Equipo Nizkor - UNSC S/2016/629 - 18th report of the Analytical Support and Sanctions Monitoring Team - Islamic State in Iraq and the Levant, Al-Qaida.

United Nations
Security Council

S/2016/629

Distr.: General
19 July 2016
Original: English

Letter dated 19 July 2016 from the Chair of the Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015) concerning Islamic State in Iraq and the Levant (Da'esh), Al-Qaida and associated individuals, groups, undertakings and entities addressed to the President of the Security Council

I have the honour to transmit herewith the eighteenth report of the Analytical Support and Sanctions Monitoring Team established pursuant to resolution 1526 (2004), which was submitted to the Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015) concerning Islamic State in Iraq and the Levant (Da'esh), Al-Qaida and associated individuals, groups, undertakings and entities, in accordance with paragraph (a) of annex I to resolution 2253 (2015).

I should be grateful if the attached report could be brought to the attention of the Council members and issued as a document of the Security Council.

(Signed) Gerard van Bohemen
Chair
Security Council Committee pursuant to resolutions 1267
(1999), 1989 (2011) and 2253 (2015) concerning Islamic
State in Iraq and the Levant (Da'esh), Al-Qaida and
associated individuals, groups, undertakings and entities

Letter dated 30 June 2016 from the Analytical Support and Sanctions Monitoring Team in accordance with paragraph (a) of annex I to resolution 2253 (2015) addressed to the Chair of the Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015) concerning Islamic State in Iraq and the Levant (Da'esh), Al-Qaida and associated individuals, groups, undertakings and entities

I have the honour to refer to paragraph (a) of annex I to resolution 2253 (2015). In this paragraph the Security Council requested the Monitoring Team to submit, in writing, comprehensive, independent reports to the Committee, every six months, the first by 30 June 2016.

I therefore transmit to you the Monitoring Team's eighteenth comprehensive report, pursuant to annex I to resolution 2253 (2015). The Monitoring Team notes that the document of reference is the English original.

(Signed) Hans-Jakob Schindler
Coordinator
Analytical Support and Sanctions Monitoring Team
established pursuant to resolution 1526 (2004)

Eighteenth report of the Analytical Support and Sanctions Monitoring Team submitted pursuant to resolution 2253 (2015) concerning Islamic State in Iraq and the Levant (Da'esh), Al-Qaida and associated individuals and entities

Summary
The threat emanating from Al-Qaida (QDe.004), Islamic State in Iraq and the Levant (ISIL) |a| and their associated individuals and entities is serious and diversifying. During the reporting period, ISIL experienced military setbacks in Afghanistan and Libya. ISIL in Iraq and the Syrian Arab Republic is under particularly sustained military pressure and continues to lose territory in both countries, resulting in increasing numbers of foreign terrorist fighters leaving the conflict zone and presenting challenges to the capacities of Member States. ISIL demonstrated its ability to conduct complex, multi-stage attacks outside the conflict zone, while at the same time the role of ISIL affiliates in the wider region was elevated. Al-Qaida and its associates were able to maintain their positions in various regions and also demonstrated an ability to successfully plan and execute significant attacks.
Sanctions remain a key tool in effectively countering the threat of terrorism from ISIL and Al-Qaida, but the sanctions regime needs to continue to evolve so as to adapt to new challenges. Recently, ISIL has introduced a range of innovations, including new recruitment and propaganda strategies; the skilful misuse of information and communications technology (ICT); broken travel |b| and the use of false, altered and fraudulently obtained travel documents; |c| diversified financing streams; and advanced tactics in international terror attacks. Therefore, while the threat from Al-Qaida continues, ISIL presents a significant set of new challenges to the existing sanctions architecture. The Analytical Support and Sanctions Monitoring Team has worked with the financial, energy, antiquities trading and ICT industries in order to develop recommendations proposing potential ways in which the current sanctions architecture could evolve to more effectively meet these new challenges.
ª Listed as Al-Qaida in Iraq (QDe.115).
^b Travel using several modes of transport and indirect routes to the final destination (see S/2015/358, para. 33).
^c ISIL obtained up to 250,000 Syrian passports (see S/2016/501, para. 22).

Contents

I. Overview of the threat

A. Strategic competition and tactical cooperation

B. Increasing numbers of returnees

C. Modus operandi of external attacks

D. Misuse of information and communications technology by terrorists

II. Regional trends

A. Levant
B. South and Central Asia
C. Arabian Peninsula
D. North and West Africa
E. East Africa
F. Europe
G. South-East Asia

III. Impact assessment

IV. Recommendations

A. Asset freeze
B. Travel ban
C. Arms embargo
D. Foreign terrorist fighters
E. Information and communications technology

V. Monitoring Team activities and feedback

Annex
Litigation by or relating to individuals on the Committee's sanctions list

I. Overview of the threat

A. Strategic competition and tactical cooperation

1. Since the seventeenth report of the Analytical Support and Sanctions Monitoring Team (S/2015/441) was submitted in March 2015, Al-Qaida and Islamic State in Iraq and the Levant (ISIL) and their associated entities have continued their competition at the strategic level. Both groups espouse competing strategic visions. Al-Qaida and its followers prioritize global attacks on the "far enemy", while aligning themselves with the so-called "emirate" of the Taliban. This alignment was demonstrated when, on 31 May 2016, Al-Qaida in the Arabian Peninsula (QDe.129), Al-Qaida in the Islamic Maghreb (QDe.014) and the Al-Nusrah Front for the People of the Levant (ANF) (QDe.137) published a joint eulogy on their websites for the former leader of the Taliban, Akhtar Mohammad Mansour Shah Mohammed (TAi.011) (Mullah Mansour). This was followed by a eulogy on its website by Al-Qaida in the Indian Subcontinent on 16 June. Aiman Muhammed Rabi al-Zawahiri (QDi.006) declared his loyalty to the new leader of the Taliban, Haibatullah Akhundzada (not listed), on 27 May in an audio statement.

2. Al-Qaida followed the same pattern in 2015 when the death of Mullah Mohammed Omar (TAi.004) and the appointment of Mullah Mansour as the new Taliban leader were announced. In both cases, neither the leadership of ISIL nor its associates commented on the death of the head of the Taliban. Al-Qaida and its associated groups continue to see the leader of the so-called "emirate" of the Taliban as the true "leader of the faithful". This alignment stands in competition with the so-called ISIL "caliphate" and its "caliph", Abu Bakr al-Baghdadi. |1|

3. Member States explained that that strategic competition did not always translate to the tactical level. Despite the competing visions of "emirate" and "caliphate" and at times violent clashes within conflict zones concerning resources and territory, |2| ISIL operatives used personal relationships with Al -Qaida individuals to support their preparation for attacks in Paris in November 2015 and Brussels in March 2016. Similarly, as a result of personal connections, ISIL individuals supported Al-Qaida operatives in the planning of a potential attack in Kenya in 2015. In Yemen, AQAP and ISIL fighters support one another at the operational level. |3| This highlights that terrorist networks may be formed by a common ideology but are sustained by personal relationships. Therefore, individuals who leave their current conflict zone to perpetrate attacks either in their home countries or in another conflict zone are a particular concern because they may be able to use the support networks of a range of groups.

B. Increasing numbers of returnees

4. Member States highlighted that the numbers of foreign terrorist fighters returning to their countries of origin, potentially intending to perpetrate attacks, in combination with those being radicalized within those countries, presented a growing challenge to national security. The challenge is exacerbated by the increase in communications on the "dark web" or through encrypted messaging applications. This situation has significantly increased the number of individuals whom the police and security services need to investigate, and the difficulty of investigating them, placing a significant strain on the capacities of Member States. The rise in the use of encryption has closed off the ability of even the most sophisticated agencies to penetrate huge quantities of messages, resulting in Member States potentially losing much of their previous technological advantage over terror groups.

C. Modus operandi of external attacks

5. The modus operandi that ISIL operatives demonstrated while conducting multiple, nearly simultaneous attacks, such as in Paris and Brussels, |4| presents particular problems in terms of the security response. First, the flow of information into command and control centres can be overwhelming. Member States explained that that was a deliberate tactic in order to make it more difficult to mount coordinated and targeted responses to the most dangerous continuing threats. The attacks in Paris in November 2015 were described by Member States as "optimized Mumbai-style attacks" demonstrating that the terrorists had studied previous "active shooter scenarios", such as the attacks in Mumbai, India, and at the Westgate shopping mall in Nairobi, and learned lessons about how to maximize confusion and casualties. |5| Second, according to various Member States, given that during attacks such as that on the Bataclan theatre in Paris the perpetrators' apparent aim was to cause fatalities as swiftly as possible, it is essential for security forces to take action quickly. Such a scenario is not, however, part of the standard response of some law enforcement agencies to hostage situations. Traditionally, security forces seek to buy time to negotiate with perpetrators to secure the release of hostages. Consequently, Member States pointed out that those in command and those providing policy approval should be briefed in advance on the limited options available to ensure that response teams are able to engage the terrorists quickly to halt the killing as soon as possible.

D. Misuse of information and communications technology by terrorists

6. The significant setbacks on the battlefield notwithstanding, ISIL continues to assert itself in cyberspace (see S/2016/501, paras. 37-40). For most foreign terrorist fighters joining ISIL, the Internet has always been part of their social experience. Although direct personal contact remains a core ingredient for radicalization and recruitment processes (see S/2014/815, paras. 29-31), the Internet and social media play a crucial role. Owing to global connectivity, there is no distance online between fighters and potential recruits worldwide. Recruiters engage individuals in their home countries employing individualized strategies, swiftly moving them on to closed forums and guiding them towards encrypted messaging systems. Furthermore, the use of social media strengthens relationships between foreign terrorist fighters, a situation that may lay foundations for future transnational networks among veteran fighters (see S/2015/358, para. 53). The Team continues to receive reports concerning the misuse of crowd funding, in addition to online sharing of instructional materials, such as those linked to the planning and execution of attacks or the construction of improvised explosive devices (see S/2014/770, para. 19).

II. Regional trends

A. Levant

7. Since the publication of the Team's previous comprehensive report, ISIL has experienced military setbacks in Iraq and the Syrian Arab Republic. In both countries, it has been unable to maintain its offensive momentum of 2014. Furthermore, a Member State reported that the continuing military pressure had forced the ISIL core to change its command and control structures in those countries, transferring decision-making powers downwards and reducing centralized management. However, while its "centre of gravity" in Iraq and the Syrian Arab Republic is under pressure, ISIL affiliates have taken on an elevated role (see S/2016/501, para. 5).

8. The group continues to use weapons and ammunition seized from the Iraqi security forces. In addition, ISIL also captured materiel during its operations in the Syrian Arab Republic in 2015. Member States assessed that, as a result of those stocks, ISIL appeared less dependent on external supplies of weapons than other terrorist groups. Nonetheless, Member States reported that the group continued to be able to obtain new supplies of weapons and ammunition. Air strikes have caused ISIL to lose a large part of the heavy weapons that it seized in Iraq and the Syrian Arab Republic in 2014.

9. Improvised explosive devices continue to be the weapon of choice for ISIL and ANF. A Member State reported that more than 19,000 such devices had been disabled by Russian forces after the recapture of Tadmur (Palmyra), Syrian Arab Republic. The Iraqi security forces also encountered many improvised explosive devices during operations in Ramadi. Those devices mainly comprised commercial components, in particular detonators and fertilizer. Member States highlighted that, during the reporting period, those components, in particular fertilizer, continued to enter Syrian territory illicitly through Turkey. In response, Turkey officially banned the transfer of ammonium nitrate-based fertilizers, potassium nitrate, detonators and detonation cord to the Syrian Arab Republic in March 2016. |6|

10. The use of chlorine in attacks by ISIL was reported to the Team by several Member States. In addition, Member States and international organizations reported that, in at least one incident, poor-quality mustard gas had been used in an area under ISIL control. Member States also reported, however, that there was currently no reliable information that pointed to ISIL having the capacity to manufacture such components, the demonstrated intent of the group to use unconventional means if available notwithstanding.

11. Currently, Member States estimate that ISIL commands up to 30,000 fighters in the Levant (see S/2016/501, para. 18). Member States explained that the rate of individuals leaving ISIL had increased and that significant numbers of ISIL fighters had been killed as a result of military pressure. This trend is partially offset by a continuing flow of foreign terrorist fighters into Iraq and the Syrian Arab Republic and by forced recruitment among tribes by ISIL and the use of child soldiers since 2014. According to one Member State, this is generating further resentment towards ISIL among the local population.

12. The leaders of Al-Qaida also consider the Levant to be of strategic importance for the group's future. Currently, ANF remains one of the most effective branches of Al-Qaida worldwide. It operates within what the Al-Qaida core perceives as the central arena for current terrorist operations and has demonstrated an ability to maintain a significant role in the Syrian Arab Republic, the capacity of ISIL to attract greater numbers of fighters and facilitators notwithstanding. The Syrian arena provides many vital relationships for ANF and therefore also for Al-Qaida. ANF continues to attract fighters and, according to Member States, external support. Lastly, the group of fighters coming to the Syrian Arab Republic from the Afghanistan-Pakistan border area comprising senior Al-Qaida members represents the external arm of ANF and is capable of launching external operations.

13. The financial situation of ISIL has deteriorated since the first impact assessment of the Team, in July 2015 (S/2015/739). The production of oil by ISIL has declined by between 30 and 50 per cent since 2015 as a result of air strikes targeting oil-related infrastructure and, consequently, oil revenue has fallen by tens of millions of dollars per month. |7| Action by the Government of Iraq to reduce liquidity entering ISIL-controlled territory has also squeezed the group's finances (see S/2016/501, para. 9 and footnote 3). The group's financial woes have led to salary cuts for its fighters, thus mitigating one of the pull factors for foreign terrorist fighters joining ISIL. |8| Furthermore, owing to the fall in oil production, ISIL requires more oil for its own operations and the civilian population living in the territory under its control than it is able to produce, thus forcing it to allocate its diminishing resources to its war machine rather than civilians and reducing its ability to govern. |9|

14. However, ISIL continues to earn significant revenue from "taxation"/extortion and has even intensified its efforts relating to that revenue source to compensate for the loss of revenue from oil. According to Member States, ISIL may earn as much as $30 million per month from "taxation"/extortion, which includes forced "zakat", business "taxes", fees for electricity and water, "rent" for seized real estate, and customs duties and passage fees. ISIL has increased the rate and type of "taxes", while at the same time providing fewer services. In a sign of desperation, in February 2016, ISIL began to "tax" the most impoverished civilians, who had previously been exempt. |10|

15. The Team has also received reports of corruption within ISIL. For example, Member States indicated that ISIL leaders had stolen money and gold. According to one Member State, the group detained four of its senior officials in Mosul, Iraq, in connection with the disappearance of some $4 million.

16. Member States informed the Team of seizures of antiquities originating from Iraq or the Syrian Arab Republic. The total amount per year that ISIL is able to generate from these activities remains difficult to estimate. |11| While the loss of territory by ISIL in Iraq and the Syrian Arab Republic has reduced opportunities for the group to loot antiquities (see S/2016/501, para. 11), the Team continues to receive reports from Member States and international organizations concerning ongoing looting within ISIL-controlled territory, such as at several sites in Ninawa governorate, Iraq.

17. The financing model of ANF has not changed, and the group continues to rely on external donations. This is demonstrated by recent United Nations and national listings of ANF financial supporters. |12|

B. South and Central Asia

18. In recent months, as a result of pressure from Afghan and international forces, in addition to the Taliban, the number of ISIL supporters in Afghanistan fell to fewer than 3,500, including some 1,500 fighters. |13| Nevertheless, Member State reports demonstrate that ISIL supporters remain present in more than 20 provinces. Member States reported that former Tehrik-e Taliban Pakistan (TTP) (QDe.132) splinter groups that had joined ISIL were located in Khost, Kunar, Nangarhar and Paktya provinces, where they were able to carry out cross-border attacks on targets in Pakistani territory. In Nangarhar, ISIL controls areas in five districts while receiving support from the terrorist groups Lashkar-e-Islam, Jamaat-ul-Ahrar and the Tariq Gidar Group. |14|

19. According to Member States, the current structure of ISIL in Afghanistan consists of TTP splinter groups from the Bajaur, Khyber, Kurram and Orakzai agencies, former members of the Afghan Taliban, some former members of the Haqqani Network (TAe.012), the Islamic Movement of Uzbekistan (QDe.010) and Jamaat Ansarullah (not listed). ISIL also maintains a media unit, Abtalul Islam. ISIL Khorasan is led by a former TTP commander, Hafiz Saeed Khan (not listed), as announced by the ISIL spokesperson, Abou Mohamed al Adnani (QDi.325), on the ISIL media channel on 26 January 2015. A strong proponent of ISIL expansion to Afghanistan is the commander of the Central Asian contingent of ISIL, Gulmurod Khalimov (QDi.372), a former military officer from Tajikistan who is based in the Syrian Arab Republic. Member States reported that the activities of ISIL in Afghanistan should be seen in the context of Central Asian foreign terrorist fighter contingents seeking to create a base in Afghanistan to exploit possible future opportunities in Central Asia.

20. According to a Member State, money to fund ISIL Khorasan has been channelled to Afghanistan from the ISIL core using cash couriers, alternative remittance systems and bank transfers. To date, ISIL in Afghanistan appears to have taken a counter-narcotics stance and manages to have sufficient financial assets to finance its operations in the country without needing to rely on revenue from opiates.

21. The constant military pressure notwithstanding, Al-Qaida maintains its position in Afghanistan. According to Member States, supporters of Al-Qaida in Afghanistan joined Al-Qaida in the Indian Subcontinent, headed by Maulana Asim Umar (not listed). Osama Mehmood (not listed) is the group's spokesperson; Umar Khattab (not listed) is responsible for the region in the east of Waziristan in Pakistan; and Umair Afzal Rana (not listed) is the head of media and propaganda. The group consists mainly of militants from Pakistan, India, Bangladesh and Maldives. Member States assess that the number of Al-Qaida operatives in Afghanistan with ties to Al-Qaida in the Indian Subcontinent could be as high as 300.

22. Member States reported that many Al-Qaida members had been killed during a Pakistani operation, Zarb-e-Azb, while others had been arrested or had left the border areas for Afghanistan. Member States expressed concern over continuing close ties between Al-Qaida and the Taliban, as exemplified by the ascent of the Taliban's new deputy emir, Sirajuddin Jallaloudine Haqqani (TAi.144). Operation Zarb-e-Azb continues to deny sanctuary to the Al-Qaida core in the Afghanistan-Pakistan border area, while al-Zawahiri and his close aides struggle to maintain the leadership structure. The presence of ISIL in Afghanistan and its ambition of establishing a "wilayat Khorasan" in South and Central Asia pose a challenge to Al-Qaida in relation to its global leadership ambitions and local support.

23. In recent years, competition between ISIL and Al-Qaida in the Indian Subcontinent through their proxies in Bangladesh has escalated. ISIL intended to incorporate Bangladesh into its so-called "caliphate". In the fourteenth issue of the ISIL English-language magazine, Dabiq, the emir of the so-called "Khilafah's soldiers in Bengal", Abu Ibrahim al-Hanif (not listed), announced the establishment of a command structure in Bangladesh and highlighted its "strategic geographic position". ISIL and Al-Qaida in the Indian Subcontinent have claimed several attacks targeting foreigners, religious minorities, police officers, secular bloggers and publishers.

C. Arabian Peninsula

24. The instability caused by the continuing conflict in Yemen has allowed AQAP to take control of territory in the country and gain access to new funds. AQAP maintains a strong presence in Yemen, where it exploits demographic and tribal structures, the weakness of the Government and security services, access to arms and explosives and the presence of explosives experts. It has been able to mount regular attacks against the Yemeni military. In April 2015, it took control of the capital of Hadramawt governorate, Mukalla, demonstrating that a core aim in Yemen is to hold territory and gain access to funds and supplies. In Mukalla, AQAP was able to steal 13 billion rials and $1.5 million from the branch of the central bank and 20 million rials from an agricultural bank. |15| The group's year-long control of Mukalla and its coastline allowed it to earn revenue from "taxes" on shippers and traders, which, according to Member States, amounted to $2 million per day. AQAP also continues to receive external donations |16| and has been known to raise significant funds through kidnapping for ransom (see S/2014/41, para. 35).

25. AQAP claims that it is supportive of the local population in order to build popular support. The group, when ousted from Mukalla by Yemeni government forces in April 2016, portrayed the development as a tactical withdrawal intended to spare civilians from conflict. |17| However, it withdrew with its resources and personnel, retreating to Shabwah and Bayda', displacing but not diminishing the threat. AQAP maintains the intent to target the West and continues to encourage lone-wolf attacks through its Inspire magazine, but is currently focused on consolidating its influence and ability to carry out attacks in Yemen. |18|

26. In 2014, an ISIL-affiliated group in Yemen was established with leadership, direction and financing from the ISIL core. Member States in the region report that ISIL in Yemen attracts a range of foreign terrorist fighters, including from Iraq, Saudi Arabia, the Syrian Arab Republic and Tunisia, although its numbers remain small in comparison with AQAP, with one Member State reporting that the group has only between 250 and 400 members. ISIL in Yemen has been successful in mounting attacks, especially in the Aden area, but is seen as comprising "foreigners" and enjoys little popular support.

27. Member States reported that the emergence of ISIL in Yemen might put AQAP under pressure to conduct deadlier attacks. The fierce propaganda competition notwithstanding, there are no reports of clashes between ISIL and AQAP in Yemen. Member State reporting suggests that AQAP and ISIL fighters are prepared to cooperate at the tactical level. According to Member States, the ISIL core sees Yemen as an attractive area for expansion, with the idea of capitalizing on the sectarian conflict and weak governance. Early in January 2016, internal dissent appeared in ISIL in Yemen over its leadership, but this was swiftly addressed by the ISIL core, preventing a strategic weakening of the group in the country.

28. Concern was expressed by a number of Member States about the continuing existence of ISIL cells on the wider Arabian Peninsula. In Saudi Arabia, ISIL continues to target security forces and their facilities and Shia mosques. For example, it claimed responsibility for the bombing of a Shia mosque in Qatif in May 2015 |19| and for a suicide bombing at a mosque of the special emergency forces in south-western Saudi Arabia in August 2015. |20| In June 2015, ISIL claimed responsibility for the bombing of a Kuwaiti mosque, |21| while the Saudi Arabian security forces disrupted an ISIL cell of five fighters in the city of Mecca in May 2016. |22|

D. North and West Africa

29. The past 12 months have seen ISIL in Libya intensify its terror campaign by combining suicide attacks, executions and conventional fighting. ISIL in Libya has also continued its attempts to sabotage or destroy oil facilities to deny oil income to its adversaries, as shown by two unsuccessful attacks in January 2016 against the Sidrah oil port and the oil terminal in the port of Ra's Lanuf. According to Member State reporting, however, the recent anti-ISIL offensive has the potential to force the group to abandon its strongholds. This could lead its members, including foreign terrorist fighters, to redeploy and regroup in smaller and geographically dispersed cells throughout Libya and in neighbouring countries.

30. A Member State outlined that Tunisian foreign terrorist fighters in particular could move back to Tunisia in higher numbers, exacerbating an already significant threat given that dozens of such fighters had already returned to the country with the intent to conduct attacks. |23| Attacks perpetrated in Tunisia in 2015 and 2016 have either involved Tunisian returnees from Libya or been coordinated by Tunisian foreign terrorist fighters from Libyan territory, with financial and logistical support provided from Tunisians in Libyan territory. The border region between the two countries continues to see clashes between Tunisian ISIL cells and security forces. In March 2016, simultaneous attacks targeted army barracks as well as police and national guard posts in Ben Guerdane. |24|

31. ISIL in Libya funds itself primarily through "taxation" and extortion and appears to be largely self-sufficient (see S/2016/501, para. 30 and S/2015/891, para. 54). According to one Member State, it has set up checkpoints in Sirte allowing it to gain access to significant funds and has close links with criminal groups and smugglers.

32. While ISIL in Libya has been attacking oil facilities, to date it has not been able to directly profit from Libyan crude oil resources, and it would be difficult for it to do so on any significant level given the structure of the oil industry in the country (see S/2016/501, para. 30 and S/2015/891, paras. 72-73). The ISIL outpost in Libya serves as a financing hub for the wider region, and funds have been channelled to Libya from the ISIL core for that purpose. |25| According to Member States, hundreds of thousands of dollars have been transferred from Libya to Ansar Bayt al-Maqdis in the Sinai. According to a recent national designation, as at early 2015, Ansar Bayt al-Maqdis had a representative in Libya involved in transferring the funds. |26| Similarly, a Member State indicated that ISIL in Libya had channelled funds to Somalia for the start-up costs of a new ISIL affiliate there.

33. Member States reported that Ansar Bayt al-Maqdis received support from ISIL in Libya. The group claimed responsibility for bringing down a Russian passenger plane in the Sinai using an improvised explosive device on 31 October 2015. |27| It has also benefited from a significant media campaign by ISIL, comprising 14 professionally made propaganda videos. |28| Released over three days (from 5 to 7 May 2016), the videos promote a "wilayat Sinai" and appeal to new recruits.

34. In contrast to the challenges faced by ISIL in Libya, Al-Qaida maintains a stronger presence in the Sahel. AQIM has gained momentum since December 2015, following its merger with Al Mourabitoun (QDe.141). This followed tactical cooperation, as both groups coordinated to perpetrate the attack against the Radisson Blu hotel in Bamako, Mali, in November 2015. It remains to be seen whether this will be a long-standing alliance. According to a Member State, the merger has already resulted in combined operational capacities, the intensification of attacks in Mali, in particular against international targets, and an expansion of activities into the Sahel and West Africa.

35. Economic interests in the region also remain targets. |29| In January 2016, Al Mourabitoun perpetrated simultaneous attacks against a hotel, a coffee shop and a restaurant in Ouagadougou, Burkina Faso, and in March 2016 attacked three hotels in Grand Bassam, Cote d'Ivoire.

36. In January 2016, AQIM incited fighters to deploy to Libya |30| and, in June, called for attacks during Ramadan, signalling a change in posture, given that AQIM has in the past generally considered Libya to be a sanctuary. AQIM continues to resort to kidnapping as a means to secure prisoner exchanges or to finance its operations.

37. Ansar Eddine (QDe.135) and Al Mourabitoun continued their attacks in Mali, mainly targeting international forces with combined and complex attacks. A Member State reported that the Sahelian groups had increased their outreach using ICT. |31| For example, on 29 February 2016, Ansar Eddine reportedly created a website, Rimaah, as its official platform.

38. Under pressure from the Nigerian and other armed forces, Boko Haram (QDe.138) has had difficulties maintaining territory. The Nigerian authorities announced in September 2015 that the group's actions had been largely limited to the Sambisa forest in north-east Nigeria. |32| In June 2016, however, the group seized the town of Bosso in the Niger. Furthermore, it continues to attack civilian targets in Cameroon, Chad and Nigeria. |33| According to a Member State, since its pledge of allegiance to al-Baghdadi in March 2015, Boko Haram has intensified its operations and expanded its media communication capabilities, but does not appear to have received operational support or financing from the ISIL core. It appears that the group's revenue continues to be mainly criminal in nature and locally generated, such as through extortion, robbery, theft (including cattle rustling) and kidnapping for ransom. |34|

E. East Africa

39. Al-Shabaab (SOe.001) maintained its allegiance to Al-Qaida, with the group adopting aggressive tactics against the African Union Mission in Somalia (AMISOM). Member States highlighted that, after establishing new safe havens, Al-Shabaab had escalated its campaign of suicide bombings in Mogadishu targeting government infrastructure and civilian targets.

40. As ISIL seeks to make inroads into the region, Al-Shabaab has warned its members against defection and detained and killed perceived ISIL sympathizers within its own ranks. |35| In October 2015, a senior Al-Shabaab member, Abdulqader Mu'min (not listed), declared his allegiance to the ISIL leader, al-Baghdadi, in an effort to obtain material support. |36| That decision subsequently led to clashes between ISIL and Al-Shabaab.

41. Whereas ISIL advocates global expansion, leaders of Al-Shabaab concentrate on a national and regional agenda. Al-Shabaab continues to reiterate its intent to conduct more attacks against the AMISOM troop-contributing countries (as seen in the attack in January 2016 against Burundian and Kenyan troops and the attack in June 2016 against Ethiopian troops), Canada, the United Kingdom of Great Britain and Northern Ireland and the United States of America, in addition to the interests of other Member States in the region. For example, it claimed responsibility for an attack on a Daallo Airlines flight after its intended target, Turkish Airlines, cancelled its flight to Mogadishu on the planned day. |37|

42. According to Member States, Al-Shabaab possesses a sizeable arsenal of weapons and ammunition, some of which have been captured from AMISOM troops during recent attacks. This has boosted the group's strength considerably. Member States reported that the forced collection of "zakat" from local Somalis, trafficking in commodities such as charcoal, extortion from businesses and international organizations, and looting of storehouses with relief goods remained major sources of the group's financing.

43. Foreign terrorist fighters continue to flow into the region, mainly into Somalia, and out of the region towards Iraq, Libya and the Syrian Arab Republic. There is an influx of fighters within the ranks of ISIL and returnees who may be tasked to conduct terrorist operations. According to Member State reporting, some 50 Al-Shabaab defectors travelled to Yemen in February 2016, while 17 joined ISIL in Sirte, Libya. In addition, in-fighting within Al-Shabaab has led to the deaths or expulsion of non-Somali fighters from the region. |38|

F. Europe

44. The flow of foreign terrorist fighters from Europe to conflict areas in the Syrian Arab Republic and, to a lesser extent, in Iraq, continues, although the numbers have reduced steadily since 2014 and 2015. According to Member States, this slowdown is, in part, because the pool of willing recruits has diminished and a result of the military and territorial losses sustained by ISIL. It is also due to measures taken by Member States to detect and deter travellers through interventions and enhanced controls at international hubs and border crossings.

45. European Member States have reported that a significant number of foreign terrorist fighters who travelled to conflict zones have now returned. The percentages generally range between 10 and 30 per cent. |39| Some returnees left the conflict zone after becoming disillusioned with ISIL and the conflict; Member States assess them to be at the lower end of the risk spectrum. Some individuals, however, have returned with the specific intent and capability to conduct terrorist attacks, as demonstrated by the attacks in Paris and Brussels. Such fighters have been using broken travel or false, stolen, altered or fraudulently obtained travel documents or have been hiding among migrant flows in order to avoid detection. Member States highlighted that many returnees had previously been involved in crime and therefore had links to criminal organizations that could enable access to weapons and travel documents in preparation of a potential attack (see also S/2016/501, para. 22).

46. Many returnees are arrested upon arrival. One Member State reported that investigations were being carried out into several hundred returnees, with more than 100 prosecutions under way. Another Member State noted that, while it had a policy of arresting returnees, where there was insufficient evidence for prosecution, they continued to be monitored and were returned to their families and communities, who often provided valuable support in the reintegration process. However, hundreds of returnees, and other individuals who have been radicalized in their home countries, continue to present security concerns in, and strain the capacities of, European countries.

47. Member States reported that Emarat Kavkaz (QDe.131) had virtually ceased to operate since 2013 following the decision of the majority of its supporters to leave for the Syrian Arab Republic and the reported death of its leader, Doku Khamatovich Umarov (QDi.290), in 2014. Since early 2014, the federal authorities of the Russian Federation have taken strict measures to prevent the flow of individuals to conflict zones. Consequently, the rate of individuals travelling to conflict zones in Iraq and the Syrian Arab Republic has reportedly dropped considerably.

48. The newly formed ISIL "wilayat Kavkaz" has been unable to gain traction and exists mainly as an ISIL regional propaganda operation. Some attacks planned by returnees were prevented by the Russian security forces. According to a Member State, a cell of returnees was arrested in Yekaterinburg in February 2016, consisting of Tajik returnees, headed and financed by an Uzbek operating out of Turkey. During the arrest, the Russian security forces recovered a cache of explosives, detonators for the manufacture of improvised explosive devices and weapons and ammunition.

G. South-East Asia

49. The threat of terrorist attacks in South-East Asia has increased since the Team's previous comprehensive report and is higher than at any time in the past few years. |40| According to a Member State, the attack in Jakarta in January 2016 |41| was inspired by a South-East Asian unit within ISIL in the Syrian Arab Republic, and three Indonesian leaders within ISIL in the Syrian Arab Republic are competing to launch attacks in South-East Asia. |42| Countries in the region have also disrupted attacks and arrested numerous individuals.

50. The rise of ISIL and its establishment of a so-called "caliphate" have had both a polarizing and a re-energizing effect on the listed groups operating in South-East Asia. The leaders of several long-standing, and some newer, South-East Asian groups have pledged allegiance to al-Baghdadi, while other groups, most significantly the resurgent Jemaah Islamiyah (QDe.092), have been linked to ANF. |43| Santoso (not listed), the leader of the ISIL-linked Mujahidin Indonesian Timur (QDe.150), remains at large, |44| while an imprisoned extremist cleric, Aman Abdurrahman (not listed), remains a central figure in the ISIL network in Indonesia. |45| Recent listings by the Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015) concerning ISIL (Da'esh), Al-Qaida and associated individuals, groups, undertakings and entities further signify the links between ISIL in Iraq and the Syrian Arab Republic and terrorist groups operating in South-East Asia. |46|

51. There are fears that the southern Philippines will once again become a safe haven attracting terrorists from the wider region. |47| The Abu Sayyaf Group (QDe.001), factions of which (including one led by Isnilon Totoni Hapilon (QDi.204)) have pledged allegiance to al-Baghdadi (see S/2015/441, para. 33), has continued to battle government forces. |48| Furthermore, it appears to have stepped up its notorious kidnapping for ransom activities and horrifically executed hostages after making ransom demands.

52. Although the numbers of foreign terrorist fighters from South -East Asia in Iraq and the Syrian Arab Republic are relatively small compared with other regions, they nonetheless number at least in the hundreds (see S/2016/501, para. 21). One Member State reported increased attempted travel to the Syrian Arab Republic by Indonesian would -be foreign terrorist fighters in 2015. The presence of combat units within ISIL made up of Indonesian and Malaysian fighters, such as Katibah Nusantara (also known as the "Archipelago Group"), underscores the threat to the region and the risk that some of these fighters could return with newly acquired skills, networks and ambitions to launch attacks. |49| As the Team indicated in 2015 (see S/2015/441, para. 32), of particular concern is that foreign terrorist fighters returning from the conflict zone will constitute the next generation of terrorists in South-East Asia, as was the case with militants from South-East Asia involved in Afghanistan in the 1980s and 1990s. |50|

53. According to one Member State, there are signs that South-East Asian fighters in Iraq and the Syrian Arab Republic have intensified their focus on supporting attacks back home, and there are direct links between ISIL operatives in Iraq and the Syrian Arab Republic and South-East Asian terrorist groups. Furthermore, according to another Member State, ISIL in Iraq and the Syrian Arab Republic has already directed foiled terrorist plots in South-East Asia, and there are also indications that money from ISIL may be flowing into the region to fund attacks. |51| ISIL reporting on "operations" in South-East Asia |52| signals that it considers the region significant to its global ambitions.

III. Impact assessment

54. ISIL finances have suffered in large part owing to international efforts. The Government of Iraq has taken action by publishing a list of more than 100 ISIL-related money exchanges and transfer companies in Iraq, excluding them from Central Bank currency auctions (see S/2016/213, footnote 6), thereby denying ISIL liquidity and making it more difficult for the group to move funds. Multilateral bodies such as the Counter-ISIL Finance Group |53| and the quadrilateral financial expert group |54| have also continued their efforts to disrupt ISIL financing. Some neighbouring States have increased their control over their financial sectors in order to stem ISIL access.

55. Nonetheless, ISIL has provided start-up capital to some of its affiliates and been able to move funds using cash couriers, alternative remittance systems and banking channels, demonstrating that continued vigilance is necessary. This is especially important as the ISIL threat has become more decentralized, thereby giving the group more opportunities to fund affiliates, cells and attacks around the world.

56. ISIL received a few million dollars in foreign donations in both 2014 and 2015. |55| Although external donations have made up a small percentage of the group's overall income, ISIL may become more reliant on donations and seek additional donors as income from other sources declines. ANF, which has been more dependent on external donations than ISIL, continues to receive substantial donations. |56| That both groups continue to receive donations demonstrates that further international effort is required in this area.

57. ISIL income from kidnapping for ransom has fallen from 2014 levels (see S/2014/815, para. 74), although ISIL continues to kidnap locals. As the group comes under increased pressure, it may seek to increase this revenue stream (see S/2016/501, para. 12), meaning that preventive measures remain critical.

58. Moreover, the role of ISIL affiliates has been elevated since 2015. Some affiliates, such as in Libya, are purpose built and serve as logistical hubs for operations in the wider region. Others, such as in Yemen, have close connections to the centre of the organization. |57| Therefore, as a Member State explained, in addition to perpetrating international attacks outside its immediate operational zones, ISIL may be relocating some of its assets to its affiliates to continue its operations if it is unable to resist the current military pressure in Iraq and the Syrian Arab Republic (see ibid., para. 7).

59. The military pressure against ISIL in Iraq and in the Syrian Arab Republic has resulted in an increase in the number of foreign terrorist fighter returnees, in particular to Europe. In addition, while foreign terrorist fighter travel to the conflict zone continues to be, in many cases, self-financed, travel patterns have changed as a result of increased Member State attention. Consequently, while increased Member State action as a reaction to resolution 2178 (2014) has demonstrated effects, foreign terrorist fighters and returnees are adjusting to the new hurdles.

60. As at 20 June 2016, only 20 Member States had submitted implementation reports to the Committee in accordance with paragraph 36 of resolution 2253 (2015). In addition, Member States have separately updated the Committee and the Team on new action taken since the adoption of the resolution and in reaction to resolution 2199 (2015). According to those reports, new measures were progressing to update legislative frameworks, enhance inter-agency coordination and improve the sharing of information. A higher reporting rate would be desirable to enable the Committee and the Team to assess in greater detail the impact that sanctions have had on ISIL, its affiliates, ANF and foreign terrorist fighters.

61. The Monitoring Team therefore recommends that the Committee task the Team with developing a self-reporting tool in the form of a voluntary questionnaire to encourage Member States to report on the impact of resolutions 2178 (2014), 2199 (2015) and 2253 (2015) on the threat from ISIL and associated entities, ANF and foreign terrorist fighters.

62. During the reporting period, the Team regularly engaged with humanitarian actors to learn about potential unintended consequences of sanctions against ISIL and ANF. Consistently, these interlocutors explained that sanctions measures created hesitation and greater caution within the financial sector and among donors. While the Team has not received official reports concerning specific humanitarian projects halted as a result of sanctions, it has become clear that further awareness-raising concerning the nature and extent of existing sanctions measures within the humanitarian sector is desirable.

IV. Recommendations

A. Asset freeze

63. Since its report focused on challenges faced by business entities in implementing the sanctions measures of resolution 2199 (2015), |58| the Team has continued its consultations with relevant private sector entities and associations, Member States and multilateral organizations. On the basis of its consultations, the Team has prepared recommendations, which it believes can strengthen the implementation of resolutions 2253 (2015) and 2199 (2015).

1. Illicit trade in oil and oil products

Location of oilfields

64. As described in the Team's initial report, relevant industry participants and associations emphasized that, to more efficiently screen for hydrocarbon-related transactions, the industry would benefit from the provision of the names and locations of the various oilfields and related infrastructure under the control of ISIL.

65. The Monitoring Team recommends that the Committee inform Member States and maintain on its website a list of oilfields and related infrastructure under the control of ISIL or any other listed group associated with ISIL or Al-Qaida in order to ensure a harmonized global process through which such information would be transmitted to Member States and to the relevant industries.

66. The process would entail two steps: the provision of the relevant information by Member States and the subsequent agreement concerning that information by the Committee.

Equipment and spare parts

67. Continuing military operations have degraded the oil-related infrastructure controlled by ISIL. Consequently, the group may seek to procure spare parts to repair the damage. |59| Industry experts explained that, to enable more effective screening by oil and gas equipment companies, information concerning the specific equipment that ISIL might be seeking to acquire would be helpful to ensure enhanced compliance and due diligence procedures whenever such spare parts featured in a commercial transaction in the wider region.

68. Military efforts have also significantly degraded the ISIL refining operations to rudimentary methods that produce less volume and a lower quality product, meaning that ISIL is likely to require fuel additives to improve the quality of the fuels, gasoline and diesel produced through these methods to make the fuels more useable.

69. The Monitoring Team recommends that the Committee inform Member States and maintain on its website an illustrative list of hydrocarbon-related equipment, spare parts and chemicals that ISIL may be seeking to acquire in order to ensure a harmonized global process through which such information would be transmitted to Member States and to the relevant industries.

70. Some Member States have already prepared a list of equipment, spare parts and chemicals that ISIL may be seeking to acquire. The Committee could first reach out to them and make any adjustments that it deems appropriate.

2. Denying access to the international financial system

71. Similar to the oil and gas industry, representatives of financial institutions emphasized that additional details relating to the territory controlled by ISIL and the financial institutions operating within that territory would enable institutions to screen transactions more effectively.

72. The Monitoring Team recommends that the Committee write to Member State encouraging those that have not yet done so to provide, where available and on a national basis, to financial institutions and related industry associations operating within their jurisdictions lists with identifying information of financial institutions operating within territory controlled by ISIL.

Terrorist financing risk indicators

73. Financial institutions are eager for greater public-private engagement in dialogue and information exchange to counter the financing of ISIL and other listed groups. The sharing of terrorist financing risks is one potential avenue for public-private sharing of information. Providing risk indicators to financial institutions could improve their due diligence processes and result in improved suspicious transaction reporting, thereby hindering the access of ISIL and other listed groups to the international financial system.

74. The Monitoring Team, in line with paragraph 24 of resolution 2253 (2015), recommends that the Committee write to Member States encouraging them to build stronger relationships with the private sector to counter the financing of ISIL and other listed groups and communicate potential terrorist financing risk indicators to the private sector. The Financial Action Task Force has drafted a report on such indicators that could serve as a starting point for Member States.

Sharing of financial information

75. The subject of sharing information relating to countering the financing of terrorism has been much discussed recently given the intensification of terrorist attacks around the globe. Multilateral bodies, such as the Financial Action Task Force and the Egmont Group of Financial Intelligence Units, have carried out extensive work to identify roadblocks to the effective sharing of financial intelligence. The Team has participated in many of the discussions and independently reached out to the private sector and Member States on the issue.

76. Global financial institutions are subject to various, often-conflicting laws, such as data protection/privacy and bank secrecy laws, together with tipping-off requirements relating to the confidentiality of suspicious transaction reports |60| in the jurisdictions in which they operate. This results in obstacles to sharing information within an enterprise, between financial institutions (not within the same enterprise) and between financial institutions and relevant government agencies, nationally and across borders.

77. For example, owing to data protection/privacy laws, a bank may be unable to determine that a customer in one country is also a customer of a subsidiary in another country, thereby hampering the institution's ability to conduct enterprise-wide risk management and compliance.

78. Furthermore, financial institutions are often unable to share relevant information with one another, even within the same jurisdiction, for fear of incurring legal liability. Representatives of financial institutions have told the Team that the ability to discuss potentially suspicious activity with one another in some defined circumstances could be very helpful to countering terrorist financing, and, where such sharing is allowed, investigations have been enriched through the process.

79. The Team's interlocutors have also indicated that they are prevented from providing a global picture of a network to each financial intelligence unit to which that global picture may be relevant. For example, although a terrorist network may span numerous jurisdictions, and a financial institution may see transactions relating to that network across several jurisdictions, that institution may be unable to provide the same global picture to the respective financial intelligence unit in each jurisdiction.

80. Other obstacles identified include privacy laws that restrict the sharing of relevant information even at the financial intelligence unit level; financial intelligence units lacking the authority to share suspicious transaction report information with all relevant national agencies dealing with counter-terrorism; and financial intelligence units being unable to share information once an investigation has been initiated, thereby missing out on the opportunity to leverage information that another jurisdiction may have on the subject of the investigation.

81. Some Member States have already implemented laws and regulations, while others have been able to devise innovative mechanisms to deal with some of these challenges. Furthermore, Member States have legitimate concerns relating to privacy and derisking, meaning that a one-size-fits-all solution may not be possible.

82. The Monitoring Team, in line with paragraph 25 of resolution 2253 (2015), recommends that the Committee write to Member States encouraging those that have not yet done so to review their relevant laws and regulations to ensure that the necessary exemptions, carve-outs and safe harbours are in place to allow for the effective sharing of financial information pertaining to terrorist financing.

Generating data on smuggling of antiquities

83. As previously outlined by the Team (see S/2016/210, para. 8), the continuing looting activities within ISIL-controlled territory necessitate the generation of more detailed data by Member States |61| in order to analyse smuggling networks that allow looted antiquities to be transported and therefore provide an opportunity to bring those looted antiquities to international markets. Further differentiation of relevant categories in chapter 97 of the Harmonized System Nomenclature and Classification of Goods |62| of the World Customs Organization (WCO) would enable national customs agencies to better identify potentially relevant antiquities and hold those that are intentionally wrongly declared.

84. The Monitoring Team recommends that the Committee write to Member States encouraging them to explore possibilities to create additional subcategories under headings 97.05 and 97.06 in the WCO Harmonized System Nomenclature and Classification of Goods.

Enabling customs and the law enforcement community to better identify relevant antiquities

85. Secure sharing of information concerning looted antiquities is key to enabling customs and law enforcement agencies to identify objects that are likely to have been traded by ISIL-related individuals. The WCO ARCHEO platform |63| allows participants to exchange information through this communications tool on warnings, seizures and other relevant areas through the secure CENComm (Customs Enforcement Network) platform. WCO also operates the CEN seizures database in which Member States can enter and analyse information on customs seizures, allowing them to develop risk indicators and identify trends. These tools are not yet widely used.

86. The Monitoring Team recommends that the Committee write to Member States encouraging them to raise awareness among the relevant customs and law enforcement agencies of the WCO ARCHEO platform with a view to its wider use and also encouraging them to share data on seizures through the WCO CEN seizures database.

87. Private sector stakeholders and Member States explained that antiquities of Mesopotamian origin could be traced because they were concentrated in Iraq and the Syrian Arab Republic, but Roman or Byzantine antiquities originating in Iraq or the Syrian Arab Republic were difficult to distinguish because similar antiquities could also be found in the wider region. Antiquities experts explained, however, that, if it could be clarified which archaeological sites, museums and excavation storage houses had been looted by ISIL or ANF, they would have a better chance of identifying relevant antiquities as a result of aesthetic differences.

88. To strengthen the compliance systems of business entities in the antiquities market, the Monitoring Team recommends that the Committee write to Member States encouraging those that have not yet done so to provide, where available and on a national basis, to relevant industry stakeholders and associations operating within their jurisdiction lists of archaeological sites, museums and excavation storage houses that are located in territory under the control of ISIL or any other listed group.

Strengthening due diligence and know-your-customer procedures

89. The trade in art and antiquities uses "provenance" |64| as its central compliance instrument, yet there is no internationally accepted standard that determines what such provenance documentation should entail. In addition, the international antiquities trade does not operate on agreed and defined compliance systems, including know-your-customer procedures. Furthermore, no internationally agreed standards exist concerning the maintenance and storage of relevant documentation involving the sale of antiquities (see S/2016/213, paras. 34-35). All these elements would not only enable market participants to better identify potentially problematic antiquities, but also allow law enforcement investigators to gain access to data on past sales more easily and therefore introduce additional risk factors for smugglers.

90. The Monitoring Team recommends that the Committee write to Member States encouraging those that have not yet done so to engage relevant business associations and antiquities market participants to agree on minimum standards of provenance documentation, differentiated due diligence and know-your-customer procedures and a minimum period during which documentation pertaining to the sale of antiquities should be retained by sellers.

B. Travel ban

91. Biometric data are crucial for automated border control and secondary border checks. Significant progress has been made in gathering such data of listed individuals, which is transmitted to Member States through INTERPOL-United Nations Security Council Special Notices. INTERPOL uses the ANSI/NIST-ITL format |65| to transmit fingerprint data. This enables the full interchangeability of biometric data between the Special Notices and police databases.

92. The Monitoring Team recommends that the Committee write to Member States encouraging those that have not yet done so to submit to the Team and the Security Council Affairs Division the fingerprints of listed individuals, if available, for inclusion in the INTERPOL-United Nations Security Council Special Notices in the ANSI/NIST-ITL 1-2007 format.

C. Arms embargo

93. Countering the threat posed by the use of improvised explosive devices by ISIL, Al-Qaida and their associates has been a core part of the Team's work since its first report, in 2004 (S/2004/679). |66| Countering this threat rests on three information streams: designers, components and designs. All three should be addressed. The INTERPOL Watchmaker project enables Member States to share information on individuals using or manufacturing improvised explosive devices. In addition, an international mechanism focusing on designs of improvised explosive devices would be an important step in countering the threat, enabling Member States to mutually benefit from existing data on components used to manufacture improvised explosive devices and to identify and more effectively defeat known designs. |67|

94. The Monitoring Team recommends that the Committee write to INTERPOL encouraging it to work with relevant Member States to establish a specialized project focusing on enabling Member States to share data concerning components and designs of improvised explosive devices.

95. The Monitoring Team also recommends that the Committee write to Member States highlighting the usefulness of INTERPOL Orange and Purple Notices, which allow Member States to share information and data on technical aspects of improvised explosive devices, |68| and encouraging Member States to actively use the Notices to that effect.

D. Foreign terrorist fighters

96. In February 2016, the Team developed recommendations on the threat posed by foreign terrorist fighters (see S/2016/210). Since then, Member State participation in the INTERPOL foreign terrorist fighter database has increased such that the database now features more than 7,000 names, although this still stands in contrast to estimates of more than 30,000 such fighters in Iraq and the Syrian Arab Republic. Member States in conflict zones and along foreign terrorist fighter travel routes highlighted the lack of information sharing once such fighters had returned to their home countries, saying that there would be benefits from the sharing of relevant information resulting from returnee interviews, including that these individuals had returned (to end wasted efforts to monitor their travel), together with information concerning terrorist and facilitation networks in the conflict zone and along their travel route.

97. The Monitoring Team recommends that the Committee write to Member States encouraging them to further share identities with the INTERPOL FTF database and encouraging those that have not yet done so to explore avenues as to how relevant information gathered from returnees could be shared, as appropriate, with Member States along the travel route and with Member States in which the returnees previously operated.

E. Information and communications technology

98. Both law enforcement and the ICT sector have undertaken efforts to counter the threat of the misuse of ICT by ISIL, Al-Qaida and associates. The cyberecosystem continues to develop very dynamically, however, adapting swiftly to newly developed countermeasures. Furthermore, as a consequence of anonymized communications tools, encryption and the remote storage of data, the link of online activities to the physical presence of ISIL and Al -Qaida has become less visible. The groups' use of the "dark web" and other covert services presents further challenges. The Team believes that a stocktaking of the knowledge and responses of various stakeholders will enable a more detailed understanding of this evolving threat and inform the continuing discussions concerning opportunities to improve collaboration between law enforcement agencies and the private sector to prevent the misuse of ICT by ISIL.

99. The Monitoring Team recommends that the Committee write to Member States highlighting the challenge of the increasing misuse of ICT by ISIL, Al-Qaida and associates and inviting them to share relevant best practices and experiences with the Committee and the Team. Furthermore, the Team recommends that the Committee mandate the Team to further engage with ICT industry stakeholders on potential ways to enable them to counter the threat more effectively.

V. Monitoring Team activities and feedback

100. Between April 2015 and June 2016, the Team conducted 26 country and technical visits. It continued to promote the sanctions regime through its participation in 79 international conferences, meetings and workshops, including those of the International Civil Aviation Organization, the International Air Transport Association, WCO, the Financial Action Task Force and its regional-style bodies, the Marrakech Security Forum, INTERPOL, the United Nations Educational, Scientific and Cultural Organization, the United Nations Office on Drugs and Crime, the European Union, the Global Counterterrorism Forum and the Organization for Security and Cooperation in Europe.

101. The Team also held three regional meetings of intelligence and security services focusing on the threat posed by ISIL, Al-Qaida and associated individuals and entities in the Middle East and North and East Africa. The Team raised awareness among the participating services concerning the potential use of the sanctions regime as an integral part of a national counter-terrorism strategy and encouraged more intensive sharing of information in the region to counter the threat.

102. The Team continued its engagement with entities and associations in the financial, energy, antiquities trading and ICT sectors. Its discussions raised awareness of the sanctions regime and resulted in reporting to the Committee on opportunities for further empowering the private sector to more effectively implement the sanctions measures.

103. The Team remains an active member of the Counter-Terrorism Implementation Task Force, participating in its working groups. It continues to maintain close relations with the Counter-Terrorism Committee Executive Directorate and various branches of the United Nations Office on Drugs and Crime. This has included multiple meetings with the Directorate, at which the Team has shared its analysis on foreign terrorist fighters, culminating in a joint presentation to the Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015) concerning Islamic State in Iraq and the Levant (Da'esh), Al-Qaida and associated individuals, groups, undertakings and entities and the Counter-Terrorism Committee on the issue. The Team also organized, with the Directorate, a joint open briefing on the issue of countering terrorism financing. The Team cooperates closely with the Directorate in the production of mandated reports of the Secretary-General. |69|

104. The Team welcomes feedback on the present report via 1267mt@un.org.

Annex

Litigation by or relating to individuals on the Committee's sanctions list

1. The legal challenges involving individuals and entities on the sanctions list maintained by the Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015) concerning Islamic State in Iraq and the Levant (Da'esh), Al-Qaida and associated individuals, groups, undertakings and entities, or whose names the Committee has removed therefrom, known to the Analytical Support and Sanctions Monitoring Team to be pending or to have been recently concluded are described below.

European Union

2. The General Court of the European Union ruled in favour of Shafiq ben Mohamed ben Mohamed al-Ayadi (delisted) and annulled the restrictive measures adopted against him by the European Union. |a| It found that the reasons provided to him for his listing had been insufficient and that the allegations made against him had not been substantiated with evidence to justify his listing by the European Union. Previously, the Court of Justice of the European Union had found that, despite having been delisted, Mr. Ayadi retained an interest in having European courts recognize that he should never have been listed in the first place. |b|

3. The action brought by Al-Bashir Mohammed Al-Faqih, Ghunia Abdrabbah, Taher Nasuf and Sanabel Relief Agency Limited (all delisted) against the European Commission was dismissed by the General Court, |c| which found that the Commission had carried out its obligation to carefully and impartially examine whether the reasons for listing were well founded in the light of the comments made by the parties and the evidence provided. The General Court also found that Sanabel Relief Agency had no interest in the proceedings because it had ceased to exist. An appeal has been lodged and is pending before the European Court of Justice. |d|

4. The action brought by Mohammed al Ghabra (QDi.228) against the European Commission seeking annulment of the restrictive measures adopted against him remains pending before the General Court. |e|

Pakistan

5. The action brought by the Al Rashid Trust (QDe.005) against the application of the sanctions measures against it remains pending in the Supreme Court of Pakistan on appeal by the Government against an adverse decision in 2003. The similar challenge brought by Al-Akhtar Trust International (QDe.121) remains pending before a provincial high court. |f|

6. In addition to those two cases, a trustee of Pakistan Relief Foundation (listed as an alias of Al-Akhtar Trust International) has challenged the freezing of his bank account.

United Kingdom of Great Britain and Northern Ireland

7. On 27 January 2016, the Supreme Court of the United Kingdom of Great Britain and Northern Ireland unanimously dismissed an appeal made by Hani al-Sayyid al-Sebai Yusif (QDi.198). He had challenged the decision-making by the Secretary of State for Foreign and Commonwealth Affairs in relation to his listing under the Al-Qaida sanctions regime. |g|

8. The United Kingdom is also defending judicial review challenges to its decision-making with regard to the designations under the Al-Qaida sanctions regime of Abdulbasit Abdulrahim, Abdulbaqi Mohammed Khaled and Maftah Mohamed Elmabruk (all delisted). Those cases had been stayed pending the outcome of the case discussed above. |h|

Notes:

1. Listed as Ibrahim Awwad Ibrahim Ali al-Badri al-Samarrai (QDi.299). [Back]

2. Especially in Afghanistan and the Syrian Arab Republic. [Back]

3. Member State information. [Back]

4. The ability to implement such complex attacks was also demonstrated by AQIM in the multi-stage attacks perpetrated in Gao, Mali, on 31 May 2016. [Back]

5. If ISIL is confirmed to be responsible, it also demonstrated this in the attacks against Istanbul airport on 28 June 2016. [Back]

6. Member State information. [Back]

7. Member State information. [Back]

8. Member State information. [Back]

9. Member State information. [Back]

10. Member State information. [Back]

11. One Member State estimated that ISIL had generated between $150 million and $200 million in 2015 from that trade; others reported that the value was too difficult to estimate. [Back]

12. See the narrative summaries of reasons for listing Abd al-Aziz Aday Zimin al-Fadhil (QDi.379), Hamad Awad Dahi Sarhan al-Shammari (QDi.381) and Sa'd bin Sa'd Muhammad Shariyan al-Ka'bi (QDi.382). See also United States Department of the Treasury, "Treasury designates Al-Qaida, Al-Nusrah Front, AQAP, and ISIL fundraisers and facilitators", 19 May 2016. [Back]

13. The Team has also provided a threat assessment of ISIL in Afghanistan in document S/2016/501, paras. 32-36. [Back]

14. These are former TTP splinter groups and are not currently listed (see S/2014/888, annex II). [Back]

15. Member State information. [Back]

16. United States Department of the Treasury, "Treasury designates Al-Qaida, Al-Nusrah Front, AQAP, and ISIL fundraisers and facilitators". [Back]

17. Katherine Zimmerman, "Al Mukalla is not Raqqa", American Enterprise Institute, 3 May 2016. [Back]

18. Member State information. [Back]

19. BBC News, "Saudi Arabia attack: Islamic State claims Shia mosque bombing", 22 May 2015. [Back]

20. SITE Intelligence Group, "IS' 'Al-Hijaz Province' claims suicide bombing at mosque in Abha", 6 August 2015. [Back]

21. Ahmed Hagagy, "Islamic State suicide bomber kills 27, wounds 227 in Kuwait mosque", Reuters, 26 June 2015. Available from www.reuters.com/article/us-kuwait-blast-idUSKBN0P618L20150626. [Back]

22. Al Arabiya, "Saudi authorities bust ISIS cell near Makkah", 5 May 2016. [Back]

23. Member State information. [Back]

24. Callum Paton, "Tunisia: Isis seeking to create emirate in Ben Guerdane after 53 killed in raid from Libya", International Business Times, 8 March 2016. [Back]

25. Member State information. [Back]

26. See United States Department of the Treasury, "Treasury designates Al-Qaida, Al-Nusrah Front, AQAP, and ISIL fundraisers and facilitators". [Back]

27. As indicated on page 43 of the twelfth edition of Dabiq, published in November 2015. [Back]

28. For example, the group circulated a video entitled "Message to our brothers in the Sinai" on 6 May 2016. See Nancy Okail, "ISIS's unprecedented campaign promoting Sinai", Huffington Post, 12 May 2016. [Back]

29. For example, the AQIM attack on 18 March 2016 against the Ayn Salih oil and gas field in Algeria. [Back]

30. Speech by the head of the AQIM "Council of Dignitaries", Abu Obeida Yusuf al-Annabi, on 14 January 2016. [Back]

31. In particular, Twitter and Telegram. [Back]

32. Guardian (Lagos), "We have restricted Boko Haram to Sambisa Forest — Buhari", 8 September 2015. [Back]

33. CNBC Africa, "Chad sends 2,000 troops to Niger for counterattack on Boko Haram", 9 June 2016. [Back]

34. Member State information. [Back]

35. For example, Sheikh Basheer Filo, his brother, Abu Baker, and Hussain Abdi Qaidi. [Back]

36. Member State information. [Back]

37. Hamza Mohamed, "Al-Shabab claims Somalia plane bomb attack", Aljazeera News, 13 February 2016. [Back]

38. Member State information. [Back]

39. One Member State reported that as many as 50 per cent of its foreign terrorist fighters had already returned. [Back]

40. In the past decade, security forces in the region had been successful in curbing the threat from terrorism. See S/2015/441, paras. 32-38. [Back]

41. ISIL claimed the attack. See SITE Intelligence Group, "IS claims attack in Jakarta, Indonesia", 14 January 2016. [Back]

42. See also Institute for Policy Analysis of Conflict, "Disunity among Indonesian ISIS supporters and the risk of more violence", 1 February 2016. [Back]

43. See, for example, the narrative summary of reasons for listing of Hilal Ahmar Society Indonesia (QDe.147). [Back]

44. Since the submission of this report on 30 June 2016 by the Monitoring Team, there have been press reports that Santoso may have been killed by Indonesian forces in July 2016. See, for example, Francis Chan, "Militant killed in Central Sulawesi may be Santoso, Indonesia's most-wanted terrorist", The Straits Times, 18 July 2016. [Back]

45. Member State information. [Back]

46. See the narrative summaries of reasons for listing of Tuah Febriwansyah (QDi.393), Muhammad Sholeh Ibrahim (QDi.395) and Mujahidin Indonesian Timur (QDe.150). [Back]

47. Member State information. [Back]

48. See, for example, "Joint statement of the DND, AFP, and WESMINCOM on the April 9 encounter in Basilan". [Back]

49. Although many South-East Asians, especially those joining ISIL, went to Iraq or the Syrian Arab Republic intending to stay permanently, there remains a risk that some will return, especially as ISIL comes under increasing pressure in Iraq and the Syrian Arab Republic. [Back]

50. See, for example, the narrative summaries of reasons for listing of Zulkarnaen (QDi. 187) and Nurjaman Riduan Isamuddin (Qdi.087). [Back]

51. See also Institute for Policy Analysis of Conflict. "Disunity among Indonesian ISIS supporters and the risk of more violence", 1 February 2016. [Back]

52. See, for example, the thirteenth edition of Dabiq, published in January 2016. [Back]

53. Comprising 36 Member States and multilateral organizations. [Back]

54. Comprising Iran (Islamic Republic of), Iraq, the Russian Federation and the Syrian Arab Republic. [Back]

55. Member State information. [Back]

56. Member State information. [Back]

57. Member State information. [Back]

58. S/2016/213; the Team also made recommendations in document S/2016/2010. [Back]

59. One Member State has already reported a failed attempt by ISIL to that effect. [Back]

60. Suspicious transaction reports are subject to confidentiality provisions in order to avoid "tipping off the subject of the report. Some jurisdictions interpret the confidentiality restrictions more strictly than others. [Back]

61. While Member States informed the Team about seizures of antiquities, the Committee has not yet received official seizure reports, demonstrating that further awareness-raising is necessary concerning the reporting provisions of paragraph 15 of resolution 2253 (2015). [Back]

62. See chapter 97 of the Harmonized System Nomenclature and Classification of Goods of the World Customs Organization on "Works of art, collectors' pieces and antiques". Available from www.wcoomd.org/en/topics/nomenclature/instrument-and-tools/hs_nomenclature_2012/~/media/BB5F7132F59C4218BBE69A882906349A.ashx. [Back]

63. Currently, only about 40 Member States participate in ARCHEO. [Back]

64. Documentation concerning the legality of prior ownership of the object. This involves, where available, also export certificates issued by countries in which these items originate. A wider use of this measure by Member States would therefore also support private sector compliance. WCO and the United Nations Educational, Scientific and Cultural Organization provide a model export certificate. See "UNESCO-WCO Model Export Certificate", available from www.unesco.org/new/en/culture/themes/illicit-trafficking-of-cultural-property/legal-and-practical-instruments/unesco-wco-model-export-certificate/. [Back]

65. INTERPOL, "ANSI/NIST-ITL 1-2007, Data Format for the Interchange of Fingerprint, Facial & SMT Information: INTERPOL Implementation", April 2011. [Back]

66. For further recommendations see also subsequent reports of the Team. [Back]

67. In past years, INTERPOL has organized two projects, "Technical Information -- Data Exchange" (TIDE) and Terminage (a pilot project), with this aim in mind. [Back]

68. Orange Notices allow the sharing of information concerning an event, a person, an object or a process representing a serious and imminent threat to public safety. Purple Notices allow the sharing of information concerning modus operandi, objects, devices and concealment methods. See www.interpol.int/INTERPOL-expertise/Notices. [Back]

69. Resolution 2253 (2015), para. 97, and resolution 2292 (2016), para. 12. [Back]

Notes to the annex:

^a Judgment of the General Court (Third Chamber), case T-527/09 RENV, Ayadi v. Commission, 14 April 2015. [Back]

^b Judgment of the Court of Justice of the European Union (Tenth Chamber), case C -183/12 P, Ayadi v. Commission, 6 June 2013. [Back]

^c Judgment of the General Court (Seventh Chamber), case T-134/11, Al-Faqih and Others v. Commission, 28 October 2015. [Back]

^d C-19/16P, Al-Faqih and Others v. Commission. [Back]

^e Case T-248/13, Al-Ghabra v. Commission. [Back]

^f Information provided by Pakistan. [Back]

^g Information provided by the United Kingdom. [Back]

^h Information provided by the United Kingdom. [Back]

19Jul16

Eighteenth report of the Analytical Support and Sanctions Monitoring Team submitted pursuant to resolution 2253 (2015) concerning Islamic State in Iraq and the Levant, Al-Qaida and associated individuals and entities

I. Overview of the threat

A. Strategic competition and tactical cooperation

B. Increasing numbers of returnees

C. Modus operandi of external attacks

D. Misuse of information and communications technology by terrorists

II. Regional trends

A. Levant

B. South and Central Asia

C. Arabian Peninsula

D. North and West Africa

E. East Africa

F. Europe

G. South-East Asia

III. Impact assessment

IV. Recommendations

A. Asset freeze

B. Travel ban

C. Arms embargo

D. Foreign terrorist fighters

E. Information and communications technology

V. Monitoring Team activities and feedback

Information
Bookshop \| Donate Derechos \| Equipo Nizkor