Turkish intelligence was aware of an Islamic State in Iraq and Syria (ISIS) operative embedded among refugees in Turkey who conducted surveillance on Christian and Jewish places of worship as part of preparations for a potential terror attack. Despite this, the agency did not alert law enforcement to enable preventive measures.
According to confidential documents obtained by Nordic Monitor, ISIS operative Mohammed Khlef Ibrahim Ibrahim, known by his alias “Abu Leys,” had established himself in Turkey’s western province of Balıkesir as a member of a sleeper cell.
ISIS assigned Ibrahim to work with the “Salman the Persian Brigade” (referred to as Selman-ı Farisi Taburu in Turkish), a Turkish-affiliated branch of ISIS originally operating as part of the group’s presence in Damascus Province. He successfully obtained Turkish identity documents under the national ID number 99906003680 (similar to a US Social Security number), granting him access to public services and enabling him to establish a business.
Ibrahim traveled extensively across Turkey, meeting with other ISIS members in various provinces. Despite knowing that his name would be recorded in the national bus ticket registration database — automatically shared with Turkish law enforcement and intelligence agencies — he continued to take bus trips, seemingly undeterred by the potential risks of detection.
The documents provide detailed records of Ibrahim’s travels, including the dates and bus companies he used, the locations where he boarded and disembarked, and whether he purchased tickets under his real name or an alias.
A report from the Turkish intelligence agency MIT reveals that the agency was aware of the ISIS surveillance team and their activities before the attack in Istanbul in January 2024:
Despite the risk of detection, Ibrahim appeared remarkably unconcerned about being flagged during his activities. In late November 2023, he and his accomplice, Mijbel al-Shuwaikhi (also known as Abu Yaqin al-Iraqi), who had moved to Turkey from Iraq in 2017, conducted surveillance operations in Istanbul. Their reconnaissance included photographing Christian and Jewish places of worship, in preparation for potential attacks.
Turkey’s National Intelligence Organization (Milli İstihbarat Teşkilatı, MIT) was fully aware of Ibrahim’s identity, his position within ISIS, his code name and the assignments he had carried out previously. Court cases concerning members of the ISIS network across various Turkish provinces have revealed that in 2018, MIT had obtained hundreds of documents from a safe house in Syria’s Haseki region, which ISIS had used as a headquarters. These documents provided detailed insights into the group’s operations and personnel.
These documents include a comprehensive list of ISIS members, detailing identifying information such as their status within the network, birth dates, aliases, identity numbers and tribal affiliations. The list was translated into Turkish and classified as strictly confidential by MIT, underscoring the depth of intelligence gathered on ISIS operatives.
Based on the list and other collected intelligence, MIT was able to identify ISIS members who had settled in Turkey, pinpoint their residences and access their Turkish identity numbers. Despite this, no significant crackdown was initiated, allowing these individuals to continue their activities on behalf of ISIS leadership without interference.
Based on the list and other collected intelligence, MIT was able to identify ISIS members who had settled in Turkey, pinpoint their residences and access their Turkish identity numbers. Despite this, no significant crackdown was initiated, allowing these individuals to continue their activities on behalf of ISIS leadership without interference.
Ibrahim was among those listed in the intelligence documents. On Nov. 28, 2023, he traveled to Istanbul to meet with Shuwaikhi, where they carried out surveillance of several Jewish and Christian sites. Their targets included the Neve Shalom Synagogue, the Ahrida Synagogue, the Or-Ahayim Balat Jewish Hospital and the Church of Saint Mary of Blachernae, an Eastern Orthodox church.
The surveillance records were forwarded to ISIS leaders in Syria, who ultimately decided to target the Church of Santa Maria (Meryem Ana Doğuş Kilisesi) in Istanbul’s Sarıyer district. The attack took place on Jan. 28, 2024, resulting in one fatality.
The post-attack investigation revealed that police detained Ibrahim and showed him CCTV footage in which he and Shuwaikhi were seen surveilling Christian and Jewish religious sites. The footage, obtained from both public surveillance cameras and private business cameras in the neighborhoods they visited, was retrieved by the police on Dec. 30, 2023 — nearly a month before ISIS executed the attack on the Santa Maria Church.
What is even more scandalous is that MIT only decided to share intelligence on Ibrahim with the police on Dec. 21, 2023, using a secret communication code: 2023122116261198715. This revelation came after Western embassies in Turkey had announced the closure of their diplomatic missions in Ankara and Istanbul, citing an imminent terror threat. MIT, which had withheld information on Ibrahim’s activities until that point, was likely compelled to share it with the police to shield the agency from potential fallout in the event that the attack occurred.
CCTV footage shows the ISIS surveillance team scouting Jewish and Christian places of worship in Istanbul, photographing the sites in preparation for a potential attack:
This is not the first time MIT has withheld crucial intelligence prior to terror attacks in Turkey. Despite being aware of past terror plots and the identities of the perpetrators, the agency has either declined to share the information with the police or did so belatedly, hindering preventive action by law enforcement. The motivation behind these decisions seems to stem from a short-sighted and questionable view of whether such an attack could ultimately benefit the Erdogan government or influence public discourse in a particular direction.
For instance, regarding the May 2013 twin car bombings in the town of Reyhanlı, in the southern province of Hatay, which killed 53 people, it was later revealed by prosecutors that MIT had prior knowledge of the plot, including details about the vehicles, their license plate numbers and the perpetrators. However, the agency chose to share this critical information only the night before the attack, forcing the police to scramble overnight in an attempt to locate the vehicles. Public prosecutors launched a criminal investigation of MIT agents over the terror incident, but the case was ultimately suppressed by the Erdogan government.
In 2012, Turkish prosecutors secured arrest warrants for five MIT agents, including high-ranking officials, after discovering that the agency had failed to inform law enforcement about impending terror plots. Moreover, it was revealed that MIT had actively encouraged its assets within a leftist terror group to escalate violence on the streets of Istanbul. Despite the serious nature of these findings, the case was once again suppressed by the Erdogan government.
In some instances, MIT even contracted ISIS militants to carry out operations. A previously published intelligence report by Nordic Monitor revealed that İlhami Balı, the mastermind behind a series of deadly terrorist attacks in 2015 attributed to ISIS, was actually working for MIT. These attacks were seen as strategically timed to help Erdogan maintain his regime and regain a parliamentary majority that he had briefly lost in the summer 2015 elections.
