Lifecycle Initiative Toolkit

Plan of Action for Identifying and Countering Recruiters and Facilitators

Download Document

Action plan that enumerates an illustrative list of actionable, rule-of-law based measures and initiatives that States are currently employing that have indicators of being successful in the effort to identify and counter the activities of terrorist recruiters and facilitators.

Sector: Government Institutions, International Agencies, Civil Society, Communities, Families, Academia, Judicial, Law Enforcement,
Theme: Community Policing, Juvenile Justice,
Go Back

Good Practices

I. Defining Relevant Criminal Offenses

Define criminal offenses to cover terrorist recruitment and facilitation, in order to implement international obligations, including those contained in UN Security Council Resolutions (UNSCR) 13733 and 21784 , and provide the basis for an effective criminal justice response to the threat of terrorist recruitment and facilitation (GCTF’s Rabat Memorandum, Good Practice 125 ).


Ongoing initiatives include:

Some multilateral bodies have taken measures and are considering additional measures that involve the criminalization of certain terrorist recruitment and facilitation activities:

Council of Europe (CoE)

Adopted on 19 May 2015 the Additional Protocol to the Council of Europe Convention on the Prevention of Terrorism6 (Additional Protocol), which implements UNSCR 21787 and calls for all parties to criminalize, among other conduct, traveling for the purpose of terrorism, and the funding, organization and otherwise facilitation of such terrorist travel. The Additional Protocol is open to signatories to the Convention8 , including nonCouncil of Europe Member States. The Additional Protocol currently has 30 signatories, including the European Union.


European Union

Discussing a new Directive on Combatting Terrorism, which would build upon the provisions addressing terrorism recruitment and facilitation in prior instruments, including the 2002 EU Framework Decision (amended in 2008) and the 2005 CoE Convention on the Prevention of Terrorism, and would implement the relevant international standards and obligations (i.e., UNSCR 21789 ; CoE Additional Protocol; FATF Recommendation No. 5). The EU Commission has proposed that the new Directive will require that EU Member States shall take the necessary measures to ensure that travelling abroad for the purpose of terrorism, any act of organization or facilitation that assists any person in such terrorist travel, knowing that the assistance thus rendered is for that purpose, is punishable as a criminal offense when committed intentionally.


Many countries are investigating and prosecuting terrorist recruiters and facilitators by enforcing criminal laws, consistent with relevant national laws, prohibiting categories of terrorist conduct that encompass recruitment and facilitation:


Terrorist recruiters and facilitators are being prosecuted under criminal offenses prohibiting participation in terrorist activity.



Terrorist recruiters and facilitators are being prosecuted under offenses prohibiting participation in any group formed or association established with a view to the preparation, marked by one or more material actions, of an act of terrorism.


United Kingdom

The UK’s Counter-Terrorism and Security Act of 2015 sets out provisions to disrupt the ability of people to travel abroad to engage in terrorist activity and then return to the UK, enhance the ability of operational agencies to monitor and control the actions of those who pose a threat, and combat the underlying ideology that feeds, supports, and sanctions terrorism.


United States

Terrorist recruiters and facilitators are being prosecuted under criminal offenses prohibiting the provision of material support to terrorist activity or to terrorist groups.


Other countries are enforcing existing laws, or have passed new laws, with offenses specifically referring to recruitment and facilitation to terrorism or participation in foreign armed conflict:

Albania, Bosnia & Herzegovina, Kosovo, and Macedonia

Each of these countries enacted new criminal legislation in 2014 and 2015, and has since brought prosecutions and obtained convictions for crimes involving (with terminology differing somewhat by country) the recruiting, organizing, training, equipping, and facilitating of others to participate in an unsanctioned manner in foreign armed conflicts.



A law adopted in 2015 criminalizes not only active recruitment for terrorist purposes, but also passive recruitment, while punishing the conducts of organizing, financing, or promoting travels abroad aimed at committing terrorist acts. The law also covers “lone wolf” terrorists involved in conduct unequivocally aimed at committing terrorist acts. An increased penalty is foreseen for training or instructions through information technology or electronic tools. Competent authorities may request Internet service providers to immediately block access to websites utilized for terrorist recruiting activities, including incitement to commit terrorist acts, as well as training for the purpose of terrorism. Failure to remove illegal content will result in a ban on access to the Internet domain.



Enacted in 2012, and is now enforcing, a Prevention of Terrorism Act with offenses, among others, including a prohibition on recruiting or facilitating the recruitment of another person to be a member of a terrorist group or to commit or participate in the commission of a terrorist act.



Enacted in June 2015, and is now enforcing, a new law which criminalizes, among other terrorism-related conduct, recruiting by any means whatsoever, training or coaching or attempting to recruit, train or coach one or more persons, in order to integrate them into terrorist entities, organizations, bands or groups, inside or outside the territory of Morocco.



Amended its criminal code in February 2015 to add, among other offenses, the crime of self-radicalization, which includes joining through social media a terrorist organization and collaborating with the terrorist organization or pursuing its aims.


European Union

EU Member States have domestic criminal laws relating to terrorist recruitment, incitement, training, as well as participation in the activities of a terrorist group in accordance with the relevant EU instruments.


3. S/2015/939 (23 December 2015).
4. S/RES/2178 (24 September 2014).
5. Supra note 2.
6. CM(2015)61-final (19 May 2015).
7. Supra note 4.
8. Council of Europe Convention on the Prevention of Terrorism, CETS No.196.
9. Supra note 4.

II. Investigative Techniques

Establish and employ a legal framework and practical measures for undercover investigations of terrorist recruiters and facilitators. (GCTF’s Rabat Memorandum, Good Practice 310).


Ongoing initiatives include:


Used in the “Toronto 18” case from 2006, and continues to use, undercover operatives along with electronic surveillance and informants to disrupt and prosecute terrorist recruitment and facilitation activity. Undercover investigation was also used in the Mohamed Hersi investigation discussed as a case study at the workshop and described below. Defendants in Canada are protected against entrapment by undercover operatives through the opportunity to have proceedings stayed upon establishing abuse of process by police investigators.



Employs undercover operatives, along with other intrusive surveillance techniques, such as electronic surveillance, including recently to penetrate and disrupt a major terrorist recruiting and facilitation network, leading to numerous prosecutions and convictions. (See further detail in description below of Kosovo case study presented at the workshop.) Use of undercover operatives requires prior judicial approval.



Employing against terrorist online recruiters and facilitators the new authorization in the Spanish code of criminal procedures for use of online undercover operatives.


Establish mechanisms to encourage cooperation, coordination, and information-sharing among domestic government agencies about the threat and activities of terrorist recruiters and facilitators (GCTF’s Rabat Memorandum, Good Practice 211).

Ongoing initiatives include:


The Joint Counter-Terrorism Centre (Gemeinsames Terrorismusabwehrzentrum, GTAZ) is a common platform for cooperation and communication to combat Islamist terrorism involving 40 federal and state agencies working in the field of internal security, including the Federal Criminal Police Office, the Federal Intelligence Service, the Federal Police, the Federal Office for the Protection of the Constitution, the Federal Public Prosecutor General, and the Federal Office for Migration and Refugees. The Joint Counter-Terrorism Centre is an inter-agency body and no autonomous authority. None of the member agencies were granted additional powers or responsibilities or gave up any of its sovereignty when joining the Joint Counter-Terrorism Centre. Each agency takes action on its own behalf and responsibility and in accordance with the laws and principles applying to it. On account of its organizational structure, there is no “Joint Counter-Terrorism Centre head”; rather, the representatives of the agencies involved work on an equal footing. The aim of the Joint Counter-Terrorism Centre is to identify threats at an early stage, to optimize the exchange of information and to reinforce the analytical capacity of all agencies. An optimized flow of information, as well as the compilation and concentration of expertise, are of mutual added value to the agencies, thus leading to a gain in security. The continuous and early exchange of current intelligence and its joint analysis based on the principle of the division of labor allow or facilitate the identification of potential threats from their beginning stages.



In its operational response, Italy adopts an integrated approach and focuses on synergic cooperation between investigative and intelligence services. A Strategic Committee for the exchange of information between law enforcement and intelligence agencies has been set up within the Ministry of Interior (C.A.S.A. – Comitato di Analisi Strategica Antiterrorismo). The Committee systematically assesses possible threats and analyzes information collected from police forces, intelligence services, international partners, and open sources.



Cooperation and information-sharing among law enforcement, intelligence services, customs and border authorities, as well as international partners, has supported an effort that led to the penetration and disruption of a major terrorist recruiting and facilitation network, leading to numerous prosecutions and convictions.



The Intelligence Center against Terrorism and Organized Crime (CITCO) was established in October 2014 to gather and share information among law enforcement, intelligence, and other agencies to link terrorist activities with other forms of organized crime. The CITCO integrates and analyzes relevant information, coordinates and determines the appropriate law enforcement action, produces weekly threat assessments and quarterly analytical reports, and proposes national strategies. The CITCO also shares information with foreign counterparts.


United States

Joint Terrorism Task Forces (JTTFs) are teams of local, state, and federal officials working together to combat terrorism on a regional scale. JTTFs include about 4,000 members nationwide, hailing from over 500 state and local agencies and 55 federal agencies (including the U.S. Department of Homeland Security, the U.S. military, Immigration and Customs Enforcement, and the Transportation Security Administration). JTTFs investigate leads, gather evidence, coordinate making arrests (either under federal or state law depending on the case), track threats to help ensure security for special events, conduct training, collect and share intelligence, and respond to threats and incidents swiftly. The JTTFs coordinate their efforts largely through the interagency National Joint Terrorism Task Force, working out of the Federal Bureau of Investigation, which makes sure that information and intelligence flows freely among the local JTTFs and beyond. They pool talents, skills, and knowledge from across the law enforcement and intelligence communities into a single team that responds together. In doing so, they unify federal, state, and local law enforcement efforts to prevent and investigate terrorist activity by ensuring that all levels of law enforcement are fully benefiting from the information and skills possessed by each.


Establish mechanism to encourage such cooperation, coordination, and information sharing, particularly among domestic agencies responsible for collecting and analyzing commercial and other records generated by terrorist recruiters’ and facilitators’ efforts to move operatives, funds, and goods across borders, in order to build investigations against recruiters and facilitators of terrorist travelers.

Ongoing initiatives include:


The Department of Immigration and Border Protection’s counterterrorism investigative workforce is coordinated through the National Security Branch (NSB) within the Department’s operational arm, the Australian Border Force (ABF). Investigators work collaboratively with other Australian law enforcement agencies to manage border-related risks through seconded investigators within a number of key State and Federal Task Forces, including the National Disruption Group, Australian Counter-Terrorism Centre, and Regional Joint Counter-Terrorism Teams. To enhance the fight against border crime, the Department has a strategic partnership with the Australian Federal Police (AFP) that combines the skills, intelligence, and investigative resources of the Department and AFP to disrupt criminals and prosecute breaches of Australia’s border legislation. This includes established protocols for the joint triaging of referrals or allegations for investigation.


United States

For example, the U.S. Department of Homeland Security helps to develop investigations through a range of investigative techniques aimed at revealing the patterns of conduct of terrorist recruiters and facilitators, including analyzing Passenger Name Records (PNR) and other travel transaction information; assembling related transactional information (such as credit cards, hotels, points of contact, etc.), revealing patterns of recruitment and facilitation; following financial flows such as trade-based money laundering and bulk cash smuggling; tracking refugee and immigration data to identify recruitment trends; and exercising expanded search authorities at borders.

10. Supra note 2.

11. Supra note 2.

III. Information-Sharing and International Judicial Cooperation

Use INTERPOL notices, diffusions, and other information-sharing systems, to gather information about terrorist recruiters and facilitators to support criminal investigations and prosecutions.

Specific case examples:

A Red Notice (seeking location and arrest of wanted persons with a view to extradition) distributed for a terrorist recruiter, charged with material support for a terrorist network.

A Blue Notice (to collect additional information about a person’s identity, location, or activities in relation to a crime) for a suspected terrorist travel facilitator believed to have smuggled people to join ISIL/Da’esh, with a warrant out for his arrest.

A Green Notice (to provide warnings and intelligence about persons who have committed criminal offences and are likely to repeat these crimes in other States) for a person convicted in a Member State for participating in military action in a conflict area, who after his return was involved in recruiting new followers and funding travels.

A Yellow Notice (to help locate missing persons, often minors, or to help identify persons who are unable to identify themselves) for two British teenagers who left for Syria to marry fighters, one likely executed by ISIL/Da’esh.

A Purple Notice (to seek or provide information on modus operandi, objects, devices, and concealment methods used by criminals) seeking information on modus operandi for illegal migration and terrorist travel routes between the EU and Turkey.

An Orange Notice (to warn of an event, a person, an object, or a process representing a serious and imminent threat to public safety) issued to all Member States on stolen Syrian blank passports.

Stolen and Lost Travel Documents (SLTD) database, available for all member states to link to border posts for screening of traveler documents, for example to detect terrorist operatives traveling under false documents.


Use international judicial cooperation procedures, such as mutual legal assistance and extradition, to support criminal investigations and prosecutions against terrorist recruiters and facilitators.

  • Prior to making a formal request for mutual legal assistance for internet communications information, send a preservation request to the internet service provider.
  • When submitting formal requests for mutual legal assistance, cooperate closely with national central authorities to ensure that the request contains the factual predicate necessary to ensure they are legally sufficient to obtain the relevant category of data, whether subscriber data, transactional data, or content.
  • In some States, like the United States, internet service providers may provide some categories of data voluntarily to foreign law enforcement officials, where doing so is consistent with national law relating to the protection of privacy, even in the absence of a formal request for mutual legal assistance, but they are not required to do so. Some law enforcement authorities have established relationships with the major providers to facilitate this.
  • European Union: Eurojust – the European Union's Judicial Cooperation Unit – supports judicial cooperation by stimulating and improving the coordination of investigations and prosecutions, including against terrorist recruiters and facilitators, in EU Member States and also beyond EU borders. Eurojust supports judicial cooperation through operational tools such as coordination meetings that can also involve third countries. Eurojust has a network of 42 contact points in the world to facilitate international cooperation.
  • France and Spain: The transfer of custody from Spain to France of a terrorist facilitator is discussed in the description below of a case study presented at the workshop.
  • France and Turkey: The transfer of custody from Turkey to France of a terrorist recruiter is discussed in the description below of a case study presented at the workshop.


Conduct joint investigations and interdiction of terrorist recruitment and facilitation networks crossing national boundaries.

Ongoing initiatives include:

Morocco and Spain

These two States have worked together to dismantle terrorist recruitment networks, including, for example, the August 2015 arrest of fourteen people on suspicion of belonging to a network that recruited and sent fighters to join ISIL/Da’esh. One suspect was detained in Spain while the other thirteen were arrested in cities across Morocco.

IV. Countering Recruitment in Prisons*

*see the GCTF’s Rome Memorandum on Good Practices for Rehabilitation and Reintegration of Violent Extremist Offenders12

Provide secure and safe confinement aimed at eliminating prisoners’ ability to recruit other prisoners to terrorism or violent extremism.

Ongoing initiatives include:


  • Transfer ideologues advocating violent extremism to a special block in a maximum security prison. (This approach was adopted after earlier efforts to bring Muslim scholars from the Middle East to conduct discussions with the extremists did not work.)
  • Work to stop the flow of logistical supplies to the violent extremist ideologues in Indonesian prisons. This is difficult in Indonesia because laws and regulations permit the provision of materials to prisoners. One initiative being undertaken is to transfer these ideologues to special blocks in the prisons, so that fewer supplies are available for other inmates of terrorist concern who are not transferred to the special blocks.



  • Specialized wing for terrorist and violent extremist offenders. A person charged with terrorism is sent to the terrorist wing immediately, even before trial and conviction, in order to prevent recruitment in prison and to begin the disengagement process immediately, which then continues throughout his or her time in prison.
  • Isolation and segregation, consistent with international law, provides the opportunity to physically remove prisoners involved in terrorist and violent extremist recruitment from the general population. It is a physical wall to stop messages from spreading. Not all, but a significant number of those inmates have become less violent in their methods and have become disengaged from their beliefs. Some are now helping security services on counterterrorism and counter-radicalization to violence programs (as “formers”).
  • Dynamic security: Influence violent extremist inmates by understanding and working to influence inmates’ attitudes and behavior. Prison staff are extensively trained in order to make personal contact with inmates, to be observant of changes in inmates’ behavior, and be vigilant to those changes. Staff are provided with courses on predictive profiling and taught to observe and react to changes in behavior.


United States

  • The Bureau of Prisons has taken substantial steps to guard against the spread of terrorism and extremist ideologies within the federal prison system and pursues a policy of containment for the most significant terrorist offenders, using a variety of management control, including:
    • Co-location of significant terrorism inmates;
    • Restricting prisoners’ housing and movement, including segregated, single-cell housing;
    • Monitoring social communications (visits, correspondence, and recording telephone calls);
    • Collaboration and communication with the inter-agency Joint Terrorism Task Force (JTTF) Correctional Terrorist Program; and
    • Providing training for correctional workers to recognize signs of radicalization to violence.


Take measures to counter radicalization to violence in the prison setting.

Ongoing initiatives include:


  • Transfer criminal inmates who are followers of violent extremist ideologues, and have been influenced by violent extremist ideology, to another prison where there are no inmates of terrorist concern. This has proven to be successful in several cases.
  • Alternatively, confront these violent extremist ideologues with other ideologues who hold different views. Prison staff position anti-ISIL/Da’esh prisoners (who are sometimes pro-Jabhat al-Nusra) to conduct counter-radicalization against the ISIL/Da’esh prisoners. The opposing ideologues become so busy arguing with each other that there is no time left for radicalizing others to violence.



Counter-terrorism correctional policy in the Netherlands includes controlling the religious message delivered in the prison. Dutch laws make it possible that the religious services held in the prisons are led not by people who have been selected by the inmates themselves, but instead by civil servants of the Dutch government. They are selected based on their counter-radicalization capacities and approved by the religious organizations of the Netherlands. Controlling the religious messaging in the prison has helped to counter the spread of extremism within the prison.


Council of Europe

The Guidelines for the Prison and Probation Services Regarding Radicalisation and Violent Extremism were adopted on 2 March 2016. The Council is currently working on a Council of Europe Handbook for Prison and Probation Services Regarding Radicalisation and Violent Extremism. The Guidelines endorse the good management of prisons as an indispensable basis for the prevention of radicalization and the introduction of efficient exit and reintegration programs.


Share best practices and provide technical support to other countries on mitigating the threat of terrorist recruitment in a prison setting.

Ongoing initiatives include:

European Union

As part of the EU’s foreign and development policy, within the framework of the European Council Conclusions of the Justice and Home Affairs Council of 20 November 2015 on criminal justice aspects of radicalization, and also part of the facilitation and provision of technical support on counter terrorism matters, the EU’s 2016 prison de-radicalization project seeks to address the spread of violent extremist radicalization among prison populations. The project will implement a twopronged approach, preventing both the progression to violent extremism, particularly among vulnerable prisoners, and effectively managing violent extremist prisoners and develop rehabilitation, disengagement and/or de-radicalization programs. Given increased numbers of FTFs serving prison sentences, disengagement and rehabilitation programs are crucial to prepare for their release. In addition, the Radicalization Awareness Network provides a platform for exchange of best practices and recommendations in particular through its work in a dedicated working group.



The Asia and Far East Institute for the Prevention of Crime and the Treatment of Offenders (UNAFEI) operated by the Ministry of Justice of Japan will organize its 167th International Training Course under the theme of “[e]ffective measures and practices that prevent re-offending and support the rehabilitation and reintegration of offenders who are, or once were, organized crime members and/or terrorists” from August to September 2017. Government officials from across Asia and Africa as well as visiting experts and lecturers will explore and share effective measures and practices for such offenders both in institutional and community settings (including prisons), especially those that prevent them from returning to criminal organizations and/or terrorism and support rehabilitation and reintegration of such offenders.

12. See the GCTF’s Rome Memorandum on Good Practices for Rehabilitation and Reintegration of Violent Extremist Offenders.

V. Curbing Online Recruitment

Establish national offices for referring to internet and communications service providers online violent extremist and terrorist recruitment and facilitation content that may violate the providers’ terms of service, including by amounting to criminal activity.

Ongoing initiatives include:


In February 2015, the Australian Government developed a new tool for people to easily report illegal or offensive violent extremist material that they find online. The Report Online Extremism tool is available on the Living Safe Together website ( and allows the Australian Government to:

  1. Discover and refer violent extremist material to online service providers, Australian regulatory agencies, or voluntary filter providers
  2. Gather information about potentially radicalizing material and improve its understanding of how violent extremist groups use the internet
  3. Improve its understanding of how to use the internet to disseminate positive messages and narratives that work against violent extremist material


United Kingdom

  • The Counter Terrorism Internet Referral Unit (CTIRU) refers content to internet and social media companies for removal under their own terms of service. Industry then voluntarily processes CTIRU’s requests by removing content based on their service terms and conditions. For example, with YouTube, 96% of CTIRU referrals have resulted in a removal. As new internet platforms emerge, CTIRU reaches out proactively to understand their service and terms and conditions, and to identify reporting lines for referring content. Smaller platforms that ISIL/Da’esh has begun using are now beginning to respond (e.g. MediaFire,, Telegram).
  • Material is identified to CTIRU in three ways:
  1. Identification by CTIRU itself
  2. Referrals from the public via an online reporting tool
  3. Referrals from partners and colleagues
    CTIRU then prioritizes material for referral if it is in the English language and breaches UK terrorism laws (e.g., content which encourages or glorifies terrorism or is useful in the preparation of a terrorist attack). CTIRU consults with UK law enforcement offices before referring.
  • The CTIRU has seen successes and advantages develop. It has seen 190,000 pieces of referred terrorist-related content removed since 2010, now at a pace of over 1,000 per week. It has the support of the major internet platforms. It allows swifter action against terrorist content, avoiding the need for lengthy legal procedures. It has attracted little freedom of speech criticism as internet platforms judge material against their own terms and conditions. The UK does not, however, view the CTIRU as the ultimate policy solution in this area, and believes that governments must work closely with internet service providers to ensure violent extremists and terrorists do not have open access to their platforms.


European Union

Europol launched its own internet referral unit (IRU) in July 2015, with over 9,000 pieces referred since. In addition, the EU IRU supports EU Member States in their investigations.



National counterterrorism centers invite reports from the public about recruitment and facilitation online to law enforcement agencies who consider investigative steps.


Internet service providers and other providers of internet platforms institute policies and programs, and dedicate resources, for taking down content relating to terrorist recruitment and facilitation activities that violates their terms of service.

Ongoing initiatives include:


Welcomes referrals of content relating to terrorist activity from governments, or from other parties. With over 1.5 billion users, it is difficult to review all content, but Facebook does not tolerate content violating its terms of service. Applying the terms of service in the terrorism context also presents a particular challenge – identifying content that violates terms of service for reasons relating to terrorist activity is more difficult than identifying child pornography, as the former is more context-dependent.

VI. Example Criminal Investigations and Prosecutions


  • The case of Mohamed Hersi demonstrates the utility of undercover operatives in investigating terrorist recruiters. Mr. Hersi was a young man working as a security guard in Toronto who had decided he wanted to travel to Somalia and join al-Shabaab. He met another young man who seemed interested in the same thing.
  • Over the course of a few months, Mr. Hersi provided the other man with encouragement and advice on how to travel to Somalia and join the terrorist group. Mr. Hersi’s advice included:
    1. Have an alibi;
    2. Don’t do anything to your appearance to make you stand out
    3. Don’t burn bridges in Canada so that you may return to conduct an attack.
  • Mr. Hersi gave the other man reading material such as a sniper manual, the Anarchist Cookbook, and Inspire Magazine.
  • The other young man turned out to be an undercover police officer, who recorded many of their conversations. Mr. Hersi was arrested as he was boarding a flight to the Middle East. He was convicted by a jury. Mr. Hersi applied for a stay of proceedings based on a claim of entrapment, but the application failed.



  • One of the main groups recruiting and facilitating foreign fighters in Kosovo was led by an extremist imam who studied in Egypt. After returning to Kosovo, the self-declared imam built a mosque financed by a Middle-Eastern nongovernmental organization and began spreading ideology through religious teachings, mobile mosques, and social programs, including aid to families in need and providing services for infants. He distributed religious literature and, through online activity, spread the message that Muslims have an obligation to join the conflict in Syria and Iraq. He assembled a group focused on recruitment, allowing his business to finance mobile mosques and to buy flights to Syria and Iraq. He started facilitating the travel of Kosovars to Syria and Iraq, and supplied videos through social media urging Kosovars to join the fight. The imam would then deliver sermons in small groups to indoctrinate them, and selected persons were recruited and sent abroad. More than 100 people travelled as a result, 20 of whom have been killed.
  • The group had weaknesses – including their open propaganda and unprotected means of communication, and the Kosovo police had begun tracking and monitoring their activities and movements. The police worked closely with intelligence services, customs and border authorities, and other authorities, as well as with international partners including the U.S. Federal Bureau of Investigation.
  • After collecting material evidence, in June 2014, through three separate operations, the police arrested most members of the group and then later the financier. Numerous convictions have been obtained, by both guilty plea and trial verdicts. The cases appear to have had strong preventative consequences – in the last seven months there have been no more reports of Kosovars travelling to Syria.



  • Prosecuted numerous recent cases involving recruitment and facilitation related to ISIL/Da’esh, Jabhat al-Nusra, and recent attacks in Paris, demonstrating the utility of electronic surveillance (GCTF’s Rabat Memorandum, Good Practice 413) among other GCTF good practices:
  • A major recruiter went to Syria in 2013, joined Jabhat al-Nusra, and started working on social media, giving interviews to magazines online. He, himself, was recruited via the internet, and then he started recruiting others through Facebook, including two people in Toulouse, and a group of eight juveniles in Strasbourg. Some of his recruits joined Jabhat al-Nusra, and some returned to France and were arrested. Seven of them were sentenced to jail on 6 July 2016. One of his recruits, Mohamed Aggad, left Jabhat al-Nusra, joined ISIL/Da’esh, and was one of the attackers in Paris on 13 November 2015. The recruiter was deported to France, indicted, and is awaiting trial on charges of leading a terrorist group. He was proud to have recruited French citizens and admitted to doing so after his arrest.
  • Another recent case involved a person who taught religion, recruited others to go to Syria, and organized their physical training. He told recruits that if they did not make the journey they would go to hell. He left for Syria in August 2013 and joined ISIL/Da’esh. He frequently called his father by phone, so a wiretap was placed on his father’s phone line, which allowed law enforcement to establish that he wanted martyrdom. He is believed to have been killed in January 2015. He was condemned in absentia and sentenced for 10 years in case his death was faked. There is a warrant out for his arrest
  • A separate terrorist facilitator has been convicted and sentenced to six years in prison. He did not leave France but used his contacts in Iraq to advise four of his friends and facilitate their travel. The four friends stayed in Iraq for only two months before returning to France, and now have been convicted and sentenced to four years in prison. He worked with another person, who left France for Iraq in January 2013. He first joined Jabhat al-Nusra, then ISIL/Da’esh, and took part in combat, and remained in Syria for a long time. This fighter welcomed the four friends and facilitated the arrival of new recruits. He returned for unknown reasons and was arrested in Spain en route to Algeria. He was transferred to France and sentenced to nine years in prison.



  • A recent case offers an example of a 19-year-old girl recruited by terrorists but whose travel was disrupted. She was arrested by Spanish National Police on August 2014 in the Beni Enzar border crossing in Melilla. She was suspected of trying to join Islamist violent extremists fighting in Iraq and Syria. When she was detained, she was trying to cross the border to Morocco with the aim of contacting the network, which would move them immediately to an area between Syria and Iraq. Her intention was to join one of the cells of ISIL/Da’esh. Her radicalization, recruitment, and later dispatch as a combatant, were planned and organized by a network that operates across North Africa. She was charged with involvement with a terrorist group, and has been released without bail but with conditions including weekly court appearances, prohibition on leaving the country, and seizure of passport.
  • The case of Silvia Celestin is an example of a recruiter disrupted. She was arrested by Spanish National Police on July 2015 in Arrecife, Lanzarote (Canary Islands). She is a Spanish woman who converted to Islam, and was directly involved in radicalization to violence of other women and facilitation of their travel to Syria. She provided them with information on the route to use and security measures necessary to avoid being detected during transit to Syria. She was in direct contact with an ISIL/Da’esh member in Syria, from whom she received guidelines and instructions on how to recruit and facilitate the travel of women for the purpose of integrating them into the terrorist group. She published extremist content on social networks. The girls recruited by Silvia Celestin were mainly motivated by religious belief, but once at their destination in Syria they were exploited as sex slaves, worked as home and hospital support, performed functions of supervisory police enforcement in the women’s field according to the Sharia, and a small group were integrated into the ranks of fighters for ISIL/Da’esh. Celestin was convicted of terrorist recruitment and exaltation of ISIL/Da’esh terrorist attacks, and remains in prison awaiting sentencing.


United States:

  • The case of Ali Shukri Amin, a terrorist recruiter and facilitator known by his online moniker “Amreeki Witness”, demonstrates the utility of forensic analysis (GCTF’s Rabat Memorandum, Good Practice 1014) and other GCTF good practices. Amin was a 17-year-old honor student in a high school in Manassas, Virginia, who took additional university classes on topics like computer cryptography. The initial complaint to U.S. law enforcement about Amin’s potential radicalization to violence came from his family – his stepfather took Amin’s passport from him after Amin said he wanted to travel to join the conflict in Syria and Iraq.
  • Meanwhile, a terrorist facilitator known by his online moniker as “Amreeki Witness” was very active on Twitter and other internet platforms, with over 7,000 followers. “Amreeki Witness” recruited people to join ISIL/Da’esh and arranged their travel to Syria, making use of tremendous access in Syria and Turkey, including to transport couriers. “Amreeki Witness” also published guidance on how to use Bitcoin to fund ISIL/Da’esh. “Amreeki Witness” facilitated the travel of four known persons to Syria, one from the United States (a classmate from Amin’s high school) and three from the United Kingdom. Their fate is unknown, but it is believed that at least two have died in the conflict. “Amreeki Witness” conducted these online activities with expert tradecraft, concealing his identity through anonymizing software like TOR and multiple Virtual Private Networks in different countries.
  • After circumstantial evidence suggested Amin might be “Amreeki Witness,” U.S. law enforcement was able to link the two identities through linguistic analysis and other forensic tools. Amin’s online terrorist activity was then corroborated by school friends. Amin did not resist arrest, showed no remorse, and proceeded to explain the nature of his global terrorist recruitment and facilitation network. As a 17-year-old, his case was initially handled under special judicial procedures for juveniles, which led to a court finding, given the seriousness of the crimes, that he should be treated as an adult, which permits his case to be discussed publicly. He was charged with material support for terrorism, pled guilty, and was sentenced to eleven years in prison.


13. Supra note 2. 

14. Supra note 2.

Go Back