Capital Prishtina
Time Zone CET (GMT+1)
Country Code 377 (Monaco); 381 (Serbia)
Mobile Codes 44
Currency Euro
Land Area 10,908 sq km
Population 1.8 million
Language Albanian, Serbian, Turkish
Major Religions Islam, Orthodox Christianity, Roman Catholicism

Italy Targets Kosovo-linked ISIS Network- But Laws Lag behind the Online Jihad Era

By Chris Deliso and Matteo Albertini

The sustained and ongoing anti-terrorist operations by police across Europe before and after the ISIS Paris attacks are indicative of just how well established and dangerous Islamist radical networks on the continent have become.

The new state of the war on terror must be appreciated- as must the fact that the Balkans (and the ‘Balkan Route’ of migration) are already becoming of much greater interest to the European authorities, as a recent Italian operation dramatically showed. However, the relative novelty of the internet jihad also means that even countries well versed in countering terrorism and organized crime, like Italy, are lagging behind, as we shall see below.

The Paris Attacks and the New State of War

As many analysts have pointed out, the Paris attacks of 13 November can be seen as a turning point in the strategy of the Islamic State, which is now evolving from traditional terrorist attacks by small cells, conducted chiefly in its own geographical area, to more organized and complex paramilitary actions conducted on the territory of a Western state. A new phase in what the Bush administration called the ‘long war’ thus appears to be upon us.

These paramilitary attacks in France represent a serious step up from the January attacks in the same country, against the editorial office of Charlie Hebdo, when the Al-Qaeda branch in Yemen killed 17 persons (12 in Charlie Hebdo’s office, and five in Paris and Montrouge). The recent attacks caused vastly more casualties, and were marked by even more precise actions, with three different teams and three different targets involved, and a considerable logistics network believed to be behind it.

Paris was the third attack Islamic State claimed this month, after an explosive device brought down Russian Metrojet Flight 9268 on November 3 in Sinai and the Beirut attacks on November 11, framing a scenario of extremely high concern about the future operations of the self-proclaimed Caliphate in Middle East and abroad.

Given the Islamic State’s media reach and international support network, threats to other Western cities like Rome, London and Washington must be taken seriously. This has been seen vividly in the Belgian authorities’ recent lockdown of Brussels and continued arrests related to the Paris attacks and possible planned attacks in Belgium. At the same time, pro-migration protesters defied a ban on public gatherings in Paris, an ominous sign of how the terrorism and migration issues are going to converge in future challenges to the authorities’ role.

We consider it highly likely that more attacks will occur, especially considering the growing potential for a possible Western military intervention on the ground in Syria. This is precisely what ISIS wants, not because it expects to win back territory (it will eventually be defeated) but because it can help fire up supporters elsewhere in the world to act in their own countries.

Needless to say, the work of international security agencies and national intelligences is becoming more and more crucial, and especially in Europe, which risks becoming one large (and generally defenseless) theater in an unpredictable war with an evasive enemy.

The Italian-led Operation as Indicator of European Cooperation- and Balkan Focus recently covered a story which passed almost without notice when it was soon eclipsed by the massive media coverage of the Paris attacks: the Italian-led operation against an ISIS group seeking to overthrow the Iraqi Kurdistan government. While the Paris attacks have been depicted as an example of intelligence failure and poor cooperation, the Italian operation can help us to understand how security agencies are actually cooperating to oppose terrorist networks active on the continent.

To recap, on 12 November some 15 people were arrested in four European countries following a five-year Italian investigation, conducted in coordination with Eurojust: they were members of a terrorist network that not only wanted to attack the Kurdish government in northern Iraq, but also to recruit militants for ISIS in Europe.

The network was called Rawti Shax (“New Course”), and is the European offshoot of Ansar al-Islam, a terrorist group affiliated with Al Qaeda. It was founded in 2001 by Najmuddin Faraj Ahmad, known as Mullah Krekar. He had already been detained in Norway and jailed as a consequence of this new investigation.

Notwithstanding his confined situation, Mullah Krekar was still able to manage from jail a well-functioning international web of terrorist recruitment, which was invigorated after the rise of the Islamic State in Syria and Iraq.

In the strategy of Ansar Al-Islam, the role of Rawti Shax was to recruit and train possible foreign fighters to be sent to Syria to fight under the banner of the Caliphate against the Iraqi Kurdish Republic. The Kurds are not just the main enemy of Islamic State in the contest for new national state creation, their fighters are also well known as being the most effective military force against ISIS on the battlefield. Therefore, any terrorist attack against the Kurdish authorities would be motivated by both revenge and a desire to destabilize Kurdistan for the terrorists’ benefit.

This organization was until now based in Merano, a little town in Northern Italy where the investigation (conducted by the Italian Carabinieri), tracked the movements of the two main suspects: Abdul Rahman Nauroz, a Kurdish Iraqi citizen, and Eldin Hodza, an Albanian from Kosovo.

The former, allegedly the successor of Mullah Krekar at the head of the organization, was particularly active in online recruitment: as Giuseppe Pignatone, public prosecutor in Rome, stated, “the investigation developed out of computer evidence, as their operating base was mostly the web, the world of the Internet.” In fact, internet cummunication allowed this group to connect small cells spanning Europe, from Greece to Norway. This assisted in, and later promoted, the “jihad lessons” Nauroz gave from his home in Merano.

The latter cell member, Hodza, was a typical ‘foreign fighter,’ who had already been sent to Syria by Nauroz in January 2014. According to the investigation, there he visited an IS training camp, but came back to Italy a month later through Switzerland.

This development is not surprising. As has covered in depth, Albania and Kosovo (and their diasporas) have made sizable contributions to the European jihadist brigades fighting for ISIS. The caliphate even made Albanian one of the chosen languages for translations when it developed its propaganda arm, a truly notable decision considering the relatively small usage of the language globally. And there have been allegations of recruitment centers on their territory, with more than 600 Albanian fighters having visited Syria in the last two years. The Al Nusra Front has also imported Albanian fighters since the beginning of the conflict in Syria, owing to specific local historical and personal connections with Syria.

The Italy-Kosovo Connection

One of these “starting points” on the route to Syria is the small southwestern Kosovo town of Restelica, south of Dragas. Although had isolated this region as a potential center of future radicalization over 10 years ago, it has never been mentioned by the media in general. In the Italian media, Restelica came up in Panorama’s interview on March 15, 2015 with the Italian ambassador to Pristina, Andreas Ferrarese.

Interestingly, in this little town almost everybody speaks Italian and a third of all citizens have worked in Italy; this connection has much to do with how Italian security officials became aware that parts of the Dragas area now represent a major center of ISIS recruitment for Albanians in Kosovo.

The reported jihadist leader for Restelica, the imam Sead Bajraktar, lives near Siena in Italy, where he founded an Islamic center in the town of Monteroni d’Arbia. He frequently travels back to Kosovo, intelligence sources say, to visit his collaborators and to participate in military training. He was once arrested near Dragas (and soon set free) along with a member of the same Monteroni center.

Bajraktar is an important figure in this story as he is considered the man responsible for Eldin Hodza’s radicalization. Already in March, Panorama underlined how Hodza went to Syria and later came back upon payment by a relative who allegedly “ransomed” him from his participation in the jihad. Apparently, the intervention of this relative did not diminish his will to join the ranks of Islamic State, since when he was arrested on 12 November he was still planning to return through Rawti Shax.

Ambassador Ferrarese had already stated in March that “there’s great attention [being paid to] the uninterrupted channel of human trafficking through the Balkans, with a primary role held by Kosovo organized crime. We immediately considered the hypothesis that this route could be used by volunteers going to fight in Syria and Iraq- a route which could furthermore be used by those who are coming back to Europe.”

International security agents working in Kosovo also confirm that some foreign fighters have made it back to Europe along the routes of clandestine immigration through Southeastern Europe, mostly entering Italy at Trieste, from Slovenia. Their transit along the ‘Balkan Route’ from Greece has been expedited by the sheer volumes of persons following this route, which has made it impossible for authorities in the countries along the way to properly identify them.

All too often, advocates of “migrant rights” have succeeded in making their arguments in the media that all migrants are being racially or religiously profiled, when in fact the main problem is simply a logistical one: there have simply been too many people coming in too short of a time. This problem has been exacerbated by poor communication (or no communication) between Greek authorities and those of their ‘northern neighbor,’ Macedonia regarding timing and numbers of arrivals. ISIS would be foolish not to exploit this vulnerability.

Aspects of the Evolving Security Threat Revealed by the Italian Investigation

The story behind these arrests helps us to underline some features of undercover terrorist action in the time of the Islamic State. The first thing that emerges is that many terrorist cells once affiliated with specific jihadist groups (Al Qaeda, Al-Nusra Front, etc.) are now working as recruitment and financing agents under the Islamic State umbrella.

This is not surprising, considering that Islamic State derives great wealth from the territory it controls, and can thus heavily finance outside operations, whereas Al Qaeda is nowhere near as well off, and seeks to survive by participating in operations of lower profile such us recruitment and logistical support. This is however a very important function for the Caliphate, which looks for fighters living in Europe, who can operate with less travel restrictions, and thus have the capacity to act in different regions.

Secondly, Italy is becoming a crossroad of international terrorist networks linked to Syria and the Balkans, as the outcomes of recent investigations show. Some persons of interest have already appeared in previous coverage of Italy-Balkan jihadist networks: these include the Bosniak imam Bosnić, arrested with 15 others in September 2014; the imam Idriz Idrizovic, active in Salafi centers in Lombardy; the Prizren imam Mazzlam Mazzlami; Shefqet Krasniqi, imam of the Great Mosque in Pristina: and Idriz Billibani, first arrested in 2010 and allegedly linked to a Kosovar-Italian web of radicalization and recruiting. Kosovo, Macedonia, Albania and Bosnia have all since 2014 made many arrests under new foreign fighters laws.

Italian Concerns over the Stepped-up War and the Vatican’s Imminent Jubilee Year

After the attacks in Paris, the attention of Italian secret services towards the role of the Balkans in linking the country and the Caliphate has become even more acute than usual. This is particularly noteworthy considering that December 8 marks the opening of the “Jubilee Year” that Pope Francis announced on March 13, 2015.

This symbolic event, which occurs every 20-30 years on Papal decree, will start on the Catholic feast of the Immaculate Conception, celebrated December 8, 2015. It will close on November 20, 2016.

At the time of the pope’s announcement in March, the National Catholic Reporter noted that the celebration of the jubilee year will formally begin “with the opening of the Holy Door of St. Peter’s Basilica at the Vatican. The other holy doors of basilicas around the world will then be opened as a sign of God’s opening a new pathway to salvation.”

Considering that Islamic State has pledged to eventually overthrow the Church of Rome and to raise its own banner over St Peter’s, an attack timed to coincide with this symbolic event – and, perhaps, timed to coincide with others at churches in different locations – would be highly tempting for the terrorists.

Of course, as we have noted in The Vatican’s Challenges in the Balkans, the Church does have its own sophisticated defenses and global intelligence networks. However, the recent Paris attacks reveal that ISIS’ affiliates can also be highly dangerous and agile and this, in addition to the migrant crisis, has forced the Vatican to tap into its international intelligence networks as it hastily tries to identify potential arrivals of terrorists among migrant groups, and in general get any useful information at all about looming threats. The Vatican also has well developed intelligence-gathering networks in Montenegro. Croatia, Bosnia, Albania and Kosovo, as does the Italian state, though it is impossible to show how these overlap in specific cases.

New Developments: Shortcomings in the Penal Code Reduce Investigation’s Success

On 23 November, new developments in the Italian courts affected the outcome of the case. It was announced that five of the 17 arrested in the Jweb investigation in Merano are going to be set free, following a decision of the Procura della Repubblica- in effect, the public prosecutor’s office in Trento. Further, while 14 persons were arrested, two of them were already in jail on charges, and three other claimed accomplices were nowhere to be found.

As already reported, the prosecutor, Giancarlo Capaldo (an expert in terrorism working at the Procura in Rome) conducted the investigation with public prosecutor Pignatone; they identified 17 alleged suspects. But since the jihadist organization was in Merano, officials in Rome had assigned the investigations to Trento, where the Provincial Procura (led by prosecutor Giuseppe Amato) was tasked with conducting the trial.

Amato, therefore, had to ask the Judge for Preliminary Inquiry (GIP) in Trento, Francesco Florenza, to co-validate the arrests. But in their following request they reported just 10 names (among them, Nauroz and Hodza). As they wrote in their comments, they considered as insufficient the charges against Hama Mahmoud Kaml and Mohamad Fatah Goran, both living in Trentino Alto-Adige. At the same, the Trento prosecutors also refused to persecute the three untraceable investigated people.

Therefore, the GIP had no choice but to release both Fatah and Goran, and to order any tracking of the other three vanished cell members stopped. This decision fwas based on the argument that “contact [through communication, ie., internet] does not imply participation in a terroristic association.”

Moreover, a recent change in the Italian Code of Criminal Procedure states that a person can be jailed only on solid proof, and not just according to circumstantial evidence. In this case, some of the people investigated had, in Mr. Florenza’s words, “vanished a long time ago from the horizon of the investigation.”

This development, as related to Il Fatto Quotidiano by Prosecutor Amato himself, seems to be due to the shortcomings in the Italian Penal Code regarding international terrorism. It was also due to the most recent laws about the rules of arrests (art. 274 of the code of criminal procedure, changed by Law 47 of 16 April 2015).

Thus, the largely online nature of the international jihadist network seems to be causing a lot of problems for Italy’s outdated penal codes. This is interesting, since because of all of its long experience fighting the mafia, Italy is usually among the most advanced countries in terms of drafting laws about fighting criminal organizations and terrorism.

Conclusion: Vulnerabilities in Fighting Online Jihad in Europe Will Continue, Enhancing Presence of Non-State Actors

The legislative shortcomings in Italy and other European countries regarding jihad in the internet era are likely to remain a significant vulnerability, especially where they intersect with the ‘civil liberties’ lobbies, thus hampering future investigations from achieving maximal results.

In this state of affairs, it is ironic that pro-civil liberties activist groups unchecked by legal restrictions, such as Anonymous, may have greater capacity to fight against the online jihad than do regular states. The “hacktivist” group, which declared “war” on ISIS following the Paris attacks, now seems to be acting as an intel source with predictions of its own. While some major governments have stated that the group – usually acting against Western governmental and corporate interests – should stay out of the fight, no doubt they are grateful for any disruption it can cause to the terrorist group’s online infrastructure.

There is not even a hypothetical scenario, of course, of how any European court would handle an anti-terrorism case in which official police resources and activities ended up mixed up with the activities of unknown hackers. It is becoming a strange new world indeed.