After the FBI arrested an Afghan man in Oklahoma planning an election day shooting on behalf of the Islamic State, the terrorist organization re-entered what has become one of the most chaotic news cycles leading up to a November vote.
Nasir Ahmad Tawhedi, 27, of Oklahoma City admitted to investigators he and a co-conspirator expected to die as IS martyrs as they opened fire on crowds on election day, according to charging documents.
Warnings about IS-sponsored or -inspired attacks in the west have intensified in recent weeks.
In a statement on the Tawhedi case, the US attorney general, Merrick Garland, remarked there was a continuing need to “combat the ongoing threat that [IS] and its supporters pose to America’s national security”. Ken McCallum, the head of MI5, the UK’s domestic intelligence service, described how his agency had “one hell of a job” managing the threat of the resurgent terrorist organization.
Despite the talk from top officials, public perception still remains that IS was defeated or has somehow disappeared.
But, experts say, before and after that incident, internal IS talk was anything but quiet: on chat boards and encrypted apps, both supporters and operatives alike have increasingly been discussing attacks on the west and the US homeland.
The online conversations are being led by IS-Khorasan (IS-K), the branch based in Afghanistan that was behind the Moscow attack that killed 145 people in March. Khorasan is a reference to an ancient region that includes parts of what is modern-day Iran, Afghanistan and other bordering countries.
IS-K has quickly become the most active international force of the terror group, having already carried out the deadly plot in Russia and another in Iran months before it. Days after Tawhedi’s arrest, US officials later confirmed it was an IS-K operative allegedly directing the plot.
In a propaganda poster it released in September, IS-K put American targets on notice as top of its hitlist.
“[IS-K] has recently reiterated its intent to target the US with a poster depicting one of its militants holding a grenade in front of the US Capitol building captioned ‘you are next,’” said Lucas Webber, a senior threat intelligence analyst at Tech Against Terrorism, a watchdog organization working with government agencies around the world.
The Guardian obtained the same poster, which was released online through a known IS-K platform.
“This is additionally concerning given the branch’s mass casualty attacks on Russia and Iran, leaving the United States as the remaining adversary on this shortlist for a successful external operation,” said Webber.
Webber said the arrest of Tawhedi gave a glimpse into the “uptick” in attempted stateside plots emanating from IS. For example, earlier this week a Maryland man was charged for supporting IS with the criminal complaint describing his attempt at buying a Kalashnikov assault rifle.
Webber continued: “This follows a Tajik [IS suspect] arrested in Costa Rica; a central Asian network rolled up in New York City, Los Angeles and Philadelphia; as well as a Canada-based Pakistani national who was allegedly plotting an attack against a New York Jewish center.”
While IS-K has seized on the tumult in Afghanistan since the Taliban took over in the summer of 2021 and established a base of operations in that country, its broader movement has also been heavily recruiting since the 7 October attacks and the Israeli military operations that followed.
It’s part of an IS-K recruitment plan targeting young men in the west who can’t travel overseas easily. A relative of Tawhedi, who was an Afghan national who came to the US after the fall of Kabul, was charged in France for a similar plot.
In one spring issue of Voice of Khurasan, its English-language propaganda magazine, IS-K encourages “contacting the organization directly” through encrypted communications and being covertly recruited from western locales.
Riccardo Valle, the director of research at the Islamabad-based publication the Khorasan Diary, closely follows the movements of IS on everything from Facebook and Instagram to Telegram and the lesser-known encrypted chat app Rocket.Chat.
“Discussions online are very diverse,” he said. “However, there has been an increase in talks about either carrying out attacks or making hijra [migration] to tamkeen – lands where IS is present in force and controls.”
For years, a long-observed debate within IS channels is whether or not it’s more effective for followers to carry out attacks at home or travel to active war zones where IS operates and join in its ranks there.
On a Rocket.Chat forum, the choice communications platform among IS supporters and operatives, Valle said one user posted about lamenting Tawhedi’s arrest.
“I feel like if we had contact with these brothers before they bought the guns from the informants things would’ve turned differently,” they said, while another wrote: “I live in the west and we can do more damage here.”
In other chat dumps that Valle had access to and shared with the Guardian, users talked about “kitchen made bombs, commercial drones” and other potential simplistic tools for carrying out terrorism.
Another Rocket.Chat user, Valle showed the Guardian, directed an account to target Jewish people in an unnamed western country with knives.
“Now take a kitchen knife and drive it into the throat of a young Jew around your age when nobody is paying attention and then escape,” wrote the user.
Webber noted that a part of the problem in raising awareness surrounding the seriousness of the moment is the “common misconception that [IS] was defeated”.
But, he added, branches still remain in “Syria, Afghanistan, Pakistan, Somalia and elsewhere”.
