3. Key Trends
This section compares key trends in each of the datasets. First, it looks at the quantity and quality â€” i.e., scale, complexity, and impact â€” of Islamic State-reported versus Islamic State-attributed attacks. Second, it turns to targeting trends â€” and any discrepancies â€” that characterize each dataset. Third, it analyses the attacks from a geographic perspective, describing an array of locational differences between what the Islamic State reported from the Badia in 2020 versus what loyalist sources attributed to it in 2020.
3.1 Rate of Attacks
Figure 1 (above) shows all Islamic State-reported and loyalist-reported attacks in the Badia in 2020. It shows that the Islamic State consistently reported significantly fewer attacks in the region than were attributed to it by loyalist sources during the same period. It also shows that the difference between the two figures was greatest in September and October, when the Islamic State reported around 90% fewer attacks than were attributed to it by loyalist sources.
Figure 1 also shows that, per the Islamic Stateâ€™s own data, its attacks in the Badia came in three waves: one small wave in the month of January, and two larger waves in July-August and November-December. The first of these is consistent with a Syria-wide trend that saw Islamic State militants carrying out significantly more attacks than usual as part of a global campaign dubbed the â€œraid to avenge the two sheikhs.â€ This was launched in the last week of December 2019 as a belated response to the killing of Abu Bakr al-Baghdadi, the Islamic Stateâ€™s former leader, and Abul Hasan al-Muhajir, its former spokesman, in late October of that year. The second wave in July-August 2020 is loosely consistent with another of the Islamic Stateâ€™s global campaigns, its summer â€œraid of attrition,â€ which was launched at the end of July to mark the first 10 days of the Islamic month of Dhul Hijjah. The third wave of attacks, which occurred in November-December 2020, did not coincide with any stated campaigns by the Islamic State. On that basis, it appears to have been driven by dynamics internal to the Badia, rather than a centrally coordinated global Islamic State campaign.
Interestingly, reporting trends in the loyalist dataset only partially correlate to those that characterize the Nashir/Naba dataset. The periods of intensification that loyalists reported occurred at different times to those that were reported by the Islamic State â€” i.e., April-May and August-October, rather than January, July-August, and November-December. Moreover, the second, August-October, wave was far more sustained than any of those reported by the Islamic State, lasting a full 90 days as opposed to just one or two weeks straddling the beginning or end of a month, as was the case with all three of the Islamic State-reported upticks.
The August-October surge indicated by loyalist sources marked the beginning of a large, sustained expansion of Islamic State operations into eastern Hama, as well as a three-fold increase in loyalist and Islamic State reported activity in southern Raqqa and a 30% rise in loyalist and Islamic State reported activity in rural western and southeastern Deir ez-Zor. These expanded Islamic State activities were likely motivated by both regional strategic considerations â€” i.e., a desire to secure and consolidate territory â€” and tactical opportunism â€” i.e., a desire to take advantage of the scarcity and/or weakness of regime forces.
3.2 Scale of Attacks
On comparison, the Nashir/Naba and loyalist datasets exhibit significant discrepancies in the reported impact of Islamic State attacks in the Badia in 2020. Per the Islamic State, its cellsâ€™ attacks there across the whole year killed 196. Per loyalist sources, however, this figure was much greater, with some 409 reportedly killed in Islamic State operations. The point at which there was greatest divergence was in August, when the Islamic State reported just 20 kills as opposed to the 71 reported by loyalists.
Generally, the number of kills reported in the context of a given Islamic State attack is a useful, albeit imperfect, proxy measure for the tactical sophistication of the attack itself. However, the seemingly significant underclaiming of Islamic State attacks in the Badia makes this metric difficult to measure. Examining only those attacks claimed by the Islamic State results in 2.6 kills per attack on average over the course of the year. Yet when the attacks reported by loyalists and not claimed by the Islamic State are included, this drops to 1.4 confirmed kills per attack on average.
The weakness of this methodology is due to the conflicting reporting methods of each party. The Islamic State is far more likely to inflate enemy losses in its claims â€” as it did on at least three occasions in 202018 â€” than to underestimate them, thus inherently leading to a higher kill per attack average. Loyalists, by contrast, are much more likely to under-report losses to Islamic State attacks, rarely giving full numbers of killed and wounded and never inflating losses. This inherently leads to a lower kill per attack average.
Rather than use lethality to assess the sophistication of Islamic State attacks, the authors have introduced the metric of â€œhigh qualityâ€ attacks. In the context of the Islamic State in the Badia, an attack is considered â€œhigh qualityâ€ if it had any one of the following five attributes: i) caused three or more deaths (note: three deaths is a high baseline in the context of the Syrian Badia, where many regime patrols are conducted by just one or two vehicles and outposts are manned by only a handful of soldiers, but would not be somewhere like northeast Nigeria, where the Islamic Stateâ€™s attacks are generally on a bigger scale); ii) involved the use of false checkpoints; iii) occurred deep in â€œsecureâ€ regime territory; iv) had multiple stages or played out across multiple fronts; v) resulted in the capture of regime positions or fighters.19
This allows for a more holistic and region-specific approach to assessing the Islamic State in the Badia, accounting for the reality that on many occasions throughout 2020 regime forces fled in the face of Islamic State attacks, enabling the group to seize weapons, vehicles, and positions in attacks that resulted in no deaths. The metric further accounts for when militants infiltrated behind regime lines. Whether or not such attacks led to high numbers of dead, they indicate the cellâ€™s sophisticated intelligence-gathering capabilities.
Figure 2 (below) shows â€œhigh qualityâ€ attack reporting according to both the Islamic State and loyalist sources across 2020. As in Figure 1, there is a significant discrepancy between the two datasets, with the Islamic State generally claiming less than half as many high-quality attacks as were attributed to it by loyalist sources in all months apart from January, when it reported two more than loyalists did.
The Islamic Stateâ€™s sustained ability to deploy high-quality operations in the Badia across 2020 presents fairly unequivocal evidence that its cells possess extensive operational and intelligence-gathering capabilities. Counterintuitively, these capabilities are only really reflected in the loyalist dataset, not in the Islamic Stateâ€™s own reporting, suggesting that its central media apparatus either did not know about them, or was unwilling to shed light on them. Given what is known about the tight structure of this groupâ€™s military-media reporting nexus, which has been consistent and systematized since it was formally consolidated in 2016, as well as the general state of health and functionality for the overarching media apparatus in Syria today, something that the authors are tracking daily, the former option seems somewhat unlikely.20
3.3 Targeting Trends
The Nashir/Naba and loyalist datasets are at their most similar when considered from the perspective of whom it was that was being targeted. Per both, the vast majority of Islamic State-brokered violence across 2020 targeted local security forces stationed in the Badia â€” whether that is the regime military or its allied militias.
When it came to the targeting of civilians, however, the Islamic State reported just a tenth as many non-combatant kills as were reported by loyalists while claiming only a third of the total number of attacks on civilians ascribed to it by loyalists. (See Figure 3 right.) Moreover, on a number of occasions, the Islamic State framed attacks on non-combatants as attacks on military targets. To an extent, this is to be expected, given that it looks â€œbetterâ€ for it to be attacking and killing active adversaries than unarmed civilians. Notably, this same diversionary approach toward reporting attacks on non-combatants is regularly practiced by the Islamic State in other places, most prominently of late in Africa.21 There is also a chance that this discrepancy is heightened by loyalists wrongfully framing Islamic State attacks as having targeted civilians, something which could have been done in a number of instances (though, due to the locations from which these incidents were reported, were only likely to be a minority).
However, while the relative absence of Islamic State reports about attacks on civilians is to be expected, the same cannot be said for the relative absence of Islamic State reports about attacks on officers in the Syrian regimeâ€™s military or NDF. Across 2020, just five of the 22 attacks that targeted regime and regime-aligned officers were claimed via its central media apparatus.22 The remaining 17 attacks were left entirely unreported by the Islamic State, even though they were significant strategic wins for it. This is more likely to be a deliberate ploy than something born of a lack of information on the part of the Islamic State, which, elsewhere in Syria or in places like Iraq or Afghanistan generally makes sure to highlight attacks in which officers are killed (even if that means doing so retrospectively).
Even if it is deliberate, this under-reporting of attacks on mid- to senior-ranking military officials could also in part be explained by the fact that some of the 12 attacks conducted with IEDs and mines were ones the Islamic State had planted indiscriminately months earlier.23 However, the Islamic State only claimed three of the at least eight attacks on commanders conducted through small-arms ambushes (meaning that Islamic State militants were present at the scene of their deaths).24
The fact that the group still refrained from reporting on most of these attacks across 2020 â€” even after loyalist sources had confirmed the identities of those killed â€” is somewhat surprising. In other contexts, such as West Africa, the Islamic State regularly claims operations that occurred months earlier, so this absence of retrospective reporting from Syria does not appear to be due to a blanket internal editorial policy on the part of the Central Media Diwan.25
3.4 Location of Attacks
Figure 4 (below) visualizes how the Islamic Stateâ€™s attacks were distributed across the Badia in 2020. Among other things, it shows that there was a much greater degree of geographic variance in the loyalist dataset than there was in the Nashir/Naba dataset. This is demonstrated in the fact that there are far more red clusters (loyalist-reported attacks) on the map than there are blue clusters (Islamic State-claimed attacks).
Notably, nearly half (33) of all the Islamic State-reported attacks in the Nashir/Naba dataset and some 90% of the entirety of its attacks in Homs governorate were described as having occurred â€œclose to Sukhnah.â€ This concentration around Sukhnah is represented by the largest blue cluster in the center of Figure 4 just northeast of Palmyra. Besides that, the Islamic State reported three other, much lesser hotspots further east in Deir ez-Zor governorate, as well as a smattering of attacks elsewhere. In general, then, its official reporting was characterized by a lack of specificity, one that stood in contrast to the rest of its reports about attacks in Syria in 2020, which were generally more detailed. By contrast, the loyalist dataset speaks to a much greater degree of diversity, with three major hotspots â€” one near Sukhnah, one just west of Deir ez-Zor city, and one in the southern Raqqa countryside â€” and a further 10 lesser hotspots dispersed across the rest of the Badia, with dozens of other more isolated attacks being reported elsewhere in remote parts of Hama, Homs, Raqqah, Aleppo, and Deir ez-Zor governorates. The spread of these reports, which are represented in the red clusters on Figure 4, shows that the Islamic State was reported to have been involved in dozens of incidents in places where it was not reporting any activities at all.
Islamic State reporting patterns differ between governorates as well. For example, the group somewhat regularly publishes pictures of the aftermath of attacks along with its claims in eastern Homs, though these pictures are almost exclusively of single vehicles hit by mines or IEDs. In other words, they are low-intensity, common attacks. Meanwhile, although attacks are fairly consistently claimed in eastern Hama and southern Aleppo, pictures here are exceedingly rare. Claims from Deir ez-Zor are less frequent than in any of the above governorates, and pictures are even rarer. Yet, the few pictures that were released from Deir ez-Zor in 2020 were just as likely to relate to small arms attacks as to IEDs. Similarly, the Islamic State almost never claims attacks or publishes pictures from southern Raqqa, but when it does, they exclusively relate to large-scale small arms attacks. Interestingly, the most recent such claim was mis-attributed by the Islamic State to â€œthe Sukhna countrysideâ€ in Homs, despite a wide array of reliable sources placing the attack in southwest Raqqa.
The governorate-to-governorate discrepancy in type of media reports gives rise to potential insights into how the Islamic Stateâ€™s media apparatus operates within central Syria. Consistent post-IED pictures from Homs combined with few text claims of small arms attacks may suggest that the media operatives or cells with connections to the Central Media Diwan are largely centered around IED cells. Mis-attributed locations of attacks may suggest that in such cases there were several layers of communication between the cell carrying out the attack and the Central Media Diwan, furthering indicating that some cells may not have direct connections to, or the technological ability to connect to, the Central Media Diwan.
This study has shown that the Islamic State appears to be under-reporting on the activities of its cells in the central Syrian Badia â€” and not in a way that one would assume. Instead of overstating their capabilities and exploits, this dynamic has the effect of playing them down.
While the discrepancies noted above relate only to the Badia and not to other parts of Syria, the impact these missing operations have on the Islamic Stateâ€™s overarching attack metrics in Syria is significant. Given that loyalist sources reported and ascribed 224 otherwise unclaimed attacks in the Badia in 2020 and that the Islamic State reported 582 attacks across the whole of Syria in the same period, if just these unclaimed loyalist-reported Badia operations are added to the national total, they raise it by about a third, from 582 to 806 across 2020.
Given the loyalist dataset relates only to central Syria, it is feasible that the Islamic State is under-reporting in other parts of the country as well, although as noted, it is reported to be claiming most of its attacks in northeast Syria. Even if it is not, though, the Badia statistics alone are sufficient cause for an adjustment of prevailing threat assessments regarding the remnants of the Islamic State in Syria today.
To be sure, the datasets on which these findings are based have their limitations, and as a result, they must be treated with a critical eye. However, as is known from other studies on Islamic State reporting behavior, including those conducted by the U.S. Department of Defense, its claims have rung truer than is usually assumed to be the case, and these days at least, it does not appear to be in the habit of entirely fabricating kinetic incidents.26 Moreover, for reasons discussed above, loyalist sources are more likely to downplay attacks than exaggerate them. Indeed, the authors ascertained, based on interviews with regime soldiers, that even more attacks hit the regime military and its allies in the Badia in 2020 than were claimed by the Islamic State or publicly reported by loyalists.27
In attempting to determine what is behind this discrepancy between what the Islamic State claimed versus what its enemies reported, which has continued into 2021, the authors have identified six hypotheses, some of which they assess to be more likely than others. The first three address assumptions that the additional 224 loyalist-reported attacks were incorrectly attributed to the Islamic State.
Hypothesis 1: Criminal gangs or other anti-regime elements, not the Islamic State, are responsible
This hypothesis assumes that the Islamic State claims all, or at least most, of its attacks in central Syria. On that basis, some other group (or groups) must be responsible for the more than 200 additional attacks that were attributed to it by loyalists. There are two options for who could be responsible: i) criminal gangs; or ii) anti-regime factions.
To be sure, several criminal organizations operate in the Badia, and on occasion, they have been known to carry out attacks against civilians and regime forces. However, these groups mainly operate in parts of eastern Hama and the Raqqa-Aleppo border region where there are large urban populations and trade to prey on; such networks have few incentives to operate in eastern rural Homs or the Deir ez-Zor desert, from which many of these Islamic State-attributed attacks are being reported by loyalists. When it comes to the few anti-regime forces operating in the Badia, like Kataâ€™ib Sharqiyyah, these groups are so inactive that, even if some of their attacks were misattributed to the Islamic State, this would not have a statistically significant impact on the data. Moreover, the Facebook pages on which much of the loyalist dataset was based routinely differentiate between attacks that are carried out by known Islamic State cells and attacks that are carried out by â€œunknown individuals.â€ Finally, repeated interviews with both regime and pro-regime soldiers and SDF officials continually point to the Islamic State as the perpetrator of these attacks.
On that basis, while there could be overlap between attacks perpetrated by criminals and attacks instigated by the Islamic State, the authors believe that it is highly implausible that the majority or even a significant minority of these attacks have been misattributed.
Hypothesis 2: Iran-backed militias, not the Islamic State, are responsible
This hypothesis also assumes that the Islamic State claims all, or at least most, of its attacks in central Syria, and that additional attacks perpetrated by Iranian and Iran-backed militias are being wrongly ascribed to the Islamic State on account of their being false-flag operations. This argument, which a number of Syrian news sources have promoted,28 holds that many, if not most, of these attacks â€” especially those targeting civilians â€” are being committed not by the Islamic State but by Iran-backed militias, which are engaging in deceptive operations to give themselves a pretext to remain in Syria.
This scenario seems unlikely for two reasons. First, the principal targets of most of the loyalist-reported attacks are forces that work alongside Iran-backed militias, not civilians. Second, these attacks make sense, from a strategic perspective, for the Islamic State, so it is not just â€œmindless violence,â€ as these reports often claim. Raids against civilians often result in the capture of basic goods and sustenance â€” a critical supply chain for a covert network â€” and has increased internally displaced people (IDP) flows into northeast Syria, making it easier for the Islamic State to move its own fighters across the informal border between regime- and SDF-held territories.29 Moreover, killing livestock and shepherds in the mountains and steppes of the Badia helps keep locals out of areas the Islamic State cells favors for stashing weapons and moving between positions, something that is also an upshot of its riddling the land with IEDs to deny access to security forces.
Hypothesis 3: Loyalists are over-reporting
Like the first two, this hypothesis assumes that the Islamic State claims all, or at least most, of its attacks in the Badia, and that loyalist sources are fabricating the rest of the attacks they are attributing to it. To be sure, while loyalist sources are just as likely to peddle false information as any other militant actor in Syria, the type of lies pushed by pro-regime accounts revolve around downplaying their own losses and exaggerating Islamic State losses during regime army-led anti-Islamic State operations. Moreover, while rare, at times certain loyalist pages will make up fake reports of fighting in the Badia. However, such reports are easy to distinguish from verifiable claims due to their wording and specificity, as explained in the above methodology section.
Due to the first authorâ€™s awareness of these reporting pitfalls, it was possible to sift through loyalist social media and only collect credible news on security incidents. False reports of â€œfierce fightingâ€ between the army and the Islamic State gained traction on pages about once or twice a month and were always discarded.
Moreover, it is important to note that even if fabricated incidents are included, the loyalist dataset as a whole is still likely to comprise an undercount of the full spectrum of violent activities in the Badia due to the various factors outlined in the methodology section. Some might assume that loyalist sources would exaggerate the level of violence in the region in order to legitimize their presence there. However, such a tactic would be aimed at international audiences, not domestic loyalist communities. As stated in the methodology, the loyalist Facebook pages used to build the second dataset serve as domestic, often hyper-local news sources. They are used to mourn losses among the community and pressure local officials when the security situation degrades too far. As Suhail al-Ghazi told the authors, this desire is at odds with the â€œregime repeatedly cracking down on individuals who publish â€˜harmfulâ€™ news,â€ which pressures communities not to report on Islamic State attacks in the Badia.30
Accordingly, based on the quality of the data, the variance of the sources, and the evidence that was presented alongside each report, it is infeasible that over-reporting could be taking place at this scale, at least per the data points included in the loyalist dataset. Moreover, as mentioned, the trends indicated in this data have been repeatedly supported in interviews with both pro-regime soldiers and SDF officials.
The next three hypotheses assume that the Islamic State did not claim all its attacks in the Badia and that the 224 additional loyalist-reported attacks discussed in this study were in fact perpetrated by it, not some other group or faction. There are three possible explanations for this, none of which are mutually exclusive: i) the Islamic State is intentionally not claiming attacks in order to limit awareness of its activities in this part of Syria; ii) the cells carrying out these attacks have difficulty establishing communication lines with the Islamic Stateâ€™s Central Media Diwan, meaning they cannot regularly send information or media files relating details of their operations; and/or iii) the structure and consequent priorities of each cell is impacting their appetite or ability for engagement with the Islamic Stateâ€™s central command in Syria. These hypotheses reference the data in Figure 5 (below).