Remarks by Acting Director of the National Counterterrorism Center

Brett M. Holmgren

Cipher Brief Threat Conference

October 6, 2024

Sea Island, Georgia

As Prepared for Delivery

Good afternoon. It’s great to be here. Suzanne, Brad – thanks for inviting me and congratulations on another superb Threat Conference.

One-year ago tomorrow, I arrived at this conference just hours after HAMAS conducted a brutal terrorist attack on Israel, the deadliest such attack in Israel’s history. Needless to say, I cut the visit short and returned to Washington the next day as national security officials began to take stock of the magnitude, horror, and implications of HAMAS’s vicious assault. As we now know, the attack killed more than 1,200 citizens and resulted in hundreds of men, women and children taken hostage. In response, Israel undertook a massive military campaign to degrade HAMAS, recover hostages, and reestablish security. The ensuing conflict has, tragically, killed more than 40,000 Palestinians, left Gaza in ruins, and raised tension throughout the Middle East.

As we reflect on the conflict one-year later, several defining trends have emerged: a humanitarian crisis in Gaza that will take years to repair; an emboldened Iran and its terrorist proxies; the importance of U.S. leadership and engagement; a more volatile Middle East; and, a reenergized global terrorism movement.

Against this backdrop, I’d like to discuss the impact of the Israel-HAMAS conflict on the broader terrorism landscape, the key terror threats facing the United States, and long-term counterterrorism challenges that require renewed focus.

***

In the weeks after 7 October, the Intelligence Community (IC) warned the crisis would galvanize a range of extremists to engage in violence—from ISIS and al-Qa'ida to anti-Semitic and Islamophobic actors. In March, Director of National Intelligence Avril Haines further warned the conflict could have a “generational impact” on terrorism.

While the long-term effects of the conflict are highly variable, the early trendlines validate the IC’s initial predictions. Let me share a few data points.

• Since 7 October 2023, there have been at least 19 attacks and 21 disrupted plots in more than 20 countries for which the Israel-HAMAS conflict has served as a primary motivational driver, contributing factor, or probable reason for target selection, based on analysis by the National Counterterrorism Center. There have also been more than a dozen plots that were motivated at least partly by the conflict and were either abandoned or potentially remain active. I’ll note these numbers exclude attacks by Sunni violent extremists in Israel, as well as the thousands of rocket, drone, missile or other attacks against Israel and U.S. forces in the Middle East carried out by Iran and its Shia militant allies since last year.
• We have also observed a notable uptick in attacks in Europe and the Five Eyes nations—Australia, Canada, New Zealand, the United Kingdom and the U.S.—from just five attacks in the 12 months before 7 October to 21 attacks since.
• And, reflecting the rise in anti-Israeli and anti-Semitic sentiments globally – in Europe, the Five Eyes nations and the Middle East, Jewish and Israeli interests have been the predominant target of attacks or disrupted plots influenced by the conflict. This excludes attacks in Israel or the Palestinian Territories.

These dynamics are likely to persist if the conflict in Gaza endures or a broader war in the Middle East breaks out. Here at home, thanks to U.S. law enforcement and homeland security, there have only been two attacks tied to the conflict thus far, though we do remain concerned that terrorist messaging and emotive content from Gaza will drive lone actors to attack, especially as events in the Middle East escalate.

So in sum, one-year later, this much is clear: the Israel-HAMAS conflict is emerging as the most consequential event impacting global terrorism in the last decade.

But the conflict is hardly the only driver of the currently elevated threat environment in which we find ourselves. There are many factors: new migration patterns spurred in part by Putin’s war in Ukraine, growing political and economic grievances worldwide, and technological advances, among others, have created this new dynamic.

***

In laying out the threat, context here is important. The elevated nature of the threat comes after years of sustained counterterrorism pressure—across multiple administrations, including the current one—against al-Qa'ida, ISIS and its affiliates across the globe. These efforts decimated these groups’ leadership and external operations capabilities and reduced the threat they posed to the U.S. Homeland to its lowest level since 9/11. But terrorists adapt and the threat evolves. And so today, we are entering a new phase of the global terrorism landscape—the latest incarnation of an ever-changing threat.

Whereas the United States previously focused on countering centrally-planned, large-scale attacks directed by groups like al-Qa'ida and ISIS, today’s threat is more diverse, decentralized, and complex. Often less capable and less sophisticated, but still lethal.

It’s more diverse because the ideological motivations and range of foreign terrorist actors are multi-dimensional. Today’s actors include not only al-Qa'ida, ISIS and Hizballah, but also transnational racially and ethnically motivated violent extremists, or REMVEs, anti-government and anti-authority violent extremist groups, homegrown violent extremists, or HVEs, and Iranian-linked entities. And when it comes to Iran, the United States will continue to aggressively thwart and deter the Iranian government’s persistent, brazen and pernicious efforts to target anyone here in the United States or U.S. interests abroad.

The threat is more decentralized, in part due to CT successes, which forced groups to disperse and operate in more locations worldwide to evade detection. The dispersed nature of ISIS’s footprint in Syria and its expansion across Africa reflect this new reality. In addition, new migration patterns due to the war in Ukraine prompted tens of thousands of Central Asian and Russian nationals to relocate to the West, including in the U.S. While many of these people were simply seeking a better future, we now know that some had ties to ISIS or embraced violent extremist ideology.

Finally, the threat is more complex because terrorists are savvier technologically. They’re using more secure communication platforms, turning to cryptocurrency and alternative payment channels, and embracing emerging technologies like 3D printing and artificial intelligence.

So that’s the new face of global terrorism: more diverse, more complex, and more decentralized. With that, let me touch on the key threats around the world.

***

In the U.S. Homeland, the most acute threat we face is from HVEs – individuals who are motivated, influenced by, or in contact with foreign terrorist organizations like ISIS. And here, it’s worth noting that since 9/11, HVEs have conducted 41 of the 49 terrorist attacks in the United States.

While groups overseas currently lack the capacity to launch large-scale attacks on the U.S. Homeland, organizations like ISIS, especially its branches in Syria and ISIS-Khorasan—the most potent elements of ISIS’s global enterprise—as well as al-Qa'ida’s affiliate in Yemen, remain committed to enabling and directing external operations.

Elsewhere, the Middle East and Africa are facing a reenergized threat from ISIS, al-Qa’ida, and Iranian-linked groups.

In Syria, ISIS began rebuilding last year as governments shifted attention and resources to the crisis in Gaza and countering threats from Iran and Iranian-aligned militants. Even as the U.S. maintained counterterrorism pressure, ISIS regrouped, repaired its media operations, and restarted external plotting. Likewise, al-Qa'ida associated forces in Syria like Hurras al-Din have also rebuilt some capabilities, though recent U.S. airstrikes on the group’s leaders have halted their momentum.

In Lebanon, we’re monitoring the situation closely and looking for any signs that Hizballah decides to escalate and plot against U.S. interests in or outside of Lebanon, which would be a mistake for the group.

Turning to Africa, stepped up U.S. efforts in Somalia since 2021 have kept al-Shabaab at bay, but elsewhere, ISIS and al-Qa'ida-aligned groups have capitalized on declining security, coups and instability in places like Burkina Faso, Chad, the DRC and Mali to establish safehaven, launch attacks, and spread their violent extremist ideology among vulnerable populations. While these groups mainly pose a local threat for now, we know that, if left unchecked, they could threaten U.S. and Western interests in the future. That’s why the United States, along with European partners, has been working to develop a more geographically diverse set of counterterrorism relationships in Central and West Africa.

Finally, in Europe, recent attacks and disrupted plots in Austria, Belgium, France, Germany, Italy and Sweden are manifestations of the threat we’re worried about here at home—young, vulnerable lone actors or loosely formed groups, often only connected virtually, drawing inspiration or guidance from ISIS to radicalize online and plan attacks.

In Europe, we're also attuned to the insidious threat from transnational REMVEs, some of whom, for example, form the Terrorgram Collective, a global community of white supremacists who communicate through Telegram channels to incite violence and propagate hateful ideologies.

***

Before I conclude, I want to share some strategic challenges we’re confronting with the aim of sparking new thinking and conversations about how to tackle these issues moving forward.

The first is increased terrorist adoption of emerging technologies. From cryptocurrency and AI to commercial UAVs and secure communication platforms, we need to develop and deploy more effective and efficient countermeasures at scale to deny terrorists the ability to operate.

Second, a permissive social media environment has allowed the proliferation of violent extremist narratives on both open and encrypted platforms. As many of these platforms have shifted overseas, the capacity and willingness of companies to proactively enforce their terms of service agreements and meet voluntary commitments regarding content moderation has been mixed at best.

And third, the growing number of juveniles engaging in terrorism. This is a phenomenon that stretches across continents and violent extremist ideologies. A permissive social media environment is part of the problem, but there’s clearly more to do when it comes to prevention and disrupting recruitment and mobilization at the local level in communities around the world.

***

In closing, I have one final reflection on the last 12 months. The 7 October attack is a stark reminder of the enduring terrorism threat. It’s a reminder that we take our security for granted at our own peril. And for me, it’s a reminder of how grateful I am for the dedicated counterterrorism professionals, at NCTC and across the U.S. Government, along with our partners and allies, who work tirelessly to keep us safe each and every day. Thank you.

###