The Russian plane crash in Sinai on October 13, which left 224 people dead, is still preoccupying intelligence organizations around the world.
Updated intelligence received by Western intelligence agencies reveals that the few days before the attack saw a significant increase in the volume of written and spoken communication between senior members of the Ansar Bait al-Maqdis (ABAM – “Supporters of the Holy House”) terror organization, which has been calling itself Sinai Province in the past year after swearing allegiance to the Islamic State, who are active in the Sheikh Zuweid area in the northern part of the peninsula.
In addition, there has been a sharp increase in volume of communication between these activists and elements affiliated with ISIS’s Security and Intelligence Council in Iraq and Syria. This body is responsible for ISIS’s most important secret activities, including special operations and aiding organizations outside Syria and Iraq, where the organization’s power base is, including al-Maqdis.
There are apparently no recordings or documentation of this communication (conversations, chats, encrypted emails), but indications of its existence clearly show that its volume grew consistently until the plane crash. Shortly after the crash, it almost completely stopped. These findings serve as evidence, although purely circumstantial at the moment, that someone in al-Maqdis had preliminary knowledge about what was about to happen, if not more than that.
This evidence is neither final nor unequivocal. Each of the involved elements has a different interest in determining the cause of the crash. Sheikh Abu Osama al-Masri, who identifies himself as the ABAM leader (It’s uncertain that this is a real name, and there are differences of opinion between intelligence organizations as to the whether he is indeed the commander) and has already issued statements on behalf of the organization in the past, claimed responsibility for downing the plane. There is no doubt that ISIS, or groups affiliated with it, are interesting in taking credit for the murderous activity.
The Russian authorities, which announced that the crash was an intentional sabotage, have a double interest to determine that it was a terror attack – both in order to remove responsibility for a technical failure from the Russian airline and to justify the ongoing Russian operation in Syria.
In a remarkable coincidence, senior Egyptian sources announced that they had reached the opposite conclusion – that the crash was not a terror attack. This matches, allegedly at least, the Egyptian interest to prove that there were no flaws in the security arrangements at the Sharm El-Sheikh Airport, where – according to suspicions – the bomb was planted on the plane, if indeed there was a bomb.
The world is waiting, therefore, for clearer results of the investigation which is being conducted simultaneously by a number of intelligence organizations in the West and in the Middle East: Will it succeed in determining if and how ISIS managed to take revenge against the Russians for intervening in the fighting against it?
The names of several key activists in this organization is repeatedly raised in the investigations into the matter: The widely mentioned name is Abdullah Mohammed Sayyid Kishta, a main force in improving ABAM’s abilities in the past two years, who served in the past as an operations officer in Hamas’ military wing. Kishta then left for Sinai, through one of the tunnels under the Philadelphi Route (which separates between Egypt and the Gaza Strip), and became head of instructions at ABAM in regards to the operation of antitank missiles and advanced explosive devices.
He is considered one of the senior antitank warfare experts in the region. Since he began his work in the organization, there appears to be an extremely significant increase in al-Maqdis’ use of antitank missiles and in their improvement. Up to two years ago, they mainly used RPGs, moving on to more advanced missiles like the Kornet.
Kishta is helping the organization improve its terror abilities in developing and assembling advanced bombs, including armor-piercing antitank explosives and explosive devices against roads and armored bunkers of the Egyptian army.
Intelligence groups in the West received information in March and April this year about ties between senior ISIS members in Iraq and members of al-Maqdis’ bomb units, including Kishta. A decoding of these messages revealed that ISIS’s R&D experts in Iraq are convinced that they have managed to develop a certain formula for putting together explosives with relatively low effectiveness, but which cannot be detected through regular means.
In the same messages, they also discussed the possibility of smuggling bombs or explosives to supervised areas, by planting the explosives inside a human being through surgery or swallowing.
Two weeks after the plane crash, Sinai Province released a picture of a can which they said had brought the plane down. Shai Arbel, CEO of the Terrogence intelligence company, which is composed of former members of the Israeli intelligence community and engages – among other things – in the collection of information about ISIS and its branches around the world, says that an analysis of the photos of the can and other material obtained by the company reveals that “there is considerable likelihood” that the claim is true and that it was indeed the reason for the plane cracking up in the air.
Arbel refused to elaborate on the information, but said that according to the company’s investigations, “the can, which had contained a soft drink that is only available in Egypt, could have contained a sufficient amount of explosives – not necessarily of the type detectable by airport sensors – in order to bomb planes.” There is a reasonable possibility that the terrorists used quite a primitive explosion mechanism, rather than an electronic switch operated by remote control, barometric pressure or a timer, but something like a condom filled with acid which gradually absorbed the rubber and activated the explosion mechanism some time after the plane took off. Such a mechanism would have only been discovered in a strict search.
Intelligence sources say that the investigation is focusing on the suspicion raised by the intelligence information that Sinai Province managed to recruit a local worker at the Sharm al-Sheikh Airport, likely a Bedouin from one of the peninsula’s large tribes, who helped get the bomb on the plane. This may match the can story, if it turns out that the worker “helped” it get through some of the control mechanisms and X-ray scanners on the way. If it turns out that this is indeed what happened, it will have far-reaching consequences on the international aviation system.
Haim Tomer, former chief of the Intelligence Division at the Mossad, says: “My instinct tells me that the explosion on the Russian plane was a terror attack. And if it indeed turns out that ABAM was behind it, we are talking about an incident with wide strategic significance. It proves that ISIS leader (Abu Bakr) al-Baghdadi has the ability to operate through satellite organizations not only in Iraq but also in Syria, Lebanon, Africa and now in Sinai. If it’s true, he succeeded, in a very short time in terms of preparing and executing an operation, in taking revenge against the Russians for the war they are waging in Syria. If that is the case, his ability and his organization’s ability is much higher than we thought.”
Regardless of the Russian plane crash, the ABAM organization is one of the most threatening and intriguing challenges faced by the Israeli and international security community. In this case, the challenge – and the threat – are only a few kilometers south of Eilat.
The target: Egypt
Israeli intelligence first heard the name Ansar Bair al-Maqdis in Gaza.
“In the early 2000s,” Haim Tomer recalls, “we heard there were radical Salafi cells in Gaza which go by that name. At the time, it was a local organization which attracted former activists from all kinds of other organizations who were discharged from them or found Hamas’ policy to be too moderate after different agreements signed with Israel.
ABAM was first comprised of a mixture of fragments of organizations and people and did not appear to be a big success. Israel’s security control and Hamas’ dominance made it impossible for the organization to really thrive and it didn’t leave a significant mark. But in 2002, its name emerged again in organizations of Bedouin in northern Sinai, and then in all of Sinai.
“We were confused for a moment,” says a senior source in the AMAN (Israeli Military Intelligence Directorate) research division. “We didn’t know if these were the same people we knew from Gaza or that they were just using the same name.”
But an examination conducted in Israel at the time revealed that global jihadist elements – mainly Egyptian, Libyan and Saudi – arrived in Sinai in order to take advantage of al-Qaeda’s international success at the time, after the September 11 attacks and the wave of attacks which washed through the world afterwards, and establish a terror organization there. These activists used a local infrastructure of Bedouins and Salafi Sunni activists who had escaped from Gaza.
They saw Sinai, and rightfully so, as a place which the Egyptian army and police had the weakest hold on, a place which would allow them to act, live and hide for an extended period of time. The Bedouins suffered at the hands of President Gamal Abdel Nasser until the Six-Day War, and when Sinai was returned to Egypt in 1982, they were perceived as collaborators with Israel. In practice, Sinai received very little budgets from the Egyptian government and the Bedouins were discriminated against. On this background, the recruiters had no problem convincing them why radical Islam was right.
The activists, who numbered about 100 people at the time, established their headquarters on the Jabal Yalak mountain range, the highest range in northern Sinai, and the Jabal Helal range, areas with no Egyptian presence and extremely difficult conditions on the ground. The organization’s goal until 2010 was local – to target the Egyptian army and Egyptian interests across Sinai, and later on to take over areas in the peninsula and keep hurting tourists.
The smuggling of weapons and additional goods through Sinai to Israel increased during that period. The Bedouins were a key factor in this industry. The ABAM people benefitted from it and the organization members purchased a large amount of weapons with the Bedouins’ help.
During that period, the organization received local funding, and the jihadist activists would raise funds among the relatively sympathetic Bedouin tribes, asking for a donation for different Islamic organizations, which did not all necessarily exist. For fear of Egyptian intelligence informers, they did not raise funds on behalf of the organization itself of course. However, “the Bedouins who donated knew exactly where the money was going,” says a Shin Bet official who dealt with the issue at the time.
On October 7, 2014, the organization executed its most devastating attack until then. Joint Palestinian-Egyptian-Bedouin cells detonated three car bombs in a scheduled and combined manner at tourist sites in Sinai which attract Israeli vacationers. Forty-three people were killed in the attacks, including 21 Israelis, and 171 were wounded.
The Egyptian authorities reacted aggressively. They executed the perpetrators of the attack who were not killed and arrested 2,400 suspects, the large majority of whom were Bedouins, who were kept under harsh conditions and sometimes tortured in their interrogations.
In addition, the Egyptian government imposed a series of tough sanctions on the Bedouin population in Sinai, which it perceived as responsible for the attacks, the great embarrassment vis-à-vis Israel (the Israeli Counter-Terrorism Bureau had repeatedly warned against the danger while the Egyptians denied it) and the serious blow to tourism.
The arrests, the investigations, the executions and the economic sanctions worked in the short run. But as is often revealed in the war on terror, they only radicalized the situation in the long run. The detainees became more radical in the prisons, where they made contact with other Salafi Sunni jihadists. At the same time, global jihad activists arrived in the peninsula again to gain support.
The next stage in ABAM’s quick organization arrived a year later, in 2005, upon Israel’s pullout from the Gaza Strip. The pullout led to a major growth in the smuggling of people, goods, food, weapons and fuel under the Philadelphi Route. Sinai’s Bedouins made a fortune from the smuggling (about $230 million a month, according to figures submitted to AMAN’s Research Division, which served as the foundations of the connection between Hamas and the organization in Sinai.
In mid 2005, the Egyptian army launched a series of attacks on the Jabal Helal mountain range in Sinai, where the organization’s bases were located. The Egyptian army sustained heavy losses and failed to achieve many of its goals. Later on, in around 2006, the organization’s members began trying to increasingly infiltrate populated areas in northern Sinai – Rafah, El-Arish on the way to Quneitra and the Suez Canal. This activity was created at the same time as the creation of the organization’s sleeper cells on the other side of the mountain, on the route between Sharm El-Sheikh and Eilat, whose only goal was to harm tourism in Sinai.
One of the problems in the Egyptian army’s activity was the “security protocol” of the 1979 peace agreements with Israel, under which it is forbidden for Egypt to station military forces in the Sinai peninsula. In the past 13 years, Egypt has repeatedly pleaded with Israel to allow it to bring in special forces to raid the area and to significantly boost the regular army forces stationed at the peninsula. Israel sometimes agreed, but quite unwillingly.
“Israel obviously has a clear interest that Egypt will fight terror in Sinai,” says Colonel (res.) Ronen Cohen, former director of the Terrorism Desk and deputy head of the research division at AMAN. Today, Cohen is one of the owners of Inspiration, a company which manages security-related projects and provides intelligence services, information collection, processing and analysis in Middle Eastern and Persian Gulf countries. “On the other hand, it was very important to us all these years to maintain the peace agreement as it is and not to create a precedent of bringing Egyptian forces into Sinai for a long period of time.”
Following the Israeli dilemma, Egyptian forces entered Sinai to conduct aggressive deep raids against members of ABAM, but were later forced to pull out so as to honor the agreement with Israel. The terror organization took advantage of this restriction and rushed to rehabilitate itself each time.
The exchange of blows with the Egyptian government continued over the next few years, but 2010 saw a change in the way the organization perceives itself: From an organization with a clear local goal – to harm the Egyptian government – it moved to the international level.
An Israeli intelligence source explains that the association with international elements is ideological, but also practical: “The world has become flat, and the connection with elements all over the world – through the Internet – has become relatively simpler, even in a world in which they are being monitored. And they know they are being monitored. Their big problem in Sinai is the physical isolation: On the one side Israel, and on the other side Egypt. All that in a dry and desolate area lacking resources. They need every help they can get.”
Sinai makes up only 7 percent of Egypt’s territory and has just a little less than 1 percent of the population (some 600,000 people). Nonetheless, the peninsula is located in an important geographical spot for the passage of significant amounts of global trade – as well as a lot of oil, of course.
“The association with al-Qaeda,” says Ronen Cohen, “dictated the ‘stage strategy’ to the organization, ahead of the establishment of the Islamic caliphate in the Arab domain. Between the stages, there is a long and gradual process, and each stage depends on the success of the previous stage. The association with al-Qaeda was also reflected in a significant increase in the terror attacks.”
Haim Tomer explains: “ABAM’s activity reflects a process which has been accelerated since the beginning of the Arab Spring, in which territorial Islamist elements team up with a global entity. Since the beginning of the decade, scattered reports began flowing in about contacts created between the organization in Sinai and global jihad elements. At that stage, it was still only al-Qaeda, mainly in Iraq. There were exchanges of messages, transfer of knowledge, and fighters travelling from Sinai to train in Iraq and Afghanistan.”
As part of this international activity, the organization boosted its activity against Israel. On August 18, 2011, a bus was targeted in a combined terror attack in Eilat; the organization released a video and dedicated it to the Palestinian prisoners. The operation’s stages, planning and execution were presented by a spokesperson of the organization whose face was blurred and by an activist known as Abu Masab, who took part in the attack.
Following the serious operation, claims were made that Israel had fired into Egypt, leading to a harsh wave of protest and even to the evacuation of the Israeli Embassy, which was exactly what the organization had been trying to do – to complicate the delicate relations between Israel, the Egyptian government and the public opinion in the country.
On September 21, 2012, three gunmen and an Israeli soldier were killed in exchanges of fire on a mountainous area on the Israeli border.
In July 2012, the organization released a video in which it claimed responsibility for a series of explosions in the pipes leading natural gas from Egypt to Israel. Against the backdrop of footage of the preparations for the attacks and a documentation of the actual explosions, al-Qaeda leader Ayman al-Zawahiri could be heard urging the jihadists in Sinai and in Egypt to target the gas pipe, in a way which implied that ABAM operated under his inspiration and guidance.
From 2010 to 2014, the organization fired rockets several times towards Israeli communities, and mainly towards Eilat, but didn’t always claim responsibility.
Morsi and al-Sisi
In June 2012, President Mohamed Morsi, a Muslim Brotherhood member, rose to power in Egypt. During his term, many Islamist activists were released from prison. When Morsi was ousted and Abdel Fattah al-Sisi rose to power, many Islamist activists fled to Sinai. Today, they make up the main organizational infrastructure on which the organization is based. Many of these activists became ABAM terrorists and largely reinforced the organization’s power.
And so an extremely skilled group of activists was formed in Sinai: Most of them trained by Hamas, Egyptian officers who support the Muslim brotherhood and retired or were discharged from the army following al-Sisi’s cleansing process there, alongside al-Qaeda elements who arrived from outside the peninsula, jihadists released from the Egyptian prison and local Bedouins who despise the government in Cairo.
On several occasions after President Morsi was ousted, al-Qaeda leader al-Zawahiri turned directly to the global jihad activists in Sinai and urged them to attack Israeli and Western targets. It was part of al-Qaeda’s ongoing effort to turn ABAM into part of the international organization.
In the past three years, the organization has carried out many operations, sometimes on a weekly basis, against Egyptian government facilities. The attacks even took on al-Qaeda characteristics. In November 2012, for example, four Bedouins were beheaded for “spying for the Israeli Mossad.”
On September 5, 2013, the organization made a failed attempt to assassinate the Egyptian interior minister. On January 25, 2014, the organization recorded an important symbolic achievement – downing an Egyptian military Apache helicopter with a surface-to-air missile. The organization’s Twitter page lauded the operation and promised many more to come, also against the “heretic tourism” in Sinai.
Hamas aid
The improved abilities demonstrated by the organization in the past three years stem mostly from the aid it receives from Hamas. Western intelligence sources I have spoken to, under the condition that I don’t mention the country they are active in, say that Hamas in Gaza is helping the al-Maqdis organization with money, weapons, military equipment and training.
According to these sources, Hamas’ attitude towards the Salafi organizations operating in the Gaza Strip is completely different, polarized in fact, from its attitude towards the organization operating in Sinai. With the former it is in the midst of a serious conflict and sometimes uses force against its members and restrains their activity against Israel, when it jeopardizes the fragile ceasefire.
With the organization in Sinai, on the other hand, it has formed extensive relations which are concentrated in the hands of Hamas’ military wing, the Izz al-Din al-Qassam Brigades. It’s unclear whether the organization’s political leadership (which resides in Turkey and the Persian Gulf) is fully aware of these relations, which are being sustained in complete secrecy, due to the high sensitivity vis-à-vis the Egyptian government.
Hamas’ interest to be in touch with al-Maqdis stems mostly from the harsh conflict between the current Egyptian government and the Muslim Brotherhood movement, and it grew significantly after President Morsi was toppled. Hamas (who Morsi is accused in Egypt of having illegal relations with) seeks to harm the Egyptian government, but without being directly involved in the fighting. Moreover, as Alex Fishman revealed in Yedioth Ahronoth this week, Hamas is paying the Sinai Province money to guard its moving arms depots as the weapons pass through Sinai on the way to the Philadelphi Route and the Gaza Strip.
In the past three years, Hamas has been significantly helping al-Maqdis to upgrade its military and operational abilities. While two years ago, al-Maqdis’ videos mainly documents peasants wearing ghalabias and equipped with small arms (Kalashnikov rifles and grenades), today they document activity on an entirely different level – with new communication means, advanced weapons and camouflage and fighting abilities in a constructed area.
Today the organization operates different types of rockets, including Fajr, aerial defense systems warning against the Egyptian army’s depth charges (Israel has allowed Egypt to operate warplanes and assault helicopters against the organization in Sinai), advanced antitank missiles, antiaircraft shoulder-fired missiles, huge amounts of explosives, mortars with different diameters, advanced communication means, some of them coded, and satellite phones.
Hamas is reaching out to al-Maqdis not only with weapons. Recently, for example, Israeli customs seized a delivery of cloths which was meant to reach Gaza, according to the customs, in order to sew striped uniform, some of which was to be transferred to Sinai. It has also been revealed that after the deadly attacks on Egyptian posts on January 29, 2015, some of al-Maqdis’ wounded were sent to Gaza for medical care, at Hamas’ approval.
According to updates estimates, the organization numbers 500 to 1,000 members, including 100-200 of activists who traveled to train and participate in the fighting in Syria and Iraq, teamed up with global jihad elements there and received combat training.
Oath of allegiance to ISIS
In November 2014, following an open and blatant conflict between ISIS and al-Qaeda, ABAM had sworn allegiance to the Islamic State and to its leader.
The public letter to al-Baghdadi read, among other things: “Oh, faithful brothers, Allah blessed be he has instructed us to march in his righteous way and hold onto the rope he is offering, unite our efforts and powers and prevent a split, so that our nation will not be lost and all that is torn will no longer be torn… Our commander, Caliph Abu Bakr al-Baghdadi al-Qurayshi al-Husseini: We, the mujahideen of Ansar Bait al-Maqdis, pledge allegiance to you as the commander of all the believers and mujahideen in the Islamic State and as the caliph of all Muslims, as long as you march in the road of Allah and the sunnah of his prophet and in the road of our righteous forefathers. We swear to listen to you and obey you, willingly or unwillingly, and not to oppose your orders. We won’t let anyone demand what he has no right to demand after swearing allegiance to you.”
“This isn’t just a symbolic statement, but part of the rift within the jihadist movements,” says Ronen Cohen, noting that the al-Nusra Front organization in Syria got into a bitter conflict with al-Baghdadi following his announcement on the establishment of an Islamic caliphate, which contradicts al-Qaeda’s stage perception. ABAM’s caliphate announcement is therefore its way to turn its back on al-Qaeda and express complete solidarity with al-Baghdadi.
Indeed, the al-Nusra Front organization was quick to respond, accusing al-Maqdis of corruption. An Egyptian al-Nusra Front activist, Abu Ubaida al-Masri, implied that Ansar Bair al-Maqdis had been paid to change its allegiance. He wrote his Twitter account that “with the mercy of Allah, the Islamic State members’ plan to buy oaths of allegiance in Pakistan, Somalia and the Caucasus region have failed. They have succeeded in Libya and Sinai.”
“This declaration of independence is mainly a challenge for al-Sisi’s regime,” explains Cohen, “as we are not just talking about a terror organization which opposes the government, but about an organization which is declaring – in a strong sovereign state like Egypt, as opposed to the weak Syria and Iraq – the establishment of a new, independent and separate state.”
As mentioned, the Sinai Province operates under ISIS’s Security and Intelligence Council. The council was founded and operated under the supervision of Abu Muslim al-Turkmani (a.k.a Ahmed Abdullah al-Hiyali), who was known by that name since he came from the Turkmen region in northern Iraq, the third ethnic group in Iraq (alongside the Kurds and the Arabs) which has tight relations with Turkey. He was a colonel in the special forces of Saddam Hussein’s Republican Guard, and after the American invasion and the disbandment of the Iraqi army, he was among the founders of ISIS and became one of the deputies of ISIS leader al-Baghdadi and the person in charge on his behalf for the Iraq area and special operations.
After his death on August 18, 2015 in an American UAV attack, he was succeeded by Abu Ali al-Anbari, who like his predecessor Turkmani, came from Mosul and was a loyal activist to Saddam Hussein, reaching the rank of brigadier-general in the Iraqi army before it was dispersed by the United States in 2003. He was appointed by al-Baghdadi as governor of the Syrian region and took control of the council after Turkmani’s assassination.
On December 12, several Arab media outlets reported that al-Anbari had been killed together with 14 other ISIS activists in a joint attack by the US and Iraqi forces on the Syrian border. These reports have yet to be officially confirmed by the organizations. If they are true, it can be seen as a significant achievement for the coalition forces. ISIS has proved, however, at least for now, that it is stronger than the assassination of some of its activists, as important as they may be, and keeps holding on and carrying out attacks despite the bombings targeting the organization.
Intelligence sources have been putting a lot of efforts, since ABAM swore allegiance to ISIS and turned into Sinai Province, to monitor the communication channels between the two organizations. One of these channels, it turns out, is the popular Telegram instant messaging app, whose encryption scheme is considered particularly difficult for infiltration by external elements, even intelligence organizations. It turns out that due to the encryption scheme’s high level, different global jihadist elements are using the Telegram app to communicate with each other. Intelligence sources have discovered that Telegram serves as an excellent communication channel between Sinai Province activists and ISIS funding and logistics elements in Syria and Iraq.
Among other things, Telegram was used to transfer the funds from the Security and Intelligence Council to Sinai Province. Intelligence sources discovered that the fund transfers were conducted through alleged NGOs for humanitarian purposes which are operating from Turkey and through the Western Union Company, which engages in an efficient international transfer of funds (and was completely innocent in these transfers, as a legitimate company operating in a completely legal manner).
The Security and Intelligence Council activists demonstrated a lot of expertise in transferring and controlling the funds. It has been revealed, for example, that they knew intelligence organizations in the world were monitoring transfers of more than $500, and therefore split their transfers into smaller “doses.”
