Issue 835 - 1 September 2008

Al-Qaeda in Yemen under pressure but defiant

The death of the Al-Tamimi brigade’s Hamza Al-Qayti deprived the jihadist movement of a senior leader and suggested that the security forces may have turned the tide against ‘Al-Qaeda’s’ Jund Al-Yemen arm, following confidence-sapping attacks in H2 2007 and H1 2008. But it is premature to say that the threat has gone away.

The pattern of rocket and small bomb attacks on western compounds and oil facilities in Q1 2008 – the latest attacks launched by 23 jihadists who escaped in the notorious February 2006 jailbreak – rattled the expatriate community and forced diplomatic missions to lock down and evacuate dependents. But a rash of counter-terrorist raids in eastern Yemen has since convinced some governments and companies that President Ali Abdullah Saleh’s regime is getting serious about the protection of expatriates for the first time since 2002, the last successful counter-terrorist campaign. Downgrading of the threat is not a step taken lightly (see page 1), and it poses the question: has the so-called Al-Qaeda in Yemen (AQY) threat really receded or is the relaxation premature?

Unlike Al-Qaeda in Iraq, Jund Al-Yemen, rebranded as AQY, is not a large and bureaucratic organisation. It instead functions in a devolved way, with individual ‘brigades’ – comprising groups of around a dozen fighters – operating largely autonomously. In keeping with the devolved model of leadership pioneered by Saudi jihadist leaders like Abdelaziz Al-Muqrin, command and control is largely achieved through two mechanisms:

• senior leaders – the occasional intervention of seasoned leaders such as Qassim Al-Raimi and Hamza Al-Qayti tends to be associated with effective long-lead attacks such as the September 2006 quadruple car bombings against oil targets, the July 2007 car bombing against Spanish tourists and attacks this year on western facilities in Sanaa. With Arab-Afghan fighter Al-Qayti apparently killed on 11 August and fellow veteran Nasir Al-Wahayshi (Abu Bashir) playing only a symbolic role, Raimi is now the only major combatant from the February 2006 jailbreak alive and on the loose; and

• the web – a highly active ‘Information Section’ receives notice of Jund Al-Yemen attacks very quickly and puts out internet communiqués, framing the action in ideological terms consistent with its focus on the release of prisoners and the expulsion of non-Muslims from the Arabian Peninsula. The Information Section occasionally edits and produces long videos and issues of the online gazette Sada Al-Malahim (Echo of Battles). This capability has proven harder for the government to target.

Three main groups

Beyond this minimal centralised structure, there appear to be three main Jund Al-Yemen cells operational in 2008, each named after a companion of the Prophet:

• Khalid Bin Al-Waleed brigade – a free-ranging group with no specific operating area that is closely tied to Jund Al-Yemen leader Al-Raimi and has been responsible for most of the high-profile attacks on Westerners since 2006;

• Al-Qaqaa Bin Omar Al-Tamimi brigade – a highly active group operating from Aden to Mukalla as well as in the Hadramaut’s Wadi Douan/Sayoun/Tarim corridor. It has undertaken all types of military activities, including the 25 July suicide car bombing of a security force building in Sayoun. Material found in safe houses in Tarim and Mukalla indicated that further suicide attacks were being planned but these were likely to hit security force rather than western targets; and

• Al-Muthanna Harith Al-Shibani brigade – a more localised cell undertaking simple attacks on security forces in Wadi Hadramaut, west and south of Shibam.

Khalid Bin Al-Waleed brigade

Named after one of The Prophet’s most esteemed companions and military leaders, Khalid Bin Al-Waleed has claimed actions in Sanaa, Marb and Hadramaut – Jund Al-Yemen’s three main operating areas. It is most closely associated with Al-Raimi; it has been linked with the 2 July 2007 Bilquis temple suicide vehicle-borne improvised explosive device (VBIED) attack in Marib, which was claimed to be a revenge attack for the deaths of Raimi associates in 2006, to the 18 January 2008 shooting of Belgian tourists in Wadi Douan, and to three rocket/mortar attacks this year in Sanaa: on the United States Embassy (18 March), Hadda compound (30 March) and the Italian Embassy (30 April). Its most recent recorded operation was the 25 June Safer refinery rocket/mortar attack in Marib.

Some cells such as the Sanaa and Marib ends of the network responsible for the July 2007 attack have been entirely destroyed, with all known members other than Raimi captured or killed. Others like the Sanaa rocket/mortar cell appear to have moved location or deactivated for a period.

As recently as Q2 2008, Raimi demonstrated his links to fairly large and well-equipped rural cells. A video of Raimi giving an hour-long lecture showed around a dozen armed militants operating openly in rural wadis; other videos have shown two ‘technicals’ mounting 12.7mm ‘Dushka’ heavy machine-guns and militants firing Katyusha rockets at the Safer refinery. It is Raimi’s group that western security managers worry about most, particularly due to his long-standing focus on western targets in Sanaa (the targets he was convicted for planning to attack in 2002).

The Tamimi brigade

There are many operational linkages, geographic factors and pointers from communiqués to suggest that Hamza Al-Qayti was the driving force behind the Al-Qaqaa Bin Omar Al-Tamimi brigade; he is arguably Yemen’s second most active and dangerous jihadist leader after Al-Raimi. Qayti, an experienced 38-year-old Arab-Afghan veteran with family ties to Mukalla, was imprisoned in Saudi Arabia in 2003 and expatriated to Yemen. He is thought to have been rounded up as a post-Taliban returnee from Afghanistan and was later held by the government until his February 2006 escape with Raimi and 21 others. Qayti’s profile and media exposure was rising at the time his death was reported on 11 August. His death will likely result in fewer high-impact attacks such as car bombings. The Tamimi brigade was the most active Jund Al-Yemen cell, associated with attack claims in three areas:

• Wadi Hadramaut – this area of central Yemen was previously popular with tourists; its foothills and remote areas make up the Masila Basin, which contains oil and gas Blocks 9, 71, 51, 10, 53 and 32. Recent activity included a mortar attack on a Calvalley Petroleum site in (Block 9) on 29 March. This was approximately 130km from the Aynat area where Qayti was killed and may have been outside the group’s usual operating areas. The group mistakenly thought they were attacking a Chinese oil facility in Block 71.

On 22 April, the Tamimi brigade mortared the Central Security Force base in Sayoun, and on 25 July the same compound was struck by a VBIED that killed one CSF trooper and five civilian bystanders. Then on 11 August, Qayti and three associates were reported killed and two others wounded, during a raid on their safe house 30km to the north-east at Aynat, near Tarim. Alongside a small amount of high explosives and LPG canisters, 25 July suicide bomber Ahmed Mashgari’s passport was found in the safe house. A follow-on attack in Wadi Hadramaut was likely planned, as opposed to a long-range strike on Sanaa. Five more militants were captured near Sayoun on 18 August;

• Mukalla area – the Al-Qayti family seat, with considerable militant pedigree since 2001 (including the October 2002 Limburg attack and September 2006 double suicide car bombing against the oil export facilities). The brigade has this year been busily engaged in actions against the security forces in Mukalla: on 26 April, three mortar rounds were fired at an army compound in the north of the city; on 1 March, militants skirmished with police near the stadium; and on 7 August, a hand grenade was dropped on a police patrol car from a highway bridge (no casualties). A safe house was raided in Fuwwah on 15 August, with the capture of a suspected militant and the recovery of explosives, firearms and clothing/cosmetics intended to allow wanted men to disguise themselves as females. The cell was linked to the 7 August attack; and

• Aden-Abyan – the government has undertaken a series of arrest operations to apprehend the individuals involved in attacks in Mukalla and Aden. The Tamimi brigade claimed the 30 May 2008 rocket/mortar attack on the refinery in Little Aden. In early June, it was ascribed responsibility for a small arms and mortar attack on a CSF base in the Zanzibar district of Abyan, 40kmeast of Aden. Since then, 21 individuals have been arrested in relation to “attacks on government facilities.”

Threat pointers

Jund Al-Yemen is mainly active in rural areas, where it is still able to maintain training camps, and many of Yemen’s current threat indicators are emerging from locations far from Sanaa and the vast majority of the expatriate community. Some cells are content to skirmish with the security forces at dusty checkpoints in small towns, and the use of indirect fire against police stations and oil facilities is a tactic that is probably here to stay. Both methods fit the slow-burning style of warfare preferred by most militants in a country where the tradition of limited coercive use of force against the government has a long history.

Aside from the well-known tribal use of pipeline attacks and tourist kidnappings to lever economic concessions from the government, there is an equally strong tradition of coercive bargaining by Islamic militants. The release of detainees is the best most Yemeni Islamists can hope to achieve in their struggle, and this theme is stressed time and again in their communiqués. In the 1990s, the Aden-Abyan Islamic Army (AAIA) undertook a campaign of intimidation against the government offices using rocket-propelled grenades and small arms.

Other elements in Jund Al-Yemen are willing to abandon limited force. The government has been effective in killing and capturing the majority of cell members involved in high-profile attacks. There is strong potential for long-running feuds focused on the security forces rather than westerners. Jund Al-Yemen communiqués increasingly berate security forces as “the soldiers of the idol”, and the use of suicide bombings against the Sayoun CSF headquarters is testimony to the way that security forces are being branded as ‘takfir’ (apostates, who may be killed). On 23 August, Jund Al-Yemen called on fighters to target the security forces to enact revenge for Al-Qayti, stating: “We are afraid that the project of Mujahideen is destroyed before it can obtain its goals.” This is high praise indeed for the Yemeni government effort.

Some Jund Al-Yemen elements want to expel westerners from Arabia – and Sanaa and Marib-based networks associated with Al-Raimi are still the ones to watch. Raimi is potentially the last Jund planner with practical experience of major VBIED attacks. While he lives, it is likely that such networks will plan long-lead VBIED attacks in Sanaa or against oil targets in Marib. This prospect – the ‘single irregular bolt from the blue’, as one security manager described an attack of unusual commitment and effectiveness – remains the key concern.