On May 27, the U.S. Department of Justice announced that Muhammed Momtaz Al-Azhari of Tampa, Fla., was charged “with attempting to provide material support or resources to a designated foreign terrorist organization, namely, the Islamic State of Iraq and al-Sham (ISIS).” The announcement provided an overview of the charges and gave appropriate praise to the agents working to mitigate the threat this individual posed. However, it is when reading through the affidavit that the full extent of Al-Azhari’s actions are realized (all case details presented here are FBI allegations in the criminal complaint). Al-Azhari had a criminal history that includes prior terrorism charges in Saudi Arabia, had acquired multiple firearms in recent months, was an admirer of the 2016 Pulse nightclub shooter, and expressed a desire to carry out a similar act of violence. He also researched and scouted potential targets in the Tampa area, to include beaches and other public locations. Some of these pieces of information were obtained through FBI discreet investigative actions, but others were observed and reported on by other individuals. And in this instance, the process of removing a threat worked.
Whether knowingly or not, threat actors conduct a series of actions that we term the Hostile Events Attack Cycle (HEAC). This process allows threat actors to identify, plan, and execute an attack. In some instances, this will also involve an escape. This process also allows organizations to potentially identify times in which threat actors are vulnerable and could lead to disruption or mitigation. Looking at this specific case and overlaying the HEAC can be a useful way to appreciate and call out examples to enhance training for employees. This attention could provide increased awareness for the organization and work to reduce the risk to an organization.
It is also of note that Al-Azhari’s sister was killed by police officers outside of Temple Terrace City Hall in Florida on May 29 after pulling a knife on an officer.
Phase 1 – Initial Target Consideration. In this phase, it is not essential for the threat actor to settle on a target location, but to begin that process to identify potential locations that will impact the rest of the planning and preparation. While there is no indication that Al-Azhari communicated with ISIS, or formally swore to or pledged allegiance to the group, he had a clear affiliation to the group. He was captured on FBI electronic surveillance as stating, “I pledge allegiance to Sheik Abu Ibrahim al-Hashimi when you consider what I’m about to do,” but there was no official allegiance video sent to the group or any affiliates. Abu Ibrahim al-Hashimi is recognized as the current leader of ISIS. Based on his search results, it would be a fair assessment to conclude Al-Azhari was planning a lone-wolf, mass shooting.
Related to a motive, FBI electronic surveillance captures two instances. In one, Al-Azhari is heard listening to a recording that stated, “This is a revenge for Muslims.” In the second instance, which appeared to be a rehearsal for a hostage type of attack, he made a video in which he states: “God willing, the exalted. This is revenge for my brothers Al Muwahideen [the monotheists] in Guantanamo in general, and for my brother [redacted] in particular. God willing, he may be praised and exalted. God willing, this is a revenge for all my Muslim brothers in Iraq and al-Sham [Syria] and everywhere.”
Phase 2 – Initial Surveillance. During the investigation, the FBI was able to determine Al-Azhari searched online for various hotels, casinos, major pedestrian areas, resorts and amusement parks, “busy beaches,” and state parks. Additionally, Al-Azhari searched for concert houses, which the FBI assessed was a reference to the November 2015 Paris complex coordinated terrorist attack, during which the Bataclan theater was attacked during a concert. Connecting with ISIS ideology and tactics, it would be reasonable to believe that Al-Azhari recognized the potential impact a similar attack could have as part of his planning considerations. It was also noted in the affidavit that Al-Azhari listened to various propaganda pieces and speeches that included strong language and inspiration, notably, “To fight the kuffar [disbelievers/non-Muslims] and to leave marks on them by defeating them to satisfy the hearts of the true believers.”
Phase 3 – Target Selection and Phase 4 – Intense Surveillance. Despite indicators that suggest Al-Azhari may have narrowed his search, there does not appear to be conclusive evidence that he made a final determination on a specific target. It is notable that he did make a two-hour round trip to Honeymoon Island State Park “without actually stopping or leaving his vehicle.” The FBI felt this was a strong indication that he was assessing this location for a possible attack. Additionally, he conducted additional searches on public places and beaches, which could indicate additional potential targets.
The goal of Phase 3 is for the hostile actor to take all the information gathered to this point and to decide on the ultimate target. The hostile actor will be able to conceive when the attack could occur, the type of security, and the amount of impact the attack will have, which will drive the actions of Phase 4 (Intense Surveillance). Building upon the initial surveillance, the phase will include additional surveillance that will go into more detail and could involve a lot more “time on target,” or time spent observing and getting to know the target in-depth. This allows the hostile actor to learn as much as possible and help lock down the attack plan and any unknowns in order to make sure the attack can accomplish the goals. Taking all the information developed to date, the attacker will formalize the plan and begin to build the various phases of the attack/pre-attack, to include logistics planning, actions at the target, and post-attack (escape/evasion/death).
Phase 5 – Planning and Rehearsals. Without question, this is the most extensive aspect of what we know about the hostile actor and what he may have planned. With the benefit of electronic and physical surveillance techniques employed by the FBI, it was well established that Al-Azhari had conceived the general plan and was readying himself for action.
- He actively attempted to acquire firearms and ammunition for his plan, ultimately collecting three weapons from various locations. He also searched for solvent traps (firearm cleaning systems), and silencers.
- He sought out firearms and self-defense training. This in and of itself may not be a reportable incident, but when considered with all other indicators it does raise the potential threat.
- He actively searched for firing ranges.
- He looked up information related to “how to find a GPS tracker on your vehicle” as well as conducted several surveillance detection measures when he was under FBI surveillance. These measures included Al-Azhari executing routes that may have been designed to identify potential surveillance. He was obviously a novice, as the FBI was still able to track him during these periods without being identified.
- Al-Azhari conducted several searches for disguises.
- FBI electronic surveillance captured Al-Azhari rehearsing various phrases including:
- “Know America. Today is your emergency. Today we kill from you guys like you killed from us. I pledge allegiance to Sheik Abu Ibrahim al-Hashimi when you consider what I’m about to do.”
- “This is custom, USA, inshallah [God willing], I shoot, inshallah.” Al-Azhari was also captured reciting verses from the Quran: “Do they not then earnestly seek to understand the Quran, or are their hearts locked up by them? Those who turn back as apostates after Guidance was clearly shown to them- the Evil One has instigated them and busied them up with false hopes. This, because they said to those who hate what God has revealed, ‘We will obey you in part of (this) matter’; but God knows their (inner) secrets. But how (will it be) when the angels take their souls at death, and smite their faces and their backs?”
- Al-Azhari also made videos that may be a dry run of his attack:
- He was observed singing as he showed off his guns. “We have a local (which could mean ‘homemade’) silencer and the bullets are 9mm. To raise to the highest levels is a must for every crusader. This is 9mm, thank God. Will be used against God’s enemies. And this .22. Of course, .22 of a hundredth of inches, not millimeter. I ask God the almighty to enable me and give me a duty that God will be happy with, and God is able to do that.”
- Another video depicts him wearing a face mask, holding a long weapon (possibly an Uzi) pointing the gun. He appears to address an audience of potential victims, speaking in both in English and in Arabic as he praises Allah and talks about revenge for his “brothers” in Guantanamo, Iraq, Syria and everywhere.
The last three phases of the HEAC were not realized because of the arrest of Al-Azhari; however, these areas are still worth reviewing as if he were to have continued his timeline.
Phase 6 – Pre-Attack Operations. This phase is focused on ensuring supplies and equipment are ready for the attack. Based on known information in the affidavit, it appeared that Al-Azhari had accumulated the weapons for his attack, but it does not appear that any additional supplies were gathered. This may indicate that the actual attack was not immediate, but also that additional supplies were not necessary. This phase is one of the less defined and more flexible elements of the Attack Cycle in that the attacker will need to do their pre-attack checks and inspections to ensure all the pieces of the attack are prepared and ready. Additionally, the threat actor will start to focus on their own internal preparation in order to get mentally prepared for what is to come.
Phase 7 – Attack and Phase 8 – Escape. The attack obviously represents the culmination of all the planning and preparation and will ultimately define the hostile actor moving forward. Meanwhile, the escape is a phase that may never be realized or carried out by all threat actors. Some attackers will plan for the escape, while others may accept that their calling will be to sacrifice their life in the execution of the attack and in an effort to make it successful. And some attacks will plan for an escape but will not be able to complete that action based on law enforcement or security responses.
In this particular case, there is no indication that Al-Azhari planned to escape. That does not mean he did not plan for an escape, but rather that none was noted in the evidence. However, based on the evidence, it is believed he planned to target a public location with an ability to inflict a maximum amount of causalities. He may have planned a hostage type of situation (as described in various videos he took during Phase 5), which may not always allow for an escape situation.
Suspicious Indicators. Hindsight is always 20/20, and especially in this case where there was a significant amount of electronic and physical surveillance actions taken by the FBI to reveal some of the deeper-seated issues in the case. However, there were some indicators that may have been evident in interactions with other individuals – coworkers, associates, or friends. Normally, family may also be in a position to identify suspicious activities and behaviors, but the affidavit revealed that Al-Azhari’s father may have been arrested with him in Saudi Arabia and would likely not be in a position or may not be willing to report on a family member.
- Previous arrest/conviction. Al-Azhari was convicted in Saudi Arabia of terrorism charges involving a plan to travel to Syria to participate in jihad and to join terrorist groups fighting the Syrian government. The conviction included possession of extremist propaganda, holding extremist views, and attempting to join a terrorist organization, namely Jaysh al-Islam. The conviction also accused him of conspiring with two other individuals, including his father, to commit those crimes and he was sentenced to serve three years in prison in Saudi Arabia.
- Online Activity. This included searching for and participating in websites, forums, chatrooms that discussed the Islamic State (ISIS), ISIS activity, and tactics related to attacks. It is likely that most of these activities occurred when Al-Azhari was alone, but it is not beyond reason to believe a person may not have stumbled upon Al-Azhari reviewing these materials in some sort. These include:
- Website that hosts unofficial propaganda and photographs related to ISIS, news updates related to the group, and blogs on how to donate to the group.
- Materials containing information on military operations carried out by Caliphate fighters in Iraq, Syria, and Nigeria.
- Sites containing information on ISIS fighters, martyrs, and propaganda. It is also worth noting that he had also downloaded a video related to the “perversion of al Qaeda,” which may indicate he was actively deciding which group he was going to align with.
- Links to training videos including street fighting, urban warfare, improvised explosive devices (IED), poison.
- Training to make IEDs or other explosive devices.
- Co-worker Observations. Some of the employees at Home Depot had expressed concern about statements that Al-Azhari had made concerning Islam, guns, and violence.
- One employee said Al-Azhari often spoke of Islam at work and conveyed views that were passionate and aggressive. In reference to the 9/11 attacks, Al-Azhari said he believed that Americans got what they deserved that day.
- Al-Azhari spoke to another co-worker about the concept of jihad, which was explained as defending Islam.
- Al-Azhari informed one employee he had kept a 9mm handgun in the center console of his car and that he had shown the employee the gun one night during a work break.
- In one incident, Al-Azhari noticed police vehicles parked outside of the store and became anxious and constantly looked out of the front window and doors. Al-Azhari told an employee that he needed to go home. Before leaving, he gave the employee two names and phone numbers, telling the employee to contact those people if he got arrested after he left work.
- An employee told corporate security that Al-Azhari openly tried to convince employees to share his religious belief.
- An employee noted that that Al-Azhari spoke negatively and passionately about the U.S. and homosexuality.
- When discussing guns with an employee, Al-Azhari said that he did not want to undergo a background check for firearms and that he would grind the serial number off a gun.
- Al-Azhari discussed his imprisonment in Saudi Arabia with an employee.
- Another employee told corporate security that Al-Azhari asked several questions about weapons – specifically, how to obtain a firearm, how to obtain a firearm suppressor and how another employee had claimed Al-Azhari had once pulled a firearm on a different co-worker while at work.
- Interest with Previous Mass Shootings/Shooters. Al-Azhari had strong beliefs about homosexuality and appeared to have a strong interest with the Pulse nightclub shooting, which resulted in the deaths of 49 people in June 2016. In addition, he appeared to have interest in Omar Mateen. Taking all of this into consideration, as well as the upcoming Pride month activities and Pulse nightclub anniversaries, it is possible Al-Azhari could have been targeting an event that would coincide with these events. Anniversaries and symbolism can play an important role for threat actors, especially ones tied to strong ideologies. Some of the below were observed from FBI surveillance activities, but nonetheless could have been manifested in other aspects of his life, for example in employee conversations, as noted above.
- Search for cemetery where the Pulse nightclub shooter, Omar Mateen, is buried.
- An image captured on his phone with the word “USA” written in the sky, likely by an airplane. The words “Oh Allah destroy” appeared handwritten on a white piece of paper that was being held above “USA,” with palm trees visible in the background.
- A search for Pulse nightclub on multiple occasions followed by an image on Al-Azhari’s phone that captured several photos of the Pulse nightclub in Orlando.
- A search for a YouTube video titled “Police release audio of 911 calls made by Orlando nightclub shooter” as well as a screenshot with a text transcription of Omar Mateen’s 911 calls from the Pulse shooting.
- Physical surveillance that followed Al-Azhari driving by the Pulse nightclub at 2 a.m., which is notable because that is the time when the Pulse attack occurred.
As noted above, identifying suspicious incidents or behaviors may help disrupt or mitigate the potential for a hostile event. Incorporating these examples into organizational training can help show the importance of being alert and aware, and then knowing how to report suspicious incidents or behaviors for appropriate intervention. This means that organizations help establish the conditions and processes that can work towards ensuring the safety of you and your colleagues. DHS’s pathway to violence looks at:
- Being aware of drastic changes in attitude toward others.
- Taking note of any escalations in behavior.
- Providing any information that may help facilitate intervention and mitigate potential risks.
HEAC remains one of the most dangerous and disruptive events an organization or community can face. With all the recent focus rightfully on the health crisis, and recovery, we are still only a year removed from some of the worst mass shootings in U.S. history, and certainly the worst mass shootings in a short period of time around the world. With everything else going on, it can be easy to overlook this deadly threat. Planning and preparedness is a continuous process and prevention cannot be passive.