Rather than focusing on managing the consequences of an attack (“the boom”), this doctrine shifts the state’s effort toward the preparatory stages of a terrorist plot, before a group or cell acquires the capabilities needed to carry it out. As a result, U.S. intelligence agencies redirected their efforts toward detecting threats at the earliest stages of their development. Accordingly, the strategic value of intelligence lies in its ability to identify the conditions under which a threat emerges, interpret its early indicators, and disrupt its preparation before it reaches the execution phase.The recent dismantling by Moroccan security services of a terrorist cell operating across several cities illustrates this approach. Beyond the immediate law enforcement results arrests, searches, and seizures the intelligence picture points to a shift away from the traditional inspired cell paradigm. The discovery of components intended for the construction of improvised explosive devices (IEDs), chemical precursors, electronic components, and a modified vehicle, together with technical manuals and pledges of allegiance, forms a correlated body of evidence that reveals a coherent operational design. It is the combination of these elements, rather than any individual item, that identifies an advanced stage of operational preparation.From an organisational standpoint, the investigation points to a transition toward networked cells. Direct contact with leaders of the Islamic State Sahel Province (ISSP) together with the receipt of operational guidance and logistical support, changes the nature of the security challenge. The available evidence suggests that this cell had moved beyond ideologically inspired radicalisation and entered into an organised relationship with ISIS’ Sahel branch, receiving strategic direction, logistical assistance, and operational support. This development changes the focus of intelligence assessment. The primary target is no longer the isolated radicalised individual but the broader support architecture recruitment, financing, logistics, communications, and the operational links that connect the different nodes of the network.Morocco’s own counterterrorism strategy is the best model that needs to be taken into serious consideration by other African countries. The May 16, 2003 Casablanca bombings, carried out by Al-Qaeda-affiliated militants, killing 45 people marked a turning point in Morocco’s approach to counterterrorism. Beyond strengthening the legal framework on combating terrorism, they prompted a gradual reorganisation of the country’s security architecture.This institutional evolution led to stronger intelligence capabilities, closer integration between security services and judicial authorities, and, on March 20, 2015, the creation of the Central Bureau of Judicial Investigations (BCIJ) under the authority of the General Directorate for Territorial Surveillance (DGST).The establishment of the BCIJ strengthened the integration of intelligence collection with criminal investigations, creating continuity between threat detection, operational exploitation, and judicial proceedings. This institutional architecture helped shift Morocco’s counterterrorism posture from a predominantly reactive model toward one centred on anticipation, the disruption of terrorist cells during their formative stages, and the preventive use of intelligence.Since its establishment in 2015, the BCIJ has dismantled dozens of terrorist cells and arrested more than 1,000 individuals linked to jihadist networks. This record reflects an intelligence practice centred on anticipation. The analysis of collected information extends well beyond established organisations. It focuses on identifying the earliest indicators of network formation, recruitment mechanisms, and the interactions capable of transforming intent into an operational terrorist project.From Criminal Investigation to Intelligence: Reconstructing the Threat ChainThis analytical approach is reflected in three recent operations that, rather than representing isolated investigations, reveal successive layers of the same terrorist ecosystem.The first dates to February 19, 2025, when the BCIJ announced the dismantling of an ISIS-affiliated terrorist cell and the simultaneous arrest of 12 suspects across nine Moroccan localities. The investigation subsequently led to the discovery of a logistical base in the Boudenib area of Errachidia Province, where weapons and ammunition had been concealed. This operation uncovered an externalised logistical infrastructure. The weapons seized had not been acquired locally but originated from an ISIS commander operating in the Sahel, who exploited the poorly governed spaces of the Sahel-Sahara belt to move matériel across borders. The case exposed a transnational supply network linking the Sahelian strategic depth to an operational cell established inside Morocco. A second layer emerged on March 25, 2026, during a joint operation conducted by the BCIJ, under the DGST, together with the Comisaría General de Información of the Spanish National Police. The operation dismantled an ISIS-affiliated cell operating between Morocco and Spain and composed of three extremists. Early findings indicated that the network had been engaged in financing and logistical support for ISIS fighters active in the Sahel and in Somalia. This operation highlighted another dimension of the terrorist ecosystem: financial flows, secure communications, and cross-border interactions. It also demonstrated that network analysis extends well beyond the identification of suspects. It encompasses financing channels, communication intermediaries, digital platforms, and the distinct legal jurisdictions within which terrorist networks seek to operate. Beyond its transnational dimension, the case also illustrates that financial support functions may be organisationally separated from operational functions while remaining integrated within the same terrorist architecture without compromising its operational coherence.The third operation, announced on July 6, 2026, marked another stage in this evolution. Moroccan authorities arrested 10 individuals across several cities. The information released by investigators revealed a clear functional division of labor involving target selection, reconnaissance, surveillance, procurement of equipment, and operational preparation.This distribution of responsibilities points to an organisational structure built around two distinct command levels. The first consists of a strategic command exercised by ISIS’ Sahel branch, responsible for defining overall guidance, maintaining organisational cohesion, and providing logistical support. The second consists of a local tactical command, responsible for target selection, reconnaissance, procurement of materials, and operational planning. Such an arrangement increases the resilience of the cell by allowing it to adapt its methods locally while remaining connected to a broader regional organisation.
