NCTC Director Christine Abizaid, Statement for the Record, Senate Committee on Homeland Security and Government Affairs

NCTC Director Christine Abizaid, Statement for the Record, Senate Committee on Homeland Security and Government Affairs

• Print

On October 31, 2023, Director of the National Counterterrorism Center Christine Abizaid delivered testimony at the Senate Committee on Homeland Security and Government Affairs annual hearing on threats to the Homeland, alongside FBI Director Christopher Wray and DHS Secretary Alejandro Mayorkas. The testimony and public hearing is available to view here, and her Statement for the Record is below.

Statement for the Record by
Ms. Christine Abizaid
Director, National Counterterrorism Center

Annual Threat Assessment to the Homeland
Statement for the Record
Senate Committee on Homeland Security and Government Affairs

October 31, 2023

Good morning, Chairman Peters, Ranking Member Paul, and members of the Committee. Thank you for the opportunity to discuss the overall terrorism landscape, the threat posed to the Homeland and U.S. persons and interests overseas, and the state of the U.S. counterterrorism (CT) enterprise. (U) I want to begin by addressing the recent attacks by HAMAS and the terrorism implications of the ongoing events, especially within the context of the threat to the Homeland. (U)

We continue to closely monitor, evaluate, and take appropriate actions with respect to potential threats to the United States in the wake of the 7 October HAMAS attacks against Israel and the resulting regional tensions. We are sharing relevant information with our federal state, local, and international law enforcement, intelligence, defense, and homeland security partners to ensure they are prepared for any threats. More broadly, we are monitoring the actions of a range of terrorist actors for key signs of terrorist escalation, including from Iran-aligned proxies in the region; al-Qa'ida and ISIS branches and affiliates from West Africa to Southeast Asia; and other terrorist organizations or lone actors who may seek to exploit the conflict. We are committed to analyzing, tracking, and enabling the disruption of threats targeting Americans abroad, and Jewish, Muslim, and Arab communities within the United States. Since 7 October, there have been increased threats to these communities worldwide, and some attacks and violent exploitation of protests, primarily driven by overall heightened tensions and individuals engaging in violent extremist attacks. My colleagues will address other threats by individuals mobilizing to violence driven at least in part by the current conflict. (U)

The cascading effects of HAMAS's brutal and highly complex attacks inside of Israel underscore the need for vigilance against a diverse array of terrorist actors who retain the capability and intent to conduct operations against the United States and our interests. Today's Middle East conflict and the potential implications thereof hits centermass for a national CT effort that otherwise had been tracking an overall reduced threat emanating from ISIS and al-Qa'ida in the region and was adjusting to a more discrete, though geographically dispersed, terrorist threat. (U)

How this conflict unfolds in the coming days, weeks and months - and the degree to which it may help renew otherwise declining terrorist actors across the globe - will require careful monitoring. In the meantime, the United States must be careful to preserve the capabilities to address an inherently unpredictable range of terrorist adversaries and enable agile responses to emerging threats and crises, even as we confront a myriad of other national security challenges that play out both overseas and in the United States. (U)

Terrorist Trends of Concern (U)

NCTC's approach to evaluating the terrorist threat to the United States factors in the current capability and intent of various terrorist actors and the conditions under which they operate. These categories of terrorists and threat actors generally align as violent Sunni extremist groups such as ISIS and al-Qa'ida; Iran and Iranian-aligned terrorist groups such as Lebanese Hizballah, some militant groups in Iraq and Syria, the Yemenbased Huthis, HAMAS, and Palestinian Islamic Jihad (PIJ); and Homegrown Violent Extremists (HVEs) and other lone actors such as Racially or Ethnically Motivated Violent Extremists (RMVEs) with a foreign nexus. (U)

CT pressure by the United States and foreign partners during the last 15 years has been critical in degrading the capabilities of the most concerning threats, particularly by disrupting experienced leaders and operatives and exerting sustained pressure against key networks. Consistent with the last two years of testimony to this committee, we assess the most likely threat in the United States is from lone actors, whether inspired by violent Sunni extremist narratives, racially or ethnically motivated drivers to violence, or other politically motivated violence. This is not to say that the threat from organized foreign terrorist groups is gone. Indeed, despite success at deterring sophisticated, hierarchically-directed terrorist attacks in the Homeland since 2001, as of 2022, terrorism threat reporting remained at roughly the same level as in 2010, when al-Qa`ida was at its relative peak, before the death of Usama bin Ladin and rise of ISIS. Today's current conflict will undoubtedly fuel even more threat reporting. (U)

As we evaluate that reporting beyond the dynamic of the Israel-HAMAS conflict, three key themes characterize our leading CT challenges: regional expansion of global terrorist networks despite degradation of their most externally focused elements; the growing danger from state involvement with terrorism; and, as mentioned above, the reality that lone actors are the most likely to succeed in carrying out terrorist attacks. (U)

Regional Shifts by ISIS and Al-Qa'ida (U)

The United States is safer today because of the suppression of the most dangerous elements of ISIS and al-Qa`ida's global networks. Thanks in large part to American and regional partner CT operations, both organizations have suffered significant losses of key personnel and sustained CT pressure is constraining their efforts to rebuild in historical operating areas. Al-Qa'ida is at a low point in Afghanistan and Pakistan, where its revival is unlikely because it has lost target access, leadership talent, group cohesion, rank-and-file commitment, and an accommodating local environment. Meanwhile, since early 2022, ISIS has lost three overall leaders and more than a dozen other senior leaders in Iraq, Syria, and Somalia-including some who had been involved in planning attacks outside the region-as a result of pressure from the United States and international allies, regional governments, and local opposition forces. (U)

These terrorist losses have been partially offset by an increased external threat from ISIS-Khorasan in Afghanistan and the expansion of both ISIS and al-Qa'ida networks across Africa, although these remain largely regionally focused. Thus far ISIS-Khorasan has relied primarily on inexperienced operatives in Europe to try to advance attacks in its name and, in Afghanistan, Taliban operations have for now prevented the branch from seizing territory that it could use to draw in and train foreign recruits for more sophisticated plots. That said, given Afghanistan's history and the mix of terrorist and insurgent groups that have long operated from its territory, a top CT priority remains protecting against threats emerging from that country. (U)

In North and West Africa, we are concerned that the erosion of democratic norms and the withdrawal of some traditional partners could further embolden terrorist groups who already pose a threat to U.S. interests in the Sahel. Al-Shabaab in East Africa has become al-Qa'ida's largest, wealthiest, and most lethal affiliate. The Somalia-based group has demonstrated the capability to carry out attacks across the region, including against U.S. personnel. (U)

In the Middle East, Al-Qa'ida in the Arabian Peninsula (AQAP) remains al-Qa'ida's most dedicated driver of external plotting despite its own losses of key personnel and resources. Remaining senior members of the Yemen-based group continue to produce media reinforcing the cohesion of al-Qa'ida's global network as well as calls for attacks against our interests globally. How AQAP, ISIS, or other regional groups may seek to capitalize on HAMAS' 7 October attack to recruit and rebuild anti-West attack capabilities will be critical to assess as tensions and violence rise as the conflict continues. (U)

Iran as Quintessential State Sponsor of Terrorism (U)

Our CT enterprise remains focused on the Iranian Government's persistent global activity, including in the Homeland, targeting multiple populations over the past four years, such as Israeli or Jewish interests; Iranian dissidents; and U.S. officials in retaliation for the death of IRGC-QF Commander Qasem Soleimani in 2020. Lebanese Hizballah, a number of Iran-aligned militant groups in Iraq and Syria, the Huthis, PIJ, and HAMAS all have long-standing relationships with Iran and have received materiel, financial support, and training from Iran. These groups and surrogates pose an asymmetric threat to the United States and Israel, and the prospect of the Iranian Government's provision of more lethal and sophisticated capabilities to them remains a serious concern. (U)

More relevant to the Homeland, we are watching for signs that Iran could pursue additional operations here, though we assess they would be unlikely to do so given the consequences amidst the current conflict. Iran and its proxies do have a history of external operations; Iranian state agents have pursued several dozen lethal plots and assassinated at least 20 opponents across four continents since 1979, while Lebanese Hizballah has conducted international terrorist attacks in Argentina, Saudi Arabia, and Bulgaria. Over the last several years, Iran has plotted against the United States, other Western interests, and Iranian dissidents more aggressively than they have at any time since the 1980s and become increasingly explicit in threats to carry out retaliatory attacks for the death of Iranian officials, especially against current and former U.S. officials whom it holds primarily responsible for Soleimani's death. (U)

As of mid-October, Iran is allowing its partners and proxies in the region to conduct attacks amidst the Israel-HAMAS conflict. For the United States, this has included Shia militant rocket and unmanned aircraft system (UAS) attacks against U.S. facilities in Syria and Iraq, leveraging a longstanding capability. Both Iran and Lebanese Hizballah are conducting or permitting dangerous actions that demonstrate their increased risk tolerance within the current crisis. So far, they appear to be avoiding dramatic actions that would immediately escalate the contours of the current conflict or open up a concerted second front with Israel. However, in the present regional context, their actions and those of their proxies carry great potential for miscalculation. (U)

The Enduring Challenge of Violence by Lone Actors (U)

Violent extremists who are not members of terrorist groups will probably remain the most likely to carry out a successful attack in the United States over the next several years. The recent resurgence of such attacks in Europe, and the context of the ongoing HAMAS-Israel conflict reinforces our assessment. By their lack of affiliation, lone actors are difficult to detect and disrupt. While these violent extremists tend to leverage simple attack methods, they can have devastating and outsized consequences, as we have experienced in the Homeland with attacks in San Bernadino, CA; Orlando, FL; El Paso, TX; and in Buffalo, NY, to name a few. (U)

Since 2010, violent extremists influenced by or in contact with ISIS, al-Qa`ida, and other foreign terrorist organizations have conducted 40 attacks in the United States that have killed nearly 100 and injured more than 500 people. In 2022, there were two such attacks in the United States, which is a decline of about 70 percent compared to the seven attacks in 2015-the height of ISIS's territorial control in Iraq and Syria and English-language messaging efforts. This averages out to a decline of almost 7 percent year-on-year during this period. The last Foreign Terrorist Organization-inspired lethal attack was in August 2021. However, we are on high alert for whether the current conflict in the Middle East may prove to be a catalyst for individuals to mobilize for attacks. (U)

Similarly concerning is the threat posed by the interconnected, transnational RMVE movement, particularly the foreign dimensions of this threat and its reach into the Homeland. NCTC continues to work closely with the Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), and our international partners to address this particular global phenomenon. (U)

The transnational nature of the threat is apparent from past RMVE attackers and plotters abroad, particularly the Norwegian attacker in 2011 and the Australian attacker in New Zealand in 2019. These previous foreign RMVEs have been particularly influential for likeminded individuals globally, with at least six subsequent RMVE attackers worldwide claiming inspiration from the writings of the Norwegian attacker and at least four citing the Australian attacker, including his use of social media to livestream his violence. Similarly instructive is the range of attacks by or disruptions of RMVEs globally in 2022, including in Slovakia, Brazil, the United States, the United Kingdom, France, and Germany. These attackers are part of an international ecosystem of individuals who share violent extremist messaging, mutual grievances, manifestos of successful attackers, and encouragement for lone actor RMVE violence. The transnational RMVE movement is largely fluid, fragmented, and lacking hierarchical structures. It is driven by individuals and networks that share racially and ethnically-based perceived grievances and messaging to incite violence, frequently framing actions around the concept of leaderless resistance. (U)

International Terrorism Landscape Impacts Homeland (U)

Attacks abroad inspire more than just lone attackers and RMVEs in the Homeland, and we remain concerned about keeping our borders secure should individuals with links to transnational terrorist actors such as ISIS, al-Qa'ida, or Iranian state agents attempt to enter the United States. Our efforts during the last two decades to build and enhance the screening and vetting system that guards against potential terrorist travel to the United States stands as one of our most valuable CT tools. Improving and sustaining our ability to identify, prevent, and disrupt such movement-whether by land, sea, or air- remains a critical priority in an era of increased global travel and migration. (U)

NCTC's support to the U.S. Government's screening and vetting enterprise plays a critical role in refugee and immigration processing by identifying any connections to international terrorism. We review about 30 million new travel and immigration applications annually-in addition to over 120 million continuous reviews-to enable DHS and the Department of State to prevent terrorist travel to the United States. (U)

We also work closely with our Intelligence Community colleagues to uncover, assess, and support actions to disrupt intersections between international terrorist and travel facilitation networks that could become potential threat vulnerabilities. While we have no credible or corroborated information to suggest that terrorist groups are currently trying to use such travel for operations, we know that terrorist actors have in the past considered or attempted different travel routes which reinforces our work to safeguard the United States. (U)

Preserving NCTC's Critical Mission and Flexibility Within an Evolving National Security Environment (U)

Over the past 20+ years, the U.S. Government has developed a highly integrated, innovative, and effective CT enterprise that continues to adapt to the changing threat. CT practitioners work behind the scenes every day to ensure that interconnected CT operations and programs are effectively used against the highest priority threats, employing a wide range of tools to do so, including identity intelligence, diplomatic security, sanctions, law enforcement investigations, direct-action operations, and partner capacity building efforts. (U)

As a critical part of that integrated community, NCTC fulfills its key missions, as directed by the Intelligence Reform and Terrorism Prevention Act of 2004. NCTC serves as the primary organization in the U.S. Government to analyze and integrate international terrorism information; conduct strategic operational planning for counterterrorism activities and integrate all instruments of national power; ensure all agencies have access to and receive needed support to execute their counterterrorism plans; and serve as the central and shared knowledge bank on known and suspected international terrorists and international terrorist groups. (U)

NCTC sits at the intersection between foreign and domestic intelligence demands, and works to track threats across that divide in a way that is both effective against the threat and protects Americans' privacy and civil liberties. As an example of our critical intelligence fusion role, in 2007, NCTC established the Regional Representatives program to station analysts in the field charged with sharing timely and relevant intelligence, conducting training, providing finished intelligence products, and offering by-request support to the FBI, DHS, and their partners for CT operations. These Regional Representatives in select locations enable front-line support to DHS and FBI, as well as other federal, state, local, and private sector partners, and use the deep expertise, unique accesses, and connectivity of NCTC to serve as force multipliers against an array of international terrorist threats. (U)

NCTC is one part of the incredible confluence of capability housed in more than a dozen U.S. agencies that make up the CT enterprise. Our whole-of-government CT architecture must work across the spectrum of the threat landscape to quickly identify new threats and overcome enduring challenges that might allow space for terrorists to advance attacks. Our role in continuously evaluating and assessing the worldwide terrorist threat enables the CT community to focus its efforts on keeping the United States safe from the myriad terrorist threats we face. (U)

Vital to our CT efforts are intelligence collection tools, especially Section 702 of the Foreign Intelligence Surveillance Act, which provides key indications, warnings, and international terrorist disruptions to the entire CT enterprise, and has done so since its inception in 2008. We regularly leverage the essential authority of Section 702 to provide insight on foreign terrorists and their networks overseas. NCTC's Section 702 program focuses on reviewing communications by known and suspected terrorists, conducting international terrorist network development, and garnering insight into international terrorist operations. One of the most important questions for NCTC to determine is whether international terrorists could gain access to and pose a threat to the Homeland. Section 702 is essential for our ability to do that, and without it, the United States and the world will be less safe. (U)

It is clear that the significant CT pressure brought to bear against terrorist groups over the last two decades, along with investment in effective CT defenses here at home, has resulted in a diminished threat to the United States Homeland. As evidenced by the events of the past month, however, our country must preserve CT fundamentals-such as collection, warning, analysis, disruption, information sharing, and key partnerships- to ensure constant vigilance. (U)

I would like to end with thanks to the professionals of the intelligence, diplomatic, military, and law enforcement communities, whose dedication to the CT mission has done so much to protect this country from persistent terrorist adversaries. It is a community the United States has relied upon time and again, and today is no exception. I am honored to be part of the CT enterprise and to work on behalf of the American people. (U)

###