Intelligence officials are concerned that ISIS is now striking foreign targets in a sequence that may include Germany, the U.K. and the U.S., NBC News has learned.
ISIS attacks have killed more than 500 people outside its Syria and Iraq-based caliphate in the past two months, including more than 100 victims in France, 224 in a Russian plane above Egypt's Sinai Peninsula, more than 100 in Turkey and almost 40 in Beirut. On Tuesday, German police evacuated a stadium in Hanover where the German and Dutch national soccer teams were about to play because of what officials called a "concrete" tip about a planned bombing.
Officials believe the terror group's strike in Paris might be part of a systematic attack on Western powers that have launched, aided or endorsed military strikes against ISIS targets on the ground. They also say they are watching for signs that individuals or a group with greater operational abilities, meaning bombmaking and terror plotting, is either aiding ISIS or has joined forces with the organization.
On Monday, CIA Director John Brennan said that ISIS had "developed an external operations agenda that it is now implementing with lethal effect. … This is not something that was done in a matter of days. This was carefully planned over the course of … several months." Brennan also said, "I would anticipate this is not the only operation that [ISIS] has in the pipeline."
The U.S. counterterrorism community believes, based on intelligence and not just ISIS claims, that the terror network is now actively engaged in exporting terrorism worldwide as a way of expanding its global footprint and establishing a religious caliphate.
ISIS is also targeting a variety of powerful enemies at the same time, including the European allies of the United States, but also Russia and even Hezbollah, the Shi'ite (terrorist) organization aligned with Syria that U.S. intelligence officials believe at least a corollary target of a recent attack in Beirut.
"ISIS has, for whatever reason — whether because they are taking some hits in Iraq and Syria — has made a significant turn to focus on external operations," said one senior U.S. intelligence official. "That's what we're seeing in terms of Sinai, in terms of Beirut and certainly in terms of Paris." The official spoke on the condition of anonymity because of an administration-wide ban on discussing ongoing counterterrorism operations.
The official said that the U.S. and allied intelligence agencies don't know what precipitated the change in focus, but said that it appears to have been in the works for far too long to be a response to some minor losses in territory that ISIS has suffered in recent months in patches of Iraq and Syria.
Instead, the shift appears to be strategic, which is of even more concern to Washington because it suggests that more well-planned attacks might be in the planning or even operational stages.
"I think this is a splendid way of ISIS raising its banner, reinforcing the establishment of the Caliphate and attacking the US and the West, Russia, and the Egyptians as way of saying, 'Look all you disgruntled people in the Middle East and the Muslim World, we're the game. We're the guys. It's not al Qaeda, it's not anyone else. It's us."
A second official said early analysis indicates the attacks are part of ISIS's growing capabilities as it adds experience and personnel. "Call it the benefits of recruiting," he said.
The CIA, Pentagon and other U.S. agencies are scrambling to determine whether any ISIS operatives have penetrated U.S. defenses and are trying to launch attacks on U.S. soil. So far, there is little if any evidence of that, but authorities are mobilizing quickly to harden U.S. targets overseas such as embassies and multinational corporations.
Douglas Ollivant, former director for Iraq at the National Security Council during both the Bush and Obama administrations, said he doubted that ISIS could launch attacks on U.S. soil for several reasons, including the success of a multiagency U.S. effort to harden the borders. Also, he said, the United States doesn't have the same large populations of disaffected Muslims from South Asia and North Africa who have traveled to Syria and Iraq as many countries in Europe and Asia.
"If you are overseas, you may want to be concerned, especially in the Middle East or Europe," Ollivant said. "In the U.S., not so much."
Counterterrorism authorities are also scrambling to determine who within ISIS has the operational expertise displayed in the simultaneous Paris attacks and the Sinai plane takedown.
Some of the suspects include a possible alliance with al-Qaeda and its offshoots such as al-Nusra Front, or Jabhat al-Nusra and possibly also Khorasan group. One official expressed skepticism about any alliance between terror groups, but wouldn't dismiss the notion that individual jihadis could have joined the fight. "It's an open door policy," said the official. There may have been some "isolated" cooperation tactically in Syria, said the official, but "no hugs yet."
But the senior U.S. intelligence official said the recent attacks raise concerns about one worst case scenario that the CIA has long feared — that senior military officers from Saddam Hussein's vaunted Baathist Party are leading ISIS efforts to attack the West.
One of the biggest strategic blunders of the Iraq war was the Bush administration's demobilization of the Baath party's military and police agencies in 2003, which created a vast reservoir of men who were heavily armed, well-trained, bitterly resentful and unemployed. In recent years, authorities have gathered evidence that some of these men, including former senior Baath party military officials, have not only joined ISIS but have provided training and strategic operational guidance to the terror network that have helped it take so much territory in Iraq and Syria.
Officials fear that ISIS is now using that kind of operational military capability to launch overseas attacks, and to hide such operations from the many counter-terrorism and military agencies trying to contain it.
"Former majors, lieutenant colonels and in the various branches of Saddam's security establishment are now very senior members of ISIL, or advising the people who are," he said, using another name for the terror network. "They are embedded in the org. What they are doing for them, we don't know. Whatever ISIL asks of them."