The Global Terrorism Landscape with the Acting Director of the National Counterterrorism Center

This transcript is from a CSIS event hosted on November 12, 2024. Watch the full video here.

Seth G. Jones: Welcome, everyone. I have the honor of welcoming, for this great discussion, Brett Holmgren, director of the National Counterterrorism Center, who was appointed by the president on July 18th, 2024. NCTC – I probably don’t need to provide much information on NCTC because I think everyone is aware of its background – but was formed after 9/11, and it is the U.S. government’s primary organization responsible for integrating, analyzing, and sharing information to protect the U.S. from terrorism and achieving some of the national counterterrorism objectives.

Mr. Holmgren served for nearly three years as the U.S. assistant secretary of state for the Bureau of Intelligence and Research. Also served as special assistant to the president and senior director for intelligence programs on the National Security Council staff. Began his career on counterterrorism at the Defense Intelligence Agency, and then moved over to become a senior analyst at the CIA. Also is a, I’m assuming very proud, graduate of the University of Wisconsin-Madison. Which means he’s a Badger with an M.A. in global security studies from Johns Hopkins University.

So, welcome. Really glad to have you.

Brett Holmgren: Appreciate it. Thank you. Thank you, Seth. And the most important line in there is I’m a proud Wisconsin Badger. So thank you for – thank you for that.

Seth, I also just want to thank you for your thought leadership on – really, on terrorism and on national security issues generally. As I noted in the way up, been a fan of your work for some time. So it’s a real pleasure to be here with you.

I also want to thank CSIS for hosting today’s event. And the purpose of CSIS is to define the future of national security. So it’s only fitting that my remarks today are intended to help define the future of the global terrorism landscape.

This past September, we celebrated the National Counterterrorism Center’s 20th anniversary. We honored the outstanding work of the tens of thousands of NCTC officers past and present who have worked tirelessly behind the scenes to keep Americans safe from terrorism at home and abroad. Their work and their contributions to our nation’s security is why I’m so proud to lead this extraordinary organization.

Now, in reflecting on NCTC’s history it was helpful to reflect on how much the global terrorism landscape has changed since President George W. Bush established NCTC in 2004. At that time Osama bin Laden and Ayman al-Zawahiri were still plotting from caves in Afghanistan and Pakistan. U.S. forces were deployed in Iraq and Afghanistan engaged in two wars.

In Iraq and elsewhere a group called ISIS didn’t exist. In the United States you didn’t have to remove your shoes at the airport. So a lot has changed over these last 20 years. The only constant is the ever-evolving nature of the threat itself. Terrorism in all its forms is underpinned ultimately by violent extremist ideology.

Ideologies can’t be defeated by governments or counterterrorism tools alone but what we can do and what we must do is have a clear-eyed assessment of the threat in order to design and implement smart, sustainable approaches that manage risks responsibly and wisely consistent with our values.

So this afternoon I’d like to describe the global terrorism threat and touch on how the U.S. government has worked aggressively to counter this evolving challenge over the last few years.

Now, today’s terrorism threat is unfolding amid tectonic shifts in the international system, a profound moment in a world marked by volatility, instability, and hostility. Governments are confronting multiple crises simultaneously involving state and nonstate actors while also trying to manage transnational issues like migration and climate change and cyber.

In this context terrorist groups like ISIS have found ways to exploit the circumstances, especially in the Middle East and Africa, to slowly and quietly rebuild. As a result, today we are in yet another transformational phase of the global terrorism landscape, a threat that is more diverse, more complex, and more decentralized.

Now, it’s more diverse because the ideological motivations and the range of foreign terrorist actors are multi-dimensional. Whereas in the past we focused mainly on monolithic groups like al-Qaida, ISIS, and Hezbollah, today’s actors also include transnational, racially, and ethnically motivated extremists, or REMVEs, anti-government and anti-authoritarian groups, home-grown violent extremists, or HVEs, and, of course, Iranian-linked entities, in particular the IRGC Quds Force.

The threat is more decentralized and distributed around the world. This is in large part due to CT successes over multiple administrations, which had the effect of forcing these groups to disperse and to operate in smaller cells in more locations to survive. As an example, the changing nature of ISIS’ footprint in Syria and its expansion across Africa reflects this new reality.

Finally, the threat is more complex because terrorists are more skilled technologically. They’re using 3-D printing and artificial intelligence to produce weapons and enhance propaganda, they’re communicating on more sophisticated platforms, and they’re turning to crypto currency and alternative payment platforms to finance their operations.

So that’s the contemporary global terrorism landscape – more diverse, decentralized, and complex – and against that backdrop let me situate the current threat to the United States.

In September of 2023 my predecessor Christy Abizaid noted that thanks to focused efforts across many administrations the terrorism threat to the U.S. homeland had been dramatically reduced to its lowest level in decades and she was right.

Unfortunately, a month later Hamas’ horrific terrorist attack on Israel and the ensuing conflict and tragedy in Gaza served as a galvanizing event for terrorist groups worldwide and it happened to come at a time when ISIS Syria and ISIS-Khorasan had begun rebuilding core capabilities.

Now, this year alone ISIS-K’s attacks in Russia and Iran, multiple ISIS linked or inspired attacks in Germany, hundreds of ISIS attacks throughout Africa, and the first ever ISIS associated attack in Amman they all signal a reenergized global ISIS enterprise.

And so today the United States and many other countries are facing an elevated terrorist threat. In addition to the Israel-Hamas conflict, a convergence of factors are driving this elevated threat environment, including new migration patterns spurred in part by Putin’s unprovoked war in Ukraine, growing political and economic grievances worldwide, and technological advances exploited by terrorist groups.

Now, here in the homeland we continue to assess that individuals who are inspired, enabled, or directed by foreign terrorist organizations, so called HVEs, pose the most serious threat to American citizens. Since 9/11, HVEs inspired or enabled by foreign terrorist organizations have conducted 45 of the 49 terrorist attacks in the United States. And the Afghan national arrested in Oklahoma last month who was charged with conspiring to conduct a terrorist attack on election day on behalf of ISIS represents the type of foreign terrorist-associated threat that we’re most concerned about domestically.

Now, elsewhere ISIS-K and ISIS-Syria are the two most potent elements of the ISIS global enterprise. In Syria, ISIS exploited reduced counterterrorism pressure last year to recover and to rebuild, as governments shifted attention and resources to the conflict in Gaza. They’ve used a base of operations in central Syria to drive external plotting, turning this desert location into the current locus of plotting against the West, including the United States. They’ve also benefited from improved finances and stronger media and propaganda campaigns.

In Yemen, al-Qaida in the Arabia Peninsula remains and retains the desire to attack the United States homeland, but U.S. counterterrorism actions and the ongoing war in Yemen have constrained AQAP’s ability to reconstitute. Meanwhile, in South Asia, Taliban pressure on ISIS-K has forced key elements of the group to relocate to Pakistan. And while recent Pakistani operations have begun to target ISIS-K, sustained pressure will be needed to prevent the group from expanding further.

Now for years, experts worried that groups like al-Qaida would turn Africa into the next global jihadist battleground. These dynamics are already well established in East Africa and places like Somalia, but they are now also beginning to unfold in the Sahel and West Africa where ISIS and al-Qaida, through its operational arm called JNIM, are expanding their presence and intensifying attacks. Just for example, the number of ISIS and al-Qaida-linked attacks in West Africa and the Sahel are on pace to double from 1,500 in 2021 to a little more than 3,000 by the end of this year.

Now, ISIS and JNIM have exploited weak governance, local grievances, and affected local security forces’ political instability to spread their ideology among vulnerable populations. Moreover, in places like Mali and Burkina Faso, Central African Republic, these groups have capitalized on the actions of Russia, including private military companies like Wagner, whose so-called counterterrorism operations have made the situation worse, resulting in human rights abuses, civilian casualties, and actually increasing recruits for these organizations.

Now, for now while ISIS and al-Qaida are mostly focused on local interests in Africa, their continued expansion and recruitment of fighters from outside the continent would position them well to pursue external operations in the future. And for all these reasons, Africa is emerging as the center of gravity for the Sunni extremist movement. And if left unchecked, could become a much more acute, long-term threat to U.S. interests.

In response, the United States and European partners have been investing in a more geographically diverse and reliable set of counterterrorism relationships in Central and West Africa, and are taking a more forward-looking and strategic approach to these and other challenges in the region. So in the time remaining let me just summarize key elements of the U.S. government’s response to the threat. And as set forth in National Security Memorandum 13 on U.S. international counterterrorism policy, issued in 2022, the administration’s approach has been guided by several key principles.

Among them, prioritizing finite counterterrorism resources against the groups that pose a direct threat to the United States. Second, investing in international partnerships and maintaining U.S. global leadership. Third, promoting civilian-led non-kinetic approaches where possible. And finally, optimizing intelligence community collection and analysis on the groups of greatest concerns. These are just some of the principles outlined in the strategy.

Now, when it comes to prioritizing anti-U.S. threats, counterterrorism actions at home and abroad in recent months exemplify this approach. For instance, as ISIS began rebuilding in Syria earlier this year, the U.S. military has since conducted numerous strikes and raids that have removed dozens of ISIS leaders and operatives from the battlefield, and this includes multiple strikes by the U.S. military late last month against several ISIS camps in the Syrian desert I mentioned. That has killed dozens of leaders and operatives. As a result, ISIS plots have been disrupted, its leadership and membership ranks have been degraded, and its safe haven in Syria is under the most severe pressure it has faced in years.

Here in the United States, thanks to the excellent work of the FBI, Departments of Justice and Homeland Security, and in cooperation with the intelligence community, two potential ISIS threats to the homeland have been disrupted this year, including the recent plot in Oklahoma that I mentioned earlier.

At the same time, we’ve stepped up foreign engagements. As reports emerged this spring that some Central Asian migrants with violent extremist ideology or possible ISIS links had entered the United States, U.S. officials engaged extensively with Central Asian governments and Turkey to share more information and to crack down on facilitation networks and activities. The United States has also continued to lead internationally through the Global Coalition to Defeat ISIS. And I attended the recent ISIS – D-ISIS ministerial hosted at the State Department last month, and I can tell you that the 87 countries who comprise this coalition remain laser-focused on cooperating to destroy and dismantle ISIS.

So as we’ve adjusted to deal with a reenergized ISIS, the U.S. government has also engaged with international partners to increase collection, analysis, and disruption efforts against a growing transnational REMVE threat which has inspired mass shootings in the United States and abroad. At NCTC, we have engaged with our Five Eyes nations and European partners to enhance information sharing and leverage best practices on preventing and countering REMVE across borders.

And finally, the IC – the intelligence community – has strengthened collection and analysis on ISIS. We’ve surged linguists with Central Asian backgrounds, and enhanced intelligence screening and vetting support to Homeland Security and border officials.

Now, of course, we know that the threat endures, and that our response to it must be flexible. So in reflecting on the last four years and looking ahead to the future, some takeaways emerge.

First, it’s worth noting that the U.S. approach to counterterrorism has successfully prevented foreign terrorist-directed or -enabled attacks on the U.S. homeland, and the – and continued to reduce the ability of these groups to conduct large-scale attacks on our country. And that is a credit first and foremost to the countless counterterrorism professionals throughout the U.S. government.

Second, as the terrorism threat in Africa metastasizes, an international approach that considers the strategic competition dimensions of the continent will be needed to address the long-term drivers that are allowing terror groups in the region to thrive.

Third, we will need to rethink and diversify our counterterrorism partnerships to reduce dependency risk if a partner’s capabilities fall short or the relationship collapses, as we saw in Niger.

Fourth, the rising number of juveniles engaging in terrorism is a global phenomenon, and it may well worsen in the near term as the effects of the Israel-Hamas conflict take hold. Now, given these global ramifications, pursuing common approaches to prevention with our close partners and allies could yield new insights, new ideas, and more efficient and effective solutions.

And finally, if future administration priorities or global realities limit the U.S. ability to take action against terrorist threats upstream, investing in downstream capabilities like identity intelligence and screening and vetting, which is really our last line of defense here in the United States, will become even more important.

So, in sum, as the United States confronts a new phase in the global terrorism threat, it is important to remember that strategies like NSM 13 are never meant to be static, and that only by internalizing lessons from the last four years can we position the next administration for success. And in that connection let me say that I look forward to engaging with the Trump administration’s national security team to conduct an orderly transition and to ensure that they are ready on day one to address a dynamic CT threat environment. And throughout the transition process, let me reassure you that the U.S. counterterrorism community will be working diligently, as they do each and every day, to keep threats at bay so that our democracy may continue to shine as a beacon of freedom and hope in the world.

And with that, thank you. (Applause.)

Dr. Jones: For the audience, before we start just wanted to remind you to scan questions. So you’ve got a QR code there. If you can’t reach it, you can get up and there’s a – there’s a place to scan it behind you in the back. I’ve got a tablet here that already has some questions on it. So some of you have already gotten started. And when we get partially through, I will start asking some of the questions from folks here in the audience.

Thank you so much for taking the time. And I just want to say, the work that you do, and your colleagues do at NCTC, across the U.S. intelligence community, the military, and then our allies and partners, I just know from experience, save lives. So thank you for all that you and your colleagues are doing. Most of it is done with Americans generally having no idea what is done to protect their freedom. But thank you for all the work that you do on a daily basis.

Mr. Holmgren: Thank you, Seth.

Dr. Jones: I wanted to start actually on the homeland. And so my question is, when you look back at the past 23 years or so since 9/11, there’s certainly – you know, we’ve certainly had very high levels of threats. Certainly, 9/11 itself. A couple of years after that around the 2008-2009 period, we had a couple of very close calls with Najibullah Zazi, which was a plot that came very close to those attacks in New York City. He built the bombs in Denver. Then we had Faisal Shahzad, the Times Square bomber, Umar Farouk Abdulmutallab, the underwear bomber from Yemen who worked with AQAP. So, you know, some periods where we’ve come very close.

You talked a little bit about it in your comments, but as we look at the ebbs and flows of threats to the homeland, can you put that into context where we sit today? I realize we can’t be complacent about the threat, but how would you – in a historical perspective – sort of put where we are right now?

Mr. Holmgren: Yeah. So the way I think about it is sort of three phases. And you’ve pointed to the first one, which was the 9/11 phase and the several – I’d say the probably five to 10 years after that, where groups like al-Qaida, principally, were focused, first and foremost, on conducting large-scale, spectacular attacks that inflicted large numbers of casualties and were designed to garner a lot of media attention. And so they spent a lot of time in the training camps both thinking – you know, planning those operations, vetting and recruiting the right operatives with the right profiles, so that they could infiltrate back into certain countries. And were, you know, very focused on executing – you know, frankly, were willing to forego smaller attacks in the interest of investing in these larger ones.

With the rise of ISIS in 2014 and really 2015, when they were at – the caliphate was at its peak, that when we – I think we began to shift into more of a second phase, where there was a – because of the large numbers of foreign fighters that had flocked to Syria to join ISIS, you saw ISIS leaders really focus on how they could quickly redeploy those individuals back into their home countries. And they were focused really on – they were focused on quality, but also were focused on quantity. So a little bit of a shift. I think they recognized, because of all the counterterrorism measures that had been taken in the last – in the preceding decade, it was just harder to executive, you know, attacks against commercial aircraft, et cetera. So they really focused on the foreign fighter component.

And then where we are now is it’s the inspiration, the enabled kind of attack model, where ISIS in particular is really – the virtual recruitment, the virtual guidance they can provide, and a desire to really throw kind of everything at the wall to see what sticks. I think the media landscape has changed dramatically over the last 20 years. And so from their view, it’s less important that an attack kills large number of people than it simply garners a lot of media attention. And so that’s the model we’re at now.

And that’s why the HVE threat that we face, where these individuals may only have, you know, virtual connections or relationships with ISIS, in some respects – it’s a less sophisticated threat, because they’re not trained in camps. They don’t oftentimes know how to – you know, these are individuals who are new to the fight. So they just don’t have the training that al-Qaida would have provided in years past. They’re focused on simple, but still very deadly and lethal, attacks, obviously. But mass shootings, knife attacks, vehicle ramming incidents. So unsophisticated, but in some respects more difficult to detect. And ultimately, the volume is greater, so it just requires a lot more resources collectively, both here and overseas.

Dr. Jones: Right, because the value for someone like Zazi, when he goes to Pakistan and goes to a training camp, is he comes back reasonably well-qualified to put together a bomb that he can put in a backpack, walk into a subway, and blow himself up. What we see with some of the individuals you’ve described is less sophistication, less concern about killing large numbers of people, but still would have a dramatic effect in the U.S. homeland.

What is – so you did mention some of the plotting, some of the arrests we’ve seen this year, including ISIS, including Oklahoma. Can you talk a little bit about how would you put that into context? How serious were those threats to the homeland? And, just more broadly, you know, what are the lessons you pull out on the counterterrorism side for cooperation to make some of the key arrests that we’ve seen?

Mr. Holmgren: Yeah. Well, first, let me just say they were serious threats. And that is why we have – the collective “we” in the U.S. government and the counterterrorism enterprise – have taken them so seriously. This was the first time in some years where, you know, ISIS had established, you know, effective relationships and communication with individuals in the United States. That’s a big deal. And it’s why we have, I think, aggressively moved and coordinated so much more closely with FBI, with DHS, to make sure that we’ve got all the support at the border to vet individuals as well.

But, you know, ultimately what it comes down to is a combination of excellent, you know, traditional intelligence collection with kind of a faster sharing of that information with our domestic partners – in many cases in real time. And you talk about one of the other evolutions since 9/11, as it pertains – actually, this one pertains to NCTC. You know, I have – I’m here in an acting capacity. Never worked at NCTC. I had the pleasure of working with NCTC over many years. But having stepped into the role this summer, you know, as the U.S. government – you know, there are other threats in the world and resources have necessarily been adjusted to address strategic competition. It’s meant that there have been less resources across the U.S. government for counterterrorism.

The silver lining in that, if there is one, is that it has forced the remaining kind of core CT elements at NCTC – which we’re the only entity that’s focused 24/7 on counterterrorism – but also at the intel agencies, at FBI, elsewhere, to work even more closely together, and to work – and to collaborate in ways that I think, in the past where the resources were plentiful, you maybe wouldn’t see it. So the one silver lining we’ve seen this summer has been, you know, I think NCTC really taking a convening role in bringing the agencies together to really drive threat analysis and to actually surface leads to support our operational partners.

Dr. Jones: Well, part of what you just did is talk a little bit about sort of the origins of NCTC and its evolution. Now, I remember when NCTC’s precursor, TTIC, was established. And then NCTC formally gets off the ground. You know, its focus is – this was after 9/11 – its focus really was on dealing with a major terrorist threat to the homeland that, as you’ve described, evolves from really a focus on al-Qaida, to groups like ISIS, and others. The focus now, and it has been with the last two National Defense Strategies – so first under Trump – the Trump administration, then under Biden.

But under the Trump administration, it was pretty explicit that great-power competition, not counterterrorism, are the primary focuses – now, that’s the National Defense Strategy – of the United States. How have – how have you evolved, or how has NCTC evolved to deal with the growing role of major powers – the Russians, the Iranians, the Chinese – in this sphere? And then I want to come back a little bit later and talk about how to balance activity against state actors with still dealing with the threat from nonstate actors. So, first, how do you – how do you balance the great or the major powers and the – and the nonstate actors?

Mr. Holmgren: Well, our mission – I mean, NCTC’s mission has – it remains unchanged, right? It is to integrate, to analyze, share information first and foremost, to conduct strategic operational planning, to support national counterterrorism policy objectives. It is to maintain the Terrorist Identities Datamart Environment, which is all the underlying data that helps feed and support our screening, vetting, and watchlisting efforts throughout the U.S. government. And then more recently it is to pursue and to identify terrorist threat leads that we can share with operational agencies to disrupt plots before they occur. So our mission hasn’t changed.

The way we work has changed. And I think it’s shifting much more to an offensive posture where, in addition to doing the traditional analysis, tactical and strategic, where can we really support and drive our state and local partners, you know, if there’s a foreign terrorist nexus, but also to support DOD partners and our intelligence agencies. I think that’s the shift, is we’re playing a more, I think, impactful and meaningful operational support role.

Dr. Jones: So in this gray area, what role have you seen? And has there been an evolution in the role that states play in this arena? I mean, Iran is clearly the biggest example of this with the Quds Force. The Russians, starting in 2015 when they got involved in the campaign in Syria, do work with Hezbollah as part of that ground campaign with the Assad regime and some of the Iraqi, Palestinian, and other forces that came in and conducted offensive operations. So states have been involved in dealing with terrorist groups. How big of a concern is that and a focus is this sort of gray area where states – adversaries, really – may operate in some cases by, with, and through terrorist organizations?

Mr. Holmgren: Well, it should be no surprise that Russia has historically dealt with unsavory groups. And you just mentioned one, Hezbollah, that they continue to deal with. So it should be no surprise that they will leverage kind of many different nonstate actors to pursue their objectives.

You know, I think there are limits to what groups they could work with. Certainly, ISIS-K’s attack in Moscow earlier this year I think is a pretty good indication that relations between ISIS and Russia are not great. And I think as long as you’ve got this large Central Asian Russian-speaking population in ISIS-K, it’s going to be – you know, ISIS continues to plot against Russia even to this day. So wouldn’t rule it out, but you know, I think most of the cooperation we’ve seen that Russia’s provided is in the Hezbollah context.

You know, I think when – on the strategic competition topic generally, you know, one of the things that has stood out to me actually pertains to China. And the PRC has, I think, looked at how effective the U.S. government has been at the counterterrorism challenge over many years through, you know, a lot of experience, both in the battlefield and then also in the – kind of the back-office functions, and they have recognized that offering counterterrorism assistance and training support to nations where they are seeking a strategic advantage is in their benefit.

Now, what’s different, of course, is the PRC approaches these engagements in West Africa – coastal West Africa, you know, with no strings attached to what they can – what they’re offering and what they can provide, notwithstanding, you know, any human rights issues that may exist. And so the – China is using CT as a counter – as a – as a tool to advance their own strategic competition when it comes to – if you think about sort of how they’re looking at the world globally and where they’re trying to check and counter the United States.

Dr. Jones: And I think it’s safe to say the Russians have as well with what we used to call Wagner Group. It’s private military companies.

Mr. Holmgren: It’s private military companies, exactly. Right.

Dr. Jones: So one big question. You mentioned Hezbollah. Can you talk a little bit about the impact on global terrorist organizations of October 7th? Did that ripple through groups? Did that inspire some? What’s been the overall impact of the October 7th attacks in Israel?

Mr. Holmgren: Yeah. We’ve said it was likely to be a generational event and I stand by that assessment.

Unfortunately, the data that we have seen in NCTC – we mentioned this publicly but, you know, more than 40 either attacks or disrupted plots in over, you know, 20 countries just in the last year that have had some link whether inspired or motivated by 7 October.

So it really has had an impact on the ground. I think the bigger impact, though, is that 7 October and then the ensuing conflict came at a time where groups like ISIS and al-Qaida were at some of their lowest operational levels and so it really has – it was a serendipitous time for groups like that and the movement more generally and it provided a shot in the arm when it comes to recruitment, fundraising, and – you know, I think it’ll turn out to be probably the most consequential recruiting event for just the kind of global terrorism movement since we’ve seen in the Iraq war.

Dr. Jones: And how much of it was – just the attack itself on Israel how much of this was the information campaign that came about following October 7th with strikes in Gaza and the wars that unfolded there and in Lebanon?

Mr. Holmgren: It’s tough to say. We don’t have any hard data on kind of what has been the weightier factor but I would say if you look at the propaganda that ISIS and al-Qaida – which, by the way, al-Qaida had never been a close friend of Hamas. They have pretty significant differences.

If you look at what they’ve been putting out it’s the images of the destruction in Gaza and the humanitarian, you know, suffering there. So they’ve really – it’s been much more on that humanitarian kind of side of things in their recruitment videos.

Dr. Jones: So what is your sense of – just turning to some of the groups there, I was just in Israel and Hezbollah – the combination of Israeli strikes against Hezbollah’s leadership including Nasrallah, the pager/walkie-talkie/laptop attacks in the supply chain, and then also the disruption in the command and control networks plus the very limited Israeli ground incursion and some of their strikes against Hezbollah’s ballistic missile capabilities, for the moment do appear to have significantly impacted Hezbollah’s capabilities.

But what is your assessment of where Hezbollah stands today and its possibility for, you know, rejuvenation and revitalization? I mean, it has generally been considered probably the preeminent terrorist organization overseas in capabilities.

Mr. Holmgren: Mmm hmm. So you’re right in that, you know, our assessment is that the Israeli military actions have significantly degraded Hezbollah’s military capabilities. But they had – before the conflict they had built up unprecedented numbers of rockets and missiles and other munitions. So they had – on hand they were starting at a very strong point.

The leadership losses have had an impact on their ability to – I think to organize and to strategically put together a way forward. But the ground forces in the south remain somewhat intact and as it pertains, you know, from a terrorist’s perspective outside the region, you know, their external capabilities have, largely, been untouched.

So in terms of the Islamic jihad organization and that external component of Hezbollah, you know, we assess there’s been little impact thus far. It still remains, you know, down but far from out.

Dr. Jones: Which in years and decades past have led to attacks in Latin America, Africa, Asia, and other locations.

Mr. Holmgren: Right. Right.

Dr. Jones: Yeah.

Mr. Holmgren: And it’ll be no surprise that we are, you know, monitoring very closely for any indication of, you know, Hezbollah seeking to escalate kind of horizontally, and working very closely with partners around the world to focus on that.

Dr. Jones: So your assessment of Hamas, how does that vary – I mean, again, a number of Hamas’ leadership has been taken out, including Sinwar recently. What is your assessment of Hamas to – part of the challenge in Palestinian areas is there’s still – you know, there’s still a lot of – there appears to be a lot of support for Hamas in general over the long run and potential opportunities for them to revitalize. But what is your assessment where Hamas sits right now, particularly since the period prior to October 7th?

Mr. Holmgren: Militarily, they have been significantly diminished. And they’re essentially morphing into an insurgent force on the ground, and they’re turning to small arms and hit-and-run, different types of tactics; you know, lobbing some mortars, you know, into Israel. But they’re really – they’ve been forced to – you know, to keep a very low profile.

Now, having said that, even a diminished Hamas is able – has been able to recruit new members to its ranks, and will likely continue its ability to do so, so long as there is not another viable political option on the ground for, you know, these disaffected young men in Gaza to turn to. And so I think that’s why it’s even – you know, even more important moving forward you’ve got to – in order to undermine the appeal of Hamas, there has to be a more viable political actor on the ground in Gaza to give them – you know, to give – these new recruits for Hamas, to give them a better option.

Dr. Jones: Last question on this stream is if you take a look back over the last few years with the Assad regime’s ability to retake territory in Syria with the help not just the Russians but of the Iranians, with the collapse of the Afghan government, and obviously a continuing relationship between Iran in the Quds Force and Iraqi groups, there’s a lot of – there are a lot of Iranian partners throughout the region – in Lebanon, in Syria, in Iraq, to some degree in Afghanistan, in Yemen with the Houthis. As you look over the next year, what are your concerns about Iranian activity and its relationship with these kinds of organizations? It has been a challenge for the U.S. The Navy has had to – you know, has been deployed to the Red Sea to conduct operations. There’s been a lot of U.S. assets, carrier strike groups pushed into the region. What’s your sense about kind of the challenges ahead over the next year as the Iranians still have a reasonable relationship with groups across the region?

Mr. Holmgren: Well, look, Iran remains the leader of the so-called Axis of Resistance. And it has, as you noted varying degrees of relationships and operational and strategic control over groups – Hezbollah, which is a proxy of Iran, but also, you know, they provide support to groups like the Houthis. But the Houthis are kind of an independent actor; they do their own thing. There are other groups in Iraq, and in particular, you know, Kataib Hezbollah, KH, which has been responsible for the largest number of attacks against U.S. forces in the region over the last year.

I think our concern is that, you know, Iran, you know, increases the use of these groups as part of its shadow war against either us and/or Israel, in part because they, you know – you know, may be concerned about their own capabilities in light of some of the Israeli strikes against them. And so do they decide to even lean more heavily into these groups and encourage them to operate outside of the region is the risk that I think we’re most focused on.

Dr. Jones: And some of them have done that in the past. I mean, I think it’s been interesting to watch where the Houthis, too, have not just utilized Iranian technology for strikes; they’ve actually exported some of that as well.

Last question. And we’ve got a lot of questions from folks in the audience. But last question for you is – this is a little bit of worry for me, so maybe you can push back and tell me I shouldn’t be worried.

There were years, including when I was in the Special Operations community, where we had, you know, a reasonable footprint and a pretty significant battle rhythm of operations against groups in Syria, in Iraq, in Afghanistan, in Somalia, in Libya, and in West Africa. Our footprint has declined notably, in part because the priority is – of the military has been the major powers, and so what it’s meant is a withdrawal of a number of forces. As you noted, the U.S. still does have capabilities that it can strike and has struck ISIS and other targets in places like Syria. The current administration in the U.S. killed Ayman al-Zawahiri in Afghanistan as well. So there are capabilities to do that, but it’s not as easy as it once was. We don’t have all of the intelligence capabilities. It’s harder to get access to places like Afghanistan because we don’t have basing in and around that area.

So the big question for you is, where do we have to be careful about pulling back too much from dealing with terrorism? And where do we run risks of not keeping a foot on the pedal against it? Because I think the worry a little bit in some quarters is that if we’re not careful, we take our foot off the pedal a little bit too much, some of these groups will strike us whether they’re Shia groups linked to Iran, groups linked to ISIS including inspired ones, or ones to al-Qaida. So how do we manage that when we’ve withdrawn forces from a lot of areas? I know AFRICOM would like more military resources; they don’t have that right now, so.

Mr. Holmgren: Well, look, as a lifelong counterterrorism professional, you always want as much as you can possibly have, whether it’s collection or operational capabilities on the ground. Having said that, again as someone who has been in a role where, you know, terrorism was one of several portfolios that, you know, I had to focus on every day, I recognize that the threat landscape – the global threat landscape has changed in the world over the last 10 years. And in some respects, that’s a credit to the counterterrorism community because of the success, again, over many years that’s allowed policymakers to accept some risk in the CT fight and to invest those resources in other areas, whether it’s – whether it’s Asia or now Ukraine.

Having said that, I think as we have seen in the last – really, the last 18 months in particular with a reenergized ISIS, and the growth of ISIS and JNIM in Africa, you know, we sort – we have to be very deliberate about how we manage these competing resources moving forward because – and that includes, by the way, the threat to the United States here in the homeland, because, you know, our security is not a birthright. You’ve got to invest it – you’ve got to invest in it. You have to constantly pay attention to it. And you know, for the most part, here in the United States people can wake up and go to work every day and drive their kids to school and go to soccer games not worry about another 9/11. And when I fly on an airplane, I don’t – I have very little worry about that commercial airliner in the United States being subject to a terrorist attack. But that’s because of all of the capability that we invested, the screening and the – and the intelligence fusion activities, whether it’s at the airport or with our domestic agencies.

But security is – it’s a lot like oxygen. When you have it, you don’t think anything about it. The minute you can’t breathe, that’s all you can think about. And so, to me, that is a reminder that we have drawn down resourcewise across the government when it comes to CT over the last few years. We’re stabilizing now. And that – and it’s been adjusted and calibrated to the current threat environment, and I think it’s moving forward.

We’ve got to be – we’ve got to be agile in our capabilities to remove direct threats to us. We’ve got to be – I think we’ve got to be careful about depending too much on particular areas where we host those capabilities. And we’ve got to make sure that we are investing both in the last line of defense here in the United States. And that means all of the really – especially with all the changes in the technology environment, making sure that we have fully interoperable systems between the intelligence community and our folks at the border, so that they can make sure that we’ve got the border threat addressed.

And then, over the horizon, whether it’s finished capabilities or intelligence collection, if we are unable as an intel community to provide that tactical and strategic indications and warning, that is when we run the risk of being blinded by the emergence of, you know, some new group in Africa who, all of a sudden, is plotting against the United States. We can’t let that happen. So we’ve got to continue to invest in these core capabilities.

Dr. Jones: So, sort of along those lines, want to get to a number of questions. This is from someone in the audience who asks: What guidance recommendations would you provide to the next administration to sustain these successes, including this year in the U.S. homeland, that NCTC has benefitted from, historically?

Mr. Holmgren: Well, I just mentioned a couple of them. I think looking at our partnerships around the world we’ve had some extraordinary successes in the partnership front just over the last four years in places like Africa. You know, there’s more work to do. And so one is I think taking a fresh look at our CT partnerships and making sure that we are not overly dependent on any of them, including with some of our closest friends and partners. We’ve been, as reported publicly, heavily dependent on the Israelis. And they were, you know, caught off guard on 7 October. So it’s a reminder that we’ve got to – we’ve got to make sure that we have all the right resources and capabilities in place that can protect the United States.

Dr. Jones: Yeah, and I think we were caught off guard too. I mean, our intelligence community was caught off guard, to some degree. Actually as, I think, were the Egyptians, the Jordanians, the Qataris, and a number of others as well.

Mr. Holmgren: Mmm hmm. Yeah. Yeah, it’s not unique, but the point is making sure that we are not overly dependent. Secondly, is, again, on the identity intelligence and on the screening and vetting. Just incredibly, incredibly vital that we are investing in the technology to make sure that that data is available to the homeland security folks who need it, kind of when they need it. Going to become even more important moving forward.

And then the proliferation of the commercial, you know, unmanned aircraft systems, the UASes, both commercial but, in some respects, even the military, the conventional grade. This is obviously a growth market for a lot of nations, including some of our close friends overseas that are benefiting from these sales. And we get that. But when terrorist groups are acquiring and reconfiguring these things for their own nefarious purposes, just, you know, imagine the threat that the proliferation of these types of capabilities would pose to our facilities overseas that are not hardened.

And so we’ve got to – I think investing in – and, again, these things are not – it’s not that you can’t defend against them. They’re not indefensible. But you’ve got to be – you’ve got to have the right technology in place. You’ve got to have the right kind of hardening capabilities in place at key facilities. And then you’ve got to scale and be able to provide some of the countermeasures at scale at a cost, efficient way. So.

Dr. Jones: Sounds good. Well, hopefully that advice will be followed. Here’s another question from one of the audience members. What’s driving youth radicalization in the U.S.? And if it’s the internet, how do you limit radicalization online? You know, there may be also a secondary question because you’ve mentioned before this – you’re seeing juveniles involved in terrorism as well. So there’s a U.S. component, but also there’s a juvenile component that I know you’ve tracked as well.

Mr. Holmgren: There is. And obviously when it, you know, comes the youth radicalization in the United States, FBI and DHS have the lead mission for that. We at NCTC look at it from the foreign terrorist organization, you know, kind of what influence are they having on radicalization here in the United States. And again, this is not unique to our – to the United States. It is an equally significant problem, especially in Western Europe.

It was – you know, COVID-19 didn’t help. And this, again, not unique to the terrorism problem set. But you had a large number of young individuals who were online for large portions of the day. And especially those who were already in vulnerable settings, they have – you know, they have gravitated – the ones that have linked up with ISIS or have been inspired by ISIS, you know, they’re looking for belonging and meaning, and a real – a sense of accomplishment. And so these – a lot of the propaganda, it’s easily accessible on the social media platforms. It is – a lot of it’s in English.

And it’s not just – in the day, it used to – back in the day, it used to be just al-Qaida or groups – you know, al-Qaida in the Arabian Peninsula who would use the Inspire magazine. Now you have many different groups that are focusing on the English language thing. So I think first and foremost is – I think there is a lot more work to do both here and abroad on the prevention side. That was a big focus many years ago. It’s hard, but figuring out ways that we can reinvest in some of these local communities, and with parents, and faith leaders to try to identify those individuals who are engaging online before they move, very quickly, into the radicalization phase.

And then also, look, a number of the social media companies are now – they’re no longer U.S.-based. And so they’re overseas, or they have overseas ownership. I think, you know, in the first instance, really working with some of our foreign partners to encourage these companies to enforce some of the voluntary standards around, you know, content moderation when it comes to violent extremist media is an area that there’s more work to do.

Dr. Jones: We don’t have time for a lot more questions, but we’ve got a couple that I think we can probably squeeze in. 127 Echo programs have been the bedrock of success against AQI and ISIS in Syria and Iraq. This is someone from the audience. Do you see these types of programs as a viable part of our counterterrorism efforts in Africa? Are other tools also of great value?

Mr. Holmgren: I think – yeah. I think in Africa, especially when it comes to the Sahel and West Africa, again, a lot of – a lot of these – a lot of these governments have very basic security capabilities, but even less basic when it comes to counterterrorism capabilities. And so I think starting with the fundamentals, I think if we try to do too much too soon we’re going to overwhelm a very, very small – a lot of times very, very small security forces. And some of these programs take a long time to build partner capacity. These governments, they need support now. And they need – so they’re – while they may be interested in some of the longer – programs that have a longer tail, I’m not sure we can wait.

So I think we got to do the long-term capacity building, but we also have to do the short-term how do we get information sharing mechanisms in place? How do we get them the intelligence they need? How can we give them some basic capabilities that will allow them to conduct their own collection activities and also to conduct their own disruption activities, with – you know, sometimes with U.S. support, sometimes allow them to do that unilaterally.

Dr. Jones: OK. One or two last questions. This one from Voice of America. And you can answer it however you want. Does the U.S. know who’s currently leading ISIS? And does this person remain in the Syria-Iraq area? Or have you seen ISIS core moving toward basing in Africa, whether in Somalia or Sahel? And reports indicate al-Qaida’s de facto leader remains based out of Iran. What does this indicate about how Tehran may still be seeking to use al-Qaida going forward?

Mr. Holmgren: Yeah. I will defer to a classified setting on the first part of the question. What was the last part on Iran?

Dr. Jones: So the question was: Reports indicate that al-Qaida still has leaders in Iran right now.

Mr. Holmgren: Yeah.

Dr. Jones: What does that – what does that suggest about how Tehran may seek – may seek to use al-Qaida in the future?

Mr. Holmgren: Yeah. Well, I mean, you know, Saif Al-Adel has been in Iran, the leader of al-Qaida. They have provided harbor –

Dr. Jones: He goes back to the Bin Laden days.

Mr. Holmgren: Yeah. He does. You know, they’ve provided harbor to al-Qaida leaders for years. So I’m not – I won’t speculate on what the Iranian intentions are, but suffice to say it is unhelpful with his presence there because he is still the de facto leader of – you know, of the al-Qaida organization.

Dr. Jones: Last question here is: Can you speak to the relationship between terrorist organizations and organized crime? How has that relationship evolved, and where do you see it headed?

Mr. Holmgren: Well, I think the – I think, you know, the Iranian-linked terrorist plotting, including against U.S. officials and against officials in other Western countries, is probably the most recent example of – groups like the Quds Force seeking to use, you know, criminal elements and surrogate networks to conduct their operations. Hezbollah has used these types of, you know, criminal networks in the past. And it’s designed to conceal and hide their activities, to try to give them some deniable cover to the operations.

And thanks to the really incredible work of the FBI over the last couple of years, where they have – working with the intel community – have uncovered Iranian efforts to do so in the United States, it has – they have not succeeded. But we know the Iranians are relentless. And they are determined to avenge the killing of Soleimani. And so that is probably the most recent example. But, again, Hezbollah has done that before. And then, of course, in the state context, you know, the Russians have played around with using criminal networks to conduct some of their own sabotage operations.

Dr. Jones: They certainly have. Last question, for the Swifties watching this, is, you know, there certainly is a concern, the way we started this, about threats to the homeland. But Americans also go to concerts overseas, as they did in Vienna for those two concerts that Taylor Swift had organized. How serious was that plot? And, you know, just basic – you know, sort of broadly speaking, I mean, what do you characterize as a success, again, of a situation like that in thwarting what appeared to be a pretty serious attack?

Mr. Holmgren: Yeah. Well, let me say as a – as a fellow Swiftie fan, I was deeply disturbed by it. But on a more serious note, it was a serious plot, and the individuals, who were arrested with – by all accounts had pledged bayat to ISIS and were inspired by ISIS, sought to kill a large number of people outside that concert venue.

Now, it should be – I would just say that, you know, concert venues have been a persistent focus for groups. We had the Bataclan concert hall in Paris in 2015. In 2017 in Manchester, England, you had the Ariana Grande concert attack, again outside the venue. And then just this past March ISIS-K’s attack on the Crocus City music hall in Moscow.

So I think the takeaway for us is they are – you know, they’re looking at large public gatherings where there – it’ll garner a lot of attention, and they’re looking for weak points in the security. And so that – but it – so that’s – for us, it’s a reminder that as – and I know DHS has done a lot of work. They had done it before, obviously, this plot emerged, but it’s a reminder – with all the different concerts and events here in the United States, that’s why there’s always such a big footprint outside our events, because we know that presence can deter. And you know, I think, you know, moving forward you’re going to see a lot more – a lot more of that.

Dr. Jones: Well, as a fellow Swiftie, thank you for the work that you, the government, our allies and partners are doing on a day-to-day basis. And as I said earlier, I don’t think most Americans have a full appreciation for how much work gets done behind closed doors for the protection of Americans both at home and overseas.

So thanks. Thanks to you and your colleagues. And if everyone here could join me in thanking Brett for a fantastic discussion. (Applause.)

Mr. Holmgren: Thank you, Seth.

Dr. Jones: Appreciate it.

Mr. Holmgren: Appreciate it. Thank you. (Applause.)

(END.)

This transcript is from a CSIS event hosted on November 12, 2024. Watch the full video here.

Seth G. Jones: Welcome, everyone. I have the honor of welcoming, for this great discussion, Brett Holmgren, director of the National Counterterrorism Center, who was appointed by the president on July 18th, 2024. NCTC – I probably don’t need to provide much information on NCTC because I think everyone is aware of its background – but was formed after 9/11, and it is the U.S. government’s primary organization responsible for integrating, analyzing, and sharing information to protect the U.S. from terrorism and achieving some of the national counterterrorism objectives.

Mr. Holmgren served for nearly three years as the U.S. assistant secretary of state for the Bureau of Intelligence and Research. Also served as special assistant to the president and senior director for intelligence programs on the National Security Council staff. Began his career on counterterrorism at the Defense Intelligence Agency, and then moved over to become a senior analyst at the CIA. Also is a, I’m assuming very proud, graduate of the University of Wisconsin-Madison. Which means he’s a Badger with an M.A. in global security studies from Johns Hopkins University.

So, welcome. Really glad to have you.

Brett Holmgren: Appreciate it. Thank you. Thank you, Seth. And the most important line in there is I’m a proud Wisconsin Badger. So thank you for – thank you for that.

Seth, I also just want to thank you for your thought leadership on – really, on terrorism and on national security issues generally. As I noted in the way up, been a fan of your work for some time. So it’s a real pleasure to be here with you.

I also want to thank CSIS for hosting today’s event. And the purpose of CSIS is to define the future of national security. So it’s only fitting that my remarks today are intended to help define the future of the global terrorism landscape.

This past September, we celebrated the National Counterterrorism Center’s 20th anniversary. We honored the outstanding work of the tens of thousands of NCTC officers past and present who have worked tirelessly behind the scenes to keep Americans safe from terrorism at home and abroad. Their work and their contributions to our nation’s security is why I’m so proud to lead this extraordinary organization.

Now, in reflecting on NCTC’s history it was helpful to reflect on how much the global terrorism landscape has changed since President George W. Bush established NCTC in 2004. At that time Osama bin Laden and Ayman al-Zawahiri were still plotting from caves in Afghanistan and Pakistan. U.S. forces were deployed in Iraq and Afghanistan engaged in two wars.

In Iraq and elsewhere a group called ISIS didn’t exist. In the United States you didn’t have to remove your shoes at the airport. So a lot has changed over these last 20 years. The only constant is the ever-evolving nature of the threat itself. Terrorism in all its forms is underpinned ultimately by violent extremist ideology.

Ideologies can’t be defeated by governments or counterterrorism tools alone but what we can do and what we must do is have a clear-eyed assessment of the threat in order to design and implement smart, sustainable approaches that manage risks responsibly and wisely consistent with our values.

So this afternoon I’d like to describe the global terrorism threat and touch on how the U.S. government has worked aggressively to counter this evolving challenge over the last few years.

Now, today’s terrorism threat is unfolding amid tectonic shifts in the international system, a profound moment in a world marked by volatility, instability, and hostility. Governments are confronting multiple crises simultaneously involving state and nonstate actors while also trying to manage transnational issues like migration and climate change and cyber.

In this context terrorist groups like ISIS have found ways to exploit the circumstances, especially in the Middle East and Africa, to slowly and quietly rebuild. As a result, today we are in yet another transformational phase of the global terrorism landscape, a threat that is more diverse, more complex, and more decentralized.

Now, it’s more diverse because the ideological motivations and the range of foreign terrorist actors are multi-dimensional. Whereas in the past we focused mainly on monolithic groups like al-Qaida, ISIS, and Hezbollah, today’s actors also include transnational, racially, and ethnically motivated extremists, or REMVEs, anti-government and anti-authoritarian groups, home-grown violent extremists, or HVEs, and, of course, Iranian-linked entities, in particular the IRGC Quds Force.

The threat is more decentralized and distributed around the world. This is in large part due to CT successes over multiple administrations, which had the effect of forcing these groups to disperse and to operate in smaller cells in more locations to survive. As an example, the changing nature of ISIS’ footprint in Syria and its expansion across Africa reflects this new reality.

Finally, the threat is more complex because terrorists are more skilled technologically. They’re using 3-D printing and artificial intelligence to produce weapons and enhance propaganda, they’re communicating on more sophisticated platforms, and they’re turning to crypto currency and alternative payment platforms to finance their operations.

So that’s the contemporary global terrorism landscape – more diverse, decentralized, and complex – and against that backdrop let me situate the current threat to the United States.

In September of 2023 my predecessor Christy Abizaid noted that thanks to focused efforts across many administrations the terrorism threat to the U.S. homeland had been dramatically reduced to its lowest level in decades and she was right.

Unfortunately, a month later Hamas’ horrific terrorist attack on Israel and the ensuing conflict and tragedy in Gaza served as a galvanizing event for terrorist groups worldwide and it happened to come at a time when ISIS Syria and ISIS-Khorasan had begun rebuilding core capabilities.

Now, this year alone ISIS-K’s attacks in Russia and Iran, multiple ISIS linked or inspired attacks in Germany, hundreds of ISIS attacks throughout Africa, and the first ever ISIS associated attack in Amman they all signal a reenergized global ISIS enterprise.

And so today the United States and many other countries are facing an elevated terrorist threat. In addition to the Israel-Hamas conflict, a convergence of factors are driving this elevated threat environment, including new migration patterns spurred in part by Putin’s unprovoked war in Ukraine, growing political and economic grievances worldwide, and technological advances exploited by terrorist groups.

Now, here in the homeland we continue to assess that individuals who are inspired, enabled, or directed by foreign terrorist organizations, so called HVEs, pose the most serious threat to American citizens. Since 9/11, HVEs inspired or enabled by foreign terrorist organizations have conducted 45 of the 49 terrorist attacks in the United States. And the Afghan national arrested in Oklahoma last month who was charged with conspiring to conduct a terrorist attack on election day on behalf of ISIS represents the type of foreign terrorist-associated threat that we’re most concerned about domestically.

Now, elsewhere ISIS-K and ISIS-Syria are the two most potent elements of the ISIS global enterprise. In Syria, ISIS exploited reduced counterterrorism pressure last year to recover and to rebuild, as governments shifted attention and resources to the conflict in Gaza. They’ve used a base of operations in central Syria to drive external plotting, turning this desert location into the current locus of plotting against the West, including the United States. They’ve also benefited from improved finances and stronger media and propaganda campaigns.

In Yemen, al-Qaida in the Arabia Peninsula remains and retains the desire to attack the United States homeland, but U.S. counterterrorism actions and the ongoing war in Yemen have constrained AQAP’s ability to reconstitute. Meanwhile, in South Asia, Taliban pressure on ISIS-K has forced key elements of the group to relocate to Pakistan. And while recent Pakistani operations have begun to target ISIS-K, sustained pressure will be needed to prevent the group from expanding further.

Now for years, experts worried that groups like al-Qaida would turn Africa into the next global jihadist battleground. These dynamics are already well established in East Africa and places like Somalia, but they are now also beginning to unfold in the Sahel and West Africa where ISIS and al-Qaida, through its operational arm called JNIM, are expanding their presence and intensifying attacks. Just for example, the number of ISIS and al-Qaida-linked attacks in West Africa and the Sahel are on pace to double from 1,500 in 2021 to a little more than 3,000 by the end of this year.

Now, ISIS and JNIM have exploited weak governance, local grievances, and affected local security forces’ political instability to spread their ideology among vulnerable populations. Moreover, in places like Mali and Burkina Faso, Central African Republic, these groups have capitalized on the actions of Russia, including private military companies like Wagner, whose so-called counterterrorism operations have made the situation worse, resulting in human rights abuses, civilian casualties, and actually increasing recruits for these organizations.

Now, for now while ISIS and al-Qaida are mostly focused on local interests in Africa, their continued expansion and recruitment of fighters from outside the continent would position them well to pursue external operations in the future. And for all these reasons, Africa is emerging as the center of gravity for the Sunni extremist movement. And if left unchecked, could become a much more acute, long-term threat to U.S. interests.

In response, the United States and European partners have been investing in a more geographically diverse and reliable set of counterterrorism relationships in Central and West Africa, and are taking a more forward-looking and strategic approach to these and other challenges in the region. So in the time remaining let me just summarize key elements of the U.S. government’s response to the threat. And as set forth in National Security Memorandum 13 on U.S. international counterterrorism policy, issued in 2022, the administration’s approach has been guided by several key principles.

Among them, prioritizing finite counterterrorism resources against the groups that pose a direct threat to the United States. Second, investing in international partnerships and maintaining U.S. global leadership. Third, promoting civilian-led non-kinetic approaches where possible. And finally, optimizing intelligence community collection and analysis on the groups of greatest concerns. These are just some of the principles outlined in the strategy.

Now, when it comes to prioritizing anti-U.S. threats, counterterrorism actions at home and abroad in recent months exemplify this approach. For instance, as ISIS began rebuilding in Syria earlier this year, the U.S. military has since conducted numerous strikes and raids that have removed dozens of ISIS leaders and operatives from the battlefield, and this includes multiple strikes by the U.S. military late last month against several ISIS camps in the Syrian desert I mentioned. That has killed dozens of leaders and operatives. As a result, ISIS plots have been disrupted, its leadership and membership ranks have been degraded, and its safe haven in Syria is under the most severe pressure it has faced in years.

Here in the United States, thanks to the excellent work of the FBI, Departments of Justice and Homeland Security, and in cooperation with the intelligence community, two potential ISIS threats to the homeland have been disrupted this year, including the recent plot in Oklahoma that I mentioned earlier.

At the same time, we’ve stepped up foreign engagements. As reports emerged this spring that some Central Asian migrants with violent extremist ideology or possible ISIS links had entered the United States, U.S. officials engaged extensively with Central Asian governments and Turkey to share more information and to crack down on facilitation networks and activities. The United States has also continued to lead internationally through the Global Coalition to Defeat ISIS. And I attended the recent ISIS – D-ISIS ministerial hosted at the State Department last month, and I can tell you that the 87 countries who comprise this coalition remain laser-focused on cooperating to destroy and dismantle ISIS.

So as we’ve adjusted to deal with a reenergized ISIS, the U.S. government has also engaged with international partners to increase collection, analysis, and disruption efforts against a growing transnational REMVE threat which has inspired mass shootings in the United States and abroad. At NCTC, we have engaged with our Five Eyes nations and European partners to enhance information sharing and leverage best practices on preventing and countering REMVE across borders.

And finally, the IC – the intelligence community – has strengthened collection and analysis on ISIS. We’ve surged linguists with Central Asian backgrounds, and enhanced intelligence screening and vetting support to Homeland Security and border officials.

Now, of course, we know that the threat endures, and that our response to it must be flexible. So in reflecting on the last four years and looking ahead to the future, some takeaways emerge.

First, it’s worth noting that the U.S. approach to counterterrorism has successfully prevented foreign terrorist-directed or -enabled attacks on the U.S. homeland, and the – and continued to reduce the ability of these groups to conduct large-scale attacks on our country. And that is a credit first and foremost to the countless counterterrorism professionals throughout the U.S. government.

Second, as the terrorism threat in Africa metastasizes, an international approach that considers the strategic competition dimensions of the continent will be needed to address the long-term drivers that are allowing terror groups in the region to thrive.

Third, we will need to rethink and diversify our counterterrorism partnerships to reduce dependency risk if a partner’s capabilities fall short or the relationship collapses, as we saw in Niger.

Fourth, the rising number of juveniles engaging in terrorism is a global phenomenon, and it may well worsen in the near term as the effects of the Israel-Hamas conflict take hold. Now, given these global ramifications, pursuing common approaches to prevention with our close partners and allies could yield new insights, new ideas, and more efficient and effective solutions.

And finally, if future administration priorities or global realities limit the U.S. ability to take action against terrorist threats upstream, investing in downstream capabilities like identity intelligence and screening and vetting, which is really our last line of defense here in the United States, will become even more important.

So, in sum, as the United States confronts a new phase in the global terrorism threat, it is important to remember that strategies like NSM 13 are never meant to be static, and that only by internalizing lessons from the last four years can we position the next administration for success. And in that connection let me say that I look forward to engaging with the Trump administration’s national security team to conduct an orderly transition and to ensure that they are ready on day one to address a dynamic CT threat environment. And throughout the transition process, let me reassure you that the U.S. counterterrorism community will be working diligently, as they do each and every day, to keep threats at bay so that our democracy may continue to shine as a beacon of freedom and hope in the world.

And with that, thank you. (Applause.)

Dr. Jones: For the audience, before we start just wanted to remind you to scan questions. So you’ve got a QR code there. If you can’t reach it, you can get up and there’s a – there’s a place to scan it behind you in the back. I’ve got a tablet here that already has some questions on it. So some of you have already gotten started. And when we get partially through, I will start asking some of the questions from folks here in the audience.

Thank you so much for taking the time. And I just want to say, the work that you do, and your colleagues do at NCTC, across the U.S. intelligence community, the military, and then our allies and partners, I just know from experience, save lives. So thank you for all that you and your colleagues are doing. Most of it is done with Americans generally having no idea what is done to protect their freedom. But thank you for all the work that you do on a daily basis.

Mr. Holmgren: Thank you, Seth.

Dr. Jones: I wanted to start actually on the homeland. And so my question is, when you look back at the past 23 years or so since 9/11, there’s certainly – you know, we’ve certainly had very high levels of threats. Certainly, 9/11 itself. A couple of years after that around the 2008-2009 period, we had a couple of very close calls with Najibullah Zazi, which was a plot that came very close to those attacks in New York City. He built the bombs in Denver. Then we had Faisal Shahzad, the Times Square bomber, Umar Farouk Abdulmutallab, the underwear bomber from Yemen who worked with AQAP. So, you know, some periods where we’ve come very close.

You talked a little bit about it in your comments, but as we look at the ebbs and flows of threats to the homeland, can you put that into context where we sit today? I realize we can’t be complacent about the threat, but how would you – in a historical perspective – sort of put where we are right now?

Mr. Holmgren: Yeah. So the way I think about it is sort of three phases. And you’ve pointed to the first one, which was the 9/11 phase and the several – I’d say the probably five to 10 years after that, where groups like al-Qaida, principally, were focused, first and foremost, on conducting large-scale, spectacular attacks that inflicted large numbers of casualties and were designed to garner a lot of media attention. And so they spent a lot of time in the training camps both thinking – you know, planning those operations, vetting and recruiting the right operatives with the right profiles, so that they could infiltrate back into certain countries. And were, you know, very focused on executing – you know, frankly, were willing to forego smaller attacks in the interest of investing in these larger ones.

With the rise of ISIS in 2014 and really 2015, when they were at – the caliphate was at its peak, that when we – I think we began to shift into more of a second phase, where there was a – because of the large numbers of foreign fighters that had flocked to Syria to join ISIS, you saw ISIS leaders really focus on how they could quickly redeploy those individuals back into their home countries. And they were focused really on – they were focused on quality, but also were focused on quantity. So a little bit of a shift. I think they recognized, because of all the counterterrorism measures that had been taken in the last – in the preceding decade, it was just harder to executive, you know, attacks against commercial aircraft, et cetera. So they really focused on the foreign fighter component.

And then where we are now is it’s the inspiration, the enabled kind of attack model, where ISIS in particular is really – the virtual recruitment, the virtual guidance they can provide, and a desire to really throw kind of everything at the wall to see what sticks. I think the media landscape has changed dramatically over the last 20 years. And so from their view, it’s less important that an attack kills large number of people than it simply garners a lot of media attention. And so that’s the model we’re at now.

And that’s why the HVE threat that we face, where these individuals may only have, you know, virtual connections or relationships with ISIS, in some respects – it’s a less sophisticated threat, because they’re not trained in camps. They don’t oftentimes know how to – you know, these are individuals who are new to the fight. So they just don’t have the training that al-Qaida would have provided in years past. They’re focused on simple, but still very deadly and lethal, attacks, obviously. But mass shootings, knife attacks, vehicle ramming incidents. So unsophisticated, but in some respects more difficult to detect. And ultimately, the volume is greater, so it just requires a lot more resources collectively, both here and overseas.

Dr. Jones: Right, because the value for someone like Zazi, when he goes to Pakistan and goes to a training camp, is he comes back reasonably well-qualified to put together a bomb that he can put in a backpack, walk into a subway, and blow himself up. What we see with some of the individuals you’ve described is less sophistication, less concern about killing large numbers of people, but still would have a dramatic effect in the U.S. homeland.

What is – so you did mention some of the plotting, some of the arrests we’ve seen this year, including ISIS, including Oklahoma. Can you talk a little bit about how would you put that into context? How serious were those threats to the homeland? And, just more broadly, you know, what are the lessons you pull out on the counterterrorism side for cooperation to make some of the key arrests that we’ve seen?

Mr. Holmgren: Yeah. Well, first, let me just say they were serious threats. And that is why we have – the collective “we” in the U.S. government and the counterterrorism enterprise – have taken them so seriously. This was the first time in some years where, you know, ISIS had established, you know, effective relationships and communication with individuals in the United States. That’s a big deal. And it’s why we have, I think, aggressively moved and coordinated so much more closely with FBI, with DHS, to make sure that we’ve got all the support at the border to vet individuals as well.

But, you know, ultimately what it comes down to is a combination of excellent, you know, traditional intelligence collection with kind of a faster sharing of that information with our domestic partners – in many cases in real time. And you talk about one of the other evolutions since 9/11, as it pertains – actually, this one pertains to NCTC. You know, I have – I’m here in an acting capacity. Never worked at NCTC. I had the pleasure of working with NCTC over many years. But having stepped into the role this summer, you know, as the U.S. government – you know, there are other threats in the world and resources have necessarily been adjusted to address strategic competition. It’s meant that there have been less resources across the U.S. government for counterterrorism.

The silver lining in that, if there is one, is that it has forced the remaining kind of core CT elements at NCTC – which we’re the only entity that’s focused 24/7 on counterterrorism – but also at the intel agencies, at FBI, elsewhere, to work even more closely together, and to work – and to collaborate in ways that I think, in the past where the resources were plentiful, you maybe wouldn’t see it. So the one silver lining we’ve seen this summer has been, you know, I think NCTC really taking a convening role in bringing the agencies together to really drive threat analysis and to actually surface leads to support our operational partners.

Dr. Jones: Well, part of what you just did is talk a little bit about sort of the origins of NCTC and its evolution. Now, I remember when NCTC’s precursor, TTIC, was established. And then NCTC formally gets off the ground. You know, its focus is – this was after 9/11 – its focus really was on dealing with a major terrorist threat to the homeland that, as you’ve described, evolves from really a focus on al-Qaida, to groups like ISIS, and others. The focus now, and it has been with the last two National Defense Strategies – so first under Trump – the Trump administration, then under Biden.

But under the Trump administration, it was pretty explicit that great-power competition, not counterterrorism, are the primary focuses – now, that’s the National Defense Strategy – of the United States. How have – how have you evolved, or how has NCTC evolved to deal with the growing role of major powers – the Russians, the Iranians, the Chinese – in this sphere? And then I want to come back a little bit later and talk about how to balance activity against state actors with still dealing with the threat from nonstate actors. So, first, how do you – how do you balance the great or the major powers and the – and the nonstate actors?

Mr. Holmgren: Well, our mission – I mean, NCTC’s mission has – it remains unchanged, right? It is to integrate, to analyze, share information first and foremost, to conduct strategic operational planning, to support national counterterrorism policy objectives. It is to maintain the Terrorist Identities Datamart Environment, which is all the underlying data that helps feed and support our screening, vetting, and watchlisting efforts throughout the U.S. government. And then more recently it is to pursue and to identify terrorist threat leads that we can share with operational agencies to disrupt plots before they occur. So our mission hasn’t changed.

The way we work has changed. And I think it’s shifting much more to an offensive posture where, in addition to doing the traditional analysis, tactical and strategic, where can we really support and drive our state and local partners, you know, if there’s a foreign terrorist nexus, but also to support DOD partners and our intelligence agencies. I think that’s the shift, is we’re playing a more, I think, impactful and meaningful operational support role.

Dr. Jones: So in this gray area, what role have you seen? And has there been an evolution in the role that states play in this arena? I mean, Iran is clearly the biggest example of this with the Quds Force. The Russians, starting in 2015 when they got involved in the campaign in Syria, do work with Hezbollah as part of that ground campaign with the Assad regime and some of the Iraqi, Palestinian, and other forces that came in and conducted offensive operations. So states have been involved in dealing with terrorist groups. How big of a concern is that and a focus is this sort of gray area where states – adversaries, really – may operate in some cases by, with, and through terrorist organizations?

Mr. Holmgren: Well, it should be no surprise that Russia has historically dealt with unsavory groups. And you just mentioned one, Hezbollah, that they continue to deal with. So it should be no surprise that they will leverage kind of many different nonstate actors to pursue their objectives.

You know, I think there are limits to what groups they could work with. Certainly, ISIS-K’s attack in Moscow earlier this year I think is a pretty good indication that relations between ISIS and Russia are not great. And I think as long as you’ve got this large Central Asian Russian-speaking population in ISIS-K, it’s going to be – you know, ISIS continues to plot against Russia even to this day. So wouldn’t rule it out, but you know, I think most of the cooperation we’ve seen that Russia’s provided is in the Hezbollah context.

You know, I think when – on the strategic competition topic generally, you know, one of the things that has stood out to me actually pertains to China. And the PRC has, I think, looked at how effective the U.S. government has been at the counterterrorism challenge over many years through, you know, a lot of experience, both in the battlefield and then also in the – kind of the back-office functions, and they have recognized that offering counterterrorism assistance and training support to nations where they are seeking a strategic advantage is in their benefit.

Now, what’s different, of course, is the PRC approaches these engagements in West Africa – coastal West Africa, you know, with no strings attached to what they can – what they’re offering and what they can provide, notwithstanding, you know, any human rights issues that may exist. And so the – China is using CT as a counter – as a – as a tool to advance their own strategic competition when it comes to – if you think about sort of how they’re looking at the world globally and where they’re trying to check and counter the United States.

Dr. Jones: And I think it’s safe to say the Russians have as well with what we used to call Wagner Group. It’s private military companies.

Mr. Holmgren: It’s private military companies, exactly. Right.

Dr. Jones: So one big question. You mentioned Hezbollah. Can you talk a little bit about the impact on global terrorist organizations of October 7th? Did that ripple through groups? Did that inspire some? What’s been the overall impact of the October 7th attacks in Israel?

Mr. Holmgren: Yeah. We’ve said it was likely to be a generational event and I stand by that assessment.

Unfortunately, the data that we have seen in NCTC – we mentioned this publicly but, you know, more than 40 either attacks or disrupted plots in over, you know, 20 countries just in the last year that have had some link whether inspired or motivated by 7 October.

So it really has had an impact on the ground. I think the bigger impact, though, is that 7 October and then the ensuing conflict came at a time where groups like ISIS and al-Qaida were at some of their lowest operational levels and so it really has – it was a serendipitous time for groups like that and the movement more generally and it provided a shot in the arm when it comes to recruitment, fundraising, and – you know, I think it’ll turn out to be probably the most consequential recruiting event for just the kind of global terrorism movement since we’ve seen in the Iraq war.

Dr. Jones: And how much of it was – just the attack itself on Israel how much of this was the information campaign that came about following October 7th with strikes in Gaza and the wars that unfolded there and in Lebanon?

Mr. Holmgren: It’s tough to say. We don’t have any hard data on kind of what has been the weightier factor but I would say if you look at the propaganda that ISIS and al-Qaida – which, by the way, al-Qaida had never been a close friend of Hamas. They have pretty significant differences.

If you look at what they’ve been putting out it’s the images of the destruction in Gaza and the humanitarian, you know, suffering there. So they’ve really – it’s been much more on that humanitarian kind of side of things in their recruitment videos.

Dr. Jones: So what is your sense of – just turning to some of the groups there, I was just in Israel and Hezbollah – the combination of Israeli strikes against Hezbollah’s leadership including Nasrallah, the pager/walkie-talkie/laptop attacks in the supply chain, and then also the disruption in the command and control networks plus the very limited Israeli ground incursion and some of their strikes against Hezbollah’s ballistic missile capabilities, for the moment do appear to have significantly impacted Hezbollah’s capabilities.

But what is your assessment of where Hezbollah stands today and its possibility for, you know, rejuvenation and revitalization? I mean, it has generally been considered probably the preeminent terrorist organization overseas in capabilities.

Mr. Holmgren: Mmm hmm. So you’re right in that, you know, our assessment is that the Israeli military actions have significantly degraded Hezbollah’s military capabilities. But they had – before the conflict they had built up unprecedented numbers of rockets and missiles and other munitions. So they had – on hand they were starting at a very strong point.

The leadership losses have had an impact on their ability to – I think to organize and to strategically put together a way forward. But the ground forces in the south remain somewhat intact and as it pertains, you know, from a terrorist’s perspective outside the region, you know, their external capabilities have, largely, been untouched.

So in terms of the Islamic jihad organization and that external component of Hezbollah, you know, we assess there’s been little impact thus far. It still remains, you know, down but far from out.

Dr. Jones: Which in years and decades past have led to attacks in Latin America, Africa, Asia, and other locations.

Mr. Holmgren: Right. Right.

Dr. Jones: Yeah.

Mr. Holmgren: And it’ll be no surprise that we are, you know, monitoring very closely for any indication of, you know, Hezbollah seeking to escalate kind of horizontally, and working very closely with partners around the world to focus on that.

Dr. Jones: So your assessment of Hamas, how does that vary – I mean, again, a number of Hamas’ leadership has been taken out, including Sinwar recently. What is your assessment of Hamas to – part of the challenge in Palestinian areas is there’s still – you know, there’s still a lot of – there appears to be a lot of support for Hamas in general over the long run and potential opportunities for them to revitalize. But what is your assessment where Hamas sits right now, particularly since the period prior to October 7th?

Mr. Holmgren: Militarily, they have been significantly diminished. And they’re essentially morphing into an insurgent force on the ground, and they’re turning to small arms and hit-and-run, different types of tactics; you know, lobbing some mortars, you know, into Israel. But they’re really – they’ve been forced to – you know, to keep a very low profile.

Now, having said that, even a diminished Hamas is able – has been able to recruit new members to its ranks, and will likely continue its ability to do so, so long as there is not another viable political option on the ground for, you know, these disaffected young men in Gaza to turn to. And so I think that’s why it’s even – you know, even more important moving forward you’ve got to – in order to undermine the appeal of Hamas, there has to be a more viable political actor on the ground in Gaza to give them – you know, to give – these new recruits for Hamas, to give them a better option.

Dr. Jones: Last question on this stream is if you take a look back over the last few years with the Assad regime’s ability to retake territory in Syria with the help not just the Russians but of the Iranians, with the collapse of the Afghan government, and obviously a continuing relationship between Iran in the Quds Force and Iraqi groups, there’s a lot of – there are a lot of Iranian partners throughout the region – in Lebanon, in Syria, in Iraq, to some degree in Afghanistan, in Yemen with the Houthis. As you look over the next year, what are your concerns about Iranian activity and its relationship with these kinds of organizations? It has been a challenge for the U.S. The Navy has had to – you know, has been deployed to the Red Sea to conduct operations. There’s been a lot of U.S. assets, carrier strike groups pushed into the region. What’s your sense about kind of the challenges ahead over the next year as the Iranians still have a reasonable relationship with groups across the region?

Mr. Holmgren: Well, look, Iran remains the leader of the so-called Axis of Resistance. And it has, as you noted varying degrees of relationships and operational and strategic control over groups – Hezbollah, which is a proxy of Iran, but also, you know, they provide support to groups like the Houthis. But the Houthis are kind of an independent actor; they do their own thing. There are other groups in Iraq, and in particular, you know, Kataib Hezbollah, KH, which has been responsible for the largest number of attacks against U.S. forces in the region over the last year.

I think our concern is that, you know, Iran, you know, increases the use of these groups as part of its shadow war against either us and/or Israel, in part because they, you know – you know, may be concerned about their own capabilities in light of some of the Israeli strikes against them. And so do they decide to even lean more heavily into these groups and encourage them to operate outside of the region is the risk that I think we’re most focused on.

Dr. Jones: And some of them have done that in the past. I mean, I think it’s been interesting to watch where the Houthis, too, have not just utilized Iranian technology for strikes; they’ve actually exported some of that as well.

Last question. And we’ve got a lot of questions from folks in the audience. But last question for you is – this is a little bit of worry for me, so maybe you can push back and tell me I shouldn’t be worried.

There were years, including when I was in the Special Operations community, where we had, you know, a reasonable footprint and a pretty significant battle rhythm of operations against groups in Syria, in Iraq, in Afghanistan, in Somalia, in Libya, and in West Africa. Our footprint has declined notably, in part because the priority is – of the military has been the major powers, and so what it’s meant is a withdrawal of a number of forces. As you noted, the U.S. still does have capabilities that it can strike and has struck ISIS and other targets in places like Syria. The current administration in the U.S. killed Ayman al-Zawahiri in Afghanistan as well. So there are capabilities to do that, but it’s not as easy as it once was. We don’t have all of the intelligence capabilities. It’s harder to get access to places like Afghanistan because we don’t have basing in and around that area.

So the big question for you is, where do we have to be careful about pulling back too much from dealing with terrorism? And where do we run risks of not keeping a foot on the pedal against it? Because I think the worry a little bit in some quarters is that if we’re not careful, we take our foot off the pedal a little bit too much, some of these groups will strike us whether they’re Shia groups linked to Iran, groups linked to ISIS including inspired ones, or ones to al-Qaida. So how do we manage that when we’ve withdrawn forces from a lot of areas? I know AFRICOM would like more military resources; they don’t have that right now, so.

Mr. Holmgren: Well, look, as a lifelong counterterrorism professional, you always want as much as you can possibly have, whether it’s collection or operational capabilities on the ground. Having said that, again as someone who has been in a role where, you know, terrorism was one of several portfolios that, you know, I had to focus on every day, I recognize that the threat landscape – the global threat landscape has changed in the world over the last 10 years. And in some respects, that’s a credit to the counterterrorism community because of the success, again, over many years that’s allowed policymakers to accept some risk in the CT fight and to invest those resources in other areas, whether it’s – whether it’s Asia or now Ukraine.

Having said that, I think as we have seen in the last – really, the last 18 months in particular with a reenergized ISIS, and the growth of ISIS and JNIM in Africa, you know, we sort – we have to be very deliberate about how we manage these competing resources moving forward because – and that includes, by the way, the threat to the United States here in the homeland, because, you know, our security is not a birthright. You’ve got to invest it – you’ve got to invest in it. You have to constantly pay attention to it. And you know, for the most part, here in the United States people can wake up and go to work every day and drive their kids to school and go to soccer games not worry about another 9/11. And when I fly on an airplane, I don’t – I have very little worry about that commercial airliner in the United States being subject to a terrorist attack. But that’s because of all of the capability that we invested, the screening and the – and the intelligence fusion activities, whether it’s at the airport or with our domestic agencies.

But security is – it’s a lot like oxygen. When you have it, you don’t think anything about it. The minute you can’t breathe, that’s all you can think about. And so, to me, that is a reminder that we have drawn down resourcewise across the government when it comes to CT over the last few years. We’re stabilizing now. And that – and it’s been adjusted and calibrated to the current threat environment, and I think it’s moving forward.

We’ve got to be – we’ve got to be agile in our capabilities to remove direct threats to us. We’ve got to be – I think we’ve got to be careful about depending too much on particular areas where we host those capabilities. And we’ve got to make sure that we are investing both in the last line of defense here in the United States. And that means all of the really – especially with all the changes in the technology environment, making sure that we have fully interoperable systems between the intelligence community and our folks at the border, so that they can make sure that we’ve got the border threat addressed.

And then, over the horizon, whether it’s finished capabilities or intelligence collection, if we are unable as an intel community to provide that tactical and strategic indications and warning, that is when we run the risk of being blinded by the emergence of, you know, some new group in Africa who, all of a sudden, is plotting against the United States. We can’t let that happen. So we’ve got to continue to invest in these core capabilities.

Dr. Jones: So, sort of along those lines, want to get to a number of questions. This is from someone in the audience who asks: What guidance recommendations would you provide to the next administration to sustain these successes, including this year in the U.S. homeland, that NCTC has benefitted from, historically?

Mr. Holmgren: Well, I just mentioned a couple of them. I think looking at our partnerships around the world we’ve had some extraordinary successes in the partnership front just over the last four years in places like Africa. You know, there’s more work to do. And so one is I think taking a fresh look at our CT partnerships and making sure that we are not overly dependent on any of them, including with some of our closest friends and partners. We’ve been, as reported publicly, heavily dependent on the Israelis. And they were, you know, caught off guard on 7 October. So it’s a reminder that we’ve got to – we’ve got to make sure that we have all the right resources and capabilities in place that can protect the United States.

Dr. Jones: Yeah, and I think we were caught off guard too. I mean, our intelligence community was caught off guard, to some degree. Actually as, I think, were the Egyptians, the Jordanians, the Qataris, and a number of others as well.

Mr. Holmgren: Mmm hmm. Yeah. Yeah, it’s not unique, but the point is making sure that we are not overly dependent. Secondly, is, again, on the identity intelligence and on the screening and vetting. Just incredibly, incredibly vital that we are investing in the technology to make sure that that data is available to the homeland security folks who need it, kind of when they need it. Going to become even more important moving forward.

And then the proliferation of the commercial, you know, unmanned aircraft systems, the UASes, both commercial but, in some respects, even the military, the conventional grade. This is obviously a growth market for a lot of nations, including some of our close friends overseas that are benefiting from these sales. And we get that. But when terrorist groups are acquiring and reconfiguring these things for their own nefarious purposes, just, you know, imagine the threat that the proliferation of these types of capabilities would pose to our facilities overseas that are not hardened.

And so we’ve got to – I think investing in – and, again, these things are not – it’s not that you can’t defend against them. They’re not indefensible. But you’ve got to be – you’ve got to have the right technology in place. You’ve got to have the right kind of hardening capabilities in place at key facilities. And then you’ve got to scale and be able to provide some of the countermeasures at scale at a cost, efficient way. So.

Dr. Jones: Sounds good. Well, hopefully that advice will be followed. Here’s another question from one of the audience members. What’s driving youth radicalization in the U.S.? And if it’s the internet, how do you limit radicalization online? You know, there may be also a secondary question because you’ve mentioned before this – you’re seeing juveniles involved in terrorism as well. So there’s a U.S. component, but also there’s a juvenile component that I know you’ve tracked as well.

Mr. Holmgren: There is. And obviously when it, you know, comes the youth radicalization in the United States, FBI and DHS have the lead mission for that. We at NCTC look at it from the foreign terrorist organization, you know, kind of what influence are they having on radicalization here in the United States. And again, this is not unique to our – to the United States. It is an equally significant problem, especially in Western Europe.

It was – you know, COVID-19 didn’t help. And this, again, not unique to the terrorism problem set. But you had a large number of young individuals who were online for large portions of the day. And especially those who were already in vulnerable settings, they have – you know, they have gravitated – the ones that have linked up with ISIS or have been inspired by ISIS, you know, they’re looking for belonging and meaning, and a real – a sense of accomplishment. And so these – a lot of the propaganda, it’s easily accessible on the social media platforms. It is – a lot of it’s in English.

And it’s not just – in the day, it used to – back in the day, it used to be just al-Qaida or groups – you know, al-Qaida in the Arabian Peninsula who would use the Inspire magazine. Now you have many different groups that are focusing on the English language thing. So I think first and foremost is – I think there is a lot more work to do both here and abroad on the prevention side. That was a big focus many years ago. It’s hard, but figuring out ways that we can reinvest in some of these local communities, and with parents, and faith leaders to try to identify those individuals who are engaging online before they move, very quickly, into the radicalization phase.

And then also, look, a number of the social media companies are now – they’re no longer U.S.-based. And so they’re overseas, or they have overseas ownership. I think, you know, in the first instance, really working with some of our foreign partners to encourage these companies to enforce some of the voluntary standards around, you know, content moderation when it comes to violent extremist media is an area that there’s more work to do.

Dr. Jones: We don’t have time for a lot more questions, but we’ve got a couple that I think we can probably squeeze in. 127 Echo programs have been the bedrock of success against AQI and ISIS in Syria and Iraq. This is someone from the audience. Do you see these types of programs as a viable part of our counterterrorism efforts in Africa? Are other tools also of great value?

Mr. Holmgren: I think – yeah. I think in Africa, especially when it comes to the Sahel and West Africa, again, a lot of – a lot of these – a lot of these governments have very basic security capabilities, but even less basic when it comes to counterterrorism capabilities. And so I think starting with the fundamentals, I think if we try to do too much too soon we’re going to overwhelm a very, very small – a lot of times very, very small security forces. And some of these programs take a long time to build partner capacity. These governments, they need support now. And they need – so they’re – while they may be interested in some of the longer – programs that have a longer tail, I’m not sure we can wait.

So I think we got to do the long-term capacity building, but we also have to do the short-term how do we get information sharing mechanisms in place? How do we get them the intelligence they need? How can we give them some basic capabilities that will allow them to conduct their own collection activities and also to conduct their own disruption activities, with – you know, sometimes with U.S. support, sometimes allow them to do that unilaterally.

Dr. Jones: OK. One or two last questions. This one from Voice of America. And you can answer it however you want. Does the U.S. know who’s currently leading ISIS? And does this person remain in the Syria-Iraq area? Or have you seen ISIS core moving toward basing in Africa, whether in Somalia or Sahel? And reports indicate al-Qaida’s de facto leader remains based out of Iran. What does this indicate about how Tehran may still be seeking to use al-Qaida going forward?

Mr. Holmgren: Yeah. I will defer to a classified setting on the first part of the question. What was the last part on Iran?

Dr. Jones: So the question was: Reports indicate that al-Qaida still has leaders in Iran right now.

Mr. Holmgren: Yeah.

Dr. Jones: What does that – what does that suggest about how Tehran may seek – may seek to use al-Qaida in the future?

Mr. Holmgren: Yeah. Well, I mean, you know, Saif Al-Adel has been in Iran, the leader of al-Qaida. They have provided harbor –

Dr. Jones: He goes back to the Bin Laden days.

Mr. Holmgren: Yeah. He does. You know, they’ve provided harbor to al-Qaida leaders for years. So I’m not – I won’t speculate on what the Iranian intentions are, but suffice to say it is unhelpful with his presence there because he is still the de facto leader of – you know, of the al-Qaida organization.

Dr. Jones: Last question here is: Can you speak to the relationship between terrorist organizations and organized crime? How has that relationship evolved, and where do you see it headed?

Mr. Holmgren: Well, I think the – I think, you know, the Iranian-linked terrorist plotting, including against U.S. officials and against officials in other Western countries, is probably the most recent example of – groups like the Quds Force seeking to use, you know, criminal elements and surrogate networks to conduct their operations. Hezbollah has used these types of, you know, criminal networks in the past. And it’s designed to conceal and hide their activities, to try to give them some deniable cover to the operations.

And thanks to the really incredible work of the FBI over the last couple of years, where they have – working with the intel community – have uncovered Iranian efforts to do so in the United States, it has – they have not succeeded. But we know the Iranians are relentless. And they are determined to avenge the killing of Soleimani. And so that is probably the most recent example. But, again, Hezbollah has done that before. And then, of course, in the state context, you know, the Russians have played around with using criminal networks to conduct some of their own sabotage operations.

Dr. Jones: They certainly have. Last question, for the Swifties watching this, is, you know, there certainly is a concern, the way we started this, about threats to the homeland. But Americans also go to concerts overseas, as they did in Vienna for those two concerts that Taylor Swift had organized. How serious was that plot? And, you know, just basic – you know, sort of broadly speaking, I mean, what do you characterize as a success, again, of a situation like that in thwarting what appeared to be a pretty serious attack?

Mr. Holmgren: Yeah. Well, let me say as a – as a fellow Swiftie fan, I was deeply disturbed by it. But on a more serious note, it was a serious plot, and the individuals, who were arrested with – by all accounts had pledged bayat to ISIS and were inspired by ISIS, sought to kill a large number of people outside that concert venue.

Now, it should be – I would just say that, you know, concert venues have been a persistent focus for groups. We had the Bataclan concert hall in Paris in 2015. In 2017 in Manchester, England, you had the Ariana Grande concert attack, again outside the venue. And then just this past March ISIS-K’s attack on the Crocus City music hall in Moscow.

So I think the takeaway for us is they are – you know, they’re looking at large public gatherings where there – it’ll garner a lot of attention, and they’re looking for weak points in the security. And so that – but it – so that’s – for us, it’s a reminder that as – and I know DHS has done a lot of work. They had done it before, obviously, this plot emerged, but it’s a reminder – with all the different concerts and events here in the United States, that’s why there’s always such a big footprint outside our events, because we know that presence can deter. And you know, I think, you know, moving forward you’re going to see a lot more – a lot more of that.

Dr. Jones: Well, as a fellow Swiftie, thank you for the work that you, the government, our allies and partners are doing on a day-to-day basis. And as I said earlier, I don’t think most Americans have a full appreciation for how much work gets done behind closed doors for the protection of Americans both at home and overseas.

So thanks. Thanks to you and your colleagues. And if everyone here could join me in thanking Brett for a fantastic discussion. (Applause.)

Mr. Holmgren: Thank you, Seth.

Dr. Jones: Appreciate it.

Mr. Holmgren: Appreciate it. Thank you. (Applause.)

(END.)