fbpx Skip to content

Analysing a foiled Islamic State terrorist plot in Istanbul

Key Takeaway:
Even though the Counter-Terrorism Department of the Turkish National Police carry out frequent operations against the Islamic State across Turkey and have apprehended many senior IS militants and have foiled terrorist attacks, IS operatives continue to be at large. They also have access to explosives and weapons, maintain their local supportive networks and are able to plot and carry out most of the phases of a complex attack in a major Turkish city.
On October 28 2017, the joint efforts of the National Intelligence Agency (MİT) and Istanbul Police prevented a major IS attack at the Forum Shopping Mall located in Bayrampaşa/Istanbul. Following two apartment explosions at the Arnavuktöy and Esenyurt districts of Istanbul and based on the findings when investigating the blasts, security officials launched an operation to locate and capture a number of Islamic State members suspected of having activated a terrorist plan to attack a target in Istanbul. MIT and police officers raided multiple addresses in Istanbul, arrested numerous IS suspects, seized large quantities of explosives, and after cross referencing the vehicles registered at the apartments where the explosions occurred with the data collected by licence plate recognition systems installed at shopping malls in Istanbul they managed to locate and arrest 4 IS members at the Forum Shopping Mall in Istanbul, shortly before they launched their attack.
The Incident
28/10/2017. 16:30. Car-bomb attack foiled in Istanbul
4 IS members were arrested at a shopping mall in Istanbul shortly before carrying out a car-bomb attack. One of them was shot while trying to escape the scene outside the shopping mall. A car loaded with explosives and a bomb-laden motorcycle were found in the shopping mall’s parking lot. “Home-made explosives that have remote control set ups, suicide vests, two firearms and many bullets were confiscated from the motorcycle and the car,” police said.

Bomb disposal expert conduct controlled explosions at the suspicious vehicles
Related incident
27/10/2017 Two explosions in Arnavuktöy and Esenyurt districts of Istanbul
19:30 hrs: Explosion on the top floor of a 4-storey building in Arnavutköy/Istanbul. 30 minutes later another explosion occurred at the entry level of a 4-storey building in Esenyurt/Istanbul.

The destroyed apartment in Arnavutköy. 
The Operation
The terrorist plan was activated when the two apartment explosions occurred. Hoping that the explosions would divert the authoritiesâ attention, the terrorists would then proceed to their 3-phase plan at the Forum Shopping Mall. Police at the apartments found chemical materials, metal marbles, nails, screws, a remote control, electronic circuits, cables and batteries pointed to individuals capable of constructing IEDs and authorities begun to expand their scope of investigation to the apartment’s tenant’s known associates and contacts.
Two of the apartments tenants – arrested at the shopping mall – Mücahit Şahin and Can Yenil, have been under 24-hour surveillance, suspected of having links with the IS. They have rented the apartments in Arnavutköy and Esenyurt and were living there with two females, believed to be their wives – two of the 4 suspects arrested were a married couple of Turkish-origin but Austrian citizens, registered at the address in Arnavutköy since 2012-. As the two suspects were under constant MIT surveillance, law enforcement agencies shared data collected by the number plate recognition system, installed at highways and at the entrances of major cities in Turkey, and from license plate recognition systems installed at the entrances and exits of mall parking lots. The mall recognition systems were installed after a Customs and Trade Ministry regulation announcement in December 2016. The implementation of this regulation and the combination of data shared between law enforcement agencies of recorded vehicle routes in Istanbul assisted the counter terrorism police units to track the vehicles at the Forum Shopping Mall.

Images taken from security camera show the arrested terrorists scouting the targeted areas. Source:CNNTURK
The two suspects and two females were constantly under surveillance until they were arrested entering at the Forum Istanbul shopping center. 4 microwave ovens packed with explosives were found inside the shopping mall and a large quantity of explosives were found in a car and a motorcycle parked in the mallâs parking lot.
The Foiled Attack
The terrorists had organized a 3-phase plan based on the following sequence: Indoor Explosion/Microwave ovens→Targets move towards ambush/kill zones→Parking Lot Kill Zone – Explosives laden vehicles detonated→Entrance Kill Zone – Weapons Fired →Suicide vests detonated.
Phase 1
Indoor explosion of IEDs houses in microwave ovens.
The police investigation revealed that the terrorists had previously bought 4 microwaves, booby trapped them with explosives and returned them at the shopping mallâs customer services claiming that they were malfunctioning. The customer service employees stored them for examination and repair. The 1st phase of the plan would be based on the remote detonation of the explosives in the microwave ovens, causing panic among the mall shoppers. The panicked people would then seek the nearest exits and open areas to seek help, leave on foot or with their vehicles or try to find their lost relatives and friends in the crowd. This would happen in the parking lot and the mallâs entrance where there is sufficient space for security services to apply their evacuation procedures and for first responders to provide the injured ones with emergency treatment.

4 microwave ovens are detonated.. Panicked people run towards the exits and the parking lot. Open Sources
Phase 2
Parking lot explosions – Motorcycle and vehicle trapped with explosives.
The next phase would find the panicked people trying to reach their vehicles in the parking lot. At that time a motorcycle and a car fitted with explosives would be remotely detonated causing further panic, casualties and confusion among the security authorities who would then realize the complexity of the attack. 66 remotely controlled IEDs were found in the two vehicles in the parking lot. Such a quantity of explosives means that the explosion blast would cover a large area, causing the parked carsâ fuel tanks to explode killing even more people and creating an even more chaotic situation. The new explosions would guide the people away from the parking lot and most likely towards the shopping mallâs main entrance where the 3rd and final stage of the attack would unfold.

Explosives-packed motorcycle and vehicle detonated at the parking lot Source:CNNTURK
Phase 3
Weapons fired and suicide vests detonated at the main entrance.
At the last phase, the terrorists, mingled with the panicked people, would start firing their weapons. At that point the police would have a clear target to engage but until they cleared them out more people would die from the terroristsâ bullets. As the final act, the attackers would detonate their suicide vests after running out of ammunition causing further casualties.

Terrorists fire their weapons and detonate their suicide vests. Open Sources
Counter-terrorism Operations Findings
Large quantities of explosives were seized and many IS suspects were apprehended.
After the two explosions in Istanbulâs Esenyurt and Arnavutköy districts the police raided IS safe houses and seized 56 bomb set-ups (with 16 different chemical materials) strengthened with aluminum and steel marbles, 67 bomb molds (3 to 4 kg each) 32 propane cylinders, gas cans, and four suicide vests. A 2 kg unidentified white powder was also found in one of the raided safe houses. Operations against IS cells were carried out across Turkey resulting in the detention of many suspected IS operatives. On November 2nd police announced that during the past 11 days they seized 66 improvised explosive devices during operations conducted in 25 provinces across Turkey and detained a total of 283 suspected IS members – 96 Turkish citizens and 187 foreign nationals. Security officials announced that the amount of seized explosives would be enough for 40 attacks.
The Constant Threat
The foiled plot to attack the Forum mall in Istanbul revealed the current operational capabilities IS operatives have in Turkey:
a) access to weapons and large quantities of explosives,
b) ability to store the explosives at safe houses for long periods of time,
c) contacts with local networks providing them safe houses – most likely operated by IS âreal estate agentsâ with access to large amounts of money –
d) contacts with explosive-experts so they receive assistance and guidance in IED and suicide-vest construction
e) able to conduct target-selection operations, and
f) ability to plan and complete most phases of complex attacks.
As long as the weapons and explosives trafficking networks are not dismantled, the registration and surveillance of suspected individuals is not consistently maintained and the local supporting networks are not penetrated by police agents, IS militants in Turkey are expected to
a) develop/alter their tradecraft in order to secure their communications and movements,
b) change their current weapons and explosives suppliers to other âclientsâ to diminish their exposure to the security authorities (exclusive and confidential trade partner) or modify their ways of obtaining the material they need,
c) attempt to disorientate the authorities by alternating forged identity documents and false registrations at the social services and
d) continue to plot complex attacks of great social impact and maximum casualties.
Report written by Panagiotis Vasilias
Back to Reports & Resources

About the author

Book a demo