Daesh in northern Lebanon: What do we really know?

Security information published on 20 July refers to the presence of approximately 300 ISIS fighters in northern Lebanon. The same article states that an alleged leader of the group was arrested. This is a serious figure, but it alone is not an official and verified statement. No public communiqué from the Lebanese Army, the Internal Security Forces or the judiciary confirms the existence of a 300-man structured force in this area. On the other hand, there is evidence of increased surveillance, targeted arrests and special attention to movements between Syria and Lebanon. The question is not therefore to deny a possible threat. It consists of establishing what the estimate covers, which are the people counted, and what evidence could be used to talk about an organised network.

An estimate without detailed method

The figure appears in an article on President Joseph Aoun’s visit to Washington, regional tensions and movements observed near the Syrian-Lebanese border. The newspaper reports that several services monitor entrances and exits, particularly in the North. He then attributed to security sources the estimate of about 300 Daesh fighters in that part of the country. He adds that one of their officials was arrested.

This formulation requires several precautions. The newspaper does not mention the organization that gave the evaluation. It does not specify the date on which the figure was established, the exact geographical area covered or the method of calculation. Nor does it indicate whether the persons concerned are all in Lebanon at the same time. The term « combatants » can therefore cover very different profiles.

In intelligence, an estimate may aggregate identified individuals, suspects, contacts, facilitators or persons reported at border crossings. It may also include members living in Syria but likely to use roads to Lebanon. Without a public definition, the number of 300 does not indicate the presence of 300 armed, consolidated and operational men in the North.

However, the information remains serious enough to call for verification. It is published in a context of strong regional tension. The Lebanese services are following the repercussions of the clashes in Syria and the movements on a long, mountainous and difficult-to-control border. Therefore, caution does not mean that the figure should be set aside. It requires that it not be transformed into certainty before official confirmations.

The arrest of a person responsible is confirmed

A specific fact is officially established. On 13 July, the Internal Security Forces announced the arrest of a Syrian national as a senior security official of the Islamic State organization in Syria. The inquiry had taken place on 30 June, following a monitoring operation conducted by the Information Division.

According to the press release, the suspect held the position of « emir general » in charge of the security of two so-called provinces of the organization, those of the South and the Centre in Syria. The investigators assign him several previous command posts. They claim that he supervised security activities and worked with other ISIS officials in Syrian territory.

This arrest confirms that the group’s cadres may be in or circulating in Lebanon. It also demonstrates that Lebanese services have monitoring and infiltration capabilities. However, it alone does not prove the presence of a network of 300 fighters in the North. The press release does not publicly locate the place of arrest. He does not say that the suspect commanded Lebanese cells or that he was planning an attack on the territory.

Distinction is essential. A Syrian leader may use Lebanon as a place of passage, withdrawal, logistics or clandestine residence. It can also maintain local contacts. Each of these assumptions has a different level of threat. Only the judicial investigation, the operation of its apparatus and the identification of its relations will determine the actual extent of its activity in Lebanon.

What does the word « combatant » mean?

The term used in the estimate is central. A fighter is normally a trained person, integrated into a structure and available to conduct operations. In counter-terrorism cases, however, the categories are less clear. Authorities can monitor radicalized individuals without evidence that they belong to a cell. They can also follow logisticians, smugglers, recruiters or money collectors.

A security list can include active members, veterans returning from Syria, suspected supporters and individuals whose status remains uncertain. It may also include duplicate names, persons who have died, were detained or were taken to another country. The services normally revise this data as surveys progress.

The difference is not only statistical. Three hundred organized combatants would represent a significant military capability. Three hundred people reported or under surveillance would describe a much more diffuse reality. This second situation would remain a matter of concern, but it would not mean that an underground army would control northern neighbourhoods or rural areas.

The vocabulary can also vary between services. An organization may qualify as a member any person who has lent allegiance. Another will require evidence of operational participation. A third will account for family and logistics networks around suspects. To assess the threat, it is therefore necessary to know the definition used, the degree of reliability of each case and the proportion of people actually located.

A difficult border to monitor

Northern Lebanon does not form a uniform space. It includes Tripoli, Akkar, the coastline, mountainous areas and a border that extends to the northern Bekaa. Official roads concentrate on controls, but many agricultural and informal roads cross steep terrain. Some roads have long linked villages, families and commercial activities on both sides.

These characteristics facilitate illegal movement. They are used to smuggle goods, fuel, weapons or narcotics. They can also be used by wanted persons. This does not mean that every informal passage belongs to a terrorist organization. The same roads are used by workers, refugees, residents and traffickers without ideological ties to Daesh.

Monitoring is therefore based on several levels. The army holds posts, organizes patrols and installs temporary dams. Intelligence services monitor communications, travel and relations between suspects. The Internal Security Forces are conducting spinning and arrest operations. General Security controls documents and movements at official crossing points.

Coordination with the Syrian authorities is also becoming more important. The cells of the Islamic State organization remain active in Syria despite the loss of their territory. Fighters may attempt to join support networks, hide or cross the border. The effectiveness of cooperation depends, however, on the quality of information exchanged and trust between the institutions.

Not all arrests concern Daesh

The army announced on 16 July the arrest of 33 people during security measures in the North. Operations included searches, motorized patrols and dams. Five Lebanese citizens were arrested for firing or holding weapons. Twenty-eight Syrian nationals were arrested for circulating without regular documents.

This assessment shows a safe mobilization, but it must not be reinterpreted. The military statement does not attribute any of these arrests to Daesh. The offences cited relate to individual weapons, shooting and irregular residence. Assimilating these 33 people to a terrorist network is now false.

This distinction is all the more important as administrative or document-related arrests can affect a large number of Syrians. The irregular presence does not constitute proof of membership in an armed organization. Similarly, possession of a pistol or shooting in the air can be an ordinary crime, without connection to a terrorist project.

However, investigations may later reveal other facts. Telephones, travel, money transfers and contacts are examined under the control of the judiciary. When a link to an organization appears, the authorities must document it in an individual file. Without this step, the combination of security, immigration and terrorism weakens the quality of information and exposes entire populations to suspicion.

A threat that can take several forms

The existence of a network is not only measured by the number of people. A few individuals with weapons, explosives and targets may pose immediate danger. Conversely, a larger but dispersed group, monitored and deprived of resources may have a reduced capacity. Services therefore assess intentions, resources, hierarchy and readiness.

An operational cell typically has secure communications, meeting places, caches and a chain of command. She searches for weapons, collects money and performs reconnaissances. The presence of manuals, explosives, plans or coordination messages is a stronger indication than a simple contact on a courier.

A logistics network performs other functions. It can provide accommodation, false documents, vehicles or itineraries. People can help for money without sharing the group’s ideology. Justice must then determine their knowledge of the project and their actual intention. This difference counts for the criminal qualification.

Finally, a movement of supporters can spread propaganda or try to recruit. It may not have immediate action capacity. However, it can facilitate the transition to the act of an isolated individual. Digital surveillance and proximity work then become essential to detect an evolution towards the preparation of an attack.

The security past of the North

The North has already faced armed groups and jihadist networks. The fighting in Nahr al-Bared in 2007 opposed the army to Fatah al-Islam. Tripoli then experienced cycles of confrontation, arrests and departures to Syria. The battle of Ersal in 2014 showed the ability of groups from Syria to cross the border and capture soldiers.

This past explains the sensitivity of the services to any signs of reconstitution. It justifies sustained monitoring of old networks, funding channels and clandestine routes. However, it does not allow poor neighbourhoods, camps or Sunni areas to be regarded as collective centres of terrorism.

Armed organizations are specifically seeking to exploit social divides. Unemployment, marginalization, overcrowding and the lack of public services can facilitate recruitment. An exclusively police response is therefore not sufficient. It must be accompanied by justice, schools, municipalities, associations and religious authorities.

The risk of collective accusation can produce the opposite effect of the one sought. Arbitrary arrests or generalizing speeches can increase distrust of the state. They also complicate the collection of information, as residents are reluctant to report disturbing behaviours. Local cooperation remains one of the most effective ways to identify dangerous individuals.

Justice must individualize responsibilities

Any person arrested shall be presumed innocent until a final judicial decision is taken. This rule remains valid in cases of terrorism. Services may have confidential information to justify monitoring or arrest. However, the conviction requires admissible evidence and a clear link between the suspect and the alleged facts.

Investigations must establish identity, role, duration of involvement and acts committed. They must distinguish ideological adherence, material support, funding, recruitment and participation in an operation. These qualifications entail different responsibilities. They also prevent an overall figure from replacing the examination of files.

Judicial oversight protects the rights of suspects, but it also strengthens the credibility of the fight against terrorism. A robust procedure resists disputes and allows network dismantling based on verified elements. Undocumented arrest can, on the contrary, lead to release and undermine related investigations.

Another issue is the length of pretrial detention. Lebanon is experiencing significant judicial delays. Maintaining people for years without trial feeds tensions and blurs the difference between suspects and convicted. Armed organization files require chambers capable of processing technical evidence and testimony quickly.

What the arrest can reveal

The inquiry announced by the Internal Security Forces could provide important information. Investigators will likely seek to reconstitute the suspect’s movements, residences, contacts and financial means. They will also examine its phones and associated digital accounts under judicial authority.

If humans had contacts in the North, these data could confirm the existence of facilitators or cells. They could also show that Lebanon was being used as a transit space without an important local structure. Both scenarios remain possible on the basis of available public elements.

The authorities will also have to establish the conditions for its entry into Lebanon. An official passage with false documents, a clandestine crossing or an old installation does not involve the same flaws. This information would help to adapt controls and identify potential accomplices.

The official communiqué remains voluntarily limited. It protects the investigation and the operations that may result from it. This discretion is normal in an active file. It means, however, that the broader claims on the number of combatants cannot be publicly deduced from the arrest alone.

What evidence would confirm the number?

An official confirmation should first specify the perimeter. The authorities should indicate whether the estimate covers only the northern governorate, Akkar and Tripoli, or a broader set including the eastern border. They should also indicate whether individuals are in Lebanon, whether they are travelling between two countries or whether they are only linked to networks monitored from Lebanon.

The second confirmation would cover the categories. How many are considered active members? How many are supposed supporters? How many were identified by their names? How many are under a warrant, investigation or surveillance? Without this breakdown, the overall number remains impossible to interpret.

Seizures would provide material evidence. Weapons of war, explosives, belts, detonators, target plans, flags used in a structure, bottoms or apparatus containing orders would establish an organized capacity. Their mere presence should still be linked to specific people and a chain of command.

Judicial decisions would finally be the most robust level of confirmation. Indictments, reasoned warrants and judgements would allow for knowledge of roles and facts. The authorities could also announce the dismantling of separate cells, with their composition and area of activity, without publishing details likely to compromise other operations.

A figure yet to be established

At this stage, information on 300 Daesh fighters in the North must be presented as an estimate attributed to security sources. It is not publicly confirmed by a detailed review of the institutions. The only element directly linked to the organization and officially announced is the arrest of a senior official alleged to be active in Syria.

Other recent operations show sustained security activity, but their press releases do not indicate a link to Daesh. They concern shooting, individual weapons or the absence of regular documents. Integrating them automatically into the estimate would create a misleading image of the threat.

Journalistic prudence therefore consists in maintaining two observations at the same time. An underground organization can have invisible networks, and the services have good reason to track movements in the North. But an unexplained figure should not lead to the designation of 300 persons as terrorists without individualized evidence.

Future confirmations could come from a joint communiqué, a series of reasoned arrests, seizures of weapons or judicial decisions. They could also lead to a downward revision of the estimate or a distinction between several categories. The investigation into the official arrested on 30 June is now one of the main issues that could shed light on the real extent of the connections between Syria and northern Lebanon.