The Islamic State at Low Ebb in Iraq: The Insurgent Tide Recedes Again

Abstract: Following a sustained buildup in attacks throughout 2019 and into first half of 2020, the Islamic State’s insurgency in Iraq underwent a steep decline over the last 20 months. A comprehensive analysis of attack metrics shows an insurgency that has deteriorated in both the quality of its operations and overall volume of attack activity, which has fallen to its lowest point since 2003. The Islamic State is increasingly isolated from the population, confined to remote rural backwaters controlled by Iraq’s less effective armed forces and militias, and lacks reach into urban centers. The downtrend in Iraq is likely attributable to stepped-up security operations, pressure on mid- and upper-tier leadership cadres, and the Islamic State’s refocusing on Syria—graphically illustrated by the January 20, 2022, attempted mass breakout by the Islamic State at Syria’s Ghweran prison. The key analytical quandary that emerges from this picture is whether the downtrend marks the onset of an enduring decline for the group, or if the Islamic State is merely lying low while laying the groundwork for its survival as a generational insurgency.

Incidents like the January 20, 2022, Islamic State prison break¹ at Ghweran, Syria, or the January 21, 2022, massacre of 11 Iraqi Army soldiers in Diyala, Iraq,² give the sense of another Islamic State resurgence,^a but a longer and more methodical survey of attack metrics shows that the Islamic State’s insurgency in Iraq is looking increasingly anemic, in contrast to the sustained resurgence it enjoyed over the course of 2019 and early 2020. Attack activities plummeted across the board in mid-2020, falling from a high of 808 Islamic State-initiated^b attacks in Q2 2020 to 510 during the third quarter of that year. Attack trends persisted in an erratic pattern of ups and downs for the remainder of the period surveyed in this study, averaging 330 per quarter over the remaining 17 months from July 2020 to November 2021. These national-level figures, supported in this article by an exhaustive qualitative and province-by-province breakdown, paint a picture of an insurgency that feels increasingly isolated and disconnected from the broader Sunni Arab population. Under pressure from rolling security offensives, the expansion of the government security footprint further into rural areas, and an energetic campaign of leadership decapitation strikes, the Islamic State is struggling to maintain even historically low levels of attack activity. While all these factors have certainly contributed to driving down attack activity in Iraq, in the authors’ view, they lack the explanatory power to fully account for the ebbing of the insurgent tide over the last 20 months. The key analytical quandary for insurgency watchers that emerges from this study is how much of the Islamic State’s present weakness can be attributed to these variables, or if some other, unseen factor, such as the deliberate preservation of forces by the Islamic State, is driving the trajectory of the insurgency.

This article extends the metrics-based analysis used in three prior CTC Sentinel pieces³ in 2017, 2018, and 2020, adding a further 20 months of Islamic State attack metrics in Iraq, picking up from the start of April 2020 (where the last analysis ended) to the end of November 2021. As in the prior study, this article looks at Islamic State attacks in Anbar, Salah al-Din, Baghdad’s rural “belts,”^c Nineveh, Kirkuk, and Diyala. The authors also look at the Islamic State’s provinces in Syria, making some rudimentary comparisons between activity levels in Iraq and the areas of Syria directly adjacent to the Iraqi theater of operations.^d

As with previous studies, to maximize comparability, this analysis used exactly the same data collection and collation methodology as the December 2018 and May 2020 CTC Sentinel studies. Attacks were again broken down into explosive or non-explosive events,^e and also by the four categories of high-quality attacks (effective roadside bombings,^f attempts to overrun Iraqi security force checkpoints or outposts,^g person-specific targeted attacks,^h and attempted mass-casualty attacksⁱ). As with any set of attack metrics, this analysis represents a partial sample that undoubtedly favors more visible attack types (explosions, major attacks) over more subtle enemy-initiated actions (such as kidnap or intimidation). Nevertheless, as with the previous studies, the immersive, manual coding of thousands of geospatially mapped attacks remains one of the best ways to gain and maintain a fingertip-feel for an insurgency.

The piece will unfold in a recognizable format borrowing from previous studies. First, the authors will review national attacks trends and high-quality attack trends. Then, the piece will proceed with quantitative and qualitative attack trends at the provincial level. Next, the article addresses the question of centralized direction and resourcing. In the period examined in this article, there have been two attack campaigns by the Islamic State that suggest surviving centralized direction and resourcing: first, efforts to carry out “external attacks” into the well-secured Kurdistan Region of Iraq (KRI), and second, an integrated assault on Iraq’s electricity sector in the summer of 2021. Both will be examined in turn. The article will conclude with an analytical section on the potential causal factors of the Islamic State decline (including conditions in Syria) and then discusses the predictive outlook for the future of the Islamic State insurgency in Iraq.

National Trajectory of Islamic State Attacks
The December 2018 CTC Sentinel study of Islamic State attack patterns in Iraq chronicled a stark decline in Islamic State attack metrics in late 2017 and the first half of 2018,⁴ while the May 2020 CTC Sentinel metrics study described a strong partial recovery of Islamic State attacks in Iraq in the second half of 2019 and the first quarter of 2020.⁵ In this new study, as shown in Figure 1, the authors discovered that the partial recovery of Islamic State capabilities in Iraq appears to have peaked in Q2 2020 and has since experienced a slow reversal in quantitative terms.

As the May 2020 analysis predicted (based on metrics up to March 31, 2020), Islamic State attacks continued to increase for some months in Q2 2020, reaching a level similar to 2012 intensity^j (including 315 Islamic State attacks in April 2020 and 319 in May 2020,⁶ a period roughly correlating with Ramadan in 2020^k). Yet this upward trajectory was not sustained. Instead, the number of Islamic State attacks dropped off sharply in June 2020 and throughout the third quarter of 2020, settling back at a level more commonly seen in 2019.⁷ Though undulating above and below the trendline in specific months, the quarterly attack metrics trended downward in 2021. This gradual decline trend is clearer when viewed via the monthly Islamic State attack metrics shown below (Figure 2).

Another very clear trend is a steady and unmistakable decline in the quality of Islamic State attacks in Iraq in late 2020 and 2021. Figure 3 shows the raw numbers of high-quality attacks (effective roadside bombings, attempts to overrun Iraqi security force checkpoints or outposts, person-specific targeted attacks, and attempted mass-casualty attacks). Again, the second quarter of 2020 marked a high point for high-quality attacks within the new study period, but this level of performance was not sustained. As Figure 4 shows, the proportion of high-quality attacks declined, from an average of 61.6% of attacks in Q2 2020 to an average of 41.6% in Q3 2021.⁸ All categories of high-quality attacks also declined, as shown in Figure 5, but two weathered 2020-2021 better than the others. Effective roadside bombing held up relatively well as a tactic, and the targeted killing of specific security and local officials overtook attempted overruns of positions as the second most common high-quality tactic from Q3 2020 onward.⁹ In the authors’ experience of analyzing Iraqi security dynamics,^l this speaks to the Islamic State’s declining capability to win stand-up fights against Iraq security force (ISF) units, with fewer overrun efforts being undertaken and a lower proportion being effective enough to be coded as recognizable overruns. As this study will discuss at various points, the gradual hardening of ISF outposts may have helped in this process, with thermal camera masts^m giving outposts better situational awareness of Islamic State raids mustering to attempt overrun attacks.ⁿ Table 1 in the appendix provides the quarterly national metrics for Islamic State-initiated attacks in Iraq since the beginning of 2018, including across the different categories of high-quality attacks.

Quantitative and Qualitative Attack Trends at the Provincial Level
In terms of provincial-level comparisons (see Figure 6), Diyala produced the highest number of Islamic State attacks in all but four months of the new 20-month dataset,^o confirming its longstanding position as the most consistently active operating environment in Iraq for the Islamic State.¹⁰ One stand-out observation from the new attack data is the growing role of Salah al-Din as a cockpit of Islamic State attack activities in Iraq, with the province moving from being a relative backwater to the second or third most active attack location in any given quarter of 2020 and 2021.^p By contrast, early 2020 Islamic State attack hotspots such as Anbar and the rural Baghdad belts fizzled out in the latter half of 2020 and Kirkuk struggled to maintain a consistently high level of attack activities.¹¹ To dig more deeply into provincial dynamics and trends, the following sections will proceed governorate-by-governorate across the six provinces.

Anbar
In the authors’ May 2020 CTC Sentinel metrics analysis, Anbar was showing signs of recovering as a major Islamic State attack location after years in the doldrums. In the first quarter of 2020, there were three times the number of attacks each month (27.6) than the 2019 average (8.7).¹² This continued in the second quarter of 2020, with a monthly average of 32.3 attacks in Anbar.¹³ But the Islamic State then suffered a precipitous drop-off of all forms of attack in Anbar from June 2020 through to late 2021. While the monthly attack average was 22.5 in 2020¹⁴ due to the high levels of Islamic State activity early in the year, the monthly attack average for the first 11 months of 2021was just 9.0,¹⁵ essentially a return to the very low attack levels of 2019.¹⁶

High-quality attacks in Anbar also dropped sharply after the summer of 2020. In Q2 2020, the Islamic State in Anbar was still striking out regularly from rural redoubts in the Wadi Husseinat, on the high plateau east of Rutbah.¹⁷ Effective overruns were targeting border guard stations on the Syrian, Jordanian, and Saudi borders, as well as outposts on the highways ringing the central desert plateau.¹⁸ Islamic State cells were moving back down onto the International Highway between Amman and Baghdad to abduct truckers and security forces at fake military checkpoints.¹⁹ Notably, the Islamic State was beginning to construct car bombs and motorcycle bombs in this redoubt for use in intimidation attacks on Sunni cities like Rutbah, Ramadi, and Fallujah.²⁰ Effective roadside bombs were being used an average of 10.6 times a month in Q2 2020, including vehicle-carried devices detonated at highway bridges as a form of vehicle-emplaced roadside bomb.²¹

Fast forward to the second half of 2021 and the picture changed considerably. There were 32 Islamic State attacks overall in Q3 2021, versus 97 in Q2 2020.²² Vehicle bombings and other attempted mass-casualty attacks were down to zero in the second half of 2021.^{23 q} Effective roadside bombings dropped to 2.2 per month in the second half of 2021 versus 10.6 per month in the second quarter of 2020.²⁴ With the exception of some Islamic State raiding around Nukhayb,^{25 r} overrun attacks in Anbar largely ceased, with just 1.6 overrun attacks per month in July-November 2021 versus an average of 6.6 per month in Q2 2020.²⁶ In general, Anbar Islamic State cells have migrated toward the softest of soft targets: dropping electricity pylons and abducting and ransoming shepherds.^s

Baghdad Belts
Like Anbar, the Baghdad belts (areas constituting heavily irrigated farmlands in rural districts bordering Baghdad but not within the city limits) were recovering as an Islamic State attack location in early 2020, with an average of 37 attacks per month in Q2 2020,²⁷ high for the post 2014 insurgency around Baghdad but lower than even the quietest moments in Iraq’s 2003-2011 insurgency.^t Yet even this level of activity dropped off sharply in July 2020 and has not yet recovered at the time of writing. By the third quarter of 2021, the monthly average in the Baghdad belts dropped to 13.3 attacks.²⁸ Of note (see Figure 7), high-quality attacks in the Baghdad belts dropped by an exact order of magnitude, from 23 per month in Q2 2020 to 2.3 per month by Q3 2021.²⁹ The roadside bombing cells active in western Baghdad’s Abu Ghraib in the latter half of 2019 disappeared completely, with effective roadside bombings in the Baghdad belts dropping from a monthly average of 13.3 in Q2 2020 to a measly 0.6 in Q3 2021.^{30 u} Overruns of rural checkpoints in the Baghdad belts dropped from an average of five per month in Q2 2020 to 0.3 per month in Q3 2021.³¹ Precision killings also dropped from an average of five per month in Q2 2020 to 1.6 per month in Q3 2021.³²

As was the case in the authors’ May 2020 CTC Sentinel metrics analysis,³³ the northern Baghdad belts remained the principal locus of Islamic State attack activity in the Baghdad belts in the new data coverage period, accounting for 49.2% of all attacks in the Baghdad belts and 60.3% of all high-quality attacks in those areas.³⁴ Areas such as Tarmiyah, Mushahidah, Taji, and Soba Saab al-Bour continued to be tough operating environments in Baghdad for ISF units and tribal militias throughout the period on which this study focuses.^{35 v} Tarmiyah is historically viewed by the Iraqi intelligence community³⁶ as the major “switch-point” between the Islamic State operating areas west of the Tigris (Anbar, the Euphrates River Valley, plus desert zones around Lake Tharthar) and those to the east (radiating northeast up the Tigris, Udhaim, and Diyala River Valleys, and the Kurdish border). As one Iraqi intelligence operator noted: “Tarmiyah was the first wilayat of Al-Qaeda in Iraq and all the walis of Baghdad have sheltered there.”³⁷ Yet, as the next section on Salah al-Din will note, the Islamic State may have found Tarmiyah too hot to handle in the face of sustained ISF^w and coalition pressure,^x prompting an apparent relocation of the redoubt further north to Yethrib.

As in other provinces, the Baghdad belts saw a steep decline in the quality of Islamic State attacks during the new data period. In Q2 2020, the Islamic State still carried out numerous effective ambushes and roadside bombings,^{38 y} and successfully attacked Iraqi Army battalion and brigade headquarters.^z Yet Islamic State high-quality attack activity in the northern Baghdad belt dropped off sharply from August 2020, and then again (almost to nothing) from April-May 2021 onward.³⁹ Aside from sporadic targeted killings and half-yearly efforts to send a suicide bomber into Baghdad,⁴⁰ the northern belts grew extraordinarily quiet in 2021, and almost devoid of high-quality attacks.^{41 aa}

Salah al-Din
The authors’ May 2020 CTC Sentinel metrics analysis characterized Salah al-Din as a formerly sleepy Islamic State operating location that was waking up and becoming highly active in early 2020,⁴² ranking as the third most active Islamic State attack location (after Diyala and Kirkuk).^ab In Q2 2020, Salah al-Din suffered an average of 44 Islamic State attacks per month, including an average of 26 high-quality attacks (59.0% of all attacks, comparable to the national average of 61.1%).⁴³ Compared to other provinces, Salah al-Din saw a more sustained and even pattern of attacks in late 2020 and 2021 that only gently declined over a longer period. For instance, between April 2020 and November 2021 attacks halved in Diyala, reduced to one-third of their April 2020 levels in Baghdad and one-quarter in Nineveh, to one-seventh in Kirkuk and one-eighth in Anbar. In contrast, in Salah al-Din, Islamic State attacks were still more than half their April 2020 levels (40 attacks) by November 2021 (24 attacks).⁴⁴

Admittedly, Islamic State attacks in Salah al-Din became much lower quality in late 2020 and 2021, with a 39.4% decline in all attacks from Q2 2020 to Q3 2021, but a whopping 71.8% decline in high-quality attacks during the same period.⁴⁵ The type of high-quality attack that held up the most between Q2 2020 and Q3 2021 in Salah al-Din was targeted killings: Whereas roadside bombs dropped by 64.9% over this period and overruns by 85.8%, targeted killings continued at almost unchanged levels from Q2 2020 to Q2 2021 (4.6 attacks per month in Q2 2020 and four attacks per month in Q2 2021).⁴⁶ A high proportion of the Islamic State’s remaining effective attacks in Salah al-Din was actually some variation of active defense measures,⁴⁷ such as raiding, mortaring, and sniping at the security forces surrounding Islamic State redoubts like the Jallam Desert, the Zarga area south of Tuz Khurmatu, the Makhul range, and the desert west of Bayji.⁴⁸ Overall, in the authors’ assessment, the Islamic State tried very hard to prevent security forces from making greater inroads into Islamic State rural redoubts in Salah al-Din.⁴⁹

The only notable offensive campaign launched by the Islamic State in Salah al-Din in the period examined in this article seems to have been a determined effort to build a new defensive bastion in Yethrib, a densely irrigated farming community in southern Salah al-Din that fills the eight-mile space between Balad city and Balad airbase. Only 40 miles north of Baghdad, Yethrib may have been developed by the Islamic State from June 2020 onward^{50 ac} as an alternative to Tarmiyah as the “switch” point between the Syria-Euphrates line of Islamic State guesthouses and the lines branching off east of the Tigris to Jallam, Diyala, Hamrin, and Kirkuk. There certainly does appear to be a correlation between the July 2020 drop-off of Islamic State activity^ad in Tarmiyah and the ramping up of Islamic State activities in Yethrib, just 20 miles north of Tarmiyah and directly accessible via farming areas between the Tigris and the main north-south road corridor, Highway 1. Throughout 2020 and 2021, the Islamic State accelerated the targeted killings of Yethrib tribal, government, and security force leaders,⁵¹ a familiar pattern (in the authors’ experience) in areas where they seek to overawe the local populous and establish “no-go” zones for the security forces and farmers.⁵² The worsening situation in Yethrib gained national and international notice when the Islamic State undertook a massacre of tribal militia and police troops at a funeral in Yethrib on July 30, 2021, killing at least eight persons and wounding at least 19.⁵³ If the authors’ identification of a new Islamic State base zone at Yethrib is accurate, it would be an indication that the movement can still undertake a kind of operational-level redeployment in order to avoid intensive targeting by government forces (such as the ISF surge at Tarmiyah in early 2020).⁵⁴

Nineveh
In their May 2020 CTC Sentinel metrics analysis, the authors took note of what seemed to be an increasingly strong and well-entrenched insurgency taking root in Nineveh.⁵⁵ Overall attack activity rose continuously through 2019, before surging to an average of 34.1 attacks per month in the six month-period including Q4 2019 and Q1 2020.⁵⁶ And yet during the following months, Nineveh showed a clear downtrend in insurgent activity, with attacks falling steadily from an average of 31.3 per month in Q2 2020 to 19.7 during Q3 2021.⁵⁷ Islamic State attacks then recovered somewhat for around a year, then fell into another less pronounced decline to an average 16.7 attacks per month after June 2021.⁵⁸ Effective roadside bombing activity in the Tigris River Valley (TRV)^ae—the main driver of quality attacks in the province—all but shut down during the latter half of 2021, averaging just 2.5 attacks per month.⁵⁹

High-quality attacks in Nineveh saw an even steeper decline, from an average of 20.6 during the busy second quarter of 2020 to 4.6 in Q3 2021.⁶⁰ The decline in high-quality activity noted across Iraq during the period covered in this study was particularly stark in Nineveh. In the first half of 2020, the rural TRV south of Mosul was experiencing an energetic insurgent roadside bomb campaign. IED cells based out of historic insurgent staging grounds in Hammam al-Alil, Ash Shura, and the Jurn corridor generated an average of 15 effective roadside bombings per month in the first six months of 2020,⁶¹ mostly targeting tribal militia and police vehicles on local road systems.⁶² Local emergency police and tribal militia checkpoints were routinely targeted with drive-by gunfire attacks and rural Sunni Arab communities were subjected to persistent insurgent intimidation via roadside bomb strikes on produce trucks, irrigation pumps, and farming equipment.⁶³ ISF and Shi`a Popular Mobilization Force (PMF) clearance operations into insurgent fallback zones in the deserts west of Highway 1 were aggressively contested by the Islamic State with effective, high-casualty roadside bombings and ambushes.⁶⁴

During the latter half of 2021, attack activity in Nineveh was almost entirely sustained by two dramatic spikes in the demolition of electricity transmission lines in July and August 2021.^af One of the more intriguing aspects of the insurgency in Nineveh was the possible reactivation of local bombing cells to join in the Islamic State’s national campaign of pylon attacks.^ag The uptick in pylon strikes in Nineveh in Q3 2021 was particularly noticeable in otherwise dormant operating areas such as Mosul’s western rural “belts,”^ah an area that was the focus of an intensive Islamic State mukhtar (tribal chiefs and village elders) killing effort in 2018 and 2019.⁶⁵ In the authors’ assessment, this hints at a latent kinetic attack capability that was briefly switched on and off, presumably with some degree of centralized direction.

By the end of 2021, attack activity in Nineveh had largely tapered off, with the province apparently relegated by the Islamic State to the role of a transit corridor and temporary staging hub. The apparent deactivation of Nineveh as an insurgent attack area after Q2 2021 was accompanied by a noticeable increase in reports of transit by Islamic State cells through the province toward active attack locations like Salah al-Din and Kirkuk.^ai Based on reports of successful arrests of would-be infiltrators, it is likely that a stream of Islamic State members and their families entered Iraq from Syria during the latter half of 2021.^aj The majority of these Islamic State returnees crossed into Iraq along the border between Nineveh and northeastern Syria’s Hasakah province, before moving down the Islamic State ‘rat line’ of guesthouses in the TRV and Wadi Tharthar to the Lake Tharthar area and the Euphrates River Valley north of Baghdad.⁶⁶ During their transit through Nineveh, these Islamic State groups passed through former Islamic State rural redoubts around Tal Afar, Ayadhiyah, and the Jurn corridor⁶⁷—all areas where security operations continue to turn up large stocks of cached weapons, explosives, and other materials, but where the Islamic State has apparently made no significant effort to recommence attacks.^{68 ak} This may be another indicator that northern Nineveh is an area of latent insurgent potential for the Islamic State, if and when the movement decides to reactivate its attack activities there.

Kirkuk
Kirkuk province was another powerhouse of the early 2020 insurgency⁶⁹ that struggled in late 2020 and during 2021 to sustain its elevated status. In Q2 2020, attacks in Kirkuk spiked to 54.3 per month, driven by a remarkably strong surge in attacks during April and May (i.e., Ramadan) following a slow start to the year over the first quarter of 2020.⁷⁰ From Q3 2020 to Q1 2021, Kirkuk saw a steady decline in activity, dropping to a record-low monthly average of 14.0 attacks in Q1 2021.⁷¹ Attack activity in Kirkuk then bounced back up to an average of 39.6 average monthly attacks during Q2 2021 and 44.3 in Q3 2021, followed by a notably weak final quarter (including a prorated December based on the average of October and November metrics), with the monthly average dropping to 16.3 attacks.^{72 al}

High-quality attacks in Kirkuk declined, falling sharply from an average of 32 high-quality attacks per month during Q2 2020 to a low of 6.6 in the first quarter of 2021.^am Though high-quality attacks did slightly increase again (to an average of 12.6 per month in Q3 2021),⁷³ effective attacks represented a significantly diminished percentage of all Islamic State-initiated activity (30% of all Q3 2021 attacks, versus 58.8% of Q2 2020 attacks).⁷⁴ Effective roadside bombings and successful outpost overruns saw the most dramatic drop-offs in Kirkuk, falling from an average of 15.7 and 13 attacks per month in Q2 2020 to 4.9 and 2.7 averaged across the Q3 2020 to Q3 2021 period, respectively.⁷⁵ Targeted killings held up slightly better, declining from an average of six per month in Q2 2020 to 3.4 over the subsequent 17 months.⁷⁶ In the authors’ assessment, this pattern of striking softer targets usually occurs in areas across Iraq where the Islamic State is less confident that it can tactically overmatch ISF units.^an

A detailed review of attack activities, ISF clearance operations,⁷⁷ and coalition surveillance patterns⁷⁸ suggests that the Islamic State has struggled to expand its geographic footprint in Kirkuk since the May 2020 CTC Sentinel study. Despite a consistent pattern of “mukhtar slayings”^ao plus other targeted killings and lower-visibility intimidation of local communities, the Islamic State has been unable to expand^ap from its sanctuaries along southern and western edges of Kirkuk province into the more densely populated Jabbouri tribal confederation^aq farming areas of Hawijah, the Mahuz triangle, and the Riyadh corridor, all historic strongholds for insurgent groups like Jaysh Rijal al-Tariq al-Naqshabandi (JRTN) and Ansar al-Sunna.⁷⁹ As in May 2020, Islamic State activity is restricted to the thinly populated Obeidi tribal confederation areas^ar of Rashad and Daquq districts, where hardscrabble, semi-abandoned farming villages are interspersed with impassable, densely vegetated wadi canyons.⁸⁰ Much of the Islamic State’s intimidation efforts in rural Kirkuk (i.e., killings and abductions of local farmers) seem purely predatory in intent, aimed at generating protection payments and extorting food and other supplies, as opposed to offensive shaping of the human terrain to support an active insurgency.^as Sporadic attempts by the Islamic State to stage mass-casualty IED and suicide bombings in urban Kirkuk also largely tapered off in the latter half of 2020 and have not yet returned.^at An Islamic State-planned suicide assault and prison break in Kirkuk city in April 2021 was successfully disrupted by security forces.^au In the authors’ assessment, the Islamic State attack cells have been all but locked out of urban Kirkuk—at least temporarily—by security force and popular vigilance.⁸¹

In the authors’ view, one key factor in the decline in high-quality rural attacks in Kirkuk (and more broadly) —particularly the steep drop-off in successful outpost overruns—has been the distribution of mast-mounted thermal camera systems among the dense mosaic of Federal Police brigades stationed in the Kirkuk farmbelts and in Samarra in Salah al-Din.⁸² While Iraqi Federal Police forces still rarely venture outside their outposts after nightfall, when insurgents are at their most active, the camera masts have greatly improved basic situational awareness.⁸³ By distributing camera masts down to small squad-sized rural security posts,⁸⁴ the Iraqi Federal Police have developed a system of interlocking mortar-fire support bases, establishing what amounts to nocturnal “free fire” zones⁸⁵ that have reduced the Islamic State’s nocturnal safety and freedom of movement.⁸⁶ This seems to be reflected in the declining number of successful outpost overruns, and their replacement by less effective nocturnal sniping and stand-off small-arms and rocket-propelled grenade (RPG) harassment, and in particular by the rise of sniping activity dedicated to damaging mast-mounted cameras.⁸⁷

Diyala
In their May 2020 CTC Sentinel study, the authors tracked a gradual ramp-up of the insurgency in Diyala during the latter half of 2019, culminating in the Q2 2020 with a peak average of 70.7 attacks per month.⁸⁸ As in most other provinces, Islamic State attacks in Diyala then dropped sharply—to 37 in August 2020—coincident with the culmination of major ISF operations in Diyala.⁸⁹ Despite periodic fluctuations, overall activity remained at this level with remarkable consistency, averaging 37.8 attacks per month for the Q3 2020 to November 2021 period.⁹⁰ While well below the high of 2017 (when the Islamic State launched an average of 79.6 per month),⁹¹ attacks in Diyala are now consistently falling between the Diyala monthly attack averages of 2018 (26.9) and 2019 (45.8).⁹²

While the overall quality of attacks in Diyala underwent a noticeable decline in the coverage period of this study, the downtrend was less pronounced than in other governorates, with high-quality attacks in Diyala averaging 35.5% of all Islamic State-initiated activity in the latter three quarters of 2020 and 25.3% throughout 2021.⁹³ The category of high-quality attacks that occurred most consistently was targeted killings, which declined from an average of five monthly attacks in the second half of 2020 to 3.5 in 2021.^{94 av} Effective roadside bomb activity nearly halved, falling from an average of 9.8 attacks per month during the latter half of 2020 to 4.9 in 2021.⁹⁵ Attempted overruns of ISF outposts became rarer, declining from an average of five per month in Q2 2020 to only one per month in Q3 2020 to Q4 2021.⁹⁶ Even in successful outpost attacks, the majority of security force casualties were typically incurred during follow-on IED strikes on reaction forces.^aw

The absence of major outpost overrun efforts by the Islamic State in Diyala was partially offset by persistent sniping and long-range small-arms harassment of road checkpoints and rural security posts.⁹⁷ Islamic State sharpshooters—frequently equipped with rifle-mounted night-vision optics^ax—kept up a near nightly pattern of these attacks, averaging around 22.7 per month in Q3 2020 and Q3 2021.⁹⁸ While these attacks rarely produced multiple fatalities (at worst, one killed and two injured in severe incidents but more often no killed but rather one or two wounded),⁹⁹ the sheer volume of sniping activity accounted for a significant portion of all security force casualties in the province.¹⁰⁰

As the authors’ noted in their 2016 CTC Sentinel analysis of the Islamic State’s insurgency in Diyala, the varied physical and human terrain and unique sectarian dynamics have long given the Diyala insurgency a somewhat autonomous and self-contained character,¹⁰¹ distinctive from insurgent operating areas more directly connected with the Islamic State’s Syrian and western Iraq systems.¹⁰² The variegated local character of each mini-insurgency in Iraq was fully in evidence throughout the new data period surveyed in this study, particularly in Diyala. In contrast to governorates such as Kirkuk or Anbar, where the local insurgencies have been pushed back or confined to remote desert or “deep rural” redoubts,^ay the Islamic State has maintained a presence in nearly all of Diyala’s subdistricts, from the Kurdish badlands of Kifri district in the north to the palm groves and highway corridors between Baqubah and Baghdad in the south.¹⁰³ A particularly noticeable aspect of Islamic State operations in Diyala, which has given the local insurgency some of its dynamic flavor, is the presence of persistently operating mortar, sniping, and bomb-making teams within each local cell across the entirety of the province at the same time.^{104 az} The western suburbs of the governorate center of Baqubah—a historic AQI and Islamic State of Iraq stronghold going back to the mid-2000s¹⁰⁵—remains the only urban area in Iraq where the Islamic State still mounts attacks on a fairly regular basis, including under-vehicle bombings and other targeted hits on government and security officials.¹⁰⁶

Evidence of Centralized Direction and Resourcing
Among the campaign objectives of the coalition war in Syria and Iraq against the Islamic State^ba was the erosion of the Islamic State’s ability to undertake coordinated multi-city actions in Iraq¹⁰⁷ or to mount “external operations”¹⁰⁸ against foreign targets in better-secured environments abroad. These kinds of actions typically require a degree of centralized direction and resourcing that exceeds the capabilities of a locally focused rural insurgency.^bb As a result, they make good yardsticks concerning the degree to which the Islamic State has been splintered into small, low-impact local cells. Iraqi government intelligence professionals currently view the Islamic State as being highly decentralized,¹⁰⁹ with each wilaya controlling most of its own resources—businesses and extortion rackets, cash and gold hoards, and cached explosives.¹¹⁰ Yet in the coverage period of this study, there have been two Islamic State attack campaigns that appear to hint at surviving centralized direction and resourcing: first, efforts to conduct ‘external attacks’ into the well-secured Kurdistan Region of Iraq (KRI) and second, an integrated attack on Iraq’s electricity sector in the summer of 2021, which saw the simultaneous, coordinated spike in pylon strikes across every Islamic State wilaya in northern and central Iraq.¹¹¹

‘External Attack Planning’ against Iraqi Kurdistan
While not strictly an ‘external operation’ undertaken abroad, one visible example of ongoing centralized direction and external attack plotting appears to be the determined and well-resourced Islamic State effort to penetrate the KRI, which is separated from federal Iraqi provinces by a militarized internal border (known formally as the “Kurdish Control Line”)^bc and which enjoys a qualitatively better security situation than Iraq proper.^bd According to Iraqi government intelligence professionals,¹¹² the Islamic State’s motive for striking Kurdistan has been to demonstrate that the group can strike anywhere it chooses, even comparatively hardened locations. In this sense, Kurdistan may now play the same role that Islamic State “reach”¹¹³ attacks into the “deep south” of Iraq (particularly Basra and the Dhi Qar area of Batha) used to play in demonstrating the group’s ubiquitous access to targets far removed from Islamic State launch pads in northern and central Iraq.^{114 be}

After the liberation of Mosul in 2017, the then Islamic State leader Abu Bakr al-Baghdadi tasked a senior operative called Khuzair Abbas Dahlaki to develop an attack campaign against the Kurdistan Region.^bf To develop this campaign, during 2018-2019, various patient efforts were made to probe and test Kurdistan Region entry procedures by air travel and land border movement, with persons brought to the KRI capital of Erbil from refuges like Al-Hol camp, Baghdad, northwestern Iran, or cities in southeastern Turkey, including Adana, Gaziantep, and Sanliurfa.¹¹⁵ In many cases, the Islamic State operatives bedded down and went inactive for a year or more before later being contacted and activated.¹¹⁶

In early 2021, the Islamic State’s probing of the KRI was upgraded into an intensified, centrally directed, penetration effort, with effects soon felt on the ground. According to the authors’ canvassing of Kurdish counterterrorism and intelligence agencies,¹¹⁷ this was the result of directives issued by Islamic State leader Amir Muhammad Said Abdul Rahman al-Mawla (also known as Hajji Abdallah), who replaced al-Baghdadi in November 2019.¹¹⁸ Sometime in the latter half of 2020 or early 2021, al-Mawla ordered the Islamic State to form a new Kurdistan Wilayat, seeking to incorporate the remnants of various Kurdish salafi terrorist groups—including Ansar al-Islam,¹¹⁹ the al-Qa`ida in Kurdistan Brigade (AQKB),¹²⁰ and Kurdish combat units of the Islamic State^{121 bg}—into a single organization. Prior to the 2021 incidents,^bh successful attacks in the KRI mostly involved homegrown Kurdish salafi terrorist networks in 2015^bi and 2018.^bj

The first new Erbil-based attack cell was rolled up in April 2021, with another cell taken down in July, a third in September and a fourth in December 2021.¹²² In the southern Kurdistan Region, security forces nabbed a small, family-based Kurdish salafi cell in Said Sadiq, near Halabja in January 2021,¹²³ followed by another large group based in Halabja and several other towns in the southern KRI during March-April 2021.¹²⁴ Another cell was captured in Chemchemal in July 2021.¹²⁵ Finally, a second larger network was rolled up in the Halabja area in December 2021, though this latter group was made up entirely of local salafi Kurdish militants and had no established operational links with the Islamic State.¹²⁶

In many respects, the Islamic State penetration effort in the KRI bears a greater resemblance to the European attack plots directed by the Islamic State’s notorious external operations bureau during its terrorist heyday in 2015-2016 than with contemporary insurgent operations in Iraq proper.^bk The majority of the 2021 attack plots in the KRI were guided, if not directly controlled, by the Kurdistan Wilayat’s emir, Abu Harith,^bl and by Syria- and Turkey-based Islamic State amnis (external operations and intelligence operatives).^bm Indeed, the role played by Islamic State networks in southeastern Turkey in enabling operations in Kurdistan stands out as a key feature of the group’s activities in the KRI. Turkey-based facilitators were directly involved in supplying two of the KRI cells with firearms and bomb components.¹²⁷ Islamic State facilitators, logisticians, and smugglers operating out of southeastern Turkish cities and Istanbul were responsible for moving Islamic State recruits and operatives from Syria and facilitating their entry into the KRI via ‘rat lines’ through Iran and the Lake Van area.¹²⁸

The cells taken down in Erbil in 2021 were made up predominantly of young Iraqi Arabs,^bn either conscripted into the Islamic State during the final phase of its territorial control in Iraq or recruited after its transition back into a clandestine insurgency.¹²⁹ Each cell was formed by or organized around an experienced terrorist operator.^bo In several cases, young recruits without insurgent histories appear to have been deliberately used to minimize the risk of operators being flagged by Kurdish security agencies.^bp Target reconnaissance operators entered and left Kurdistan in 2019 without engaging directly with in-place attack cells, though at a later point in 2021, cells were sometimes detected due to their pre-attack foot reconnaissance of potential targets.^bq Only three of the cells taken down in Erbil and the southern KRI managed to acquire weapons—crude explosive devices with command wire detonators, suppressed handguns and rifles¹³⁰—while the remaining five were successfully disrupted by Kurdish counterterrorism agencies before they could arm themselves.¹³¹

Overall, Islamic State external operations plotting against the KRI was more determined than successful.^br The cells that reached Erbil made the same unimaginative targeting choices that characterized earlier attack plots,^bs fixating on hardened or high-visibility government targets such as the Erbil governorate building (aiming to repeat the July 2018 shooter team attack outlined in footnote BJ¹³²) and the touristy bazaars around the citadel in downtown Erbil.¹³³ A specific and to an extent myopic focus on security targets also continued to characterize their target selection.^bt The authors began to detect a shift in Islamic State targeting priorities in the KRI in summer 2021, possibly reflective of changed operational guidance from above.^bu In addition to their other targets, both cells taken down in Erbil in July and September 2021 also planned to target malls and other locations frequented by foreigners, including military or diplomatic personnel.¹³⁴

In the southern Kurdistan Region (i.e., Sulaymaniyah and Halabjah provinces), Islamic State cells have traditionally shown a more imaginative and locally informed approach to their target selection, reflecting their roots in local Kurdish salafi mosque networks.^bv Islamic State cells taken down in Chemchemal and Halabja were actively planning to conduct assassinations of Asayesh officers as well as kidnappings for ransom of affluent local nationals to fund their operations.^bw Southern KRI-based cells entering via Iran or the Kirkuk, Tuz Khurmatu, and Diyala areas have also tended to include more veteran Islamic State operators (usually of Kurdish background) with experience fighting in the insurgency in federal Iraq.^bx

The 2021 ‘Pylon Campaign’
A second potential example of a centrally inspired campaign could be the escalation of attacks against Iraqi electricity transmission and distribution systems from November 2020 onward, and particularly in the summer of 2021. Though it is always difficult to say with certainty who attacked pylons in Iraq and for what primary motive,^by careful case-by-case parsing of attack reports produced the assessment below (Figure 8) of pylon attacks (and attacks on pylon repair crews) that can reasonably be ascribed to the Islamic State.^bz The campaign bore some resemblance to the late 2004/early 2005 coordinated effort^ca by AQI to black out Iraq’s electrical system and related water treatment and pumping systems, which included a widespread pylon destruction campaign.

The 2020-2021 pylon campaign reached its crescendo in Q3 2021, at the period of peak heat and electricity demand in Iraq,^cb and just a few months ahead of Iraqi general elections in early October 2021.^cc The focusing of significant numbers of attacks on pylons is also reminiscent of the centrally inspired but largely decentralized 2019 campaign of crop-burning by Islamic State cells in farming communities across Iraq during the drought of that year.^cd Like the crop-burning campaign of 2019, the 2021 pylon campaign by the Islamic State is assessed by Iraqi government intelligence officers to have been an effort to demonstrate the ongoing relevance and potency of the Islamic State and its ability to have more than local or tactical effects.¹³⁵ “It was an effort to say ‘we are still here,’”¹³⁶ noted one senior Iraqi intelligence officer specializing in the counter-Islamic State mission. An alternative explanation, given the dearth of Islamic State leadership commentary on the pylon attacks, is that the pylon (and crop-burning) attack series were an example of local Islamic State cells logically identifying pylons as a more attractive target during periods of peak heat, and/or mimicking a growing trend of such attacks.

As Figure 9 shows, the pylon campaign was mostly focused in the provinces of Kirkuk, Diyala, Nineveh, and Baghdad, albeit with every Islamic State wilaya in Iraq taking part.¹³⁷ Three 400Kv heavy transmission lines were targeted repeatedly: the Iran-Diyala line, the Kirkuk-Qayyarah line, and the Qayyarah-Mosul line.¹³⁸ Numerous 132Kv local transmissions lines were repeatedly targeted at Udaim and Buhriz (in Diyala’s Udaim and Diyala River Valleys), on the lines that handrail the Kirkuk-Beyji and Kirkuk-Tikrit highways, and at connection points to distribution networks serving towns such as Samarra, Dour, Balad, Muqdadiyah, Khanaqin, Hawijah, Dibis, Al-Qaim, Nahrawan, and Taji.¹³⁹ In the northern Baghdad belts, the Islamic State struck repeatedly in the Tarmiyah area and with a special focus on the Karkh water treatment plant,¹⁴⁰ the same node used in late 2004 to cut off western Baghdad’s drinking water supply.¹⁴¹

The Apparent Weakening in Iraq of the Islamic State: Causality
The prior May 2020 CTC Sentinel Islamic State attack metric study¹⁴² highlighted three causal drivers that seem to shape Islamic State attack activity in Iraq. One is the situation in Syria, where civil war conditions gave the Islamic State an influx of foreign fighters, territorial resources, a sanctuary, and access to heavy weapons and explosives.¹⁴³ The second and third drivers are interrelated and discussed together below: the status of ISF leadership and capabilities, and the degree of international support given to the ISF by the U.S.-led coalition.¹⁴⁴ These levels of analysis are still useful ways to approach the issue of why Islamic State attacks levels increase or decline in Iraq, and how they will evolve in the future.

The Role of Syria
On the issue of Syria, the May 2020 CTC Sentinel analysis partially attributed the surge of Islamic State attacks in Iraq in the latter half of 2019 and early 2020 to an influx of veteran insurgent manpower^{145 ce} released by the collapse of the final Islamic State-held pockets in the Syrian Middle Euphrates River Valley (MERV) in March 2019. Does it follow, therefore, that some reduction of this flow might be partially responsible for the stagnation and qualitative decline of the Islamic State insurgency in Iraq in the second half of 2020 and much of 2021?

To better understand the Islamic State operating environment over the border in Syria, it is useful to make a rudimentary comparison of Islamic State attack metrics in Iraq and Syria during the Q2 2020 to Q4 2021 period. The authors drew on a geolocated incident dataset collected using a broadly comparable methodology for collating and categorizing attacks (including a separate category for high-quality attacks, grouped under the same definition).¹⁴⁶ There remain persistent issues with building a comprehensive picture of Islamic State activity in Syria, including significant—and probably deliberate—under-reporting by the Islamic State of its attack operations.¹⁴⁷ In addition, differences between the information gathering and media environments in Iraq and Syria make drawing a quantitative like-for-like comparison of monthly SIGACT tallies between individual Iraqi and Syrian provinces a challenging exercise. Nonetheless, the authors believe the data on Syrian attack metrics is sufficiently deep to infer a vague relationship between trends in attack activity in Syria and Iraq.

Interestingly, the authors noted a tentative but almost exact inverse relationship between Iraqi and Syria attack trends by the Islamic State.^cf The drop-off and then slow decline of the Islamic State insurgency in Iraq after Q2 2020 was exactly mirrored by a sustained ramp-up in Islamic State attacks in adjacent regime-held areas of Syria. For instance, the peak of the Islamic State’s 2019-2020 buildup in Iraq was an exceptionally quiet time for the Islamic State in Syria, with an average of just 20.3 Islamic State attacks per month in regime-controlled areas of Syria from Q3 2019 to Q1 2020.¹⁴⁸ As the Islamic State got less active in Iraq in the second half of 2020, there was a gradual increase in Islamic State attacks in Syria,^cg to a peak average of 38 attacks per month in Q1 2021. As Iraq briefly saw a partial recovery in the late summer of 2021, Islamic State attacks in Syria got quieter again.^ch There is no direct relationship between rises or drops in Islamic State attacks in Iraq and those in Syria (the two theaters are scaled differently, for instance with an average of 135.3 attacks per month in Iraq in Q1-Q3 2021, versus an average of 29* attacks per month in Syria over the same period) but the exact inversion is nonetheless intriguing, even if potentially coincidental.^ci

Anecdotal reporting from Iraqi intelligence officers with a special focus on the Islamic State¹⁴⁹ suggests that they (Iraqi government analysts) believe the ‘upstream’ release of veteran fighters from Turkey, Iran, and Syria into Iraq is still a driver of the operational tempo of the Iraqi insurgency.¹⁵⁰ As noted in the Nineveh section of this article, ISF arrest reports¹⁵¹ do suggest a growing pattern of Islamic State combatant and family border-crossings into Iraq from Al-Hol (via Rabia and Sinjar), as well as other less direct routes via the Turkish and Iranian borders with the Kurdistan Region. In the same manner that Mayadeen in Syria was a ‘release point’ for operational Islamic State reserves during the 2014-2019 major combat operations,^cj and Turkey was a similar spigot for strategic reserves of fighters,^ck it is likely that Idlib, Al-Hol, and Turkey still serve as a reservoir of Islamic State combat veterans who have only been partially remobilized by Islamic State leadership thus far.^cl The January 20, 2022, prison assault in Ghweran, Syria, is a reminder that prisons in Iraq and Syria are another potential pooling of reserve forces that the Islamic State may seek to draw upon more regularly in the future.

Iraqi Capabilities and Coalition Support
Within Iraq, it appears clear that ISF operations, backed by coalition intelligence and airstrikes, have been a factor in driving back down Islamic State attacks from their recent apex in May 2020. Kirkuk, Nineveh, Baghdad, and Anbar all witnessed dramatic downturns in the quantity and quality of Islamic State attacks from June 2020 onward.¹⁵² In the authors’ view, this decline can be partly explained as a natural reset after a surge of activity during the Islamic State’s Ramadan offensive.^cm This spring 2020 Islamic State surge can also be partially explained by the accelerated drawdown of coalition forces from forward advisory locations in north central Iraq,^cn the distraction of the coalition effort by militia threats,^co and initial COVID-related disruption to ISF security operations in Q1 and early Q2 2020,^cp all of which cumulatively had the effect of adding an external ‘artificial’ boost to the Islamic State’s resurgence in the first half of 2020. However, another variable that probably subsequently drove down insurgent attacks was the effective ongoing targeting of senior Islamic State leadership^cq and the large-scale “Heroes of Iraq” phased security offensives launched during Q2 and Q3 2020. Together, all these factors may have acted as a momentum-breaker on the Islamic State’s’ nascent recovery in early 2020.

These operations somewhat differed from previous clearance operations because each focused more deliberately on a specific Islamic State rural redoubt^cr and each operation combined mass-mobilization of clearance forces and fire support^cs with intelligence-led raids and strikes on Islamic State mid-level leadership.^ct The big downward step-changes in monthly Islamic State attack numbers in Anbar, Kirkuk, and later Diyala track quite closely with the “Heroes of Iraq” series of offensives in those areas. These operations were followed up with other targeted large-scale, coalition-supported operations along the Iraq-KRI disputed line of control, including joint Iraqi-KRI operations such as the “Ready Lion” operation in Makhmour in March 2021^cu and numerous smaller follow-on operations in Diyala, Salah al-Din, and Kirkuk throughout 2021.¹⁵³ Alongside such offensive actions, the whole ISF has gradually built-out some of the rudimentary necessities of counterinsurgency in Iraq, such as fortified outposts, night vision equipment disseminated to outpost level, basic route clearance, auxiliary units manned by local people, and organic mortar support and quick reaction forces.¹⁵⁴ The ‘head-start’ in insurgency that the Islamic State was described as enjoying in a December 2017 CTC Sentinel study¹⁵⁵ may have finally been eroded by ISF advances. Combined with steadily improving tactical leadership,¹⁵⁶ the ISF—though still rough around the edges by international standards—is outfighting the Islamic State in most parts of Iraq.

It may be notable that the Islamic State has best maintained its level of high-quality attacks in areas of Diyala and Salah al-Din that are garrisoned by the least developed security forces with the worst access to coalition intelligence and air support—namely the Federal Police and particularly the units of the PMF that draw support from Iran and that oppose coalition support to the ISF.¹⁵⁷ In the authors’ assessment,^{158 cv} Iran-backed militias are dominant in exactly the places that the Islamic State is still the strongest—Sinjar, Baaj, the districts of Daquq and Tuz Khurmatu, Khanaqin, the Iran-Diyala border, Yethrib, the Jallam Desert, the Hamrin foothills, the desert outskirts of Bayji, the Makhul Mountains, and Nukhayb. Thus, some of Iraq’s least disciplined and least resourced troops¹⁵⁹ continue to hold the key to stabilization in the areas that the Islamic State is increasingly gravitating toward. In many of these vital “liberated” areas, such militias undertake racketeering that includes smuggling Islamic State fighters and families through checkpoints or taking bribes to allow supplies into Islamic State pockets like the Pulkhana redoubt. In such areas, international and Iraqi media visibility of the real character of insurgency and counterinsurgency is reduced: informal truces abound between outsider militias and Islamic State remnants, for mutual comfort and for profit.¹⁶⁰ In the authors’ assessment, terrain under the authority of Iran-backed militias inside Iraq’s borders has arguably become one of the last real sanctuaries that the Islamic State enjoys inside Iraq.^cw

The Outlook in Iraq for the Islamic State
The three prior CTC Sentinel Islamic State attack metrics analyses illustrated the undulating pattern of the Islamic State insurgency in Iraq: In the August 2017 issue of CTC Sentinel,¹⁶¹ one of the authors explored the head-start that the Islamic State insurgency enjoyed over security forces that had not yet pivoted to counterinsurgency. The December 2018 CTC Sentinel study¹⁶² analyzed a precipitate decline in Islamic State attack activity, and the May 2020 update sought to explain a partial recovery of Islamic State attack capability in late 2019 and early 2020. This new January 2022 study notes new downward steps in Islamic State attack capabilities. The first and most obvious finding of this study is that neither an Islamic State recovery nor further decline is inevitable, as this quartet of studies has already chronicled multiple cycles of Islamic State remission and recovery.

Indeed, conditions in Iraq and Syria will dictate the level of Islamic State attack capability in the future. Short-term conditions—including insurgency in Syria, capabilities and leadership in the ISF, and the level of coalition support—must be carefully monitored in data-led analyses undertaken by experienced analysts inside and outside of the intelligence community. Particular attention should be directed toward the potential that reduced coalition special forces and airstrike activity could create breathing space for a recovery of centralized leadership functions and planning in the Islamic State. If U.S. forces in Iraq have indeed ceased all combat activities, and are not requested by the Iraqi government to provide such support, then there is a strong possibility that Iraq will struggle to conduct time-sensitive strikes using its own air forces.¹⁶³ This could result in a recovery of the Islamic State’s leadership cadre and its ability to plan more complex operations within a six- to 12-month timescale. Routine day-to-day insurgency would take longer to recover and may be “capped” by other underlying factors.^cx

Other long-term drivers such as reconstruction of liberated areas,¹⁶⁴ resettlement of displaced persons,¹⁶⁵ and reintegration of Islamic State families¹⁶⁶ are slower-acting factors that may have less impact on today’s ebb and flow of insurgency, but which will be critical factors—unobvious but vital battlefields—when the insurgency is later viewed through the prism of a generation-spanning struggle against violent extremism.

For now, at the outset of 2022, the Islamic State insurgency in Iraq is at a very low ebb, with recorded attack numbers that rival the lowest ever recorded.^cy The Islamic State was so disrupted and weak in 2021 that it was apparently unable to exploit golden opportunities such as the potential for global attention-grabbing attacks during Pope Francis’ daring March 5-8, 2021, visit to Iraq,¹⁶⁷ or extensive attacks on religious festivals (like Ramadan) in 2021,^cz or even exploitation of reducing levels of coalition air support and periods of poor flying weather.^da The pylon campaign in the summer of 2021 demonstrated that the Islamic State still has a glimmer of its old instincts and, in the authors’ speculation, perhaps felt the need to reverse its obvious stagnation with a centrally inspired ‘concept campaign’ (attack electrical power supply in summer), albeit one aimed at one of the most defenseless, vulnerable, but also repairable target sets in Iraq.

One reason that Islamic State leadership needs to occasionally boost its profile is precisely because the attack cells of the movement have largely relocated (in the assessment of the authors) to the depopulated deserts and hills of Iraq. In his December 2017 CTC Sentinel article, Hassan Hassan discussed the growing importance of deep desert sanctuaries for the Islamic State.¹⁶⁸ Iraqi intelligence officers likewise stress the Islamic State’s special connection to the desert, with one interviewee noting that the Islamic State was “fully harmonized with the cruel deep desert environment.”¹⁶⁹ It is notable to the veteran Iraq-watcher that the Islamic State has been forced into defending corners of Iraq that were never really theaters of conflict in the 2003-2011 period¹⁷⁰—in the authors’ assessment, places such as the Makhul and Qara Chaugh ridges, the wadis of southern Kirkuk, the Jallam Desert, the empty Jazeera steppe between Hatra and Rawa, Wadi Husseinat, or the Nukhayb area in Anbar. In the authors’ assessment, these barren fly-blown backwaters are the Islamic State’s main strongholds now.

Yet an insurgency that is primarily constrained to such deserts and other uninhabited environments can fade into irrelevance, ruling only the parts of Iraq that most Iraqis can afford to live without. Hence, in the view of some Iraqi intelligence professionals and the authors, the Islamic State may continue to mount campaigns to remind Iraq of its existence—whether by a regular drumbeat of mortar fire out of the Jallam Desert into the suburbs of Samarra, or with an annual campaign to deny the cities the electricity that is transmitted across Iraq’s deserts. To remain relevant, the Islamic State may decide that it has to come out of the deserts and back closer to the cities, or to hit cross-desert transit systems like roads, pipelines, and electrical grids on a more systematic basis.

In closing, nothing is simple about the cyclical rise and fall of the Islamic State’s insurgent activities in Iraq. Diagnosis of whether an insurgency is strengthening or fading, and why, is a maddening analytical task. In the same manner that a rising tide or a receding tide both create a steady pattern of waves, an analyst always has to ask, “Am I looking at a strong wave, or a rising tide?” or even “Is the tide receding because a tsunami is gathering strength?” Unlike the sea—itself notoriously unpredictable—there are no neat tables to bound the range of high and low tides. In this current study, the authors are not fully satisfied that the known explanatory variables—the ramp-up of the insurgency in Syria, improved capabilities and leadership in the ISF, and the level of coalition support—capture the whole story of the Islamic State’s downturn in Iraq since the early summer of 2020. The authors can feel some “unknown unknown” out there that needs to be identified and analyzed, an “X factor” or “dark matter” that invisibly shapes Islamic State activity levels.

Occam’s razor—the rule that the simplest answer is usually the best—would suggest that the downturn is simply due to the Islamic State’s exhaustion, years of attrition, and isolation from a disillusioned Iraqi Sunni population, with a less pronounced downturn in areas where outsider Shi`a militias have colonized the environment.¹⁷¹ Projecting this trend, the Islamic State will continue to get weaker and concentrated in fewer areas in coming years, and focus on less and less ambitious attacks.^db

But the non-linear path of the Islamic State—weaker one year, stronger the next—suggests a less tidy outlook. The Islamic State’s apparent gradual diminishment in Iraq could to some extent involve deliberate conservation of offensive capacity^dc—based on the Islamic State’s professed strategic patience and belief in outlasting enemies¹⁷²—resulting in a ‘withholding’ of attacks in which the Islamic State was not fighting as hard as it could in 2020 and 2021.^dd As CTC Sentinel authors Haroro J. Ingram, Craig Whiteside, and Charlie Winter have noted, the Islamic State has a proven capability to absorb tactical defeats, encyst in new safe havens, partially hibernate, learn from mistakes, and return to fight new campaigns.¹⁷³ As this study has observed, in Iraq the Islamic State presently uses only a fraction of its available explosives and seems to deliberately attempt very few suicide operations or urban attacks, but given a cadre of new high-quality operators and the decision to resume such attacks, it could return to these activities and find cities as vulnerable as, or more than, in the past.^de

This study has noted that the Islamic State can, with suspicious ease, periodically reactivate bombing cells in parts of Iraq for special purposes, such as the pylon campaign. Further study should investigate whether the Islamic State has the intention and capability to reactivate an under-utilized reserve of experienced manpower scattered in sleeper cells across southeastern Turkey, Syria, Iraq, and beyond. All these conundrums suggest that analysts should leave a wide margin that some fraction of the Islamic State’s decline in Iraq is, in fact, dormancy^df or latency^dg that could be reversible under the right conditions.     CTC

* Editor’s Note (February 11, 2022): The authors corrected the Q3 monthly attack average in Syria and the Q1 to Q3 monthly attack average in Syria in this updated version of the article.

Dr. Michael Knights is a Jill and Jay Bernstein Fellow at The Washington Institute for Near East Policy. He has worked in all of Iraq’s provinces, including periods embedded with the Iraqi security forces. Dr. Knights has briefed U.S. officials and outbound military units on the threat posed by Islamic State militants in Iraq since 2012 and regularly visits Iraq. He has written on militancy in Iraq for the CTC Sentinel since 2008. Twitter: @mikeknightsiraq

Alex Almeida is the lead security analyst at Horizon Client Access, an analytic consultancy headquartered in New York. He is the co-author of Back to Basics: U.S.-Iraq Security Cooperation in the Post-Combat Era, Washington Institute for Near East Policy, 2020. Twitter: @AlexAlmeida2020

© 2022 Michael Knights, Alex Almeida

Appendix

Substantive Notes
[a] For instance, the Soufan Center asks in a January 25, 2022, paper whether this “flurry” of attacks is the leading edge of a new momentum in Islamic state operations. See “Islamic State attacks in Syria and Iraq demonstrate a growing momentum,” Soufan Center IntelBrief, January 25, 2022.

[b] By “Islamic State-initiated” attacks, the authors have used the same criteria as with the three prior CTC Sentinel metrics studies. Based on the authors’ extensive experience of analyzing threat incidents in Iraq, “Islamic State-initiated” attacks are assessed to have been undertaken by the Islamic State and exclude violent incidents in which the Islamic State did not intentionally undertake combat actions. So, for instance, the authors would not include a security force ambush of Islamic State fighters or an airstrike that collapsed a shelter with Islamic State fighters inside. The authors would, conversely, count a recently installed Islamic State booby trap initiated by a security force patrol, as this military effect was exactly what the Islamic State was intending and aids understanding of their intentions and capabilities. See Michael Knights, “Predicting the Shape of Iraq’s Next Sunni Insurgencies,” CTC Sentinel 10:7 (2017); Michael Knights, “The Islamic State Inside Iraq: Losing Power or Preserving Strength?” CTC Sentinel 11:12 (2018); and Michael Knights and Alex Almeida, “Remaining and Expanding: The Recovery of Islamic State Operations in Iraq in 2019-2020,” CTC Sentinel 13:5 (2020).

[c] The Baghdad belts are heavily irrigated farmlands that contain the ranches of former government officials and the town houses of tribal sheikhs and serve as a logistics hub for trucking companies and vegetable markets. They include the rural districts bordering Baghdad but not within the city limits (amanat) and include places such as Taji, Mushahidah, Soba al-Bour, Tarimiyah, Husseiniyah, Rashidiyah, Nahrawan, Salman Pak, Suwayrah, Arab Jabour, Yusufiyah, Latifiyah, Iskandariyah, and Abu Ghraib.

[d] This basic analysis of Islamic State activities in Syrian provinces is an attempt to remedy a long-standing weakness of the 2018 and 2020 CTC Sentinel Islamic State attacks metrics pieces from 2017, 2018, and 2020, namely the artificial cut-off of focus at the Syrian border. As the Islamic State seems to operate fluidly across the national boundary, analysis of the Iraqi theater should also take into account the dynamics over the border.

[e] Explosive events include attack categories such as improvised explosive device (IED), under-vehicle IED (UVIED), vehicle-carried or vehicle-concealed IEDs, all categories of suicide bombing, indirect fire, hand-grenade and rocket-propelled grenade attacks, guided missile attacks, plus recoilless rifle and improvised rockets. Self-detonation of suicide vests to prevent capture are not counted. Of particular note, it is vital to not include in the count the detonation or disposal of old mass-emplaced “legacy IEDs,” which is often mentioned explicitly in reporting and hinted at in imagery of IED finds.

[f] Defined in the authors’ dataset as IED attacks on vehicles that are assessed to have struck the specific type of target preferred by the attacker, and to have initiated effectively. This is clearly highly subjective but such uncertainty is inevitable and acceptable if recognized from the outset and applied consistently.

[g] Defined in the authors’ dataset as attacks that successfully seized an Iraqi security force location for a temporary period, or which killed or wounded the majority of the personnel likely to have been present at the site. The latter type of ‘stand-off’ but intense bombardment of outposts became more regular than actual overruns in this period of study.

[h] Inferred in the authors’ dataset by connecting the target type with circumstantial details of the attack to eliminate the likelihood that the individual was not the intended victim of the attack. As noted, Baghdad city has been excluded from the dataset, and a heavy filter is applied to most urban areas and areas known to suffer high levels of criminal, ethno-sectarian, and militia murders (for instance, Kirkuk and Tuz Khurmatu cities). If the area, target, or target type has seen similar Islamic State assassination attempts, the attack stands a better chance of being counted in the Islamic State attack metrics used in this study. The authors have endeavored to exclude apparent revenge attacks on suspected Islamic State members by Iraqi tribes, which are common.

[i] Defined in the authors’ dataset as IED attacks on static locations that are assessed as being intended to cause 10 or more civilian or security force casualties. This excludes most roadside bombings, which target vehicles with lower capacity than 10 persons.

[j] In 2012, there was an average of 576 attacks in Iraq by the Islamic State (then known as the Islamic State of Iraq) per quarter, which jumped to an average of 1,554 attacks per quarter in 2013, with Q2 2020 in between at 808 attacks.

[k] Ramadan in 2020 took place from April 23 to May 23.

[l] The authors have a combined 27 years of experience in Iraq security metrics collection and analysis, with 18 years of continuously operating collection for one and nine years for the other.

[m] “The masts are electro-optical, lightly-armored camera systems described by Iraqis as ‘thermal cameras.’ The masts retract into an armored box when not in use.” See a discussion of the masts in the authors’ last metrics study in Knights and Almeida, “Remaining and Expanding.”

[n] It is noteworthy that the small number of successful outpost overruns have usually been preceded by takedown of camera masts. For a recent example, see the overrun and massacre of a rural outpost position in Diyala’s Udhaim River Valley by a vehicle-mounted raiding force in January 2022, described in Jared Malsin and Ghassan Adnan, “Islamic State Kills Sleeping Iraqi Soldiers, Attacks Syrian Prison,” Wall Street Journal, January 21, 2022.

[o] The four months in which other provinces were higher are August 2020, November 2020, and January 2021 (when Salah al-Din was higher) and June 2021, when Kirkuk just surpassed Diyala by one attack.

[p] In the new 20-month coverage period, Salah al-Din totaled 668 attacks, second only to Diyala (899) and just higher than third-placed Kirkuk (640 attacks). All incident data is drawn from the authors’ geolocated SIGACT dataset.

[q] One mass-casualty attack may have been intended but was foiled at an early stage: a car bomb that appears to have been intended for use on a Ramadi police station but was discovered on October 14, 2021. Qualitative insight drawn from the authors’ geolocated SIGACT dataset.

[r] Nukhayb is a desert town on the junction of a road system that links Saudi Arabia, Anbar, and Karbala.

[s] These rural activities carry very low risk of interference by security forces as these plentiful targets—pylons and shepherds—can be engaged far away from security force outposts and at a time and place of the Islamic State’s choosing.

[t] Even in very low Islamic State attack activity periods like Q1 2011, Baghdad still had 357 attacks, nearly an order of magnitude higher than the present levels. All incident data is drawn from the authors’ geolocated SIGACT dataset.

[u] The authors take special care to also exclude roadside bombings and other convoy attacks undertaken by Shi`a militias, not the Islamic State. These bombings are typically claimed by known militia outlets, not claimed by the Islamic State, and occur in a rarified subset of locations. For more detail on the convoy strategy of the militias, see Michael Knights and Crispin Smith, “Ashab al-Kahf’s Takeover of the Convoy Strategy,” Militia Spotlight, Washington Institute, November 22, 2021.

[v] The dataset also captures security force actions, so the authors have a fine-grain feel for ISF activities and unit-level performance and challenges. Based on author’s (Knights) interviews with Iraqi military and U.S. military advisors, the northern Baghdad belts are considered a ‘hot’ province in which ISF are given more regular leave and danger pay. Based on the authors’ conversations with Iraqi and U.S. military officers working on the Islamic State, 2018-2019; names and places of interviews withheld at request of interviewees.

[w] The Tarmiyah area is the site of numerous opulent Baathist leadership ranches and well-irrigated farmlands, both very valuable commodities. Both Iraqi Army and PMF units compete to dominate these areas and the lucrative (i.e., corrupt) business of running the highways to the north of Baghdad. As a result, the Tarmiyah area has been swamped with ISF units in recent years. Based on the authors’ conversations with Iraqi and U.S. military officers working on the Islamic State, 2018-2019; names and places of interviews withheld at request of interviewees.

[x] Without fanfare, the U.S.-led coalition has provided significant intelligence, strike, and special forces support to the fight in the northern Baghdad belts since 2014, due to the special importance of preventing the Islamic State from developing bombing cells close to the capital. Based on author’s (Knights) interviews and visits with U.S. intelligence officers working on the Islamic State in Syria and Iraq, 2018-2021; names and places of interviews withheld at request of interviewees.

[y] Roadside bombs and other booby traps frequently kill three to five men, which is often the whole occupancy of a utility vehicle. Qualitative observations drawn from the dataset.

[z] For instance, on July 17, 2020, the Islamic State killed Staff Brigadier General Ali al-Khazraji (commander of the local ground-holding unit, the Iraqi Army 59th Brigade) along with three other soldiers in an ambush on their convoy near Tarmiyah. All incident data is drawn from the authors’ geolocated SIGACT dataset.

[aa] September to November 2021 marks the first period in the authors’ recollection and records since 2003 in which zero high-quality attacks were registered for consecutive months in the northern Baghdad belts.

[ab] Diyala suffered 212 Islamic State attacks in Q2 2021, Kirkuk 162, Salah al-Din 132, Baghdad belts 111, Anbar 97, and Nineveh 87. All incident data is drawn from the authors’ geolocated SIGACT dataset.

[ac] A pattern of unusually aggressive Islamic State actions began in Yethrib in June 2020.

[ad] In June 2020, there were 19 Islamic State attacks in the northern Baghdad belt, and in July 2020, there were four. (High-quality attacks dropped from 14 in June 2020 to three in July.) As the time of writing, neither all attacks nor high-quality attacks in north Baghdad have recovered to their June 2020 levels.

[ae] Iraq and Syria’s main river valleys tend to become known in military circles by these three- or four-letter acronyms. The Tigris River Valley (TRV) is used to describe the Tigris River and adjacent land north of Baghdad, inside Iraq.

[af] There were pylon attacks in Nineveh in July and in August 2021. In several incidents, attacks on electricity towers were used to draw repair crews and their security force escorts onto ‘come on’ roadside bomb attacks. All incident data is drawn from the authors’ geolocated SIGACT dataset.

[ag] In the authors’ view, based on their experience of analyzing Iraqi attack networks, the spike in bombing activity in previously dormant operating areas associated with pylon attack campaign may reflect the use of ‘part-time’ insurgent contract labor hired on specifically to conduct (low-risk) pylon strikes, likely from the large pool of Islamic State-adjacent individuals (former recruits, relatives, sympathizers) potentially available to conduct such attacks. Another interesting aspect of the pylon attack campaign in Nineveh was the repeated use of heavy munitions, including large-caliber 120mm mortar rounds and in a few cases 155mm artillery shells (each single shell more than sufficient to destroy an unarmored vehicle) as IED main charges to knock down individual pylon struts. This suggests an abundance of cached munitions, and also potentially a lack of familiarity with munition explosive yields, pointing to a lack of bomb-making experience. Data on munitions recovered in pylon IED finds is drawn from the authors’ geolocated SIGACT dataset. The authors have reviewed many hundreds of reported IED finds, often with photographic evidence as well as text descriptions of the finds.

[ah] This area includes the rural Jurn “triangle” south of Mosul and the Badush corridor, which runs west of Mosul to the major road junction at Kisik.

[ai] According to the authors’ geolocated SIGACT dataset, arrests along a 90-kilometer segment of the border between Nineveh and northeastern Syria rose from a single family picked up in the second half of 2020 to 25 persons in the first half of 2021. Ninety-five persons were arrested after crossing the border in the second half of 2021. While specific details on the nationality of detainees are not always available in media reportage or the official arrest statements released by the Iraqi security forces on their social media pages, arrests involved a mix of military-aged males and occasional larger groups of several families, including women and children (in some cases, specifically identified as so-called “IS families”). Individuals identified as Syrian nationals generally outnumbered Iraqis. In several cases, detainees were specifically identified as Iraqi nationals who had crossed illegally into Syria. In one notable incident in September 2021, a group of four Islamic State families transporting six AK-pattern rifles and over 5,000 detonators was picked up by Iraqi security forces shortly after crossing the border. See “21 infiltrators arrested near the Syrian border,” Iraqi News Agency, September 12, 2021.

[aj] Islamic State family members frequently move into Iraq before adult male fighters in order to establish secure bed-down locations and transit safehouses and to facilitate the movement of Islamic State fighters on to active insurgent operating areas. See “Lead Inspector General for Operation Inherent Resolve Quarterly Report to the United States Congress, April 1, 2021 – June 30, 2021,” U.S. Department of Defense Office of Inspector General, August 3, 2021.

[ak] The authors have reviewed many hundreds of reports of cache finds, often with photographic evidence as well as text descriptions of the finds. To cite only one recent example, in August 2021, security forces cleared a large rural cache south of Tal Afar containing 27 120mm mortar rounds, 25 81mm rounds, an artillery shell, four home-made IEDs, four propellant charges and 700 rounds of 12.7mm ammunition. See “Five Infiltrators Arrested and a Cache Found in Western Nineveh,” BasNews, August 8, 2021.

[al] When viewed in a longer context, Kirkuk has tended for most of the period since its liberation from the Islamic State to suffer around 25 Islamic State attacks per month. In this context, the mid-2020 and mid-2021 Islamic State attack surges in Kirkuk are anomalies, well above the more typical “resting level” of the province.

[am] Despite the sharp drop-off in quality attack activity in Kirkuk since Q2 2020, the Kirkuk Islamic State insurgency remains capable of generating some lethal high-quality attacks, particularly close to its rural staging grounds in Rashad and Daquq. While rarer than in early 2020, deliberate outpost overrun efforts in the period of study continue to demonstrate sophisticated complex assault tactics, with squad-sized infantry assaults supported by mortar fire frequently followed by ‘come on’ roadside bomb attacks against Federal Police reaction forces. The September 2021 overrun and massacre of a 19th Federal Police Brigade squad outpost in the Rashad farmlands, which ended with the deaths of over a dozen Federal Police troopers, stands out as a particularly brutal example of this trend. Incident data is drawn from the author’s SIGACT dataset. See “13 soldiers & policemen killed, 8 injured in the disputed territories,” KirkukNow, September 5, 2021.

[an] The logic being that in areas where Islamic State forces no longer feel confident enough to attack the security forces directly, they tend to focus instead on unarmed civilians and other ‘softer’ targets. This kind of displacement has historically occurred in all provinces, in rural and urban areas. Qualitative insight drawn from the authors’ geolocated SIGACT dataset.

[ao] Assassinations of village mukhtars in Kirkuk’s rural subdistricts were averaging 3.5 per month in 2018 before falling to 0.75 by the second half of 2019. The winding down of the campaign against the mukhtars tracks closely with the gradual weakening of the Kirkuk insurgency and its contraction from Hawijah district into the Obeidi areas of southern Kirkuk over the course of 2019. See the Kirkuk section in Knights and Almeida, “Remaining and Expanding.”

[ap] Tracking of geolocated security incidents in the Kirkuk farmbelts over the course of 2019 and into 2020 shows a gradual contraction of the insurgency’s footprint from the Jabbouri-dominated farming areas north of the Kirkuk-Tikrit highway into Obeidi-dominated Rashad and Daquq, and increasing reliance on the southern Kirkuk wadi systems as an operational sanctuary and staging ground. In the authors’ assessment, based on their experience of Iraqi insurgency networks in Kirkuk, this points to a real failure by the Islamic State to hold on to its territorial control in Hawijah, despite strong activity during most of 2018.

[aq] One of the authors (Knights) worked in Kirkuk on a regular basis in 2008-2012, supporting reconstruction activities. The lands north of the Kirkuk-Beyji pipeline and road corridor were largely populated by Jabbouri confederation tribes that were imported to the area by the Baathist regime and settled on newly irrigated farmlands.

[ar] One of the authors (Knights) worked in Kirkuk on a regular basis in 2008-2012, supporting reconstruction activities. The parched Obeidi farmlands of southern Kirkuk are considerably less densely populated than the core (Jabbouri) farming areas around Hawijah and Riyadh (north of the Kirkuk-Tikrit highway), which benefit from an extensive irrigation infrastructure developed under the Saddam regime, when large numbers of Sunni Arab transplants from Nineveh and Salah ad-Din were settled in the area.

[as] This is reflected in the steady pattern of kidnappings for ransom of farmhands and extortion of local villagers in comparison with the decreased number of high-quality attacks targeting higher-profile figures such as tribal sheikhs or mukhtars. Qualitative observations are drawn from the author’s dataset.

[at] The Islamic State undertook periodic coordinated multi-IED bombings in urban Kirkuk during major religious festival dates in 2019, as well as under-vehicle bombings targeting police and security officials. The last mass-casualty attack attempted by the Islamic State in Kirkuk city involved a botched suicide shooter raid on the Kirkuk security directorate headquarters in April 2021. All incident data is drawn from the author’s SIGACT dataset.

[au] The disrupted plot was for over a dozen suicide attackers wearing security force uniforms to enter Kirkuk on vehicles painted to resemble police pickups and raid the city’s central prison and main courthouse. Suicide car bombs would have been employed to breach the prison compound. Security forces disrupted the planned attack in early April 2021. Incident data drawn from the authors’ SIGACT dataset. Based on author’s (Knights) interviews with Kurdish intelligence officer working on the Islamic State in Syria and Iraq, 2021; name and place of interview withheld at request of interviewee.

[av] Tracking of targeted killings in Diyala is somewhat complicated by the multitude of active tribal and factional or political disputes raging in the province, which can make it difficult to distinguish assassinations undertaken by Islamic State cells from those conducted by other non-insurgent actors.

[aw] A recent November 2021 attack on a Peshmerga outpost in the Kulajo area of northern Diyala is a stand-out example of this trend. Sharpshooter harassment of a fortified outpost was used to draw a Peshmerga reaction force onto an effective roadside bomb attack. All five Peshmerga fatalities (plus another four injured) were incurred when a Humvee evacuating casualties from the attack hit an IED on a dirt access track leading to the outpost. Incident data drawn from the authors’ SIGACT dataset.

[ax] Insurgent sniping cells in Diyala are known to employ a range of mid- to high-end night-vision optics, with Pulsar Apex XD50/75 and Pulsar Trail XP35/50 thermal imaging scopes being the most frequently attested models. Usage of Iranian Rayan Roshd thermal weapon sights, as well as Fortuna and ATN models, is also likely but not reliably documented in Diyala. Employment of night-vision goggles is also unverified but probable based on reports. NVGs are likely commercial derivatives of AN/PVS-7 and AN/PVS-14 models, or possibly originals captured from Iraqi military stocks. Data provided by a materiel and non-state groups analyst focused on Iraq via email to the authors, January 2022.

[ay] Such as southern Kirkuk farm districts like Ghaydah, on the foothills of the Hamrin range, or the Jallam Desert in Salah al-Din.

[az] In less attack-prone provinces like Anbar or Nineveh, a territory will often be haunted by an Islamic State cell specializing in a certain type of attack (for instance, a mortar cell, or a sniper, or a cell that kills targeted individuals at night). In Diyala, most operating areas seem to have multiple specialist cells working in parallel, more reminiscent of the old “articulated” high-intensity insurgency that had sub-leaders for various articulated functions—roadside bombing, suicide operations, sniping, indirect fire, etc. Based on the authors’ combined 27 years of analyzing Iraq insurgent cell activity at provincial level.

[ba] One of the authors (Knights) was a member of the Combined Joint Task Force – Operation Inherent Resolve (CJTF-OIR) campaign assessment team in 2015. In essence, the aim of CJTF-OIR was to whittle the Islamic State down to its early 2012 level—before the era of regular multi-city, coordinated, mass-casualty bombings and attacks on Western targets from Iraq and Syria.

[bb] External attack plotting sometimes—but not always (in the case of cyber-coaching lone wolves or small teams)—requires penetration of border security and/or global airline security, and can involve more costly and complex preparations, including false documentation, long-range target reconnaissance, renting or buying property, and a host of issues that localized insurgencies encounter less frequently.

[bc] The northern stretch of the Iraq-KRI internal border is fortified with an extended berm and ditch system, interspersed with flood-lit observation posts and segments of barbed-wire fencing. Most of the southern Kurdish border is less intensively fortified, with entry into the Region controlled primarily by checkpointing of the main highways leading into the KRI interior and a loose screen of widely spaced outposts in rural areas. Both authors have visited multiple segments of the KRI frontline with federal Iraq and visually inspected the defenses in 2008-2021, and one author (Knights) has moved back and forth across the Baghdad-KRI lines, observing immigration and security procedures.

[bd] Most notably, the lack of an active insurgency within its territorial borders generating attacks on a daily basis.

[be] The Islamic State and its forerunners tended to pick Shi`a-dominated areas far from Baghdad where they could exploit very small Sunni communities like Abu al-Khasib, Zubayr, and Safwan in Basra, or al-Batha near Nasiriyah. One of the authors (Knights) worked closely with Iraqi security forces in Basra and Dhi Qar in 2010-2012, when such “reach” attacks were becoming more common. Michael Knights, “The Role and Significance of Signature Attacks in the Iraqi Insurgency,” CTC Sentinel 3:9 (2010).

[bf] A veteran Islamic State amni, Dahlaki was identified as a former Baathist intelligence apparatchik. Based on author’s (Knights) conversations with Kurdish intelligence officers working on the Islamic State, March 2019; names and places of interviews withheld at request of interviewees.

[bg] Ex-members of Katibat Salah ad-Din and Ansar al-Islam residing in the Halabja area were also involved in earlier attempts to reactivate the Kurdistan Wilayat in mid-2018. Based on author’s (Knights) conversations with Kurdish intelligence officers working on the Islamic State, March 2019; names and places of interviews withheld at request of interviewees.

[bh] The Kurdistan Region suffered a wave of infiltration during the Islamic State’s heyday in 2015-2016, though only one of these culminated in a successful attack operation. The bulk of the 2015-2016 penetration effort was undertaken against the southern KRI, where Islamic State operatives sought to establish safehouses and training camps in remote rural locations. All incident data is drawn from the authors’ geolocated SIGACT dataset.

[bi] In April 2015, the Islamic State successfully detonated a car bomb outside the U.S. consulate offices in Erbil’s Ainkawa neighborhood, killing two and wounding 14. All incident data is drawn from the authors’ geolocated SIGACT dataset.

[bj] In July 2018, a homegrown cell of Kurdish teenagers radicalized by an Islamic State-inspired salafi imam based in Erbil undertook a shooter team raid against the Erbil governorate headquarters in the city center. The cell had originally planned to conduct an attack against the French consulate in Erbil, but switched to the governorate building when arrests by security forces disrupted their preparations. Another Erbil-based cell part of the network formed around the same salafi imam planned to attack the Kawergosk refinery outside the city. Based on author’s (Knights) conversations with KRI intelligence officers, 2018; names and places of interviews withheld at request of interviewees.

[bk] In terms of its permissiveness as operating environment for the Islamic State, the authors assess that the core KRI is closer to the European countries that were the focus of the Islamic State’s 2015-2016 terror campaign than Iraq proper, or even southeastern Turkey. Operationally, this has imposed certain functional similarities, including the remote direction of cells by amnis of the Islamic State’s external operations bureau and the use of clandestine facilitator and smuggling networks in the Islamic State’s ‘near abroad’ to move personnel, weapons, and explosives. All incident data is drawn from the authors’ geolocated SIGACT dataset.

[bl] Also identified as Abu Fahd by Kurdish officers in conversations with the author (Knights), March 2021; names and places of interviews withheld at request of interviewees.

[bm] Abu Harith was personally involved in remotely directing the cell taken down in Erbil in September 2021 via the social media messaging app Telegram. The Islamic State’s amniyat chief for Syria, Abu Walid, was responsible for directing the cell arrested in Erbil in April 2021. A Turkey-based Islamic State amni directed the cell nabbed in July 2021. Based on Kurdistan Region Security Council (KRSC) confession videos and author’s (Knights) conversations with KRI intelligence officers, July-September 2021; names and places of interviews withheld at the request of interviewees.

[bn] The cell operatives were generally junior Islamic State members from Anbar or Nineveh in their early to mid-twenties, usually with family or local tribal links. Data drawn from KRSC confession videos.

[bo] The initial leader of the cell taken down in Erbil in April 2021 was an Islamic State veteran in his late thirties from the Fallujah-Ramadi area of Anbar province who joined the group in 2014. The leader of the cell nabbed in July 2021 was an Anbari Ansar al-Sunna veteran with over 16 years in the insurgency. Data on the cell members’ backgrounds, places of origin, and personal histories are drawn from publicly available confession videos posted on the Facebook page of The Directorate General of Counter Terrorism (CTD) in the KRSC: “Arrest of a terrorist cell and the defusing of their plans,” posted April 12, 2021; “Confessions of a dangerous ISIS group planned to conduct terrorist attacked during Eid al-Adha in Erbil,” posted July 13, 2021; and “Confessions of a terrorist group planned attack inside city of Erbil,” posted September 5, 2021.

[bp] Both the cells taken down in Erbil in July and September 2021 included new recruits—among them, three teenaged relatives of deceased Islamic State members—who were used to conduct close-target surveillance in downtown Erbil. The group rolled up in the southern KRI in March-April 2021 also included multiple new recruits who lacked arrest records that could trip security flags, making it easier for them to move into and out of the Region. Confession videos of the two cells, posted on the Facebook page of the CTD in the KRSC: “Confessions of a dangerous ISIS group planned to conduct terrorist attacked during Eid al-Adha in Erbil,” posted July 13, 2021, and “Confessions of a terrorist group planned attack inside city of Erbil,” posted September 5, 2021. Plus author’s (Knights) conversations with Kurdish intelligence officers, April 2021; names and places of interviews withheld at request of interviewees.

[bq] Two members of the cell taken down in Erbil in July 2021 were tracked by CCTV cameras as they walked around the citadel in downtown Erbil and nearby commercial streets. Based on KRSC-released confession video, available on the Facebook page of the CTD in the KRSC: “Confessions of a dangerous ISIS group planned to conduct terrorist attacked during Eid al-Adha in Erbil,” posted July 13, 2021.

[br] As noted above, of the eight cells rolled-up in the KRI over the course of 2021, only two managed to obtain weapons or explosives, and all (with the exception of the cell nabbed in Erbil in early in July 2021 that was taken down only about a week prior to the date of its first planned attack on Eid al-Adha (July 19-20, 2021)) seem to have been arrested in the fairly early stages of attack planning. None managed to get off a successful attack. Data drawn from KRSC confession videos and conversations with KRI intelligence officers throughout 2021; names and places of interviews withheld at request of interviewees.

[bs] The Islamic State’s focus on the same set of hardened or high-profile government and diplomatic targets has persisted even as the terrorist group’s ability to mount successful mass-casualty attacks inside the KRI has steadily degraded. Following coordinated mass-casualty attacks on the Erbil Asayesh headquarters and Ministry of Interior building in 2013 (previously hit with a truck bombing in 2007 staged by an AQKB-linked cell), the Islamic state was only able to mount the relatively low-casualty VBIED against the U.S. consulate in 2015, followed by the storming attack on the Erbil governorate building in 2018. As noted in footnote BJ, the cell responsible for the 2018 attack on the Erbil governorate headquarters had also planned to target the French consulate in Erbil. Finally, the Erbil-based cell arrested in July 2021 had also planned to re-attack the governorate headquarters with a suicide shooter team raid.

[bt] For example, the Islamic State cell arrested in April 2021 planned to conduct IED attacks on Asayesh and police vehicles passing along the Erbil-Makhmour road near their safehouse in the city’s southern outskirts. An Islamic State sleeper operative captured in Erbil in July 2021 was directed to conduct close-target reconnaissance of the Directorate General of Counter-Terrorism, allegedly in preparation for a planned jailbreak operation. Finally, the group arrested in September 2021 planned to emplace an under-vehicle explosive charge at a floating checkpoint near the Erbil citadel. Based on confession videos posted on the Facebook page of the CTD in the KRSC: “Arrest of a terrorist cell and the defusing of their plans,” posted April 12, 2021; “Confessions of a dangerous ISIS group planned to conduct terrorist attacked during Eid al-Adha in Erbil,” posted July 13, 2021; and “Confessions of a terrorist group planned attack inside city of Erbil,” posted September 5, 2021.

[bu] In the authors’ experience of monitoring Iraq attack cells, this is suggested by the fact that the persons and networks responsible for directing attack plots earlier in 2021 (Abu Harith of the Kurdistan Wilayat, and the cluster of Syria and Turkey-based amnis) were the same that provided targeting guidance to the cells rolled-up in July and September 2021—i.e., there do not seem to have been major changes to the roster of Islamic State operators responsible for directing attacks against the KRI. This suggests the shift in targeting priorities may have originated in guidance from the senior levels of the Islamic State central leadership.

[bv] In contrast with the northern KRI cells, which were made up almost entirely of young and inexperienced Arab outsiders unfamiliar with the urban Kurdish environments of Erbil. Qualitative insight drawn from the authors’ geolocated SIGACT dataset, which includes arrest data.

[bw] Islamic State cells in the southern KRI during 2018-2019 often developed plans to attack specific Asayesh targets or made threats to specific Asayesh officers, in retaliation for major arrests or with the aim of coercing them to release captured Islamic State members with links to Islamic State-friendly tribes. This back-and-forth ‘conversation’ between Islamic State operators and their Asayesh opposites gives a good feel for the sense of familiarity developed during the long-running cat-and-mouse game between the Islamic State and security forces in southern Kurdistan. Based on the authors’ geolocated SIGACT dataset and author’s (Knights) conversations with Kurdish intelligence officers, March-April 2019 and January-April 2021; names and places of interview withheld at request of interviewees.

[bx] For example, the six-man terrorist cell uncovered in Chemchemal in July 2021 included several insurgent combat veterans with specialization and significant experience in bomb-making, arranging suicide attacks and other combat and logistical functions. Based on the authors’ geolocated SIGACT dataset and conversations with Kurdish intelligence officers, March-April 2019 and January-April 2021; names and places of interviews withheld at request of interviewees.

[by] In the authors’ experience of working in Iraq and studying criminality and insurgency at the local level, attacks on electricity transmission systems generally involve some mix of political and financial motive. Even when political motives are in the forefront (e.g., reducing electricity supply ahead of an election to undermine the government and its foreign backers), there will often still be a commercial angle: payment to conduct the attack, stripping of valuable copper sheathing from the lines, scrap metal, reconstruction, and establishing new paid guard forces for the transmission lines.

[bz] The authors looked for pylon attacks that took place in Iraqi provinces (and the parts of those provinces) where the Islamic State conducts attack activities. If there is an indication of primarily economic motivation, the attack is not counted. Attacks that took place during periods of intensive pylon targeting are scored as more likely for inclusion.

[ca] The 2004-2005 effort was partially successful, crashing Iraq’s electricity grid twice (January 7 and January 29, 2005) and cutting off water supply to western Baghdad for a week. The campaign in 2004 was bolstered by integrated attacks on piped and trucked fuel supply to Iraqi power plants. See Michael Knights, “Iraqi Insurgents Undertake Sophisticated Targeting of Critical Infrastructures,” Jane’s Intelligence Review, December 2005.

[cb] Peak temperatures in Iraq (80-100 degrees Fahrenheit) occur in June-September.

[cc] In the 2004 campaign, also undertaken in the lead-up to elections (January 2005), an average of 66 pylons were dropped each month versus a still-considerable 22 per month in the 2020-2021 period. Knights, “Iraqi Insurgents Undertake Sophisticated Targeting of Critical Infrastructures.”

[cd] The issue of widespread crop-burning, for extortion and driving off farmers, is analyzed with satellite imagery in Wim Zwijnenburg, “Torching And Extortion: OSINT Analysis Of Burning Agriculture In Iraq,” Bellingcat, June 3, 2019.

[ce] An injection of veteran insurgents, including experienced tactical leader and bomb-making specialists drove a 260% increase in effective roadside bomb attacks and successful outpost overruns between Q1 2019 and Q2 2020. Knights and Almeida, “Remaining and Expanding.”

[cf] The inverse relationship does not suggest a like-for-like exchange of Islamic State attacks in Iraq and Syria, as the decreases and increases in Iraq are objectively much larger than the ups and downs of Islamic State attacks in Syria. As a notional example, a 20% increase in Iraq incidents (+26 on a previous month of 130 attacks) is not an exact mirror of a 20% decrease in Syria incidents (say, -6 on a previous month of 30 attacks). Though based on a relatively small number of sample months, this apparent inversion underlines the manner in which veteran Islamic State cadres may fluidly alter their focus on Syria or Iraq but rarely both at the same time. At the very least, the relationship between Islamic State operational activity in Iraq and Syria is worth more detailed study.

[cg] Both the volume and quality of Islamic State attacks in Syria trended steadily upward, reaching an average of 38 attacks per month in Q1 2021.

[ch] While Islamic State attack activity in Iraq bottomed-out in Q1 2021 and then began a slow but noticeable recovery, Islamic State attacks in Syria fell steadily from an average of 26.7 per month in Q2 2021 to 22.3* during Q3 2021.

[ci] Anyone who has spent years compiling the metrics of attack patterns is familiar with the weird coincidences that do occasionally seem to happen.

[cj] One of the authors (Knights) was a member of the Combined Joint Task Force – Operation Inherent Resolve (CJTF-OIR) campaign assessment team in 2015. The Mayadeen area of Syria was consistently used by the Islamic State as a central location for reserves to allow such forces to be switched back and forth between different battlefields in Iraq and Syria.

[ck] The use of Turkey as a reservoir for Islamic State fighters was a coalition concern that one author (Knights) detected working on the CJTF-OIR campaign assessment team and interviewing U.S. and Syrian officers on the Islamic State. In the author’s (Knights) recollection, the Islamic State would release built-up “headwater” (recruits and foreign fighters) from safe locations in Turkey into the Syrian and Iraqi battlefields. Turkey then, and perhaps still, played the role of a canton for reserved and resting Islamic State forces.

[cl] To cite only one recent example, during the latter half of 2021 some 150-200 militants from the Islamic State-linked Jundullah group based in Syria’s Idlib province relocated to Iraq via Islamic State ‘rat lines’ through Rabia, Turkey, and Iran following a crackdown on the group by Syrian militants. See Shelley Kittleson, “Militants from Syria blamed for multiple attacks on Iraqi Kurds,” Al-Monitor, December 10, 2021.

[cm] Ramadan in 2020 lasted from April 23 to May 23.

[cn] These included advisory cells at al-Qaim and Taqaddum in Anbar, the NiOC operations center and Qayyarah-West in Nineveh, Balad air base in Salah al-Din, and K1 base in Kirkuk. In addition to hosting a U.S. advisory cell embedded with the Iraqi operational headquarters in Kirkuk, K1 also served as the advanced operating base for a U.S. special operations cell that was actively supporting counterterrorism raiding into rural Hawijah by Iraqi CTS. See the Lead Inspector General for OIR quarterly reports for Q1 and Q2 2020: “Lead Inspector General for Operation Inherent Resolve I Quarterly Report to the United States Congress, January 1, 2020 – March 31, 2020,” U.S. Department of Defense Office of Inspector General, May 13, 2020; “Lead Inspector General for Operation Inherent Resolve Quarterly Report to the United States Congress, April 1, 2020 – June 30, 2020.” U.S. Department of Defense Office of Inspector General, August 4, 2020.

[co] Militia threats to coalition bases forced a reallocation of intelligence, surveillance, and reconnaissance assets, and strike aircraft, to base-protection missions. See “Lead Inspector General for Operation Inherent Resolve Quarterly Report to the United States Congress, April 1, 2020 – June 30, 2020.”

[cp] Though the COVID-19 pandemic did not put a long-term crimp on ISF operations, it did cause some early disruption and made coordination with coalition advisors more problematic. See “Lead Inspector General for Operation Inherent Resolve Quarterly Report to the United States Congress, April 1, 2020 – June 30, 2020.”

[cq] For instance, on May 17, 2020, a joint U.S.-Syrian Defense Forces raid killed Ahmad Issa Ismail Ibrahim al-Zawi (also known as Abu Ali al-Baghdadi, the Islamic State wali of northern Baghdad) and Ahmad Abd Mohammed Hasan al-Jughayfi (also known as Abu Ammar, the Islamic State’s logistics chief of cross-border Iraq-Syria movements). Then, on May 26, 2020, the Iraqi Counter-Terrorism Service (CTS) announced the death of senior Islamic State leader Mutaz Numan Abd Nayif Najm al-Jabbouri (also known as Hajji Taysir, the Islamic State wali for all of Iraq). See “Counter-Terrorism Service: Moataz al-Jubouri, the deputy leader of ISIS for states affairs, was killed,” Al-Mirbad Agency, May 26, 2020.

[cr] Operation Heroes of Iraq I in Anbar kicked off in mid-February 2020, followed by Heroes of Iraq II in the Kirkuk wadis and the Hamrin spine in early June 2020. Heroes of Iraq III followed in late June 2020, covering the border areas between Kirkuk, Salah ad-Din, and Diyala provinces. The run of offensives (originally planned as a series of eight to 10 sequenced operations) concluded with Heroes of Iraq IV in northern Diyala during mid- to late July 2020. See “Lead Inspector General for Operation Inherent Resolve Quarterly Report to the United States Congress, April 1, 2020 – June 30, 2020,” and “Iraqi Security Forces hunt Daesh in Diyala for ‘Heroes of Iraq 4,’” U.S. Central Command, August 1, 2021.

[cs] One feature of major security operations in 2020 and 2021 has been improved integration of coalition-supported Iraqi special forces with clearance operations, including denser fielding of coalition-trained Air Weapons Teams (capable of directing air and helicopter strikes). See “Lead Inspector General for Operation Inherent Resolve Quarterly Report to the United States Congress, July 1, 2020 – September 30, 2020,” U.S. Department of Defense Office of Inspector General, November 3, 2020.

[ct] Until recently, ISF clearance operations regularly kicked off with pre-planned sets of coalition airstrikes on Islamic State cell bed-down locations and other targets developed by an extensive airborne surveillance “soak” over the preceding weeks. These strikes, along with coalition-enabled rural raids by the Iraq CTS, inflicted a series of heavy blows to the Islamic State’s mid-level leadership cadre inside Iraq. One notably effective example of this kind of partnered strike was Operation Sweeping Torrent in the Jurn corridor area south of Mosul in December 2020, which killed the emir of the Islamic State’s Dijla Wilayat and destroyed most of the insurgent network in southern Nineveh. Drawn from the authors’ geolocated SIGACT dataset, which also includes security force operations and airstrike data.

[cu] Ready Lion involved a two-week siege of the Islamic State base complex in Makhmour’s Qara Chaugh hills during March 9-24, 2021. During the operation, the Qara Chaugh ridge system was pounded by 133 coalition airstrikes while Iraqi CTS (plus embedded U.S. special forces operators) and Kurdish Peshmerga cordoned off the hills and picked off insurgent “squirters” with sniper and mortar fire. Some 27 insurgents were killed during the operation (including the local Islamic State emir of the Makhmour area), plus dozens more presumably buried in cave systems demolished by the airstrikes. Qualitative observations drawn from the dataset, which includes security operation details.

[cv] One good example outlined by Kurdish intelligence officers is Pulkana, where an Islamic State enclave manages to resupply itself despite being completely surrounded by Iraqi and Kurdish security forces. Another is Sinjar and al-Baaj, on the Nineveh-Syria border, where PMF units smuggle Islamic State families and fighters in from Syria to the TRV. In the Sharqat area, PMF units and the Islamic State have clearly understood red lines about which roads or pipelines or electricity lines they are, or are not, allowed to cross without entering the other’s terrain. Author’s (Knights) conversations with Kurdish intelligence officers, March-April 2019 and January-April 2021; names and places of interview withheld at request of interviewees.

[cw] It may seem logical that the Islamic State can also recruit more easily in places where outsider Shi`a militias are garrisoning Sunni areas. This was the author’s (Knights) expectation in the August 2017 CTC Sentinel article, where he wrote about a future “colonization zone” in which the insurgency would be at its strongest as local Sunni resentment of outsider security forces increased. This issue of Islamic State recruitment in Shi`a militia-garrisoned areas is worthy of on-the-ground investigation. Knights, “Predicting the Shape of Iraq’s Next Sunni Insurgencies.”

[cx] Coalition support including airstrikes, enabling, and intelligence support is focused on leadership targeting and disrupting the Islamic State’s external operations capability versus grinding down the routine low-level insurgency in Iraq’s rural backwaters. For a discussion of the factors “capping” a potential insurgent rebuild, see Joel Wing, “Can The Islamic State Make A Comeback In Iraq Part 3? Interview With Horizon’s Alex Mello,” Musings on Iraq, August 2019.

[cy] There were 95 Islamic State attacks throughout Iraq in November 2021 (the lowest level of the new 20-month data period) and an average of 159.5 attacks per month across the entire period. As noted earlier, May 2003 (when incidents were poorly recorded) saw 145 recorded attacks, and the lowest other recorded month with credible incident collection efforts was September 2011 (278 incidents). Attack levels in Iraq are now mostly below the lowest levels seen in the 2003-2011 conflict. All incident data is drawn from the authors’ geolocated SIGACT dataset.

[cz] In Ramadan 2020, the Islamic State undertook 317 attacks in Iraq, versus 144 in Ramadan 2021. All incident data is drawn from the authors’ geolocated SIGACT dataset.

[da] Over the past six years, the Islamic State has traditionally exploited periods of low-visibility weather that hamper the effectiveness of coalition airpower to mount major offensive operations. In one notable example, in November 2015, the Islamic State mounted a company-sized micro-offensive on Kurdish Peshmerga forces on the Makhmour peninsula. Data drawn from the authors’ geolocated SIGACT dataset.

[db] For instance, the Islamic State may continue the current trend of shifting from more risky and uncertain physical overruns of outposts to long-range harassment, sniping, and mortaring that is less likely to cause casualties than determined attacks that involve close assaults. The apparent Islamic State preference for ‘come-on’ roadside bombs against nocturnal quick reaction forces is another indicator of the Islamic State adopting a more risk-avoidant approach.

[dc] This was also a nagging concern in the author’s (Knights) December 2018 CTC Sentinel article, as suggested by its title. See Knights, “The Islamic State Inside Iraq: Losing Power or Preserving Strength?”

[dd] Indeed, it is possible and even likely both factors are at work, with the Islamic State’s struggles to re-embed itself with the border Sunni Arab community driving a strategy of conserving strength for a generational insurgency, as the movement holds out for ‘better days’ in the future. For one particularly notable example of a ‘generational’ insurgent, see Shelly Kittelson, “Iraq continues to kill, capture IS members as effectiveness questioned,” Al-Monitor, December 24, 2021.

[de] In one of the authors’ (Knights) view, having visited Baghdad in 2021 and maintaining a deep knowledge of urban security arrangements in Iraqi cities, the remission of Islamic State urban mass-casualty attacks is likely to have encouraged a degree of security force and public complacency that may be later exploited by the Islamic State. One concerning incident was the mass breakout of hundreds of Islamic State detainees from a prison in Syria’s Hasakah province in January 2022. This company-sized assault, initiated with a diversionary car bombing (recapitulating the group’s famous “Breaking the Walls” campaign of 2012-2013), offers a possible template for how this latent attack capability could re-emerge in urban environments, not only in Iraq but Syria as well. See Ben Hubbard, Hwaida al-Saad, and Asmaa al-Omar “ISIS Fighters Attack Syria Prison to Free Fellow Jihadists,” New York Times, January 21, 2022.

[df] Dormancy is defined as “the state of having normal physical functions suspended or slowed down for a period of time; deep sleep.” See the Lexico website.

[dg] Latency is defined as “the state of existing but not yet being developed or manifest; concealment.” See the Lexico website.

Citations
[1] Mohammed Tawfeeq and Joshua Berlinger, “Deadly ISIS prison break attempt fuels fears of the group’s resurgence,” CNN, January 21, 2022.

[2] “Eleven Iraqi soldiers killed in overnight attack on army base by IS group,” AFP, January 21, 2022.

[3] See Michael Knights, “Predicting the Shape of Iraq’s Next Sunni Insurgencies,” CTC Sentinel 10:7 (2017); Michael Knights, “The Islamic State Inside Iraq: Losing Power or Preserving Strength?” CTC Sentinel 11:12 (2018); and Michael Knights and Alex Almeida, “Remaining and Expanding: The Recovery of Islamic State Operations in Iraq in 2019-2020,” CTC Sentinel 13:5 (2020).

[4] See Knights, “The Islamic State Inside Iraq.”

[5] See Knights and Almeida, “Remaining and Expanding.”

[6] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[7] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[8] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[9] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[10] For a definitive deep-dive on Diyala, see Michael Knights and Alex Mello, “Losing Mosul, Regenerating in Diyala: How the Islamic State Could Exploit Iraq’s Sectarian Tinderbox,” CTC Sentinel 9:10 (2016). For a literal blast from the past, see Michael Knights, “Pursuing Al-Qa`ida into Diyala Province,” CTC Sentinel 1:7 (2008).

[11] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[12] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[13] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[14] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[15] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[16] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[17] See the Anbar section in Knights and Almeida, “Remaining and Expanding.”

[18] Ibid.

[19] Ibid.

[20] Ibid.

[21] Ibid. Qualitative insight drawn from the authors’ geolocated SIGACT dataset.

[22] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[23] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[24] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[25] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[26] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[27] See the Baghdad section in Knights and Almeida, “Remaining and Expanding.”

[28] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[29] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[30] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[31] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[32] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[33] See the Baghdad section in Knights and Almeida, “Remaining and Expanding.”

[34] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[35] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[36] Based on the authors’ conversations with Iraqi intelligence officers working on the Islamic State, 2014-2021; names and places of interviews withheld at request of interviewees.

[37] Based on author’s (Knights) conversations with a senior Iraqi intelligence officer working on the Islamic State, in 2021 in Iraq; name and place of interview withheld at request of interviewee.

[38] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[39] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[40] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[41] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[42] See the Salah al-Din section in Knights and Almeida, “Remaining and Expanding.”

[43] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[44] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[45] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[46] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[47] Qualitative observations drawn from the dataset.

[48] Qualitative observations drawn from the dataset.

[49] Qualitative observations drawn from the dataset.

[50] Qualitative observations drawn from the dataset.

[51] Qualitative observations drawn from the dataset.

[52] Qualitative observations drawn from the dataset.

[53] “Terrorist Attack on Funeral South of Salah Al-Din Kills 8, Wounds 19 Citizens,” Iraq News Agency, July 31, 2021.

[54] Based on author’s (Knights) interviews and visits with U.S. intelligence officers working on the Islamic State in Syria and Iraq, 2018-2021; names and places of interviews withheld at request of interviewees.

[55] See the Nineveh section in Knights and Almeida, “Remaining and Expanding.”

[56] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[57] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[58] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[59] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[60] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[61] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[62] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[63] See again the Nineveh section in Knights and Almeida, “Remaining and Expanding.”

[64] Ibid.

[65] See the Nineveh section in Ibid.

[66] Insight into the functioning of the Islamic State’s ‘rat line’ system is drawn from the author’s (Knights) conversations with Iraqi intelligence officers working on the Islamic State, 2021; names and places of interviews withheld at request of interviewees.

[67] Based on author’s (Knights) conversations with Iraqi intelligence officers working on the Islamic State, 2021; name and place of interview withheld at request of interviewee, as well as insights drawn from the authors’ experience monitoring insurgent movement flows and patterns of activity in Nineveh and northern Iraq.

[68] Data on cache finds is drawn from the authors’ geolocated SIGACT dataset.

[69] See the Kirkuk section in Knights and Almeida, “Remaining and Expanding.”

[70] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[71] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[72] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[73] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[74] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[75] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[76] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[77] The authors have logged over 48 months of continuous, day-to-day monitoring of ISF operational activity in the Kirkuk farmbelts since the liberation of the Hawijah pocket in Q4 2017, allowing them to build a highly granular picture of insurgent staging grounds and sanctuary areas (to include specific wadis and ridge systems) from the pattern of Federal Police and other ISF security operations.

[78] Drawn from real-time aircraft tracking service FlightRadar24. Persistent day-to-day monitoring has allowed the authors to further develop their picture of the Kirkuk insurgency by overlaying the distinctive racetrack patterns and circular orbits of coalition surveillance flights over time onto geolocated mapping of security incidents and ISF security operations.

[79] For JRTN’s strength among the Jabbouris of Hawijah, see Michael Knights, “The JRTN Movement and Iraq’s Next Insurgency,” CTC Sentinel 4:7 (2011). On the presence of Ansar al-Sunna (and other non-Islamic State insurgent factions) in Hawijah, see Sinan Adnan and Aaron Reese, “Beyond the Islamic State: Iraq’s Sunni Insurgency,” Institute for the Study of War, October 2014.

[80] For an account of Islamic State predation on local communities and the cat-and-mouse game between security forces and insurgents in the rural backwaters of Kirkuk province, see Ghaith Abdul-Ahad, “‘They will never let go’: Isis fighters regroup in the heart of Iraq,” Guardian, July 11, 2021.

[81] Qualitative observations drawn from the dataset.

[82] See footnote M for discussion of the camera masts.

[83] Authors’ conversations with journalists who visited the Kirkuk farmbelts, 2021; names and places of interviews withheld at request of interviewees. The authors also conduct intensive day-to-day monitoring of Iraqi security forces operational activity, equipment trends, and order of battle.

[84] Based on author’s (Almeida) day-to-day monitoring of Federal Police operations in Kirkuk, plus an increase in reports in the authors’ geolocated SIGACT dataset of sniping attacks aimed at knocking out camera masts.

[85] Based on the authors’ geolocation of known Federal Police outpost positions overlaid with range rings for the 120mm and 81/82mm mortars most commonly used by the Federal Police.

[86] Based on author’s (Knights) conversation with a journalist who noted significant improvements in the Federal Police’s operational posture in Kirkuk during multiple visits to the area in 2018 and 2019.

[87] Qualitative observations drawn from the author’s SIGACT dataset.

[88] See the Diyala section in Knights and Almeida, “Remaining and Expanding.”

[89] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[90] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[91] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[92] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[93] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[94] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[95] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[96] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[97] Qualitative observations drawn from the dataset.

[98] Based on author’s (Almeida) review of dozens of Islamic State imagery set releases from Diyala over the last 20 months, as well as in comments from provincial security officials cited in Iraqi media reportage. For a recent example, see Louisa Lovelock and Mustafa Salim, “An ISIS attack in Iraq provokes conflict between neighbors, stirring sectarian violence,” Washington Post, November 12, 2021.

[99] Qualitative observations drawn from the author’s SIGACT dataset.

[100] Qualitative observations drawn from the author’s SIGACT dataset.

[101] Knights and Mello, “Losing Mosul, Regenerating in Diyala.”

[102] Ibid.

[103] Qualitative observations drawn from the author’s SIGACT dataset.

[104] Qualitative observations drawn from the author’s SIGACT dataset.

[105] On AQI and the ISI’s longstanding presence in the western residential neighborhoods of Baqubah, see Knights, “Pursuing Al-Qa’ida into Diyala Province.” For an in-depth account of Baqubah’s significance to AQI in the first iteration of Iraq’s insurgency, see Joel Wing, “How Iraq’s Civil War Broke Out In Diyala Province: Interview With Former Interrogator Richard Buchanan,” Musings on Iraq, July 28, 2014.

[106] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[107] For a pioneering account of the multi-city strikes, see Jessica Lewis, “Al-Qaeda in Iraq Resurgent, Part II,” Institute for the Study of War, October 2013.

[108] The issue of the Islamic State’s external operations planning against European targets in 2015-2016 is discussed in Michael Knights and Wladimir van Wilgenburg, “Policy Focus 168: Accidental Allies: The US–Syrian Democratic Forces Partnership Against the Islamic State,” Washington Institute for Near East Policy, June 22, 2021, pp. 106-107.

[109] Based on author’s (Knights) conversations with U.S. and Iraqi intelligence officers working on the Islamic State, 2018-2021; names and places of interviews withheld at request of interviewees.

[110] Based on author’s (Knights) conversations with U.S. and Iraqi intelligence officers working on the Islamic State, 2018-2021; names and places of interviews withheld at request of interviewees.

[111] Qualitative insight drawn from the authors’ geolocated SIGACT dataset.

[112] Based on author’s (Knights) conversations with a senior Iraqi intelligence officer working on the Islamic State, in 2021 in Iraq; name and place of interview withheld at request of interviewee.

[113] On projection of ‘reach’ attacks into the Shi`a deep south, see Michael Knights, “The Role and Significance of Signature Attacks in the Iraqi Insurgency,” CTC Sentinel 3:9 (2010).

[114] Ibid.

[115] Based on author’s (Knights) conversations with Kurdish intelligence officers, 2018-2019; names and places of interviews withheld at request of interviewees.

[116] Based on author’s (Knights) conversations with Kurdish intelligence officers working on the Islamic State (2020-2021); names and places of interviews withheld at request of interviewees.

[117] Based on author’s (Knights) conversations with Kurdish intelligence officers working on the Islamic State, (2020-2021); names and places of interviews withheld at request of interviewees.

[118] “Kurdistan Region announces it arrested ISIS cell planning attack on Erbil,” Kurdistan24, April 12, 2021.

[119] Based on author’s (Knights) conversations with KRI intelligence officers, March 2021; names and places of interviews withheld at request of interviewees.

[120] Based on author’s (Knights) conversations with KRI intelligence officers, March 2021; names and places of interviews withheld at request of interviewees. For background on Ansar al-Islam’s and AQKB’s history and operations in the KRI, see Wladimir van Wilgenburg, “Iraqi Kurdistan Hit by First Suicide Bombing in Six Years,” Al-Monitor, September 2013.

[121] Based on author’s (Knights) conversations with KRI intelligence officers, August 2018 and March 2021; names and places of interviews withheld at request of interviewees. For background on the Islamic State’s Kurdish combat unit, the Katibat Salah ad-Din, see Aymenn Al-Tamimi, “The Islamic State and the Kurds: The Documentary Evidence,” CTC Sentinel 10:8 (2018).

[122] All data on cell takedowns is drawn from the authors’ geolocated SIGACT dataset, which includes arrests.

[123] Drawn from the authors’ geolocated SIGACT dataset.

[124] Drawn from the authors’ geolocated SIGACT dataset.

[125] Drawn from the authors’ geolocated SIGACT dataset.

[126] Drawn from the authors’ geolocated SIGACT dataset, supplemented by the author’s (Knights) conversations with KRI intelligence officers, December 2021; names and places of interviews withheld at request of interviewees.

[127] Confession video of the April 2021 Erbil cell released by the Kurdistan Region Security Council (KRSC), posted on the Facebook page of The Directorate General of Counter Terrorism (CTD) in the KRSC: “Arrest of a terrorist cell and the defusing of their plans,” posted April 12, 2021, supplemented by conversations with Kurdish intelligence officers, March-April 2021; names and places of interviews withheld at request of interviewees.

[128] Based on cell members’ confession videos released by the KRSC, posted on the Facebook page of the CTD in the KRSC: “Arrest of a terrorist cell and the defusing of their plans,” posted April 12, 2021; “Confessions of a dangerous ISIS group planned to conduct terrorist attacked during Eid al-Adha in Erbil,” posted July 13, 2021; and “Confessions of a terrorist group planned attack inside city of Erbil,” posted September 5, 2021. Plus author’s (Knights) conversations with Iraqi intelligence officers, August 2021; names and places of interviews withheld at request of interviewees.

[129] Data on the cell members’ backgrounds, places of origin, and personal histories are drawn from publicly available confession videos released by the KRSC, posted on the Facebook page of the CTD in the KRSC: “Arrest of a terrorist cell and the defusing of their plans,” posted April 12, 2021; “Confessions of a dangerous ISIS group planned to conduct terrorist attacked during Eid al-Adha in Erbil,” posted July 13, 2021; and “Confessions of a terrorist group planned attack inside city of Erbil,” posted September 5, 2021.

[130] Based on KRSC-released confession video, posted on the Facebook page of the CTD in the KRSC: “Arrest of a terrorist cell and the defusing of their plans,” posted April 12, 2021, supplemented by author’s (Knights) conversations with KRI intelligence officers, March-April 2021; names and places of interviews withheld at request of interviewees.

[131] Based on author’s (Knights) conversations with KRI intelligence officers, March-September 2021.

[132] “Security forces end attack on Erbil governorate by suspected Islamic State militants,” Reuters, July 2018.

[133] Based on confession videos of the Erbil cells detained in July and September 2021, posted on the Facebook page of the CTD in the KRSC: “Confessions of a dangerous ISIS group planned to conduct terrorist attacked during Eid al-Adha in Erbil,” posted July 13, 2021, and “Confessions of a terrorist group planned attack inside city of Erbil,” posted September 5, 2021.

[134] Based on confession videos of the Erbil cells detained in July and September 2021, posted on the Facebook page of the CTD in the KRSC: “Confessions of a dangerous ISIS group planned to conduct terrorist attacked during Eid al-Adha in Erbil,” posted July 13, 2021, and “Confessions of a terrorist group planned attack inside city of Erbil,” posted September 5, 2021, plus author’s (Knights) conversations with Kurdish intelligence officers, July-September 2021; names and places of interviews withheld at request of interviewees.

[135] Based on author’s (Knights) conversations with Iraqi intelligence officers working on the Islamic State, 2019-2020; names and places of interviews withheld at request of interviewees.

[136] Based on author’s (Knights) conversations with a senior Iraqi intelligence officer working on the Islamic State, in 2021 in Iraq; name and place of interview withheld at request of interviewee.

[137] All incident data is drawn from the authors’ geolocated SIGACT dataset.

[138] Qualitative insight drawn from the authors’ geolocated SIGACT dataset.

[139] Qualitative insight drawn from the authors’ geolocated SIGACT dataset.

[140] Ahmed al-Tai, “Iraqi officials ramp up security measures to protect power lines,” Al Mashareq, August 18, 2021. See also “Baghdad’s west without water after ISIS attack on power grid,” AFP, August 14, 2021.

[141] Michael Knights, “Iraqi Insurgents Undertake Sophisticated Targeting of Critical Infrastructures,” Jane’s Intelligence Review, December 2005.

[142] Knights and Almeida, “Remaining and Expanding.”

[143] See the concluding analytic section in Ibid.

[144] Ibid.

[145] Ibid.

[146] See collated monthly incident tracking reports produced by Gregory Waters at the Counter Extremism Project. All Syria attack metrics cited in this study are drawn from this dataset. For a discussion of the methodology behind the collation process, see Gregory Waters, “‘A Force They Haven’t Seen Before’: Insurgent ISIS in Central Syria,” Middle East Institute, April 15, 2020.

[147] For a full discussion of the under-reporting issue, see Gregory Waters and Charlie Winter, “Islamic State Under-Reporting in Central Syria: Misdirection, Misinformation, or Miscommunication?” Middle East Institute, September 2, 2021.

[148] All Syria incident data is drawn from the Waters’ dataset.

[149] Based on author’s (Knights) interviews and visits with Iraqi intelligence officers working on the Islamic State in Syria and Iraq, 2019-2020; names and places of interviews withheld at request of interviewees.

[150] Based on author’s (Knights) conversations with a senior Iraqi intelligence officer working on the Islamic State, Iraq, 2021; name and place of interview withheld at request of interviewee.

[151] All incident data is drawn from the authors’ geolocated SIGACT and arrest dataset.

[152] Quantitative trend analysis drawn from the authors’ geolocated SIGACT and arrest dataset.

[153] Drawn from the authors’ geolocated SIGACT dataset, which also includes security force operations.

[154] These previous gaps in the ISF’s basic counterinsurgency toolkit are identified in Joel Wing, “Can The Islamic State Make A Comeback In Iraq Part 3? Interview With Horizon’s Alex Mello,” Musings on Iraq, August 2019.

[155] Knights, “Predicting the Shape of Iraq’s Next Sunni Insurgencies.”

[156] For an easy read on the gradually improving quality of ISF commanders, see the table in Michael Knights and Alex Almeida, “Back to Basics: U.S.-Iraq Security Cooperation in the Post-Combat Era,” Washington Institute for Near East Policy, 2021, p. 26.

[157] For a detailed, one-volume read on all aspects of the PMF, see Michael Knights, Hamdi Malik, and Aymenn Jawad Al-Tamimi, “Honored, Not Contained: The Future of Iraq’s Popular Mobilization Forces,” Policy Focus 163 (2020): pp. 58, 61, 143.

[158] Based on the authors’ conversations with Iraqi intelligence officers and politicians with close insight into militia operations in the provinces, 2018-2020; names and places of interviews withheld at request of interviewees.

[159] For a deep dive on the disciplinary and command and control problems in the PMF, see Knights, Malik, and Al-Tamimi, pp. 101-124.

[160] Based on the authors’ conversations with Iraqi intelligence officers and politicians with close insight into militia operations in the provinces, 2018-2020; names and places of interviews withheld at request of interviewees.

[161] Knights, “Predicting the Shape of Iraq’s Next Sunni Insurgencies.”

[162] Knights, “The Islamic State Inside Iraq.”

[163] On Iraq’s persistent difficulties with developing an effective, time-sensitive dynamic strike capability, see “Lead Inspector General for Operation Inherent Resolve Quarterly Report to the United States Congress, July 1, 2021 – September 30, 2021,” U.S. Department of Defense Office of Inspector General, November 4, 2021.

[164] For a good primer on reconstruction issues, see “Rebuilding the Iraqi State: Stabilisation, Governance, and Reconciliation,” European Union, 2018.

[165] “Exiles in Their Own Country: Dealing with Displacement in Post-ISIS Iraq,” International Crisis Group, October 19, 2020.

[166] Husham Al-Hashimi, “ISIS in Iraq: The Challenge of Reintegrating ‘ISIS Families,’” Newlines Institute, July 7, 2020.

[167] “Pope Francis visits regions of Iraq once held by Islamic State,” BBC, March 8, 2021.

[168] Hassan Hassan, “Insurgents Again: The Islamic State’s Calculated Reversion to Attrition in the Syria-Iraq Border Region and Beyond,” CTC Sentinel 10:11 (2017).

[169] Based on author’s (Knights) conversations with a senior Iraqi intelligence officer working on the Islamic State, Iraq, 2021; name and place of interview withheld at request of interviewee.

[170] Qualitative observation based on the authors’ combined 27 years of monitoring Iraqi security dynamics.

[171] For a good ground-sourced view on Sunni disillusionment with the Islamic State, see Liz Sly, “ISIS: A catastrophe for Sunnis: Many have suffered under the Islamic State, but the misery inflicted on Sunnis will resonate for generations,” Washington Post, November 23, 2016.

[172] For an excellent review of the issue, and a general must-read for Islamic State watchers, see Haroro J. Ingram, Craig Whiteside, and Charlie Winter, “Lessons from the Islamic State’s ‘Milestone’ Texts and Speeches,” CTC Sentinel 13:1 (2020).

[173] Ibid.