IBC Threat Assessment July 2015


This month’s Threat Assessment includes:

  • Drinking water supply of Kosovo capital Prishtina temporarily cut off due to alleged Daesh-linked poisoning plot
  • No terrorist CBRN attack in EU region during to 2014 according to EUROPOL
  • IAEA to publish extensive assessment of the Fukushima Daiichi disaster at its upcoming 59th Annual Conference in September
  • Jihadist groups add tunnel bombs to their tactical repertoire in several jihadi theaters

The IBC Threat Assessments are based on open sources. End date of collection: July 25, 2015.


Drinking water supply of Kosovo capital Prishtina temporarily cut off due to alleged Daesh-linked poisoning plot

On July 11, Kosovo authorities temporarily cut off the water supply to almost half of the population of the capital Pristina due to an alleged Daesh-linked poisoning plot. Patrolling policemen arrested three men behaving suspiciously on a road near Lake Badovac, an important drinking water reservoir. Two other suspects were arrested later.

The five suspects have been identified as Enis Latifi, Besnik Latifi, Gazmund Haliti, Milazim Haxhijaj and Fahmi Musa. On July 12, the Basic Court in Pristina ordered a month’s detention for all of them.

berto cOn the day of their arrest a document, possibly an internal police circular, was leaked to the press saying that police had received details about a possible attempt to poison water supplies in both Skopje, Macedonia, and Pristina, Kosovo. The Water Supply Company Pristina turned on the water supply again after tests of water samples had shown no signs of contamination. Although a press report said that a poison was found in a bag of one of the suspects, it was not further identified. None of the media reports provided any context on the technical feasibility of poisoning the water supply of a large city.

Police had been an alert due to a Daesh propaganda video warning of attacks against various targets, including water supplies. The Kosovo Security Service reportedly also had information about an attack order by a close associate of Lavdrim Muhaxzeri, a Kosovar jihadist currently in Syria, who had been reported dead in August 2014 in a battle with the Kurds. The associate who was not further identified allegedly had contacted operatives from Macedonia and Kosovo and ordered them to execute attacks in June.

Lavdrim Muhaxzeri is linked to a recent attack on a border police station in Gosince (Kosovo) on April 21 and a clash with the police in Kumanovo (Macedonia) on May 9. It is assumed that these attacks were intended to spark a wider conflict. Muhaxheri has distributed a number of propaganda videos from Syria where he commands an Albanian platoon within Daesh. He has been charged by the Basic Court in Urusovac with terrorist activities and organizing a group to wage war in Syria and Iraq.

Retired general Momir Stoyanovic, a former high-standing security service official, had warned in late June that Kosovo terrorists planned to commit three terrorist acts in central and southern areas of the country. This warning and the information on the attack order and the propaganda video led to stepped up security measures in Macedonia and Kosovo. The National Institute of Public Health called for stepped up vigilance and protection of water resources, including the initiation of a protective zone around Lake Badovac.

Kosovo is facing a growing jihadist problem. In April the Kosovar Center for Security Studies concluded that Kosovo contributed the highest number of militants per capita to militant organizations in Syria and Iraq. Figures up to mid-January 2015 state that 232 Kosovars are confirmed to have joined jihadist organizations in Syria and Iraq. Kosovo security forces have stepped up operations to prevent potential jihadists from traveling to Syria and Iraq. The Ministry of Interior has stated that about 300 Kosovars have joined the ranks of Daesh and about 15 of them have been killed.  In May about 30 Kosovars were found guilty of having ties to Daesh. In March new anti-terrorism legislation was introduced allowing for harsher punishments.

The alleged poisoning threat preceded the visit of Victoria Nuland, the US Deputy Secretary of State for European and Eurasian Affairs, to Kosovo. One of the issues to be discussed was the introduction of a special court to try former Kosovo Liberation Army (KLA) commanders for war crimes. The US and the EU have been pushing for the creation of a special court, which is widely resisted in Kosovo. It is expected that the Kosovo government will resubmit the draft amendments to the assembly after Nuland’s visit.

The proposed court will be integrated in Kosovo’s own legal system but will have special status. Tribunal sessions will be held abroad and the judges, prosecutors and the staff will be international. If the Kosovo parliament approves of the special court it will have to adopt new legislation and amend the constitution for the establishment and operation of the special judicial chambers.


Since the end of the Balkan war in the 1990s, radical Islam gained ground in several parts of the region. A growing number of terrorist groups are active in the region and foreign organizations are actively recruiting fighters for the jihad in the Middle East. The region is seen by islamist organizations as part of the ‘Green Corridor’, that eventually may result in the establishment of a Muslim state in Europe.

The recent developments in Kosovo and Macedonia are part of this development and are likely to escalate further in the coming period. Via its propaganda Daesh is trying to expand its footprint in the Balkan. It is expected to continue its recruitment of fighters for the struggle in the Middle East and step up activities in the Balkan region itself. The period of Ramadan usually is accompanied with a higher level of violent activity. But also after the Ramadan terrorist activity in the Balkan is expected to increase due to the weakness of the security forces and law enforcement. The introduction of new anti-terrorism legislation allowing for harsher punishments has only a limited deterrence effect.

It is difficult to assess whether there was a real threat to the drinking water supply in Pristina. There have been threat videos before in which threats were issued against drinking water facilities in other countries, e.g. Spain. These were mostly general threats that did never materialize and were not linked to active attack planning. In fact, poisoning the water supply is technically quite difficult due to safety measures and the limited number of poisons that could be used to have a significant impact. For a significant effect substantial amounts of poison are needed. The acquisition and transport of big quantities of poison are likely to trigger the security forces before an attack can be executed.

By not providing the right context of the threat the media indirectly contributed to the level of fear in their audience. Also improved government information could have helped to provide a more realistic perspective of the threat. As this has not occurred it leaves open the option that the threat was deliberately manipulated by the Kosovo authorities to put the security forces and law enforcement on alert for the Victoria Nuland visit and to distract attention from the sensitive political issue of the initiation of a war crimes tribunal for former KLA commanders.






































No terrorist CBRN attack in EU region during to 2014 according to EUROPOL

In the latest annual Terrorism Situation and Trend Report (TE-SAT) EUROPOL reports on developments during the year 2014, which includes a section on CBRN issues. According to EUROPOL there have been no CBRN-attacks in the EU region during 2014. This doesn’t mean that there is no threat. Treats of terrorist attacks using CBRN substances continue to appear on terrorist Internet forums and social media. Closed forums are also used to discuss possible modus operandi for CBRN attacks and to share knowledge via manuals, recipes and information about high profile targets. EUROPOL concludes that the technical information on these forums is not always accurate, but it still may remain a source of inspiration for lone actors.

EUROPOL further reports on the UAV incidents above nuclear facilities that were also covered by IBC last year. The motives behind these incidents are still unclear. EUROPO concludes that the publicity and alarm elicited by the incidents might serve as inspiration to terrorist actors. Nuclear power plants and nuclear power facilities in the EU remain an important target for religious inspired terrorists or groups. EUROPOL concludes, however, that the threats rarely reach the planning stage.

berto bA development of growing concern is the possibility to acquire and sell explosives, firearms, ammunition and CBRN materials and substances via market sites on Internet with restricted access.  These sites can only be accessed with specialized tools. The TE-SAT report mentions a case in which the biological toxin Abrin was purchased this way by at least two individuals in two EU member states.  Sections of this realm of ‘dark space’ on the Internet are inaccessible to government surveillance and governments need the cooperation of internet companies for their investigations. The House Homeland Security Committee dedicated a hearing on this issue in June. Different agencies are currently involved in developing technologies to search and index the Darknet in order to be able to zoom in on specific topics or issues for investigative purposes.

The EUROPOL concern was recently illustrated by the arrest of a man from Liverpool in the United Kingdom who had attempted to acquire 500 grams of ricin via Internet. He had used encrypted communications to order the chemical from an online black market dubbed the Evolution Marketplace. The suspect who had no ties to a terrorist organization allegedly paid $ 500 for five separate vials of ricin to be sent to his home disguised as batteries for a toy car. The seller was an undercover FBI agent. It was the FBI who tipped off British law enforcement that led to the arrest of the suspect, who had conducted Google searches comparing various lethal poisons. He claimed that he had no terrorist intentions and ordered the chemical out of curiosity.


The annual TE-SAT report published by EUROPOL is one of the open source reports on terrorist developments in the EU region largely based on self-reporting by the member states. It is intended not only to provide a factual overview of developments during the year but also to identify areas of concern that need attention of policymakers, intelligence services and law enforcement agencies.

The report rightfully concludes that the security of CBRN in the EU has been improved significantly in recent years, with the implementation of several measures to enhance control over, and to restrict access to a number of CBRN substances. A significant threat still remains, however, as a number of hazardous substances can still be procured and used as weapon with relative ease.  Internet market sites with restricted access increasingly facilitate the acquisition of CBRN materials and substances. One can easily find price lists and available materials and substances. Monitoring of Internet forums indicates that religiously inspired individuals and groups actively discuss modus operandi and exchange technical information. Even if the technical information is not always accurate it may inspire potential perpetrators.

Although TE-SAT specifically emphasizes the threat of the religiously inspired groups and individuals, some of the examples presented in the report were related to an anarchist group and a criminal organization. This means that the threat can come from other groups with different motivations. The recent ricin case in the UK illustrates the undercover presence of law enforcement agencies on Internet black market sites. As there was never a real threat main stream media usually use these incidents to exaggerate the CBRN threat. Research in the US has questioned the use of so-called sting operations by the FBI. Several so-called lone wolf attacks would never have been possible without the entrapment and aid by undercover FBI agents. It is expected that new technologies to better search and index the Darknet will soon allow intelligence and law enforcement agencies to better focus their investigations.









IAEA to publish extensive assessment of the Fukushima Daiichi disaster at its upcoming 59th Annual Conference in September

During its general conference scheduled for September 2015, the IAEA is expected to publish its final report on the Fukushima Daiichi disaster of 2011. The report represents and authoritative factual and balanced assessment of what happened in 2011.  A total of 180 experts from 42 IAEA-member states and several other organizations were involved in writing the report taht is based on five detailed technical volumes. The report considers human, organizational and technical factors and aims to provide an understanding of what happened and why, so that the necessary lessons learned can ben acted upon by governments, regulator and nuclear plant operators throughout the world.

berto rThe report also examines measures that were taken in response to the emergency in Japan and internationally, to prevent future accidents, and should they occur, mitigate the effects. Some of the factors that contributed to the Fukushima Daiichi disaster were not unique to Japan. A draft of the report has been discussed at a meeting of the IAEA board of governors in June.

In May the IAEA had issued a report containing the assessment of the IAEA expert team that reviewed progress in Japan’s efforts to plan and implement the decommissioning of the Fukushima Daiichi Nuclear Power Station. The report contains advisory points on topics such as long-term radioactive waste management, measures against contaminated water and issues related to the removal of spent nuclear fuel and fuel debris. Currently, 7,000 workers are working on site to develop and implement decommissioning work that can take at least 40 years. The IAEA report provides highlights of important progress in twenty areas, including management of radio-active waste, management of contaminated water, removal of spent fuel assemblies and institutional and organizational matters. The report also offers fifteen advisory points meaning current practices that could be improved.


As the emphasis in Japan is shifting to radio-active waste management and decommissioning the situation at the Fukushima Daiichi site remains very complex as the latest IAEA reports clearly illustrate.

Shortly after the Fukushima Daiichi disaster the IAEA endorsed an Action Plan on Nuclear Safety with a comprehensive work program to reinforce safety internationally. The IAEA’s role has been expanded to include providing analysis of a nuclear emergency, potential consequences and preventing possible scenarios on how it could develop. IAEA expert teams advise countries on how to improve nuclear safety.

The situation in Fukushima Daiichi is still underreported by the media. It is hoped that the latest May report and the upcoming September report of the IAEA will contribute to more coverage of the pressing situation in Japan and of safety issues related to nuclear plants. As the IAEA director Amano indicated after the June meeting of the board of governors, the widespread belief in the safety of nuclear power plants was one of the main reasons why Japan was unprepared for the accident. The latest IAEA reports will have far reaching consequences for the whole nuclear industry.









Jihadist groups add tunnel bombs to their tactical repertoire in several jihadi theaters

By copying tactics of Hamas in Gaza and Hezbollah in Lebanon jihadist groups in Syria and Iraq have begun to make use of tunnel bombs. During the 2014 Gaza war, Hamas militants launched surprise attacks from tunnels that crossed under Israel’s security fence and into Israel. According to the American JIEDDO database there have been at least 45 tunnel bomb attacks, most of them in Syria. The tunnel bombs are being used against military checkpoints, buildings and other protected facilities. Short tunnels can be dug in less than thirty days while longer ones may take up to as many as nine months to dig.

As tunnel bombs can be very destructive they can be exploited for propaganda purposes. Syrian insurgent groups have frequently filmed the attacks from different angles and posted the videos on YouTube and propaganda websites. Successful tunnel bomb attacks raised morale of the insurgents. It is their way to compensate for the more advanced weaponry of their opponents.

berto eThe first tunnel bomb in Syria was reported during Ramadan in 2013. The tactic spread from Damascus and Homs to the north and it became the specialty of the Liwa al Tawheed organization after rebel commander Aadil Nasir (aka Abu Assad) asked members of the military wing of Hamas to train his men. The tactic has been used in surprise attacks and to break military stalemates. The rocky earth in Aleppo has been challenging for the involved groups. They have consulted experts in topography for advice on how to excavate and with engineers to ensure safety for the diggers.

A good example is the tunnel bomb attack on the Wadi Deif military base in May 2014. It was one of the regime’s last strongholds in Idlib province. For more than a year insurgent groups had tried to capture the base but didn’t succeed. They dug a runnel of 850 meters that took seven months and placed about 60 tons of explosives under the base. The Islamic Front, a coalition of several insurgent groups, claimed responsibility for the attack.

Beyond bombs, organizations may use tunnels to move weapons and avoid detection by coalition fighter jets and drones. There are indications this may be the case in Iraq. Saddam Hussein had developed an extensive tunnel network under his palaces, military strongholds and houses. This network is now being used by Daesh. During a US air raid on a Daesh vehicle in Iraq a large bunker complex was accidentally discovered in the area between Kirkuk and Mosul.

As the use of tunnel bombs and tunnels becomes more popular there will be a stronger incentive to mobilize the scientific community and the oil and gas industry, to see whether their specialized equipment and seismic devices to see underground can be adapted for military purposes. An amendment to the 2016 defense authorization bill calls for the US to work with Israel on the tunnel problem. The legislation allows for more collaborative work in the field of research and development, testing and evaluation of anti-tunneling defense capabilities. In 2011, the US government set up a Joint Tunnel Test Range at the Yuma Proving Ground in Yuma, Arizona. Experiments have been done using different technologies like electrical resistivity tomography, ground penetrating radar and the active acoustic tunnel detector. Israel is currently working on a system that would detect tunneling at a distance as a way to detect any terrorist attackers. The system is developed by a defense electronics company and is based on a series of sensors to detect any movement underground. Cost estimates run at $ 3.5 million per mile of a fully constructed system.


As warfare is gradually shifting to urban environments the use of tunnels for IED attacks and other purposes provides insurgent or terrorist organizations with a low risk strategic advantage. Some countries, especially the US and Israel, perceive tunnels as a serious national security threat and are currently actively developing new and more effective anti-tunneling defense capabilities. They expect tunnels to play a major part in future wars in the Middle East.

Usually the tunnel bomb attacks are part of an information operations campaign of an organization that distributes the footage of the attack via social media. This may contribute to the popularity of the tactic and may result in its proliferation to other conflict areas.

The Israeli sensor system currently in development is intended for a static border area. The costs involved in constructing this system will make it unlikely that it will soon be used on the more dynamic frontlines and different topographies of other ongoing conflicts in the Middle East. As there currently is no effective high-tech formula for finding hidden tunnels on the horizon, tunnel warfare and tunnel bombs are expected to remain a persistent problem in the near future. Good intelligence will remain necessary to identify the location of tunnels.
































Previous articleReport: Explosive chickens latest addition to ISIS’s arsenal
Next articleCBRN Terrorism: Kurdish Peshmerga Forces Facing New ISIS Threat
Berto Jongman (1955) majored in western sociology at the University of Groningen in 1981. He began his academic career at the Stockholm International Peace Research Institute (SIPRI) in Sweden. From 1982 to 1987 he worked as a researcher at the Polemological Institute of the University of Groningen where he participated in a project on early warning of armed conflict and political violence. In 1987 he moved to the University of Leiden where he acted as data-manager of the Project on Interdisciplinary Research on the Root Causes of Gross Human Rights Violations (PIOOM). In 2002 he moved from academia to government. From early 2002 to late 2012 he worked as a senior terrorism analyst for the Dutch Ministry of Defence. During this period he participated in a number of Advanced Research Working Groups of NATO, e.g. on radicalization, cyber crime/terrorism and the use of Internet by terrorist organizations. A large part of his work at the Ministry involved terrorist threat assessments, including the quarterly assessment of the terrorist threat to the Netherlands for the NCTV. He left the Ministry of Defense in late 2012 and is currently active as a consultant in the area of CBRNe.