Executive Summary:
The Islamic State (IS), also known as the Islamic State in Iraq and Syra (ISIS) or Islamic State in
Iraq and the Levant (ISIL), is a transnational Sunni Islamist terrorist and insurgency organization. While
the group has seen a decline over the past five years, the U.S. Central Command (CENTCOM)has
assessed that the organization has the capability to sustain itself and its operations at its present level in
the Syrian desert. 1 The Islamic State can sustain itself even after successive blows to its organization in
large part due to its intelligence apparatus and counterintelligence efforts. The Emni, the Islamic State’s
intelligence service, has been extremely effective in carrying out the organization’s intelligence and
counterintelligence efforts. To form effective counterterrorism policy and strategy against the Islamic
State, it is essential to understand the group’s intelligence and counterintelligence capabilities.
The Islamic State and the Emni Background:
Originally an affiliate of the terrorist organization Al Qaeda, the Islamic State grew out of the
organization formally known as Al Qaeda in Iraq (AQI) and then the Islamic State of Iraq (ISI). 2 However,
the Islamic State in Iraq and Syria (ISIS) was formally founded in 2013 when its leader, Abu Bakr Al-
Baghdadi, proclaimed himself as the caliph. In 2014, Al Qaeda officially severed ties with al-Baghdadi’s
Islamic State when it subsumed the Al Qaeda affiliate organization in Syria, the Nusra Front. 3 While the
Islamic State has suffered significant blows over the last several years, it continues to wage low-level
insurgency across central and northern Syria and across parts of the Syrian Desert that cross into Iraq. 4
The United States Central Command (CENTCOM) has stated that the Islamic State, at its present level,
has the capability to sustain operations in the Syrian Desert. Despite its decline and territorial losses, the
Islamic State can sustain itself and evade total defeat in large part due to its sophisticated intelligence
and counterintelligence efforts.
The Islamic State intelligence and counterintelligence service is known as the Emni. Emni in
Arabic stands for “security,” “Trust,” or “Safety” and is responsible for the collection of intelligence both
within and outside of the Islamic State. 5 The Emni’s structure and operations are highly influenced by
the former Saddam Hussein’s Ba’athist regime’s intelligence service. Haji Bakr, a former colonel in
Hussein’s intelligence service, has been called al Baghdadi’s spymaster and architect of the Emni. 6 Along
with Bakr, other former intelligence and military officers of the Hussein regime have filled the ranks of
the Islamic State Emni. Pulling on the knowledge and experience of Hussein’s intelligence service, the
Emni has become a sophisticated organization.
Intelligence and Counterintelligence:
All organizations, whether state or non-state, owe their security and continued operations and
activities to counterintelligence. Counterintelligence has repeatedly lacked attention in much of the
counterterrorism literature, even though it plays a vital support role in any organization’s intelligence
function. To understand a terrorist organization like the Islamic State and its intelligence and
counterintelligence apparatus, it is important to understand the meaning of both terms.
Intelligence refers to information collected, processed, and disseminated to decision-makers
who guide policy based on the learned information. However, what makes intelligence more unique
than simple research and data collection is the element of secrecy. While maintaining a certain level of secrecy is important for all organizations, it is especially important for illicit organizations that seek to
evade detection and avoid disruption, like the Islamic State. Therefore, it is the role of
counterintelligence to guard an organization’s secrets. Counterintelligence can be understood as
activities and processes organizations conduct to detect and deter insider threats and moles, as well as
those activities that seek to deceive and neutralize an adversary’s intelligence collection operations. 7
Simply put, counterintelligence aims to prevent an adversary from gaining inside access to one’s secrets,
which can be done using various counterintelligence methods.
A framework for understating counterintelligence, as advanced by Dr. Henry Prunckun,
identifies two main taxonomic classifications of counterintelligence: defensive and offensive
counterintelligence. 8 Defensive counterintelligence focuses on detection and deterrence, while offensive
focuses on deception and neutralization. Defensive counterintelligence, detection, and deterrence
activities typically fall within the categories of basic denial and adaptive denial. At the same time,
offensive counterintelligence deception and neutralization activities fall under the category of covert
manipulation. Basic denial, adaptive denial, and covert manipulation are theoretical categories that
build off of and overlap with one another, where activities of one category can bleed over into another.
Basic denial is a foundational counterintelligence process that aims to prevent the movement of
information, either intentionally or unintentionally, from one’s organization to an adversarial one. Basic
denial typically takes the form of vetting procedures for new personnel and carrying out measures to
ensure that current personnel have not been compromised. Activities of basic denial include background
checks, polygraph interviews, having a formal or informal system for reporting abnormal and alerting
behavior, and educating members about the risks and penalties for espionage. 9
Adaptive denial builds off of basic denial by examining the unique intelligence collection
operations of an adversary and altering its security measures to counter these collection efforts.
Adaptive denial activities include the investigation and interrogation of suspected insider threats, the
cataloging of personally identifiable information of members, the identification of risk factors for
potential traitors, tracking group members’ access to sensitive information, and conducting damage
assessments when information is leaked. 10 However, more sophisticated adaptive denial techniques,
which in some cases begin to cross over and are associated with activities of covert manipulation,
include the penetration of the adversary’s intelligence organization and communications systems and
the identification of human sources that could pinpoint traitors within one’s organization. 11
Covert manipulation falls under the taxonomic classification of offensive counterintelligence and
is the most sophisticated subprocess of counterintelligence. Covert manipulation aims to deceive and
neutralize an adversary’s intelligence collection methods, which requires significant insight into an
adversary’s intelligence apparatus. 12 Covert manipulation includes activities and processes that attempt
to plant false information about an organization and its operations to mislead and distract an adversary.
While not as effective as state intelligence services at conducting activities of covert manipulation,
terrorist and insurgent organizations are increasingly growing in sophistication and attempting to carry
out deceptive aspects of covert manipulation.
The Emni and its Intelligence and Counterintelligence Efforts:
The Islamic State’s Emni is responsible for the collection of intelligence both within and outside
of the Islamic State. 13 The Islamic State, like many other terrorist and insurgent organizations, requires
some level of secrecy to maintain its operational security and defend itself from adversaries that seek to
dismantle the organization. As previously stated, counterintelligence aims to prevent an adversary from
gaining inside access to one’s secrets. Therefore, the Emni employs both defensive and offensive
counterintelligence, specifically the activities of basic denial, adaptive denial, and covert manipulation to
maintain the organization’s security.
Basic Denial
The primary basis of the Emni’s basic denial activities is the utilization of its extensive informant
network and its system of vetting members. The Islamic State’s informant network operates as a formal
and informal system for reporting altering or suspicious behavior and is critical in the detection and
deterrence of insider threats. The Emni uses Da’wah offices or religious centers in areas under its control
as central locations where informants can meet to report on suspicious individuals and is used as a
prime location where the Emni recruits potential ISIS members. 14 Both paid and unpaid informants
report any alerting behavior and conversations to Emni members at local Da’wah offices. 15 The
Informant system as a method of counterintelligence allows the Emni to collect intelligence within the
Islamic state about its citizen. Haji Bakr, often referred to as the architect of the Emni, designed the ISIS
informant network in an attempt to create almost an omnipresence of the Emni throughout ISIS-
controlled territory. Under this informant system, everyone, even children as young as 6 and 7, became
informants for the Emni. 16 As stated by one former Emni member, “The people will be good eyes and
armor to protect us from spies…”. 17 Another significant aspect of the ISIS informant system was its use of paid informants. In certain cases, paid informants could earn up to $5,000 for each spy caught. 18
However, while this appears to enhance the informant system through monetary incentives, one must
question the reliability of informants when a great deal of money is offered. The creation of the
informant system is one of the most critical components of the Islamic State’s ability to monitor
members and asses if an adversary has compromised any current members and is therefore critical to its
basic denial efforts.
Furthermore, the Islamic State’s system of vetting new members is also a critical basic denial
activity. The Islamic State’s vetting system aims to prevent, detect, and deter the entry of any potential
insider threats. The ISIS vetting system includes the use of fingerprinting, collection of blood samples,
physical examinations, and requires the periodic confiscation of new and current members’ electronic
devices. 19 Electronic devices such as phones and personal laptops are periodically seized and
investigated for signs of disloyalty or treason. For most new members of ISIS, there is a significant
amount of distrust and skepticism, but even more so for foreign fighters. An additional step of the
vetting process for foreign fighters that the Emni distrusts includes sending these individuals to battle,
where they will either prove themselves or die. 20 Additionally, in some cases, those that the Emni
distrusts are encouraged to be martyrs and suicide bombers. In any case, those who are untrustworthy
are provided with limited information until they prove their loyalty or are otherwise physically
eliminated.
Adaptive Denial: Adaptive denial aims to identify an adversary’s unique intelligence collection methods and
establish measures to counter such collection efforts. The Islamic State’s most prominent adaptive
denial method is its use of extreme violence to create fear. Leaders of the Islamic State recognize that
the organization faces many adversaries and, therefore, uses violence and fear not only to communicate
its political objectives as a terrorist organization but also to use these elements as a primary means of
deterring insider threats. The use of extreme violence, such as beheadings and other public executions,
can be an effective tool at deterring adversarial intelligence collection efforts, preventing defectors, and
maintaining order within the Islamic State. 21 Additionally, the extensive and pervasive informant system
is another means of establishing fear of the Emni and its reach. The fear that an informant will out
anyone who is suspected of being a spy is a significant deterring factor. Often, those traitors and spies
found within the Islamic State are interrogated, tortured, and have their confessions filmed and
broadcast. 22 The use of filming and broadcasting confusions, whether real or false, also works to create
even more fear throughout its territory and the world that the Emni will find all traitors and spies within
its territory and eliminate them.
Another aspect of the Islamic State’s adaptive denial activities is the Emni’s efforts to recruit
human sources in areas that the Islamic State seeks to influence and control. The recruitment of human
sources is a sophisticated adaptive denial activity that helps identify insider threats within the Islamic
State and the identification of potential threats in territories and communities ISIS seeks to control. 23
When the Islamic State seeks to gain control of a new town or community, it will often open a Da’wah
office that bases Emni officers and members. As previously mentioned, Da’wah offices or religious
centers are used as prime locations for the recruitment of new ISIS members. Human sources within a
new community or area that ISIS is seeking to control are identified by Emni officers at these newly
opened Da’wah offices and are recruited to provide the Emni with key information about local leaders
and influential members of the community. Using these human sources, the Emni can determine if there
are any alerting or suspicious individuals in the area that may have been planted by another intelligence
service as well as those that may be sympathetic to or against ISIS’s efforts, which ultimately assists in
ISIS’s infiltration and eventual takeover of a new community. Some human sources that are recruited
are even instructed to try and marry into an influential family as a means of gaining loyalty. 24 The
recruitment of human sources as a sophisticated activity of adaptive denial begins to push into the
category of covert manipulation as a great deal of deception is involved in using Da’wah offices for more
nefarious purposes and the deceptive practices human sources must sometimes carry out. However, as
a defensive counterintelligence effort, using human sources is critical in detecting insider threats and
potential future threats.
Another adaptive denial technique of the Islamic State focuses on the collection and cataloging
of personally identifiable information of members. The cataloging of personally identifiable information
of members is an important aspect of many bureaucracies to keep track of those living and working
within one’s territory. Information is collected, primarily through the ISIS informant network, on all
individuals living within the Islamic State, and certain profiles of ISIS members are cataloged in physical
and digital databases. 25 All information compiled on members of the Islamic State is maintained and
examined by the Emni to determine if any members show signs of risk factors for potential traitors. If
any member’s profile presents signs that they are potential traitors, the Emni is responsible for tracking
down, arresting, and investigating any of these members. The idea that the Emni must identify, track
down, and investigate any threats to the Islamic State is not only part of its counterintelligence effort but also resonates with ISIS’s greater principle that its land must be purged of any opposition in order to
unify a Salafist community. 26
Covert Manipulation
As previously mentioned, covert manipulation is the most sophisticated subprocess of
counterintelligence, and it aims to deceive and neutralize an adversary’s intelligence collection methods.
Activities of covert manipulation are typically practiced solely by state intelligence services. However,
increasingly advanced terrorist and insurgent organizations are attempting to carry out deceptive
aspects of covert manipulation while still not full achieving neutralization aspects. Deceptive activities
aimed at misdirecting adversarial intelligence collection efforts as carried out by the Islamic State
include the use of Da’wah offices in new towns and areas, the obfuscation of the actual number of ISIS
members, and the attempt to train members on how to pass as westerners when traveling.
As stated in the previous section, Da’wah offices are a critical component of ISIS’s ability to
recruit human sources, especially in areas where it wishes to overtake. Human sources are a critical
aspect of its adaptive denial techniques as they are important in detecting spies within the Islamic State
and potential threats in new communities. However, infiltrating new towns and communities by
recruiting human sources is also part of its deceptive activities of covert manipulation. By infiltrating a
new community or town through these Da’wah offices, these human sources can begin to spread either
false or misleading information about the Islamic State and its intentions. 27 These human sources that
are recruited may vary in occupation and societal class; with a greater focus on recruiting sources with
access to influential roles and members in these new towns and areas, the Islamic State has a greater
degree of garnering community support for the organization.
Another aspect of ISIS’s deceptive practices of covert manipulation is the obfuscation of the
actual number of fighters the organization has. The obfuscation of the member count of ISIS is part of its
efforts to maintain the element of surprise and its operational security. One way the Islamic State seeks
to distort both regional and international adversaries is by using uniforms when they carry out attacks
and when they engage in battle. ISIS fighters are often spotted wearing black masks when they are
fighting. The use of a simple black mask not only conceals the identity of those involved in an attack but
also makes it difficult to count the actual number of fighters ISIS has. 28 By having members appear in
black masks at multiple locations over a certain amount of time, it becomes difficult to identify if these
are the same members carrying out attacks repeatedly or if these are a totally new set of fighters,
obscuring the true number of fighters. The act of obscuring the number of fighters is a deceptive
measure aimed at disrupting an adversary’s assessment of the Islamic State and its personnel.
Another deceptive measure that the Islamic State attempts to carry is the training on how to blend into a society that trusted members are traveling to. To avoid defectors, only greatly trusted members of ISIS and the Emni travel abroad to carry out attacks, track down other known defectors, and carry out other business of the Islamic State. 29 These members who travel abroad, especially if traveling to a Western country, are provided limited training on how they might best fit in when traveling to avoid detection and detainment by foreign customs and law enforcement officials. Part of this training is guided by ISIS publications such as “How to Survive in the West,” which guides members not only on how they should appear while traveling in the West but also on what cosmetics to use and what underwear to wear so as not to draw attention to them when going through airports and customs. 30 While these deceptive measures appear to be minor and by no means attempt to neutralize an adversary’s intelligence collection efforts, they are beginning attempts to carry out deceptive aspects of covert manipulation to mislead and distort the adversary’s view and assumptions of the Islamic State.
Conclusion:
No organization is immune to insider threats and information leakages. Even the most powerful
intelligence services, such as the CIA, are prone to defectors. The Islamic State’s Emni is no different,
and it has attempted to carry out the counterintelligence activities of basic denial, adaptive denial, and
covert manipulation to offset this issue of insider threats. Therefore, it is important to the
counterintelligence vulnerabilities and capabilities of nefarious organizations like the Islamic State. A
better understanding of the methods by which the Islamic State secures itself from potential spies is
critical in forming counter-terrorism strategies and policies to counter organizations like ISIS.
Endnotes
1 Thomas, Clayton. “The Islamic State.” Congressional Research Service, 2022.
https://crsreports.congress.gov/product/pdf/IF/IF10328
2 Ibid.
3 Ibid.
4 “Containing a Resilient ISIS in Central and North-Eastern Syria.” International Crisis Group, September 6, 2022.
https://www.crisisgroup.org/middle-east-north-africa/east-mediterranean-mena/syria/containing-resilient-isis-
central-and-north.
5 Speckhard, Anne, and Ahmet S. Yayla. “The ISIS Emni: Origins and Inner Workings of ISIS’s Intelligence
Apparatus.” Perspectives on Terrorism 11, no. 1 (2017): 3. http://www.jstor.org/stable/26297733.
6 Ferdinand J. Haberl, “Chapter 9: Counterintelligence,” essay, in Jihadi Intelligence and Counterintelligence:
Ideological Foundations and Operational Methods (Cham: Springer Nature Switzerland, 2023), 179–216, 181.
7 Blake W. Mobley, “Chapter 1: Introduction,” introduction, in Terrorism and Counterintelligence: How Terrorist
Groups Elude Detection (New York, NY: Columbia University Press, 2012), 8.
8 Hank Prunckun, Counterintelligence Theory and Practice ( Lanham, MD: Rowman & Littlefield Publishers, 2019),
26.
9 Blake W. Mobley, “Chapter 1: Introduction,” introduction, in Terrorism and Counterintelligence: How Terrorist
Groups Elude Detection (New York, NY: Columbia University Press, 2012), 8.
10 Ibid, 9.
11 Ibid.
12 Ibid, 10.
13 Speckhard, Anne, and Ahmet S. Yayla. “The ISIS Emni: Origins and Inner Workings of ISIS’s Intelligence
Apparatus.” Perspectives on Terrorism 11, no. 1 (2017): 3. http://www.jstor.org/stable/26297733.
14 Carl Anthony Wege, “The Changing Islamic State Intelligence Apparatus,” International Journal of Intelligence
and CounterIntelligence 31, no. 2 (2018): 275. https://doi.org/10.1080/08850607.2018.1418552
15 Speckhard, Anne, and Ahmet S. Yayla. “The ISIS Emni: Origins and Inner Workings of ISIS’s Intelligence
Apparatus.” Perspectives on Terrorism 11, no. 1 (2017): 7. http://www.jstor.org/stable/26297733.
16 Ibid, 7.
17 Ferdinand J. Haberl, “Chapter 9: Counterintelligence,” essay, in Jihadi Intelligence and Counterintelligence:
Ideological Foundations and Operational Methods (Cham: Springer Nature Switzerland, 2023), 184.
18 Vera Mironova, Ekaterina Sergatskova, and Karam Alhamad, “Isis’ Intelligence Service Refuses to Die,” Foreign
Affairs, January 17, 2023, https://www.foreignaffairs.com/articles/iraq/2017-11-22/isis-intelligence-service-
refuses-die.
19 Ferdinand J. Haberl, “Chapter 9: Counterintelligence,” essay, in Jihadi Intelligence and Counterintelligence:
Ideological Foundations and Operational Methods (Cham: Springer Nature Switzerland, 2023), 179–216, 207.
20 Speckhard, Anne, and Ahmet S. Yayla. “The ISIS Emni: Origins and Inner Workings of ISIS’s Intelligence
Apparatus.” Perspectives on Terrorism 11, no. 1 (2017): 7. http://www.jstor.org/stable/26297733.
21 Ibid, 7.
22 Vera Mironova, Ekaterina Sergatskova, and Karam Alhamad, “Isis’ Intelligence Service Refuses to Die,” Foreign
Affairs, January 17, 2023, https://www.foreignaffairs.com/articles/iraq/2017-11-22/isis-intelligence-service-
refuses-die.
23 Ferdinand J. Haberl, “Chapter 9: Counterintelligence,” essay, in Jihadi Intelligence and Counterintelligence:
Ideological Foundations and Operational Methods (Cham: Springer Nature Switzerland, 2023), 179–216, 183.
24 Speckhard, Anne, and Ahmet S. Yayla. “The ISIS Emni: Origins and Inner Workings of ISIS’s Intelligence
Apparatus.” Perspectives on Terrorism 11, no. 1 (2017): 5. http://www.jstor.org/stable/26297733.
25 Carl Anthony Wege, “The Changing Islamic State Intelligence Apparatus,” International Journal of Intelligence and
CounterIntelligence 31, no. 2 (2018): 275. https://doi.org/10.1080/08850607.2018.1418552
26 Ferdinand J. Haberl, “Chapter 9: Counterintelligence,” essay, in Jihadi Intelligence and Counterintelligence:
Ideological Foundations and Operational Methods (Cham: Springer Nature Switzerland, 2023), 186.
27 Carl Anthony Wege, “The Changing Islamic State Intelligence Apparatus,” International Journal of Intelligence and
CounterIntelligence 31, no. 2 (2018): 274. https://doi.org/10.1080/08850607.2018.1418552
28 Speckhard, Anne, and Ahmet S. Yayla. “The ISIS Emni: Origins and Inner Workings of ISIS’s Intelligence
Apparatus.” Perspectives on Terrorism 11, no. 1 (2017): 5. http://www.jstor.org/stable/26297733.
29 Ferdinand J. Haberl, “Chapter 9: Counterintelligence,” essay, in Jihadi Intelligence and Counterintelligence:
Ideological Foundations and Operational Methods (Cham: Springer Nature Switzerland, 2023), 186.
30 Ibid.
Bibliography
- “Containing a Resilient ISIS in Central and North-Eastern Syria.” International Crisis Group, September 6, 2022. https://www.crisisgroup.org/middle-east-north-africa/east-mediterranean-
mena/syria/containing-resilient-isis-central-and-north.
Haberl, Ferdinand J. “Chapter 9: Counterintelligence.” Essay. In Jihadi Intelligence and
Counterintelligence: Ideological Foundations and Operational Methods, 179–216. Cham:
Springer Nature Switzerland, 2023.
Mironova, Vera, Ekaterina Sergatskova, and Karam Alhamad. “Isis’ Intelligence Service Refuses to Die.”
Foreign Affairs, January 17, 2023. https://www.foreignaffairs.com/articles/iraq/2017-11-22/isis-
intelligence-service-refuses-die.
Mobley, Blake W. “Chapter 1: Introduction.” Introduction. In Terrorism and Counterintelligence: How
Terrorist Groups Elude Detection, 1–19. New York, NY: Columbia University Press, 2012.
Prunckun, Hank. Counterintelligence theory and practice. Lanham, MD: Rowman & Littlefield Publishers,
2019.
Speckhard, Anne, and Ahmet S. Yayla. “The ISIS Emni: Origins and Inner Workings of ISIS’s Intelligence
Apparatus.” Perspectives on Terrorism 11, no. 1 (2017): 2–16.
http://www.jstor.org/stable/26297733.
Thomas, Clayton. “The Islamic State.” Congressional Research Service, 2022.
https://crsreports.congress.gov/product/pdf/IF/IF10328
Wege, Carl Anthony. “The Changing Islamic State Intelligence Apparatus.” International Journal of
Intelligence and CounterIntelligence 31, no. 2 (2018): 271–88.
https://doi.org/10.1080/08850607.2018.1418552.
