Terrorists and Technological Innovation

Often when terrorists use new technology, they bungle it—the new bomb design does not detonate or the new video technology fails to upload. Yet terrorists often quickly master new technologies and use them in unanticipated ways. Daveed Gartenstein-Ross and Matt Shear of Valens Global, along with Colin Clarke of The Soufan Center, propose a new way of thinking about this threat. They detail the terrorist learning curve and how counterterrorism agencies respond and adapt.

Daniel Byman

***

On Oct. 9, 2019, a terrorist motivated by anti-Semitic beliefs descended on a synagogue in Halle, Germany, where people were observing the Yom Kippur holiday. Stephan Baillet had penned a manifesto describing his objective as killing “as many non-Whites as possible, Jews preferred.” Bruce Hoffman and Jacob Ware note that Baillet “allegedly used steel, wood and 3-D-printed plastic components” to manufacture three weapons. His use of homemade weapons may have helped him avoid authorities’ scrutiny, and another of his stated objectives was to “prove the viability of improvised weapons.” Fortunately, his innovation seemed to fail, as his weapons jammed three times, probably saving many lives.

The fact that the attack faltered because of its technical innovation may lead some observers to underestimate the significance of its use of 3-D printing. Based on our research into how violent nonstate actors (VNSAs) adopt new technologies, we believe this would be a mistake: After an initial period marked by failure, VNSAs often get far more proficient, posing a host of dangers that governments move to counter only belatedly. We refer to the process by which VNSAs adopt new technologies and refine their methods as the VNSA technology adoption curve.

The Adoption Curve

Baillet’s mixed success in using an emerging technology is consistent with VNSAs’ pattern of adopting these technologies, which tends to progress in four phases:

1. Early adoption. A VNSA tries to adopt a new technology, but initial attempts underperform.
2. Iteration. The commercial technology undergoes consumer-focused improvements. These improvements aid the VNSA, but success can be inconsistent, and there are often prominent setbacks during the iteration phase.
3. Breakthrough. The VNSA’s success rate with the technology improves significantly.
4. Competition. Technology companies, state actors and other stakeholders develop countermeasures. The outcome of this phase is uncertain, as the VNSA and its competitors enter a cycle of adaptation and counteradaptation.

Figure: The VNSA Technology Adoption Curve

This process demonstrates that it is myopic to interpret a VNSA’s early attempts as “failures” and later attempts as “successes” in a binary fashion. As Eric Ries writes in The Lean Startup, many for-profit firms bring less-than-perfect products to market. This allows a firm to disseminate a product quickly, analyze consumers’ likes and dislikes, and leverage this data to tweak the product. So, too, should early attempts in the VNSA adoption curve be understood as part of a learning process.

Social Media and the Virtual Plotter Model

The Halle attack, and the Christchurch attack before it that killed 51 people, both speak to how indispensable social media has become to many VNSAs. To date, no VNSA has harnessed social media as effectively as the Islamic State. Though the group’s effectiveness has declined precipitously in recent years, at its 2014 peak, Islamic State supporters operated more than 46,000 Twitter accounts and could push content to millions of people. Due in part to the strength of the Islamic State’s online communications, around 42,000 foreign fighters from more than 120 countries were drawn to militant groups in the Syria-Iraq theater.

Social media was also integral to the Islamic State’s virtual plotter model. The group’s virtual plotters—operatives in its external operations division—provided logistical and tactical support to sympathizers seeking to carry out attacks. This level of interaction between plotter and operative was once reserved solely for face-to-face meetings. This incorporation of social media technology as a medium for coordinating attacks was revolutionary, but it was not instantaneous. It built on al-Qaeda’s earlier attempts.

Early Adoption. The late Anwar al-Awlaki was a master propagandist and high-level leader of al-Qaeda in the Arabian Peninsula (AQAP). Awlaki became influential due in no small part to his early adoption of social media, posting sermons to YouTube and maintaining a blog. Religious novices and hardened militants alike could suddenly access an authoritative extremist cleric on demand.

Awlaki’s use of YouTube demonstrated the promise of social media even during the early adoption phase, with his inspirational materials being connected to numerous plots. Yet Awlaki could never compete with the pace of mobilization that later virtual plotters achieved. Though YouTube is a social media platform, Awlaki used it more like a blog, refraining from constant interactions with followers. Further, though Awlaki was effective at radicalizing people, he was unable to fold attackers into al-Qaeda’s overarching strategy. He put out general calls for action, but—aside from the plots like the 2009 Christmas bomb plot, which he was able to orchestrate in person in Yemen—Awlaki never specifically coordinated with attackers to ensure their efforts would help al-Qaeda achieve its long-term objectives.

Iteration. Though social media platforms did not drastically evolve between the period of Awlaki’s prominence and the rise of the Islamic State’s virtual plotters, important changes occurred. Social media capabilities became better understood, and tactics for engaging with followers became increasingly refined. These approaches to improved engagement coincided with an explosion in the number of social media users; Facebook had 608 million monthly users at the end of 2010, and by the end of 2014, that number had soared to 1.4 billion (with Twitter users increasing similarly). Additionally, the growth in end-to-end encryption permitted secure conversations between jihadist influencers and operatives.

The Islamic State’s external operations division, the Amniyat al-Kharji, was charged with identifying and training operatives to conduct attacks outside the group’s core territory. Virtual plotters were integrated into its geographic command structure, but in the cyber realm; each was assigned areas of responsibility according to nationality, cultural knowledge and linguistic skills. The Islamic State engineered a system by which top operatives could directly, albeit remotely, guide lone attackers. Islamic State militants played an intimate role in every step of the attack process, including conceptualization, target selection, timing and execution.

The first Islamic State virtual plotter to gain international recognition was former British hacker Junaid Hussain, whose operatives were almost always arrested. One critical error was the frequency with which he engaged would-be operatives through Twitter direct messages. While Twitter was an efficient way to find potential recruits, a message between Hussain and another user could catch authorities’ attention. Yet, from an alternative perspective, Hussain was a dazzling success. While his operational security left much to be desired, he mobilized operatives at an unprecedented pace—despite lacking Awlaki’s charisma and credentials. Such is the power of social media. When future Islamic State operatives combined the mobilization power of social media with better operational security, the organization reached its breakthrough phase.

Breakthrough. The Islamic State subsequently increased its use of secure messaging platforms, including Wickr, Telegram, WhatsApp and Signal. In March 2016, after coordinating with a virtual planner in Raqqa, Najim Laachraoui led a team of suicide bombers in carrying out three suicide bombings in Brussels that killed more than 30 people and injured more than 300 others. The group’s improvements in operational security are illustrated clearly by the extensive documentation of a subsequent attack in Germany in July 2016. On July 24, Mohammed Daleel detonated a suicide bomb near a music festival. Daleel and his virtual handler with the Islamic State had successfully managed to conceal the plot from authorities, and though Daleel was the only fatality, 15 others were wounded in the bombing.

Daleel was in direct contact with an Islamic State virtual plotter. In fact, absent Daleel’s ongoing discussions with his handler, the attack may never have happened. Daleel was a bundle of nerves in the moments just before the attack, and the virtual plotter with whom he conversed helped him overcome his doubts:

Daleel: [The music festival] will be over soon, and there are checks at the entrance.

Virtual Plotter: Look for a suitable place and try to disappear into the crowd. Break through police cordons, run, and do it.

Daleel: Pray for me. You do not know what is happening with me right now.

Virtual Plotter: Forget the festival and go over to the restaurant. Hey man, what is going on with you? Even if just two people were killed, I would do it. Trust in God and walk straight up to the restaurant.

And that is what Daleel did, detonating his bomb at a wine bar. While an operative on his own might have aborted the attack, Daleel’s anxiety was calmed by his handler. The fact that Daleel went through with his attack was directly influenced by a virtual plotter.

The Islamic State’s model allowed the group to recruit and manage attacks remotely, increasing the number of attacks abroad and their likelihood of success.

Competition. Social media companies faced pressure to remove Islamic State content shortly after the group emerged, but their early efforts were often lackluster. Their efforts really picked up steam in 2016. Companies began employing artificial intelligence to identify proscribed content, which reduced reliance on manual reporting and increased the speed of removal.

Social media companies’ ability to take down material supporting violent extremist groups improved dramatically, as did their willingness to use these capabilities. As a 2016 study showed, suspensions proved detrimental to both the number of social media followers and the amount of content associated with the Islamic State. For now, authorities have significantly disrupted the Islamic State’s exploitation of social media, but the future of the competition phase is less clear. It is possible that a platform with libertarian principles that will not remove terrorist content could gain popularity. (On this point, it is noteworthy that Telegram announced in late 2019 that it had banned nearly 17,000 “terrorist bots and channels.”) The Islamic State could also discover an effective workaround to social media companies’ community standards.

Unmanned Aircraft Systems (UAS)

Several VNSAs have tried to take advantage of the commercial availability of unmanned aircraft systems (UAS), from remote-controlled helicopters and planes marketed to hobbyists to quadcopter drones popular with videographers. VNSAs’ efforts to weaponize UAS have been marked by early failures and experimentation.

Early Adoption. The early adoption phase was characterized by well-resourced VNSAs’ first forays into unmanned systems. One of the earliest attempts was undertaken by Japanese cult Aum Shinrikyo in 1994. Aum developed a chemical and biological weapons program, and several methods of dispersal. The cult experimented with a remote-controlled helicopter retrofitted to spray sarin gas, but the helicopter crashed the second time the group tried to use it.

Iteration. Following Aum’s unsuccessful attempt to use a do-it-yourself unmanned system in its plot, UAS technology subsequently became widely commercially available. As commercial technologies improved, so did the probability of successful weaponization by VNSAs, which could develop new modifications for more reliable platforms.

One plot illustrating the progress in VNSAs’ use of UAS is that of Rezwan Ferdaus, who was arrested in 2011 for a plot to target the Pentagon and U.S. Capitol building with remote-controlled model aircraft packed with explosives. Ferdaus’s key innovation was a plan to use a commercially available GPS autopilot system and Google Earth to navigate the aircraft toward its target. While the plot’s likelihood of success was questionable even if Ferdaus had not been caught, it foreshadowed future threats.

Breakthrough. Several factors contributed to the breakthrough in VNSAs’ use of UAS around 2014. Perhaps most critical was the boom in affordable, easy-to-operate quadcopter drones like those produced by DJI Technology. Another factor was the Islamic State’s organizational structure, as its bureaucracy played an important role in guiding the group’s acquisition of complete UAS systems and specialized components.

The Islamic State’s earliest known uses of UAS occurred in mid-2014, when the group released propaganda featuring aerial footage that demonstrated it had obtained a capability—aerial surveillance—that until that point had largely been limited to states. The first known case of the Islamic State successfully weaponizing a UAS occurred in October 2016, when two Peshmerga fighters died and two French soldiers were injured after a drone they shot down detonated. An explosive in the drone had been disguised as a battery. Shortly thereafter, the Islamic State’s weaponized drones proliferated.

Competition. A multitude of counter-drone systems have emerged. A 2018 report by the Center for the Study of the Drone at Bard College identified 155 manufacturers. Their systems employ various technologies, such as electronic jamming, acoustic detection, nets to entangle drone rotors, lasers, and machine guns. Despite the growth in this industry, VNSAs still appear to have the upper hand, as drone incidents are hard to thwart.

Future VNSA Technology Adoption

While social media and drones provide insightful retrospectives of VNSAs’ adoption of new technologies, these groups will continue to innovate. As the Halle terrorist demonstrated, 3-D printing poses opportunities for groups looking to obtain lethal weapons while avoiding detection by law enforcement. Artificial intelligence is another technology that VNSAs will likely work to incorporate into their operations.

VNSAs’ adoption of new technologies is contingent on a number of factors, including a group’s technological acumen, available resources and the proliferation of countermeasures. What is certain is that VNSAs will continue to innovate. As new technologies proliferate, there will invariably be individuals trying to figure out how to use these technologies to kill. By outlining the adoption curve, we hope to enable our colleagues to more quickly recognize danger signs and be slower to dismiss what seems like bungling, and to subsequently interdict VNSA attempts to adopt technologies that pose the greatest risks.

The authors appreciate the support of the Canadian Department of National Defence, which provided them a Targeted Engagement Grant to fund the research that forms the backbone of this article. The technical study from which this article is adapted, which was co-authored with David Jones of the Edmonton-based Organization for the Prevention of Violence, can be found here.