During 2014-15 Isis was building a three-level structure: a state-like core entity in Syria-Iraq, external territories in other countries, and an ad hoc global network of supporters and sympathisers, which I began calling the “Isis Internationale.”

Isis Overseas Territories, 2015

By mid-2015, Isis had been established in separate provinces in Libya, as well as in Algeria, Tunisia, Egypt’s Sinai desert, Yemen, Saudi Arabia, Afghanistan–Pakistan (Khorasan), Nigeria, and the Caucasus.

There were also numerous Isis wilayat within the core Isis territory in Syria–Iraq, acting as administrative subdivisions of the Islamic State.

Despite a superficial similarity to the Al Qaida (AQ) “franchises” that still existed in some of the same areas, Isis wilayat were different in concept and purpose.

AQ’s franchises were guerrilla or terror groups operating in their own way, in their own region, furthering their own interests but as part of a global insurgent strategy – a confederation of independent groups, united not by a parent political entity, but by the informal AQ “aggregation” model that disaggregation was designed to destroy.

By contrast, Isis wilayat were more like overseas provinces of an empire, or colonial possessions of a nation state, pursuing the parent state’s interest even at the expense of their own agenda. The term wilayat (meaning governorate, province, or authority) was used under the Ottoman Empire and older caliphates to describe provinces, each with a governor (wali) exercising day-today authority under the suzerainty of the caliph.

This isn’t the only way the word can be used – wilayat also means “authority” in Shi’ism and Sufism, for example – but this is the sense in which Isis understands it. Isis wilayat were formal territorial, legal and political entities within the caliphate, with defined borders and populations, administered by governors appointed or approved by Isis leader Abu Bakr al-Baghdadi, governing in line with Isis policy, and conducting operations within a well defined set of strategic guidelines.

As of late 2015, the wilayat also acted as catchment areas for flows of fighters trying to join Isis but unable to make it all the way to Syria or Iraq, as rally points for recruits wanting to bring Isis to their own countries, or for fighters returning from Syria-Iraq. Most importantly, they were bridgeheads-in-depth – outposts behind enemy lines that distracted Isis adversaries from the main fight in Syria-Iraq, diverted resources that might otherwise have been used against the caliphate, and mounted attacks to support Isis offensives or relieve pressure on its defences.

The wilayat could also serve as points of attraction for disillusioned members of rival groups. This may have been what happened in the worst Isis inspired attack on Western civilians to occur in the first half of 2015 – the massacre at Sousse, in Tunisia.

Since the fall of Zine el Abidine Ben Ali’s regime at the very outset of the Arab Spring, Tunisia had made huge progress toward democracy, making it a bright spot among the failures of the wider regional protest movements. But there were danger signs: secular democrats weren’t the only ones opposed to Ben Ali.

Islamic state fighters dismantling the border between Syria and Iraq in 2014. Photograph: Medyan Dairieh/Zuma Press/Corbis

As in the other Arab Spring uprisings, Salafi-jihadists had a very different idea of post-revolutionary Tunisia from that of the people power movements. They organised Ansar al-Sharia (AS, “supporters of Islamic law”) in April 2011, a loose movement of like-minded groups with chapters in Yemen, Mali, Egypt, Mauritania, Morocco, Syria, Egypt and Libya.

AS Tunisia (AST) focused on propaganda to society at large, as well as vigilantism against individuals whom the group saw as transgressing Islamic norms.

In May 2012, AST held a major rally in the town of Kairouan, calling for the Islamisation of all aspects of Tunisian society. Over the next year, the group ratcheted up the violence – something its leaders (including its founder, Seifallah Ben Hassine) could get away with at first, since they practiced a form of leaderless resistance that let them avoid responsibility for supporters’ actions.

But this pose – unconvincing from the outset – was impossible to sustain. In September 2012, Ben Hassine led a mob that stormed the US Embassy in Tunis, in a riot that left four dead and forty-six injured. The pretext was a YouTube video, “The Innocence of Muslims”, which AS branches exploited to incite similar protests in Egypt, Sudan, Yemen and India, using social media to manipulate public outrage and trigger deadly riots.

These also provided background cover for Al Qaida in the Islamic Maghreb (AQIM) and AS Libya’s pre-planned assault on the US facility in Benghazi. Indeed, the close collaboration (and overlapping networks) between AS in Tunisia and Libya mean that to fully understand one we need to briefly explore the other as well. The Benghazi attacks were an example of the broader phenomenon I mentioned earlier, where larger numbers of self-radicalised attacks camouflaged more serious, premeditated terrorist plots.

Initial field reporting (subsequently very controversial) seems to have suggested that a spontaneous protest in Benghazi had spiralled into lethal violence; later reports showed there was never a spontaneous demonstration in Benghazi and that the incident was a preplanned AQIM/Ansar al-Sharia Libya attack.

As of late 2015, questions remained about when policy-makers in Washington realised Benghazi was a terrorist attack, and why (or whether) they avoided acknowledging that fact.

It’s certainly possible that administration spin linking the attack to the YouTube video – which continued, based on emails released in October 2015, for at least five days after Secretary Clinton knew that “two of our officers were killed in Benghazi by an al-Queda-like [sic] group” – was part of an operational cover for the existence of a then-unacknowledged CIA facility in Benghazi (where two of the Americans lost in the attack were killed).

Critics of the administration, however, saw the YouTube story as part of a broader attempt to maintain the narrative of reduced terrorism threat after bin Laden’s death. Benghazi occurred only two months out from a closely fought election in which reducing terrorism and ending the nation’s wars were key administration talking points, and in which Libya (and Secretary Clinton’s key role in it) was put forward as a foreign policy achievement.

In any case, my own US government service suggested to me that error was at least as likely an explanation as malice. On balance, US Government reaction to Benghazi was probably not (or not only) an effect of the ideological bent of particular policy-makers – it was also an artefact of the new environment where larger numbers of spontaneous, self-radicalised attackers raised the background clutter, letting more serious adversaries (AQIM and AS Libya) fly under the radar.

This was yet another failure of disaggregation: the strategy had reduced the size of attacks, but the atomised threat made it extraordinarily hard to predict or track smaller attacks, and – big or small – each plot required roughly the same intelligence effort, so that the proliferation of smaller plots made it more likely that overstretched intelligence services would miss the big ones when they came along.

Screengrab taken from the Site Intelligence Group website purporting to show the Tunisian hotel gunman Seifeddine Rezgui. Photograph: Site Intelligence Group/PA

To my mind this (at least as much as ideological bias or political ass-covering) explains Benghazi. Back in Tunisia, a few months after Benghazi, AST assassinated two politicians in February and July 2013. The Tunisian government banned the group and launched a crackdown, scattering AST operatives – some to Libya to train with Ansar al-Sharia there, others to Isis in Syria. This deepened links between AST and Isis: even as the United States, UK, UAE and UN designated AST a terrorist organisation, its leaders travelled to Syria and pledged allegiance to Baghdadi, well before his proclamation of the caliphate.

When the caliphate was announced in July 2014, AST spokesman Seifeddine Rais immediately offered bayat to Baghdadi. AST – allied to Isis but not yet a wilayat –then launched a campaign of attacks on tourists and public places. The first major attack was on 18 March 2015, when three gunmen stormed the Bardo Museum in Tunis, killing twenty-two (including seventeen Western tourists) and injuring fifty.

Isis claimed the attack, though its involvement remains unproven. The attack used tactics – mobile active shooter, urban siege, diversionary assault, supporting propaganda on social media – like those seen in Paris and Copenhagen. It also signalled the formation of an Isis wilayat in Tunisia: after the attack, an organisation calling itself “soldiers of the Caliphate in Africa” posted images of weapons and ammunition on Twitter, under a tourism hashtag (#IWillComeToTunisiaThisSummer), as if to say “we’ll be waiting for you.”

The group linked Tunisia to the US-led air campaign against Isis: “To the Christians planning their summer vacations in Tunisia, we cant accept u in our land while your jets keep killing our Muslim Brothers in Iraq & Sham. But if u insist on coming then beware because we are planning for u something that will make you forget #Bardoattack.”

In early May 2015, analysts warned that Isis was setting up a Tunisian province – Wilayat al-Ifriqiya – noting that this would escalate the competition between Isis and AQ (whose regional affiliate, AQIM, was already active in Tunisia) and could lead to increased violence as each group sought to outdo the other.

Then Seifallah Ben Hassine was killed in a US airstrike in Libya intended for Mokhtar Belmokhtar, the AQIM leader, who’d been flirting with switching allegiance to Isis. Two weeks after Ben Hassine’s death, on Friday 26 June, Seifeddine Rezgui Yacoubi – a Tunisian educated in the AST stronghold of Kairouan and trained in Libya – attacked the el-Kantaoui beach resort near Sousse, on Tunisia’s Mediterranean coast.

Disguised as a tourist, Rezgui infiltrated the Imperial Marhaba Hotel, concealing an AK-47 in a beach umbrella.14 After socialising at the bar, he pulled out the weapon and methodically swept the beachfront, pool and bar area, shooting hotel patrons and calmly reloading three times. He was killed by police, but not before murdering thirty-eight people (thirty of whom were British tourists) and wounding thirty-nine.

Sousse was the deadliest terrorist attack in modern Tunisian history. It brought Isis huge gain for tiny input – at a cost of one attacker, one rifle and four magazines of ammunition, Isis had established itself in Tunisia, out-competed its rival AQIM, and retaliated against a country (Britain) that was attacking it in Iraq.

The low-cost, high-impact method exploited electronic connectivity to achieve a bang-for-the-buck far in excess of either traditional expeditionary terrorism or the evolved guerrilla terrorism of the post-9/11 era. And Sousse was only one of three Isis attacks that day, which included a beheading and bombing at a US-owned factory near Lyon in France, and a suicide bombing at a Shi’a mosque in Kuwait that killed twenty-seven and wounded 227. Isis claimed all three incidents, while supporters crowed about the triple attacks – which they dubbed “Black Friday” – on social media.

Coming three days after Isis spokesman Abu Muhammad al-Adnani had called for worldwide attacks during Ramadan, Black Friday seemed to signal an expansion of Isis reach, and the extension of its operations and propaganda to the global stage.

Blood Year

What was impressive was not that Isis could coordinate simultaneous attacks in multiple countries – indeed, there’s no evidence that the attacks were formally synchronised or coordinated in that way. Rather, the attacks showed that Isis had perfected leaderless resistance, remote radicalisation and guerrilla-style terrorism to the point where a central organisation no longer even needed to coordinate such attacks: the caliphate spokesman could simply issue a public call, and the Internationale and the wilayat structure would act without further direction.

By September, Isis had active provinces in eleven countries (the wilayat level of its three-tier structure) and had inspired or directed (via the Internationale) seventy-nine successful or attempted terrorist attacks, in twenty-six countries, since the declaration of the caliphate.

But it was at the third, central tier of its structure, and in just three of these countries – Iraq, Syria and Afghanistan – that Isis would transform the terms of the conflict in 2015.

This is an edited extract of Blood Year: Islamic State and the Failures of the War on Terror by David Kilcullen (Black Inc.).