fbpx Skip to content

Islamic State Threat to Turkey

This report will begin with the findings of the investigation into the January 1st 2017 Islamic State (IS) attack at the Reina nightclub in Istanbul. This is done to show the extent of ISâs operational capabilities in Turkey, the vulnerabilities of the Turkish State, the security environment in which IS operatives managed to successfully conduct an operation and to set a reference point on which we will be able to relate IS current activity in Turkey and examine its evolution. The report then goes on to highlight an analysis of the IS related incidents during the period August 1st until August 31st 2017 with a focus on: the weaponry found and the target selection operations, Turkeyâs porous Southern borders and, the national identity of the arrested members and the type of intercepted plots.
On January 1st 2017, an Uzbek national named Abdulkadir Masharipov, armed with an AK-47 assault rifle and three stun grenades, entered the Reina nightclub in the Beşiktaş district of Istanbul, killed 39 people and wounded 71. On January 16th 2017, the attacker was captured alive in the Esenyurt district of Istanbul. Following Masharipovâs attack, the counter terrorism units of the Turkish Police Forces conducted a series of operations targeting suspected IS safe-houses and detained a high number of suspects. The operations led to a series of findings concerning the support network Masharipov used to successfully avoid detection by the Turkish authorities and safely complete all the phases of his objective.

Abdulkadir Masharipov The attacker entering Reina nightclub
Reina-attack key findings
The porous Turkish borders, especially the remote parts of it, are proven points of entry for IS operatives. In 2016, after a one month detention in Iran, Masharipov was deported from Iran to Turkey through a remote, uncontrolled part of the Iranian-Turkish border. The Turkish authorities were not aware of the deportation.Sleeper cells displayed high operational security standards avoiding detection and capture. Masharipov was in Konya, central Turkey, waiting orders almost a year before the attack. He was instructed by an IS member from Raqqa/Syria to do so.Encrypted communication applications were of critical importance to the organizationâs successful planning and execution of operations. Masharipov used the messaging app Telegram to communicate with high ranked IS members in Raqqa even a few hours before the attack.IS had established a sustainable network within Turkey. The captured IS members were responsible for recruitment, financial / logistic and intelligence support, and for safely moving IS operatives within Turkey.Turkey was a part of IS Regional Operational Command. According to Masharipovâs statement, Abu Shuhada – an IS high ranked member- had in his control the operational planning for Turkey.Weapons and other tactical material were easy to obtain and transfer to safe-houses. The weapons Masharipov used were dropped off in an apartment at Zeytinburnu district of Istanbul. Other material such as guns, drones and large amount of cash were found at the apartment Masharipov was arrested.The large number of safe-houses revealed ISâs advanced network of contacts, financing resources and local-regional knowledge. Nearly 100 safe houses were managed by Islamic State operatives, many of them in Istanbul. IS supporters and operatives were able to adopt social roles which raised no suspicion to the authorities. Masharipov had more than 50 people discreetly supporting him during all steps of his operation.IS has a major focus on international operations. The nearly half a million of US dollars found at different safe houses linked to the Reina attack shows ISâs financial capabilities and its focus in conducting foreign operations.
IS Incidents in Turkey
Period: August 1st until August 31st 2017
The incidents recorded on Intelligence Fusionâs database show that all preparatory stages of the Terrorist Attack Cycle are present (Broad Target Selection, Surveillance-Specific Target Selection, Planning and Weapons acquisition) and ISâs operatives, Turkish and foreign, were apprehended during intelligence gathering, target selection operations or in safe houses. One of them managed to kill a police officer while being captured. Turkish Police Special Operation Units conducted raids in several safe houses throughout the country, an indication of IS extensive presence in the country, and arrested several suspected IS members. Alongside organizational documents, a large selection of weaponry and other tactical material was found during the raids showing how IS operatives benefit from the weapon trafficking in Turkey and the high number of local crime networks which can easily provide them the operational material they need.

(Click on above image to expand)
Since August 1st the Turkish Police counter terrorism units have arrested a high number of IS suspects during simultaneous raids in multiple locations throughout the country. Istanbulâs high concentration of incidents is not unusual as Istanbul, as a large urban center provides the anonymity needed for IS members to operate in, sustaining in that way the network of safe houses they use to regularly change locations and hide. According to the latest report from Istanbulâs security general directorate, between Aug. 15, 2016 and Aug. 15, 2017 counter terrorism police conducted a total of 117 operations against IS and arrested 282 people in Istanbul. As in the case of Masharipov, locations in central and South East Turkey are used as temporary hideouts or places where IS operatives can establish their covert identities after entering from Turkeyâs Southern borders.

(Click on above image to expand)
IS related Incidents from August 1st until August 31st 2017
07/08/2017: 5 foreign IS members were arrested at two locations in Başakşehir/Istanbul.10/08/2017: A Russian citizen linked to IS was arrested in Adana for plotting an attack at Incirlik Air Base.10/08/2017: A Belgian national was arrested in Istanbul/Fatih district for links to IS. It is believed he was preparing an attack.11/08/2017: 22 people were arrested for links to IS in Elazığ’s center during raids at multiple addresses.12/08/2017: Ten IS-linked people were arrested in Bingöl during two operations.12/08/2017: An IS collector was caught in Altındağ/Ankara.13/8/2017: A Turkish police officer was stabbed to death by IS member in Istanbul.14/08/2017: 12 IS suspects – Iranian, Iraqi and Syrian nationals- were detained in Istanbul.17/08/2017: Two IS members were arrested in Beylikdüzü/Istanbul.18/08/2017: Four, Syrian nationals, IS suspects were arrested in Çerkezköy/Tekirdağ.19/08/2017: A black jeep, which entered from the Syrian-Turkish border and was heading towards Iskenderun, with 5 IS supporters, three Turkish and two Syrians, was stopped at a security checkpoint at the Topbağazı area of Hatay. 4 of them were arrested and one who tried to escape was shot and later died at the hospital. The authorities believe they were preparing an attack.24/08/2017: An IS member captured in Istanbul has confessed to the police that he was instructed to assassinate the prominent cleric Ahmet Mahmut Ünlü, after receiving instructions in encrypted communication messages by his superiors.26/8/2017: An IS commander was arrested during an anti terrorism operation in Eskişehir. The 41-year-old Iraqi man was previously arrested in Iraq for plotting to assassinate the then-Iraqi Prime Minister Nouri al-Maliki but escaped with help from IS.29/08/2017: 6 foreign IS members were arrested at two districts of Istanbul. The Police authorities believe they were preparing an attack.29/08/2017: 6 IS members were arrested in Izmir.29/08/2017: The US Treasury Department announced that an Iraqi senior Islamic State official, Salim Mustafa Muhammad al-Mansur, “finance emir for Mosul-Iraq”, had been added to the US government’s list of specially designated global terrorists and listed three locations inside Turkey where he was tracked: Mersin, Istanbul, and Adana.
Major Incident
Date: 13/8/2017
Time: 23:00
A police officer in Istanbul was stabbed to death by IS suspect in custody
A police officer was stabbed to death in Istanbul by an IS member. The assailant stabbed the officer as he was being taken out of the patrol car at the Istanbul police headquarters on Vatan Avenue, after his arrest. The attacker, accused of planning a suicide bomb attack, was shot dead by the police.
Related incident:
Date: 14/8/2017 Time: 00:00
12 IS suspects – Iranian, Iraqi and Syrian nationals- were detained during anti-terror operations carried out in various addresses of Istanbulâs Fatih district, Aksaray neighborhood, following the stabbing of the police officer.
It is unknown how, when and where the detainee got hold of a knife while in detention and how he managed to stab the police officer. It seems that he waited for the time he was getting out of the police car, so that he had some relative freedom of movement and the police officers had lowered their guard. Such an incident shows the alertness, determination and clear objective of IS supporters.
Target selection operations and weaponry
The weaponry found in possession of IS supporters, the relatively easy access they have to heavy weaponry in Turkey, combined with the locations scouted by IS operatives in Adana and Ankara raises the probability of a potential IS attack against a symbolic, high impact target.
A number of weapons were found during the raids of IS safe houses.

(Click on above image to expand)
The weaponry found ranges from small arms to grenades and assault rifles, even machine guns. Considering the uncontrolled weapon trafficking in Turkey, IS operatives appear to have no difficulty in accessing a variety of weapons, a fact that enhances their operational abilities.
Target Selection Operations
During these operations IS members were caught scouting their candidate target locations and facilities to record the security routines applied, examine them and detect the security gaps and vulnerabilities which they can take advantage of.
A. 10/08/2017: Renat Bakiev, a Russian citizen was caught in Adana close to the Incirlik Air base and confessed that he was planning to shoot down a US military plane with a drone.

(Click on above image to expand)
B. 12/08/2017: An individual with the initials M.A was caught in Ankaraâs Altındağ district collecting information on buildings belonging to the Turkish Grand National Assembly, ministries, military posts and non-governmental organizations.
Both incidents possibly reveal IS intent of attacking higher impact targets. An attack at well protected sites, such as a governmental building or a military base would cause a further lack of confidence among the Turkish society towards the Turkish authorities, meaning that if a highly protected facility is not safe then peopleâs safety is at extreme risk. Further, such an attack will deteriorate even more the security environment in Turkey causing a general political and social unrest and disorientation among the Turkish security forces. Such an environment would facilitate IS recruiting, propaganda tactics and a foothold in vulnerable Turkish provinces.
Plots/attacks Intercepted and the Foreign Element
It is highly likely that Foreign IS operatives will continue entering Turkey through jihadi-controlled border points and plot attacks under remote guidance from non-Turkey based IS command centers.
The national identity of the IS operatives arrested is an indicator of how much focused the international jihad movement is on Turkey. Iranian, Iraqi, Russian, Belgian and Syrian nationals were either arrested during target selection operations or while laying low in safe houses. Apart from IS cells, experienced in operations planning jihadis were caught and confessed their plots, such as the Belgian jihadist, sought by Interpol for his connection to IS attacks in Europe, who is believed to have came to Turkey to organize an attack on Turkish soil. Similarly, the Russian terrorist, who was previously deported from Turkey and managed to enter undetected, was caught for planning an attack at the Incirlik Air Base. The Iraqi, previously arrested for assassination plots in Iraq, was found in Turkey after escaping from Iraqi authorities with the help from IS networks.
The US Treasury Departmentâs announced that a senior Islamic State official, Salim Mustafa Muhammad al-Mansur, the “finance emir for Mosul-Iraq”, had been added to the US government’s list of specially designated global terrorists and that he was tracked inside Turkey in Mersin, Istanbul, and Adana. This shows the capability of Islamic Stateâs networks in Turkey as they helped facilitate the movement of a high ranked terrorist. US intelligence sources say that he left Iraq and moved to Turkey sometime in July. The point of entry is yet unknown.
The presence of foreign IS operatives in such diversity and numbers show their capacity to avoid detection during their border crossing to Turkey and, as in the case of the IS member arrested in Istanbul- Incident No.12-, reveals the remotely given direct guidelines and support they receive to begin plotting their attacks in Turkey. The wide range of the intercepted plots and the candidate targets being scanned, or already selected, during intelligence gathering operations by IS members might seem random, but it is not. Even though some of the plots might be of low scale and opportunistic, there is a clear focus on strategic targets and symbolic figures of Turkey. Further, we should mark IS central commandâs undeterred focus on the country -mostly Istanbul- even though the Turkish State has activated and deployed massive police and counter terrorism units throughout the country.

(Click on above image to expand)
The Hatay Province as a point of entry for IS operatives
The Hatay Province remains a potential point of entry for IS operatives as the human smugglers and Turkish corrupt border guards used by the rebel/jihadi networks at the Syrian side of the border are still active.
The incident occurred on August 19th in Hatay Province, bordering the North-West part of Syria, shows the control the rebel groups have over the Turkey-Syria border crossings in Hatay.
19/08/2017. A vehicle, which entered from the Syrian-Turkish border and headed towards Iskenderun with three Turkish and two Syrian IS supporters on board, was stopped at a security checkpoint at the Topbağazı area in Hatayâs Kırıkhan district by MIT (Turkish National Intelligence Organization), Police and Gendarmerie forces. Four of them were arrested and one who tried to escape was shot and finally died at the Mustafa Kemal University Hospital.

(Click on above image to expand)
IS is expected to intensify its foreign operations after the territorial losses in Syria and Iraq. Turkey, due to its geographic proximity, is facing a worst case scenario of IS operatives crossing the borders from Syria in high numbers and taking advantage of locations in southern Turkey which the Turkish security forces neglect or are unable yet to secure as they focus on PKK insurgents. The Hatay Province is one of those locations as during the Syrian conflict it has been a two-way corridor of Turkish-backed radical Islamists to Syria with massive transportation of personnel, vehicles and weaponry and a reported high presence of radicals at the Hatay villages of Reyhanlı, Yayladağı and Altınözü. If the rebels and jihadis in Idlib Province need to seek refuge in case of a major offensive from the coalition or the Assad regime/Russian forces they will possibly use their networks in Hatay and seek refuge there.
Aydin, Cetin. 2017. Hürriyet. âReina saldırganının esi dahil 11 kisi tutuklandı;â http://www.hurriyet.com.tr/bir-daha-olsa-yine-yaparim-40340861
Dewan,A & Smith,E. 2017. CNN âIstanbul nightclub attack suspect confesses, governor says,â. http://edition.cnn.com/2017/01/17/europe/istanbul-reina-attack-arrest/index.html
Department of Foreign Affairs and Trade, Australia,Canberra. 2017. http://smartraveller.gov.au/countries/europe/southern/pages/turkey.aspx
Foreign and Commonwealth Office 2017, UK. Turkey. https://www.gov.uk/foreign-travel-advice/turkey
GÜLER,Damla. 2017. Hürriyet. âReina katliamcısı pisman degilmis!â http://www.hurriyet.com.tr/son-dakika-reina-katliamcisi-ile-ilgili-flas-gelisme-40362650
Joel Leson. 2005. U.S. Department of Justice, Office of Justice Programs, Bureau of Justice Assistance, Assessing and managing the terrorism threat.https://www.ncjrs.gov/pdffiles1/bja/210680.pdf
McCabe, M. & Harrington, D. 2017. Intelligence Fusion Platform [Online]. London: Ambix. Available: https://www.intelligencefusion.co.uk/
Proteus Security Group. 1997. Risk: A Risk Model. Monograph. The Proteus Security Group, Inc. Available online at http://members.aol.com/proteus101/risk.html.
Sendika. 2016 .The impact of the Syrian war and Turkeyâs Syrian policies on Hatay report.
US Treasury Department. 2017. OFFICE OF FOREIGN ASSETS CONTROL. https://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Pages/20170829.aspx
Yayla, Ahmet S. March 2017. CTC Sentinel, The Reina Nightclub Attack and the Islamic State Threat to Turkey. https://ctc.usma.edu/posts/the-reina-nightclub-attack-and-the-islamic-state-threat-to-turkey
Özgür ALTUNCU & İdris TİFTİKCİ. 2017. Hurriyet. http://www.hurriyet.com.tr/teroristin-yakalandigi-evde-ilginc-not-40338132.
Report written by Panagiotis Vasilias
Back to Reports & Resources

About the author

Book a demo

Close the book a demo popup

Book a Demo

Live and in-depth incident profiles

Intelligence Fusion provides an industry leading platform to help security professionals and global businesses.