By Anne Speckhard, Ph.D. and Ahmet S. Yayla, Ph.D.
Thirty-eight ISIS defectors from Syria, Western Europe, and the Balkans interviewed over the last year in our ISIS Defectors Interviews Project reported about life inside ISIS and their reasons for ultimately risking their lives to escape. The defectors also shared their observations of the ISIS intelligence operation—known in Arabic as the “Emni. ” From the defectors’ detailed stories, supplemented with journalists’ reports, and our own experiences interviewing terrorists over the years, we have been able to piece together a chilling view of the structure, leadership, duties, funding, and patterns of communication of the ISIS Emni. Relying primarily on first person accounts, this article sheds light on the highly organized activities undertaken by the Emni, since the first days of the “Islamic State’s” inception, to become one of the most totalitarian and brutally efficient terrorist organizations to date alongside its aspirations for attacking the West (what the Emni labels as “external operations”).
The name “Emni” derives from the Arabic word emniyyah (transliterated into English), which has its root in the Arabic word for trust, and basically means “gained intelligence”. The ISIS Emni is responsible for collecting intelligence, both inside the “Islamic State” (IS) and external to it, as well as planning external attacks globally.
The Emni’s duties, which will be elaborated in detail in the ensuing sections, include but are not limited to:
Collecting intelligence for battles in Syria, Iraq, and elsewhere
Gathering intelligence about everyone who lives inside the “Islamic State”
Gathering detailed intelligence about areas that ISIS intends to overtake
Studying new recruits to the group, especially those that appear without “referrals”
Gathering and analyzing intelligence about possible attacks against IS
Spreading ISIS propaganda and fear inside IS and globally, beyond its borders
Recruiting and deploying foreign fighters for intelligence gathering and attacks in their home countries
Feeding ISIS media centers about ISIS inspired and ISIS directed external attacks
Sending and deploying spies and recruiters in Turkey and in other countries , including spying upon the Syrian refugees who are fleeing the violence
Monitoring ISIS’s logistical support operations inside Turkey to ensure that there are no leaks or interruptions
Interacting with agents from other rival terrorist groups and states, including those from Assad’s intelligence.
Any kind of critical “dirty job” including organizing slave, oil, wheat and antiquities trade, as well as assassinations, kidnappings, and bartering for hostages
ISIS Hierarchy & the Emni
As we learned from defector interviews, ISIS is a very hierarchical organization, and its members work their way up the ranks. Those at the very bottom, lacking in any skills useful to ISIS, or who displease ISIS leaders in any manner (including learning information that ISIS wishes to cover up), often end as disposable “cannon fodder”—being ordered to “volunteer” for suicide missions or sent to the front lines where they are highly likely to be killed.
The pinnacle of ISIS membership is to be admitted into the prestigious Emni where they will enjoy more authority, power, and status than the other relatively high-status positions in ISIS, such as becoming members of the ISIS police (hisbah) or foreign fighters. Cadres in the Emni also have a lot of money at their disposal.
The Emni has a centralized structure as well and follows a detailed intelligence hierarchy and operations set out by Haji Bakr, a former colonel of Saddam’s army (discussed further in the next section). The Emni’s headquarters are located in the Syrian town of al-Bab. Its last known chief was thirty-nine-year-old ISIS spokesman Abu Muhammad al-Adnani (previously known as Taha Sobhi Falaha), born near Idlib, Syria. Al-Adnani was killed in August 2016 by a U.S. airstrike in al-Bab. According to a recent ISIS defector, the current Emni leader of Raqqa goes by the kunya of “Dr. Samir,” and is considered one of the strongest and most powerful figures of ISIS in Raqqa. However, senior American intelligence and defense officials name the current leader as either one of two top lieutenants of Mr. Adnani who may have taken over when he was killed: either a French citizen who goes by the Arabic kunya (nom de guerre) Abu Souleymane al-Faransi (father of Souleymane, from France) or a Syrian who is known as Abu Ahmad. Ludovico Carlino, a senior analyst with IHS Conflict Monitor in London, raised the prospect of Abu Souleymane, who is a Frenchman of either Tunisian or Moroccan ancestry, being promoted to the top terrorism planner for Europe versus all of the Emni after Mr. Abaaoud’s death, (another ISIS Emni operative discussed in detail further on.)
The Emni’s Intelligence Operations for Governing and Expanding the “Islamic State”
One of the many things that multiple defectors described, were the many Iraqi former Baathists leading the organization, even in Syria, who had brought with them the tradecraft and totalitarian intelligence operations they had practiced in Saddam Hussein’s government. These ISIS intelligence agents very cleverly embedded their own cadres into groups that opposed them as well as “turned” or recruited select individuals from rival groups into assets to serve ISIS. ISIS leaders could thereby learn key information about opposing groups, their fortifications, and weak spots prior to attacking. Likewise, these embedded spies or ISIS “assets” also murdered important leaders in the opposing group, set off explosions, and even ran suicide operations to spread unease and terror throughout the rival group, to weaken it prior to ISIS attacking.
In one case, an individual who had been recruited from al Nusra told us about being returned to his regiment as an undercover spy for ISIS. When it came time for ISIS to attack, he was instructed to remain with al Nusra and wear clothing with some special markings that ISIS fighters would recognize, so as not to kill him by accident. He was to remain “in role” throughout the battle, even killing ISIS cadres if necessary to avoid being caught as a spy. Following orders, he killed an approaching ISIS cadre and was dumbfounded when a fellow al-Nusra leader reassured him that what he had done was correct. They had each, unknown to the other, been embedded as ISIS spies.
Well before their arrival, the Emni also places well-paid informants in villages they intend to invade to map out the political and ideological stands of those living there. Upon capturing the village, and given they have already categorized the people, their modus operandi is to quickly order and carry out assassinations of those they have identified as enemies, or incapable of working with them.
Twenty-four-year-old Abu Tahir, a Syrian defector told us, “ad-Dawlah [ISIS] started to kill the leaders of opposition before the ad-Dawlah army arrived to fight. So at different places we had been seeing many leadership being killed before the fight by ad-Dawlah spies. There was a bridge in Deir ez-Zor. It is the only way to enter Deir ez-Zor, anyone that controls that bridge controls Deir ez-Zor. Of course no one has boats. Ad-Dawlah came from Raqqa and surrounded Deir ez-Zor from two sides. They captured the bridge and then ordered their people inside ad-Dawlah who had embedded as spies inside Jabhat al Nusra and Jaysh al Hur inside Deir ez-Zor to rise up and create check points and tell the people that ad-Dawlah had captured the city before they had even entered the city [to avoid any fighting by tricking the people].”
The Emni also carefully studies the population of areas they gain control of to safeguard their positions and to eliminate all dissenters inside the borders of the “Islamic State.” Having learned well from Saddam’s totalitarian state, paid informants are placed everywhere inside ISIS, creating a widespread fear of defying the group in any manner. ISIS defectors were even skeptical of their own family members, including young children, fearing that they may have been turned into informants. Some observed children as young as 6 and 7-years-old being trained and deployed for intelligence work. ISIS cadres also reported that they were loath to divulge to other members their doubts and disgust with ISIS’ brutality for fear of being informed upon and punished. Multiple examples were given of beheadings and assassinations for speaking out in any manner, or for expressing doubts about ISIS.
One Syrian defector, a 35-year-old from Deir ez Zor joined ISIS in 2014 after concluding that they practiced Islam better than the other militias, but defected a year later over the behavior of the ISIS Emni. He was upset that when he invited Free Syrian Army soldiers to join ISIS and gave them guarantees that they were not going to be harmed if they surrendered to ISIS, the ISIS intel killed them all without even holding any trial. (Interview in November 2016).
The Emni is also responsible for finding spies inside ISIS: capturing, interrogating, torturing, and eventually having them executed. When foreign volunteers to ISIS appear in Syria, they are held for up to a week in an ISIS holding center near the border, where they are questioned and investigated to be sure they are not spies. Those that are not trusted are sent to the front lines to either prove themselves as valiant or die. Captured documents in Aleppo reveal that the Emni keeps detailed lists and personnel files on the foreign fighters that join them, including letters of application detailing their level of religious knowledge, former military training and terrorism references, including their telephone numbers, and even their hobbies.
Origins of the ISIS Emni
The origins of the ISIS Emni were revealed in a chance discovery of documents in 2014, owned by Haji Bakr (aka Samir Abd Muhammad al-Khlifawi), a former colonel in the intelligence service of Saddam Hussein’s Air Defense Force. Haji Bakr became the architect of ISIS’s intelligence apparatus—the Emni. Previously jailed in Abu Ghraib and Camp Bucca, along with ISIS leader Abu Bakr al-Baghdadi and other embittered former nationalistic Iraqi intelligence officers, Haji Bakr emerged in the leadership of a group, who after plotting together in Camp Bucca during the time period from 2004 to 2008, reunited in 2012 to birth the clandestine group that eventually became known as the “Islamic State.” Interested in retaking power and asserting Sunni dominance and by making Abu Bakr al-Baghdadi, their emir and later “caliph” of what in actuality operates as a totalitarian state—these former intelligence officers cleverly gave the group an Islamic face, carefully modeled after the former Iraqi regime but now cloaked in Islamic garb.
Haji Bakr was sent by the group into Syria in late 2012, as a part of a tiny advance cluster, with the mission to help plot out the steps for the emergent “Islamic State,” to capture as much territory as possible in Syria, and from there to launch an invasion back into Iraq. Haji Bakr settled obscurely in the small Syrian town of Tal Rifaat, north of Aleppo, where he put his immense knowledge of Saddam’s intelligence and totalitarian practices to work, charting out the invasion of Syria and emergence of the “Islamic State”—plans that were later meticulously carried out by ISIS.
Haji Bakr was killed by a Syrian rebel group in 2014, but not before he had transmitted his knowledge and intelligence plans learned inside Saddam Hussein’s former totalitarian regime to the nascent “Islamic State.” The documents he produced, discovered after his death, consist of 31 pages of handwritten organizational charts, lists, and schedules, all of which describe how to step-by-step subjugate a nation. Christoph Reuter who broke the news, wrote, “They reveal a multilayered composition and directives for action, some already tested and others newly devised for the anarchical situation in Syria’s rebel-held territories. In a sense, the documents are the source code of the most successful terrorist army in recent history.” In addition, they were the code for a band of determined terrorists to emerge not only as an insidiously brutal terrorist group, but also as a totalitarian state, capable of ruthlessly ruling its citizens and territory.
Just as our interviewed defectors recounted, Haji Bakr’s plan outlined the following steps: “Islamic State” recruiters first opened a dawa [Islamic teaching] office in the towns they planned to take over, all in an effort to win hearts and minds of locals. In these centers, they recruited spies among those who attended lectures and courses on Islamic life. Most were in their twenties, but some as young as 16 and 17-years-old were instructed to spy on their own people, report back lists of the powerful families in the village, and provide details about individuals within those families, their sources of income, and any compromising information that might make them fall prey to blackmail—particularly their shariah (Islamic law) violations. Likewise, these spies formed lists and descriptions of rebel brigades in the village, their leaders and political orientations. Infiltration was then followed by the elimination of any individual deemed as a potential leader or opponent to ISIS. Moreover, following the lead of other terrorist groups (Basaev’s Chechen rebels for instance), Haji Bakr instructed some of the “brothers,” ostensibly sent in as dawa teachers, to marry local women from the prominent families to “ensure [ISIS] penetration of these families without their knowledge.”
Following this blueprint, ISIS overtook Syria, village by village, often completely surprising the residents and avoiding heavy battle losses. The ISIS Emni, following the plans of Haji Bakr, relied on surveillance, espionage, murder, and kidnapping to pave the way for the powerful totalitarian state structure of the “Islamic State,” while also disguising itself under the religious cover of Islam and thereby exploiting the religious faith of others to gain ultimate power. Bakr’s plan was to emulate Saddam Hussein’s omnipresent security organs, with the goal of having everyone keep an eye on each other and creating a security environment in which everyone lived in a state of fear and uncertainty about whether or not they, too, were being spied upon, achieved in short order.
Additional ISIS documents captured in Aleppo confirmed the internal surveillance system set up inside of ISIS as well as the highly complex system of infiltration and surveillance of all the groups opposing them. In the captured ISIS archives from Aleppo were long lists noting the informants installed in each rebel brigade and government militia. These lists even noted who among the rebels was a spy for Assad’s intelligence service and they repeated instructions for ISIS cadres to strategically marry into influential families ahead of overtaking villages, thereby gaining their loyalty and allegiance before ISIS emerged into power.
The Emni was also careful in surreptitiously creating fighting forces in inconspicuous military training camps in remote areas of Syria—that no one could tell who was leading. In them, they gathered foreign fighters from Arab states, Europe, and the Balkans, most having no serious military experience, and placed them under the command of battle-tested Chechens and Uzbeks that they named as the elite “special forces” of ISIS. As defectors recounted, this allowed ISIS to create blindly obedient troops who lacked knowledge of the societal terrain in which they operated and had no reasons to show mercy to locals. As a result, they fought loyally and easily followed the ISIS dictum of “hear and obey.”
The Emni also used trickery to create fear and doubt within rival Syrian rebel groups. Their fighters always appeared in black masks, giving the impression that there were far more than actually was the case. Der Spiegel reporter, Christoph Reuter, inquired “When groups of 200 fighters appeared in five different places one after the other, did it mean that IS had 1,000 people? Or 500? Or just a little more than 200?”
In April 2015 Reuter also noted, “Within IS, there are state structures, bureaucracy, and authorities. But there is also a parallel command structure: elite units next to normal troops; additional commanders alongside nominal military head Omar al-Shishani; power brokers who transfer or demote provincial and town emirs or even make them disappear at will. Furthermore, decisions are not, as a rule, made in Shura Councils, nominally the highest decision-making body. Instead, they are being made by the “people who loosen and bind” (ahl al-hall wa-l-aqd), a clandestine circle whose name is taken from the Islam of medieval times.” This is the ISIS Emni.
Haji Bakr’s hand-drawn organizational chart (below) shows his vision for the Emni, as he drew out the intelligence chain of command that included an emir, or commander, to be in charge of murders, abductions, snipers, communication, and encryption, as well as an emir to supervise the other emirs—”in case they don’t do their jobs well.”
Source: Der Spiegel
The Emni’s Role in External Relations
The Emni is also responsible for dealings external to ISIS, specifically its leaders bartering among the ever-shifting political alliances surrounding ISIS. This became evident when an al Qaeda emissary sent by Ayman al-Zawahiri bypassed Abu Bakr al-Baghdadi, the titular head of ISIS, and met with Haji Bakr instead, the Emni’s architect, along with other “Islamic State” intelligence officers.
Likewise, in 2014, Haji Bakr rekindled ties with Assad’s intelligence agents; ties made a decade earlier, in 2003, when Assad feared that victorious U.S. troops in Iraq would continue into Syria to topple his dictatorship as well. In 2003, Assad’s intel conspired with deposed Iraqi intelligence agents, including Haji Bakr, to transfer foreign fighters through Syria into Iraq. It is estimated that about ninety percent of the suicide attackers—that set off the Sunni/Shia sectarian violence and made it difficult for the U.S. military to provide security for ordinary Iraqis—had entered Iraq via Syria. Haji Bakr had cemented loyalties with the Syrian generals in 2003, who in 2014 were again happy to reunite in jointly held goals against common enemies.
Through these rekindled intelligence links, the Emni bartered for assistance from Assad’s air force—that would regularly bomb the positions and headquarters of opposing rebel groups, while leaving ISIS fighters unscathed. In return, ISIS, through its Emni, ordered their fighters to refrain from shooting at the Syrian army. Many defectors were deeply disillusioned by these clear but contradictory alliances that included the sale of wheat stores and oil to Assad, oil that later returned in barrel bombs raining down on Syrian civilians. Defectors also observed regime forces strangely giving up territory to ISIS without much of a fight, and even leaving their weapons for ISIS rather than destroying them. However, in those instances when ISIS cadres questioned the decisions of the Emni, they were sharply reprimanded with statements like, “We are a state and we can make deals with anyone we want.”
Among its many tasks, the Emni actively controls and monitors the flow of ISIS’ logistical support operations inside Turkey that have been crucial to its operations, including the flow of materials used for explosives (igniters, chemicals, fertilizers, cables, etc. that have been funded through Turkey to ISIS) and other deliveries critical to them. Although they do handle logistics themselves, they order the ISIS deployed logistical support people as they wish.
The Emni also deploys spies, assassins, and recruiters in countries where there are thousands, if not millions, of Syrian refugees. This is especially true for Turkey. A defector told us of an Emni agent who clandestinely followed and photographed an ISIS member on his R&R break into Sanliurfa, Turkey, as he met in a café with a member of the opposition. Upon his return to Syria, this ISIS member was arrested, interrogated, and shown the picture of his meeting, after which he was assassinated. The Emni in Turkey also collects intelligence about opposition groups, their activities and silences the enemies of ISIS. At least four Syrian opposition leaders who spoke out against ISIS were assassinated in Turkey under orders of the ISIS Emni.
Emni Use and Control of Communications
While ISIS is infamous for their use of the Internet and social media for globally glorifying their cause and for recruiting foreign fighters to their so-called “Caliphate”, inside Syria and Iraq, however, they strictly control Internet usage. The Internet is provided to ISIS fighters and civilians alike, in cafes referred to as ISIS “post offices”. ISIS does not rely on any high-level technical intelligence to monitor Internet usage, but instead places ISIS cadres in their “post offices” to listen in and see what is being communicated. On the technical side, their computers are also monitored in a low-tech manner for Internet history and with free downloadable apps that allow monitors to know if banned sites are being accessed. Unmonitored Internet access can also be obtained via mobile phone service in certain parts of ISIS territory but one runs the risk of discovery of having accessed these providers if his phone is searched.
The hisbah, or ISIS police, routinely stop those in ISIS territory to sporadically check cell phones of civilians and their own fighters. This is done to ensure they are not downloading religiously banned material (including music) or accessing banned sites, as well as to check if there is anything compromising in their cell phones in terms of communications with other groups, or states, to ensure that there are no spies among ISIS ranks.
The Emni also investigates the phones of captives and hostages. Several ISIS hostages who have survived reported that one of the first things ISIS cadres demanded from them were the passwords to their phones and social media accounts. Indeed, with personal information so easily accessed via the Internet, the Emni investigates foreign fighters that arrive unannounced or without referrals, as well as hostages and captives via Internet search, to learn if what they are telling them is true and to glean facts about them, such as what assets they and their families possess for procuring ransoms.
For its own communications, Emni members, learned well from their precursor organization (al-Qaeda in Iraq and al-Qaeda central) not to use e-mail or phones that could be traced by foreign intel to discover their plots and whereabouts. They prefer face-to-face communication. This is difficult, however, in those instances when the Emni needs to communicate with foreign fighters they have recruited or deployed outside Syria and Iraq, necessitating special procedures. While regular ISIS members frequently use phone communication via encrypted social media apps like Telegram and WhatsApp, the Emni may also avoid even using those means. Instead, to totally avoid security scrutiny, they rely on prearranged communication via video games, making use of the video call or chat function inside the games. Communicating behind the game platforms is clever, as they can hide and blend in between the hundreds of people playing, chatting, and communicating on the game platforms.
The Emni members are instructed to be careful with their words and not to reveal much openly about their plans as they communicate, often using cryptic phrases that they have agreed upon beforehand for passing messages. Furthermore, they use VPNs to divert the IPs from which they are connecting. Defectors have also reported that the Emni gave recruits it deploys in Europe programs such as CCleaner, a program to erase the user’s online history, as well as TrueCrypt, instructing them to upload encrypted messages into a dead inbox on a Turkish server—to avoid detection of uploaded encrypted e-mails. Likewise, the Emni also uses new converts in Europe to serve as face-to-face go-betweens to carry messages between Emni handlers and their operatives.
Foreign fighters and new recruits acting outside ISIS territory are expected to carry out attacks while minimizing communications. When the attack is imminent, ISIS usually ceases communication, expecting the ordered attack to be carried out immediately and smoothly without more communication, unless approvals for changes in the plan occur. Defectors reported that internal “chatter” often named locations of imminent attacks without providing details in the days leading up to it.
In some cases, if a local, unknown to ISIS attacker, has carried out an ISIS-inspired attack, then the Emni emir in charge of that country would also initiate contacts through video games to begin ISIS media claims that their attacks are carried out in the name of ISIS.
The Emni’s role in Attacks in the West
ISIS has declared its desire to expand its “Caliphate” beyond the borders of Syria and Iraq, and has worked hard to recruit and plan attacks in the West—tasks also carried out by the ISIS Emni. According to interrogation reports of arrested ISIS members in Europe and Australia, the Emni have sent their operatives into Austria, Germany, Spain, Lebanon, Tunisia, Bangladesh, Indonesia and Malaysia. Internal reports from ISIS informants have revealed that the Emni has placed hundreds of its operatives in the European Union, including hundreds in Turkey alone. It is now understood that Emni trained operatives carried out the 2015 Paris café, stadium, and nightclub attacks as well as recruited the cadres for and built the bombs used in the 2016 Brussels airport and metro attacks. They have also been involved in plotting and carrying out many more attacks globally—multiple attacks in Turkey, Tunisia, and Bangladesh included. A New York Times review of interrogation records provided from European capitals, revealed that the Emni operatives are selected by nationality and grouped by language into small, discrete units (similar to what defectors told us) whose members sometimes only meet one another on the eve of their departure abroad.
This account is confirmed in the interrogation records of an Algerian ISIS cadre named Adel Haddadi who entered Europe alongside Syrian refugees and was eventually interdicted and arrested in an Austrian migrant camp, outside of Salzburg. He met his co-conspirators only days before leaving ISIS territory, when ISIS Emni leader, Abu Ahmad (who some believe has now taken over after al-Adnani was killed), gave them his Turkish (versus Syrian) cell phone number telling them to label him as FF on their phones. He wanted them to communicate with a Turkish phone that he parked near the border inside Syria, believing it would not raise the same suspicions as calls into Syria. He also supplied the men with two thousand dollars—all in one hundred dollar bills—and had them driven to the Turkish border where another ISIS cadre took their pictures and supplied them with fake Syrian passports, while yet another ISIS paid smuggler inside Turkey arranged their boat travel to Leros, Greece. Haddidi kept in touch with Abu Ahmad via the encrypted app Telegram as well as text messages on Abu Ahmad’s Turkish phone and received money orders via the Western Union. This same Turkish number was also found on a slip of paper in the pants pocket of the severed leg of one of the suicide bombers at the Stade de France. 
The Emni top leaders identify who among Western ISIS cadres is to be sent back. They choose targets and organize logistics for operatives, including paying smugglers to get them to Europe and, according to European intelligence documents, in at least one case, sending Western Union transfers. That ISIS hierarchy is strictly observed inside the Emni as well is also confirmed by one of the hostages in the Bataclan concert hall who overheard one of the bombers in a moment of doubt, asking his compatriot, “Should we call Souleymane?” referring to a Frenchman who is believed to be one of the top Emni leaders. Emni operatives sent abroad work with autonomy regarding tactics and strategy, but they must have a green light from their Emni leaders before embarking on an attack, noted Jean-Charles Brisard, chair of the Center for the Analysis of Terrorism in Paris. 
Harry Sarfo, a German of immigrant descent from Ghana, and now ISIS defector jailed after his three-month stint with ISIS, gave testimony to German prosecutors and was interviewed by journalists about his interactions with the Emni. According to Sarfo, he arrived to ISIS territory only to be met shortly thereafter by masked Emni members who told him that ISIS wanted Europeans like him to stay in his home country, or once arrived to ISIS, train and quickly return for attacks at home. According to Sarfo, the Emni wanted to plan Western attacks “that happened everywhere at the same time.”
Similarly, another European, Reda Hame, a 29-year-old computer technician from Paris who was arrested in August 2015, was only a week into ISIS membership when the Emni approached. His work as a computer technician for Astrium, a subsidiary of the French aeronautics giant Airbus, and French passport, made him attractive to the Emni. In a six-day training course outside of Raqqa, Hame was shown how to fire an assault rifle, hurl a grenade at a human silhouette, and use an encryption program to enable him to keep in touch with his handlers back in Syria.  When Hame was sent back to Europe, his Emni handler drove him to the Turkish border and supplied him with two thousand Euros, passwords to encrypted online forums, and instructions to “Hit a concert hall to cause the maximum number of casualties.” He was also told to pick an easy target and to take hostages while shooting as many civilians as possible until security forces made a “martyr” of him, which is exactly in line with what happened in ISIS attacks carried out by others in the Fall of 2015 in Paris.
Hame’s handler was none other than Emni leader, Abdelhamid Abaaoud—the architect of the deadly 2015 Paris attacks—whose cell also carried out the 2016 Brussels airport attacks. Abaaoud, known in ISIS by the kunya Abu Umar al-Baljiki (father of Umar from Belgium), left Belgium via Germany to join ISIS, where he quickly rose up to become the head of an Emni unit devoted to sending Europeans ISIS cadres to attack at home.  Abaaoud is now believed to have also recruited and directed Mehdi Memmouche, a French ISIS cadre returned from Syria who shot down visitors in front of the Jewish Museum in Brussels in May 2014.  Abaaoud clandestinely crossed back and forth from Syria into Europe to purchase weapons, recruit others, plot and direct attacks in France and Belgium. At times, he directed attacks from Greece, before he was nearly arrested and escaped back to Syria, only to resurface again in Europe where he again plotted out the infamous Brussels and Paris attacks. Abaaoud is believed to have also mentored the Moroccan born Ayoub al-Khazzani who attempted to kill passengers on a high-speed train from Amsterdam to Paris but was taken down by off-duty American soldiers. Additionally, he is believed to be behind the lesser-known foiled attacks on a Belgian police station, priests in France, and the successful killing of a ballet instructor. 
Ibrahim Boudina, arrested in February 2014, was another European ISIS operative sent back to attack. Pulled over only four miles from the Turkish border by Greeks, he was questioned but released, as there was no warrant for his arrest in Europe. That happened despite the fact that the Greek police found fifteen hundred Euros in his car and a French document entitled, “How to Make Artisanal Bombs in the Name of Allah.” It turned out that Mr. Boudina’s residence was already being wiretapped by the French police as he was on their watch list as part of a cell of 22 men radicalized at a mosque in Cannes, France. Only a few weeks after being stopped by Greek police, Boudina’s mother received a call from Syria informing her that her son had been sent on a mission. While searching his building police discovered 600 grams of TATP, the same explosive used in the Paris and Brussels attacks in a utility closet.Evidently, Boudina had been well trained in Syria for explosives preparation.
Algerian born Sid Ahmed Ghlam, a university student residing in France, also appears to have been recruited and handled remotely by the Emni in Syria. He murdered a French woman while trying to take her car, apparently to be used in an ISIS directed attack. Having traveled to Turkey for a ten-day stay, Ghlam potentially represents one of the Emni recruits who crossed briefly into Syria, was trained, and then quickly sent back as to remain undetected by security services. French police stated that Ghlam appeared to have received instructions on how and where to obtain a Kalashnikov, pistol, bullets, and bulletproof vests, and was given orders from Syria to mount an attack on a church in France.
Mohamad Jamal Khweis, a 26-year-old American from Alexandria, Virginia, who joined “Islamic State” but defected during his training, also claimed that the Emni approached him about their desire to send him back to the U.S. to attack. According to Khweis, foreigners trained by the Emni to return home to mount attacks had to “be single, train in remote locations, be free of any injuries, and had to agree to remain reclusive when returning to their home countries.”
According to former ISIS cadre, German Harry Sarfo, there were ten grueling levels of training one must undergo to become an Emni operative; training that included running, jumping, push-ups, parallel bars, crawling, swimming, scuba diving, sleeping in holes in the ground, navigating by the stars, and surviving on limited food and water rations and in difficult conditions in the desert. Upon completion of all ten levels, recruits were blindfolded and driven to pledge their allegiance—still blindfolded, to then Emni leader, Abu Muhammad al-Adnani.
Sarfo was only three days in ISIS occupied Syria before being approached in 2015 by masked men from the Emni who told him they were looking for Europeans, particularly Germans and British citizens who were willing to return for attacks at home. They claimed to have more than enough French fighters willing to do so, but lacked British and German volunteers. Sarfo recounted being told that al-Adnani had set up an elaborate system of lieutenants posted globally, each empowered to plan attacks in different parts of the world, including a “secret service” for European affairs, Asian and Arab affairs.
Harry Sarfo claimed that Emni’s undercover operatives in Europe evade detection by making use of “clean men” who are new converts with no known ties to extremist groups as go-betweens. They link up new recruits who have been drawn in by ISIS propaganda and want to carry out attacks with trained underground operatives who instruct them on everything from how to make a suicide vest to how to credit their violence to the “Islamic State.” This ensures that the underground Emni operatives avoid direct contact with the new recruits, remaining hidden while giving out instructions and receiving videotaped pledges of “martyrdom” and allegiance to ISIS for upload and use by ISIS’ propaganda channels.
ISIS Media Centers and the Emni
ISIS media centers also work under the direction of the Emni, which until recently were being run by al-Adnani, who also functioned as the ISIS spokesman. The Berlin rapper, Denis Cuspert (aka Deso Dogg), is also believed to have had a key role in the ISIS media arm, al Hayat, formed in May 2014. Al Hayat is one of the key media arms of ISIS that produces videos in multiple languages, including English as well as its online magazine Dabiq to recruit for ISIS. Before his death, Cuspert often starred in these videos as a key propagandist to attract Western recruits. ISIS media is carefully crafted for recruitment and propaganda purposes, sometimes glorifying ISIS barbarity, but also spending considerable effort attempting to convey a stable and utopian state. In recent years, al-Adnani called for supporters of ISIS to attack and kill Westerners with stabbings, vehicles, and even using a rock as a weapon to crush their skulls. He also promoted the militant jihadi view of “martyrdom” missions frequently pushing out media that glorified home-grown and ISIS inspired suicide attacks in the West. ISIS media centers are not allowed to push any news or analysis about attacks or incidents happening external to “Islamic State” without the control of the Emni.
The Emni receives a significant share of the “Islamic State’s” budget, which is used for propaganda and paying intelligence agents and informants, among other things. Before the heavy onslaught of Russian and Coalition bombings in 2015-2016, ISIS had no shortage of funds from the sale of oil, slaves, wheat stores and antiquities, bank robberies, and taxation/extortion of cash from those living inside its territory. Funding, up until recent military inroads on ISIS financing, has not been an issue for the Emni who appear to have had large sums of cash at their disposal. Abdelhamid Abaaoud was well financed to travel, rent apartments, move ISIS cadres and to purchase fake passports, weapons, and the necessary ingredients for explosives. French press reported that, according to an interrogated French ISIS cadre, (most likely Reda Hame) Abaaoud was responsible for selecting candidates who could be paid as much as fifty thousand Euros for carrying out attacks. Although typical for ISIS, two Tunisians above Abaaoud in the Emni hierarchy had to sign off beforehand on who would be sent for which missions.
For international operations, under normal circumstances, fighters would not carry large sums of money. Instead, money is sent to different countries in Europe, via the Western Union or MoneyGram via ISIS cadres in Gaziantep or Istanbul. Emni members in Turkey arrange the transfers to occur in smaller amounts to avoid attracting attention, making use of a depositor who is not a member of the Emni.
Emni Selection and Training
Emni members are considered the “cream of the crop” and chosen accordingly based on their loyalty and abilities. Those with Western passports who are recruited by ISIS to attack back in their homelands become members who do not stay long in Syria and Iraq, particularly since late 2014 when Western intelligence became more proactive stopping travelers to ISIS and placing them under surveillance upon their return. To avoid detection, the Emni currently instructs foreigners coming to ISIS to book a holiday package in Southern Turkey, complete with a return flight, but instead of taking a vacation, the new recruits are smuggled into Syria for a short time during which they quickly receive the necessary explosives training and are sent back to their home countries where they are handled both by locally placed ISIS emirs and Emni members still in Syria.
Those from Syria and Iraq who serve in the Emni are not at first directly assigned to it. They are first tested in different parts of ISIS and, if deemed successful and trustworthy, are transferred to the Emni. Emni members are trained based on the needs and the area they are going to work and receive their training onsite, being mentored as they work under senior members. The only specialized courses for Emni members are for military, explosives, and weapons training.
Trust, loyalty, and commitment are key factors for a posting in the Emni, especially if the ISIS member is going to be assigned outside of Syria and Iraq. Caution is taken because there were several Emni members sent outside Syria and Iraq who later cut their ties with the ISIS. They basically used the Emni as a means to escape ISIS. As a result, ISIS is very careful not to send people out of their borders if there is not ultimate trust.
European recruits who are deployed after receiving quick training receive a great deal of autonomy in choosing their targets and modes of attack, as are those who never make it to Syria but are drawn into Emni directed operations by ISIS’s online seduction campaign. In its online French magazine, Dar al-Islam, ISIS quoted a French security blog that likened some of its attacks to German 19th-century techniques in which commanders gave their subordinates a goal and timeframe for completion of the attack with complete freedom to execute it. The ISIS author implied that in order to avoid detection, the Emni follow German techniques as they deploy their recruits, giving them “complete tactical autonomy” with “no micromanaging.”
The ISIS Emni is the core structure that gave birth to ISIS both as a terrorist group and as a nascent totalitarian state. The Emni was formed by disgruntled former Sunni Baathists dismissed from the intelligence regime of Saddam Hussein following the 2003 American coalition invasion of Iraq. Angry over Shia ascendance in Iraq and security violations against Sunnis, and fiercely nationalistic, strategic and fanatical in their drive to put Sunnis back into power, the ISIS Emni have shown themselves willing to clothe themselves in Islamic garb in order to manipulate the masses. Yet, under scrutiny, it is clear that there is nothing Islamic in their actions, nor in their corrupt and ever shifting alliances, calculated plotting, masterfully carried out propaganda campaigns, and Internet seduction. As Christoph Reuter wrote of ISIS, “Faith, even in its most extreme form, is just one of many means to an end. Islamic State’s only constant maxim is the expansion of power at any price.” Power and restoration of Sunni dominance in Iraq and Syria is the main mission of the ISIS Emni and calculated manipulation of faith is only a means to an end.
 Speckhard, A., & Yayla, A. S. (2016). ISIS defectors: Inside stories of the terrorist caliphate. McLean, VA: Advances Press, LLC.,
 Speckhard, A., & Yayla, A. S. (2016). ISIS defectors: Inside stories of the terrorist caliphate: McLean, VA: Advances Press, LLC.; Shajkovci, Ardian (August, 2016). Personal communication regarding unpublished ISIS interviews with Bosnian and Albanian defectors dated 2014).
 Yayla, Ahmet S. (September 2016). Unpublished interview with an ISIS defector.
 Callimachi, R. (August 3, 2016). How a secretive branch of ISIS built a global network of killers. New York Times. Retrieved from http://www.nytimes.com/2016/08/04/world/middleeast/isis-german-recruit-interview.html?_r=0.
 Fernandez, M. A. (February 2, 2016). Lining up the tools to break the Islamic State Brand. The Washington Institute. Retrieved from http://www.washingtoninstitute.org/policy-analysis/view/lining-up-the-tools-to-break-the-islamic-state-brand
 Yayla A & Speckhard, A (August 9, 2016) No Coincidences in Terrorist Attacks, ICSVE Brief Reports. https://www.icsve.org/brief-reports/no-coincidences-in-terrorist-attacks/;
Anne Speckhard, Ph.D. is Adjunct Associate Professor of Psychiatry at Georgetown University’s School of Medicine and Director of the International Center for the Study of Violent Extremism (ICSVE). She is also the author of Talking to Terrorists, Bride of ISIS, and co-author of the newly released ISIS Defectors: Inside Stories of the Terrorist Caliphate, Undercover Jihadi, and Warrior Princess. Dr. Speckhard has interviewed nearly 500 terrorists, their family members, and supporters in various parts of the world including Gaza, West Bank, Russia, Iraq, Jordan, Lebanon, Turkey and many countries in Europe. In 2007, she was responsible for designing the psychological and Islamic challenge aspects of the Detainee Rehabilitation Program in Iraq to be applied to 20,000 + detainees and 800 juveniles. For a complete list of publications for Anne Speckhard see: https://georgetown.academia.edu/AnneSpeckhard and www.icsve.org
Ahmet S. Yayla, Ph.D. is the Deputy Director of the International Center for the Study of Violent Extremism (ICSVE). He is also Adj. Professor at the Department of Criminology, Law and Society at George Mason University and formerly served as Professor and the Chair of the Sociology Department at Harran University in Turkey. Dr. Yayla earned both his Master’s and Ph.D. degrees in Criminal Justice and Information Science from the University of North Texas in the United States. Dr. Yayla served as the Chief of Counterterrorism and Operations Division for the Turkish National Police.
Both authors are sought after counter‐terrorism experts and have consulted to NATO, OSCE, foreign governments and to the U.S. Senate & House, Departments of State, Defense, Justice, Homeland Security, Health & Human Services, CIA and FBI and CNN, BBC, NPR, Fox News, MSNBC, CTV, and in Time, The New York Times, The Washington Post, London Times and many other publications.
Anne Speckhard, Ph.D. is Adjunct Associate Professor of Psychiatry in the School of Medicine and has also taught the Psychology of Terrorism for the Security Studies Department in the School of Foreign Service at Georgetown University. She is the Director of the International Center for the Study of Violent Extremism. Dr. Speckhard has been working in the field of posttraumatic stress disorder (PTSD) since the 1980’s and has extensive experience working in Europe, the Middle East and the former Soviet Union.