CommandEleven Intelligence // Asia and North Africa Desk. Foresight Audit, status as of November 3, 2026. This audit scores the 2026 Global Counter-Terrorism Assessment (GCTA), published in April 2026, against evidence published afterwards.
Bottom Line Up Front
The GCTA has no North Africa chapter. It has one baseline line on page 14 and a short note on page 59, so this audit pairs North Africa with the Southeast Asia and Sulu Sea sections (pages 34 to 39). Of three judgments we can score, one is partly confirmed and two are open: 0.5 of 1 on the one that can be judged. The facts in the chapters are checked separately as baseline facts and do not count.
The call that holds is the one about youth. We wrote that the threat had “migrated from the jungle to the urban centers” of Kuala Lumpur, Jakarta and Manila through an ISKP digital expansion. Indonesia’s counterterrorism unit arrested 11 suspects in six provinces on October 2 to 4 for rebuilding Islamic State networks online, and the national agency says 620 children were exposed to violent or radical content between January and August. But no attack has followed, and none of the reporting names ISKP. The maritime drone claims, which are the most specific in the Southeast Asia chapter, have no public support. We found no insurgent maritime drone incident and no report of the underwater devices we described.
Key Judgments
KJ1: Online radicalization of youth in Southeast Asia is confirmed. The urban attack and the ISKP link are not. Indonesia has not had an attack since December 2022. [PARTIALLY CONFIRMED]
KJ2: The maritime drone threat has not materialized in public reporting. The Philippine clashes we found were land fights with Dawlah Islamiyah-Maute fighters. [OPEN]
KJ3: IS-Sinai and IS-Libya stayed out of the headlines. That fits our low-tempo call but does not prove it. [OPEN]
KJ4: Five specific claims in these chapters could not be reproduced. They include the Kuala Lumpur Transit Plot, the Nusantara Protocol arrests and the Zamboanga drone recoveries. [BASELINE, unverified]
How We Scored
Every call is scored under the Foresight Record rules, set out in full in the GCTA Foresight Audit introduction. The original is quoted and dated, the score rests on evidence published after the GCTA appeared, and confirmed counts 1 and partly confirmed counts 0.5. Where an official attributes something without publishing evidence, we score partly confirmed. A call that depends on a verdict or a data release is held open. Only our own judgments count.
The Southeast Asia chapter spans pages 34 to 36 and the maritime section pages 35 and 37. Pages 38 and 39 describe a Pakistani maritime case and fall outside this audit. North Africa appears on pages 14 and 59 only. We scored only the statements that characterize a trend or predict how a threat would develop, and we checked the rest as baseline facts.
The Scored Calls
| ID | Judgment | GCTA page | Score |
|---|---|---|---|
| SE-01 | The threat has migrated to the urban centers of Kuala Lumpur, Jakarta and Manila, driven by ISKP’s digital expansion | p. 34 | PARTIALLY CONFIRMED |
| SE-02 | Abu Sayyaf and Maute remnants have moved from kidnapping to maritime interdiction with drones | pp. 35, 37 | OPEN |
| NF-01 | IS-Sinai and IS-Libya are in a low-tempo phase, kept as logistical nodes for Mediterranean transit | p. 59 | OPEN |
SE-01. The shift to cities and ISKP’s reach
What we said (GCTA, p. 34). “The threat has migrated from the jungle to the urban centers of Kuala Lumpur, Jakarta, and Manila, driven by the ISKP Digital Expansion.” We added that radicalization velocity had reached record highs and that recruits were organizing into decentralized cells on gaming platforms.
What the record shows. On October 2 to 4, Indonesia’s Densus 88 arrested 11 suspects aged 22 to 52 in West Java, Central Java, Central Sulawesi, South Sulawesi, Riau and North Maluku. Police linked them to networks affiliated with Daulah Islamiyah, the Indonesian term for the Islamic State, and said the suspects recruited and spread propaganda online and in person. Police did not disclose a specific planned attack. The national counterterrorism agency said 620 children aged 11 to 18 were exposed to violent or radical online content between January and August, and Densus 88 identified 70 children in 19 provinces as members of leaderless online groups centered on violent crime. The last terrorist attack in Indonesia was a suicide bombing at a Bandung police station in December 2022. The reporting does not mention ISKP. In the Philippines, the fighting we found in 2026 was in rural Lanao del Sur, where troops killed 10 Dawlah Islamiyah-Maute fighters on April 17 while serving arrest warrants.
Score: PARTIALLY CONFIRMED. Online youth radicalization is documented and arrests are frequent. The move to urban attacks and the ISKP link are not shown, and the arrests were spread across provinces, not concentrated in capitals.
SE-02. Maritime interdiction with drones
What we said (GCTA, pp. 35, 37). “Remnants of the Abu Sayyaf Group (ASG) and the Maute Group have abandoned traditional kidnapping-for-ransom in favor of Maritime Interdiction.” We wrote that insurgent groups had upgraded using drone tactics from the Sahel and Ukraine, and that Philippine forces had recovered underwater IED drones in the Sulu Sea in early 2026.
What the record shows. We found no report of an insurgent maritime drone attack or of the underwater devices we described. The 2026 clashes in the sources we reviewed were on land. The April 17 operation in Marantao served warrants that included murder and kidnapping charges, and troops recovered rifles, a grenade and bomb-making components. Reports of underwater drones recovered in Philippine waters describe suspected Chinese surveillance craft found by fishermen, not insurgent weapons.
Score: OPEN. The claim describes a capability and we cannot check it from open sources. We will score it as not confirmed at the year-end review unless an attack or a documented recovery appears by December 31.
NF-01. IS-Sinai and IS-Libya in a low-tempo phase
What we said (GCTA, p. 59). “Currently in a low-tempo phase, but maintained as vital logistical nodes for Mediterranean transit.”
What the record shows. The Global Terrorism Index for 2026 says the epicenter of terrorism has moved from the Middle East and North Africa into the Sahel, with nearly half of 2025 deaths there and 5,582 deaths worldwide, down from 7,555 in 2024. We found no 2026 report of a significant attack by IS-Sinai or IS-Libya. The logistical-node part of the claim has no public evidence either way, and our search was not exhaustive.
Score: OPEN. The absence of attacks fits a low-tempo call, but a quiet record does not confirm what the groups were doing behind it.
Baseline Facts Checked
These are factual statements in the GCTA that were checkable. They are not forecasts and are not counted in the Foresight Record totals. A claim we could not reproduce is marked unverified, which is not the same as wrong.
| GCTA statement | What we found | Status |
|---|---|---|
| The Sahel and North African corridor accounts for over half of global terrorism deaths (p. 14) | The Global Terrorism Index for 2026 puts nearly half of 2025 deaths in the Sahel alone, the third year at that level. North Africa adds little. | Roughly consistent; wording overstated |
| The Kuala Lumpur Transit Plot, November 2025: a 19-year-old used 3D-printing instructions from an ISKP handler in Khost (p. 34) | We found no public record of this plot. The reports we found describe earlier Malaysian plots. | Unverified |
| ISKP’s Al-Azaim launched a Bahasa Indonesia and Malay translation cell in late 2025 (p. 34) | We could not confirm this. A March 2026 analysis of Islamic State outreach to Malaysian youth exists, and we could not open it. | Unverified |
| The Nusantara Protocol, January 2026, led to 42 arrests in four countries in February and stopped an Eid plot (p. 36) | We found no public record of the protocol or the arrests. | Unverified |
| Underwater IED drones recovered near Zamboanga in January 2026, and PALID-series prototypes (pp. 35, 37) | We found no report of such recoveries. Reported recoveries of underwater drones in Philippine waters involve suspected Chinese surveillance craft. | Unverified |
| Militants embed in clan disputes and run a shadow governance model in the southern Philippines (p. 35) | We found no reporting that tests this. Clashes in Lanao del Sur show Dawlah Islamiyah-Maute fighters resisting arrest warrants. | Unverified |
What Would Change These Scores
- An insurgent attack or a documented recovery of a maritime drone in the Sulu or Celebes Seas before December 31 would resolve SE-02.
- A 2026 attack in Kuala Lumpur, Jakarta or Manila, or a court filing that names ISKP, would move SE-01 toward confirmed.
- A named IS-Sinai or IS-Libya attack or an official report on their logistics would let us score NF-01.
- A source for the Kuala Lumpur plot, the Nusantara Protocol or the Zamboanga recoveries would move those rows from unverified.
What We Learned
Our specific claims were the weakest part of these chapters. The general direction, youth radicalization online, held. The details that make a chapter vivid, a named plot, a named protocol and a named drone class, are the ones we cannot source.
We bundled a region we barely covered with one we covered thinly. North Africa should either get a real chapter or leave the series, and the Sulu Sea section needs the same sourcing standard as the rest.
What This Audit Does and Doesn’t Establish
- It establishes that online radicalization of Indonesian youth continued in 2026 and that Indonesia made arrests across six provinces in October.
- It establishes that we found no public support for five specific claims in the Southeast Asia chapters.
- It does not show that ISKP is behind Southeast Asian networks.
- It does not prove that insurgents have no maritime drones. It shows that none has surfaced publicly.
- It does not review IS-Sinai or IS-Libya activity exhaustively.
Frequently Asked Questions
Why does this audit combine North Africa and Southeast Asia?
Because the GCTA has no North Africa chapter. Its only North Africa content is a baseline line on page 14 and a note on page 59, so we paired it with the Southeast Asia and Sulu Sea sections.
Has ISKP carried out an attack in Southeast Asia?
We found none. Indonesia’s recent arrests are tied to Islamic State networks locally, and the reporting does not name ISKP.
Do Philippine insurgents use maritime drones?
We found no public report of it. The recoveries of underwater drones reported in Philippine waters involve suspected Chinese surveillance craft.
What comes next?
Parts 9 to 11 cover ISKP governance, cyber-kinetic convergence and a closing synthesis.
Sources
- The Star, Analysis: Indonesia’s efforts are keeping the terror threat under control, but can it continue to stay ahead? (October 8, 2026)
- The Star, Indonesia arrests 11 terrorism suspects in raids across six provinces (October 5, 2026)
- The Daily Tribune, 10 Maute fighters killed (April 18, 2026)
- Africanews, Sahel accounts for nearly half of all terror-related deaths: report (March 19, 2026)
- Maritime Executive, Philippine Fishermen Catch Another Underwater Spy Drone (undated)
