On Jan. 28, an armed attack occurred at the Santa Maria Church in Istanbul’s Sarıyer district, resulting in the loss of one life. The Counterterrorism and Intelligence Branch of the Istanbul Police Department arrested two foreign suspected members of the Daesh terrorist organization. Some 34 individuals, also detained in connection with the attack, were brought before a magistrate for potential arrest. The Interior Ministry reported 1,046 operations against Daesh from June 1, 2023, to present.
Why did Daesh – dormant since 2017 – once again target Türkiye? Is the assault on Santa Maria Church an isolated incident, or does it signify the manifestation of the organization’s broader regional plans? How can we decipher the attack given the timing, method, target, and profile of the assailants? What is the status of counterterrorism operations against Daesh? Prominent experts have provided their assessments for our readers.
Prepared by
Experts
Çağatay Balcı
Ömer Behram Özdemir
Çağatay Cebe
Ahmet Yusuf Özdemir
Kutluhan Görücü
Dr. Çağatay Balcı
Researcher, International Security and Terrorism
-
- In light of the recent attack on Santa Maria Church in Istanbul’s Sarıyer, how can the incident be decoded regarding its timing, modus operandi, target selection, and the profile of the assailants?
Firstly, it is challenging to assert that a special or symbolic choice was made regarding the timing and target of the attack. However, it is possible to establish a connection between the timing of the attack and the recent operation by the National Intelligence Organization (MİT) and police that captured Daesh terrorists involved in planning and reconnaissance activities targeting synagogues and churches. It would not be inaccurate to assess that the mentioned operation might have caused panic among the terrorist organization’s cells in Türkiye.
As we are aware, Türkiye’s churches and synagogues are considered ‘given’ or ‘natural’ targets for the Daesh terrorist organization. The execution of this act was declared to be in line with the group’s call and instruction for its cells in different countries to ‘kill them (Christians and Jews) wherever you find them.’ However, for the first time, this action was claimed by the so-called ‘Türkiye Province (Wilayat Turkiya),’ representing the organization’s structure in Türkiye. In this context, when considering the attack, the group’s call and instruction to its cells, and the motivation for the Türkiye structure to come to the forefront and ‘prove its existence,’ the characteristics of this terrorist act, in terms of timing and target, can be explained.
On the other hand, examining the method of the attack and the profile of the assailants it is initially observed that this act has a relatively ‘archaic’ nature. Analyzing Daesh actions in Türkiye tells us that explosive attacks are considered the primary method. However, the attack on Santa Maria Church was executed in the form of an armed assault. This situation indicates that Daesh, especially within Türkiye, has started to shift toward more ‘archaic’ types of attacks (stabbing, vehicle ramming crowds, and armed assaults), which are less complicated and do not require extensive preparation, similar to its actions in European countries.
- How did Türkiye respond to the attack on Santa Maria Church, and how do you assess the efficacy of recent counterterrorism operations? Is there a discernible security vulnerability in the execution of the attack?
Türkiye’s approach to counter Daesh is based on the concepts of prevention and preemption. This approach is a natural reflex arising from the organization predominantly adopting an ‘urban guerrilla’ strategy and organizational model. It is applicable not only within Türkiye alone but in the fight against Daesh structure in Syria as well. In 2023, Türkiye’s MİT conducted 122 operations against Daesh, leading to the capture of numerous organization members and the prevention of many attacks. This demonstrates Türkiye’s consistent and continuous efforts in the fight against Daesh.
Initially, this situation may seem to create a perception of contradiction and vulnerability in the context of the attack on Santa Maria Church. However, especially considering the form of the mentioned attack, it indicates more of a necessary organizational tactical shift than a security vulnerability. The consistent and determined nature of Türkiye’s operations against Daesh compels the terrorist organization to undergo a necessary change in its modus operandi. This resulted in the terrorist organization adopting a model summarized as ‘urgent decision-urgent preparation-urgent execution’ in carrying out its actions. This model aims to minimize risks for the organization. However, from the perspective of security and intelligence units, predicting these actions and conducting pre-emptive activities become equally challenging. Nevertheless, expecting Turkish security and intelligence units to analyze this change and develop an appropriate understanding in a short period, thus thwarting the ‘advantage’ the organization seeks, would not be unreasonable. This situation could potentially lead the organization into a deadlock, especially in terms of operational effectiveness within Türkiye.
Dr. Ömer Behram Özdemir
Researcher, Levant Studies, ORSAM
- In light of the recent attack on Santa Maria Church in Istanbul’s Sarıyer, how can the incident be decoded regarding its timing, modus operandi, target selection, and the profile of the assailants?
The presence of Daesh not only creates a legitimate ground for many actors’ actions in our region but also plays a ‘compelling, even transformative’ role in the policy preferences of decision-makers. The attack taking place at a time when claims have surfaced about the United States preparing to withdraw its troops from Iraq and Syria seems to parallel the recent rising trend of Daesh activism. The origins of the attackers (Russian and Tajik citizens), the possibility that the primary target was the Polish Consul General Witold Lesniak present among the targeted congregation, and the selection of a ‘church’ as a target in Türkiye harbors various signs. There is a high likelihood that the attackers are affiliated with the Daesh Khorasan Province, one of the terrorist group’s extensions highlighted in international public opinion, particularly given their recent association with the group.
The action, targeting symbolic objectives (a church and a consul), with a narrow cell structure, aims to damage Türkiye’s image in the anti-Daesh struggle in the eyes of the international public. Furthermore, the attackers traveling to the region in a car with Polish plates and attempting an action targeting the Polish Consul General gains significance when interpreted through Poland’s recent experience in counterterrorism. Last July, a person sympathizing with Daesh, allegedly preparing to attack public buildings, was identified and apprehended by the Polish authorities. Additionally, considering Poland’s deportation of a Tajik citizen suspected of having Daesh connections, who illegally entered the country from Belarus last year, it can be said that this action targeted both Türkiye and Poland’s counterterrorism efforts in different ways.
- On May 10, 2023, Türkiye disclosed the arrest of Şahap Varis, the alleged leader of Daesh’s self-proclaimed Türkiye Province. It was asserted that, in contrast to the organization’s activities between 2014 and 2017, it persisted in clandestine operations. Does the recent attack signify a deviation within this established pattern, or is it indicative of an evolving, new paradigm?
Following the loss of territorial control in Iraq and Syria, the organization experienced significant setbacks in its revenue streams and leadership. This resulted in diminishing influence from the central command over the organization’s extensions over time. Consequently, actions have come to rely more on the autonomous will of these extensions rather than decisions made centrally. Moreover, intelligence structures have penetrated the organization’s extensions more intensely than before.
Due to targeted operations against the organization’s Turkish structure over the years, mainly involving Turkish citizens, both the leadership and cells of the organization have suffered significant blows, severely weakening their operational capabilities. Given the profiles of the perpetrators in the recent attack, there is a strong likelihood that they do not have a hierarchical connection with the so-called Türkiye Province of the organization. Therefore, when evaluating the attack, it is more probable that it should be investigated in connection with other Daesh extensions, especially the Khorasan Province, rather than being considered an action by the so-called Türkiye Province of the organization.
Çağatay Cebe
Researcher, Jihadist Organizations
- The disruption of a group planning IS-K-linked attacks on churches and synagogues in Türkiye at the end of December, the revelation of the Santa Maria Church assailants’ origins from Tajikistan and Russia, and the identification of a Tajik assailant in the January attack in Kerman, Iran, prompts contemplation on the involvement of Daesh’s Khorasan branch (IS-K). Could this assault be indicative of a broader regional strategy?
The Khorasan branch of Daesh currently constitutes the organization’s most powerful group. At the height of Daesh’s influence, the city of al-Bab in Syria served as its external operations hub. However, with Türkiye’s capture of al-Bab in February 2017 and the subsequent turmoil within the organization, Daesh transitioned to survival mode in the regions where it operated. Attempts to expand into Africa were unsuccessful, and during this time, it took advantage of the weak security situation in Afghanistan to regain strength.
The power vacuum created during the transition from the American-backed Republic to the Emirate established by the Taliban provided an opportunity for significant strengthening of Daesh Khorasan. The group engaged in serious acts, including assassination attempts on Russian and Pakistani ambassadors. The Taliban became a major target for the Khorasan group during this period. However, through the efforts of intelligence agencies and special operations forces, the strong presence of Daesh Khorasan within Afghanistan was significantly reduced, as highlighted in the U.N. Security Council report dated Jan. 29, 2024.
Meanwhile, recent reports U.N. reports have identified the Khorasan branch as the largest regional threat. The U.N. Security Council report on Daesh and Al-Qaida dated July 24, 2023, highlighted the ambitious nature of the leader of the branch in Afghanistan, identified as Sanaullah Jafari, also known as Shehab al-Muhajir.
Another report dated May 23, 2023, stated that Jafari had entirely transformed the organization, made more strategic decisions, and selectively recruited university students and graduates. The selection of Tajiks in Afghanistan is attributed to several factors, including the absence of distinct physical characteristics for this ethnic identity, a lack of association with armed actions, and the general composition of anti-Taliban political and armed groups being predominantly composed of Tajiks.
Notably, individuals with Daesh Khorasan connections, including Tajiks, have been apprehended by security forces, not only in Türkiye but also in various European countries before carrying out attacks. In summary, Daesh Khorasan prefers Tajiks for various reasons, allowing them to operate more freely in carrying out actions outside the organization’s regions in Asia and the Middle East.
- Considering Daesh’s relatively low attack frequency since 2017, what motivated the renewed targeting of Türkiye? Is there a correlation between this and the January 4 call by Daesh spokesperson Abu Hudhayfah al-Ansari to “unleash attacks against Jews and Christians worldwide, without distinguishing between civilian and military apostates”?
Over the past seven years, Daesh has consistently attempted to target Türkiye, aiming at both Turkish elements in Syria and critical points within Türkiye. However, these attempts have been thwarted before any actions could materialize, thanks to the regular raids conducted by the relevant units of the National Intelligence Organization (MİT), the counterterrorism and intelligence directorates of the Police, and the Gendarmerie Command against Daesh cells. The speech by Abu Hudhayfah al-Ansari was a call made to mobilize the organization, especially given the general state of mobilization within the Daesh environment.
In the 413th issue of Daesh’s weekly newspaper, al-Naba, dated Oct. 19, 2023, a clear global call for action was made. However, this call did not result in operational consequences. The significance of Abu Hudhayfah’s speech lies in the fact that Daesh spokespersons are among the few individuals who are constantly present beside the organization’s leader. Notably, in the beginning, he delivers the greetings of the current leader Abu Hafs, which was warmly received by pro-Daesh circles. The first part of Abu Hudhayfah’s speech is entirely composed of a global call for action. Particularly, the statement ‘Our struggle will continue until we defeat the Antichrist under the banner of Prophet Jesus’ is an encouraging sentence for all followers. The entire rhetoric is built upon the idea of a global religious war.
Following this speech on Jan. 4, Daesh immediately launched a weeklong attack campaign titled ‘Kill them wherever you find them,’ publishing attack messages from almost all regions where the organization is present – from the Philippines to Mali. These attacks were essentially intended to inspire and trigger other global attacks, making them part of a broader campaign.
Dr. Ahmet Yusuf Özdemir
Political Science and International Relations, Ibn Haldun University
- The disruption of a group planning Daesh-K-linked attacks on churches and synagogues in Türkiye at the end of December, the revelation of the Santa Maria Church assailants’ origins from Tajikistan and Russia, and the identification of a Tajik assailant in the January attack in Kerman, Iran, prompts contemplation on the involvement of Daesh’s Khorasan branch (Daesh-K). Could this assault be indicative of a broader regional strategy?
Understanding what Daesh’s plans entail is a key question for researchers in this field, and providing a brief background will make it more explanatory. Especially with the loss of control in areas in Syria and Iraq, it is crucial to emphasize the internal struggles, ruptures, and questions that have occurred within the organization. Additionally, in the Afghanistan region where Daesh-K is strong, the Taliban’s assumption of power after the U.S. withdrawal poses a significant threat to Daesh. It is important to recall that Daesh, compared to its contemporaries like al-Qaida or the Taliban, claimed to be a unique structure that unites both local and global elements. However, the group, which rose rapidly, also experienced territorial losses at a similar pace. As of 2024, its specific competition with Daesh-K and the broader engagement with structures declaring allegiance to Daesh in Africa or Asia reveal the tactics they employ.
Being adjacent to Afghanistan and despite Tajikistan being within the sphere of influence of the other two mentioned organizations, especially the Taliban, the involvement of individuals from this country by Daesh-K in its ranks and the ability to carry out actions through them primarily convey a regional message. It is too early to interpret this as a global resurgence, as we currently lack sufficient data. Instead, it should be understood more as a message to local, regional, and global supporters, as well as adversaries, saying, ‘I am here.’
- Considering Daesh’s relatively low attack frequency since 2017, what motivated the renewed targeting of Türkiye? Is there a correlation between this and the January 4 call by Daesh spokesperson Abu Hudhayfah al-Ansari to “unleash attacks against Jews and Christians worldwide, without distinguishing between civilian and military apostates?
It is accepted as a fact that Türkiye actively participates in the Global Coalition to Counter Daesh. However, regionally, it is evident that the Republic of Türkiye is among the targets of the organization, as seen in Daesh attacks within the country. The security forces have prevented many attacks and the prevention of the entry of those attempting to use Türkiye as a transit point to join Daesh, following international intelligence sharing, has inflicted lasting damage on the organization. The global recruitment efforts that Daesh bases its legitimacy on have been thwarted.
The reverberation of the Jan. 4 statement in Türkiye provides us with many clues. The call for this attack, especially coming after the genocide in Palestine, is not surprising. Every group attempts to consolidate its supporters during such globally resonating situations. However, considering Daesh’s attempts to establish order in Syria and Iraq and the subsequent experiences, maintaining its credibility and the capacity to mobilize its ‘troops’ is not as easy as before. Certainly, the importance of counterintelligence, as mentioned earlier, is significant. Yet, unlike groups that align with opposing forces in other war scenarios, Daesh’s supremacist ideology hinders its ability to act in practical and everyday decision-making situations, such as in the case of Palestine.
Kutluhan Görücü
Researcher, Foreign Policy and Security, SETA
- In light of the recent attack on Santa Maria Church in Istanbul’s Sarıyer, how can the incident be decoded regarding its timing, modus operandi, target selection, and the profile of the assailants?
If the echoes of today’s attack were limited, one of the assailant’s malfunctioning weapon likely prevented a much larger catastrophe. Even though the incident may have created a limited agenda, I believe certain details within the attack’s codes do not discredit ‘conspiracy theories.’ Let me elaborate:
As you are aware, Daesh claimed responsibility for the attack, and according to media reports one of the attackers was Russian, and the other was Tajik. If you recall the Jan. 3, Daesh also claimed an attack in Kerman, Iran. The target people were visiting Maj. Gen. Qassem Soleimani’s grave. Iranian intelligence revealed that the attackers were Tajik.
At this point, I hold the opinion that individuals within or directly overseeing Tajik cells within Daesh might have international engagements. After Türkiye neutralized the so-called Daesh leader last year, instead of retaliating with a ‘revenge’ attack, Daesh targeted an Italian church in Türkiye. While the founders of the church were Italian, its present-day priests are from Romania. But, it is worth noting that perhaps these attacks were thwarted and this was just the first one we witnessed. Nevertheless, the question of priority remains.
Especially after Italy’s government officials, at the Prime Minister and Foreign Minister levels, expressed support for a two-state solution for Palestine, an attack on a place known as the ‘Italian’ church raises further questions. As evident from the images, the attackers embarked on such an assault without adequate preparation, such as weapons training or testing, which further adds to the existing uncertainties.
