The Challenges of Effective Counterterrorism Intelligence in the 2020s

Editor’s Note: The terrorism threat is constantly evolving in response to social, political and technological change as well as adapting in response to counterterrorism pressure. Bruce Hoffman, my Georgetown colleague who is also a senior fellow at the Council on Foreign Relations (CFR), joins Jacob Ware of CFR to identify how the terrorism threat might morph in the months and years to come and the implications for counterterrorism.

Daniel Byman

***

The terrorist threat is vastly different today than it was on 9/11. Social media has empowered extremist movements and terrorist groups to network and organize online, making it far easier for them both to recruit newcomers and to direct or inspire attacks. Violent far-right extremism has reemerged as a threat, inspiring a number of devastating attacks across the Western world targeting Jews, Christians and Muslims alike. And the United States’s terrorist decapitation policy, which has led to the high-level killings of al-Qaeda’s Osama bin Laden and Anwar al-Awlaki as well as the Islamic State leader Abu Bakr al-Baghdadi, has damaged each of those terrorist entities—even though the threats they respectively pose continue largely unabated. But beyond those transformational changes, a number of smaller transitions and subtler trends are taking place, all of which have the possibility to dramatically alter opportunities and successes for the United States in the ongoing war on terror. From the increasing prominence of terrorist manifestos to the dominance of lone actors to the convergence of extremist ideologies, these changes are likely to intensify throughout the next decade—presenting new challenges and hurdles to intelligence and law enforcement agencies charged with countering this highly dynamic and evolving threat.

Blurring Domestic and International Terrorist Threats

First, the blurring of the distinction between domestic and international terrorism will affect the existing division between foreign and domestic intelligence and intelligence and law enforcement and how government organizes to respond to such overlapping threats. In an increasingly networked world connected by social and digital media, any practical distinction between domestic and international terrorism has almost completely disappeared.

International jihadist groups today, for instance, rely largely on local, lone actors to commit violence. In May 2016, Islamic State spokesman Abu Muhammad al-Adnani implored followers in the West to attack in their home countries, rather than join the fight in Syria and Iraq. “The smallest action you do in their heartland is better and more enduring to us than what you would if you were with us,” he declared. “If one of you hoped to reach the Islamic State, we wish we were in your place to punish the Crusaders day and night.” His call to arms was answered by followers thousands of miles away, manifesting itself in deadly violence in the United States and several of its European allies. In the United States, the deadliest Islamic State-inspired attack, which occurred in Orlando, Florida, in June 2016, was perpetrated by a native New Yorker living in Florida, acting alone.

The Islamic State’s success in enlisting persons through social media with hitherto little or no connection to the organization has arguably revolutionized contemporary terrorism. A new generation of violent far-right extremists, whose ideological predecessors pioneered this same leaderless resistance/lone wolf strategy in the early 1980s, has today weaponized social media as a means to radicalize and inspire serial acts of violence. In addition, extreme elements of the far-left and anarchist movements as well as the most violent fringe of the incel (involuntary celibate) community have adopted this strategy. Organizational entreaties for precisely this kind of lone-actor violence were reiterated most recently in early 2020 by since-deceased al-Qaeda in the Arabian Peninsula leader Qassim al-Rimi. According to the SITE Intelligence Group, Rimi called on Western Muslims—including the “dear delegate over there, dear student, dear journalist, dear doctor, dear engineer, dear merchant, dear worker, dear Arab and non-Arab Muslim”—to attack Americans and Europeans with whatever means at their disposal.

Meanwhile, extremist movements that have traditionally been focused on local issues are paradoxically growing increasingly international. Brenton Tarrant, perpetrator of the New Zealand mosque shootings in March 2019, was an Australian who had spent years traveling and meeting with like-minded extremists in Europe, prompting the Soufan Center, a leading international risk-assessment think tank, to deem his attack “possibly the first example of an act of terrorism committed by a white supremacist foreign fighter.” Tarrant’s attack was an extreme manifestation of what British academician Graham Macklin calls “the self-referential nature of extreme-right terrorism,” in which extremists often look to predecessors beyond their own borders for inspiration. Tarrant, for instance, cited Norwegian terrorist Anders Behring Breivik as his foremost inspiration, and Tarrant in turn inspired a Texan to open fire at an El Paso Walmart in August 2019, killing 23. A U.S.-based neo-Nazi group, the Atomwaffen Division, has similarly inspired like-minded extremists to establish their own affiliated branches of the group in Canada, the United Kingdom, Germany, the Baltics and Russia. And The Base, another neo-Nazi organization that originated in the United States and hopes to precipitate a race war, recently sheltered Canadian army reservist Patrik Mathews in the United States for several months before he was arrested for plotting attacks at a gun rights rally in Richmond, Virginia, in January 2020. The group’s leader is an American now living in Russia, its membership spans four continents, and one of the group’s cells claimed responsibility for an arson attack in Sweden, thus further muddying the hitherto clear distinction between domestic and international terrorism.

Even attacks linked to foreign terrorist groups, or attacks in which the perpetrator has claimed them in the name of a foreign organization, have been almost entirely domestic terrorist operations from conception to execution—as has been displayed to devastating effect in San Bernardino, Orlando and New York City. Of course, the succession of terrorist incidents involving local, lone actors outlined above does not necessarily suggest that terrorist organizations, leaders, and command, control, and communications chains have either disappeared or become irrelevant. Indeed, it is worth noting that the December 2019 shooting at a U.S. Navy installation in Pensacola, Florida, provides an outlier to several of these emerging trends. It involved an international plot as well as a gunman who took advantage of his privileged access to the very definition of a hard target—a U.S. military base. The incident was thus a timely reminder of the enduring threat of a seemingly bygone era: It was the first attack successfully orchestrated by a foreign terrorist organization on U.S. soil since 9/11.

The Age of the Manifesto and the Livestream

The Islamic State’s remarkable success in speaking to a global audience via social media and digital technology is now being replicated by a variety of other adversaries, including violent far-right and far-left extremists as well as by so-called violent incels. In 1974, Brian Jenkins famously described terrorism as “theatre.” Today, it has become a deliberately homicidal form of performance art, in which individuals produce, choreograph and broadcast their violence themselves via social media in real time to global audiences, completely bypassing the reliance on the traditional media of the past. As a result, we now live in an age of the manifesto and the livestream.

Inspired by Breivik’s twin 2011 attacks on the Norwegian prime minister’s office in Oslo and a youth camp on the island of Utøya in order to publicize his 1,500-page manifesto, Tarrant, for instance, took full advantage of modern communications technologies both before and during his own twin attacks in New Zealand. He publicized the impending violence over Twitter, advertised it on the anonymous imageboard 8chan, and posted links on both platforms to his 74-page manifesto, which he titled “The Great Replacement.” Tarrant also strapped a camera to his forehead to livestream the shootings via these sites and posted additional links to the footage on the internet, complete with instructions on how to access them. Since the Christchurch attacks, at least three additional white supremacist gunmen have sought to livestream their assaults on places of worship. Two incidents occurred on Jewish holidays. The 2019 Poway, California, shooting, that killed one person and wounded three others, coincided with the last day of Passover and the Jewish Sabbath. The livestream failed, as did the attempted streaming of the August 2019 shooting at a mosque in Bærum, Norway. The most recent attack occurred two months later in Halle, Germany, on Yom Kippur, the Jewish religion’s most sacred holiday. Two people were killed, and this time the livestream worked. Armando Hernandez Jr., the incel-inspired gunman who injured three at the Westgate Entertainment District in Glendale, Arizona, in May 2020, also streamed parts of his shooting on Snapchat.

Today’s terrorists also often post texts just before their attacks to publicize their grievances and deliberately inspire others to follow in their footsteps. Terrorist manifestos are growing increasingly important and, crucially, are not confined to white supremacist and white nationalist terrorism. Male supremacy has now emerged as a new terrorist threat. Elliot Rodger, referred to by members of the violent incel movement as their “patron saint,” conceived his 2014 stabbing and shooting attack as a platform to publicize his 141-page manifesto. Rodger emailed it to nearly three dozen addresses to ensure its wide distribution. The manifesto, titled “My Twisted World,” publicized the existence of a viral online movement comprising young men whose failure to find female sexual partners had driven them to violence. It has since helped inspire at least seven subsequent attacks that have claimed the lives of around 50 persons. The most lethal incident to date occurred in April 2018 in Toronto, Canada, when Alek Minassian rammed a vehicle into pedestrians, killing 10. “All hail the Supreme Gentleman Elliot Rodger!” Minassian had written in a Facebook post.

Manifestos and livestreams have led to one of the more callous recent terrorism innovations. In what experts have called “the gamification of terror,” terrorism has evolved into a kind of real-world video game, in which extremists encourage one another to top each other’s “high scores.” The perpetrator of the Halle shooting in October 2019, for example, ended his manifesto with a list of “achievements” that he hoped to unlock. Points would be scored, he explained, for killing Jews, Muslims, Christians, blacks, children and communists, as well as through the use of different means, including 3D-printed guns, grenades, swords, a nail-bomb, and his “secret weapon,” which likely referred to his car. The gunman was doubtless hoping future attackers would tally up his “high score”—and eventually try to beat it.

Livestreams and manifestos are thus the latest expression of an age-old terrorist tactic. In 1972, during that year’s Summer Olympics in Munich, a group of Palestinian terrorists took nine Israeli athletes hostage. Over the next 20 hours, a worldwide audience watched in real time the story’s tragic climax on the tarmac at Fürstenfeldbruck Air Base. The attack’s planners had correctly calculated that the media coverage focused on the Olympiad could be hijacked by the terrorists to bring unprecedented attention to their cause, broadcasting their grievances and generating sympathy, support and new recruits. Far-right terrorists are today adopting exactly the same strategy, but they now have complete control over the production and broadcasting of their acts: releasing livestreams and explanatory manifestos in hopes of not only gaining attention and support but also inspiring similar future attacks.

Evolving Terrorist Tactics

The resources of intelligence and law enforcement will likely be increasingly strained trying to identify and prevent simple, crude terrorist attacks using everyday weapons that require little planning and do not depend on terrorism’s conventional arsenal. Conversely, additional challenges will continue to be presented by the deliberate efforts of a range of adversaries to obviate existing laws and restrictions on weapons through 3D-printing technology and “ghost guns.”

Terrorists are utilizing a spectrum of both simple and innovative weapons to carry out attacks that in some cases minimize planning and logistical preparation and in others effectively render national laws and restrictions on firearms irrelevant. The stabbing, mass shooting and vehicular attacks detailed above are clearly less sophisticated and their perpetrators less capable than their more professional, trained counterparts—such as the multiple Islamic State teams that executed the Paris November 2015 and Brussels March 2016 attacks, largely with sophisticated suicide vests. Nonetheless, they can be just as homicidal. A particular case in point is the truck driven into a crowd of Bastille Day celebrants in Nice in July 2016, which killed 86 persons. Although the death toll from Minassian’s Toronto vehicular rampage was considerably lower, it was no less tragic and underscored the homicidal potential of ramming attacks against archetypal soft targets.

Last fall’s shootings in Halle, Germany, showcased an early—albeit not entirely successful—use of 3D-printing technology for firearms. Stephan Balliet’s manifesto included detailed descriptions of an array of homemade guns and explosives, and cited his primary aim as to “prove the viability of improvised weapons.” Balliet alarmingly also turned his attack into a didactic exercise, likely eschewing the more numerous casualties he could have inflicted using proven, off-the-shelf weapons by instead utilizing a number of homemade guns in order to encourage others to improve on his designs and thereby produce more effective firearms in the future. As Daveed Gartenstein-Ross, Colin Clarke, and Matt Shear have noted, Balliet’s struggles do not diminish the threat posed by 3D-printed arsenals—terrorists implementing new technologies often experience difficulties, but, “after an initial period marked by failure, [violent non-state actors] often get far more proficient, posing a host of dangers that governments move to counter only belatedly.”

In addition to the promise of 3D-printing technology, it is also easy—as a recent New York Times exposé reveals—to evade national firearms laws and restrictions with so-called “ghost guns”: weapons without serial numbers or sales pedigrees that are assembled from kits purchased online. Steven Carrillo, an anti-government extremist who murdered two police officers in California in two June 2020 incidents, used a ghost gun without a serial number to commit the killings. And the aforementioned Canadian white supremacist, Patrik Mathews, was ultimately arrested along with two American far-right extremists on weapons charges after they allegedly built a homemade assault rifle.

There has also been an evolution in terrorist targeting. Largely behind us are the days when terrorists focused on organizing elaborate plots aimed at well-defended and clearly symbolic hard targets, such as embassies, airports, military installations and government offices. Today’s terrorists sacrifice the spectacular for the straightforward. In a now well-established pattern, lone actors of all ideologies attack soft targets—public venues and other gathering places—where their inherent open access inhibits effective defenses and thereby lowers the bar in terms of operational planning and execution. They have increasingly provided a new challenge for law enforcement and politicians alike, not least in how to better defend locations often defined by their openness and accessibility.

Violent Extremism and the Military

The prevalence of members of the military in acts of mass violence in the United States, Canada and Europe also presents on ongoing concern. According to the FBI, of all adult active shooters in the United States between 2000 and 2013, nearly a quarter had some military experience. The bureau also concluded that of 52 “lone offender” terrorists in the United States between 1972 and 2015, 37 percent were veterans or active duty. Both proportions are significantly higher than the roughly 7.3 percent of living Americans who have served in the military.

The growth in the number of persons in Western countries with prior military service and attendant expertise in weapons and tactics has the potential to enhance significantly the capabilities of violent, extremist movements. The American white supremacist movement flourished during the 1980s in part because of the expertise in warfare and training provided by veterans of the wars in Indochina. Louis Beam, Bo Gritz, Randy Weaver and Glenn Miller were some of that movement’s leading figures at the time and were all Vietnam War veterans—some with special operations training and skills. A decade later, America’s most lethal modern domestic terrorist incident—the 1995 bombing of a government office building in Oklahoma City—was perpetrated by a U.S. Army veteran of the First Gulf War. And Glenn Miller would go on to murder three at a Jewish community center in Kansas in April 2014.

Federal law enforcement sources told us that veterans and their experience are now being sought by both violent far-right and far-left movements. As a result of the nearly two-decade long war on terrorism and repeated overseas combat deployments, the U.S. and other countries now have many men and women with what Anthony McCann, in his book about the 2016 armed standoff at the Malheur National Wildlife Refuge in Oregon, describes as “close personal knowledge of contemporary guerrilla insurgency.” Veterans and military dropouts, for instance, have perpetrated terrorist attacks and hate crimes against minority groups in Oak Creek, Wisconsin, and New York City, and have also been responsible for incel-inspired violence in Toronto, Canada, and Tallahassee, Florida, among other places. In addition, groups like the Atomwaffen Division have conducted military training in the Nevada desert, while Ukrainian militant groups have hosted Westerners seeking real combat experience. Canadian soldier Patrik Mathews helped run combat trainings for members of The Base while the group sheltered him from authorities.

The involvement of some military veterans in domestic extremism has also been demonstrated recently in anti-government “boogaloo” plots and violence responding to the nationwide protests against police brutality prompted by the death of George Floyd. In early June, three current or former service members—one Army, one Air Force and one Navy—were arrested in Las Vegas en route to a Black Lives Matter protest with Molotov cocktails and other explosives. The charges they face include state terrorism charges. Additionally, Steven Carrillo, the double murderer who scrawled messages associated with the boogaloo movement in blood at the second scene, was a staff sergeant stationed at Travis Air Force Base and leader of an “elite military security force.”

By no means are we suggesting that individuals serving in the military or who are veterans are any more inclined to embrace extremist views than the general population or are attracted or drawn to extremist ideologies. Rather, this point is a reflection that a much larger potential reservoir of persons with military expertise and knowledge of weaponry now exists—and that they are being courted by extremists who may themselves lack such skills.

Convergence and Obfuscation of Terrorist Ideology

Ideological crossovers have also become a common theme in terrorist violence. Increasingly, individual terrorists are mixing and matching ideologies to justify and explain the targets of their animus and give wider context to their violence. Some far-right militants, for instance, have attempted to make common cause with Islamist radicals to promote their own version of jihad—as is showcased by their common worshipping of Osama bin Laden. The FBI calls this development “ideological convergence,” while terrorism experts Daveed Gartenstein-Ross and Madeleine Blackman have described it as “fringe fluidity.”

Far-right ideologies have catered to and sought to make common cause with other extremist milieus, in order to create new, more broad-based far-right networks. This is especially evident in the confluence of racist language demeaning both minority groups and women prevalent on extremist incel sites. Platforms like the imageboard site 8chan—removed following the 2019 El Paso shootings and then relaunched as 8kun—herald the convergence of the incel movement’s politicized misogyny with the far right’s strident diatribes about immigration and race. The incel community’s most venerated figure, Elliot Rodger, for instance complained in his manifesto that “an inferior, ugly black boy [was] able to get a white girl and not me,” a grievance often repeated in chatrooms today. Elsewhere, the convergence of left-wing concerns over the environment and far-right policies focused on immigration and race has also led to the emergence of a new strand of the radical right: Brenton Tarrant, the Christchurch attacker whose manifesto expressed grave concerns over climate change, referred to himself as an “eco-fascist” and helped inspire a similarly motivated attack in Texas later in 2019; similarly, the aforementioned attack perpetrated by a teenage Swedish member of The Base targeted a mink farm, the type of target more popular among far-left animal rights extremists than more traditional neo-Nazis.

We should also, of course, prepare for the possibility that new extremist movements enter the terrorism stage, choosing to adopt violence as a form of political activism. Modern far-left terrorism has been largely sporadic and (fortunately) has resulted in few deaths, but the movement is growing and turning increasingly militant. A warning sign of the potential escalation of violent far-left extremism—that hitherto has entailed civil disobedience, vandalism and brawling—into terrorism occurred in June 2017, when a self-professed supporter of Sen. Bernie Sanders opened fire on an early-morning baseball practice of Republican Party congressmen that wounded six, including the House of Representatives majority whip. Then, in July 2019, a longtime activist attempted to firebomb a Tacoma, Washington, Immigration and Customs Enforcement facility. Increasing political polarization could provide fertile ground in the future for more consistent far-left violence. And, the counterterrorism intelligence challenges are especially acute with respect to members of the violent far left, who deliberately eschew any organizational framework, are completely devoid of identifiable leaders and an accompanying command-and-control hierarchy, and thus defy traditional conceptualizations of threats coming from actual groups as opposed to grassroots amalgamations of individuals.

The traditional ideological orientation of intelligence gathering and analysis is based on organizations having a single belief system. But growing ideological convergence challenges that orientation. When individuals and organizations embrace a variety of idiosyncratic beliefs culled from disparate and sometimes even opposing thought processes, reconceptualization of the standard ideological organization and attendant countermeasures is needed.

A Family Affair?

There are also indications that terrorism is increasingly turning into a family activity. It is not unusual to find siblings involved in terrorism—three pairs of brothers, for instance, were among the nineteen 9/11 hijackers, and two brothers each committed the 2013 Boston Marathon bombing and the 2015 attack on the Charlie Hebdo satirical newspaper in Paris. But the frequency of siblings and indeed entire families being involved is a noteworthy feature of several Islamic State-linked operations in recent years. Two brothers, the sons of a wealthy Sri Lankan spice trader, were among the Easter Sunday bombers in 2019. At least three sets of brothers comprised the roughly 10-person terrorist cell in Catalonia responsible for the Barcelona and Cambrils attacks in August 2017. Two brothers participated in the November 2015 Paris attacks and two brothers also carried out the March 2016 dual suicide bombings at the Brussels international airport and at a subway station in the city. A husband and wife were responsible for the mass shooting in San Bernardino, California, in December 2015. Three brothers were implicated in a plot to blow up an Etihad Airways passenger plane en route from Sydney to Abu Dhabi in July 2017. And three sets of families were implicated in the May 2018 suicide bombings of three churches in Surabaya, Indonesia, the country’s second largest city. Among them was a family of six—including a nine-year old daughter and her three brothers, ages 12, 15 and 18; another family of six with four children, ages 10 through 17; and, a family of five, among whom was their eight-year-old daughter. Penetrating an Islamic State terrorist cell not comprised of close-knit family is already challenging for the authorities in any of these countries. But gaining access to an intimate, nuclear family presents different operational security challenges of an entirely more formidable magnitude.

To date, family ties have not been as significant among more domestic movements. A Black Hebrew Israelite-linked shooting at a Jewish supermarket in Jersey City in December 2019 was perpetrated by a romantically involved couple, much like the San Bernardino violence four years earlier. Similarly, a husband and wife perpetrated an anti-government-inspired attack against police officers and civilians in Las Vegas in June 2014, in which three were killed. And the Atomwaffen Division had a pair of brothers—the Dentons—in senior leadership positions before one of them, the group’s leader, was arrested. So far, we have not seen modern white supremacist or neo-Nazi violence perpetrated jointly by family members. But we should nevertheless remain vigilant—as several of the other categories show, the violent far-right has a penchant for learning from its jihadist counterparts. This is especially true given that extremist far-right communities often spend time socializing and training their young, as scholars Pete Simi and Robert Futrell outline, “[normalizing] racist extremism among their children by making white power culture central to family life.”

Implications

The emergence of these six trends underscores terrorism’s stubborn persistence and continued evolution—despite the considerable efforts over the past two decades and more to contain it. Terrorists, in this respect, possess a key advantage over their government adversaries. They are intrinsically revolutionary—and, hence, have to be both dynamic and adaptive if they are to survive and continuously evade or obviate the countermeasures arrayed against them. Governments, by contrast, are inherently bureaucratic and therefore reactive—resistant to prompts to change, slow to adapt once they do so, and, in the specific case of terrorism, sometimes averse to warning and therefore disinclined to take signal action. Yet public expectations of safety demand an omniscience and infallibility that is unattainable. The challenge in counterterrorism, therefore, may be seen in Nassim Taleb and Mark Blyth’s observation that “[p]olitical and economic ‘tail events’ are unpredictable, and their probabilities are not scientifically measurable.” But, based on an understanding of current and emerging trends—and the reasons for their evolution—we can at least make sound, though linear, predictions about the future.

Each of the trends described above provides a potential outline for intelligence and law enforcement in preparing their responses to multiplying and, in some cases, intensifying threats that are sufficiently different as to challenge the counterterrorism successes achieved in recent years. Terrorism is getting easier because terrorists can radicalize themselves on social media, no longer adhere to coherent and defined ideologies, use crude tactics and attack soft targets, and often ultimately act alone. Meanwhile counterterrorism is getting harder due to the multiplicity of threats from often vastly different adversaries who, paradoxically, are increasingly finding common ground. Moreover, several of these trends do not present obvious counterterrorism corrections for intelligence and law enforcement, which cannot, for instance, institute or manage countering violent extremism programs or intrusively monitor their own citizens.

Sustained counterterrorism success requires knowing the enemy and challenging terrorists and extremists on the strategic and tactical levels they determine—in former Secretary of Defense James Mattis’s words, “the enemy gets a vote.” If, for instance, terrorists are increasingly blurring the lines between domestic and international, intelligence agencies must also blur their efforts between domestic and international, working ever more closely with domestic partner agencies at state, local and tribal levels, as well as international allies to counter the threat. Agencies are beginning to take this approach, as showcased by the U.S. National Counterterrorism Center’s quiet commencement of domestic extremist tracking. If Western extremist groups intend to continue actively recruiting from the military, we must better protect our war-weary heroes from the allures of domestic militarism and the fraternity provided by secretive extremist groups. Greater cooperation and integration of databases among intelligence, law enforcement, and the military and Department of Veterans Affairs will be required to better address extremist efforts to recruit veterans with combat and other weaponry and tactical expertise and to divert veterans who themselves are drawn to such movements from this violent trajectory. If terrorists are publicizing their ideologies and acts in manifestos and livestreams, law enforcement agencies must make tough calls on whether to allow extremist material on social media or censor it at the risk of violating First Amendment rights and driving extremists further underground. And traditional approaches of counterterrorism focusing on leadership decapitation and targeting organizational logistics and finances will be increasingly challenged by movements where there are no identifiable leaders, no existing organization and no infrastructure to disrupt. Intelligence and law enforcement will therefore need to assess what other vulnerabilities can and should be targeted.

Our ability to respond to these emerging challenges and develop effective countermeasures is likely to define our counterterrorism success in the coming decade. Terrorism is changing—we must adapt too.

The authors would like to thank Simon Cottee, Richard English and Michael Rainsborough for their comments on a previous draft of this article and also the International Centre for the Study of Radicalisation and Political Violence at King’s College London for providing access to the Halle manifesto.