This article is part of Evolving Threats to Southeast Asia’s Maritime Security, a series of analyses produced by experts convened by the S. Rajaratnam School of International Studies.
How has the maritime terrorism threat evolved over the last 20 years?
Twenty years ago, terrorist organizations such as Jemaah Islamiya (JI), the Kumpulan Mujahidin Malaysia (KMM), and the Abu Sayyaf Group (ASG) of the Philippines were all assessed to have high levels of maritime capability. Some of these capabilities were demonstrated through successful operations. In the period since, their capacity has been diminished but it would be premature to assess the threat as become null.
ASG, whose members are predominantly from the island provinces of Sulu and Basilan, had the greatest capability to launch maritime terror attacks, as they did when raiding towns such as Ipil (killing around one hundred people in 1995) and conducting many kidnap-for-ransom attacks against vessels and coastal communities. The same group caused more than 100 deaths in February 2004 by bombing the ferry Our Lady Mediatrix. Abu Sayyaf was also connected with the bombing of SuperFerry 14 in Manila Harbor, an attack where 116 people perished. JI, the group with the widest geographic range of operations failed to pull off similar attacks in the maritime domain, but authorities uncovered plans for several such attacks around Singapore and there was great concern about threats impacting shipping in the Strait of Malacca. Terrorist activity outside the region, including the 9/11 attacks in the United States and the bombing of USS Cole (2000) and MV Limburg (2002) in the Middle East, brought Southeast Asian maritime threats into the global spotlight.
These terrorist organizations were empowered by their interlinkages with regional networks and the interconnectivity provided by the sea. Many of the linkages between these groups had begun during the 1990s in the landlocked Afghan war, and the post-9/11 United States wars in Afghanistan and Iraq provided more veterans. Back in Southeast Asia, the organizations used maritime routes, especially through the Sulu-Celebes Sea, to move personnel and equipment for training and operations. JI members from Indonesia and Malaysia would come to the Philippines for combat training while experts from Malaysia and Indonesia would train Philippine-based groups in bomb making and war strategies. ASG served as a main channel that linked the Malaysians and Indonesians with local armed rebel groups such as the Moro Islamic Liberation Front (MILF) and Bangsamoro Islamic Freedom Fighters (BIFF). For instance, Zulkifli Marwan, a Malaysian and a member of KMM, trained BIFF members in bomb making, while Mahmud Ahmad, also a Malaysian, allegedly facilitated the creation of the Dawlah Islamyyah alliance in Southern Philippines that went on to initiate the attack in Marawi in 2017.
Over the last two decades, the evolution of maritime terrorism in Southeast Asia has been inextricably linked with others issues of regional terrorism, as operations at sea are extensions of those ashore. Improved state counter-terrorism capacity, capacity-building activities, and international cooperation have enabled the steady dismantling of organizational structures and stripped the groups of their capabilities. Those with the least maritime background, such as the urban-based JI, lost their maritime capacity first. Organizations with many seafarers in their ranks continued to make attacks on vessels around the tri-border area of the Sulu-Celebes Sea—many now affiliated with the Islamic State (IS) in Sulu province. However, ultimately, the Philippine government’s victory in the Marawi Siege left fighters without leaders or direction. Kidnap-for-ransom activities spiked for a short as the terrorists scrambled for resources and the area came to be considered the “fastest growing piracy hotspot…and an increasing successful kidnap and ransom business model.” However, Philippine authorities systematically registered watercraft, isolated would-be culprits from the vessels needed, and implemented a range of other countermeasures. With the criminals short on skilled mariners and lacking access to watercraft, the last kidnap-for-ransom attack in this area took place in 2020.
What are the primary governance tools that are being used in response to the maritime terrorism threat?
While much of the effective rollback of the maritime terrorism threat is based on the dismantling of the organizations ashore, specific law enforcement activities take place in the maritime space. Increased maritime patrols and military presence in areas affected by terrorism, such as Malaysia’s Eastern Sabah Security Command (ESSCOM), have been important governance tools. This, coupled with state-verified International Ship and Port Facility Security (ISPS) code compliance, contributes to protecting maritime infrastructures and reducing terrorist activities.
Due to its transnational nature, maritime terrorism also requires international responses. In May 2016, the governments of Malaysia, the Philippines, and Indonesia started discussions on a formal agreement for joint patrols in the Sulu-Sulawesi Sea and intelligence sharing to address the series of kidnappings by the ASG. In June 2017, the Trilateral Cooperation Agreement (TCA) was signed to cover both air and sea patrol.
The TCA involves information sharing, communications, and the creation of Joint Maritime Coordinating Centers in Tarakan (Indonesia), Tawau (Malaysia), and Bongao (Philippines). The signing was fast-tracked largely due to the Marawi siege happening then in the Philippines, initiated by the IS-affiliated groups of which the ASG was a major player. The signing of the TCA was a proactive measure focused on preventing foreign terrorist fighters from entering the Philippines and Marawi siege fighters from escaping to Malaysia or Indonesia through the porous maritime borders. The TCA is also a formal recognition that unguarded coastlines have long been used as trading, smuggling, and piracy routes by criminal groups plying the area.
What are the primary harms maritime terrorism poses to regional stakeholders?
Maritime terrorism accounts for only a small number of all acts of terrorism and, with exception of the ferry bombings of the early twenty-first century, those attacks have been relatively minor. However, terrorists use of seas for fundraising and logistics remains a major concern. Furthermore, while it has been nearly twenty years since a terrorist organization was able to kill more than 100 people in a single attack, the steady beat of smaller scale, yet still brutal, attacks continued until much more recently. For example, the International Maritime Bureau counted nearly 200 actual and attempted armed attacks on ships in the Southeast Asian littoral during the 2014 to 2018 period, and analysts have pointed out the ASG was the “perpetrator of the vast majority of the attacks.”
Terrorist groups in the region have proven to be resilient and have the flexibility to level up their capability based on necessity. The Abu Sayyaf Group, credited for most attacks in the Sulu-Sulawesi seas, demonstrates this adaptability. Records show that, beginning in 2016, the ASG “moved its operations farther out to sea, conducting kidnappings of seafarers while ships were underway. Its cadres initially targeted smaller vessels, but soon began attacking larger vessels.”
Though the rate of attacks has since subsided, kidnapping threats against tourists in east Malaysia and the movement of victims across the sea to the Philippines also remains a significant concern, as it acts both as a threat to the tourism industry and its patrons, as well as a fundraising mechanism for terrorist activity. The use of the seas for logistics and the movements of terrorist group members is also important. Malaysia’s Sabah, for example, is recognized as an important terrorist transit point.
How has maritime awareness developed to reduce the maritime terrorism threat?
Under the terms of the TCA, patrolling, and coordination have commenced, but the exchange of intelligence information remains at the preliminary stage with the various national interests complicating progress. All three partners are embroiled in overlapping geopolitical concerns (i.e. the overlapping claims in the South China Sea; the territorial dispute over Sabah between the Philippines and Malaysia; and the Sarawak issue between Malaysia and Indonesia) and these stand in the way of information-sharing efforts. While terrorist networks themselves have proven their inter-operability over more than two decades of cooperation, inter-governmental partnerships remain, in some ways, juvenile.
What additional context is necessary to understand the maritime security challenges associated with the maritime terrorism threat?
Six years on from the signing of the TCA, it is difficult to determine its effectiveness in mitigating maritime terrorist attacks. Despite the desire of states to cooperate, the geopolitical relations and national interests of the three states continue to pose challenges. The effectiveness of efforts against maritime terrorism is also linked to the respective countries’ efforts in dealing with domestic triggers of armed rebellion, the management of security policies and mechanisms, and the capability of their respective state security forces.
To move forward, the following steps are necessary to manage the issue of maritime terrorism and security, specifically for the countries Malaysia, Indonesia, and the Philippines. First, the three countries must develop a common watchlist on the high-value targets. The common watchlist will help the three countries “skip” the national interest debate and focus exclusively on counter-terrorism operations. Second, the TCA must be embedded in the domestic legal and security practices of the three countries, to facilitate a whole-of-government or convergence approach in defense and law enforcement operations. Third, more people-to-people engagement is necessary as a parallel effort to monitor and address issues related to terrorism and security, and; fourth, the domestic triggers of armed rebellion (e.g. poverty, lack of political and economic space, discrimination, bad governance) must be addressed.
 Author’s various conversations with Philippine-based intelligence officers, 2016-2022
 Ibid. Both have been killed in separate occasions. Marwan was killed in a police operations in the Mamasapano province in 2015, while Mahmoud was killed at the height of the Marawi siege in 2017.