MS Risk Blog

Cyber-attack against SingHealth’s IT System

In July 2018, Singaporean healthcare system SingHealth was the victim of a cyber-attack. Approximately 1.5 million patients’ medical data was stolen, among them the medical record of the Singaporean Prime Minister Lee Hsien Loong. The Cyber Security Agency of Singapore (CSA) experts recognised unusual activity on one of SingHealth’s IT databases on 4 July, but by that time, the attackers had stolen online credentials and covered their tracks. A police investigation confirmed that data was stolen between June 27 and July 4.

Authorities suspect the attack was state-sponsored, particularly considering the high profile of the key target. The investigation showed that there were several attempts to obtain the Prime Minister’s data. Such data can be used by belligerent countries or local terrorist organisations to plan covert operations against politicians and decision makers. The CSA chief executive said at a news conference it is better not to speculate what the attacker had in mind. Further, the Communication and Information Minister did not name any state in the interest of national security.

Sophisticated attack

The attack on SingHealth shows a great deal of sophistication; according to the CSA, the attackers planned ahead and set up several entry points to the system to avoid detection. They were not preparing for a hit-and-run attack; rather, they built their persistence on the target network. It is also one of those rare cases when the final target of the attack is known, as evidenced by the attempts to breach the system and access the Prime Minister’s data. The other 1.5 million accounts gathered by the attackers are likely a “bonus”, however, this kind of data is highly sought by criminal organisations. Medical data contains not only information related to an individual’s health, but also contains easily identifiable personal and financial details. Until now, the medical data has not surfaced in the public domain and there is no information proving the authorities have tried to contact the attackers.

In most cases of cyber-attack, the final target is unknown. Even if it is unearthed, targets are unlikely to admit that their applied defences were not strong enough to protect their data, or that of their clients. According to SingHealth, they had taken steps to thwart the hackers, including closing entry points to their network and asking their employees to change their passwords. The latter is critical, as these passwords were used to penetrate the system and obtain the medical data.

Cyber attacks and mitigation

The attack on SingHealth is just one example of the dozens of different cyber-attacks, which can target not only people using the internet, but redirecting the online communication of any service, or the changing of commands of any program. All of these activities can have as devastating effects, such as stealing online credentials and using them to penetrate a system for financial gains. Cyber-attacks are among the most significant modern threats. According to Sonicwall’s 2018 Cyber Threat Report, there were 9.3 billion malware attacks registered in 2017, which is a nearly 20% increase compared to the number of attacks in 2016. These attacks are targeting not only individuals, but critical infrastructures, state organisations and businesses as well. Most people are familiar with malicious e-mails that include odd-looking attachments or have heard stories of stolen online credentials.

Unfortunately, there is no 100% perfect protection against cyber-attacks, but there are some best practices everyone advised to follow to minimise the chances of becoming a victim of a cyber-attack. One of the most important defences is our choice of passwords. Sometimes, choosing a simple password that is easy to remember can also be easy to break. Further, using only one password for all the online accounts would make one’s online presence extremely vulnerable to an attack. Once the password is obtained, access is granted to one’s social media accounts, online shopping accounts and so on. As most of the attacks targeting individuals arrive via e-mail, it is important to avoid opening e-mails with unknown origin. Security experts highly recommend building this awareness into our daily online routine. The human component in cyber security is perhaps the most critical, as ill-informed users are often the gateway for cyber-attackers to obtain personal data.

Ebola outbreak highlights security challenges for MONUSCO in DRC

The challenges and limitations faced by the United Nations Organization Stabilization Mission in the Democratic Republic of the Congo (MONUSCO) have been highlighted during recent efforts to respond to the latest Ebola outbreak in the Democratic Republic of the Congo (DRC).

Aid workers are unable to enter some areas outside of Mangina, a community located approximately 30km of the town of Beni, one of the epicentres of the outbreak. These areas are considered “red-zones”, corresponding to level four on the scale employed by the United Nations Department of Safety and Security (UNDSS). This means that health-care personnel cannot enter in order to monitor the spread, or offer treatment to anyone who has contracted the deadly disease.

Despite the presence of MONUSCO forces, North Kivu remains host to what from the outside may appear to be a bewildering array of rebel groups and militias. These groups, according to their own statements and declarations, have varied ideologies and causes that they allegedly seek to represent. These ideologies fall across a wide range. On one end are the ethno-nationalists claiming to represent ethnic/tribal interests. On the other end are Islamists such as the Allied Democratic Forces trying to create an Islamic state. The latter have been accused of ties to al-Qaeda and its affiliate al-Shabaab, but these allegations remain unverified.

Still other groups appear to serve as little more than vehicles for the ambitions of their leaders, or an excuse to engage in banditry under the cover of representing tribal or local interests. The names used (or given by outside observers) for these groups also vary from the grandiose which results in impressive acronyms such as ADF, APCLS, FDC, FLDR-FOCA, FLDR-CNRD, NDC-R to the more informal for local militias (mai mai) such as ‘Simba, ‘Charles’ and ‘Mazembe’. These groups are frequently accused of murder, rape, abduction and other abuses against civilian populations. They have been known to fund their activities by occupying mining sites and operating roadblocks across the province.

Side note: in October 2017, a two-minute-long video was shared by several pro-Islamic State channels showing a small group of fighters who claimed to be in the DRC. They called themselves “The City of Monotheism and Monotheists.” No further information regarding this group or its activities has emerged since the release of this video despite initial interest from both the media and online community of Islamic State supporters.

These groups are unlike the rebels of the March 23 Movement (aka M23) who were defeated in 2014 by the Congolese Army (FARDC), with the independent support of the United Nations Force Intervention Brigade (FIB). Rather, these rebel forces offer a much smaller and elusive target. This is despite often operating from known bases and fielding forces that number from hundreds up to several thousand fighters.

These smaller groups do not engage in the type of large-scale military offensives or attempts to seize major cities like Goma attempted by M23. Instead, these groups launch hit-and-run attacks and then retreat into the bush or disperse and blend into civilian populations. They do not engage in prolonged head-on battles over towns and territory. The effectiveness of these tactics was demonstrated in the evening of 07 December 2017, when 14 MONUSCO peacekeepers were killed and 53 were wounded in an attack  on their base at Semuliki located in Beni Territory, North Kivu. The attackers were fighters belonging to the Allied Democratic Forces (ADF) rebel group. A further five FARDC soldiers were also killed in the attack.

Restructuring the United Nations Force Intervention Brigade

Despite having some 15,533 troops, United Nations peace-keepers have struggled to defeat these rebel forces and militias as its forces are dispersed across North Kivu and across other regions in the eastern DRC. The FIB, was critical to the defeat of the M23 rebellion and the later targeting that same year of bases belonging to rebels of the ADF. However, they have proven less successful than hoped in more recent efforts to target other rebel groups and militias. This recent lack of progress prompted a July 2018 report by the United Nations which recommended a reconfiguration of the force to make it “more flexible, agile and able to conduct both offensive and protection of civilians operations across North Kivu”. This reconfiguration, expected to be completed by 30 September, includes replacing an infantry battalion with a Special Forces company, strengthening the intelligence unit and introducing a new utility/attack helicopter unit.

This plan is currently opposed by the Government of South Africa, which fears a reduction in the size of the FIB may result in its forces (as well as those of other troop contributing countries, like Malawi and Tanzania) suffering greater casualties. Nevertheless, it remains unclear how a more ‘flexible and agile’ FIB will help MONSUCO achieve greater success. Even at its current size, this force has proven inadequate to provide security across this vast territory, while the FARDC and other government forces deployed in the region remain unreliable partners. A worsening of the latest round of Hema-Lendu fighting in Ituri Province, which has already seen mass killings and the displacement of more than 350,000 persons, or eruption of other conflicts, would only place a further strain on UN peacekeeping resources.

Due to the current scale of the challenge faced by MONSUCO, it is unlikely that this reconfiguration of the FIB will be enough to meet the threat posed by the rebel and militia forces currently terrorising the eastern regions of the DRC. Even with greater mobility and a larger contingent of Special Forces, the FIB will still be left in a position akin to ‘swatting at flies’. The sheer number and highly mobile nature of potential targets threatens to overstretch these resources.

There is no question that the FIB under its current force structure, even with the infantry battalion which is to be replaced, has already suffered from this problem. That healthcare workers have not been able to access areas near Beni, where the UN also has a Nepalese infantry battalion and am Formed Police Unit (Indian), has only served to draw attention to this fact. The notion that a force restructure is seen as necessary is understandable.

It will now be the responsibility of all governments that provide troops and support to the MONSUCO mission to ensure that the future performance of the FIB be closely monitored and that any shortfalls or lessons learned receive a quick and full response. A failure to do so may lead to a further deterioration in the security situation in the eastern regions of the DRC and further inhibit the ability of the UN and other actors to respond to the current Ebola outbreak.

Turkey’s Economic Crisis and its Dispute with the US

It all begun last month when tensions between the US and Turkey due to a disagreement over the fate of North Carolina Pastor Andrew Brunson. Turkey imprisoned Brunson in October 2016, claiming he had ties to a group that Erdogan blames for the failed coup earlier that year. When Turkey failed to release Brunson in July, the Trump administration sanctioned two top officials in the Turkish government. The dispute between the two NATO allies continued with both sides threatening each other with imposing sanctions on one another. Turkey vowed it would not succumb to threats. This indeed led to further escalations earlier last week as the US doubled its tariffs on metal imports from Turkey. This worsened the economic crisis for Turkey’s currency, the lira, which has lost about a third of its value against the dollar since January. Nonetheless, the court refused to release Mr Brunson, and the government in Ankara increased tariffs on imports from the US of cars, alcoholic drinks and leaf tobacco. While this managed to recover the value of the lira slightly, a fresh tweet from President Trump fuelled the dispute as he accused Turkey of had “taking advantage of the United States for many years” and that he was “cutting back on Turkey”. Last Thursday, US Treasury Secretary Steven Mnuchin said: “We have more that we are planning to do if they don’t release him [Mr Brunson] quickly.”

Mr Brunson has denied charges of espionage, but faces up to 35 years in jail if found guilty. The US insists the pastor, a long-time Turkish resident, is “a victim of unfair and unjust detention”. President Recep Tayyip Erdogan accused Washington of showing an “evangelist, Zionist mentality”. The standoff appears to be one of the most serious crises between Turkey and the United States in modern history, along with the rows over the 1974 Turkish invasion of Cyprus and the 2003 US-led invasion of Iraq. While the diplomatic crisis deepens, the lira is still going into meltdown and continues to fall again this week. This turmoil has prompted widespread selling in other emerging markets, sparking fears of a global crisis. Nevertheless, Turkish President Recep Tayyip Erdogan vowed his country will not be brought to heel amid an ongoing diplomatic crisis with the United States. Without naming the US directly, the Turkish leader on Monday said that there was no difference between attacks on the country’s economy and attacks on “our call to prayer and our flag”. In his speech, Erdogan denounced Washington for declaring “economic war on the entire world” and holding countries “for ransom through sanction threats”. However, he urged Turks to shore up the currency by not trading in dollars and euros. The central bank also said it would provide all the liquidity Turkish banks needed, as it seeks to keep money flowing in the financial system.

Yesterday morning, the US Washington rejected an attempt by President Erdogan to solve the worsening crisis in Turkey’s relations with the United States by linking the fate of an American pastor to a Turkish bank accused of sanctions-busting. More specifically, Ankara offered to release Andrew Brunson, an evangelical preacher who was detained by the Turkish authorities and accused of links to the 2016 coup attempt, in return for relief for Halkbank, a majority state-owned bank, according to reports from Washington. The bank is facing billions of dollars in US fines over accusations that it masterminded the purchase of gold to pay for oil imports from Iran into Turkey. However, the US officials have rejected a deal, saying that Mr Brunson must be released before other issues can be discussed.

As the diplomatic deterioration continues, and the economic crisis deepens, speculation is rife that Germany could be ready to offer Turkey financial aid when President Recep Erdogan visits the country next month, but analysts say it’s unlikely that Ankara would ask for help. Moscow is also expected to stand by Turkey if the crisis continues. Russia’s Foreign Minister Sergei Lavrov, visited Ankara on Tuesday, branding the US sanctions an illegitimate policy. Reports amid all speculations, state as the financial situation due to the sanctions has left citizens with little or no option than to advance towards the cryptocurrency to survive.

Whilst the entire world watches the two NATO allies continuously failing to end this dispute, an announcement by Russia could spark greater renewed tensions and even sanctions as analysts fear. Yesterday, Russia’s state arms exporter, Rosoboronexport, says it will begin delivering its advanced S-400 antiaircraft missile systems to Turkey in 2019. Washington has voiced concern over NATO-member Turkey’s purchase of Russian-made S-400 missiles, arguing that its deployment could risk the security of several U.S-made weapons that Ankara uses. U.S. lawmakers have been working to block the delivery in response to the American pastor’s arrest and Turkey’s pledge to buy Russian S-400 missile systems.

Islamic State on its West Africa Province

Videos featuring the Islamic State’s ‘West Africa Province’ (ISWAP) are released infrequently making each one a notable occurrence. What was particularly noteworthy about the video released on 11 July 2018, titled “Tribulations and Blessings”, was the fact it represented the first official confirmation by the group of armed conflict with the break-away faction Jamaa’at Ahl as-Sunnah lid-Da’wah wa’l-Jihad (JASDJ) led by former leader Abubakar Shekau. Of additional interest was the fact that the video also featured the first evidence of the group using an up-armoured suicide car bomb (SVBIED). Nevertheless, despite being interesting revelations the release of this video was quickly overshadowed by news of a series of deadly attacks by jihadist insurgents targeting military convoys and bases in Nigeria’s Borno and Yobe states.

Perhaps the video was overlooked because neither revelation adds materially to what is known about the group. The rivalry between ISWAP and JASDJ has been well documented since their split in August 2016 after the Islamic State moved to remove Abubakar Shekau as leader for his use of violence, including suicide-bombings and kidnapping, against Muslim civilians. After Shekau refused to accept this decision reports soon began to emerge of clashes between the factions. While hundreds of fighters are believed to have been killed during this in-fighting the situation did not erupt into open warfare as both forces concentrated on consolidating their forces in differgent regions of Nigeria. For ISWAP this was around Lake Chad and the region along the Nigeria-Niger border while for JASDJ this was the centred on the Sambisa forest from which then extended its influence across the central and southern regions of Borno State as well as across the border into Cameroon. Likewise, the up-armoured SVBIED demonstrates either the transfer of technical expertise from Syria and Iraq – which would not be a surprise – or else it indicates an ability to adopt and adapt tactics that are well documented in Islamic State propaganda.

But to allow this video to be shelved alongside all the other propaganda churned out by the Islamic State’s media department is to miss its actual message and purpose. That is, to lay out a justification for the beginning of open warfare, a type of jus ad bellum, against Abubakar Shekau and his faction should there be no reconciliation between them. This is evident in the general order and content of each major ‘theme’ addressed in the video namely: governance, military operations, remaining and expanding; and martyrdom.

The first major theme of the video is governance. This is depicted through scenes of crops, market activity, the catching and smoking of fish as well as the testimonies of a farmer and herdsman regarding life under the rule of ISWAP . Each of these represent the primary economic activities engaged in by communities in areas under the influence or control of the group. This demonstrates ISWAP efforts to develop an effective system of administration in areas under its influence and control. It also underscores the ongoing attempts to differentiate itself from its JASDJ rival, which maintains a reputation for extreme violence in its search for food and other supplies.

The second major theme concerns military operations and can be seen in footage of attacks targeting forces belonging to the Nigerian military and the Multinational Joint Task Force (MNJTF). The use of an up-armoured jeep as an SVBIED is indicative of the group learning from and adopting tactics employed in Syria and Iraq. However, it is the use of suicide-bombers against military targets that serves as a contrast to JASDJ, which uses them to target civilians; often Muslims themselves. This serves to emphasize the point that ISWAP is targeting the ‘correct’ enemy and in doing so has enjoyed success on the battlefield.

The third theme regards ‘remaining and expanding’ (baqiya wa-tatamaddad). This is seen in the decision to emphasize attacks on the Nigerian military encampment in Buni Yadi (Yobe State) and Faruk – located south of Goniri and east of Buni Yadi in Yobe State. This demonstrates the continued expansion by ISWAP into the region south of the cities of Damaturu and Maiduguri. As recently as April, the presence of ISWAP in this area was believed to be weak or else absent. In contrast, the strength of JASDJ in adjoining region which lies south of Maiduguri and runs eastwards from Chibok towards Buni Yadi was assessed as moderate to strong. This will lead to a further reduction in the geographical separation between the operational areas of both factions and is likely to result in an increase in violence between them.

But it is in the fourth and final theme, martyrdom, that the Islamic State offers the clearest indication that it has run out of patience with Abubakar Shekau, and may be prepared to declare open war on him and his faction. This can be found in the eulogy for the ISWAP commander Abu Fatima al-Lagosi, who was reportedly killed in a battle with JASDJ . As part of a description of the exploits of this jihadi the narrator, speaking in Hausa, states: ‘He made the khawaarij of Shekau and the apostates of Africa drink from a bitter cup’. This comparison between JASDJ and the historic Kharijite movement may have some legitimacy due to the extreme position both have adopted on the matter of ‘excommunication’ (takfir) as it applies to fellow Muslims. However, by making this association the Islamic State is not only attempting to undermine the religious legitimacy of Abubakar Shekau and his supporters, but also establish a legitimate basis for attacking them should they not ‘repent’ and seek a reconciliation (tawba).

Observers of the jihadist insurgency in Nigeria may disagree on the meaning behind this video, and it is possible some will view it as a typical example of the propaganda churned out by the Islamic State’s media team. However, this video was released only weeks after the publication online of the book “Taking Out the Tumor of Shekau’s Khawarij Through Pledging Alliance to the People of Benevolence”. This book (which has fortunately received been translated for those interested) was allegedly written by the sons of Muhammed Yusuf, the founder of the Boko Haram movement, and presents a version of the two factions shared history and seeks to undermine reputation of Shekau leader as well as the religious legitimacy of his ideology, strategy and tactics.

Taken together it would appear that the Islamic State has finally grown tired of the game Abubakar Shekau has attempted to play by not revoking his oath of allegiance but still defying the orders of its central leadership.  This raises a number of important questions: In an open conflict would ISWAP or JASDJ be more likely to prevail? What impact could an increase in inter-jihadi violence have on other conflicts eg herdsmen v farmers? Could an expanded conflict force one or both factions to try and expand into new regions? Are the Nigerian and other regional military forces capable of successfully exploiting any opportunities presented by inter-jihadi conflict?  Could an expanded conflict actually encourage or force a reconciliation between the factions?  … These are questions that will not only present a challenge for both local and foreign policy-makers as well as military planners but also intergovernmental organizations, government aid agencies, multi-national companies and non-government organizations that are active in Nigeria, neighbouring countries and the wider region. It will remain important for each of these actors to continue to monitor the state of the ‘Boko Haram’ insurgency, as the campaigns of both factions continue to be populalry refered to as, in order to ensure their activities, operations and interests are not threatened or negatively impacted.

Ability of Islamic State to Exploit Conflict in Northern Somalia – Less Certain than First Feared?

Concern continues to be raised about the potential ability of jihadist actors to exploit the on-going stand-off between Somaliland and Puntland over the town of Tukaraq. The town which is at the centre of this crisis is located in the Sool region was (re)captured by forces belonging to the self-declared region of Somaliland in January 2018. Highlighting the importance with which regional and international actors view the situation – not only in regards to this threat but the wider impact that a worsening conflict may have on these two regions and their inhabitants – was the recent 28-30 July visit to Garowe and Hargeisa by the United Nations Special Representative for Somalia, Mr. Michael Keating, and the the Intergovernmental Authority on Development’s Special Envoy for Somalia Dr. Mohamed Ali Guyo. The town itself has has been a frequent flashpoint in a two-decades long dispute between Puntland and Somaliland over the regions of Sool, Sanaag and Cayn. Puntland has also sought to assert its own right to govern them based on the clan affiliation of local inhabitants; this being primarily Dhulbahante and Warsangali who are part of the Darod/Harti clan family to which the dominant clan in Puntland, the Majerten, also belongs This latest episode in the long-standing conflict between Puntland and Somaliland over these regions has brought them both to the brink of open war and caused thousands of civilians to be displaced.

Rise of terror groups in the region

It is in the context of this already complex and volatile environment that concerns have been raised by observers such as the International Crisis Group that the local affiliate of the Islamic State in Puntland- known variously as Abnaa al-Khalifa (sons of the caliphate), Islamic State in Somalia and Wilayat as-Somaal (meaning the Somali Province of the Islamic State) – could exploit the crisis to strengthen and expand its own presence in northern Somalia.

Such concern is not without cause

The Bari region of Puntland, which lies on the north-eastern corner of Somalia on the tip of the Horn of Africa, has remained a poorly governed space. Local authorities and their security forces have been able to maintain only a weak presence in this region allowing a mixture of jihadist insurgent groups, including both al-Shabaab and the Islamic State, along with clan militias and criminal networks with considerable freedom to operate. Puntland has had limited success in containing this threat and there are genuine reasons to be concerned that a worsening of the crisis, especially if it became open war, could lead to further strain on its already overstretched military resources. This could not only lead to a lessening of military pressure  but also result in a worsening of existing inter and intra-clan rivalries and conflicts all of which may create openings that the Islamic State could be expect to exploit. However, even in the ever of such developments the local operational context in Puntland may not on fact be as permissive as may be first feared.

Can Islamic State thrive in Northern Somalia?

This is not to say that the group is not well positioned to try and take advantage of a worsening of the current crisis. Although still relatively small the group under the leadership of its leader Abdul Qadir Mu’min has already displayed a remarkable level of resilience. It has grown in size from several dozen men when it first defected from al-Shabaab in 2015 in response to the announcement by the Islamic State that it had re-established the Caliphate and now has an estimated 200-300 fighters. Since first emerging as a separate jihadist faction the Islamic State in Puntland has also managed to successfully maintained good relations with local clans in the Bari region despite military and diplomatic pressure from both al-Shabaab and the Puntland administration. Nevertheless, there are three key factors that could limit – perhaps even threaten – the ability of the Islamic State to exploit an eroding security situation and expand beyond its existing area of operations in the Golis and Bari mountains.

Shifting clan loyalties could mitigate support for IS

The first of these factors is the continued reliance of the Islamic State group on the hospitality (perhaps better described as tolerance) given to it by the Majerteen/Ali Saleeban and other minority clans. This hospitality has been offered to the group because of kinship ties and the belief that its activities serve local interests. Other groups, such as al-Shabaab, Abdisamad Mohamed Gallan (former governor of Bari in an ongoing state of semi-rebellion), and the Qandala-Hafun network of pirates and smugglers also rely on these local clans for support. Support is given to these groups, including the Islamic State, because local clans are engaged in their own long-standing dispute with the Puntland administration over issues of political and economic marginalization. The Islamic State affiliate in Puntland is seen as one of several useful proxies and a potential future bargaining chip by local clans in their conflict with Garowe. In the context of Somali clan politics, it would not be unheard of to see the loyalty shown Puntland’s IS leader Abdul Qadir Mu’min (a member of the Ali Saleeban clan) superseded by other loyalties and interests.

For this reason any success by the Islamic State in strengthening and expanding its presence in the Bari region could be seen by local clans as upsetting the current balance of power between jihadists, clan militias, and criminal networks operating in the region. This could provoke resistance from these same clan actors if it is felt that their own interests and influence are threatened by this development. Such a desire to maintain a balance between the various forces operating in their territory may have been the reason behind the seemingly reckless and ultimately disastrous attempt by al-Shabaab in May 2016 to send hundreds of fighters from south-central Somalia by boat to the region. If local clans welcomed, or at least were willing to tolerate, the establishment of the Islamic State as another anti-government actor then the leadership of al-Shabaab may have felt that its hand was forced to act. This would explain why al-Shabaab attempted reinforce its local branch in Puntland with hundreds of fighters despite already possessing an overwhelming advantage in numbers and firepower over its jihadist rival. It may have been feared by al-Shabaab that it would not be ‘allowed’ to destroy Abdul Qadir Mu’min and his (then) small band of fighters and that it would also need to guard itself against any potential backlash from local clans; not only for being seen to act against their political interests but for killing their relatives who are members of the group.

IS could no longer be viewed as supporting local interests

A second factor that may threaten the ability of the Islamic State to exploit a worsening of the conflict between Puntland and Somaliland concerns the potential of the group to try and organize and influx of foreign fighters. This been a long-standing concern since the emergence of the Islamic State as a separate jihadist faction in Puntland and has been raised by various observers including the United Nations Monitoring Group on Somalia and Eritrea. Such a development would further reduce the groups reliance on the Ali Saleeban and other local clans for recruits; representing an acceleration of a process already underway as it draws fighters from across a broader range of clans and sub-clans. But this would not be without its own risks.

The greater the reliance on non-local leaders and fighters, the less the Islamic State will be seen as a representing local interests. This may already be a growing problem as the group has drawn increasing numbers of fighters from other clans and sub-clans from across Somalia. There is a risk that this could place the group in a situation similar to that experienced by al-Qaeda when it first attempted to establish and embed itself in Somalia during the early 1990’s. Even if Islamic State were to be successful in adding dozens if not hundreds of new fighters to its ranks such an influx of foreign fighters could actually undermine its position as it faces an increasingly lukewarm or even hostile reaction from local clans because of being seen as ‘foreign’. Not only would this present al-Shabaab with an opportunity that present itself as a defender of local interests but also undermine what protection (or tolerance) the Islamic State has enjoyed because of the ties of kinship enjoyed by Abdul Qadir Mu’min and other members of the group.

Other groups seeking growth amid the security vacuum

A third factor that needs to be considered is that the Islamic State is not the only group that would be well positioned to take advantage of a worsening of the security situation in the Bari region. Any vacuum emerging in the wake of the redeployment, retreat or defeat of  Puntland’s military and security forces in the region would also offer similar opportunities to these other actors. This would not only include Abdisamad Gallan and his militia but also smugglers and arms dealers like the members of the Qandala-Hafun network.These other actor s, unlike al-Shabaab, may choose to ally themselves (if only temporarily) with Puntland authorities in order to protect their own interests. But perhaps of greater concern would be the problem of al-Shabaab almost certainly devoting significant political and military efforts to contain (and if possible, destroy) its Islamic State rival while taking advantage of its own opportunities to expand its presence across the region.

It is also important to note that even in an environment in which Puntland’s military and security forces have been significantly weakened, this would not necessarily present equal opportunities to each group. Some (including the Islamic State) may face advantages or indeed disadvantages due to the current location of their forces, relations with local clans, financial resources and access to arms. These would also be important factors that may limit the ability of the Islamic State to exploit any worsening of the current crisis.

As such, although there is no question that a conflict between Puntland and Somaliland ‘could’ be exploited by the Islamic State, the actual ability of the group to do so may in fact be more limited than observers and analysts have feared. The local factors that may advantage or disadvantage a group such as the Islamic State in the Somali context are highly complex, and may shift quickly in response to local, regional and sometimes even external developments. This may present challenges to external observers but it is important that they are understood and included in any assessment of the Islamic State and current efforts to establish a sustained presence not only in Puntland but across other regions of Somalia as well.