The September 11 attacks fundamentally reshaped modern counterterrorism doctrine. Out of that transformation emerged what is now known as the Left of Boom approach. Rather than focusing on managing the consequences of an attack (“the boom”), this doctrine shifts the state’s effort toward the preparatory stages of a terrorist plot, before a group or cell acquires the capabilities needed to carry it out. As a result, U.S. intelligence agencies redirected their efforts toward detecting threats at the earliest stages of their development.
Accordingly, the strategic value of intelligence lies in its ability to identify the conditions under which a threat emerges, interpret its early indicators, and disrupt its preparation before it reaches the execution phase.
The recent dismantling by Moroccan security services of a terrorist cell operating across several cities illustrates this approach. Beyond the immediate law enforcement results—arrests, searches, and seizures—the intelligence picture points to a shift away from the traditional inspired cell paradigm. The discovery of components intended for the construction of improvised explosive devices (IEDs), chemical precursors, electronic components, and a modified vehicle, together with technical manuals and pledges of allegiance, forms a correlated body of evidence that reveals a coherent operational design. It is the combination of these elements, rather than any individual item, that identifies an advanced stage of operational preparation.
From an organizational standpoint, the investigation points to a transition toward networked cells. Direct contact with leaders of the Islamic State Sahel Province (ISSP), the successor to ISGS, together with the receipt of operational guidance and logistical support, changes the nature of the security challenge. The available evidence suggests that this cell had moved beyond ideologically inspired radicalization and entered into an organized relationship with ISIS’s Sahel branch, receiving strategic direction, logistical assistance, and operational support.
Stay ahead of the geopolitical week.
MD Briefing delivers expert analysis across five global fronts — the Indo-Pacific, energy, geoeconomics, European security, and the Middle East — every Monday morning. Free.
This development changes the focus of intelligence assessment. The primary target is no longer the isolated radicalized individual but the broader support architecture—recruitment, financing, logistics, communications, and the operational links that connect the different nodes of the network.
Beyond this, this shift reflects Morocco’s own counterterrorism trajectory. The May 16, 2003 Casablanca bombings, carried out by Al-Qaeda-affiliated militants, killed 45 people, including the twelve suicide bombers, and injured more than one hundred others. Those attacks marked a turning point in Morocco’s approach to counterterrorism. Beyond strengthening the legal framework through the adoption of Law No. 03-03 on combating terrorism, they prompted a gradual reorganization of the country’s security architecture.
This institutional evolution led to stronger intelligence capabilities, closer integration between security services and judicial authorities, and, on March 20, 2015, the creation of the Central Bureau of Judicial Investigations (BCIJ) under the authority of the General Directorate for Territorial Surveillance (DGST). The establishment of the BCIJ strengthened the integration of intelligence collection with criminal investigations, creating continuity between threat detection, operational exploitation, and judicial proceedings. This institutional architecture helped shift Morocco’s counterterrorism posture from a predominantly reactive model toward one centered on anticipation, the disruption of terrorist cells during their formative stages, and the preventive use of intelligence.
Since its establishment in 2015, the BCIJ has dismantled dozens of terrorist cells and arrested more than 1,000 individuals linked to jihadist networks. This record reflects an intelligence practice centered on anticipation. The analysis of collected information extends well beyond established organizations. It focuses on identifying the earliest indicators of network formation, recruitment mechanisms, and the interactions capable of transforming intent into an operational terrorist project.
From Criminal Investigation to Intelligence: Reconstructing the Threat Chain
This analytical approach is reflected in three recent operations that, rather than representing isolated investigations, reveal successive layers of the same terrorist ecosystem.
The first dates to February 19, 2025, when the BCIJ announced the dismantling of an ISIS-affiliated terrorist cell and the simultaneous arrest of twelve suspects across nine Moroccan localities, including Casablanca, Fez, Tangier, Laayoune, Guercif, Azemmour, Taounate, Tamesna, and Oulad Teima. The investigation subsequently led to the discovery of a logistical base in the Boudenib area of Errachidia Province, where weapons and ammunition had been concealed. This operation uncovered an externalized logistical infrastructure. The weapons seized had not been acquired locally but originated from an ISIS commander operating in the Sahel, who exploited the poorly governed spaces of the Sahel-Sahara belt to move matériel across borders. The case exposed a transnational supply network linking the Sahelian strategic depth to an operational cell established inside Morocco.
A second layer emerged on March 25, 2026, during a joint operation conducted by the BCIJ, under the DGST, together with the ComisarÃa General de Información of the Spanish National Police. The operation dismantled an ISIS-affiliated cell operating between Morocco and Spain and composed of three extremists. Early findings indicated that the network had been engaged in financing and logistical support for ISIS fighters active in the Sahel and in Somalia.
This operation highlighted another dimension of the terrorist ecosystem: financial flows, secure communications, and cross-border interactions. It also demonstrated that network analysis extends well beyond the identification of suspects. It encompasses financing channels, communication intermediaries, digital platforms, and the distinct legal jurisdictions within which terrorist networks seek to operate.
Beyond its transnational dimension, the case also illustrates that financial support functions may be organizationally separated from operational functions while remaining integrated within the same terrorist architecture without compromising its operational coherence.
The third operation, announced on July 6, 2026, marked another stage in this evolution. Moroccan authorities arrested ten individuals across several cities, including Agadir, Taroudant, Casablanca, El Hajeb, Tetouan, Fkih Ben Salah, and Safi. The information released by investigators revealed a clear functional division of labor involving target selection, reconnaissance, surveillance, procurement of equipment, and operational preparation.
This distribution of responsibilities points to an organizational structure built around two distinct command levels. The first consists of a strategic command exercised by ISIS’s Sahel branch, responsible for defining overall guidance, maintaining organizational cohesion, and providing logistical support. The second consists of a local tactical command, responsible for target selection, reconnaissance, procurement of materials, and operational planning. Such an arrangement increases the resilience of the cell by allowing it to adapt its methods locally while remaining connected to a broader regional organization. In this model, intelligence must do more than identify a chain of command; it must also understand the interfaces linking these two command levels.
The degree of specialization observed, combined with direct guidance received from ISIS’s Sahel branch, points to an advanced level of organizational maturity. It reflects a transition from ideologically inspired mobilization to a structured system of operational support. The cell had moved well beyond the initial stage of radicalization and entered an advanced phase of operational preparation, combining external command, local logistics, target reconnaissance, and the technical means required to carry out an attack.
This organizational pattern corresponds to the characteristics of a Network-Based Model of Terrorism, in which operational functions are distributed among multiple actors while remaining coordinated through a broader network. Under such conditions, neutralizing individual operatives is no longer sufficient. The central objective of intelligence becomes identifying and disrupting the interfaces that preserve the coherence of the network as a whole.
Taken together, these three operations reveal an architecture in which command and logistical functions remain largely anchored in the Sahel, while cells detected in Morocco and operational connections extending into Southern Europe point to the gradual expansion of this threat beyond its original theater.
This capacity for anticipation—grounded in the interpretation of weak signals and the reconstruction of terrorist architectures—has also strengthened Morocco’s position as a reliable intelligence partner within security cooperation frameworks involving African, European, and North American countries.
Intelligence as an Instrument of Strategic Anticipation
Within an environment in which terrorist organizations increasingly rely on decentralized and adaptive structures, the effectiveness of an intelligence service can no longer be measured solely by the number of disrupted plots or arrests. It also depends on its ability to anticipate how terrorist networks evolve and to identify the functions that sustain them before they become operational.
In this respect, the Left of Boom doctrine shifts intelligence priorities from monitoring individuals to identifying the structures that enable terrorist action. The objective is no longer limited to locating potential attackers, but extends to disrupting the logistical, financial, communications, and coordination functions that allow an attack to materialize.
Morocco’s experience reflects this approach through the integration of technical collection, financial intelligence, geolocation, digital exploitation, and human intelligence into a unified analytical process. Intelligence is therefore valued not simply for the amount of information it collects, but for its ability to reconstruct the relationships linking individuals, resources, and operational functions before they converge into an executable terrorist plan.
The growing volume of information generated across the Sahel-Sahara region also raises a broader intelligence challenge. The increasing flow of operational, financial, and digital data requires mechanisms capable of filtering and prioritizing information before it reaches the analytical stage. In practical terms, algorithm-assisted triage and prioritization should be understood as complements to human analysis rather than substitutes for it. Their purpose is to reduce the volume of raw information requiring examination, allowing analysts to concentrate on weak signals and correlations with the greatest operational significance.
This evolution reinforces the role of interpretive intelligence. The value of intelligence lies not simply in collecting information, but in identifying relationships that remain invisible when individual pieces of information are viewed in isolation. Weak signals often acquire their meaning only when placed within a broader operational context. Interpretation therefore becomes an essential stage in transforming fragmented information into actionable intelligence.
In this sense, Left of Boom reflects a temporal logic: intervening before an attack occurs. Interpretive intelligence, by contrast, reflects a methodological logic: understanding the architecture of a threat early enough to make such intervention possible. The two approaches are complementary. The first defines when to act; the second explains how intelligence makes that action possible.
The three operations examined here indicate that the center of gravity of the terrorist threat has gradually shifted toward the Sahel. This does not suggest that terrorist organizations intend to reproduce within Morocco the operational models observed in Mali or Burkina Faso. Rather, it indicates that the Sahel has become a logistical, financial, and organizational depth from which operational cells can be supported well beyond their original theater.
Therefore, the challenge extends beyond dismantling terrorist cells operating within national borders. It requires reconstructing the links connecting command structures, logistical chains, financial networks, and local facilitators in order to assess the maturity of a terrorist project before it reaches the operational stage.
The Sahel has consequently become a strategic space whose evolution directly affects the security of North Africa and the Western Mediterranean. For intelligence services, the central challenge is no longer limited to information collection. It lies in connecting information originating from different geographic areas, actors, and timelines in order to reconstruct a coherent picture of the threat.
The three operations further point to what may be described as Functional Territorial Dissociation. Under this organizational model, the principal functions of a terrorist organization—command, financing, logistics, recruitment, and operational execution—are distributed across multiple geographic spaces while remaining integrated within the same operational architecture. Strategic command may remain in the Sahel, financial support may move through another jurisdiction, logistical capabilities may be established elsewhere, while the operational cell functions inside a different country. This geographical distribution increases organizational resilience while complicating detection and disruption by intelligence services.
As a result, the value of intelligence lies in its ability to reconstruct this dispersed architecture before its different functional components converge into a single operational project. The three operations discussed here demonstrate that the security dynamics emerging in the Sahel are no longer confined to that region. They increasingly affect the broader Euro-African security space and underscore the need for intelligence services to adapt to terrorist organizations whose operational functions now extend well beyond the borders where attacks may ultimately occur.
Seen through this lens, the geography of terrorism no longer mirrors the political geography of states. Command structures, logistical networks, financial channels, and operational capabilities are increasingly distributed across different territories before converging toward a common objective. As a result, one of the defining challenges of contemporary intelligence lies in its ability to reconstruct this fragmented architecture before it becomes operational. In an era of networked terrorism, strategic advantage depends less on reacting to attacks than on understanding how dispersed functions become integrated into a coherent operational system.
