At the Sixth Ministerial Plenary Meeting in New York on 27 September 2015, Global Counterterrorism Forum (GCTF) Ministers endorsed the launch of the GCTF’s Initiative to Address the Life Cycle of Radicalization to Violence (Life Cycle Initiative). As part of this new initiative, and in recognition of the complexity of the issues relating to returning “foreign terrorist fighters” (RFTFs) and the need for additional detail, the GCTF’s “Foreign Terrorist Fighters” (FTF) Working Group was tasked to develop an Addendum relating to elements of Good Practice 19 of the GCTF’s The Hague-Marrakech Memorandum on Good Practices for a More Effective Response to the FTF Phenomenon (The Hague-Marrakech Memorandum)1, and other relevant issues pertaining to RFTFs. This Addendum to the GCTF’s The HagueMarrakech Memorandum is a contribution to this initiative.

The GCTF’s The Hague-Marrakech Memorandum focuses on the threat of FTFs2 . States are now increasingly concerned with the potential threat posed by FTFs who return home or travel to a third State. This threat ranges from the involvement in plotting terrorist attacks, to establishing new terrorist cells, or linking up with existing local terrorist networks. RFTFs can also provide operational expertise, raise funds for terrorist activities, be actively involved in recruitment, be vulnerable to (further) radicalization, or be a source of inspiration to others susceptible to terrorist ideologies. In this regard it is important to note that the distinction between “home-grown” and “foreign” terrorist fighters is becoming increasingly blurred. The radicalization life cycle of RFTFs often starts at home. There is also the risk that RFTFs may suffer from post-traumatic stress disorder (PTSD).

United Nations Security Council Resolution 21783 (UNSCR 2178) underscores the importance of law enforcement tools in countering the RFTF threat. Investigating, prosecuting, and detaining RFTFs who have committed crimes and pose an ongoing threat can and should be at the forefront of States’ responses to this phenomenon. States face numerous challenges in the identification, detection, prosecution, and rehabilitation of RFTFs. The lack of a clear profile of an FTF is one; just detecting and tracking their movements so that States are aware of their return is another. States need to improve the timely detection of their travel. RFTFs take advantage of porous borders, use stolen passports, and are increasingly creative in interrupting and diversifying travel routes, thereby making optimal use of freely available encrypted communication technology to conceal their travel plans.

While detection and information sharing are key to successful investigation and law enforcement action against RFTFs, other issues that could impair effective prosecutions include the inability to secure strong evidence on activities that took place abroad, the inability to use intelligence in criminal proceedings, or the need for, and availability of, mutual legal assistance. Considering the number of RFTFs who cannot be prosecuted or who have already served (a short) time in prison, States should consider how rehabilitation programs can assist in ensuring a meaningful reintegration into society.

There is a growing recognition that States should adopt a comprehensive approach which should be a mixture of preventive, security, criminal, and rehabilitative measures. It should address the repression of terrorist acts, the prevention of (further) radicalization and/or violence in the direct social environment of the returnee, and, ultimately, the reintegration of RFTFs into society.

The implementation of this Addendum must be consistent with applicable international law, as well as national law and regulations, taking into account the varied histories, cultures, and legal systems among states. Principles such as proportionality and legality underpinning human rights should be carefully observed to ensure that an individual right is only restricted when absolutely necessary, legitimate, and proportionate.

The following non-binding recommendations provide additional guidance on how States can address RFTFs. This document builds on the GCTF’s The Hague-Marrakech Memorandum4 and other relevant GCTF (and GCTF-inspired) documents such as the GCTF’s Recommendations for Using and Protecting Intelligence Information in Rule of Law-Based, Criminal Justice Sector-Led Investigations and Prosecutions5, the GCTF’s The Hague Implementation Plan on FTF, the Malta Principles for Reintegrating Returning Foreign Terrorist Fighters (FTFs) (22 Principles) developed by Hedayah and the International Institute for Justice and the Rule of Law (IIJ), and the Guiding Principles on Foreign Terrorist Fighters of the Security Council Committee established pursuant to resolution 13736 .

1. See the GCTF’s The Hague-Marrakech Memorandum on Good Practices for a More Effective Response to the FTF Phenomenon.

2. For a definition see the GCTF’s The Hague-Marrakech Memorandum or United Nations Security Council Resolution 2178 on Threats to International Peace and Security Caused by Terrorist Acts (UNSCR 2178), S/RES/2178 (24 September 2014).

3. Supra note 2. 

4. Supra note 1.

5. See the GCTF’s Recommendations for Using and Protecting Intelligence Information in Rule of Law-Based, Criminal Justice Sector-Led Investigations and Prosecutions.

6. S/2015/939 (23 December 2015).

Recommendation 1

Ensure timely detection of, and intensify information sharing on, RFTFs within and between States.

Sharing of concrete, timely, and accurate information is vital to identify and detect RFTFs. The more relevant information that is shared in real-time between governmental and nongovernmental partners – such as financial institutions, the travel sector, internet service providers, and other private sector organizations as appropriate – the more capable States will be in assessing potential risks and responding effectively. Furthermore, States are encouraged to share “operational” information and develop practical tools and procedures to ensure that the information they receive is appropriate, timely, and actionable. States should facilitate the interoperability of the current multilateral information systems.

In line with Good Practice 15 of the GCTF’s The Hague-Marrakech Memorandum7, States should make better use of existing multilateral information systems and bilateral mechanisms, which provide information regarding the whereabouts of known FTFs, including minors, recruitment and relevant human smuggling networks, FTF travel routes, the production and use of false travel documents, stolen and lost identity or travel documents, the procurement or acquisition of firearms and explosives, and illegal trafficking of weapons. States should consider making use of other inter-state and relevant databases. In addition, States should regularly update national and regional Sanctions Lists, based on UNSCR 12678 , 13739 , and 225310 . States are also encouraged to share national lists of known individuals having the intent to commit terrorist attacks and, if applicable, no fly lists.

To improve inter-agency cooperation and coordination, some States have created mechanisms – such as a fusion center, national counterterrorism coordination body, or information-sharing arrangements – in which law enforcement, (military) intelligence, border control agencies, and public prosecution services, while working independently, share relevant information whilst maintaining control over the information. Regional information hubs and networks for cooperation have also proven effective tools to share timely information.

Timely detection is based not only on the presence of accurate and timely information, but also on effective border and police controls – in terms of qualified staff and appropriate detection technology. States should strengthen their border security capacity at critical points of entry and implement coordinated border management. States should ensure that all law enforcement and border agencies have adequate access to relevant multilateral, regional, and national databases. Furthermore, close collaboration between countries of origin, destination, and transit is necessary. States are also encouraged to develop evidence-based travel risk assessment tools and screening procedures. In some countries specialized risk analysis units have been established.

Despite technical challenges, States are encouraged to implement systems for the processing and analyses of passenger data, such as an Advance Passenger Information (API) system and consider developing Passenger Name Record (PNR) systems. To facilitate the implementation of travel information systems, some countries are establishing a centralized and automated portal that collects all travel information. By using a “single window” system, airlines have to submit travel data to just one single entity.

States should devise robust community engagement and enhanced border policing approaches, to include communities, particularly in remote border areas, to contribute to efforts to detect and prevent illegal border crossings. Connecting border communities with central and regional border management could be done through establishing hotlines.11

7. Supra note 1.

8. S/RES/1267 (15 October 1999).

9. S/RES/1373 (28 September 2001).

10. S/RES/2253 (17 December 2015).

11. For additional guidance, see the GCTF’s Good Practices in the Areas of Border Security and Management in the Context of Counterterrorism and Stemming the Flow of Foreign Terrorist Fighters.

Recommendation 2

Use individual risk assessment tools that provide a basis for tailor-made interventions.

In accordance with Good Practices 16 and 19 of the GCTF’s The Hague-Marrakech Memorandum12, States are encouraged to develop and use individual risk assessment tools to determine the threat a RFTF poses to society. Effective risk assessment will indicate whether a RFTF is vulnerable to (further) violent extremism and is receptive for rehabilitation. An initial individual risk assessment should be performed by trained professionals as early as possible once an FTF has returned and/or has been legally detained. It can help to determine which interventions are potentially effective and what tailor-made interventions are appropriate. Risk assessment tools will help States to allocate resources and improve the effectiveness and efficiency with which RFTFs are dealt with.

The risk assessment tool should contain a clear set of risk indicators that should relate to the needs of an individual (motivational factors), the narrative (adherence to an extremist ideology) and networks (the intent and capability to carry out terrorist attacks as well as the support of the social network for the extremist ideology). Risk assessment should be conducted by persons proficient in understanding the many facets of radicalization and the local and cultural context.

In-depth risk assessments should make use of multiple sources including interviews with the individual, family members, and social networks observations, and case files. Re-assessment is essential to develop an overview of the risk trajectory over time. States are encouraged to validate their risk assessment tools – internally and, if possible, externally. States could consider cooperating with each other on harmonization of tools and exchanging data. Risk assessment tools that are being used in prisons for violent extremist offenders can also provide valuable lessons learned for the development of risk assessment tools for RFTFs.

12. Supra note 1

Recommendation 3

Apply a case-by-case approach and address specific categories of returnees.

In view of Good Practice 19 of the GCTF’s The Hague-Marrakech Memorandum13, States are encouraged to develop targeted and tailored engagement approaches for RFTFs in accordance with their national laws. Deciding which measure should be applied to a RFTF should be made on a case-by-case basis and weigh the following factors: the risk the individual poses with respect to the commission of a terrorist attack; the gravity and seriousness of the crime; the available evidence; motivational factors; the age of the returnee; the support network of family and friends; the impact on victims; and the public interest. The application of individual risk assessment is a helpful tool to reach such a balanced decision.

Taking a case-by-case approach will allow States to address specific issues RFTFs are dealing with, which may be particularly relevant for minors, women, and those with mental health problems. In some countries, a RFTF that is dealing with mental health issues could be placed in custodial care or could be hospitalized. With respect to returning minors, States should consider – if appropriate – to apply child protection measures in addition, or as an alternative to, prosecution and sentencing. These measures should promote the rehabilitation and reintegration of the minor into society and could include counseling, education, or other forms of support. In some cases, a minor RFTF with (mental) health issues could be placed in a closed child care institution by a juvenile court.

Furthermore, children that have been taken involuntarily to destination countries or are born in these countries have been exposed to violent extremism on a regular basis and are likely to require specific support and care upon return. Furthermore, States should take into consideration family members of a RFTF that are affected and in need of assistance.

13. Ibid.

Recommendation 4

Invest and develop a close partnership with local government and local communities to deal with RFTFs (GCTF’s The Hague-Marrakech Memorandum, Good Practice 1914).

States are encouraged to develop a good partnership with both local government and local communities. While States are in charge of developing a comprehensive approach in dealing with RFTFs, local governments and local communities often have a better understanding of the context in which individuals in their communities have become radicalized and can play a critical role in preventing violent extremism, detecting the return of an FTF and assisting in the reintegration of a RFTF into society. Local authorities can thus play an important role in individual risk assessment by providing relevant information and in deciding on appropriate, tailor-made interventions.

Timely sharing of information between the national and the local level is essential. Local police can – through regular contacts with the family, schools, and neighborhood – be involved, where appropriate, in monitoring and surveillance of RFTFs and in collecting evidence through interviewing teachers, friends, or family members.

Local governments should be closely involved in developing a reintegration program for RFTFs. The local government can advise on housing issues, education, and job prospects within the municipality, but can also help to prepare and gain support from the local community to accept the return of an FTF into the community.

In some countries, multidisciplinary panels or teams have been created, including at the local level. The use of multi-disciplinary platforms to discuss RFTF cases can facilitate reaching a common assessment and making a proper and tailor-made decision as to how to proceed in an individual case. These multi-disciplinary teams could consist of law enforcement, security agencies and prosecutors but could also involve social workers, probation services, and relevant municipal authorities to further assist in reaching integrated decisions - respecting the mandates and responsibilities of each of the partners.

Furthermore, States are also encouraged to reach out to local communities and establish constructive dialogues. States could facilitate setting up independent telephone helplines, local points of contacts, or family support units, which provide counseling, support and information to family members of RFTFs. To gain trust, it is advisable to develop privacy rules and share these with the local community. The support of family members and the local community are vital to achieving a successful reintegration of a RFTF back into society and to prevent (further) radicalization to violence in the direct social environment of the RFTF.15

States should consider measures to ensure that other actors, which may include the private sector, civil society organizations, local authorities, community leaders, receiving communities, and families, are provided with adequate support and guidance in their roles and that they take on roles that suit their unique strengths and consider their limitations.

14. Supra note 1.

15. For additional guidance, see the GCTF’s The Role of Families in Preventing and Countering Violent Extremism: Findings, Recommendations and Programming Options.

Recommendation 5

Engage and build sustainable partnerships with multi-disciplinary actors in the private sector and civil society organizations.

The need for a multi-disciplinary approach is one of the key principles of the Good Practice 19 of GCTF’s The Hague-Marrakech Memorandum16. States are encouraged, while being in charge of developing a comprehensive approach in dealing with RFTFs, to closely work together with the private sector and civil society organizations. While ensuring their leading role, States need to establish and maintain a good and transparent working relationship with the private sector and civil society organizations.

First, in order to facilitate the exchange of timely information and detection of travel, States should ensure that national watch lists, UN sanctions lists, and other relevant lists are disseminated and accessible to the financial sector, travel services providers (airlines, tour operators, cruise lines etc.), and public and private registries. Financial intelligence can play not only a vital role in detecting RFTFs, but also help reveal the networks within which they operate. Financial institutions generate a huge amount of data, but in order for financial institutions to identify financing of terrorist activities, governments can provide the financial sector with sets of indicators through which a potential FTF can be detected.17

Second, States should engage with internet companies to improve the collection and preservation of evidence on the internet located within the country or abroad in order to ensure effective investigation and prosecution of RFTFs. States are increasingly working together with internet service providers and civil society to identify and prevent violent extremism and on-line recruitment, but need to further expand their cooperation with internet companies to address the increasingly complex internet infrastructure (e.g. cloud computing, satellite links, end-to-end encryption, the use of anonymizers, foreign 3G networks), which significantly complicate detection of travel plans and effective investigations. States need to balance and coordinate the oftentimes competing interests of taking down or maintaining extremist content online for investigative and intelligence purposes in accordance with national laws and international obligations.

In addition to the mandatory measures – such as data retention laws or data preservation orders – States may also require real-time information, in contrast to stored data which can be obtained through interception orders or through wiretaps or other special measures. The investigative powers for the collection of internet-based evidence should have sufficient privacy and dataprotection safeguards. States need to provide a legal mandate to law enforcement agencies (and, in some jurisdictions, prosecutors) to collect internet-based evidence. This includes legal provisions that ensure the preservation of the integrity of data in order to maintain the chain of custody as well as laws ensuring its admissibility in court proceedings.

Securing internet-based information which is located in other countries can be pursued in different ways. States can resort to mutual legal assistance – often lengthy and bureaucratic processes – or consider using informal means of cooperation. States are encouraged to improve mutual legal assistance through formal and informal mechanisms such as joint investigations teams, police-to-police cooperation, the use of liaison officers, establishing a 24/7 network for cooperation, prosecution cooperation networks such as the Counter Terrorism Prosecutors Network, and setting up of regional networks that promote cooperation.

Internet service providers should take measures to counter violent extremist content such as online campaigns, updating and enforcing their terms of use to counter the use of the internet for terrorist purposes, raising awareness among users how to flag illegal or offensive content but also among law enforcement officials on the range of tools available to collect evidence from the internet, including the use of emergency requests.

Third, private sector and civil society organizations can play a role with respect to rehabilitation programs which may vary from State to State and can consist of different elements such as mental health support, education, vocational training, and religious or other counseling. Psychologists, social workers, job counselors, or health instructors can all be engaged in a rehabilitation program for RFTFs – in custodial or non-custodial settings. In some countries, civil society organizations offer voluntary intervention or rehabilitation programs.

16. Supra note 1.

17. This is in line with the Financial Action Task Force (FATF) and Egmont Group regimes.


Recommendation 6

Integrate rehabilitative measures within and beyond the criminal justice response.

States should take measures to effectively bring perpetrators of terrorist-related crimes to justice. At the same time, Good Practice 19 of the GCTF’s The Hague-Marrakech Memorandum18 underscores that rehabilitation and reintegration form a vital component to mitigate the potential threat that RFTFs pose to society. States should facilitate the rehabilitation and reintegration of RFTFs - where appropriate - within the context of a criminal justice response and as part of a broader integrated approach. States are encouraged to introduce rehabilitative measures during, preceding, or after different stages of criminal proceedings - in accordance with their national laws and practices.

A prerequisite to integrating rehabilitation of RFTFs into the criminal justice sector response is close cooperation and exchange of information between the law enforcement agencies, the criminal justice sector, prison and probation officers, and social services. Training for criminal justice actors could be useful to improve the understanding and the objectives of the rehabilitation program, including the respective roles of the different actors involved.

In different stages of criminal proceedings, rehabilitative measures could be incentivized. For example, in the pre-trial stage, taking the presumption of innocence into account, States could introduce rehabilitative measures on a voluntary basis as an alternative or in addition to pretrial detention or as an additional condition for release from pre-trial detention. The referral to rehabilitation should be made on the basis of an individual risk assessment which indicates that the RFTF still adheres to violent extremism.

In the trial-stage, to the extent appropriate and allowed under national laws, judges and public prosecutors should be enabled to integrate rehabilitative efforts into the charges and sentence, in particular when dealing with cooperative individuals, minors, individuals suffering from mental health problems like PTSD, or other special categories of RFTFs. A convicted FTF can be sentenced to participate in a rehabilitation program as part of the sentence or part of parole/probation. States should consider whether participation in a rehabilitation program by a suspected or convicted RFTF will have an influence on the charges, and bail arrangements, and/or whether it should be regarded as mitigating circumstances.

In the post-trial stage, rehabilitative tools can be used as a condition for suspended prison sentence, for more favorable prison conditions, or as condition for early release (parole/probation).

Rehabilitation, diversion, exit, or other off-ramp programs may be offered as part of the criminal justice system, and also on a voluntary basis in cases where RFTFs have been acquitted, charges have been dropped or where prosecution is not possible due to a lack of evidence.

Whether, and to what extent, rehabilitative efforts can be introduced as an alternative to a prison sentence – or in complement to a prison sentence – depends on the criminal justice system of each individual State. Introducing rehabilitative measures in the different stages of criminal proceedings may require States to amend their criminal procedure laws to provide the relevant criminal justice actors with legal authority to – after an assessment whether the person is suitable for rehabilitation – refer a suspected or convicted RFTF to a rehabilitation program. In addition, States need to assess whether referrals to existing rehabilitation initiatives are suitable or can be adapted for RFTFs or whether developing a new legal framework for a rehabilitation program for RFTFs would be more appropriate.19

18. Supra note 1.

19. For additional guidance, see the GCTF’s Addendum to the Rome Memorandum on Good Practices for Rehabilitation and Reintegration of Violent Extremist Offenders.

Recommendation 7

Consider using administrative procedures20 within a rule of law framework to effectively mitigate the risk posed by RFTFs.

In line with Good Practice 11 of the GCTF’s The Hague-Marrakech Memorandum21, States could consider taking a wide range of administrative and regulatory procedures, in accordance with their national laws and international obligations, to diminish the risk posed by a RFTF. These types of measures can be applied in an administrative law or criminal law context. Depending on the legal system, these types of measures can be applied in an administrative law or criminal law context. The purpose of the measures, and the criteria upon which they are imposed, will vary in individual cases, taking into consideration proportionality and subsidiarity. Some of these measures can be issued by a court at the request of a prosecutor, police, or other relevant authority or be imposed by an administrative authority. Measures such as travel bans, reporting on a regular basis to the authorities, electronic surveillance, or orders that restrict movement in or to certain areas, limit the right of assembly, or access to the internet could be considered. Administrative procedures and measures – embedded in the legal framework and subject to independent judicial review mechanisms – can, when applied proportionally and with due diligence, contribute to prevent (further) radicalization and diminish the threat a RFTF poses to society. Furthermore, States could consider voluntarily participation in a rehabilitation or disengagement program as an incentive to reconsider certain measures.

20. Administrative procedures are also referred to as restrictive measures, non-criminal measures, or risk reduction measures.

21. Supra note 1.