The battle for blame over a deadly terror attack in Moscow

The deadliest terror attack in Russia in decades may not be directly related to the ongoing war in Ukraine, but that doesn’t mean it won’t have implications for the future of that conflict. In fact, the horrific attack has already become one more battle in the ongoing information war between Russia, Ukraine, and Ukraine’s Western allies, including the US. The nature and timing of the attack, as well as its alleged perpetrators, have all combined to make this tragedy fertile ground for conspiracy theories and motivated reasoning.

At least 133 people were killed in the attack on the Crocus City Hall theater just outside Moscow on Friday, where a concert by the veteran Russian rock band Piknik was happening. A group of gunmen wearing tactical gear and carrying automatic weapons shot concertgoers and set fire to the building. Grisly videos circulating on social media seen by Vox show the attackers firing on defenseless people crouched on the ground.

With over 100 people wounded, the death toll is likely to rise, but it is already higher than the 132 people killed in the 2002 Moscow theater hostage crisis — an event with which it shared some disturbing resemblances — and is likely to be the second-worst terrorist attack in Russian history after the 2004 Beslan school hostage crisis in the country’s North Caucasus region, which resulted in more than 300 deaths.

The Islamic State terrorist network has claimed responsibility for the attack and US intelligence officials have said they believe it was specifically the work of the group’s Afghan affiliate, the Islamic State in Khorasan (ISIS-K). (Khorasan refers to a historic region that includes parts of modern Afghanistan, Iran, and Turkmenistan.)

On Sunday, ISIS corroborated its claim by releasing bodycam footage of the attack, which has been verified as genuine by the BBC.

The US embassy in Moscow had issued a warning on March 7 advising US citizens to avoid large gatherings due to reports that “extremists have imminent plans to target large gatherings in Moscow, to include concerts.” Russian authorities also claimed earlier this month to have foiled an ISIS attack on a synagogue in Moscow.

The four suspects, whom officials have identified as citizens of Tajikistan, appeared in court on Sunday, where they appeared to be badly injured.

Colin Clarke, a terrorism analyst with the Soufan Center, said that evidence suggested the four gunmen had experience and training. “If you look at the videos of this attack, the way that they shot, and even the spacing between them when they carry out the attacks, it’s clear they were well-trained,” Clarke told Vox. “It doesn’t seem like these were just local guys who were imbibing ISIS propaganda and decided to do something. I would put money on them being trained in Afghanistan.”

Why would an ISIS offshoot attack Russia? Islamist extremist groups like ISIS-K have long-standing grievances against Moscow dating back to the Soviet war in Afghanistan in the 1980s, as well as the Russian Federation’s brutal counterinsurgency campaigns in Chechnya and the North Caucasus in the 1990s and 2000s and its support for Bashar al-Assad’s government in Syria. More recently, ISIS-K carried out a suicide attack targeting the Russian embassy in Kabul in 2022.

The simple explanation that ISIS was responsible would be an inconvenient one for President Vladimir Putin. It would mean that he had ignored the US warning of an imminent attack, which at the time he dismissed as “blackmail” intended to destabilize Russian society. (In fairness, he would definitely not be the only world leader to recently ignore such a warning.)

It would also be another instance, along with the remarkably detailed US warnings of Russian war plans ahead of the 2022 invasion of Ukraine, when America’s spies seemed to know more about what was happening in Russia than Putin’s own security services.

So it’s not that surprising that Russian authorities are already assigning blame elsewhere.

Moscow points at Ukraine

In a video statement released Saturday, Putin hinted that the attack was linked to Ukraine, saying that the suspects had been detained in the western Bryansk region, which borders Ukraine, and “where, according to preliminary data, a window was prepared for them on the Ukrainian side to cross the border.”

The Russian government has not presented any evidence of a link. None of the videos that are circulating of the detained suspects contain any mention of Ukraine, including a particularly grisly one in which guards appear to cut a prisoner’s ear off. (This video, posted on Russian Telegram channels, has not been verified.)

There are also some indications the suspects might actually have been fleeing to Belarus, which also borders Bryansk. The Latvia-based Russian opposition news site Meduza reported, citing state media employees, that Russian news outlets have been instructed to emphasize possible Ukrainian involvement in the attacks.

Putin has not yet publicly mentioned any ISIS connection to the attack. Russia’s Foreign Ministry spokesperson Maria Zakharova accused the US of using the “bogeyman” of ISIS as cover for its “wards” in Kyiv.

Ukrainian officials have denied any involvement, with Mykhailo Podolyak, a senior adviser to President Volodymyr Zelenskyy, tweeting, “Ukraine certainly has nothing to do with” the attacks. He added: “Ukraine has never resorted to the use of terrorist methods. It is always pointless.”

Earlier on Friday, Ukraine’s military intelligence services had gone further than that, posting a statement calling the attacks “a planned and deliberate provocation by the Russian special services at the behest of Putin. Its purpose is to justify even tougher strikes on Ukraine and total mobilization on Russia.”

The statement noted that the attacks come shortly after Putin’s reelection as president and just hours after the publication of an interview in which Kremlin spokesperson Dmitry Peskov had described the conflict in Ukraine as a “war” for the first time, rather than the Russian government’s preferred euphemism: special military operation. In other words, the attacks would be used to justify a new, more brutal phase of the war for Putin’s new term in office.

Post-fact warfare

To be clear: There is little evidence to suggest at this point that the attacks were planned by Kyiv or were a “false flag” operation by Russia. It seems far more likely that ISIS, the group that has claimed responsibility and has shown itself in the past to have both the means and motivation to pull off precisely this kind of attack, was the actual perpetrator. In addition to the attempted Moscow synagogue attack, a pair of ISIS-K suicide bombings killed nearly 100 people in the Iranian city of Kerman in January.

But there are several reasons why it will be particularly easy for partisans on both sides in the Ukraine-Russia war to believe whatever they want.

First: while Ukraine has never targeted Russian civilians like this and would risk losing all of its international support if it did so, officials like intelligence chief Kyrylo Budanov have been fairly open about helping, though not actively coordinating with, anti-Putin Russian militant groups like the Russian Volunteer Corps and Freedom of Russia Legion. Both groups have carried out raids in Ukraine-Russia border regions, including in recent weeks.

Some of the leaders of these groups have extremist ties of the far-right variety, rather than to Islamist militants. Some Russian media outlets have also suggested the Russia Volunteer Corps may have been involved in the Crocus attack, though the group has denied it. Still, the notion of Ukraine backing militant attacks on Russian soil will not seem far-fetched to Russians nor to their international supporters.

On the other side, those suggesting it was a Kremlin inside job will point to the widespread allegations, with some compelling evidence, that it was the Russian government that was behind a series of apartment bombings in 1999 that were blamed on Chechen separatists.

Those bombings, which caused the deaths of more than 300 people, provided a pretext for Russia’s second war in Chechnya and were a key event in the political rise of then-Prime Minister Vladimir Putin. The Russian government was also accused by Western intelligence services of orchestrating so-called “false flag” attacks in eastern Ukraine to justify the full-scale invasion in 2022.

The Russian government already appears to be using Ukraine’s supposed involvement for propaganda value. “If it is established that these are terrorists of the Kyiv regime … All of them must be found and mercilessly destroyed as terrorists, including officials of the state that committed such an atrocity,” said former president and frequent Kremlin attack dog Dmitry Medvedev.

But as Sam Greene, professor of Russian politics at King’s College London, noted, “The fact that the Kremlin will use the attack for political purposes does not mean it was a false flag.”

The attack has also focused an enormous amount of attention on the US embassy warning from earlier this month. US intelligence agencies operate under a policy known as “duty to warn,” which requires them to warn potential victims, including non-Americans, of imminent lethal threats, as long as it does not compromise sources and methods of intelligence gathering.

There’s no exception for US adversaries: The US privately warned Iran’s government ahead of the ISIS bombings in January. But in this case, many Russian officials and media figures have instead seen the warning as evidence that the US was partly responsible for the attack.

Who is ISIS-K

Finally, the nature of ISIS-K lends itself to conspiracy theories.

The group simply doesn’t map neatly onto either the West’s or Russia’s prevailing geopolitical narratives. Yes, the group has now apparently attacked Russia and Iran this year, but before that, its best known attack was a bombing at Kabul’s airport that killed 13 Americans and more than 100 Afghans in the end stages of the US withdrawal from Afghanistan in 2021. Just a few days ago, German authorities arrested two Afghan ISIS supporters allegedly planning an attack on the Swedish parliament.

Rather than taking sides in the clash between Russia and the West, ISIS’s propaganda has welcomed the war in Ukraine as the opening salvo in “crusader against crusader wars” that they hope will help destroy all their enemies.

“If you think about Iran, the US, and Russia, we’re always talking about great power competition, but ISIS hates all of those countries for different reasons,” Clarke said. Similarly, after the attack in Iran in January, Iran initially blamed the US and Israel despite ISIS claiming responsibility and the group’s long history of targeting Iran.

All of these factors contribute to a situation where it can feel like, as the title of a prominent book on Russia’s media environment puts it, “nothing is true and everything is possible.”

In normal times, the Russian state would be expected to carry out a brutal campaign of retaliation against the group responsible for the attack, as it did in the Caucasus after previous attacks. Right now, however, thanks to the war in Ukraine, Russia’s military and security services have little manpower to spare. Instead, we get Medvedev’s threats against Ukraine and other Russian officials calling for the country to reinstate the death penalty.

Even if ISIS was responsible for the attacks — and there’s every indication that they were —Ukrainians as well as Putin’s remaining opponents inside Russia are more likely to be targeted by the Kremlin’s response.

Update, March 25, 11:00 am: This story was originally published on March 23 and has been updated to reflect news about the identities and nationalities of the alleged attackers.