who supported the ideology of Jabhat Fath al-Sham (former al-Qaeda affiliate Jabhat al-Nusra). Denmark reported that recruitment, radicalisation and facilitation of people and resources to the conflict zone takes place in circles that are less visible and organised than previously observed.

It appears to have become increasingly harder to leave IS territory. Italy reported only one returnee to Europe in 2016 and Denmark reported that the number of returnees from Syria/ Iraq has been declining since mid-2014. The Netherlands also stated that there have been only a few new returnees in the past two years (four in 2016), but that there have recently been indications that a number of Dutch men and women would like to leave Syria.

It is important to emphasise that a particularly strong security threat is posed by individuals who have received prolonged ideological indoctrination, military training in the use of weapons and explosives, or have gained combat experience during their stay in a conflict region. They may also have established links to other FTFs abroad and become part of capable transnational networks. These returning fighters will have increased proficiency in terms of carrying out attacks, either under direction or independently. In addition it is assessed that individuals who have joined terrorist groups like IS will be more brutalised and prone to violence; the influence being greater if their stay was lengthy. They may also have developed a high degree of security awareness. Moreover, some returnees will perpetuate the terrorist threat to the EU through radicalising, fundraising and facilitation activities.

The first groups of returnees were often disappointed with their situation in the ‘caliphate’. The motivations of the more recent ones are not yet entirely clear. The subsequent activities of the returnees from the conflict regions are reported to be diverse. They range from followers, who reduce their involvement in the jihadist milieu (even to the point where such activities are no longer noticeable), to persons prone to violence. However, it has been suggested (by Germany for example) that a disposition to jihadist ideology is likely to prevail, which, under certain conditions, allows the subject’s mobilisation at short notice. Denmark also noted that the threat from returning fighters may become apparent within a very short time frame, but may remain dormant and not appear until a triggering event.

As reported in the 2016 TE-SAT, the irregular migrant flow was exploited in order to dispatch terrorist operatives clandestinely to Europe (in regards to the November 2015 Paris attacks). The procurement and use of high quality false administrative documents was also successfully applied by terrorist operatives (for example by those involved in the March 2016 Brussels attacks). Over this reporting period, the Netherlands stated that in some cases IS operatives have applied for asylum in European countries.

A case in Switzerland involved three suspects purporting to be Syrian refugees and asylum-seekers. Two of them arrived in Switzerland with humanitarian visas and at the time of writing were being investigated as potential IS members.

Italy also stated they have had cases of refugees with previous jihadist backgrounds; and Austria reported it had several cases of individuals suspected of terrorism among the migrants staying in, or travelling through, its territory.


Even though terrorists use a wide range of readily available weapons, explosive devices continue to be used in terrorist attacks, due to their high impact and symbolic power. In 2016, the transfer of terrorist tactics, techniques and procedures (TTPs) from the current conflict zones and illicit spread of bomb-making knowledge and instructions has been observed. The availability of explosive precursors has facilitated the use of Home-Made Explosives (HMEs). Of particular concern are improvised explosive device (IED) attacks on soft targets and the use of suicide person-borne IEDs (PBIEDs).


Jihadist terrorist IED attacks generally aimed at soft targets, with the main intention of causing a large number of civilian casualties. In recent years, targets included air and rail transport facilities, commercial premises and major sports events.

Two distinct trends have been observed with regards to jihadist terrorists’ use of IEDs in the EU. Firstly, IEDs have been reported to show similarities in design and construction with IEDs used in conflict zones. Some elements of these IEDs appeared to have been modified based on available resources and circumstances in the EU. For example, HMEs and improvised components were used in place of military components that are difficult to procure. Such devices have been more prevalent in attacks by terrorist groups and lone-actors directed by IS. These incidents commonly required additional logistical support and specific knowledge in the manufacturing of larger amounts of HMEs. Nonetheless, these IEDs were not particularly sophisticated but relatively reliable and simple to use. Bomb-making knowledge, in some cases, was transferred to the attackers through direct contact and experience (facilitated by foreign terrorist fighters and returnees). In other cases, knowledge and guided instructions have been transferred via ‘remote assistance’ using various social media and online communication channels.

Secondly, more rudimentary IEDs have been used by jihadist terrorists recently. These mostly consisted of readily available explosive components, such as gas cylinders, pyrotechnic articles and ammonium nitrate-based products. Such IEDs can be constructed without any specific expertise, preparation, extensive planning or logistical support. They have been primarily used by small terrorist groups or self-radicalised lone-actor terrorists inspired by IS. It is also notable that IS has started to promote the use of readily available flammable products to construct basic improvised incendiary devices (IIDs) and commit arson attacks – a new simple terrorist tactic recommended for lone-actors.

Regarding the potential use of alternative and more sophisticated types of IEDs, the current trend in using weaponised unmanned aerial vehicles (UAVs) in the Syria/Iraq conflict zone might also inspire other jihadist supporters and expand the use of this kind of tactic outside this area of operation.

Additionally, as seen in recent attacks in Egypt and Somalia, threats posed to civil aviation by IED attacks are still present. Main threats emanate from the use of concealed and hardly detectable IEDs and facilitation by affiliates working as airport employees to bypass security checks.

Groups and individuals belonging to the extreme right-wing scene maintained their affinity to weapons and explosives. This was illustrated by the significant increase in the number of incidents involving arson and explosives, as well as seized explosive devices. In addition to common types of IIDs/IEDs such as Molotov cocktails and improvised pipe bombs, these groups tend to use military-grade explosive devices.

Left-wing and anarchist groups have predominantly carried out arson attacks using flammable liquids and IIDs, such as Molotov cocktails and gas cylinders. Nevertheless, an increase has been noted in the number of terrorist attacks in which perpetrators constructed and delivered postal IEDs/IIDs filled with incendiary or low-explosive charges, such as gunpowder. In general, all devices have been constructed from improvised material readily available on the open market.

The attack methodologies and capabilities used by Dissident Republican (DR) groups in Northern Ireland (UK) varied across groups. Many attacks involved firearms or small IEDs such as pipe bombs but they have also employed larger and/or potentially more destructive devices such as vehicle-borne IEDs (VBIEDs) and explosively formed projectiles (EFPs). There have been four DR IED attacks in 2016 including a fatal IED attack on a prison officer. All groups retain access to a range of firearms and explosives and there is an ever-present threat of under-vehicle IED attacks.


HMEs have been the most common type of explosive used in recent terrorist IED attacks. The explosive used in most of the attacks was triacetone triperoxide (TATP), a home-made explosive that remains the explosive of choice for terrorists. The internet continues to be a crucial resource for loneactor terrorists to gain bomb-making skills. Internet websites, forums, social networks and the Darknet facilitate access to bomb-making knowledge and information.


The availability of explosives in current and former conflict areas such as the Western Balkans and Ukraine, and the illicit trafficking of explosives into the EU, is believed to present a significant threat. Terrorists are known to have acquired hand grenades, rocket launchers and high-grade plastic explosives and detonators from organised crime groups (OCGs).

In addition to trafficking explosives, other methods of obtaining military explosive ordnance include thefts from military explosives storage facilities and the illegal collection of explosive remnants of war (ERW) and unexploded ordnance (UXO) from former battle zones.


Commercial pyrotechnic articles and gunpowder continue to be misused for terrorist purposes as a source of explosive compounds for constructing IEDs. These pyrotechnics are widely available, and the use of pyrotechnic mixtures in IEDs is promoted in jihadist terrorist publications. This threat might increase in the future. Misuse of pyrotechnics has been observed in most EU countries. The pyrotechnic articles have been used in various forms: in the original state; modified; or by extracting the pyrotechnic mixture and utilising it in IEDs. Pyrotechnics have largely been used in small-scale bomb attacks. The most frequently used types have been the categories F3 and F2, which are sold to the general public. However, it appears that the misuse of professional category F4 flash bangers has increased in the recent period.

Chemical, biological, radiological, nuclear (CBRN)

To date, no large-scale CBRN attacks in the EU by any terrorist group have been reported. However, IS has significantly improved its capacity to produce explosives and improvised explosive devices through the adaptation of existing military ordnance stolen or retrieved from abandoned or conquered military facilities. There is concern that they have also accumulated knowledge to develop CBRN weapons that could later be used in attacks. In territories under its control, IS might have gained control of CBRN facilities (abandoned military and industrial facilities, laboratories or stockpiles) allowing access to chemical agents. In addition, the group might have recruited, voluntarily or by force, scientists previously working in the chemical, biological or radio-nuclear sectors. The Organisation for the Prohibition of Chemical Weapons– United Nations (OPCW-UN) Joint Investigative Mechanism confirmed that IS has used chemical weapons in Syria.

Furthermore, in 2016, CBRN-related topics continued to appear in terrorist propaganda. Various jihadist media outlets used social media channels, in particular Telegram, to express intentions to commit CBRN attacks, share possible tactics for attacks and suggest targets. For example, in May 2016, a jihadist tutorial on ricin toxin extraction, addressing lone actors, was published online.

Food contamination threats

Threats to intentionally contaminate food or water occurred in 2016, both in criminal and extremist contexts. In two cases, anarchists threatened to use toxic chemicals. In June, Italian anarchists threatened to poison foodstuff in supermarkets in Lombardy using herbicide. The campaign aimed to protest against the use of toxic chemicals in the agriculture, engineering and food production industries. Those anarchists posted a technical description of the methods to be used and a list of potential targets on their website. In December, Greek anarchists published a warning claiming that they had contaminated several food and drink products of multinational companies. Their operation, “Green Nemesis #2”, was planned to take place between Christmas and New Year in Athens, Greece. The warning message posted on the anarchist website explained how to introduce chlorine and hydrochloric acid into products while leaving packaging intact. Similar threats to contaminate beverages were also expressed in December 2013.

Use of radioactive materials

In November 2016, several Slovak institutions including the Ministry of Justice, district courts and a regional police office, received suspicious envelopes containing anonymous letters. The letters expressed dissatisfaction with the judicial system and mentioned a lost court trial. One letter referred to radioactive contamination and incidents in 2015 and 2016 when employees of various judicial institutions were exposed to radioactive material emitting alpha-particles. Further laboratory expertise confirmed the presence of small amounts of radioactive Americium-241 in the envelopes. The case was investigated by the Slovak authorities as an act of terrorism. This incident demonstrated that certain CBRN materials that are commonly used in various civilian applications, in particular radioactive substances, can be acquired by criminals or terrorists due to inadequate security measures.