AQAP’s Expert Bombmaker: Ibrahim Hassan al Asiri

Abdullah Hassan al Asiri, perpetrator of the failed 27 Aug 09 suicide attack against Saudi Prince Muhammad bin Nayef and brother of Ibrahim Hassan al Asiri, assessed to be a top AQAP explosives expert and bombmaker.

As the US continues to develop a more in-depth intelligence picture of Al Qaeda in the Arabian Peninsula (AQAP), I wanted to provide some background on a potential high-value target who I believe serves as a key node in AQAP’s suicide bomber network. Ibrahim Hassan Tali al Asiri is a Saudi citizen currently assessed to be living and operating in Yemen. While his name is far from commonplace among most CT experts, he is someone we definitely should have been tracking based on his assessed involvement in AQAP’s two most recent high-profile suicide attacks. I assess that Ibrahim al Asiri serves as one of AQAP’s explosives experts and bombmakers – a critical position which requires a relatively high level of technical knowledge and experience. Most terrorist networks have few individuals with the necessary skills to fill this important role, making their kill/capture very valuable in terms of degrading the network’s capability.

Ibrahim al Asiri first drew attention after being named as the #1 target on Saudi Arabia’s “Most Wanted List,” which was released to the public in February 2009 [see an English translation of the list from the Saudi Embassy here]. Some online versions of the list that I was able to find also specifically list Ibrahim al Asiri as an “explosives expert.”

While his appearance on the Saudi list is important, things really start to get interesting when you take a look at the individual listed as #40 on the same list – Abdullah Hassan Tali al Asiri. As Christopher Boucek mentions in his recent article in the CTC Sentinel, Ibrahim al Asiri (#1) is assessed to be the brother of Abdullah al Asiri (#40). This relationship is confirmed in an article from the Saudi Gazette, which provides a profile of the entire family and explains how Abdullah (the younger brother) was recruited into AQAP by his older brother, Ibrahim.

If the name Abdullah Hassan al Asiri sounds familiar to you, it should. He was the perpetrator of the failed suicide attack against Saudi Prince Muhammad bin Nayef (the lead Saudi CT official) back on 27 Aug 09. Prior to this attack, Abdullah made contact with Prince Muhammad and claimed he wanted to turn himself in to Saudi authorities. Prince Muhammad agreed to meet him in person and during their meeting Abdullah detonated a PETN-based explosive device which was hidden in his underwear (which of course bears a striking resemblance to the TTP employed by Umar Farouq Abd al Mutallab during his failed midair attack over Detroit). Abdullah al Asiri was killed in the explosion, but Prince Muhammad bin Nayef was not harmed. Several weeks later, in fact, the prince met with top Obama CT officials to warn them of the growing threat from AQAP and provide details about the “underwear suicide bomb” TTP.

As we further unravel the key players involved in both attacks (the 27 Aug attack and the 25 Dec attack) and the methods employed, an article from Newsweek highlights a critical piece of information. The article quotes an unnamed US intelligence official who explains that, “U.S. officials now suspect that Nayef's attempted assassin and Umar Farouk Abdulmutallab, the Nigerian suspect aboard the Northwest flight, had the same bomb maker in Yemen.” Several pieces of evidence support this conclusion: 1) As Peter Bergen explained in an article at CNN, the explosives used (PETN-based) were virtually identical in both attacks; 2) The method of concealment (explosives hidden in the bomber’s underwear) was identical in both attacks; and 3) we know that the same group (AQAP) directed, planned, and resourced both attacks.

So, who is the most likely individual that played the critical role of bombmaker? I believe with high confidence that Ibrahim Hassan Tali al Asiri fits the bill. Additionally, I believe that he has likely constructed similar devices (or even improved versions) for use in future attacks that AQAP is planning against Western targets in the US, Europe, Saudi Arabia, and Yemen. Ibrahim al Asiri should become a top priority for US intelligence collection and targeting. His movements and communications will likely indicate the timing, target, and possibly attacker of any future attacks conducted by AQAP.

As multiple news sources have reported recently, the Obama administration has publicly warned of the impending threats against the US homeland (and other Western targets) being planned by AQAP [see articles from the NY Times, the Critical Threats Project, and STRATFOR for the best coverage of these threats]. While it’s clearly important to focus on targeting the AQAP top-tier leadership (Nasir al Wuhayshi and Said Ali al Shihri) and the recruitment/facilitation network being run by Anwar al Awlaki, I think the most effective way to disrupt impending attacks and prevent future attacks is to target the key node within the AQAP network who is absolutely necessary to provide the explosive device. I would venture to guess that as Umar Farouq Abd al Mutallab continues to provide intelligence to the FBI during ongoing interrogations, he is highlighting Ibrahim al Asiri as the individual who constructed the device he used during his failed 25 Dec attack. US intelligence and CT officials should immediately make Ibrahim al Asiri a high-priority target for collection and eventual targeting. This is our best way to stop the multiple attacks currently being plotted by AQAP.

AQAP Claims Failed Midair Plot

The Counterterrorism Blog has some great coverage of Al Qaeda in the Arabian Peninsula's (AQAP) recent claim of responsibility for the failed terror attack on Christmas Day. Only three days after the attack (Dec 28), AQAP released a message praising the "heroic mujahid...Omar al Farooq." A full translation of the media release is available from the NEFA Foundation. The text and timing of the the release tell us a few important things:

1) The AQAP media wing ("Al Malahim") is able to rapidly produce and disseminate a fairly sophisticated release. This indicates that AQAP likely has in place a robust command-and-control (C2) structure modeled similarly on the structure we saw in place in Mosul in 2008 (see my earlier post here). It also illustrates that AQAP views the recent failed attack as an opportunity to gain additional recognition and attention, a critical element of expanding their campaign.

2) The AQAP release contains a photo (see above) which shows Umar Farouq Abdulmutallab in a photo with an al Qaeda banner in the background. Although we are uncertain exactly when the photo was taken, this proves that Abdulmutallab was definitely associated with AQAP prior to the attack. It might also indicate that AQAP knew he was going to carry out the attack and wanted a photo of him to release after the attack which would prove a linkage between the attacker and AQ. This is significant and goes a long way towards confirming the claims made by Abdulmutallab that the attack was directed by AQ in Yemen. Further, the release spells out the fact that the attacker conducted the operation, "through direct coordination with the mujahideen in the Arabian Peninsula."

3) The release explains that the main reason for the attack was in response to, "the monstrous raids using cluster bombs and cruise missiles that were launched from the American warships occupying the Gulf of Aden, targeting the proud tribes of Yemen in Abin, Arhab, and lastly in Shabwa, and they killed tens of Muslim women and children, and they also killed entire families." Although an attack this complex was likely already quite far along in the planning process, AQAP was savvy enough to speed up the execution of the attack in order to make it seem like a response to the Dec 17 and Dec 24 US-Yemeni stikes on AQAP. This is similar to the response we saw from al Shabaab (an AQ-affiliated group in Somalia) after the death of Saleh Ali Saleh Nabhan in September 09. Nabhan was killed on Sep 14 and we saw a massive suicide VBIED attack three days later on Sep 17 that targeted the AMISOM HQ and killed several top African Union leaders. This appears to be a common TTP for AQ and AQ-affiliated groups who want to seize the opportunity to respond to US counter-terrorism efforts in their countries with a swift and symbolic response.

4) The AQAP media release provides some further insight into the organization and capabilities of their group when they explain that, "the mujahideen brothers in the Manufacturing Sector possessed a highly advanced device, with Allah’s grace, and it was tested and proved to be successful and practical, and it passed the inspection machines." Once again, we see parallels between AQAP and other AQ-affiliated groups, which all usually contain a separate "Logistics" structure which often constructs IEDs and other weapons and supplies them to members of the "Military" cells which then carry out the attacks. This allows the network to design advanced weapons and keep the identity of the highly valuable bombmakers secret from military cell members who may be captured and compromise their identity.

5) The release ends (as usual) with a call to arms for, "every Muslim protective of his religion and doctrine to...declare it a full-scale war against every crusader in the [Arabian] Peninsula." However, they then go a step further urging, "every soldier who works in the crusader armies and the apostate governments to repent to Allah and walk the footsteps of the heroic mujahid brother Nidal Hasan." Clearly, AQAP wants to play upon the knowledge that Anwar al Awlaki (who inspired and corresponded with Nidal Hassan) is known to live/operate in Yemen. As AQAP builds their reputation, they desire to affiliate themselves with al Awlaki, who has gained increased prominence since the Ft. Hood shooting spree. **On a related note, see our earlier posts which discuss the possibility that the Dec 24 strike by the Yemeni AF killed al Awlaki. There is still no official confirmation either way if he was EKIA.

Finally, on a separate but clearly related topic, also check out the article released on Oct 29 in AQAP's official magazine Sada al Malahim (English translation available here from the NEFA Foundation). In the article, AQAP leader Nasir al Wuhayshi (who was possibly EKIA in the Dec 24 airstrike) urges would-be attackers to target, "airports in the western crusade countries that participated in the war against Muslims; or on their planes, or in their residential complexes or their subways." While we have no way to know for certain, this could be an indication that the airplane plot was devised by top AQAP leadership and had been underway for several months. On the other hand, it could be an example of the increasingly common trend where top AQ leaders continue to push the "AQ brand" and advocate attacks, but individuals or small groups actually do the planning and conduct attacks on their own.

I think in this case, the attack was planned with the knowledge and support of top AQAP leaders. In fact, it's quite likely that the Dec 24 meeting which was hit by the Yemeni AF based on US intelligence was being held to give final approval for the attack that Abdulmutallab was going to carry out the next day. This would potentially explain why Nasir al Wuhayshi, Said Ali al Shihri, and possibly Anwar al Awlaki were all located together.

Background: Umar Farouk Abdulmutallab

For some great additional background and bio data on Umar Farouk Abdulmutallab and the circumstances behind his failed attempt to detonate a PETN-based bomb on Northwest Flight 253 over Detroit, check out the following resources:

-Steve Coll at his blog Think Tank does a great job of examining the attacks in the wider context of the overall global al Qaeda movement. He also provides a good primer on the Nigerian Taliban aka Boko Haram, which maintains loose ties with AQ and could be viewed as a "feeder" for AQAP. For more on Nigeria and Boko Haram, check out Josh's post from last month here.

-Coll also provides a link to a good, in-depth bio of Abdulmutallab from the Nigerian newspaper This Day. The article provides some interesting insight into the attacker's upbringing as well details about his father, a prominent international banker, who actually reported his own son to US authorities last month.

-Wes Bruer at the Long War Journal gives us some good background and commentary from Bill Roggio about possible links between Abdulmutallab and AQAP in Yemen.

-The NY Times provides important details about the reporting of Abdulmutallab's name to US authorities at the US Embassy in Nigeria - by the attacker's own father. The article also highlights the fact that his name was added to the TIDE (Terrorist Identities Datamart Environment) database, which is supposed to be used to track potential terrorists and provide a base for the "no-fly" list.

-Peter Bergen provides some excellent original analysis at CNN based on the method of attack and the type of explosive. He argues that there are several key similarities between the failed attack attempt by Abdulmutallab and the failed assassination attempt on Saudi prince Mohammed bin Nayef, the head of Saudi Arabia's CT efforts. The attacker who targeted Nayef also used PETN and the plot was linked back to Yemen. This link could be critical to unraveling the origins of the failed Christmas Day plot on Northwest Flight 253.

-Finally, Abu Nasr at Challenge COIN does a great job of summarizing the similarities between many of the recent terrorist attacks in the last few months, providing a rough profile that can be used to better understand the origins and motivations of the individuals who are perpetrating these attacks. His "un-politically correct" analysis is exactly the type of honest dialog we need to be having in the face of increasing domestic terrorist threats.