Scott Stewart
Scott Stewart supervises Stratfor’s analysis of terrorism and security issues. Before joining Stratfor, he was a special agent with the U.S. State Department for 10 years and was involved in hundreds of terrorism investigations.
Emergency services respond to a March 19 attack on Istanbul’s Istiklal Street, an area popular among tourists. Turkey faces a terrorist threat from three distinct groups, each with its own methods. (BURAK KARA/Getty Image
Three strands of terrorism currently have Turkey wrapped in a deadly embrace. One strand made its presence felt March 19, when a suicide bomber detonated his device among a group of tourists on Istiklal Street, one of Istanbul’s main pedestrian shopping areas, killing at least four people and wounding dozens, including 24 foreigners. The attack occurred near a local government office, in an area that includes restaurants, cafes and foreign consulates. Turkish authorities have since identified the bomber as a Turkish member of the Islamic State they had been seeking to arrest. Unfortunately, he was able to attack before he could be apprehended.
The second thread is the Kurdistan Freedom Falcons (TAK), a domestic militant group that seeks independence or autonomy in southeastern Turkey and that is a direct offshoot of the Kurdistan Workers’ Party (PKK). On March 13, the TAK detonated a car bomb that killed 37 in a central Ankara neighborhood, its second large vehicle bomb attack in the Turkish capital this year.
The third strand is the Marxist Revolutionary People’s Liberation Party-Front (DHKP-C). Two female operatives from the group attacked a police bus with firearms and a hand grenade as it was approaching a police station in Istanbul’s Bayrampasa district on March 3. They succeeded in wounding two officers before being confronted and killed by police.
Though all three of these groups employ terrorism, each does so in a distinct manner. When these strands are unraveled and examined separately, important lessons can be gleaned about the capabilities of each group and the threat each poses.
Focusing on the How
Terrorist attacks do not just happen. They are the result of a process called the terrorist attack cycle. While every terrorist actor must follow the cycle to conduct an attack, the manner in which they do varies. By examining the terrorist tradecraft employed by a specific group and focusing on how attacks are conducted, it is possible to detect discernable patterns. These patterns can then be used to help identify the operative or group responsible for a particular attack. This is especially useful in a case where no organization claims responsibility for an attack or a group uses a false name in an effort to hide its hand.
Terrorists can and do improve their tradecraft, but this is normally an evolutionary process rather than a quantum leap, and there are normally indicators of a group’s evolving capabilities. This process of incremental advancement can be skipped when a terrorist actor receives outside assistance and training by someone with more advanced capabilities. This has historically been a state sponsor such as the Soviet KGB or East German Stasi, or a more experienced terrorist organization such as the Irish Republican Army, which taught bomb making in terrorist camps in Lebanon, Libya and Yemen. In recent years, such a leap occurred in Nigeria in mid-2011 when Boko Haram and Ansaru suddenly transitioned from using small improvised grenades to successfully employing vehicle bombs. This happened after Nigerian militants reportedly received training from Al Qaeda in the Islamic Maghreb and al Shabaab.
The Islamic State in Turkey
Islamic State attacks inside Turkey have been for the most part unsophisticated and aimed at soft targets. In January 2015, the pregnant Chechen widow of an Islamic State fighter detonated a hand grenade at a guard post outside a tourist police station in Istanbul’s Sultanahmet district, killing herself and one police officer. It is unclear whether the group was responsible for the attack or if the woman planned and executed it herself. But in mid-2015, the Islamic State began a carefully orchestrated campaign of attacking Kurdish interests in Turkey in an effort to increase Kurdish/Turkish tensions. In June 2015, a pro-Kurdish Peoples’ Democratic Party (HDP) rally was targeted by two bombs left in the crowd in Diyarbakir, leaving four HDP members dead and over 100 injured. In July 2015, a suicide bomber attacked a rally at a Kurdish cultural center in Suruc, killing 33 and wounding over 100. Then in October 2015, a double suicide bombing at an HDP rally killed 103 and wounded more than 400 in the deadliest terrorist attack in modern Turkish history.
In 2016, the Islamic State shifted its focus to tourist targets. On Jan. 12, a suicide bomber attacked a group of foreign tourists near the Blue Mosque in Istanbul’s Sultanahmet district, killing 13 — mostly German tourists — and wounding nine. The March 19 suicide bombing on Istiklal Street mirrored this attack.
While the Islamic State has demonstrated that it can reach targets in Istanbul and Ankara, to date, none of the Islamic State attacks in Turkey have demonstrated a high degree of terrorist tradecraft. As we have previously noted, the Islamic State has struggled to project its terrorist power beyond its core areas of operation, and has not exhibited the same type of advanced transnational terrorist tradecraft capabilities that al Qaeda possesses. Because of this, even foreign attacks directly tied to the Islamic State’s core, such as the November 2015 Paris attacks, have been simple attacks directed against soft targets rather than more sophisticated attacks.
To date, relatively simple attacks have met the group’s needs in Turkey, but given the low body count in the March 19 bombing, it might not be surprising to see the group shift to armed assaults in Turkey in an effort to generate higher death tolls. The group will likely have to develop more sophisticated surveillance and other capabilities before it will be able to successfully attack better-protected targets in hostile environments such as Ankara and Istanbul. Because of this, and the current campaign of targeting foreigners, we can anticipate additional Islamic State attacks against locations where foreigners congregate, such as tourist sites, restaurants, hotels, etc. These may include armed assaults in addition to suicide bombings.
The TAK
There is some uncertainty regarding the relationship between the PKK and the TAK. Some observers claim that the TAK is a radical splinter that broke away from the PKK. Others maintain that the TAK is actually a PKK urban warfare unit using another name to deflect blame from the political group, or an autonomous unit that subscribes to the PKK’s general philosophy but does not operate under its direct guidance. Stratfor ascribes to the latter position because of the close correlation between TAK attacks and the PKK’s cease-fire — they ceased attacks before the cease-fire was proclaimed in March 2013, and resumed them shortly after the cease-fire was ended in November 2015. If the TAK was really a more radical splinter of the PKK, it could have been expected to conduct attacks after the PKK proclaimed its unilateral cease-fire. For its part, TAK claims it is separate from the PKK, but Stratfor believes it is more important to judge the group by what it does than what it says for public consumption.
The TAK began their activity with a series of low-level attacks against tourist sites along the Aegean Sea in 2005-2006. Unlike the recent Islamic State attacks in Istanbul, these strikes were meant more to scare tourists away and damage the Turkish economy rather than produce a large body count. In 2008, the TAK shifted its operations to target Istanbul, with deadly effect. The group’s first attack in Istanbul in October 2008 killed 17 and injured more than 150. In October 2010, it initiated a series of suicide bombings in Ankara, targeting police and security forces. As noted, TAK operations correlate closely with PKK sentiments. When the PKK negotiated with the government, proclaiming a cease-fire in 2013, the TAK attacks ended.
But while the TAK temporarily ended hostilities, it appears that the group’s operational activity did not cease. The group announced its reactivation in a spectacular fashion in December 2015 with a mortar attack on Istanbul’s Sabiha Gokcen International Airport. The attack, launched at 2 a.m. local time, killed one airport worker and damaged several aircraft parked on the tarmac. The timing of the attack indicated that it was likely meant to be more symbolic than deadly. A much deadlier attack would come in February when the TAK targeted a military transport bus near a military housing complex in Ankara with a suicide car bomb that killed 29 and wounded dozens more.
Then, on March 13, the organization conducted another suicide car bomb attack against a bus, this one near a transportation hub in the heart of Ankara. That particular action killed 37 and wounded more than 120. In a statement claiming credit, the TAK said that the attack had been intended to target security forces rather than civilians but noted that further civilian casualties are inevitable.
The TAK and PKK have long focused their attacks on security forces, so the statement’s claim that civilians were killed by mistake could be true. However, the Turkish military’s recent operations against the PKK in southeastern Turkey have been heavy-handed, and a number of civilians have died as a result. Because of this, it is possible that the TAK was retaliating for the Kurdish civilian deaths and glossing over that fact for the international audience. These Kurdish terrorist groups have no real motive to attack foreigners, and indeed, they are attempting to appeal for outside support to pressure Turkey to stop its campaign against them. So, directly attacking foreigners makes little sense. Still, with the TAK using powerful suicide car bombs in its current campaign, there is a possibility of foreign citizens being caught in the wrong place at the wrong time. The TAK does not appear to be experiencing a shortage of explosives or willing suicide operatives. In addition, the group seems to have a robust planning and logistics capability. Therefore, we can expect more attacks directed against security forces in Ankara and elsewhere. However, to date the TAK has not exhibited the ability to directly attack hardened targets, such as ministry buildings or government officials with protective details.
Foreigners visiting government buildings and security force installations are at risk, as are foreigners living near government installations or along routes used by security force transport buses. Given that the group has at least one mortar, it is likely that they will conduct other indirect fire attacks at government facilities in addition to continued suicide bomb attacks.
The DHKP-C
The Marxist Revolutionary People’s Liberation Party-Front can trace its lineage back to the old Revolutionary Left or Dev Sol militant group that has been fighting the Turkish government since the 1970s. Yet despite this long and violent heritage, the DHKP-C is more ambitious than it is capable. Since 2000, the group has carried out only about a dozen effective armed assaults, suicide bombings and assassinations. Many of the group’s attempted attacks have been thwarted or botched, including a May 2003 attack in which a DHKP-C member accidentally discharged her suicide device inside a restroom. The group was also behind the failed February 2013 suicide bombing of the U.S. Embassy in Ankara.
What the group lacks in capability it makes up for in persistence. Two members of the group stormed an Istanbul courthouse and took a prosecutor hostage before being gunned down — the prosecutor was also killed during the exchange of fire. In August 2015, the DHKP-C employed a car bomb and armed assault against a police station in Istanbul’s Sultanbeyli district in an attack that killed one police officer. The same day, two of the group’s members also attempted an amateurish armed assault against the U.S. Consulate in Istanbul.
The March 3 attack against a police bus in Istanbul was perhaps inspired by or modeled after the February TAK bus attack in Ankara, but its execution displayed the hallmarks of a typical DHKP-C attack. Security camera footage of the attack showed that the female operatives were ill at ease with their firearms and displayed poor marksmanship fundamentals. Also, the hand grenade they threw at the bus did not detonate. With this amateurish execution, it is not surprising that despite choosing a soft target, only two police officers were wounded and none killed.
The DHKP-C is mostly focused on attacking the Turkish government and U.S. diplomatic facilities. Because of this, tourists and business travelers are not likely to be directly targeted but could be unintended casualties or be caught in the wrong place at the wrong time.
These three groups differ in capability, motivation, intent and tradecraft, but they are all deadly, and can all be expected to continue to go after soft targets in Turkey for the foreseeable future. Of these, the TAK is the most capable at the present time, but the Islamic State is the most likely to directly target foreigners.
