By Thomas Abi-Hanna
No one has claimed responsibility for a recent series of attacks in the Cairo area despite the existence of multiple groups eager to strike at the Egyptian state. The recent attacks indicate the emergence of a grassroots terrorist threat in Egypt. Egypt's major jihadist groups have been under pressure from government forces over the past year, undermining their ability to organize and conduct attacks.After a relatively quiet 2018 in terms of terrorist attacks, Cairo and the adjacent tourist destination of Giza have experienced a series of bombings in the past two months. On Dec. 28, 2018, a roadside improvised explosive device exploded next to a tourist bus near the Pyramids in Giza, killing three tourists and an Egyptian tour guide and injuring 11 other people. On Feb. 15, police found three explosive devices, also in Giza. One of them detonated, injuring two police officers and three civilians. Then on Feb. 18, a suspected bombmaker detonated a suicide device while reportedly conducting pre-operational surveillance near central Cairo's Khan el-Khalili market, killing himself and two police officers and wounding three bystanders.
The Big Picture
Attacks by individuals and small groups are limited in their scope and sustainability, but they are also harder for authorities to stop. The emergence of a grassroots threat in Cairo would make attacks more likely, but also smaller and more opportunistic in nature.
Authorities did not suggest the first bombing had links to any particular militant group. Though authorities did blame the last two bombings on numerous militant groups with a history of staging attacks in Egypt, they did not provide evidence for such links. And whereas attacks generally generate claims of responsibility, no group has claimed any of the three attacks, something that is unusual for Egypt.
This suggests Egypt now faces a grassroots militant threat, alongside the extant risk from organized militant groups. This, in turn, means Egypt is likely to suffer more, albeit less potent, terrorist attacks.
An Egyptian Grassroots Terrorist Threat
While Egyptian authorities have not provided any evidence linking the suspect killed Feb. 18 to existing jihadist groups, they have provided evidence he was a skilled bombmaker. Shortly after the suspect died Feb. 18, police searched his apartment and found a well-stocked explosives laboratory containing tools, pipe, wiring and what appears to be precursor chemicals for making explosives. The suspect may have used large sections of well casing to construct a large bomb, such as a vehicle-borne improvised explosive device, as well as smaller pipe elbows that have appeared in small explosive attacks linked to jihadists elsewhere. While police have not tied the suspect to the Dec. 28, 2018, attack against the tourist bus, jars of ball bearings visible in a photo of the suspect's apartment are consistent with the shrapnel added to the device used in that attack.
At 37, the suspect was older than the typical suicide bomber, suggesting he had more training and experience. This would make him akin to the veteran bombmakers prized by terrorist groups rather than just a young, recently radicalized and expendable recruit. The suspect is known to have spent time in the United States and France before his deportation to Egypt — a factor that might have given him opportunities for networking and training.
Surveillance video shows the suspect detonating an explosive device in his backpack just as officers descended upon him, suggesting he chose to avoid imminent arrest rather than plan such an attack. The video also raises the possibility that he may have been conducting surveillance of the prominent al-Azhar Mosque nearby and was only carrying the explosives to ensure he would not be taken alive if his cover was blown.
The decentralized nature of the grassroots terrorist threat makes small, dispersed attacks harder to stop, though it also tends to limit the scope of assaults. None of the three recent attacks was particularly sophisticated or deadly, but the bomber was able to progress through the attack cycle undetected thanks to the inherent operational security that comes with acting alone. Working alone reduces the risk of allowing an informant into a group, having communications intercepted by authorities or jeopardizing the operation when security forces arrest and interrogate one individual. Operational security, however, comes at a price: The greatest of these is that the lone attacker must conduct each step of the attack cycle by himself, exposing militants like the Cairo bomber to interdiction at every step.
All the evidence so far suggests the suspect killed Feb. 18 was a capable, valuable terrorist operator. But the mystery of why no group has claimed responsibility for his actions remains.
A Successful Crackdown on Militant Groups
Part of the solution may lie in the crackdown on jihadist groups in Egypt over the past year. Aggressive counterterrorism operations have thwarted efforts by various jihadist groups to carry out attacks in the capital and other densely populated areas, meaning affiliation with one of those larger organizations gives rise to operational security risks outweighing the reward of tapping the resources of a larger network. This suggests the bombmaker was working alone as a grassroots terrorist conducting attacks across the Cairo region. The lack of reports of further arrests after his death also suggests he was working in isolation.
As the attacks in Egypt show, breaking such terrorist organizations up or at least stopping them from expanding is no guarantee violence will end altogether: Radicalized individuals or small independent cells can continue to carry out attacks.
The dynamic of successful counterterrorism operations against groups resulting in grassroots attacks has been seen before in Western countries and Morocco, where vigorous counterterrorism programs have stymied efforts by hierarchical terrorist organizations to conduct spectacular attacks. This has forced jihadist groups to rely on inspired or directed individuals following the leaderless resistance model of terrorism to conduct attacks in their name.
Terrorist organizations that form networks and cells and allocate resources to maximize the impact of their attacks pose a greater threat to the security and internal stability of a country. But as the attacks in Egypt show, breaking such terrorist organizations up or at least stopping them from expanding is no guarantee violence will end altogether: Radicalized individuals or small independent cells can continue to carry out attacks. But their effectiveness and the duration of their campaigns tend to be limited. The Cairo bombmaker's death, for example, could end the recent string of successful attacks in the Cairo area. Even so, there are doubtless more individuals like him who could choose to follow in his footsteps.
As for militant groups themselves, several prominent terrorist groups continue to pose a threat to Egypt's population centers despite short-term government successes against them. These include the Islamic State's Wilayat Sinai, al Qaeda-linked groups and the Hasam Movement.
Wilayat Sinai
The Islamic State's Wilayat Sinai has waged a multiyear insurgency in the Sinai Peninsula, which it has also used as a base to strike in mainland Egypt. In its most notable terrorist attacks, it brought down a Russian airliner in 2015, bombed Coptic Christian targets in Cairo and Alexandria, and killed more than 500 people in a November 2017 attack on a Sufi Mosque in the Sinai Peninsula. While the number of attacks in Sinai dropped following Operation Comprehensive Sinai 2018 — a yearlong counterterrorism campaign by the Egyptian army — the group has still conducted frequent insurgent attacks against security forces on the peninsula, and was behind the last significant attack in the Cairo area when it targeted a Coptic store and church in Helwan in December 2018. But Egyptian operations have treated Sinai more as a counterterrorism operation rather than a counterinsurgency. The failure to address the underlying grievances helping to drive the insurgency means future attacks are likely.
Al Qaeda-Linked Groups
Various al Qaeda-linked groups operate in different parts of Egypt. Ansar al-Islam, which operates in its Western Desert region, was behind an October 2017 raid that killed dozens of Egyptian soldiers. The group would like to attack targets in Cairo, but it faced significant setbacks in 2018. It lost its leader, Hisham Ashmawy, whom Libyan authorities arrested in October 2018, and is not known to have carried out any attacks that year. Jund al-Islam, meanwhile, operates in the Sinai, where, in line with al Qaeda doctrine, it has largely chosen to strike security forces and foreigners rather than local civilians. Occasionally, it has even attacked Islamic State militants in an effort to win the support of Sinai Bedouin tribes. Ansar al-Islam has previously targeted security forces, high-profile officials and foreign civilians.
The Hasam Movement
The Hasam movement has staged numerous attacks in the Nile Delta, including shootings and bombings targeting police officers in Cairo and Alexandria. During 2016 and 2017, the group maintained a high tempo of attacks, which included assassinations of prominent officials. Aggressive security measures by Egyptian authorities have recently stymied its efforts, and the group has only been linked to three attacks (all unsuccessful) since the beginning of 2018, including a botched attack on the Myanmar Embassy in Cairo.
We expect these groups, and others like them, to continue their efforts. The recent bombings, however, strongly suggest Egypt now also faces a more multifaceted, yet less potent, grassroots threat.