An Iraqi man inspects damage after a bombing in Kirkuk last month. (Marwan Ibrahim — AFP via Getty Images)

Long before U.S. officials declared al-Qaeda to be on the ropes, taking hits to the body and the head, they were making similar declarations about a more discrete enemy: the group’s affiliate in Iraq. In 2008, with American forces making substantial gains in the war, the CIA’s director at the time, Michael V. Hayden, pointed to a “near-strategic defeat” for al-Qaeda in Iraq.

More than three years on, there’s little doubt that the U.S.-led effort to counter al-Qaeda in Iraq has vastly weakened the group. Its members now number no more than 1,000 and it lacks the ability to challenge the slowly strengthening Iraqi state.

At the same time, as a string of recent attacks show, there’s also little doubt that al-Qaeda in Iraq, or AQI, remains active. And that, a counterterrorism expert argues in a new analysis, means it is still dangerous, both in Iraq, where about 300 people died every month in terrorist attacks last year, and possibly even in the West.

“We need to be paying closer attention,” Brian Fishman, of the New America Foundation, said in an interview. “The nature of AQI has changed.”

Fishman writes in a new paper that a tendency to celebrate the end of AQI is allowing U.S. policymakers to ignore the threat it poses. Smaller and less ambitious, it is also more resilient. And while the Iraqi security forces are still shaky, there are areas around Mosul in the north of Iraq, Anbar in the west and even in Baghdad that might reasonably be described as safe havens for the group’s members.

“They don’t need that much space,” said Fishman. “They don’t need training camps like they had in Afghanistan pre-9/11, where they went around on monkey bars. It wasn’t the monkey bar training that allowed them to take down planes on 9/11, it was the ability to sit and think of ways of hijacking an airplane. And today you need even less space.”

Fishman’s worry is that AQI, no longer preoccupied with trying to create an Islamic state in Iraq, will heed calls from al-Qaeda leaders to expand operations and attempt to strike the West. Some, like Abu Yahya al-Libi and Atiyah Abd al-Rahman – reportedly recently killed in Pakistan – have explicitly called for more such attacks.

AQI is organized and has the ability to stage coordinated strikes. Meantime, while the numbers of operators in Iraq is small, the Yemen-based al Qaeda in the Arabian Peninsula (AQAP) has shown that a small number of people working in a weak state can make ambitious plans. The many Western connections to Iraq – the embassies, companies and NGOs – might also make the process of planning an attack in the West easier than in isolated Yemen.

In his analysis, Fishman suggests that “a weakly governed Iraq may offer a better platform for al-Qaeda attacks against the West than AQAP’s increasingly chaotic home in Yemen.”

“If they developed the desire to operate outside Iraq’s borders, it seems like they’d be able to do so,” he says.

Fishman says, as in Iraq, the counterinsurgency strategy in Afghanistan could very well fail to eliminate the terrorist threat even if the broader insurgency is defeated. Elements of the Taliban could reconcile with the Afghan government, and the Afghan state could function on its own. But “if we have an environment in Afghanistan that relies on the state to defend itself against the Taliban and control major cities, that doesn’t necessarily mean it has the ability to control its territory to the degree where terrorist organizations cannot operate,” Fishman says.

What do the limits of counterinsurgency mean for long-term U.S. foreign policy? Reluctantly, Fishman concludes that Washington is probably best off maintaining some American presence in both Afghanistan and Iraq to support local security forces and to monitor regional threats. But, he says, there are trade-offs involved. The presence of American troops in either country – not to mention Pakistan, Somalia or Yemen – is used as a recruiting tool by extremists.

“Whether we acknowledge it directly or not, we have tacitly made the choice that we have reduced the risk of the large attack but increased the risk of the small-scale one,” he says.

“That’s frankly probably the right policy for us,” he added, “but we have to honest with ourselves about the trade-off.”