The Islamic State is also still sitting on the massive windfall that it built up during the height of its power. “What we know is that they accumulated large amounts of cash and other assets,” said Howard Shatz, a senior economist at the Rand Corporation and co-author of several studies on the Islamic State’s finances. “We don’t know where it all went.”

Some of those funds appear to have been invested in legitimate commercial enterprises. In October, a series of raids on Islamic State–linked businesses in the Iraqi city of Erbil uncovered a paper trail that suggested the group had invested in everything from real estate to automobile dealerships. These businesses are often run by middlemen who partner with the group not out of ideological sympathy but for profit, and then funnel revenue to the Islamic State when called upon.

The senior Iraqi security official told me that the bulk of the Islamic State’s assets had been transferred to Turkey, though the Treasury Department has sanctioned its money-services businesses in Syria and Iraq, which have connections as far away as the Caribbean. Some of these funds are reportedly held in cash by individuals in Turkey, while a portion has also been invested in gold. There is precedent for Ankara turning a blind eye toward the terrorist organization’s activity on its soil: The group used to make millions of dollars by selling smuggled oil to Turkish buyers. The October raid in Erbil also targeted the financial network built up by Fawaz Muhammad Jubayr al-Rawi, an Islamic State leader who the Treasury Department claims owned and operated Syria-based money-services businesses that exchanged money with Turkey. The Turkish government has consistently denied providing safe harbor to either Islamic State individuals or the group’s assets.

The war-ravaged states of Syria and Iraq also provide the Islamic State with ample opportunities to revive the tactics that financed its predecessor organization. From 2008 to 2012, when al-Qaeda in Iraq was driven underground, it operated much like a mafia: It skimmed construction contracts, particularly in the northern Iraqi city of Mosul; stole goods and resold them; and kidnapped members of wealthy families for ransom. Despite its straitened circumstances, the group was recording monthly revenues of nearly $1 million just in Nineveh province, of which Mosul is the capital, in late 2008 and early 2009.

Today it has even more factors working in its favor. The destruction of areas of northern Iraq once controlled by the Islamic State has necessitated a massive reconstruction effort. At a conference last year, countries pledged $30 billion to rebuild the area, a figure that is still well below what the Iraqi government said it needs. Perversely, such a massive injection of funds provides the Islamic State with even more opportunity to benefit from corruption. Declassified documents show that senior Iraqi, Kurdish, and Turkish politicians had dealings with al-Qaeda in Iraq in 2009; oversight of how funds are spent is likely even worse now, given the magnitude of the task. Second, the Islamic State kept meticulous records about the approximately 7 million to 8 million people living under its rule during the height of its power. If it retained control of those records, it could use them to extort Iraqis and Syrians.