OPINION — The global terrorism landscape in 2026 — the 25^th anniversary year of the 9/11 terrorism attacks — is more uncertain, hybridized, and combustible than at any point since 9/11. Framing a sound U.S. counterterrorism strategy — especially in the second year of a Trump administration — will require more than isolated strikes against ISIS in Nigeria, punitive counterterrorism operations in Syria, or a tougher rhetorical posture.

A Trump administration counterterrorism strategy will require legitimacy: the domestic, international, and legal credibility that leverages a wide-range of counterterrorism tools, while engendering international counterterrorism cooperation. Without legitimacy, even tactically successful counterterrorism operations risk becoming illusory, politicized, and ultimately self-defeating.

The terrorist threat landscape

Extremist violence no longer conforms to clean ideological lines. Terrorist objectives and drivers are muddled in ways that are hard to understand — but evolving. There’s little ideological purity with those radicalizing in today’s extremist milieu.

At the same time, state-directed intelligence officers increasingly behave like terrorists. Russian intelligence-linked sabotage plots blur the line between terrorism and hybrid warfare. Islamic Revolutionary Guard Corps officers provide hands-on training to Lebanese Hizballah commanders. Addressing these kinds of risks requires legitimacy, too, especially among allies whose intelligence cooperation, legal authorities, and public support are indispensable.

Nowhere is this threat picture more tenuous than in the Middle East. Hamas’s October 7, 2023, attacks triggered a profound rebalancing of power in the region. Yet, Syria remains unfinished business. Power vacuums there invite foreign jihadists, threaten Israel's border communities, and create future opportunities for Iranian influence to rebound.

A modest but persistent U.S. presence in Syria with a friendly Ahmed al-Sharaa-led government remains a strategic hedge against an Islamic State resurgence, and is a strong signal of U.S. commitment that helps sustain partner confidence. The U.S. counterterrorism presence and alignment with al-Sharaa is not without its risks, though: in December, three Americans were killed by a lone ISIS gunman in central Syria. The country is, and will continue to be, plagued by sectarianism and terrorism, which means that restoring control over a deeply fractured Syria remains fraught.

Taken together, the current transnational terrorism threat landscape is volatile and difficult to predict, a challenge compounded by resource constraints. In such an environment, legitimacy becomes a force multiplier. A belief that America is a ‘force for good’, credible messaging, and confidence that U.S. government action is perceived as just, can go a long way.

This is not an abstract concern. Terrorism today thrives in contested information environments, polarized societies, and fragile states. In short, transnational jihadist networks now coexist with domestic violent extremists, and online radicalization ecosystems that blur the line between terrorism, insurgency, and hybrid warfare. Terrorist propaganda continues to resonate with individuals in the West, especially younger generations who radicalize online. In this environment, legitimacy is no longer a secondary benefit of sound strategy—it is a core guiding principle.

The Trump administration's counterterrorism approach

We are looking for more clarity on the trajectory of Trump 2.0 counterterrorism efforts. It’s still, premature to consider a strategy that has yet to be formally articulated, as many in the counterterrorism community eagerly await its release. History offers a useful reminder. The first Trump administration did not publish its National Strategy for Counterterrorism until its second year. When it appeared in 2018, critics and supporters alike acknowledged that it reflected professional judgment rather than ideological excess. That document recognized terrorism’s evolution and called for strengthening counterterrorism partnerships within the U.S. government, but abroad as well, with a range of longstanding allies.

What gave that strategy durability was its legitimacy. Authorities were grounded in law, threat assessments were evidence-based, policies were stress-tested for faulty assumptions, and foreign partnerships were treated as strategic assets rather than transactional relationships.

When the Biden administration publicly released a set of redacted rules secretly issued by President Trump in 2017 for counterterrorism operations — such as “direct action” strikes and special operations raids outside conventional war zones — those guidelines explicitly acknowledged the power of legitimacy. Counterterrorism succeeds when allies trust the U.S., and the American public believes force is used proportionately and lawfully.

That legacy of trust matters now more than ever, given signals that a second Trump administration could overcorrect on its counterterrorism priorities by redirecting and focusing resources on far-left extremist groups such as the Turtle Island Liberation Front (TILF) or Antifa, while downplaying far-right extremism—or being distracted from the more dangerous terrorism threats from ISIS and other violent jihadists. As the world recently witnessed during the holidays, from Bondi Beach to Syria, ISIS remains a threat. Far-Left terrorism in the U.S. is on the rise, but far-right terrorism accounts for greater lethality than did the left. And still, after 25 years, it’s ISIS and al-Qa’ida that remain the most persistent and enduring transnational terrorism threat against U.S interests.

The Trump National Security Strategy

It’s concerning that the recently published National Security Strategy (NSS) only tepidly addresses transnational terrorism, but notably links terrorism with cross-border threats and hemispheric cooperation against things like “narco-terrorists,” blurring the traditional separation between transnational organized crime and terrorism.

Still, the Trump administration’s emphasis on drug cartels is justifiable, if it does not detract from broader counterterrorism objectives, such as the ISIS or hybridizing terrorist threats that continue to emerge. Commentators claim, however, that the Trump administration is already losing sight of the ISIS and al-Qa’ida threats, though settling that debate here is quixotic at best — only time will tell.

Besides jihadi threats, the U.S. does not need the unintended consequences and risks of triggering a cycle of cartel retaliation – or provoking greater far-left violence – down-the-line in the U.S. homeland.

Contrastingly, the 2017 National Security Strategy saw radical Islamist terrorism as one of the priority transnational threats that could undermine U.S. security and stability. The strategy highlighted groups such as ISIS and al-Qa’ida as continuing dangers, stressing that terrorists had taken control of parts of the Middle East and remained a threat globally.

The Cipher Brief brings expert-level context to national and global security stories. It’s never been more important to understand what’s happening in the world. Upgrade your access to exclusive content by becoming a subscriber.

Addressing transnational terrorism during the first Trump administration required discipline and steadiness amid predictable frictions at the National Security Council (NSC) among policymakers who wanted a more rapid shift toward other priorities, such as great power competition. Still, terrorist labeling and designations, strategic messaging, and resource allocation for counterterrorism were grounded in evidence rather than politics.

So, overhyping some threats while minimizing others undermines legitimacy, invites backlash, and weakens the very moral authority needed to operationalize a cogent, thoughtful national security strategy. It also erodes trust between the government and the public and leads citizens to second-guess whether they are being told the truth or being led astray. The 2017 NSS carried weight precisely because it was grounded in intelligence, not politics. Moreover, the NSS helped frame the counterterrorism strategy that followed and proved highly effective in keeping Americans safe.

Drawing lessons from the 2018 National Strategy for Counterterrorism

The 2018 National Strategy for Counterterrorism (NSCT) remains a useful foundation for the second Trump administration—not because the world is unchanged, but because it embraced balance. The strategy emphasized foreign partnerships, non-military tools, and targeted direct action when necessary. It recognized a central legitimacy principle: the United States cannot and should not fight every terrorist everywhere with American troops when capable counterterrorism partners can do so in their own backyards, with local consent, and a more granular understanding of the grievances that motivate these terrorist groups and their supporters.

And still, U.S. counterterrorism pressure through direct action remains a necessary tool to disrupt terrorism planning. It seems that the second Trump Administration is following the playbook of the first Trump administration in terms of aggressive counterterrorism kinetic strikes in places like Somalia, Yemen, and Iraq.

President Trump rescinded Biden-era limits on counterterrorism drone strikes, allowing the kind of flexible operational framework used for counterterrorism throughout the President’s first term. Thus far, in the aggressive counter-narcotic campaign in international waters off Venezuela, the standoff U.S. strikes resemble counterterrorism operations in Yemen and Somalia during the first Trump administration. Operationally, direct action remains an indispensable counterterrorism tool for disrupting terror groups overseas, and more U.S. direct action will likely be necessary in West Africa and the Sahel to keep jihadist groups operating there off balance, forcing them to devote more time and resources to operational security.

But pressure without legitimacy is counterproductive. What works against jihadist networks does not necessarily translate cleanly to drug cartels or transnational criminal gangs. So, policymakers must be circumspect that expanding the scope of counterterrorism authorities and terrorist designations to canvas drug cartels, risks the unintended consequences of triggering destabilizing cycles of violence in the future, and straining more traditional counterterrorism resources.

Coming full circle, in light of the U.S. capture of Nicolás Maduro for narcoterrorism-related offenses, the idea of legitimacy will be fiercely debated in the days and weeks ahead. If the Trump National Security Strategy is the roadmap for focusing on narcoterrorism in the Western Hemisphere, then the need for publishing a clarifying and rational U.S. counterterrorism strategy for the rest of the world takes on even greater sense of urgency.

Pushing a boulder uphill

Drawing on past counterterrorism lessons to find a comprehensive strategy—from the Bush administration’s wartime footing, through 8 years of Obama counterterrorism work, to President Trump’s "war on terror" — is a Sisyphean task. But, in the wake of over two decades of relentless overseas counterterrorism work, a few ideas have come into sharper focus:

After more than two decades of counterterrorism, loosening the Gordian knot of modern terrorism requires balance, far greater clarity, and consistent, predictable national leadership.

Above all, counterterrorism strategy requires legitimacy. Without it, counterterrorism becomes reactive and politicized. With it, a Trump 2.0 counterterrorism strategy can still be firm, flexible, and credible in a far more dangerous world.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief, because national security is everyone’s business.

Bill Gates had a front-row seat for the rise of AI, from his longtime work at Microsoft to early demonstrations of key breakthroughs from OpenAI that illustrated the technology’s potential. Now he’s urging the rest of us to get ready.

Likening the situation to his pre-COVID warnings about pandemic preparedness, Gates writes in his annual “Year Ahead” letter Friday morning that the world needs to act before AI’s disruptions become unmanageable. But he says that AI’s potential to transform healthcare, climate adaptation, and education remains enormous, if we can navigate the risks.

“There is no upper limit on how intelligent AIs will get or on how good robots will get, and I believe the advances will not plateau before exceeding human levels,” Gates writes.

He acknowledges that missed deadlines for artificial general intelligence, or human-level AI, can “create the impression that these things will never happen.” But he warns against reaching that conclusion, arguing that bigger breakthroughs are coming, even if the timing remains uncertain.

He says he’s still optimistic overall. “As hard as last year was, I don’t believe we will slide back into the Dark Ages,” he writes. “I believe that, within the next decade, we will not only get the world back on track but enter a new era of unprecedented progress.”

But he adds that we’ll need to be “deliberate about how this technology is developed, governed, and deployed” — and that governments, not just markets, will have to lead AI implementation.

More takeaways from the letter:

Job disruption is already here. He says AI makes software developers “at least twice as efficient,” and that disruption is spreading. Warehouse work and phone support are next. He suggests the world use 2026 to prepare, citing the potential for changes like a shorter work week.

Bioterrorism is his top AI concern. Gates warns that “an even greater risk than a naturally caused pandemic is that a non-government group will use open source AI tools to design a bioterrorism weapon.”

Climate will cause “enormous suffering” without action. Gates cautions that if we don’t limit climate change, it will join poverty and infectious disease in hitting the world’s poorest people hardest, and even in the best case, temperatures will keep rising.

Child mortality went backward in 2025. Stepping outside AI, Gates calls this the thing he’s “most upset about.” Deaths for children under 5 years old rose from 4.6 million in 2024 to 4.8 million in 2025, the first increase this century, which he traced to cuts in aid from rich countries.

AI could leapfrog rich-world farming. Gates predicts AI will soon give poor farmers “better advice about weather, prices, crop diseases, and soil than even the richest farmers get today.” The Gates Foundation has committed $1.4 billion to help farmers facing extreme weather.

Gates is using AI for his own health. He says he uses AI “to better understand my own health,” and sees a future where high-quality medical advice is available to every patient and provider around the clock.

AI is now the Gates Foundation’s biggest bet in education. Personalized learning powered by AI is “now the biggest focus of the Gates Foundation’s spending on education.” Gates says he’s seen it working firsthand in New Jersey and believes it will be “game changing” at scale.

Read the full letter here.

Stewart Rhodes, the founder of the Oath Keepers, a far-right militia, announced in November 2025 that he will relaunch the group after it disbanded following his prison sentence in 2023.

read more

EXPERT PERSPECTIVE — In 2021, a fifteen-year-old in a small Texas town started something from his bedroom. He’d dropped out of school. He spent his days online, deep into violence and gore. He found others like him and built a network. He named it after his ZIP code: 764.

Within two years, it had spread to every continent. Members – a lot of them teenagers – were finding kids as young as nine on Minecraft and Roblox. They’d befriend them, earn their trust, then trap them. They forced children to hurt themselves on camera. To hurt animals. To do things I’m not going to describe here. That kid from Texas is serving eighty years now. But 764 didn’t stop. It splintered and kept growing.

The FBI currently has over 300 active cases in the U.S. – investigations running in every single field office across the country. They’re looking at more than 350 people tied to the network. Worldwide, authorities believe there are thousands of victims. Arrests connected to groups like 764 jumped nearly 500% in 2025 compared to 2024.

The FBI ranks 764 as a “tier one” threat. That’s the same level as ISIS. Last year, Canada became the first country to officially call 764 a terrorist organization. Not a crime ring. Not predators. Terrorists.

I ran the State Department’s programs against violent extremism. I’ve studied how terrorist groups find and recruit people for most of my career. Canada got this one right.

Who’s Reading this? More than 500K of the most influential national security experts in the world. Need full access to what the Experts are reading?

What Canada Did

Calling something a terrorist organization isn’t just a label. It changes what governments can do. In Canada, the designation means that anyone who helps 764 – with money, with recruitment, with anything – is now committing a crime. Banks have to freeze assets. Immigration can block people at the border. Law enforcement gets access to tools they can’t use for regular crimes. It also sends a message. When a country puts a group on the same list as Hezbollah and the Islamic State, it tells allies, tech companies, and the public: this is serious. Pay attention.

Canada’s intelligence service says nearly one in ten of their terrorism investigations now involves a minor. Think about that. We’re not talking about kids as victims – we’re talking about kids as suspects in terrorism cases.

How They Find Kids

764 doesn’t stumble onto victims. They go looking for specific kinds of kids. Depressed kids. Lonely ones. Kids who get picked on at school. Kids who cut themselves or post about wanting to disappear. They hunt for these signs in Discord servers, on Roblox, in Minecraft – places your kid probably hangs out.

When they find someone, they’re patient. They don’t ask for anything. They just show up. They say “I get it” and “you’re not crazy” and “I’ve been there.” If you’re a thirteen-year-old who feels invisible, having someone actually listen? That hits different.

Weeks go by. Maybe months. They share darker stuff. Normalize it. Then they ask for a photo – something the kid wouldn’t want anyone to see. Once they have that, everything changes.

“Send more or we show everyone.”

Most blackmail is about money. Not 764. They want content. They make kids film themselves getting hurt. Humiliated. Some get pushed toward suicide attempts—on camera, while the network watches.

One mother told investigators her daughter carved a screen name into her arm with a razor blade. When she finished, the guy on the other end told her he loved her.

Her daughter said it back.

Victims Become Recruiters

Here’s what turns 764 from a bunch of predators into an actual network. Members earn status by producing “content.” The worse the content, the higher they climb. They keep files on their victims – records of what they made them do—and trade them like trophies. Kids who started as victims become perpetrators because that’s how you move up.

In Connecticut, a former honor roll student got caught up in 764. She ended up making bomb threats against her own school – threats phoned in by someone overseas who she thought was her friend. When police searched her devices, they found abuse images, photos of self-harm, and pictures of her paying tribute to the network. Her mom told ABC News, that “It was very difficult to process, because we didn’t raise her to engage in that kind of activity.” That’s the thing. Nobody raises their kid for this. These children get found, groomed, trapped, and turned. One researcher put it simply, “The most horrendous part is it’s minors doing this to minors.”

This Is Terrorism

I know – it sounds like the worst kind of predator ring. So why call it terrorism? Because it works exactly like the terrorist networks I’ve tracked for years. Find someone in pain. Give them a worldview that makes sense of that pain. Then get them to act on it.

764 finds broken kids and tells them the world deserves to burn. That cruelty is honesty. That hurting people is power. The ideology underneath is simple: chaos for its own sake. No political demands. No territory. Just destruction as the point.

Then they turn victims into recruiters – kids climb the ranks by trapping other kids. The ones who got groomed become the groomers. And it doesn’t stay online.

Last July, a 764 member in Minnesota stabbed a woman twenty times. In Germany, authorities arrested someone connected to the network on over 120 charges — including murder. In Finland, police are investigating whether two teen suicides are linked to 764. The network shares guides on how to plan real-world attacks. This isn’t abuse that sometimes leads to terrorism. It’s a terrorism pipeline that uses child abuse as its on-ramp.

Why the U.S. Hasn’t Moved

So Canada calls this terrorism. Why haven’t we? Our laws weren’t built for this. We’ve got tools to go after foreign terrorist groups. We’ve got tools to prosecute child predators. But 764 started in Texas, spread everywhere, and mixes exploitation with extremism in ways that confuse the system.

Right now, we’re going after these guys one at a time for the abuse. That puts individuals in prison. But it treats 764 like random criminals instead of a network with a shared playbook and a body count that keeps growing. The FBI calls it “one of the most disturbing things we’re seeing.” The Attorney General calls it “one of the most heinous online child exploitation enterprises we have ever encountered.” Meanwhile, kids keep getting trapped. The network keeps growing. And we keep treating each case like it exists in a vacuum.

Canada made a call. We should make the same one.

Cipher Brief Expert Dexter Ingram also publishes on Substack Code Name: Citizen

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.

Abstract: A decade ago, the terrorist attacks in Paris illustrated the risks and challenges posed by complex coordinated terrorist attacks (CCTA) in a Western capital. These marauding attacks, striking multiple scenes in quick succession, were different from the bombing of public transport in Madrid in 2004 and London in 2005. This article explains the evolution of the Western law enforcement response while facing such attacks, and how the 2008 Mumbai attacks and the 2015 Paris attacks led to operational and tactical evolutions in France, the United Kingdom, and the United States.

read more

Evidence that the Islamic State allegedly inspired the attack that killed at least fifteen people at a Hanukkah event in Australia could spur new concern about the reach of the terrorist group six years after it was defeated militarily. Australian authorities say that flags and explosive materials linked to the father and son who mounted the attack points to the influence of ISIS.

read more

The mass shooting during Hanukkah in Bondi Beach is a horrific reminder that contemporary terrorism can affect the places where we meet others, shop, celebrate and conduct our daily lives. However, our research suggests that what the UK public fears and assumes about terrorism threats is quite different from reality.

read more

DEEP DIVE — On November 24, 2025, President Trump launched a process to designate Muslim Brotherhood chapters in Lebanon, Egypt, and Jordan as Foreign Terrorist Organizations (FTOs) and Specially Designated Global Terrorists (SDGTs).

Citing fresh intelligence that these specific affiliates provided material support to Hamas after the October 7 attacks on Israel, the White House gave Secretary of State Marco Rubio and Treasury Secretary Scott Bessent a tight 30-day deadline to produce a formal report. The goal, administration sources say, is to sever the financial arteries — from charitable fronts to hawala networks — that have kept the Brotherhood’s regional machinery alive.

The decision comes at a moment when the Brotherhood’s once carefully cultivated image as the respectable face of political Islam lies in tatters. Days before Trump’s executive order, Texas Governor Greg Abbott made his state the first to label both the Muslim Brotherhood and the Council on American-Islamic Relations (CAIR) as terrorist entities, vowing to target what he called “radical extremists.” Florida Governor Ron DeSantis followed the move by Texas with his own similar executive order. With federal momentum now behind him, the designations threatens to cascade across the region—and potentially beyond.

“Hamas was founded as the Egyptian arm of the Muslim Brotherhood and has made this very clear in its Charter of 1987,” Hans-Jakob Schindler, Senior Director of the Counter Extremism Project, tells The Cipher Brief. “The political statement of Hamas of 2017 did not mention this link specifically, but it also did not state that Hamas would be independent. Hence, Hamas remains part of the Muslim Brotherhood network.”

Roots of a Transnational Shadow

To grasp the stakes, the story must begin in Ismailia, Egypt, in 1928, when schoolteacher Hassan al-Banna founded the Ikhwan al-Muslimin as a movement of Islamic revival and social reform. What started with Quranic lessons and charity work exploded into a mass organization of hundreds of thousands by the 1940s, complete with a secret paramilitary wing, the Special Apparatus, that carried out bombings and assassinations against British forces and Jewish targets. Egypt banned the group in 1948; al-Banna was assassinated shortly afterward, almost certainly by state security.

Heavy-handed crackdowns, periods of accommodation, and notable ideological shifts have defined the Brotherhood’s trajectory since then.

Officially, the Brotherhood renounced violence in the 1970s, and it built an unrivaled network of mosques, clinics, schools, and labor unions. The 2011 Arab Spring briefly catapulted it to power: Mohamed Morsi became Egypt’s first elected president in 2012. Fourteen months later, mass protests and a military coup ended the experiment. Egypt declared the Brotherhood a terrorist organization in 2013, killed more than 1,000 supporters in a single day at Rabaa Square, and imprisoned tens of thousands more. Exiled, splintered, and radicalized, remnants went underground or looked to Gaza.

Fernando Caravajal, executive director at The American Center for South Yemen Studies and an expert in Sudanese affairs, tells The Cipher Brief that the Brotherhood’s ideological flexibility allows it to reemerge in power vacuums, but cautions that the potential United States terrorist designation likely stems from outside interests.

“Notice the timing: these statements came a week after the meeting with Saudi,” he said. “It wasn’t announced during the meeting, so we can’t say Saudis are openly pushing it, but they clearly have a hand behind it because of the timing, because of the content. It mentions Jordan and Lebanon — those are Saudi priorities.”

Riyadh’s priorities center on containing Islamist movements and curbing Iranian influence in the Levant, making Jordan and Lebanon key arenas for Riyadh’s regional security strategy.

Across the region, local chapters adapted in different ways. Jordan’s Islamic Action Front (IAF) became the kingdom’s most organized opposition, running hospitals and schools and holding parliamentary seats. Lebanon’s looser network operates in Palestinian camps alongside Hezbollah. Both insist they are peaceful and gradualist.

“It is important to understand that the relationship between the Muslim Brotherhood and violence is a tactical one,” Schindler said. “It can change at any point if the network feels that violence would be useful for its position and influence.”

Past American attempts to designate the entire Brotherhood collapsed amid pushback from Qatar, Turkey, and some European allies. This time, the White House has chosen a surgical strike. According to Schindler, the White House’s endeavor to focus on individual chapters is an optimal approach because it targets “chapters in countries that have themselves banned and/or designated the Muslim Brotherhood (Egypt, Jordan) and on Lebanon, where the distinction between Muslim Brotherhood and Hamas is hard to make.”

Need a daily dose of reality on national and global security issues? Subscriber to The Cipher Brief’s Nightcap newsletter, delivering expert insights on today’s events – right to your inbox. Sign up for free today.

The October 7 Reckoning

The trigger, ultimately, was October 7 and the events that followed. In Lebanon, the most explicit public demonstration came when a Brotherhood-affiliated militia calling itself the al-Fajr Forces fired rockets into northern Israel days after Hamas’s massacre.

“Hamas is the Muslim Brotherhood organization in Gaza and the West Bank. It calls itself such. However, it operates independently,” Nonresident Senior Fellow at the Atlantic Council and Former DHS Deputy Assistant Secretary for Counterterrorism Policy, Thomas Warrick, tells The Cipher Brief. “Its revenues were derived from control of Gaza’s governance: taxes, donations from outside governments, and criminal activities from which it profited. Other MB chapters are small in budgets and manpower compared to Hamas.”

In Jordan, the IAF organized some of the largest pro-Hamas demonstrations in the Arab world.

“The clearest demonstrated ‘link’ between Hamas and the specified Muslim Brotherhood chapters is that a Brotherhood-affiliated group in Lebanon, al-Fajr Forces, launched rockets into Israel following the October 7 2023 Hamas terrorist attack,” Rose Kelanic, director of the Middle East Program at Defense Priorities, tells The Cipher Brief, stressing that “the Muslim Brotherhood is not a terrorist threat to the United States.”

In Egypt, underground networks — despite Sisi’s repression — funneled money and propaganda into Gaza. Yet Schindler specifically highlights Lebanon’s darker role in Hamas’s external operations.

“According to German court documents, the Hamas cell that was arrested in Germany and the Netherlands in December 2023, which had planned and prepared for terror attacks in Germany, was led by Hamas handlers in Lebanon,” he noted. “Given the close connection between Hamas and the wider Muslim Brotherhood network, it is therefore likely that such contacts also exist in Lebanon.”

The real power of the designation, however, lies in America’s arsenal of financial warfare. Once listed, any bank worldwide that touches Brotherhood money in dollars risks losing access to the United States market.

“Disrupting the ability of large-scale extremist and terrorist networks, such as the Muslim Brotherhood, to have unhindered access to the global financial system is, of course, a very effective way to hinder their overall operations,” Schindler explained. “Hence, any country where this access is more restricted is, of course, a problem for such networks as it will increase their operational costs.”

Are you Subscribed to The Cipher Brief’s Digital Channel on YouTube? There is no better place to get clear perspectives from deeply experienced national security experts.

Allies on the Brink

Jordan is already on edge. Dependent on $1.5 billion in annual U.S. aid and facing street fury over Gaza, King Abdullah II banned the Brotherhood in April 2025 — yet the IAF still functions. While Schindler sees Washington’s possible move as reinforcement that will “aid in the efforts of the Jordanian government in countering Muslim Brotherhood structures in the country,” Kelanic warns of unintended consequences.

“The only scenario I worry about is if the U.S. insists on applying the FTO designation to the IAF, because that amounts to major meddling in Jordanian politics,” she noted. “The last thing the U.S. needs is another failed state in the Middle East.”

Turkey, experts point out, is perhaps the bigger headache. Schinder asserts that Turkey “is indeed an important network hub for Hamas,” in particular when it comes to the group’s financial systems.

“Turkey is in a unique position to pressure Hamas to give up its weapons and power in Gaza and leave the Strip,” he continued. “Unfortunately, so far, the Turkish government does not seem to have done so.”

According to Warrick, “what Turkey will do in response to the U.S. designation is not yet clear.”

“Supporting Muslim Brotherhood affiliates in the region is a core policy of the Turkish government, but President Erdoğan is mindful that his relationship with President Trump is strong and is valuable,” he explained. “The Turkish government is aware of the Trump administration’s hostile attitude towards the Muslim Brotherhood but is not likely to change its approach except in countries that the U.S. government has formally designated Brotherhood branches as Foreign Terrorist Organizations.”

A senior U.S. intelligence official, speaking to The Cipher Brief on background, described the administration’s delicate balancing act.

“The President comes out with a statement where he’s clearly trying not to offend the Qataris too much, but at the same time satisfying the UAE and the Saudis and the Egyptians,” the insider noted. “He’s riding the fence on this but skewing more to the anti-side.”

Washington is particularly wary of antagonizing Doha because Qatar remains a critical mediator with Islamist movements and an indispensable interlocutor in hostage, de-escalation, and regional crisis negotiations. The Qatar-based Brotherhood chapter formally disbanded in 1999, and Doha has repeatedly denied formal support for the Muslim Brotherhood, despite continued investigations indicating the group’s ongoing financial backing and praise from the likes of Hamas.

That same insider predicted domestic ripple effects: “If we suddenly see a ton of states passing laws against the Brotherhood and CAIR, then we start to have some real domestic impacts.”

CAIR has long faced allegations of historical ties to the Muslim Brotherhood because some of its early founders were involved with U.S.-based organizations linked to Brotherhood-affiliated networks, and because it was named as an “unindicted co-conspirator” in the 2007 Holy Land Foundation case. Critics cite these associations as evidence of ideological or organizational overlap. However, no criminal charges were ever brought against CAIR, and no direct operational link to the Brotherhood has been proven. CAIR denies any affiliation, and most of the evidence remains circumstantial, dated, and heavily disputed.

Analysts also point out that Saudi Arabia and the UAE, both of which already list the Brotherhood as terrorists, are quietly celebrating. But not everyone agrees that an FTO designation is a step in the right direction.

“Doing a blanket listing of ‘the Muslim Brotherhood’ is a huge risk for the U.S.,” Caravajal said. “It allows people to be arrested simply for going to the wrong mosque.”

For a movement that has survived bans, coups, and massacres for almost a century, this is only the latest test.

“The problem with designating the Muslim Brotherhood is that it never was a unitary organization or even a franchise organization like Al-Qaeda or Da’esh,” Warrick added. “This is why the solution the Trump administration came up with is the correct one. By working with partners that have already outlawed or sanctioned the Muslim Brotherhood chapters in their countries, the U.S. government can work cooperatively with those countries. This approach also gives some clarity to people in those countries, which groups they need to avoid in order not to be sanctioned by OFAC.”

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

EXPERT OPINION / PERSPECTIVE -- Less than three months ago, two people were killed in a terrorist attack on Jewish people in a synagogue in Manchester, UK, on the most solemn day of the Jewish religious calendar.

Three days ago, a large crowd of Jewish people in Sydney, Australia, celebrated Hanukkah on Bondi Beach. Two Islamic terrorists, father and son, fired at them from a nearby bridge. Sixteen innocent Jewish people were murdered, including a Holocaust survivor and a ten-year-old child.

The point of a terrorist attack is that even a relatively contained engagement spreads widespread fear. This is particularly the case with the Jewish community. The background for Jews is centuries of persecution culminating in the indescribable horror of the Holocaust. Even since then Jews for many years have lived in fear.

I was friendly with an Israeli diplomat in Turkey thirty years ago. He could not travel in his own car, hopping around Istanbul instead by taxi (dangerous enough), and no one knew where he lived.

Synagogues and Jewish schools in the UK have the sort of security I was used to in Kabul. There is even a charity trust, CST, dedicated purely to the security of Jewish people here. When a terrorist incident happens, most Jews ask themselves “Are we safe here?”

So, terrorism is working well against Jewish people and western governments need to show that they are serious about opposing terrorism. You can’t have a democracy when terrorism against one community is tolerated. Not least, because assuredly if we give up on the security of Jewish people others will be next. That is why anti-semitism must be seen as a national security imperative.

When the UK united against Islamic terrorism in the aftermath of the murder of 52 Londoners in 2005, we realised that it was not enough simply to pursue possible terrorists and to be prepared for possible attacks. We realised that we needed to understand and combat the hatred that drove these attacks and to stop it infecting vulnerable people who might be tempted by the Al-Qaeda message.

What national security news are you missing today? Get full access to your own national security daily brief by upgrading to Subscriber+Member status.

Much of the focus on the Jewish community since the Sydney attack – and it has been gratifying to see the media at last seriously focused on anti-semitism – has been about the need to “protect” Jews. That was the message of British prime minister Keir Starmer. That is fine but the solution for Jewish people, as the terrorists know, is not about even more security systems around their synagogues and schools, about armoured cars transporting schoolkids around north London or about how safe it is to be publicly identifiable as Jewish. “Safety concerns” have been used to ban an Israeli football team from playing in Birmingham, and non-political Jewish entertainers from appearing in Edinburgh. Jews are likely to conclude that this is no life, and there must be safer places to live: and you have lost your battle against terrorism.

The only solution to defeat this terror is declaring war on anti-semitism. Lots of people will tell me how difficult this would be. How do you distinguish “legitimate” criticism of Israel from criticism that uses conscious or unconscious anti-semitism? Couldn’t a state-backed campaign against anti-semitism have the opposite effect to the desired one, leading to even more isolation and hatred of the Jewish community?

These are serious risks: no one is saying this is easy. But the status quo is no longer acceptable.

One more mass casualty attack – let's say in some European or American city on Passover, 2026 – and the Jewish community is going to be packing its bags. And you have lost your battle against terrorism. Anti-semitism is a national security priority.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals.

Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The terror attack at Bondi Beach on Sunday should be understood not only as an act of violence but as a stress test of Australia’s security, social and policy systems.

The immediate danger has passed. The more consequential question is what this event reveals about the community assumptions that have quietly taken hold—and what follows if those assumptions are left unchallenged.

read more

At least 16 people – including a ten-year-old child – are dead after two men opened fire on a crowd of people celebrating the Jewish holiday of Hanukkah on Sunday in a public park at Sydney’s Bondi Beach. Many more are injured.

I am horrified. But as a researcher who studies hate and extremist violence, I am sadly not surprised.

read more

Very little new information has been released since Rahmanullah Lakanwal murdered West Virginia National Guard member Sarah Beckstrom in Washington, DC, two weeks ago. He also shot and injured Andrew Wolfe, another National Guardsman, in the same attack. Prosecutors have since charged Lakanwal with murder, assault with intent to kill while armed, and possession of a firearm during a violent crime. Terrorism charges are absent because prosecutors do not yet know his motives. The FBI is conducting a terrorism investigation to discover those.

read more

How can society police the global spread of online far-right extremism while still protecting free speech? That’s a question policymakers and watchdog organizations confronted as early as the 1980s and ’90s – and it hasn’t gone away.

read more

A largely overlooked directive issued by the Trump administration marks a major shift in U.S. counterterrorism policy, one that threatens bedrock free speech rights enshrined in the Bill of Rights.

read more

Peace is a prerequisite to the ambitious economic development plans that could transform Gaza. Securing that peace, however, requires addressing the future role of Hamas’s fighters.

read more

Although progress in biological sciences and technologies will offer more opportunities to improve human well-being in the coming decades, this progress may also lower barriers that are blocking bad actors from engineering pathogens to cause destruction. In severe cases, the harms of future biological attacks may approach the magnitudes of the worst plagues of history—from the devastation wrought by the Black Death to the epidemics that decimated Mesoamerican societies after initial European contact.

read more

President James Garfield’s life is defined by the man who ended it. Charles Guiteau, Garfield’s assassin, has been historically characterized as a megalomaniac with delusions of grandeur. However, it’s another label that helps explain why he shot the president: office seeker.

read more

Many people celebrated President Donald Trump’s executive order targeting “political debanking.” Yet, those same people seem to be silent now that the president created new pressures to effectively debank the left.

read more

DEEP DIVE – It’s the opening act in a potential public health nightmare: a chicken dies on a farm, for no apparent reason; another perishes at a farm hundreds of miles away; it takes time for the farm owners to notice, more time for tests to be conducted and different anomalies connected, and before the diagnostics are complete, the damage is done – the first wave of a bird flu pandemic has broken.

Beyond natural outbreaks, there are also concerns involving deliberate acts: This week the Department of Justice charged three Chinese nationals with smuggling biological materials into the U.S.; and in June two Chinese researchers were charged with trying to smuggle a fungus into the U.S. that can devastate grain crops.

Some experts are imagining a world in which technology is harnessed to ensure that such biosecurity nightmares don’t happen – or are dealt with much faster and more effectively.

“What we're promoting is a system that can look at things more holistically and on a much larger scale,” Robert Norton, a professor of veterinary infectious diseases and coordinator of national security and defense projects at Auburn University, told The Cipher Brief. “The system is designed to fill gaps in biosurveillance, looking for disease outbreaks, whether they be naturally occurring or induced through bioterrorism.”

That proposed system has a name – BISR, for Biosurveillance Intelligence, Surveillance, and Reconnaissance – and its backers believe it would revolutionize the field of biosurveillance. The core concept is that sophisticated sensors and other tools used by the U.S. Intelligence Community (IC) can be leveraged to improve detection, and that artificial intelligence can be deployed to help fast-track diagnosis. The chicken-farm example is only one scenario; responses to a COVID-19-like outbreak or acts of bioterrorism would be improved as well.

Norton, Daniel Gerstein, a senior policy researcher at RAND, and Cris Young, professor at the College of Veterinary Medicine at Auburn, co-authored an article last year arguing that the creation of a BISR system was “a national security imperative at the crossroads of technology, public health, and intelligence.” The BISR, they wrote, “would be designed to address two mission-critical requirements for biosurveillance: rapid detection and predictive analysis.”

They have taken their plans to Capitol Hill – specifically, to the House Permanent Select Committee on Intelligence, where they say they have received “good reviews.” The Select Committee wouldn’t comment on the BISR proposal itself but in a statement to The Cipher Brief, a spokesperson said that “The Committee continues to explore various biosecurity initiatives and programs to ensure that the U.S. is postured sufficiently to combat and prevent any future biosecurity threats that could cause widespread harm.” The statement went on to say that the Committee is working with the Office of the Director of National Intelligence (ODNI) “to establish an Office of Intelligence within the U.S. Department of Agriculture to address threats to U.S. agriculture.”

The threats are clear, to agriculture and beyond. The U.S. remains vulnerable to biologically driven disruption – be it from another COVID-like pandemic, an outbreak of bird flu that reaches humans, or bioterrorism. Anxiety over the latter has grown as experts worry that AI may be used to create dangerous biological pathogens.

At last year’s Cipher Brief Threat Conference, Jennifer Ewbank, a former CIA Deputy Director for Digital Innovation, warned of “the application of AI in biological weapons by unsavory actors.” And a 2024 report from the Johns Hopkins Center for Health Security said that the same AI capabilities that might produce medical breakthroughs could – inadvertently or otherwise – lead to the creation of deadly pathogens. AI models may “accelerate or simplify the reintroduction of dangerous extinct viruses or dangerous viruses that only exist now within research labs,” the report found.

How prepared is the U.S. to counter such threats? And might a technology-driven “BISR” system revolutionize biosurveillance, as its backers contend?

Save your virtual seat now for The Cyber Initiatives Group Winter Summit on December 10 from 12p – 3p ET for more conversations on cyber, AI and the future of national security.

How a “BISR” might work

The crux of the case for a BISR system is twofold: first, that an array of sophisticated data-gathering tools – drones, satellites, hyperspectral sensors and others – can be mobilized to track biosecurity anomalies; and that trained AI models would analyze the data that the system collected. The system’s architects envision a BISR “dashboard” that provides first responders and decision makers in government, the military and business near-real time insight and analysis.

It’s a high-tech effort to gather clues – a change in a community’s waste water, a spike in the sales of certain medications, even the breathing or social behavior of animals – and assess their meaning more rapidly than current systems allow.

“Our system is agnostic,” Norton said. “It doesn’t matter whether it’s a natural disease outbreak or a terrorism event, it’s looking for those changes and then being able to rapidly detect them and rapidly alert the individuals that are responsible.”

To expand on the chicken-farm scenario: at the moment, one animal’s death might lead a farm worker to call the company veterinarian, the veterinarian would take samples, the farm would look at the flock as a whole, and samples would be brought to laboratories for tests. Ultimately the case might go to a national lab to determine whether avian influenza or another condition was present.

Public health officials say the current system works – but can be slow. Advocates for the BISR system say it would at minimum improve the speed of response, gaining valuable time to determine not only whether a virus was present, but also how it might be circulating in the broader environment. Sensors in and around the poultry houses would track not only a dead chicken, but also the emissions and even behavioral anomalies within the flock – “pattern-of-life” behavior, as the experts say. Any anomaly would be flagged and the system “tipped off,” as Auburn’s Cris Young put it, to alert sensors on other farms.

“The sensors would tip and cue other sensors that would then take a larger look at the larger area or even a state,” Young told The Cipher Brief, “to determine if those signatures coming off of that one particular house that's affected are similar to things happening in other houses.”

Given the sheer volume of data generated by a BISR system, AI models would be used to rapidly assess the data – and check anomalies against specific pathogens.

BISR’s proponents say a similar approach could be taken with viruses among humans, providing more rapid early-warning mechanisms and analysis.

“Advances in sensor capabilities, coupled with the use of AI platforms, provide new capabilities that could be applied to the detection of biological events in the early stages of an outbreak,” the authors of the BISR article wrote. “The concept would provide new tools for early detection, response, mitigations, and ultimately, recovery from an outbreak.”

Are you Subscribed to The Cipher Brief’s Digital Channel on YouTube? There is no better place to get clear perspectives from deeply experienced national security experts.

The tools of a BISR system

The system’s architects say most of its high-tech elements already exist – sensors in place on poultry farms or in public spaces, and various tools of ISR (intelligence, surveillance and reconnaissance) that are currently used across the IC. These might include multispectral and hyperspectral sensors, and many airborne assets – balloons, drones, aircraft and satellites – that have been used to detect concentrations of gases for national security purposes. The International Space Station, for instance, regularly uses hyperspectral imaging to map the earth’s surface, and the Department of Defense uses hyperspectral imaging for several purposes – including detection of chemical and biological hazards.

Norton cited the example of the IC’s use of satellite imagery to monitor concentrations of nitrate in Afghanistan – because high levels of nitrate often indicated the presence of bomb-making facilities. Nitrate is also a component found in animal waste – and so in the public health example, he said, satellite imagery could be used to monitor levels of nitrate and other compounds on a farm.

Ultimately, BISR’s proponents believe the system could also be used to monitor the volatilome (essentially, what humans and animals breathe out) of people at airports or stadiums or other crowded environments, and alert public health officials about anomalies in the data. Young described a scenario in which international arrivals at Atlanta’s Hartsfield Airport – the nation’s busiest – would be watched by hyperspectral sensors to detect anomalies in respiration.

“We might have sensors set up in multiple places as [people] disembark from their flight,” Young said. “There might be several places to take a different scan with multiple sensors, and we might be able to say with some certainty, this person is infected with let's say COVID, and this person is actually shedding the virus.”

The hope is that any anomaly – be it on a chicken farm or at a crowded airport – would tip the system to sweep up other relevant information: Have ER visits spiked in a community? Does social media from that community suggest related anomalies? And so forth. Ideally, a dangerous pathogen would be flagged and identified before it leads to a pandemic, or an act of bioterror would be detected at the earliest possible moment.

Michael Gates, CEO of GDX Development, a company that bills itself as “solving very complex national security challenges,” says he joined the BISR effort “from the technology side of the equation.” GDX has worked previously with the U.S. Special Operations Command. Gates says the key to BISR’s success will involve “sensor fusion” – the linking of a range of data-gathering mechanisms.

“If you think about the world of the Internet of Things, everything's a sensor, and there's not very many systems out there that have the ability to collect off of all of those sensors, bring that data payload in, and then push it into a single pane of glass that can be used for military operations, for intelligence sharing or more tactical things,” Gates told The Cipher Brief.

In the chicken farm example, Gates envisions “sensor fusion” ranging from a hyperspectral scan to “available drone assets” and ultimately “zeroing in down to sensors such as temperature, air purification, even cameras monitoring chicken behaviors.”

Once a problem has been identified, Gates said, “you can use open-source intelligence and other things to mine, let's say, a Reddit form for these things – is anybody talking on the internet about their chicken coops having issues? – and so on, for whatever the issue is.”

“There's already enough sensors out there,” he added. “The data is there. What's happening is that information's not being shared. It's not being centralized, meaning we're getting delayed responses...Nobody has a holistic picture right now on biosurveillance.”

In the early stages of a crisis, the BISR might do a lot of work before humans are engaged, though the Auburn professors stress that the system aims only to provide experts a head start, rather than cut them out of the proverbial “loop.”

“We support human-in-the-loop artificial intelligence systems,” Young said. “We want there to be a person that has to look at this screen at some point and say, okay, I understand what's going on here. Maybe that happens within minutes of an anomaly occurring, but regardless, at some point a person needs to decide, Yes, that's what this is, or No, we need further information.”

Sign up for the Cyber Initiatives Group Sunday newsletter, delivering expert-level insights on the cyber and tech stories of the day – directly to your inbox. Sign up for the CIG newsletter today.

The challenges

Norton and Young say they have presented their plans to the House Select Committee and are prepared to do the same to the Defense Advanced Research Projects Agency (DARPA). They believe their system can be 80 percent complete in three years and fully functional in five. As for costs, they say the first two years would require a budget of $10 million, and that the system’s operating costs would eventually be $300 million annually. They argue that billions of dollars have been spent in the biosurveillance domain, and that the BISR would be a major upgrade over existing capabilities.

It may sound like a no-brainer – the smart use of technology to guard against myriad biosecurity threats – but questions abound about BISR and its future. And many of the hurdles to its implementation involve, in one way or another, the human element.

Just as the Intelligence Community has struggled at times to share information and assess national security risks, the government architecture in biosurveillance is complex and often siloed. A host of agencies share responsibility for the nation’s biosecurity – the Centers for Disease Control (CDC), the Health and Human Services Department (HHS), the National Institutes of Health (NIH), the Department of Homeland Security (DHS) and the Department of Agriculture (USDA), to name a few. Experts say they don’t always communicate effectively with one another – and that states don’t always share critical information effectively with the federal government.

Dr. Tom Inglesby, Director of the Johns Hopkins Center for Health Security, noted that in the most recent bird flu outbreak in the U.S., some states wanted to handle the information and response without involving the federal government.

“They weren't even very interested in USDA at times,” Inglesby told The Cipher Brief. “So they said, we'll handle this on our own and we'll let you know. Meanwhile, CDC has to wait for states to bring them the data and information. They don't have command authority to say you must deliver it. It's a voluntary basis.”

Norton says the BISR developers are hoping to partner with one “Mother Ship” agency within the IC – he wouldn’t say which one – because the IC controls the government’s most sophisticated satellites and other data-gathering systems. He also said that while the system involves high-tech elements and the building of the BISR “dashboard,” technology isn’t the primary hurdle.

“Biosurveillance is not a technology problem, but rather a permissions and authorities problem,” Norton said. That might involve permission to use a Pentagon satellite for biosecurity purposes, he said, or agreement from a major industrial farm to share its data or house sensors on its property.

Inglesby said that transparency and information-sharing would be critical for a BISR-like system to work – and that in the case of the chicken farm example, key stakeholders might be unwilling to cede control of the analytical process to a BISR “dashboard.”

“You have the farm owner who will want to make his or her own assessment, you have local government that may not want outsiders coming in and making a determination for them, and you might have unwillingness even at the federal level to do this,” Inglesby said. “You’re going to need an across-the-board buy-in that we haven’t always seen.”

There are also questions about technical implementation. In the Atlanta airport example, Norton acknowledged that even a highly sophisticated hyperspectral sensor wouldn’t be able to detect, say, COVID-19, unless passengers were directed to a discrete area close to the sensors – and here again, permissions would be needed to install such sensors. The post-COVID atmosphere has suggested less public appetite in the U.S. for intrusive screening, not more. The House Select Committee, in its statement to The Cipher Brief, included a reference to “ensuring any proposal balances privacy and the need to avoid the abuses of the COVID-19 period.”

Inglesby also stressed the importance of transparency on the global stage when it comes to public health crises. In the early days of the COVID-19 pandemic, China failed to share the detailed casework of its first 500 patients in the “ground-zero” city of Wuhan – and more than five years later, it still hasn’t done so.

“In Wuhan, the data was very available, there were a lot of people dying, but the data was covered up,” Inglesby said. “And so even if you had installed the most sophisticated systems, if they're being run by people who don't want to share that information, it's not going to change anything.”

Some early-warning biosurveillance systems are already in place, in the world of what’s known as “Syndromic Surveillance” – and experts say many have worked well.

The CDC’s BioSense platform gathers health-related data from hospitals and clinics to detect potential outbreaks or bioterrorism events. As a part of BioSense, "Sentinel Alerts" are generated when reports involve high-concern viruses or diseases. In the case of influenza (the human variant), alerts are triggered when more than 3 % of ER visits are for the flu. Globally, satellites have been used to track dengue fever outbreaks by measuring water levels in the jungle. And wastewater surveillance systems exist to check on levels of bacteria or viruses.

A less positive precedent is the BioWatch program, which was created by DHS in 2001 and billed as "the nation's first early warning network of sensors to detect biological attack." The system tracks the air supply using Environmental Protection Agency air filters, and sends information to the CDC and – if warranted, to the FBI. The system has been blamed for generating dozens of false positives, and in an audit reported by the Associated Press in 2021, BioWatch was said to have failed in detecting known threats.

Norton told The Cipher Brief that today’s technologies are sophisticated enough to ensure that BISR would operate at a higher level than BioWatch. He added that rigorous standards in the AI models would “prevent AI hallucinations” that could cause false positives – or worse, false negatives.

And Inglesby was quick to note that any improvements in early warning and diagnostics would be welcome.

“There is no single system in the country, and people have been talking about building stronger biosurveillance for a long time,” he said. “Anything you can get done in this space would be super-valuable, assuming the costs aren’t prohibitive and you get the buy-in to use this information wisely.”

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

DEEP DIVE — On the night of June 20, 2025, the Nigerien village of Manda became the stage for one of the deadliest massacres in the Sahel in recent memory. As dozens of worshippers gathered at a mosque for evening prayers, militants from the Islamic State’s Sahel Province encircled the village and opened fire without pause. Bullets tore through the congregation, killing at least 71 men, women, and children and wounding dozens more.

Survivors later recalled the horror of lying motionless beneath the bodies of neighbors and relatives to avoid being shot, while houses were torched and families scattered in the chaos. The bloodshed was not only an assault on a remote community in Tillabéri, but a stark signal of how deeply jihadist violence has penetrated this once quiet borderland.

In the span of a few hours, Manda joined the growing list of towns and villages reduced to symbols of terror, underscoring the reality that groups like Islamic State in the Sahel now operate less as rogue insurgents than as entrenched power brokers whose reach stretches across Niger, Mali, and Burkina Faso. For the United States, the massacre is more than a humanitarian catastrophe — it is a sobering reminder that the doctrine of forward defense faces its most formidable test yet in Africa’s most fragile frontier.

“The threat from Sahelian jihadists is really two-fold,” Caleb Weiss, editor of FDD’s Long War Journal, tells The Cipher Brief. “They are destabilizing wider West Africa, particularly the Gulf of Guinea states, which have been firm U.S. and Western allies. And secondly, there is worry about European security if jihadis in the Sahel are allowed to operate freely. The Sahel can become a base of operations from which to launch or even sponsor attacks into continental Europe.”

Hans-Jakob Schindler, Senior Director of the Counter Extremism Project, frames the problem in similarly stark terms.

“There are two primary terrorist threats that can be identified,” he tells The Cipher Brief. “First of all, the rapid expansion of the al-Qaeda affiliate JNIM as well as the ISIS affiliates ISSP and ISWAP in the Sahel region has destabilized several countries, in particular Burkina Faso, Mali and to a growing extent also Niger, with continuing serious security problems in the North of Nigeria.”

From Margins to Mainstream: The Rise of Sahelian Jihadism

The massacre in Manda reflects a decade-long unraveling of state control. The collapse of Libya in 2011 unleashed vast armories and fighters into the desert, reigniting dormant rebellions and enabling extremist groups to entrench themselves in northern Mali. The Malian state itself fragmented in 2012 following a coup, allowing jihadist coalitions to seize major northern cities.

Over time, groups splintered and reformed. Jama’at Nusrat al-Islam wal Muslimeen (JNIM), an al-Qaeda affiliate, emerged in 2017, while the Islamic State in the Greater Sahara (ISGS) evolved into the Islamic State’s Sahel Province. These factions began imposing taxes, adjudicating disputes, and governing their respective territories. According to Vision of Humanity, the Sahel accounted for 51 percent of global terrorism deaths in 2024, with nearly 25,000 conflict-related fatalities — a near tenfold increase since 2019.

Liam Carnes-Douglas of the Terrorism Research & Analysis Consortium (TRAC) says the rise reflects more than battlefield victories.

“Some of the most urgent threats posed by Sahel-based jihadist groups stem from the destabilization of key regional partners,” he tells The Cipher Brief. “Once among the strongest U.S. allies in counterterrorism, these governments have shifted rapidly from fragile democracies to military juntas, fueled in part by the failures of Western-backed security initiatives. That has sidelined the United States as anti-Western sentiment grows.”

Andrew Lewis, president of the operational intelligence firm Ulysses Group, agrees that the power vacuum extends beyond the battlefield.

“In the truest sense, the U.S. has limited national security interests in the region. But we do have resource and energy interests that underpin our national security strategy — particularly in Niger, Mali, and Burkina Faso,” he tells The Cipher Brief. “The control of trade routes, ports, and export conduits of critical minerals is a strategic concern. We would like to see JNIM, ISIS, and their affiliates contained before they threaten those supply chains.”

Need a daily dose of reality on national and global security issues? Subscriber to The Cipher Brief’s Nightcap newsletter, delivering expert insights on today’s events – right to your inbox. Sign up for free today.

Tactical Adaptation and Regional Spillover

Over the last eighteen months, jihadist groups in the Sahel have evolved their tactics in ways that suggest a larger ambition. Motorcycles enable lightning raids across ungoverned stretches. Drone warfare — once limited to surveillance — has evolved into an offensive capability. JNIM has carried out more than 30 confirmed drone strikes since late 2023.

“Both al-Qaeda’s JNIM and the Islamic State’s Sahel Province have deployed suicide drones,” Weiss noted. “They’re also utilizing Starlink to stay connected in remote areas. Helping counter drones, exploiting Starlink’s vulnerabilities, and shutting off externally sourced financing would help the region tremendously.”

Carnes-Douglas also warns that “rapid technological advancements are increasingly shaping warfare.”

“Drones and Starlink-enabled communications stand out as particularly transformative, yet both regional security forces and U.S. capabilities lag significantly behind,” he continued, pointing out that lessons from Ukraine “demonstrate how these technologies are quickly adapted for combat,” and their proliferation “signals that warfare in the Sahel is entering a transitional, high-tech phase.”

Schindler underscores a connected, transnational risk.

“The Sahel region is also a key network hub for the international drug transportation pipeline of Hezbollah-linked drugs that are transported from South America via West Africa to Europe for sale there,” he explained. “This pipeline directly funds Hezbollah’s activities in Lebanon. Given the central role that the U.S. is playing in the current negotiations between Hezbollah and Israel, this income stream for Hezbollah will continue to ensure that this terror group will be able to continue to fund its activities both within Lebanon and beyond.”

Across Niger, Mali, and Burkina Faso, militants are consolidating control.

“Islamic State in the Greater Sahara has long used the tri-border area to evade interdiction,” Carnes-Douglas explained. “That makes coordinated regional responses not just useful but necessary.”

The violence, however, is also spilling outward.

“Sahelian jihadis are now inching closer to Senegal,” Weiss said. “They’re creating a jihadist land bridge between the Sahel, littoral West Africa, and Nigeria — effectively one large area of jihadist operations encompassing a significant chunk of the continent.”

This expansion also has a sectarian dimension. Lewis surmised that more than 50,000 Christians have been murdered in Nigeria since 2009, “with more than 7,000 killed in 2025 alone.”

“It’s difficult to assess the true scale of persecution Islamist militant groups are carrying out,” he underscored. “But it’s happening.”

Schindler also highlights an alarming operational trend: “Currently they are not only able to conduct multi-layered attacks against single targets (such as a military camp) but also to conduct simultaneous and coordinated attacks on multiple targets across relatively large geographic areas.”

Are you Subscribed to The Cipher Brief’s Digital Channel on YouTube? There is no better place to get clear perspectives from deeply experienced national security experts.

U.S. Policy Today: A Detachment Problem?

For years, the U.S. viewed the Sahel as a key front in counterterrorism, maintaining drone bases and training missions in Niger. But the 2023 coup upended that equation. Washington froze over $500 million in aid and limited cooperation even as the junta expanded ties with Russia’s Wagner Group. The result is a fragile balance between limited engagement and strategic erosion.

“Outside of JSOC, U.S. efforts in the region have been marginal at best. That’s evident in the surge in violence and the formation of the Alliance of Sahel States, which pivoted away from the West to Russia,” Lewis said. “None of our 333 programs in the region has dented terror operations. We rely heavily on intelligence-led frameworks but have very little real-time intelligence since withdrawing key assets from Niger.”

Carnes-Douglas echoes that concern. “American counterterrorism efforts have achieved tactical successes but strategic failures,” he observed. “Short-term gains from drone strikes or training are constantly undermined by state fragility, coups, and shifting alliances.”

Moreover, while France’s drawdown from Operation Barkhane — the 2014–2022 French-led counterterrorism campaign across the Sahel that deployed more than 5,000 troops to combat Islamist insurgencies in Mali, Niger, and Chad — created a vacuum, “the U.S. has not yet developed a sustainable replacement strategy,” Weiss stressed. “There are some indications the U.S. has resumed limited intel support to Sahelian juntas, but nothing that matches previous levels of engagement,” he continued.

Schindler argues that the disengagement itself has worsened the crisis.

“Although a lot of criticism has been levied against the UN, EU and US counter terrorism operations in West Africa and the Sahel in the past, the current situation, in which the UN, the EU and the US have largely disengaged from the region clearly demonstrates that overall, the counterterrorism efforts had been successful in stemming the tide of terrorist expansion in the region,” he said.

A Strategic Imperative: What Must Washington Do Next

Analysts emphasize that the path forward requires reimagining engagement. Weiss argues that U.S. support should focus on technology denial and intelligence integration, not just kinetic strikes.

“Helping counter drones, exploiting the use of Starlink and the data vulnerabilities therein, and helping to shut off externally sourced financing would help the region tremendously,” he said.

Washington, Lewis highlighted, must also think pragmatically about force posture.

“If we want to contain JNIM and ISIS, the focus should be on protecting the coastal regions with ISR and targeted strikes where success is measured by territory denied, not by how many host forces we train,” he said. “But that requires basing rights, logistics, and political will, and China and Russia hold significant leverage over potential host countries.”

Indeed, Beijing’s influence looms large.

“China has financed major ports, railways, and industrial projects across Ghana, Côte d’Ivoire, Nigeria, and Senegal,” Lewis explained, noting that this gives it immense leverage to counter U.S. influence and deny access to infrastructure critical for forward operations.

Carnes-Douglas, meanwhile, advocates for a recalibrated diplomacy that acknowledges political realities.

“Although U.S. foreign policy appears to be shifting away from involvement in these conflicts, Washington should recommit pragmatically to directly limit jihadist groups’ ability to threaten American interests,” he asserted. “This, in turn, would form stronger relationships with the newly formed governments and in turn could be an industrial and economic boon, as well benefiting all partners.”

Schindler proposes a containment-first approach, prioritizing direct engagement with the littoral Gulf of Guinea states.

“One primary goal should be containment, ensuring that the expansion of terrorist activities and control in the region does not affect additional countries, in particular the littoral states of the Gulf of Guinea,” he said.

The slaughter at Manda, the border ambushes, the drone blitzes — all are signs of a metastasizing threat.

“Through the increasing influence and power of these terrorist affiliates in the Sahel region, the threat to US interests in the region, as well as potentially to the US homeland, is increasing in parallel,” he added.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.