How Russia Will -- and Won't -- Respond to the Moscow Terror Attack

(STRINGER/AFP via Getty Images)

A law enforcement officer patrols the scene of the terrorist attack at the Crocus City Hall concert venue in Krasnogorsk, outside Moscow, on March 23, 2024.

The Russian government will respond to the Moscow concert hall attack with concrete but limited actions that will not eliminate the threat of future terrorist attacks in the country, while the Kremlin will use the massacre to maintain and potentially increase Russia's options in pursuit of its war in Ukraine. Hours after armed assailants attacked the Crocus City Hall near Moscow, killing over 100 people, the Afghanistan-based Islamic State Khorasan Province (ISKP) claimed responsibility for the assault. Over the past week, however, numerous high-ranking Russian officials — including President Vladimir Putin — have alleged Ukraine was involved in the deadly terrorist attack, while downplaying the ISKP threat. On March 25, Putin said the attack fit ''quite logically into the intimidation campaigns that Kyiv is carrying out'' and that Russia was interested in finding who gave the order to conduct the attack, noting that it was the United States that was ''trying to convince everyone that there is supposedly no Kyiv trace'' in the incident. The next day, the director of Russia's Federal Security Service (FSB), Alexander Bortnikov, said that while the attack was conducted by radical Islamists, Ukrainian special services ''facilitated'' or ''contributed to'' the assault; he also claimed the perpetrators fled in the direction of Ukraine, where Kyiv was allegedly prepared to welcome them ''as heroes.'' On March 27, Russian state media outlet RIA Novosti, citing a source in Russia's security services, admitted the individuals who committed the terrorist attack were recruited through the ISKP's Telegram channels targeting Tajiks. But that same day, Kremlin Spokesman Dmitry Peskov stressed that no official Russian version of the attack had been expressed, and called to wait for Russia's security services to settle on their assessment of the incident. Overall, Russia's continued use of vague and general language about Ukraine ''facilitating'' the attack, as opposed to participating in it — combined with the government's failure to support this accusation with evidence beyond claims the terrorists fled toward Belarus and Ukraine — confirm Moscow does not have any serious information indicating Kyiv's involvement.

On March 22, armed attackers opened fire and detonated explosives inside the Crocus City Hall — located some 20 kilometers from Moscow's city center — as a concert was taking place at the venue. In the early hours of March 23, ISKP claimed responsibility for the attack on the group's Telegram channel. The death toll now stands at over 140, marking the deadliest terrorist incident Russia has seen in 20 years and the deadliest ever in Europe that the Islamic State jihadist group has claimed. Russian authorities have since arrested the four suspected attackers, who have all been identified by Russian media as citizens of Tajikistan, in addition to numerous others on suspicions of aiding the attackers in various ways.
On March 26, former FSB director and current secretary of Russia's Security Council, Nikolai Patrushev, said there were ''many'' indications of Ukrainian involvement in the attack, and that more detailed information about this would be released at a later date.
On March 26, Putin reportedly met with top security officials to discuss the investigation into the attack. Hours after the meeting, Bloomberg reported, citing a source claiming to know about the meeting, that the participants agreed there was no connection to Kyiv, but remained determined to use the tragedy as a way to rally Russians behind the ongoing war in Ukraine. Russian Foreign Ministry Spokeswoman Maria Zakharova quickly responded to the Bloomberg report by calling it ''the mother of all fakes.''
There are strong signs Russia was closely monitoring the ISKP threat in Afghanistan before the recent Moscow attack. During an October meeting of the heads of security services in Commonwealth of Independent States (CIS) nations, FSB chief Bortnikov warned the group was expanding its capabilities to the point where it would eventually be able to carry out terrorist attacks outside of Afghanistan. Bortnikov added that ISKP had as many as 6,500 fighters, though in November 2023, the U.S. Defense Intelligence Agency estimated that ISKP had only 2000 active militants.

Moscow will continue to tie the attack to Kyiv and its Western partners to bolster Russia's geostrategic goals in Ukraine. For Russia, directly acknowledging the ISKP threat would fuel public expectations for a more drastic counterterrorism response that would risk diverting a substantial amount of human and material resources away from its war in Ukraine. This is something Russia cannot afford, as the Kremlin believes that the conflict in Ukraine will define Russia for generations, while the threat posed by terrorist groups on Russia's southern frontiers, like ISKP, is comparatively less acute from a strategic standpoint. In addition, taking too drastic of action to reduce the ISKP threat — e.g. a sweeping crackdown on Central Asian migrants — would risk economically damaging Russia and its Central Asian partners by robbing the former of a source of cheap labor and the latter of a source of crucial worker remittances, which would increase rather than reduce the Islamist threat since poorer people are typically more vulnerable to radicalization. Therefore, while Moscow will formally acknowledge that ISKP militants conducted the Crocus City Hall attack, it will also keep insinuating that the attack was the result of U.S. foreign policy and that Kyiv could have played some role in the perpetrators' alleged escape attempt — both to reduce Russians' desire for destructive, excessive measures to combat the ISKP threat, and to rally support for the war in Ukraine by further villainizing Kyiv and its Western partners. Indeed, Russia will likely use Ukraine's alleged involvement in the attack to further justify mobilization efforts later this year in response to new Ukrainian mobilization that is set to be finalized in the coming weeks. From a propaganda perspective, Moscow is also compelled to suggest that continued attacks on the homefront, regardless of who perpetrates them and why, will only entrench the Russian government's current course and not lead to a major adjustment in Moscow's military strategy in Ukraine or broader foreign policy.

Russia could step up mobilization efforts later this year to convince Ukraine and the West that further Ukrainian mobilization will not accelerate an end to hostilities. Such a move would also be aimed at pressuring Kyiv into accepting Moscow's conditions for a reduction in the intensity of hostilities. Russia would threaten to surge troops in Ukraine to try to achieve a more decisive victory before letting the war decline in intensity. But Moscow will seek to preserve maximal flexibility to continue the war should Ukrainian mobilization and Western support prove underwhelming, or reignite the war later after using a cease-fire to buy time and resources to address Russia's security challenges on its southern frontiers in Central Asia and the Caucasus.

Russia will reassign security personnel, conduct demonstrative raids on suspected illegal migrants, and tighten some border and migration procedures, but economic and political considerations will constrain Moscow's response and the ISKP threat will persist. Moscow is still in the phase of assessing how the warnings, including from the United States on March 7 about the potential attack involving Tajik citizens, slipped through the cracks. But in the coming days and weeks, Russia will likely undertake a series of measures — some more demonstrative and other substantive — to address the threat posed by Islamist terrorism from Central Asia and ISKP in Afghanistan in particular. There will be massive increases in raids to scrutinize the passports and work permits of Central Asians living in Russia to ensure they are working and residing in the country legally. There will also be an increase in preemptive apprehensions of those suspected of sympathies for Islamist groups. Some FSB personnel and other agencies will be reassigned from activities related to the Ukraine war to domestic radicalism and surveillance of Central Asian migrants. In addition, Russia may formally adjust some of the legal requirements for Central Asian migrants to work in the country. Such legal changes, however, are unlikely to happen quickly and would not fundamentally alter the accessibility of Russia to Central Asians (for example, Moscow is unlikely to introduce visa requirements for Central Asians to travel to Russia). This is because the Russian government will be hesitant to take steps that could threaten a mass exodus of Central Asians or prevent their ability to continue the essential role they play in Russia's economy by providing cheap labor and performing many jobs in the country's construction and extractive industries, among others. Russia's response to the Crocus City Hall attack will therefore be more targeted and behind the scenes. Such a limited response, however, will not defuse the ISKP threat to Russia. This is because millions of migrant workers will continue to reside in Russia and regularly move between Russia and Central Asian states, which — combined with increased freight cargo between Russia and Central Asia, and the ample opportunities for weapons smuggling amid the war in Ukraine — will make it impossible to remove all potentially radicalized Central Asians and their access to illegal firearms.

Just over two weeks before the Moscow concert hall attack, the U.S. Embassy in Moscow issued a security alert on March 7 warning of ''reports that extremists have imminent plans to target large gatherings in Moscow, to include concerts,'' within the next 48 hours. The alert was issued several hours after Russia's FSB disrupted a plot allegedly orchestrated by a cell of ISKP members to attack a synagogue.
Russian media and analysts are already reporting a spike in hate crimes and violence against migrants from Central Asia, which risks making these migrants more vulnerable to radicalization. On March 27, Putin said ''Russia is a multinational and multi-religious country, we need to take care of interethnic peace in the country,'' presumably in response to the massive reports of crimes, abuses and discrimination against Central Asians in Russia following the March 22 attack.
Central Asian migrants have become even more important to Russia's economy as a result of the invasion of Ukraine, which has increased inflation and exacerbated labor shortages inside Russia. Central Asians (excluding Turkmenistan), can currently travel to Russia for up to 90 days without needing additional documentation. All Central Asian states derive a significant percentage of their GDP from remittances from migrants working in Russia. Tajikistan's economy is particularly dependent on this revenue source, as such remittances from Tajik workers in Russia generate around a third of the country's GDP. Russia is interested in preserving such flows of remittances to prevent these nearby Central Asian economies from collapsing, creating millions of unemployed individuals vulnerable to radicalization and, in turn, political and social instability that could spill into Russia.

Moscow will also step up its activities inside Central Asian partner states and invest in increasing their counterterrorism capabilities. On March 26, Reuters reported that Russian security personnel in Tajikistan were questioning the families of the four perpetrators charged with carrying out the deadly attack. Such activities are likely to only grow in scope and scale in the coming weeks as the family and associates of not only the perpetrators, but the numerous other Tajiks detained in Russia over the attack, are questioned. Russia will also likely use the attack to pressure Central Asian governments into deeper cooperation, as the geopolitical importance of Central Asia has grown since the invasion of Ukraine, with Russia and China seeking to ensure close alignment with regional governments to keep them from balancing toward Turkey and the West. To ensure its ties with the region's security services remain strong, Moscow will step up efforts to help Central Asian partners conduct counterterrorism operations, monitor citizens, prevent radicalization, and report their findings to Moscow. Russia will also seek to elevate its political coordination with regional governments by inking new bilateral agreements or by increasing meetings of permanent working groups, including within the Collective Security Treaty Organization, devoted to threats emanating from Islamist groups in Afghanistan. However, stepping up regional surveillance and security efforts in remote and cash-strapped countries like Tajikistan will come with a financial cost that Moscow may not be able to quickly front. Regional governments will also want to ensure such measures do not anger their own citizens, excessively strain their already tight budgets, or make them a greater target for ISKP attacks.

Russia will likely consider conducting strikes inside Afghanistan against alleged ISKP camps to degrade the group's abilities and deter future attacks. But there is likely a limited number of targets that would have a tangible effect on ISKP's ability to conduct attacks abroad, which means such strikes would probably be more symbolic in nature and do little to defuse the threat of further ISKP terror attacks in Russia.
Russia may also selectively increase security cooperation with the Afghan Taliban by, for example, sharing more counterterrorism information with the group. The Taliban, for their part, could quietly accept this Russian cooperation to increase their domestic legitimacy by showing the group's commitment to improving Afghanistan's security, as well as their international legitimacy via leverage over Moscow and Afghanistan's Central Asian neighbors.