Salafi-Jihadi In Africa

African groups may become more direct participants in global jihad as they develop capabilities that they can use overseas. Every Salafi-jihadi group that has attacked transnationally began with a local focus; past examples show that groups can rapidly pivot to transnational attack plotting when circumstances shift. As African Salafi-jihadi groups continue to develop more advanced military and nonmilitary capabilities, they stand to provide even greater benefits to the global Salafi-jihadi movement in terms of recruits, money, propaganda, innovation, leadership, and safe havens.

This report considers the capabilities, resources, and opportunities that can be used to assess the relative strength of a Salafi-jihadi group in terms of its sophistication, effectiveness, and resilience. This framework aims to facilitate comparing groups at different stages of development, tracking changes in their capacity over time.

The analysis in this report points to a necessary rethink in US policy to counter the Salafi-jihadi movement. The United States’ counterterrorism policy is missing the opening to stop Salafi-jihadi insurgencies from forming and becoming entrenched. Policymakers should reform US foreign assistance and expand intelligence coverage to prioritize conflict prevention and resolution. A long-term solution requires reducing the overall level of capability, resourcing, and opportunity available to the Salafi-jihadi movement.

Selected Salafi-Jihadi Activity in Africa, 2012–22

• Al Qaeda in the Islamic Maghreb and its allies took over northern Mali in 2012.

• Al Shabaab attacked Kenya’s Westgate Mall in 2013.

• Boko Haram kidnapped hundreds of schoolgirls in 2014.

• Islamic State gunmen attacked Tunisian tourist sites in 2014 and 2015.

• The Islamic State seized Sirte, Libya, in 2015.

• Al Shabaab attacked Kenya’s Garissa University in 2015.

• Islamic State militants downed a Russian passenger jet in Egypt in 2015.

• Islamic State–linked fighters ambushed American servicemen in Niger in 2017.

• Intensifying militant activity caused mass displacement in Burkina Faso in 2018.

• The Islamic State announced affiliates in the Democratic Republic of the Congo and Mozambique in 2019.

• Authorities disrupted an al Shabaab plot targeting commercial airliners in 2019.

• Al Shabaab attacked a US military position in Kenya in 2020.

Al Qaeda and the Islamic State are rising in Africa. The Salafi-jihadi movement has long-standing connections to the continent, exemplified by the participation of North African mujahideen in Afghanistan in the 1980s and al Qaeda’s operations in East Africa in the 1990s. The global crackdown on al Qaeda’s networks in the aftermath of the 9/11 attacks compounded setbacks for the movement, briefly reversing its progress on the continent.

But the past decade has been a period of clear expansion marked by the exponential growth of rank-and-file membership and increases in the number of active Salafi-jihadi organizations and their territorial reach in Africa. (See the sidebar.) This phenomenon has immediately and severely affected thousands of Africans subjected to violence. But not only Africans have a stake in beating back this jihadist expansion. The growing Salafi-jihadi base in Africa supports a global movement waging war on the US and many of its allies.

Several Salafi-jihadi groups in sub-Saharan Africa are advancing as Western countries shift focus away from counterterrorism concerns and toward geostrategic competition. Al Shabaab, al Qaeda’s East African affiliate, seized the opportunity to reestablish itself in south-central Somalia after US troops withdrew in January 2021 and again threatens Mogadishu’s security, despite the US military’s reentry to the country in May 2022. Al Qaeda–linked groups in the Sahel are capitalizing on a rash of coups, deteriorating security, and reduced counterterrorism pressure to embed themselves further in a growing swath of terrain. The Islamic State affiliate in Nigeria is expanding its operations into areas of greater concern to the Nigerian government. Salafi-jihadi groups across West Africa have tapped into illicit trafficking networks, deepening a symbiosis between terrorism and crime. Even in North Africa, where military and policing campaigns significantly degraded Salafi-jihadi groups in recent years, governance and security trends — particularly in Libya and Tunisia — signal opportunities for militants to regroup.

Expanding Salafi-jihadi militancy in Africa harms not only the militants’ direct victims but also those affected by related conflicts and humanitarian crises. Salafi-jihadi expansion also contributes to persistent instability that compounds state weakness. Antiliberal and antidemocratic actors can draw opportunity and justification from this weakness and the presence of jihadist terror threats. Long-running jihadist insurgencies and disruptive terror campaigns undermine economic growth in some of the continent’s poorest countries and disrupt global markets, including oil and gas. Instability, poor governance, and high security costs also threaten the advancement of cornerstone countries — those that will disproportionately affect the continent’s trajectory — including Algeria, Egypt, Ethiopia, and Nigeria.

The effects of Salafi-jihadi expansion in Africa reach beyond national and regional borders. African bases and affiliates help sustain the global Salafi-jihadi movement. Al Qaeda and the Islamic State’s African affiliates are more than just rebranded local insurgencies. Even newly pledged affiliates can derive concrete benefits from their participation in regional and global jihadi networks. As African Salafi-jihadi groups continue to develop more advanced military and nonmilitary capabilities, they stand to provide even greater benefits to the global movement in terms of recruits, money, propaganda, innovation, leadership, and safe havens.

The trigger point for Western policymakers to act is a transnational terror threat from one of these Salafi-jihadi groups. Yet though Africa-based groups are responsible for many attacks on limited Western interests in Africa, only a fraction of transnational terror attacks trace back to them. Islamic State attacks in Germany in 2016 and the UK in 2017 originated with external attack plotters in Libya. Al Shabaab has attempted to target international aviation in recent years, with a bomb attempt on a plane leaving Mogadishu in 2016 and an early-stage 9/11-style attack disrupted in the Philippines in 2019.

What national security strategies tend to overlook is that the maturation of African Salafi-jihadi groups will lead to an increased transnational terror threat. Local and global jihad are indelibly linked. Attack cells — the small groups of individuals involved in a terror attack — are small, but they rely on a threat node with a larger footprint. The threat node’s larger set of capabilities comes from Salafi-jihadi insurgent organizations’ regional support bases.

These regional bases also allow threat nodes to reconstitute, meaning that counterterrorism gains against particular plotters, attacks, and infrastructure are typically temporary, especially when there is a well-developed underpinning organization. Salafijihadi havens provide capabilities and resources, including “recruitment and inter-theater movement; funding; communication; counter-intelligence; media support; vetting, training, and indoctrination; weapons design expertise; and intelligence and planning.” Local and regional insurgencies provide destinations for foreign fighters and propaganda fodder for global Salafi-jihadi organizations. Entrenched jihadist insurgencies with governing capabilities are also preparing future recruits by indoctrinating a generation of children.

US counterterrorism policies focus on eliminating threat nodes over removing regional support bases. These policies and accompanying legal authorities are structured around either actors’ present intent and active plotting or their past culpability for attacks. Identifying and destroying discrete terror networks is necessary to address present threats but fails to prevent new terror threats from emerging. The existence of a larger Salafi-jihadi base — the loose network of individuals, groups, and organizations united by a common cause — allows external attack plotting and facilitation networks to regenerate continually. The expansion of Salafi-jihadi insurgencies also creates new opportunities for terror networks to form.

African groups may become more direct participants in global jihad as they develop capabilities that they can use overseas. Every Salafi-jihadi group that has attacked transnationally began with a local focus; past examples show that groups can rapidly pivot to transnational attack plotting when circumstances shift. Not every Salafi-jihadi group will inevitably pursue or enable global terror campaigns. Some may calculate that eschewing such attacks better serves their efforts to achieve local dominance. Certainly, groups that originate within the Salafi-jihadi movement but disavow global terror deserve further study. But past patterns show that ideological, bureaucratic, and organizational factors, including intra-jihadist competition, push local groups toward pursuing transnational attacks directly or supporting externally focused attack networks.

Assessing Salafi-Jihadi Capabilities, Resources, and Opportunities

▲ Figure 1. Salafi-Jihadi Groups in Africa. Source: Author.

The tables in this report consider capabilities, resources, and opportunities that can be used to assess the relative strength of a Salafi-jihadi group in terms of its sophistication, effectiveness, and resilience. (See Figure 1.) These tables incorporate military and technical skills but recognize that assessments of militant groups’ strength often overvalue these “hard” metrics. The tables therefore also consider “softer” skills, including governance capabilities and organizational qualities, that affect groups’ ability to recover from hardships. This framework aims to facilitate comparing groups at different stages of development and track changes in groups’ capabilities, resources, and opportunities over time. Any effective policy for degrading the global Salafi-jihadi movement will require blocking or reducing groups’ overall capabilities and access to resources and opportunities.

Salafi-Jihadi Capabilities, Resources, and Opportunities: Governance

▲ Table 1. Salafi-Jihadi Capabilities, Resources, and Opportunities: Governance. Note: Colors indicate the level of a group’s capabilities or its access to resources and opportunities. The color-coding indicates the level of skill or access, from red (highest threat level) to orange, yellow (moderate threat level), and green (lowest threat level). * “AQIM” in these tables refers to AQIM activity in Algeria, Libya, and Tunisia. AQIM activity in the Sahel is considered as part of JNIM. ** “JNIM and Allies” refers to groups that are part of JNIM and those that cooperate with it, including AQIM in the Sahel and Ansar al Islam in Burkina Faso. “ISCAP-DRC” refers to Islamic State Central Africa Province–Democratic Republic of Congo. See Appendix A for a further explanation of group definitions and labeling. See Appendix B for the criteria and thresholds used to assess groups’ capabilities and resources. Source: Author’s analysis using cited materials.

These factors assess a group’s interaction with its audience, particularly the local population but also potential recruits regionally and globally. (See Table 1.) These criteria consider a group’s capacity to bend a population to its will by either force or persuasion and the local conditions that create opportunities for armed groups to influence communities. This analysis is a rough proxy for criteria that are difficult to judge, including popular sentiment and other hyperlocal dynamics, which should be studied for a deeper understanding of Salafi-jihadi groups’ effectiveness across local contexts. The factors are provision of social services, exercise of social control, effective use of propaganda, exploitation of local networks, and mobilization of the population.

Salafi-Jihadi Capabilities, Resources, and Opportunities: Military and Technical

▲ Table 2. Salafi-Jihadi Capabilities, Resources, and Opportunities: Military and Technical. Note: Colors indicate the level of a group’s capabilities or its access to resources and opportunities. The color-coding indicates the level of skill or access from red (highest threat level) to orange, yellow (moderate threat level), and green (lowest threat level). See Appendix B for the criteria and thresholds used to assess groups’ capabilities and resources. Source: Author’s analysis using cited materials.

These factors analyze an armed group’s ability to build, acquire, and use tools for making war. (See Table 2). They consider conventional and unconventional military effectiveness and terror attack capability, ranging from local to transnational. The factors are bomb making, access to weapons systems, sophisticated tactics, local force projection, regional force projection, global terror attack capability, presence of elite units, access to resources, and access to a permissive environment.

Salafi-Jihadi Capabilities, Resources, and Opportunities: Organizational

▲ Table 3. Salafi-Jihadi Capabilities, Resources, and Opportunities: Organizational. Note: Colors indicate the level of a group’s capabilities or its access to resources and opportunities. The color-coding indicates the level of skill or access from red (highest threat level) to orange, yellow (moderate threat level), and green (lowest threat level). See Appendix B for the criteria and thresholds used to assess groups’ capabilities and resources. Source: Author’s analysis using cited materials.

These factors consider a group’s ability to coordinate people toward its goals by managing its internal processes and its interactions with other organizations. (See Table 3.) These criteria also consider groups’ contributions to the broader Salafi-jihadi movement. The factors are the ability to generate force, resilience and adaptability, the ability to integrate with and amplify Salafi-jihadi networks, and interaction with competitors and the presence of infighting.

Capabilities Won and Lost

The below narratives consider the trajectories of several African Salafi-jihadi groups that have gained and lost capabilities. The narratives explore different categories of capability: governance, military and technical, and organizational. They consider how these capabilities affect each other and contribute to the groups’ overall resilience and effectiveness.

Al Qaeda Plays Politics in the Sahel. The Salafi-jihadi expansion in the Sahel demonstrates the importance of adaptation to a local social context. Al Qaeda in the Islamic Maghreb (AQIM) emerged from Algeria’s 1991–2002 civil war, and its leaders have largely been Algerians focused on North African affairs. Yet this group leveraged its foothold in southern Algeria to set off a chain of jihadist activity in the Sahel that, a decade later, has spread all the way to the Gulf of Guinea.

AQIM came to the Sahel because of the opportunities that region presented. The group took up lucrative kidnapping-for-ransom efforts in southern Algeria and over time embedded itself in cross-border human networks, including through intermarriage. This attenuation to local dynamics and Malian security forces’ inability to apply consistent pressure allowed AQIM to establish a consistent presence in northern Mali, though not to overtly control terrain. (See Figure 2.)

▲ Figure 2. AQIM Areas of Operations. Note: Overlap in operations reflects overlap in goals and leadership. MUJWA stands for Movement for Unity and Jihad and West Africa, a now-defunct AQIM-linked group. Source: Andreas Hagen, “Al Qaeda in the Islamic Maghreb: Leaders and Their Networks,” Critical Threats Project at the American Enterprise Institute, March 27, 2014.

AQIM rapidly increased its influence in northern Mali by tapping into elite Tuareg networks. AQIM and its partner, the Tuareg-majority militant group Ansar al Din, outcompeted a less-organized non-jihadi group to take lead of the rebellion that controlled northern Mali. (See Figure 3.) Organization and governance provision helped AQIM and Ansar al Din overtake their rivals before implementing a hard-line interpretation of shari’a. (See Figure 4.)

▲ Figure 3. AQIM’s Support for Ansar al Din. Note: MUJWA stands for Movement for Unity and Jihad in West Africa. Source: Andreas Hagen, “Al Qaeda in the Islamic Maghreb: Leaders and Their Networks,” Critical Threats Project at the American Enterprise Institute, March 27, 2014.

▲ Figure 4. Ansar al Din and Movement for Unity and Jihad in West Africa Southward Advance from March 30, 2012, to January 10, 2013. Note: MUJAO is the French-language acronym for the Movement for Unity and Jihad in West Africa. Source: Alix Halloran and Katherine Zimmerman, “Warning from the Sahel: Al Qaeda’s Resurgent Threat,” Critical Threats Project at the American Enterprise Institute, September 1, 2016. Halloran and Zimmerman’s analysis uses data from RFI, BBC, Reuters, and Al Jazeera.

AQIM and its allies have continued to embed themselves in the Sahel’s social fabric by taking advantage of weak competitors and adapting to local conditions. Salafi-jihadi militants, despite their violence, have cultivated a reputation for being less corrupt than local or national authorities.

AQIM’s longevity also stems from organizational and ideological flexibility across a diverse jihadist network. The Salafi-jihadi ecosystem in the Sahel is characterized by a high degree of fragmentation, but these internal squabbles have largely not undermined the movement and its goals. Several factions split off in the early 2010s due to frustrations with leadership, including limited opportunities for non-Arab militants. But the Salafi-jihadi network in the Sahel seems to have largely overcome this challenge through a franchising model in which ideological ties integrate armed groups aligned to multiple ethnicities.

Jama’at Nusrat al Islam wa al Muslimeen’s (JNIM) 2017 formation underscores this dynamic. JNIM formed through a merger that brought together several AQIM-linked groups, including the Tuareg-majority Ansar al Din and the Fulani-majority Macina Liberation Front (MLF). JNIM’s federation model enables its subgroups to operate where they are most effective. The MLF has led JNIM’s expansion through central Mali and into Burkina Faso. (See Figures 5 and 6.)

▲ Figure 5. Location of Fulani and Tuareg Groups. Source: Alix Halloran and Katherine Zimmerman, “Warning from the Sahel: Al Qaeda’s Resurgent Threat,” Critical Threats Project at the American Enterprise Institute, September 1, 2016. Halloran and Zimmerman’s analysis uses data from National Geographic, SIL International, and Geopolitical Atlas.

▲ Figure 6. AQIM’s Resurgence in the Sahel from January 1, 2012, to May 31, 2016. Source: Alix Halloran and Katherine Zimmerman, “Warning from the Sahel: Al Qaeda’s Resurgent Threat,” Critical Threats Project at the American Enterprise Institute, September 1, 2016.

The MLF has introduced a more grassroots model of engaging with local populations, in contrast to AQIM’s initial entry through Tuareg elites. The MLF practices a combination of coercion and negotiation to develop de facto control relationships with villages. The Fulani population in central Mali includes many pastoralists often marginalized by state structures and in conflict with other communities. The MLF has merged Fulani grievances with a narrative of religious legitimacy to cast itself as the population’s defender. (See Figure 7.) The MLF’s success in its pressure-and-governance campaign has also yielded military benefits, bringing it within striking distance of Mali’s capital and facilitating attacks on strategic Malian military positions.

▲ Figure 7. AQIM’s Integration with West African Ethnic Groups. Note: The MNLA is the National Movement for the Liberation of Azawad. ANSIPRJ is the National Alliance for the Protection of Peul (Fulani) Identity and Restoration of Justice. Source: Alix Halloran and Katherine Zimmerman, “Warning from the Sahel: Al Qaeda’s Resurgent Threat,” Critical Threats Project at the American Enterprise Institute, September 1, 2016.

JNIM has weathered a challenge from an Islamic State affiliate in the Sahel. Islamic State in the Greater Sahara (ISGS), which originated as an AQIM splinter group, has challenged JNIM in some areas, including in attracting defectors. ISGS is likely not a serious threat to JNIM’s overall dominance in large areas of Mali and Burkina Faso, however. (See Figure 8). JNIM and ISGS have vacillated between cooperation, conflict, and deconfliction, and they will likely carve out separate spheres of influence over the long term. ISGS’s presence allows JNIM to present itself as comparatively moderate. JNIM fighters, likely from the MLF, may now be partnering with non-jihadist forces against ISGS. JNIM will likely suffer some short-term losses but will cement its ties to local communities — and its base for fighting against the Malian government — in the long term.

▲ Figure 8. Salafi-Jihadi Areas of Operation in the Sahel. Source: Brian Carter, “Salafi-Jihadi Areas of Operation in the Sahel,” Critical Threats Project at the American Enterprise Institute, September 30, 2022.

JNIM’s governance proposal is perhaps best described as solving the problem it helped create. The group strikes security agreements with communities in Mali and Burkina Faso, granting truces or providing security while requiring residents to accept the group’s interpretation and implementation of shari’a. The deals, accepted by community leaders desperate to stop displacement and violence, reflect exhaustion with years of violence perpetrated by jihadists, state security forces, local militias, and foreign forces.

Much of JNIM’s progress is owed to its adversaries’ shortcomings, including a Malian state that has an absent, if not abusive, relationship with many communities in northern and central Mali. Mali’s recent coups and its government’s hiring of Russian Wagner Group mercenaries have only intensified negative relationships between security forces and populations in central Mali.

JNIM’s application of governance skills and military strategy will allow it to solidify its position as the de facto governing entity across large areas of Mali and Burkina Faso. JNIM — and al Qaeda — will consider this success against the “near enemy” a major victory for the movement. JNIM media has drawn parallels between the 2021 French withdrawal from Mali and the 2021 US withdrawal from Afghanistan, placing JNIM within an al Qaeda strategic narrative that prioritizes long-term insurgencies to remove external forces and topple local “apostate” governments. In an August 2021 video, the group’s leader called for Muslims to rise up and attack France, Israel, Russia, and the US.

These threats do not indicate that JNIM will immediately plot or facilitate external attacks, but they demonstrate the group’s ideological predisposition to support such operations. JNIM has not followed the model of the former al Qaeda–linked group Hayat Tahrir al Sham in Syria, which disavowed external terror attack plotting. JNIM’s expansion in the Sahel not only delivers another victory to al Qaeda’s model for jihadist takeovers but also perpetuates the Salafi-jihadi transnational terror threat by providing havens and a growing pool of funding and recruits.

The Islamic State in Libya Loses the Governance Game. The Islamic State’s branch in Libya rose rapidly thanks to external support and the chaotic conditions of Libya’s civil war. But the group also collapsed quickly, in part because it failed to root itself into the local community and align itself with popular grievances.

IS-Libya rose rapidly in 2014 and 2015, capitalizing on the Libyan Salafi-jihadi networks that had reemerged as the Libyan state disintegrated. The Islamic State provided crucial expertise and startup funding, including senior leaders with wartime experience in Iraq and Syria. The Islamic State highlighted IS-Libya as its priority outpost beyond its core terrain, particularly as the group consolidated control of Sirte — Muammar Qaddafi’s hometown and a city largely abandoned between the front lines of Libya’s civil war.

IS-Libya developed an advanced military capability, including the capacity to build and use multiple suicide vehicle-borne improvised explosive devices. Islamic State media highlighted its governance project in the city. IS-Libya attracted significant numbers of foreign fighters, including many from neighboring Tunisia and an unprecedented mobilization of militants from sub-Saharan Africa. IS-Libya also supported external attack planners. The group facilitated the Berlin Christmas market attack in 2016 and the Manchester Arena bombing in 2017. (See Figure 9.)

▲ Figure 9. ISIS Libya Network, 2017. Source: Emily Estelle, “A Strategy for Success in Libya,” Critical Threats Project at the American Enterprise Institute, November 8, 2017.

However, IS-Libya’s high public profile and appearance of strength belied weaknesses in its organization and ability to exert control and influence. The group’s multiple outposts in Libya gradually crumbled when rival armed groups — including some linked to al Qaeda — mobilized against it. IS-Libya’s crown jewel, Sirte, slipped from its fingers, first because it struggled to provide for civilians and eventually its fighters there and second because the group expanded too far westward, inciting the military campaign that would oust it from the city. IS-Libya’s lack of ties to the local population left its remnants vulnerable in desert camps far from populated areas, making it vulnerable to follow-on strikes that decimated its forces. (See Figure 10.)

▲ Figure 10. Fighting Forces in Libya as of December 2017. Note: This map shows the Islamic State area of operations in Libya a year after its retreat from Sirte. Source: Erin Neale and Emily Estelle, “Fighting Forces in Libya: December 2017,” Critical Threats Project at the American Enterprise Institute, December 8, 2017.

IS-Libya today is a rump group in a remote area, still lacking governance capabilities and organizational backing. It retains explosive attack capabilities but is not waging a consistent insurgency, instead launching intermittent attacks on security forces. (See Figure 11.) Its trajectory demonstrates the limits of pursuing a territorial insurgency that draws too much support from external organizations and a global narrative. IS-Libya is not defunct, however, and continues to play an amplifying role by providing trainers to militants in West Africa.

▲ Figure 11. Salafi-Jihadi Areas of Operation in Libya. Source: Kathryn Tyson, “Salafi-Jihadi Areas of Operation in Libya,” Critical Threats Project at the American Enterprise Institute, October 12, 2022.

Al Shabaab in Somalia Builds Skills over Years. Al Shabaab’s greatest asset may be time. The group has persisted thanks to a combination of its own strategy and innovation and its adversaries’ failure to sustain an effective effort against it. This persistence has allowed the group to entwine itself into Somalia’s political economy. Al Shabaab has also increased its military and technical skills and its organizational sophistication.

Al Shabaab developed out of Somalia’s civil war and has benefited and survived thanks to its ability to exploit a fragmented Somali society. The militant wing of the Islamic Courts Union that took over Somalia in the early 2000s, al Shabaab capitalized on the 2006 Ethiopian intervention to garner popular support. (See Figure 12.) This support waned when the intervention ended, but al Shabaab weathered the transition, largely because Somalia’s fractious political environment did not yield an effective alternative or sufficient armed force.

▲ Figure 12. Somalia: Islamist Areas of Control and Influence, 2010. Source: Katherine Zimmerman, “Somalia Conflict Maps: Islamist and Political,” Critical Threats Project at the American Enterprise Institute, May 31, 2010.

Al Shabaab adapted to military setbacks. It successfully transitioned to a rural insurgency after losing control of major cities in 2011 and 2012. (See Figure 13.) This setback may have ironically preserved the al Shabaab insurgency by relieving from it the potentially delegitimizing challenge of needing to govern densely populated areas.

▲ Figure 13. Somalia: The Retreat of al Shabaab, 2012. Source: Political Geography Now, “Somalia: The Retreat of al Shabaab,” October 9, 2012.

Al Shabaab has also weathered particularly fractious internal dynamics. Internecine squabbles and even significant defections have not destroyed the group, but rather they have concentrated control with its most hard-line leaders. The group has thus far demonstrated the capability to crush dissent and suppress rivals, notably the Islamic State. The current Somali government’s efforts to include al Shabaab defectors in government may challenge al Shabaab in certain regions, but there is not yet evidence of growing internal divisions.

Al Shabaab has deeply enmeshed itself in the Somali economy, particularly in south and south-central Somalia. The group makes as much revenue as the Somali federal government — enough to surpass AQIM as al Qaeda’s richest affiliate. Al Shabaab’s many moneymaking endeavors include the black-market charcoal trade, widespread extortion of Somali businesses, and taxation of the populations it controls. Al Shabaab also manipulates humanitarian aid in famine-hit Somalia, sometimes blocking distribution but other times stealing and redistributing supplies. (See Figure 14).

▲ Figure 14. Al Shabaab’s Humanitarian Response, March–August 2017. Source: Brian Carpowich, “Map Update #2: Al Shabaab’s Humanitarian Response,” Critical Threats Project at the American Enterprise Institute, September 5, 2017.

Al Shabaab’s access to relatively secure havens and its now decade-long fighting experience have created ample opportunity for it to increase its military and technical capability over time. (See Figure 15.) It has gained expertise from the al Qaeda network, particularly al Qaeda in the Arabian Peninsula, based in nearby Yemen. Iraq may have been the source for al Shabaab’s development of armor-piercing improvised explosive devices (IEDs) in 2011.

▲ Figure 15. Al Shabaab Area of Operations. Source: Liam Karr, “Al Shabaab’s Area of Operations,” Critical Threats Project at the American Enterprise Institute, September 15, 2022.

Al Qaida in the Arabian Peninsula’s expertise likely supported al Shabaab’s 2016 use of a laptop bomb in a botched attempt to destroy a passenger airplane leaving Mogadishu. Al Shabaab has also adapted to gain access to explosive power to support its military campaigns. It has increasingly relied on manufacturing its own homemade explosives from industrial precursors, instead of scavenging explosives, since 2017. Further, al Shabaab has demonstrated the capability to integrate IED attacks into complex military operations. The group, like other Salafi-jihadi groups on the continent and elsewhere, has begun to adopt drones for surveillance purposes.

Al Shabaab maintains specialized units to conduct regional terror attacks and pursue transnational operations. Elite al Shabaab units focus on internal security and external operations, including infamous attacks in Kenya such as the 2013 Westgate Mall attack, the 2015 Garissa University attack, and the 2019 DusitD2 hotel attack. The planner of the Camp Simba attack in 2020, al Shabaab’s first on a US military installation in Kenya, also coordinated an external attack network. (See Figure 16.) The group has shown more ambition in recent years, including dispatching members to pilot training in the early stages of planning a 9/11-style attack.

▲ Figure 16. Major al Shabaab Attacks in Kenya, 2013–20. Source: Author. Created with Datawrapper.

Al Shabaab and IS-Somalia both support Salafi-jihadi networks across East Africa. Fighters who became part of the current Islamic State–linked insurgency in Mozambique trained in Somalia, for example. IS-Somalia, though contained in Somalia by al Shabaab, serves as a coordination unit for Islamic State affiliates in the Democratic Republic of the Congo (DRC) and Mozambique.

The Islamic State in Nigeria Learns from Its Network. Salafi-jihadi militants in Nigeria have transformed from a brutal but localized threat into a potential regional and global threat as they have become increasingly enmeshed in the Islamic State’s network.

The group known as Boko Haram started on the margins of the global Salafi-jihadi movement. Al Qaeda expressed interest in a relationship, but personal and ideological conflicts prevented Boko Haram from officially joining. Boko Haram’s leader from 2009 to 2021, Abubakr Shekau, broke with al Qaeda’s teaching on several key issues, most importantly by defining any Muslim who did not support Boko Haram as a lawful target. (See Figure 17.)

▲ Figure 17. Boko Haram Activity in Nigeria, 2013. Source: Encyclopaedia Britannica, s.v. “Boko Haram,” accessed November 20, 2022.

Shekau’s ideological divergences with al Qaeda and his brutality helped set up a relationship with the Islamic State. Islamic State leaders, focused on building their global network, supported Boko Haram’s mass kidnapping of schoolgirls in 2014 and the group’s focus on holding territory and immediately implementing shari’a. The Islamic State’s objectives aligned with Shekau’s search for legitimacy and possibly other Boko Haram leaders’ desire to moderate him. Boko Haram pledged allegiance to the Islamic State in March 2015, becoming the Islamic State’s West Africa Province (ISWAP).

Joining the Islamic State accelerated organizational changes in ISWAP and gave the group funding and training from the Islamic State network. Recognizing Shekau’s ungovernability, Islamic State central backed an effort to oust him. ISWAP then rebranded to bolster its popular support, including announcing a focus on military — not civilian — targets. The Islamic State also provided money and capabilities directly, including giving more than a million dollars in 2017 and linking ISWAP to a network of trainers and IS officials operating predominantly in Libya through northern and western Africa. Islamic State leaders directly engage in ISWAP leadership affairs, including at least one potential instance of backing the murder of an ISWAP official.

ISWAP has continued to draw legitimacy and some concrete benefits from its Islamic State membership, even as the Islamic State has weakened in its core terrain and likely lost the ability to give significant cash transfusions to its African branches. ISWAP received training on small-arms tactics that improved its military effectiveness. The group has also begun using drones for surveillance thanks to training from the Islamic State network.

The Islamic State in turn uses ISWAP — which is still the largest, deadliest, and most active among its African affiliates — to bolster its self-reported statistics when many other affiliates and the core group are relatively less active. (See Figure 18.) Islamic State media frequently highlights ISWAP in its major publications. An Islamic State periodical even called for hijra (migration) to Africa, reflecting its greater focus on this theater as a key part of the group’s future.

▲ Figure 18. Salafi-Jihadi Areas of Operation in the Lake Chad Basin. Source: Liam Karr, “Salafi-Jihadi Areas of Operation in the Lake Chad Basin,” Critical Threats Project at the American Enterprise Institute, November 29, 2022.

Islamic State in Tunisia: Tied to Regional Circumstances. The rise and decline of the Islamic State in Tunisia demonstrates the potential fragility of Salafi-jihadi insurgencies that rely heavily on external support and cross-border havens. This case is also a warning, because Tunisia continues to suffer from many of the dynamics that yielded significant Islamic State recruitment, indicating that latent terror networks likely remain a potent threat.

The Arab Spring period created an opportunity for jihadi experimentation and innovation in Tunisia. Ansar al Shari’a in Tunisia, an al Qaeda associate, capitalized on the mobilization of society during and after the revolution to convert itself from a covert network to a social movement. The Syrian civil war also proved a potent mobilizer, with nearly 30,000 Tunisians attempting to travel to Syria and several thousand succeeding.

The Islamic State’s infrastructure in Syria, and particularly in Libya, proved effective for exporting violence back to Tunisia. The Islamic State was particularly effective at targeting Tunisian tourism, with major attacks in 2014 and 2015 that cratered the Tunisian tourism industry. (See Figure 19.)

▲ Figure 19. AQIM and ISIS in Tunisia: Latent Threats. Source: Alexa Santry and Emily Estelle, “AQIM and ISIS in Tunisia: Latent Threats,” Critical Threats Project at the American Enterprise Institute, December 15, 2017.

The Islamic State’s assault on Tunisia peaked in 2016 with an incident that underscored the group’s ambitions and shortcomings. A large contingent of militants based in northwestern Libya attempted a cross-border assault to seize the Tunisian town of Ben Guerdane. (See Figure 20.) The assault failed, however, reflecting several changes that made Tunisia a less permissible environment for a major Islamic State campaign.

▲ Figure 20. Major Islamic State Attacks in Tunisia, 2015–16. Source: Author. Created with Datawrapper.

First, Tunisian military and security forces had become more effective, thanks to government and foreign partner initiatives since 2015. The local population resisted the Islamic State assault — to the group’s surprise — and received backup from security forces. The Ben Guerdane attack also catalyzed another surge of Western foreign military aid. Tunisia has also significantly hardened its border with Libya.

Second, the Islamic State had begun to lose its secure haven in Libya. A month before the Ben Guerdane attack, a US air strike killed a major Tunisian Islamic State leader in northwestern Libya, near the Tunisian border. Local power brokers soon decided to oust the Islamic State presence from the area, denying the group the base it had used to coordinate prior attacks in Tunisia. The Islamic State’s position in Libya continued to split throughout 2016, culminating in the group’s loss of its primary foothold in Sirte. While the Islamic State still has a presence in remote southwestern Libya, it lacks access to populated areas and accessible cross-border routes into Tunisia.

The Islamic State is no longer visible as an organized group in Tunisia. It likely has remnants in remote areas in the country’s interior, where insurgents are often based, and there are indications of terror and radicalization networks in the more populated coastal areas. The group has not conducted a major attack in years, however.

And yet Tunisia still faces a serious latent threat. The underlying grievances that fed the Islamic State’s recruitment drive in the country have not resolved and may even worsen, given current economic woes and political crackdowns. Tunisia also faces the challenge of foreign fighters returning from Libya and Syria and a large, radicalized prison population. IS-Tunisia thus likely has the human resources it needs to reactivate, particularly if the Tunisian state destabilizes.

Takeaways: The Local Context for Jihad

This analysis describes a set of circumstances from which Salafi-jihadi groups draw potential energy that they can use to react to setbacks or exploit opportunities. US policy largely treats these groups as threats to partner countries only because their demonstrated capabilities do not yet threaten the US homeland. But this view misunderstands the interdependence between the local and global contexts for jihad.

The persistence and spread of regional Salafi-jihadi insurgencies sustains global networks and repeatedly erodes or even reverses the effects of counterterrorism interventions, which focus on removing groups’ military capabilities. Counterterrorism operations aimed at eliminating threat nodes are similarly reactive and will not prevent “locally focused” Salafi-jihadi groups from turning their capabilities and resources toward transnational goals as opportunities arise. The groups that pose the most serious long-term threat are adaptable organizations that embed in local contexts and can capitalize on changing conditions.

Adaptability. The groups that have strengthened over time are adaptive, learning organizations that can shift in response to setbacks and opportunities. One version of adaptability that successful groups practice is shifting between a “territorial” and “semi-territorial” presence. Al Shabaab in Somalia and AQIM in Mali both survived military losses in the early 2010s by shifting from overt territorial control to rural insurgency, a transformation that allowed them to entrench themselves into economic networks and prepare to capitalize on moments of state weakness.

Salafi-jihadi groups have demonstrated a wide range of adaptations, including deploying strategic ambiguity and plausible deniability to avoid attracting a Western counterterrorism response. Highly adaptable groups are more likely to survive and gain the capabilities and resources to become a regional or even global threat — particularly if they demonstrate an ability to balance localized political dynamics while maintaining a relationship with transnational jihadist networks.

Embeddedness. Local dynamics — and militants’ attenuation to them — primarily determine a group’s trajectory. Groups that receive heavy support from a global jihadist outfit, such as IS-Libya or IS-Tunisia, may struggle to recover from setbacks if they lack a robust local support base. Groups that are more rooted in local armed conflicts can benefit from targeted infusions of expertise and money to increase their effectiveness in military operations and strategic communications, as demonstrated by the Islamic State’s support for its West and Central Africa Provinces.

The most dangerous group is therefore one that is primarily oriented on its local governance objective and has demonstrated skill at exploiting the local context but can simultaneously absorb high-end capabilities from the global network. Among current African groups, al Shabaab most emulates this model, given its enduring haven and access to expertise from within the al Qaeda network.

Opportunism. Salafi-jihadi insurgencies form when governance and security gaps are already present. They benefit from and sometimes accelerate these conditions but do not initiate them. Likewise, the greatest opportunities for jihadists to succeed come from collapsing governance and security conditions, not groups’ own huge leaps in capability or ambition. For example, ISWAP has expanded its area of operations outside its core areas in northeastern Nigeria by taking advantage of the destabilization of the northwest and proliferation of non-state armed actors there. This adaptation indicates that ISWAP is building its capability to threaten the Nigerian capital while counterbalancing military pressure in its main havens, in northeastern Nigeria.

Communal violence, civil wars, violent uprisings, and any other major destabilizing incident creates an opportunity for jihadist expansion wherever insurgencies are already established or jihadist networks are latent. Heavy-handed security responses intended to quell or crush unrest also feed the grievances that fuel Salafi-jihadi insurgencies.

Policy Implications and Recommendations

This analysis points to a necessary rethink in US policy to counter the Salafi-jihadi movement. The United States’ counterterrorism policy and the counterterrorism policies of its allies and partners are missing the opening to stop Salafi-jihadi insurgencies from forming and becoming entrenched. At worst, bad counterterrorism policies — particularly when militaries and vigilantes conduct human rights abuses — hasten jihadist entrenchment by allowing groups to install themselves as security providers and defenders of vulnerable populations.

Counterterrorism properly understood refers to both largely kinetic efforts to destroy the parts of groups that plan and execute external terror attacks and homeland security defenses to disrupt active terror plots. Counterterrorism is a necessary part of the national security tool kit for countering extant or emerging threat nodes, but it is not a substitute for removing the group’s base of support. Military campaigns may be disproportionately effective in cases in which the Salafi-jihadi support base is limited, as in the case of IS-Libya and IS-Tunisia’s Libya-based contingent. But when Salafi-jihadi insurgencies are more embedded, military-forward counterterrorism efforts at best temporarily suppress militant activity and at worst cause popular backlash on which militants can capitalize.

The heavily kinetic counterterrorism tool kit cannot defeat Salafi-jihadi insurgencies because it does not fill the governance gaps that allowed for jihadist entrenchment in the first place. And counterterrorism is inherently reactive — responding to a threat after that threat has already formed.

The US should instead focus on policies to prevent Salafi-jihadi groups from taking root. Orienting an interagency focus on this goal requires transforming foreign assistance to emphasize “conflict prevention, stabilization, and peace building.” A key challenge is mobilizing conflict prevention and governance-building resources into the areas most at risk, which are often peripherals prone to conflict and lacking positive or effective ties to the state.

The US has prioritized providing military training and support for anti-Salafi-jihadi forces. More attention must be placed on improving these actors’ ability to outcompete Salafi-jihadi groups through governance — for example, through providing impartial dispute-resolution mechanisms and overseeing implementation of basic social services and aid distribution. Surging governance and aid to areas affected by violence is especially important to preempt Salafi-jihadi groups from taking root or re-forming after losses.

US agencies should make institutional changes, including accepting a higher degree of calculated risk to diplomatic and military personnel pursuing their missions. Proactive policy also requires streamlining and coordinating US assistance across multiple agencies to avoid fatal delays in which much money is spent but no action taken until a jihadist insurgency has already destabilized the at-risk region in question.

Policymakers have an opportunity in motion to pursue these changes, if senior officials are willing to back real change. The 2019 Global Fragility Act (GFA) initiates a framework for an integrated and prevention-focused approach to countering state fragility, with the goal of closing off opportunities to not only Salafi-jihadi groups but also other malign actors, including criminal actors and state adversaries and their proxies. The US government has already selected countries for GFA plans, including Libya, Mozambique, and five coastal West African countries. The primary risk is that these plans will relabel existing initiatives and fail to implement the integration that the GFA seeks.

There are also challenges in implementation. The GFA aims to create new flexible and long-term funding mechanisms, but its implementers warn of impediments to their ability to move money quickly to launch programs before conditions deteriorate beyond prevention. The GFA presents an opportunity to implement US lessons learned from the Afghanistan and Iraq wars; senior officials should not let this opportunity pass.

A policy focused on closing space to adversaries, including the Salafi-jihadi movement, requires a serious focus on increasing US diplomatic capability beyond what the GFA alone can deliver. Countering fragility targets areas not yet or not currently afflicted by an entrenched Salafi-jihadi insurgency, and it is worthwhile, particularly because many countries in Africa are in this at-risk stage. But counter-fragility approaches come too late for the countries that are already fighting long-running wars with al Qaeda and Islamic State affiliates, such as Somalia and Mali.

US policy so far has focused on supporting and training partner militaries, with mixed results because of the weaknesses of the Somali and Malian states. In Somalia, the renewed US deployment has bolstered a Somali offensive against al Shabaab that is the most promising push against the group in years. There has not been a complementary increase in US diplomatic energy, however, which is necessary to support the Somali government through the long-term challenge of outcompeting al Shabaab governance.

The US needs to reframe its involvement in these counterterrorism fights to prioritize conflict resolution and diplomacy, with military engagement subordinated to this larger goal. Likewise, the US should accept risk on short-term military victories — with mitigations in place — for the sake of bringing necessary pressure to bear on regimes that need to reform their approach. Only resolving the conflicts and their underlying grievances will create conditions for the long-term defeat of entrenched Salafi-jihadi insurgencies.

Policymakers also need to recognize the significant overlap of counterterrorism, counter-fragility efforts, and the geostrategic competition problem sets. Fragile environments create opportunities for state and non-state actors alike. The presence of Salafi-jihadis in particular creates cover for malign actors pursuing other goals. For example, the Wagner Group’s deployments in Africa can be seen as a sanctions evasion scheme and regime preservation-for-hire often cloaked in the language of counterterrorism.

The US is seeking stronger partnerships in Africa to counter the expansion of Russian and particularly Chinese influence there. US presence and relationships are crucial to having the partnerships and positions necessary to compete over time, and engaging on countering the Salafi-jihadi movement is both an independent goal and a way to sustain and enhance the US position on the continent. European security also cannot be divorced from African security; humanitarian crises and conflicts in Africa, as well as jihadist and criminal activity, affect European security and political cohesion.

The US government faces an obvious prioritization challenge because it lacks the resources and bandwidth to counter fragility everywhere. Policymakers should therefore improve US analytical capabilities to facilitate prioritization and early recognition. New Salafi-jihadi groups do not form and existing groups do not embark on dangerous trajectories without notice, and their development does not pose a particularly difficult analytical puzzle. Rather, the US intelligence community faces a challenge of collection, processing, and synthesis. Analysts working on Africa and other non-priority areas are spread thin and often responsible for covering many countries and regions simultaneously, a trend that the prioritization of East Asia and the Russian invasion of Ukraine will only exacerbate.

Classified collection assets, including intelligence, surveillance, and reconnaissance (ISR), are limited, and the huge amount of available open-source information goes underutilized due to bandwidth constraints, linguistic limitations, and institutional cultures favoring classified sourcing. Senior leaders should dedicate resources and shift incentives to encourage the intelligence community to maintain an ongoing picture of potential threats in fragile environments. A broader, deeper, and more sustained approach to collection and analysis will help the US government identify threshold-crossing jihadist insurgencies and gain awareness of — and the ability to counter — the actions of geopolitical competitors.

Transforming US policy to deny resources and opportunities to the Salafi-jihadi movement will take time, and Salafi-jihadi groups are already reaching new thresholds of capability in many cases. US officials should therefore identify and pursue mitigations while the larger policy transformation occurs. These mitigations should include investing in the collection and analysis of intelligence on the Salafi-jihadi movement. This is primarily a resource question, particularly as high-demand intelligence assets are shifted to other regions.

Congress should prioritize increasing the US military and intelligence communities’ acquisition of ISR assets to meet this demand. Increased investments in human intelligence and open-source and language capabilities are necessary to avoid strategic surprise. Increased focus on diplomatic engagement in at-risk countries will also improve the intelligence picture. Sustaining this intelligence picture should also feed robust crisis-response planning for future state collapses, including expected periods of increased instability during governmental transition. This planning should include working with partner countries to secure critical infrastructure and materials in the event of instability and a Salafi-jihadi surge.

The stakes are too high for US policymakers to ignore African security, no matter how much they may want to. The Salafi-jihadi movement is a virulent movement that is not declining and will likely enter a new phase marked by increased global terror attacks. It will overlap in fragile areas and strategic terrain with geostrategic competition, particularly in East Africa and increasingly along the West African Atlantic coast. The growth of illiberal movements, including the Salafi-jihadi movement and autocratic and illiberal regimes, threatens the US-led world order that undergirds US power and prosperity. The US must be forward-thinking, not reactive, in Africa and recognize that failing to partner with Africans in a more secure and prosperous future will harm US security in the coming decades. A status quo, wait-and-see approach will fail.

Appendix A. Salafi-Jihadi Group Reference Guide

This appendix defines the groups named in the report, in the order in which they appear in the tables.

Islamic State Algeria Province (IS-Algeria). The Islamic State recognized this wilayah (province) in Algeria in 2014. Security pressure has rendered this group largely defunct since 2017.

Al Qaeda in the Islamic Maghreb (AQIM). AQIM originated in 1998 during the Algerian civil war. It took on its current name when it affiliated with al Qaeda in 2006. The tables in this report use “AQIM” to refer to the North African components of the group, including AQIM activity in Algeria and AQIM-linked groups in Libya and Tunisia, including the Uqba ibn Nafa’a Brigade. AQIM and its affiliates are also active in the Sahel. The tables use “JNIM and allies” to denote AQIM and AQIM-linked organizations in the Sahel.

Islamic State in Tunisia (IS-Tunisia). IS-Tunisia refers to the network of Islamic State members and sympathizers in Tunisia. The Islamic State never declared an official wilayah in Tunisia but produces media about Islamic State–linked activity in Tunisia.

Islamic State Libya Province (IS-Libya). IS-Libya refers to the Islamic State’s Libya Province. The Islamic State declared three Libya provinces — Tarablus (Tripoli), Barqah (Cyrenaica), and Fezzan — in 2014. The Islamic State shifted to referring to thegroup as its Libya Province in 2019.

Islamic State Sinai Province (IS-Sinai). IS-Sinai is a former al Qaeda affiliate active in Egypt’s Sinai Peninsula since 2011. It pledged allegiance to the Islamic State in 2014.

Harakat al Shabaab al Mujahideen (al Shabaab). Al Shabaab is al Qaeda’s primary affiliate in East Africa. It is based in Somalia but also active in Kenya and has attacked in Ethiopia and Uganda. The group formed as an armed wing of the Islamic Courts Union in the mid-2000s. Al Qaeda recognized al Shabaab as an affiliate in 2012.

Islamic State Somalia Province (IS-Somalia). IS-Somalia is an al Shabaab splinter group that pledged allegiance to the Islamic State in 2015. Islamic State leadership accepted this pledge in 2017. IS-Somalia operates primarily in Puntland in northern Somalia.

Islamic State Central Africa Province–Democratic Republic of Congo (ISCAP-DRC). The Islamic State announced its Central Africa Province in 2019, incorporating Salafi-jihadi insurgent groups active in the DRC and Mozambique. These groups operated independently, despite their shared name. The DRC branch of ISCAP developed from the Allied Democratic Forces, an insurgent group that originated in Uganda in the early 1990s and has been based in the DRC since 1995.

Islamic State Mozambique Province (IS-Mozambique). IS-Mozambique is active in northern Mozambique’s Cabo Delgado Province. It officially joined the Islamic State as part of the Central Africa Province in 2019. The Islamic State began referring to IS-Mozambique separately from ISCAP-DRC in May 2022.

Jama’at Nusrat al Islam wa al Muslimeen (JNIM) and Allies. JNIM is AQIM’s affiliate in the Sahel and the successor of AQIM’s networks that became prominent in Mali in 2012. It formed in 2017 from a merger of several AQIM-linked groups: AQIM’s Sahara Emirate, Ansar al Din, al Murabitoun, and the Macina Liberation Front (MLF). “Allies” refers to smaller brigades active within JNIM’s orbit and Ansar al Islam, a Burkina Faso–based group that cooperates with JNIM. JNIM is active in Mali and Burkina Faso.

Islamic State Sahel Province, or Islamic State in the Greater Sahara (ISGS). ISGS is a commonly used name for the Islamic State’s affiliate in the Sahel. The group’s founder, the prior leader of a splinter group that had broken from AQIM, pledged allegiance to the Islamic State in 2015. The Islamic State formally accepted this pledge in 2019, recognizing the group under the umbrella of its Islamic State West Africa Province (ISWAP), though the Sahel branch continued to function independently. The Islamic State recognized ISGS as an independent unit, the Islamic State Sahel Province, in 2022. ISGS operates in Burkina Faso, Mali, and Niger.

Islamic State West Africa Province (ISWAP) and Jama’at Ahl al Sunna lil Da’wa wal Jihad (Boko Haram). Boko Haram formed as a religious movement in northeastern Nigeria and transitioned to an armed uprising in 2009. The group pledged allegiance to the Islamic State in 2015, changing its name to ISWAP. A subsequent schism divided the group. ISWAP largely overtook the rump Boko Haram in 2021. ISWAP and the Boko Haram remnants operate in northern Nigeria, particularly the northeast, and border regions of Cameroon, Chad, and Niger.

Jama’at Ansar al Muslimeen fi Bilad al Sudan (Ansaru). Ansaru is an al Qaeda–aligned group that splintered from Boko Haram in 2012. Ansaru resumed attacks in northwestern Nigeria in 2020 after a multi-year dormancy.

Appendix B. Matrix Definitions

This appendix defines criteria for assessing Salafi-jihadi groups’ capabilities and access to opportunities and resources.

Governance Factors

These factors assess a group’s interaction with its audience, particularly the local population but also potential recruits regionally and globally. These criteria consider a group’s capacity to bend a population to its will by either force or persuasion and the local conditions that create opportunities for armed groups to influence communities. This analysis is a rough proxy for criteria that are difficult to judge, including popular sentiment and other hyperlocal dynamics, which should be studied for a deeper understanding of Salafi-jihadi groups’ effectiveness across local contexts.

Provide Social Services. This factor assesses a group’s ability to deliver services to a target population. Groups are categorized according to the highest level of service they provide, even if they also provide fewer or no services in other parts of their area of operations.

• Red: The group functions as the de facto state through direct rule. It provides services such as health care, education, dispute resolution, and security. It conducts large-scale, organized taxation.

• Orange: The group functions as a de facto state in combination with local authorities. It provides services and enforces some rules.

• Yellow: The group provides intermittent services, such as dispute resolution, justice, and some rule setting. It may have set up internal governance structures serving its members.

• Green: The group provides no services.

Exercise Social Control. This factor assesses a group’s ability to control the behavior of a target population. Groups are categorized according to the highest level of control they exert, even if they exert a lesser level of control or influence in other parts of their area of operations.

• Red: The group is capable of declaring and enforcing modes of living unilaterally in some areas, including public executions and other mandatory events. It rapidly quells dissent.

• Orange: The group has a looser control structure and may exert influence through preexisting local organizations and leadership networks. It can change some modes of living through a combination of force and negotiation. The group may tolerate or negotiate some dissent.

• Yellow: The group engages in intermittent engagements to shape a population’s behavior, including preaching and violence such as kidnapping or assassination. It may extract taxes. Rival governing structures and security forces contest the group’s ability to exercise social control.

• Green: The group is not in regular contact with communities.

Effective Propaganda. This factor assesses a group’s ability to spread its message and cause effects through distributing media.

• Red: The group or its partners distribute high-quality media that reaches global and local audiences. This media may have inspired attacks in locations outside its area of operations or attracted foreign fighters.

• Orange: The group or its partners distribute high-quality media for a local audience, including videos. The group features in jihadist propaganda outside its local area.

• Yellow: The group or its partners distribute low-quality media for a local audience. Global jihadist outlets cover its activities.

• Green: The group distributes no media. Global jihadist outlets may mention it irregularly.

Exploitation of Local Networks. This factor assesses a group’s ability to suppress or exploit local political and security networks toward its objectives.

• Red: The group can suppress and deter rivals. There is no significant rival for providing security or governance inside its control or support zones. The group is integrated into human networks and the local economy. It does not need to collaborate with non–ideologically aligned groups at a large scale.

• Orange: The group is taking steps to integrate with the local community, including intermarriage and alliance formation. It may work to undermine rivals by stoking or participating in communal conflict or aligning itself with particular populations. It may cooperate with other armed groups, including non–ideologically aligned groups.

• Yellow: As a territorial insurgency, the group can deny access to terrain and prey on local populations but does not integrate with local networks and operates in remote areas. Alternately, as a clandestine network,103 the group can maintain covert terror cells and safe houses in populated areas.

• Green: The group has largely hostile encounters with the local population and can only exist in a remote area without state power. The population may perceive it as foreign.

Mobilization of Population. This factor considers the level of grievance that elements of the population hold against either state authorities or other segments of the population. This analysis assumes that a degree of population mobilization and poor governance is a requirement for the survival of a Salafi-jihadi insurgency, particularly one that seeks to hold terrain. This factor approximates popular mobilization by combining three criteria defined in The Underestimated Insurgency: African States at Risk for Salafi-Jihadi Insurgencies.

Use of Conflict. This criterion refers to the prevalence of conflict as a means to resolve political disputes. It considers the national level, including civil war, armed takeovers of government, and the projected risk of mass killing in which the state is the perpetrator or is unable or unwilling to prevent mass conflict.

• Red: Civil war or internal military conflict is ongoing or occurred in the past six months, a military coup occurred in the past six months, or mass killing is assessed as ongoing or at increasing risk of happening.

• Orange: Civil war or internal military conflict or coup occurred in the past year or period of expected civil war averted in the past six months.

• Yellow: Civil war or internal military conflict or coup occurred in the past two years or period of expected civil war averted in the past year.

• Green: Not applicable.

Abusive Security Forces. This criterion approximates harmful security force behavior toward civilians by comparing current reporting on human rights abuses.

• Red: Security forces regularly abuse civilians and prisoners (e.g., summary executions and collective punishment) with overt or tacit government support.

• Orange: There are intermittent security force abuses (e.g., violently dispersing protesters).

• Yellow: There is abusive use of detention but less tendency to use violence against civilians. Security forces fail to respond to protect civilians.

• Green: Security forces generally work professionally and in the population’s interest.

Intergroup Grievances. This criterion approximates the level of hostility between population groups using the “group grievance” indicator from the Fragile States Index 2022.

• Red: 7.5–10.0.

• Orange: 5.0–7.4.

• Yellow: 2.5–4.9.

• Green: 0–2.4.

Military and Technical Factors

These factors analyze an armed group’s ability to build, acquire, and use tools for making war. They consider both conventional and unconventional military effectiveness and terror attack capability ranging from local to transnational.

Bomb Making. Improvised explosive device (IED) development is one indicator of a group’s growing lethality. This factor is important for assessing not only the development of a group’s terror attack capabilities but also its asymmetric military capabilities. Salafi-jihadi militants regularly use explosives to increase the effectiveness of their ground assaults in lieu of conventional weaponry. Drivable suicide vehicle-borne improvised explosive devices (SVBIEDs) require technical skill and relatively long logistical chains to make, and groups use them to augment conventional attacks and conduct targeted bombings.

• Red: The group builds IEDs locally, including drivable SVBIEDs. A known master bomb maker may be present. There may be evidence of research and development for weapons of mass destruction, demonstrated success at technical innovation, and use of SVBIED waves and major explosives as part of a coordinated military offensive or defensive operation.

• Orange: The group builds IEDs locally, possibly including drivable and up-armored SVBIEDs, or there may be evidence of training or studying from a master bomb maker or demonstrated attempts to innovate.

• Yellow: The group employs remote-detonated or other immobile IEDs; uses found explosives, land mines, and suicide vests; or has demonstrated capability at the “red” or “orange” level more than three years ago.

• Green: The group does not use explosive devices.

Access to Weapons Systems. This factor indicates a group’s access to and ability to use weapons systems effectively.

• Red: The group modifies drones to drop explosives or has confirmed or is likely to access man-portable air-defense systems (MANPADs).

• Orange: The group demonstrated access to weapons systems at the “red” level more than three years ago. It may have access to MANPADs.

• Yellow: The group uses commercial drones for surveillance. It has used rockets, mortars, or other heavy fires in the past three years.

• Green: The group uses small arms only.

Sophisticated Tactics. This factor approximates the group’s level of military sophistication as a ground force. Groups may develop more advanced tactics with time — for example, combining skilled-fire teams with vehicle-borne improvised explosive devices (VBIEDs) to breach hard targets. Sophisticated tactics in theater also potentially indicate a latent transnational terror attack capability. The 2015 Islamic State Paris attack is an example of trained fighters from specialized military units adapting their skills for terror attacks.

• Red: The group uses VBIEDs and drones to support large-scale infantry operations. It may have effectively exported tactical teams to another country.

• Orange: The group conducts complex attacks combining explosives and tactical teams to breach hard targets or coordinate attacks with multiple VBIEDs and other increasingly complex attacks, such as secondary bombings targeting first responders and geographically separated attacks on hard targets.

• Yellow: The group conducts simultaneous small-arms attacks.

• Green: The group is not using sophisticated tactics.

Local Force Projection (Within Country). This factor indicates a group’s ability to conduct military operations and terror attacks beyond its immediate area of operations within a country.

• Red: The group can sustain ground offensives in multiple distinct geographic areas, or it credibly threatens population centers of high priority to the state.

• Orange: The group can wage a ground insurgency in one area and conduct intermittent terror attacks or raids in other areas, or it can sustain operations across a large geographic area.

• Yellow: The group can conduct brief simultaneous attacks in geographically separate locations, has demonstrated a recent but now suppressed capability to sustain attacks in multiple locations, or can sustain a terror network while under pressure in its primary area of operations.

• Green: The group is constrained to a local area, and any terror networks it maintains in other areas are largely dormant.

Regional Force Projection (Cross Border). This factor indicates a group’s ability to conduct terror attacks and conventional military operations across international borders.

• Red: The group sustains a consistent insurgency across an international border or has expanded across international borders and established new enduring bases.

• Orange: The group makes cross-border incursions or runs terror networks in neighboring countries from its primary area of operations.

• Yellow: The group uses smuggling routes or support zones in a border region and has not attacked in a neighboring country in the past three years.

• Green: The group’s activities are confined to a single country.

Global Terror Attack Capability. This factor indicates whether a group is capable of transnational terror attacks beyond its immediate country or region.

• Red: The group has conducted or directly facilitated an attack outside its region on an international or transnational target in the past three years, or more than one successful individual attacker has credited the group for inspiration.

• Orange: The group has actively attempted one or more attacks outside its region, including advanced plots interdicted in early stages, or an individual attacker has credited the group for inspiration.

• Yellow: The group or individuals connected to it have attempted poorly designed attacks abroad, or the group conducted or directly facilitated one or more transnational terror attacks more than three years ago.

• Green: The group has not been connected to any attacks abroad.

Elite Units. This factor considers the presence of military units to carry out more specialized and sensitive tasks.

• Red: The group has one or more units focused on external terror attacks either regionally or transnationally.

• Orange: The group has one or more units focused on specialized functions such as counterintelligence, innovation and weapons development, or training, including either training foreign fighters for other conflicts or dispatching trainers to other groups.

• Yellow: The group has a unit with special attack capabilities in either conventional fighting or terror attacks.

• Green: The group has no specialized units.

Resources. This factor considers the group’s ability to access resources to sustain or enhance its efforts.

• Red: The group has a tax base and access to or dominance of economic networks. It likely has excess funds for operational planning or supporting other groups.

• Orange: The group has access to economic networks, or it may receive funds from other Salafi-jihadi groups or financiers.

• Yellow: The group’s economic resources are likely limited but sufficient for survival and baseline recruitment.

• Green: The group is isolated and struggles to access sufficient resources to sustain its membership.

Permissive Environment. This factor considers the group’s access to areas with ineffective security forces and havens outside state control. It also considers recent man-made or natural crises that create a window of vulnerability for all or part of the population. This factor approximates whether an environment is permissive by combining three criteria defined in The Underestimated Insurgency: African States at Risk for Salafi-Jihadi Insurgencies.

Ineffective Security Forces. This criterion uses a measure of a country’s monopoly on the use of force as a proxy for security force capability. These data are from 2020. Where indicated, the author has adjusted the assessment to 2022 to account for overt changes in the use of force in the country.

• Red: Monopoly on use of force ranking in the range of 0–2.5.

• Orange: 2.6–5.0.

• Yellow: 5.1–7.5.

• Green: 7.6–10.0.

Uncontrolled Areas. This criterion considers the degree to which a state controls the territory in its borders. It also considers the relative importance of that territory and the state’s degree of access to it.

• Red: Terrain actively controlled by a force hostile to the government.

• Orange: Populated terrain with limited access for government forces and personnel, with government and insurgent forces contesting control of that terrain.

• Yellow: Sparsely populated terrain outside government control and ongoing intercommunal conflicts that the government cannot or chooses not to intervene in.

• Green: Not applicable.

Vulnerability Window. This criterion refers to a recent change in position or security for all or part of the population, including armed conflict, mass political unrest, natural disasters, and humanitarian crises. This criterion also considers influxes of refugees and migrants as potentially destabilizing incidents.

• Red: Man-made or natural crisis in the past six months.

• Orange: Man-made or natural crisis in the past year or forecast crisis with medium-high confidence.

• Yellow: Man-made or natural crisis in the past two years or forecast crisis with low-medium confidence.

• Green: Not applicable.

Organizational Factors

These factors consider a group’s ability to coordinate people toward its goals, both by managing its internal processes and through its interactions with other organizations. These criteria also consider groups’ contributions to the broader Salafi-jihadi movement.

Force Generation. This factor considers a group’s ability to build and regenerate a fighting force.

• Red: The group has training camps, possibly with foreign recruits, and there is evidence of growing membership.

• Orange: Limited information indicates that the group may have training camps, foreign recruits, or growing membership.

• Yellow: The group’s size is steady, there is no significant indication of membership growing or decreasing, or there is insufficient data to judge group size.

• Green: The group is losing members to arrests, attacks, or defections, or the group suffered significant losses in recent years and does not appear to be recovering.

Resilience or Adaptability. This factor considers whether a group has overcome a major military setback or adapted in response to pressure.

• Red: The group has overcome a setback, such as the loss of terrain or its initial leaders, and returned at a level equal to or above preceding the setback.

• Orange: The group lost capability in its initial area of operations but shifted elsewhere, or it has sustained a territorial insurgency under significant military pressure.

• Yellow: The group has lost military capability but sustains as a terror attack network, or it encountered pressure and significantly reduced its area of operations.

• Green: The group has not yet come under pressure, or it has become dormant for at least a year after coming under pressure.

Network Integration and Amplification. This factor considers whether a group effectively draws on or contributes to larger Salafi-jihadi networks.

• Red: The group sends fighters to other groups and helps start or seed new Salafi-jihadi franchises.

• Orange: The group sends trainers, media expertise, and weapons experts to other groups; receives foreign fighters for training; or plays a coordinating role for other groups.

• Yellow: The group receives training, delegations, media coordination or amplification, and money or weapons from other groups. It may have changed its name or formal affiliation or rhetoric.

• Green: The group may receive superficial media attention from Salafi-jihadi publications but otherwise receives no support from other groups.

Competitors and Infighting. This factor considers the role of intergroup relations. Competition between Salafi-jihadi groups can be destructive and constrain a group’s ability to pursue its governance and military goals, but it can also empower more radical factions and encourage defections between groups.

• Red: The group is collaborating or deconflicting with Salafi-jihadi rivals against shared adversaries.

• Orange: The group has a local Salafi-jihadi rival but is either successfully repressing or absorbing its rival or increasing its overall rate and scale of attacks.

• Yellow: The group is dedicating some energy to quelling infighting but has not split, or it has no local Salafi-jihadi rivals or apparent infighting.

• Green: The group is primarily preoccupied with infighting, including targeting spies and defectors, or it is suppressed by rival Salafi-jihadi groups.

Emily Estelle Perez is a research fellow at the American Enterprise Institute and the research manager of AEI’s Critical Threats Project, which provides open-source intelligence analysis on the Salafi-jihadi movement and Iran. She studies al Qaeda, the Islamic State, and associated Salafi-jihadi groups in Africa, and she specializes in security and related dynamics in East Africa, Libya, and the Sahel.