The use of the term “security” among armed opposition factions emerged in the beginning of 2012. It spread among grass-roots communities and armed factions present outside regime-controlled areas. The term “security officers” refers to individuals and, later, was used in reference to groups, part of or independent of factions, in charge of maintaining security. These groups were established as a neutral equivalent to security services developed in all countries.

Since the "security officers" remained a factional phenomenon, each area witnessed the parallel work of security officers from multiple and competing factions, engaging with each other in armed and unarmed conflicts. Due to this, maintaining security became part of the conflict and one of its most important tools at the same time. The ongoing conflict also produced an unprecedented situation where different and conflicting groups undertook worked to ensure security in a single environment.

The faction security work is characterized by ambiguity which characterises the work of security officials in state and non-state structures. However, in this case, the faction security work ambiguity comes in an environment of insecurity and chaos that lacks organizational and political structures. In turn, security officers are turned into symbols of the prevalent chaos, rather than symbols of security. 

This study attempts to shed light on the opposition factions’ security sector to understand the nature of this security work and its position within factions’ organizational structures. It will also evaluate the performance of the security sector during recent years. The research is part of Jusoor for Studies attempt to address the most influential sectors affecting citizens’ life in areas outside regime control which are issues that have been addressed rarely in previous studies. This study then is in keeping with Jusoor’s previous studies such as the report addressing the Sharia officials’ sector. This study is based on interviews with individuals who participated in forming some of factions’ security committees, faction leaders, and civil society actors and observers operating in factions-controlled regions in recent years.

The faction security sector developed gradually in accordance with the field and political developments in Syria as well as the changes that took place in the environments the armed factions operated in. These developments can be divided into four main stages: 

Different groups started forming security apparatus clusters and special operation teams in the period between the end of 2012 and beginning of 2013. The security clusters specifically targeted the regime, its symbols and worked through security action to offer an alternative complementing military action or building supporting structures.

As part of the security work, many “Popular Committee” security figures and leaders were assassinated during this period. The Popular Committees are thug groups formed by the regime security apparatus in 2011 and the most prominently recognized are the Abu Amara Brigades and Ababil in Aleppo city. 

It is necessary to mention the security work of Jabhat al-Nusra li-Ahl al-Sham, later Al-Nusra Front, which began in March 2012 when the group blew up the Air Security Branch and the Criminal Security Department in Damascus. 

Moreover, several groups were formed focusing on gathering intelligence and information. These groups established databases and worked to infiltrate the regime’s intelligence networks as well as monitor regime security and military movements. These groups then communicated with political figures and media platforms to provide this information as they did not have the capacity to make direct use of the information. 

The security work in this period can be characterized as follows:

1. Completely directed towards the regime especially as the regime was the only actor in the field opposed to the oppositional formations which had not yet expanded.

2. Completely secret since the security work was carried out within regime-controlled areas at a time when regime security apparatus had not yet lost control.

3. Limited in scope as most of the security work was done by groups of no more than 10-20 people at the most. Individuals were included based on their belonging to tested trust circles especially as the decades of totalitarian rule had eliminated trust among community members.

4. Limited resources since each security groups did not have their own headquarters and lacked prisons, detention centres, cars and equipment. Later on, groups acquired this infrastructure and resources.

5. Limited professional expertise since the security group members rarely had experience in security work. However, some groups worked in the intelligence security sector and some of these groups’ civilian members had previous experience building the regime security apparatus’ technological infrastructure.

The regime’s increased loss of control of areas in 2012 led opposition factions and civil groups to develop governance systems in these areas. In the beginning, the form of governance was primitive as it maintained the state as a general frame but lacked regulations and controls which constitute governance systems. In addition, the form of governance lacked many components of a governance system. 

As time passed, these governance systems gradually developed and the development, its form and direction differed between areas as diverse factions gained control of areas. Each area witnessed the emergence of a different civilian force that oriented and impacted the form of the adopted governance system.

The majority of the factions formed security apparatuses where these apparatuses always remained faction specific. In no case was a security apparatus formed that followed a joint faction committee or a civilian-faction committee.

In parallel with the faction security apparatuses, police forces were formed, but the factions were not keen on monopolizing the police forces. In many cases, they allowed civil administration of the police forces or at least jointly administrated the police forces with civilian components.

One of the first police forces formed was the judicial police in Herytan and Tal Rifaat in Aleppo countryside. In early 2012, revolutionary police stations were established in most of the areas that were under opposition control. In the second half of 2012, the experiment developed into a more sophisticated form aided by external support as the “Free Police” in Aleppo and Idlib, the police leadership in Eastern Ghouta, the police leadership of Eastern Qalamoon, al-Badiya and the internal security forces in Homs were founded.

The work of the police and security forces witnessed interference and was the site of conflict in several cases. The judicial police did not have the ability to arrest wanted persons which necessitated military intervention by one of the factions. Some of the factions were involved in criminal acts such as pillaging and robbery, and the police forces were not able to deal with these cases.

Some of the factions established security apparatuses whose work overlapped with the police forces’ mandate. One of the most prominent cases was Abdul Qadir al-Saleh, commander of the Liwa al-Tawhid Brigade, announcing on the formation of the “Revolution’s Security Bureau in Aleppo Province” led by the defected Brigader-General Zaki Ali Loula and his deputy Lt. Colonel Ahmad Hamdou Sheikh al-Jub on August 19, 2012. The bureau was formed to protect public property and given the mandate to hold those breaking the law accountable even if associated with the revolution. In this case, responsibilities traditionally assigned to the police forces were given to a security apparatus. The formation of the “Revolutionary Security Brigades" was announced in the opposition controlled western neighbourhoods Aleppo on August 28, 2012. The brigades were estimated to be formed of 30 people. They later dissolved the brigades and turned the formation into a military battalion. The foundational statement of the brigades mentioned that part of their objectives is, “to protect security and order; arrest those engaging in corruption, whether military or civilian individuals, and place them before the revolution’s judiciary; protect public and private property, and regulate traffic in the liberated areas.” In other cases, some factions established security services that interfered with police work.

Later, some civilian institutions attempted to merge the different faction security apparatuses within one geographical area to establish a joint security apparatus. The most prominent attempt was in Saraqib when the Local Council formed a security committee consisting of ten candidates, from the different armed factions operating in the area, and assigned them to handle the security file. Four people were selected to chair the committee and the Saraqib Local Council to oversee the entire process. However, this experience did not last long and ended following repeated disputes among the factions that was reflected by their representatives in the committee.

By the end of 2012, about two thirds of Syrian soil was under the control of the Free Syrian Army factions. That year witnessed a significant growth in the number of factions, most of which later disappeared. 2012 also saw the emergence and growth of the al-Nusra Front that operated differently to the other factions. It had a clear project (as it turned out) accompanied by military and security experience coming from across the border. Most of the foreigners who came to Syria at that time had years of experiences in security work. It later emerged that many of the Iraqi elements (most of whom later moved to ISIS) had worked in the Iraqi security apparatuses under Saddam Hussein.

The growth of the al-Nusra Front coincided with the rise of other Salafist and Islamist factions that did not have the same degree of "external experience", but still had expertise beyond other local factions and an integrated project to gain control.

At that time, several major factions tried to develop some joint projects to build mechanisms to share influence consensually among them. The formation of a quadripartite Shariah Board in Aleppo Province was announced on December 15, 2012. The board included al-Tawhid Brigade, the Syrian hawks, Ahrar al-Sham and al-Nusra Front. These factions alternated leadership of the board. In its structure, the board included a presidential office that oversaw several offices with specific functions, namely; the education office, the Ifta and mosques office, the services office, the medical office, the judicial office, the grain office and the mills department. In addition, the board had a police force, composed of masked members, to support it and intervene based on direct orders from the presidential office or the investigation office. The board also secretly deployed security personnel to key locations across Aleppo city who were in direct contact with the police.

The police force of the quadripartite Shariah Board represented an integrated security apparatus for the factions that were then seeking to control governance in the province. The force carried out an offensive on the Hasan Jazraa-led Gurbaa al-Sham Brigade’s headquarters and locations in eastern Aleppo on June 15, 2013.

The Shariah Board also took full control of the judicial system in areas under opposition control. The board established a judicial office entrusted to maintain the judiciary. The board sought to undermine the work of the “Unified Judicial Council” in various ways, including kidnapping some of its judges and encircling the council’s main headquarters in al-Ansari district in Aleppo City.

The Shariah Board’s security apparatus’s behaviour helped to perpetuate the security phenomenon. The security forces’ masked personnel arrested people without arrest warrants. The board ordered personnel not to disclose information about the arresting party or detainees’ locations to deny any links to the Shariah Board, unless a formal order was given.

The presence of Salafist jihadist organizations in the Shariah Board contributed to framing the behaviour of the security apparatus and expanding its mission. In this case, the role of Ahrar al-Sham Movement Ahrar Sham and the Nusra Front was prominent. These organizations’ leaders dominated the security aspect of the Shariah Board, unlike the Free Syrian Army (FSA) faction leaders. The Salafist organizations replicated their military and security experiences from Iraq, Afghanistan and elsewhere. They relied on a policy of hiding faces and names as a tool to install respect and fear among the local public, other factions and even members of their own factions.

Many in Aleppo city believed that al-Nusra Front was the faction that influenced the nature and behaviour of the Shariah Board, and that al-Nusra Front joining the board was part of its quest to influence the decision of other factions and infiltrate their security. Many activists argued that the al-Nusra Front’s aim of joining the Board was not to form a military governance council. It appears that these claims were justified especially since many disputes broke out among the board members until the board froze the work of al-Nusra Front in mid-2013. Due to the disputes, the activities of the Shariah Board were disrupted and the Board no longer functioned as it had before. In February 2014, al-Nusra Front officially announced its withdrawal from the Shariah Board and attributed its withdrawal to the divergence of the board’s original project and differences in implementation that emerged with other factions. This decision came a few months after the remaining Shariah Board factions formed the Islamic Front and since then, the board became ineffective.

Although sustainable joint security work stopped at the beginning of 2013, it continued in other forms. With each merger or alliance between factions, security offices were created such as the executive force of the Fatih Army, the security office of the Free Syrian Army, the joint security office of the Descendants of Hamza Brigades, Abu Amara Brigades, the Homs Operations Room, the security office of the Rahman Corps, the security office of al-Shami Front and the security office of the Islamic Front. In some cases, the factions created joint security apparatuses despite the lack of an alliance, such as the executive force in al-Gab plain which is shared by both Syria Liberation Front and the Jaish al-Nasr.

In these cases, the joint security work was relatively effective within specific objectives, such as sharing security information about a particular battle or monitoring the regime forces and its allies; however, in no case did the joint security work succeed in becoming more participatory.

Areas that were no longer under regime control in 2013 witnessed widespread security chaos. These areas saw the assassination and kidnapping of foreign and local relief workers, media personnel and military personnel. It later emerged that most of these operations were carried out by ISIS. In conjunction, the scope of criminal offenses expanded especially kidnapping and the looting of private and public property.

In 2013, different factions began to feel a sense of stability in their powers as they expanded the territories under their control and the centers of liberated parts of Aleppo and Idlib were no longer exposed to a ground attacks by the regime. This situation of "stability", together with the abundance of material resources, led to factions’ vertical and horizontal expansion and their quest to build up their independent influence. These attempts to develop their influence exacerbated conflicts with rival factions and resulted in the breakdown of inter-enterprise and armed conflict.

The conflict and rivalry between factions encouraged the expansion of the factions’ security offices. Many factions benefited from ISIS’s experience by using ISIS tools on the one hand, and developing their own tools on the other. 

The situation in northern Syria was similar to other opposition-controlled areas. In the Eastern Ghouta, each faction established its own security office, where the security tool was used in cases of fighting between the "Army of Islam" and other factions. Following a bloody conflict with the “Army of Islam”, the other factions were later reduced to the " Rahman Corps ". The conflict began in 2015 when the "Islamic Union of the Soldiers of the Levant" and "Islamic Nation Dawn Movement" arrested three members of the Army of Islam on charges of carrying out security work. The incident was followed by the security personnel of both sides carrying out multiple kidnappings. It may be assumed that the Army of Islam was the first faction in this conflict to employ its security apparatus in the internal fighting when it announced that it was able to arrest the deputy commander of the Nation Army Brigade Ahmed Taha and his deputy Abu Ali Khobeib in early January 2015.

The situation did not differ radically in Daraa province in southern Syria where every military faction established a security office. In recent years, security cells in Daraa fostered security chaos. The Department of Crimes and Criminal Offenses of the “Documentation of Martyrs” in Daraa Province, documented more than 450 assassinations between April 2013 and May 2017. This statistic does not include the number of field executions of abductees or victims who died under torture in faction prisons, nor the number of persons killed by improvised explosive devices which the regime has claimed responsibility for.
 

Based on factions’ security officers’ work, we can divide their responsibilities into four main security functions: information security, operation security, front security and prison security. 

Factions’ information security officers work on investigating, constantly monitoring and infiltrating the activities of civil organizations, other military factions, local councils and media centres. They are active directly, by joining these formations and infiltrating them, or indirectly, by dealing with informants who provide the faction with information in exchange for something.

The role of information security officers differs between one faction and another in term of functions. With the exception of ISIS which is not covered by this study, it can be said that Hayat Tahrir al-Sham has a clear security approach to what we call "information security". Tahrir al-Sham has an official responsible to handle the organizations’ file, an official responsible for the military factions’ file and an official for the   judicial and Shariah boards. The official responsible for the organizations’ file is tasked with building a database of all the organizations operating in northern Syria and trying to obtain their monthly financial and activities reports. The official in charge of this file relies on personal relations within the organizations or on persons recruited by these organizations who are in contact with Tahrir al-Sham. The official responsible for the local council file, is tasked with infiltrating the councils, influencing the councils’ electoral processes and reporting on their activities. Through its security apparatus, Tahrir al-Sham managed to control many service bodies including local councils and civil society organizations among others.

Information security officers play a large role in the cases of internal fighting as they are depended on to carry out investigation and follow-up. For example, Hayat Tahrir al-Sham announced on February 23, 2018 the arrest of a senior security officer working for Nur al-Din al-Zanki Movement named Mohammed al-Dili’. Tahrir al-Sham arrested him after they obtained information that al-Dili’ was preparing an attack on the Tahrir al-Sham headquarters and personnel in al-Dana and Dar Izaa cities west of Aleppo during the fighting with Nur al-Din Zanki Movement.

Furthermore, information security officers investigate incidents of disorder and security chaos that affect the faction and the areas under its controll. For instance, in September 2017, Nur al-Din al-Zanki Movement assigned its security office to investigate and follow up on the assassination of one of its leaders. Based on preliminary information obtained by the security office, the Movement accused Tahrir al-Sham of being responsible for the assassination.

Information security officers are also tasked with recording the faction’s internal conversations to trace who leaked information in the event a leak of information to another faction or party occurs. For example, information was leaked from Tahrir al-Sham in September 2017 which affected its leader Abu Mohammed al-Joulani. The leak resulted in the resignation of Abdullah al-Muhaisini and Muslih al-Alyani from Tahrir al-Sham. It is not known whether the Tahrir al-Sham security officers were responsible for the leak or if it was a leak by the security officers of another faction or an external party. 

In Jihadist organizations in particular, security officers are assigned who are responsible for maintain the security of internal documents. They are tasked with securing the lists that include the real names of fighters especially foreigner fighters and holding their passports. They are also responsible for protecting the information of the organization’s secret agents in various regions and entities. The document security section usually consists of a very limited number of people.

Operation security officers carry out assassinations, kidnappings, raids, arrests, plant IEDs and booby-traps and other operational functions.

Several incidents related to operation security were documented. The most prominent was reflected in the fighting between the Nur al-Din al-Zanki Movement and Hayat Tahrir al-Sham in September 2017. The fighting began as the Movement accused Tahrir al-Sham of assassinating one of its leaders. In response, Tahrir al-Sham security officers raided several Movement headquarters in the areas of Rahal and Khan al-Asal and arrested several Movement members.

The infiltration aspect is also a prominent task of operation security officers. Many Ahrar al-Sham Movement members acknowledge that Hayat Tahrir al-Sham’s approach enabled them to take control from the movement and dismantle a large part of the Movement’s force in northern Syria in July 2017. The security forces played a great deal in this matter as they attacked the Movement's internal battalions and conducted a coup against them in some sectors.

Operation security officers use improvised explosive devices (IED) as one of their tools. The prevalence of this tool emerges in inter-factional accusations that other factions have assassinated commanders and operatives using IEDs planted under the vehicles they use. In the second half of 2018, Hayat Tahrir al-Sham intensified its security activities in northern Syria, and depended on planting of IEDs and booby-traps, and assassinating other faction members by shooting them or conducting stealth attacks on military checkpoints. There are suspicions among those in the field that al-Qaeda's jihadi organizations are also behind some of these attacks. In some cases, the assassination of faction commanders may be an internal matter, supervised or undertaken by security agents, resulting from liquidation operations. For example, the information that emerged about Abu Khuzaymah, security officer of Ahrar al-Sham, following the assassination of 40 of the Ahrar’s leaders on 8 September 2014.

It must be noted that operation security personnel many be a group or an individual who operate openly or secretly. Those operating secretly may act as a dormant cell. Those working openly are acknowledged by the faction executive force or security forces and act without cooperating with any other faction.

Security operation personnel have kidnapped journalists, foreign activists, businessmen, financially and socially prominent individuals for ransom. Many examples exist including the Noureddine al-Zanki Movement kidnapping the Italian aid activists Vanessa Marzolo and Greta Ramili in 2014. The pair were released a year later for $ 5 million, according to Hossam Atrash, a leader in the Movement.

In most of the factions, prison wardens perform the same functions as the security services in the prison. They are responsible for monitoring and interrogating prisoners using various techniques including physical torture. All the security elements working in the prisons wear masks, use aliases among themselves and the prison heads are referred to as security officials. 

There are several known security prisons, including Hayat Tahrir al-Sham “Punishment” prison in Jabal al-Zawia in southern Idlib that has become popular since 2015. There is a prison in Sarmin, one in Drakush, Ahrar al-Sham’s former "Bab al-Hawa" prison, “Repentance" prison affiliated to the Army of Islam and the Central Prison in Idlib. There are other sub-prisons known only to the security forces in faction. No human rights institution were able to visit these prisons or observe how the security forces dealt with detainees. Some kidnapped persons were detained in these prisons for months and years without their presence being disclosed or denied. 

It must be noted that faction leaders, who visit the prisons, to preach to prisoners or participate in sentencing prisoners do not have access to the security-controlled detention centers, and cannot meet detainees until they are transferred to the Sharia courts. Prior to their transfer to regular prisons, detainees are held by security services branches in unknown conditions. 

Hayat Tahrir al-Sham has a general security force that apprehended wanted persons as well as a security force assigned to each of its prisons. The prison Special Security Force carries out raids and arrests based on the instructions of the security officials.

Front Security is the substantive counterpart of the military security (with its military functions only), where the front security forces carry out several functions including patrols (in coordination with the border forces of each faction) along Syria’s international border or the strip separating areas of control. Front security forces also patrol roads between areas of control areas, monitoring and controlling the activity of smugglers, limiting the entry of enemy operatives, monitoring the movements of enemy military units and communications.

Protection security and body guards resemble the security and special protection forces or the Republican Guard in some of their functions. The appearance of these forces is part of the stage when factions witnessed an excessive expansion of their resources. Faction leaders appointed more than one person to the task of acting as their escort and personal guard. This phenomenon extended even to small battalions where security guards were responsible for escorting and protecting platoon leaders. These body guards were tasked with constantly monitoring the military headquarters of faction commanders and accompanying them during the field tours. In some cases, battalion commanders had at least two or three guards. 

The task of protection security and body guards expanded later on as large factions assigned battalions for security and protection. These battalions were assigned their own headquarters, cars and uniforms. This shift was accompanied by an increase in the numbers of companions allocated to faction leaders and extending the protection to other leaders in the faction, even judicial leaders. In some cases, the protection security personnel were also assigned the task of escorting outside guests.

The protection security divisions also provide protection for the faction’s vital facilities including faction headquarters and camps, secret operation rooms, ammunition depots and manufacturing workshops, money-keeping facilities and other locations holding precious assets.

Security officials are responsible for overall supervision of the security work, including taking measures to prevent the targeting of camps and premises through redeployment or other measures, evaluating the information provided to them by security personnel and then taking decisions based on intelligence gathered. The security departments are responsible for the overall security of the faction and the geographical area under their control according to the distribution of responsibilities as well as the general task of supervising prison security.

In addition, in coordination with the faction’s leadership, general security supervisors monitor and follow-up on special security operations. These include carrying out operations within the security perimeters in regime controlled areas and deep within areas of conflict. For example, in mid-October 2016, al-Sham Corps conducted a security operation deep within regime controlled areas that resulted in the death of six Russian officers, including a major-general, several guards and officers and Iranian and Syrian translators. The al-Sham Corps leadership and its security officials directly supervised the operation. 

The General Security Supervisor of the Salafist Jihadist organizations has more functions and powers than security supervisors in the majority of organizations. For example, Abu Ahmad Hudud of Hayat Tahrir al-Sham assumes the position of the second man in the Hayat after its commander Abu Muhammad al-Joulani. Hudud played a prominent role in the signing of agreements with the Syrian regime, opposition factions or ISIS. He also played a role in the abduction of journalists and in prisoner swap deals. He was part of major displacement deals.

The Genereal Security Supervisor manages the operations to fight other factions where he supervises the preparedness of fighters in closed combat camps. The security supervisor also can  issue arrest warrants against whoever he wants, including the Shariah officers in the same faction who do not have immunity from security processes.
 

Most of the factions have a security apparatus or security offices and sub-offices. The importance of the security apparatus differs based on the faction, but, generally, the security affairs files are central to the factions’ organizational structures. For instance, Hayat Tahrir al-Sham and the Syrian Liberation Front have a security body, a military body, and two councils; one for Shura and the other for Shariah. On the other hand, the National Liberation Front has a military council that is subdivided into several main offices including a security office. The Syrian Interim Government’s Ministry of Defense corps has security offices subdivided into security committees that are decentralized at the decision-making level due to family, regional or tribal control.

The form of security offices in the Eastern Ghouta is different to other areas where the Rahman Corps and the Army of Islam had a security apparatus subdivided into security offices. While the Army of Islam maintained the security apparatus as directly subordinate to its leadership council, the Rahman Corps dissolved all its security offices in August 2016 and handed them over to the police and judicial institutions. However, these two institutions were under the influence and authority of the Corps itself, so the Corps was attempting to institutionalize its security work within the scope of its military authority over the central sector of East Ghouta.

In every faction or military alliance, there is a supervisor or a general security officer who is in direct communication with the faction commander. The position of the general security officer in the organizational structure varies among factions. For instance, Abu Qusay al-Dirani, the security apparatus general officer in the Army of Islam was also the general commander’s deputy. In  Hayat Tahrir al-Sham, Abu Muhammad al-Joulani is considered the main person responsible for the security affairs files and the leader of each sector in the Hayat is considered a member of the Shura Council and at the same time a security official. On one occasion, Hayat Tahrir al-Sham re-appointed the former security officer Abu Yousef al-Hamawi as a commander for the Hama strip. Abu Ahmad Hadoud, the commander of the border sector, then assumed the responsibilities and powers of supervising the security apparatus in Tahrir al-Sham. The Shura Council of Hayat Tahrir al-Sham maintains broad security authority to monitor and follow-up on the work of the security apparatus and intervene in its decisions if necessary. The security apparatus in Tahrir al-Sham is subdivded into offices according to speciality and geographical distribution, where there is a general security officer and security officers for each geographical location and others assigned to sub-offices, including shift rotation, traffic and market guards, border area, raids and others.

The remaining opposition factions also have a general security officer and supervisor for each geographical sector and officials for branch offices. However, in most cases, they do not have the highest powers at the command and decision-making levels as is the case with the Syrian National Army and the National Liberation Front.

The faction security apparatuses have a pro forma relationship with the Shariah officers who are usually issue legitimate justifications for security work. The Shariah officers may supervise investigations sometimes. They also follow-up on cases in security prisons and participate in security training camps to mobilize and equip elements for the fight against other opposition factions. Shariah officers have different roles in relation to the security officers, where a Shariah officer’s status in the faction, his personal and organizational relationship to the security and faction leadership influence his role.

Within the faction organizational structure, security prisons are directly linked to the security apparatus while civilian prisons are linked to Shariah and judicial offices.

Foreign security officers (immigrants) are clearly represented in the organizational structure of the security apparatuses at the Salafist Jihadist factions, especially Hayat Tahrir al-Sham. The visible representation is due to the relatively high proportion of foreigners within these factions compared to others. Also, the foreigners joining these factions often have previous security experience acquired in other countries like Iraq and Afghanistan.

Among the most prominent examples of these foreign security officers are: the Jordanian Abu Saif whose real name is Ahmed Harbi al-Obeidi. Prior to his assassination, Abu Said was an official in the al-Nusra Front responsible for overseeing the infiltration of other opposition factions. Another example is the ISIS general security official in Idlib, a Russian citizen going by the name Abu Suleiman al-Rusi. He was arrested by Tahrir al-Sham in July 2017.  

In the field of security, Al-Nusra Front benefited from ISIS as most of its security officers were trained in the al-Sidiq Camp in Idlib countryside in 2012. The trainers in the camp were all foreigners who later joined ISIS. 

In contrast, not all other opposition factions relied on foreigners in their security work, and the majority relied on localss. However, some factions’ security offices cooperated and coordinated with al-Nusra Front and Ahrar al-Sham Movement’s security apparatuses until the Ahrar al-Sham Movement shifte to local jihadist salafism. An example of this inter-faction coorperation over security issues was the formation of the Shariah Board in Aleppo city.
 

It is necessary to evaluate the security sector alongside evaluating factions’ experiences as security work is marked by the characteristics of factions’ experiences in every aspect. 

The obvious justiciation for the existence of a security apparatus in any state or sub-state regime is ensuring security (whether social security, system security or the security of the group that the security apparatus serves). These apparatuses fail immediately if they cannot achieve this objective since it is existential.

Observing the security situations in areas outside regime control shows that extensive security infliterations were occuring all the time and that faction security officers were unable to even protect their factions let alone the larger society. Areas outside the regime control continuously witnessed kidnappings, assassinations and explosion operations that affected all social actors including military actors. These violations occurred in tandem with criminal acts that started in 2012 and persist until the present time.

Furthermore, incidents that occured in northern and southern Syria reflect factions’ failure to discover ISIS slepper cells and demonstrate how ISIS, and ISIS affiliated extremist groups, were able to establish themselves within opposition-controlled areas. ISIS and ISIS affiliated groups managed to develop almost complete organizations that included training camps without opposition factions discoveirng them and without revealing themselves to opposition groups!

The factions’ security failure can be explained through four main factors:

Overall, different factions suffered from a lack of vision and they excluded strategists from their work. Factions depended on addressing events in real-time and based on the shifting position of the funders and actors without maintaining long term objectives or developing a real plan to achieve these objectives. The factions’ lack of vision was reflected on the security scene. Security officers in all factions were reoccipied with dealing with events without a project or strategic plan. The lack of a project and vision led factions to favor being exposed to the Syrian regime, ISIS and other actors rather working on developing security cooperation among themselves which resulted in their destruction and displacement from their land.

Despite all the factions have relatively great resources during the past years, they did not succeed in institutionalizing their security work even in what would serve the narrow goals of the faction.

The relative disparity between factions with respect to the existence of a vision and project should be noted here. Hayat Tahrir al-Sham, for instance, has a clearer vision compared to other factions which helped it build a security apparatus that is different from other factions. At the same time, this security apparatus remained relatively primitive compared to the ISIS security apparatus.

The armed factions with their ideological and regional diversity failed to unite and failed to organize joint actions to serve their own interests let alone those of the local community. Since 2013, the different factions resorted to allocating much of their resources to fostering their rivalary and conflict with other factions instead of confronting the regime or ISIS. Sustained inter-faction rivalary wasted any practical chances of joint action. 

The security dossier reflects one of the most prominent forms of faction failure and the most dangerous one since the nature of the joint security actions is based on sharing information with other actors. In most cases, this only happened in limited cases such as when joint security action were conducted in tandem with joint military battles. 

Despite the fact that states have several security apparatuses operating within the same state and they do not coordinate their work for deliberate considerantion, their work still falls under the purview of a security body such as a joint security council or a single official in authoritarian regimes. However, in areas outside regime control, factions developed a unique and unprecedented model as different “security apparatuses” worked in the same geographical area, affiliated to factions that target each other and external enemies without any form of coordination or higher authority to monitor or supervise their work.

For example, in opposition controlled areas, there was no unified database for wanted persons and such a database was not developed as most factions do not have such organized databases.

The security work of all factions including Tahrir al-Sham is marked by simplicity and primitivty even in comparision with sub-state security orgainzations such as the Fateh Movement or Hezbollah’s security apparatuses. Factions’ security work depended mostly on oral reports and paperwork and did not include developing databases.  

In most cases, the officers working in the security sector have no previous experience in the field and did not receive any professional training. They depend on trial and error to develop an approach to the work and on the confidence of the faction leadership.

The research team conducted interviews with several factions’ leaders in northern Syria that revealed that all the investigations that have been conducted over the years with ISIS elements, regime elements and others were not recorded and no central party keeps the investigation records!

The research team’s interviews showed that the regime security branch archives that were obtained in the period between 2012-2013 were completely lost during the conflict with ISIS. The factions took the archive at that time, merely preserved it without copying it or using it in any way. 

Despite the continuous security threats in recent years, different factions were not able to develop their a security tools to counter the threats. For example, car and motorcycle bombs and IED attacks never stopped. Faction response to these attacks after announcing that they are in a state of alert was to install checkpoints and inspect cars manually without using any other tools like trained dogs or explosive detection devices.

In addition to the dependence on primitive tools, there is an objective factor that is related to the huge gap in technological capacities between the factions operating in the field, and the local, regional and international intelligence agencies that are interested in the region. These actors possess devices that enable aerial observation, monitoring communications as well as fostering informant networks. This gap allowed these intelligence agencies to carry out operations in opposition-controlled areas to achieve their objectives in recent years.

Various external operations were carried out based on intelligence. Of the most prominent operations, the assassination of Abdul Qadir al-Saleh, commander of Tawhid Brigade, on November 17, 2013; the assasination of all the Tahrir al-Shma leaders on September 9, 2014; the assasination of Zahran Alloush, commander of the Army of Islam, on December 25, 2015. In addition to dozes of other assasination that were executed via aerial bombardment, IEDs or direct gunfire.

It must be mentioned that all the assasinations of faction leaders were carried out while they attended meetings in secret headquarters and when they were in their main headquarters or their normal place of residence. Moreover, the operations were executed shortly after their arrival at these headquarters demonstrating the size of the exposure of all these factions.

For years, factions have been preoccupied with rivarly and fighting with each other within the areas of control. They shifted their approach from conducting offensives on the regime or ISIS to a defensive mode. In recent years, factions intitiating a confrontation against the regime or ISIS became the exception that required the faction to declare an emergency although fighting them is the raison d’etre of the factions. 

During interviews with former security officers and actors in factions, the research team found that most of the factions’ security work is concentrated on collecting information within the local community and monitoring the activities of other factions, civil institutions and faction members. The interviews also revealed that faction security officers had limited security sources in regime-controlled areas or areas controlled by other parties. 

The factions’ preoccupation with their rivarly is attributed to several factors including their security sections’ practical inability to confront major states’ security projects and the lack of vision among faction commanders. These factors resulted in faction commanders limiting their aspirations to inter-faction competition to gain control of small geographical areas.
 

The fate of elements working in factions’ security sector is largely tied to the factions’ overall fate. However, they are distinguished from other faction members by the special expertise they acquired and the type of information they possess or have accessed. These affect their future prospects in the event there is a change in the political and military conditions that gave them the opportunity to work as security officers in the first place. So far security elements in factions in Homs, Damascus countryside and Daraa have faced this change in the political and military conditions.

The possible fate of the security officers depends on several factors, most importantly:

1. The type of functions security officers are assigned to: security officers in high administrative positions who have access to sensitive and strategic information face a different fate to security elements in executive positions such as elements working as guards, carrying out executions or torture in prisons.

2. The local and regional position of the faction: the situation of security officers affiliated with a faction that is party to a local or regional political settlement is different to the situation of officers affiliated with a faction that is not part of the same settlement or if the faction is on an international target list.

3. The manner in which a faction dissolves and its location: factions that are dissolved as part of certain settlement may secure a more “decent” existence for its elements than those that cease operating due to military defeat in battle.

4. The form and nature of the political solution reached: For example, a solution that maintains a special situation for the northern region will be different from a solution that imposes regime control on all regions without exception. Also such a settlement will be different from one where pro forma or essential adjustments are conducted to the structure of the regime.

According to these factors, elements working in faction security sector face several possible scenarios in the event opposition control over areas cease for any reason. The main possibilities are:

1. Return to a form of ‘normal’ life:  in a way that is similar to normal fighters in the factions. This option can be applied to the security offiers at entry level in the security sectors’ structures and they are the majority of security elements.

2. Physical liquidation: the assassination of security officers by the regime or its allies, international parties to the conflict or even other actors within the same faction due information officers may have acquired or accessed during their time in the faction security sector. The information may be a source of concern for any of these actors who do not want the information published or used by other parties for legal or political blackmail.

3. Polarisation by local or international political parties: in this case, security officers return to undercover work or work within small groups like they used to work in 2011. They may offer their service to state or sub-state actors where this “cooperation” is based on intellectual motives such as the security worker seeing his political stand towards the current political regime, represented in a specific party’s project. Such a cooperation may be based on mutual interest whereby the security officer obtains sums of money or logistical services in exchange for the “security services” provided.

4. Re-positioning geographically: security officers, especially those affiliated with Jihadist factions, moveto “new Jihadist fields”. In this case, they employ the security expertise they acquired in Syria elsewhere and avoid any other possible scenario occuring. 

5. Joining the state security regime:  they join the state security apparatus, either as individual or as a whole faction security sector. On the individual level, some security officers may join  the regime’s security apparatus where they will be expected act as informants and sources of information. They would not be considered part of “circles of trust”, unless one of them was orginally connected to the security apparatus during his work in the faction security apparatus. In the case of integrating the sector apparatus as a whole, this may be achieved by forming a parallel official security apparatus within the state structure such as the information department in Lebanon. Alternatively, the security sector may serve as security apparatus within a non-state entity similar to Hezbollah’s security apparatus in Lebanon. Both forms are tied to the type of future settlement that is reached in Syria. 
 

Opposition factions’ security sectors emerged in parellel to the formation of the armed factions. Some of the security groups were part of an armed faction, other security groups become armed factions with time and in other cases, some groups emerged that were not part of the factions’ environment and did not enter into it.

Over time, factions security groups expanded and became the striking force for faction leaders in areas under their control with the expansion of the opposition control and factions’ increased resources since 2012.

Despite armed factions having large resources for some time, even if unevenly distributed, they did not succeed in investing effectively in their security groups even in what may have served their narrow factional objectives.

Observing the security situation in areas outside regime control, reveals that the factions suffered from almost complete security exposure. Their security sectors failed to achieve their existential objective of ensuring “security” whether of the faction or wider society. This failure is attributed to several reasons: most importantly, faction leaders’ lack of vision that led to inter-faction rivalry and conflict at the expense of cooperating to face common threats. Other reasons include, the lack of professionalization and specialization among security officers, their dependence on primitive work methods and the lack of security cooperation with other factions.