Posts Tagged ‘lone wolves’

It has been a busy day. Events in Barcelona are still a bit unclear, but it sounds like we are moving towards some resolution. In the meantime, catching up on posting latest contribution for the excellent West Point Combating Terrorism Center’s journal CTC Sentinel. Thanks to Paul for his excellent and patient editing. More to come on this topic invariably, and some more catch up to do after this week’s atrocities in Spain.

Britain on Alert: The Attacks in London and Manchester and the Evolving Threat

Abstract: After a respite from mass-casualty terrorism for more than a decade, thus far in 2017 the United Kingdom has suffered three such attacks and a higher tempo of jihadi terrorist plotting than ever before. Absent from the threat picture so far are any Paris-style plots in which the Islamic State has dispatched operatives to launch attacks in the United Kingdom. At this early stage of the investigations, it appears that the Westminster attacker had no contact with the Islamic State and that the Manchester and London Bridge attackers were at most loosely connected to the group. The current threat environment is mostly made up of individuals and smaller scattered cells planning lower-tech attacks with very short planning and operational cycles—sometimes remotely guided by the Islamic State—rather than cells trained and dispatched by the group. But this could change as more British Islamic State recruits return home. With over 20,000 British nationals and residents subject to counterterrorism investigations since 9/11, a growing number of ‘frustrated travelers,’ and a complex and unpredictable set of threats, the United Kingdom faces an unprecedented security challenge. 

It has been a difficult year so far in the United Kingdom. After a period of relative stability, the United Kingdom has abruptly faced a period of deep political turmoil and a series of terrorist strikes that killed 36 people. While the full story around the terrorist plots that rocked the country during the first half of the year is not yet entirely clear—with multiple public and confidential reviews currently underway—the series of cases has led to deep introspection about how the United Kingdom manages the risk posed by the growing number of radicalized individuals at home. In July, Commissioner of the Metropolitan Police Cressida Dick stated that “since March this year, the [threat] tempo has changed. What we are seeing is now being described by the experts as a ‘shift’ in threat, not a spike.”1

This article argues this shift has to be understood as a permanent adjustment in the threat. There has been significant continuity in recent years in the nature of the threat faced by the United Kingdom, with a noticeable move away from large-scale plots to smaller scattered cells, with the tempo of plotting increasing noticeably. The article builds on a previous article in this publication in March 2016, which laid out the United Kingdom’s threat picture through analysis of a series of disrupted terror plots.2 The conclusion then was that “the public threat picture has been dominated by lone-actor plots”3 rather than more ambitious plots directed by the Islamic State like the Paris and Brussels attacks, an assessment that has not been challenged by the attacks in London and Manchester this year. Although only tentative conclusions can be made at this stage, the information that has come to light suggests these plots were significantly less ambitious and complex than some of the conspiracies seen in continental Europe and were carried out by men with at most loose connections to the Islamic State.

This article first outlines what is now known about the March 2017 Westminster Bridge attack, the May 2017 Manchester bombing, and the June 2017 attack on London Bridge and Borough Market. It then assesses what these attacks and other thwarted plots reveal about the broader threat picture in the United Kingdom and the challenges faced by security services.

The return of terrorism to the headlines in the United Kingdom this year was all too predictable. After a period of almost three years with the threat level at the second-highest level of ‘severe,’ British authorities had long warned that an attack was highly likely. Disruptions took place regularly. In early March 2017, the Metropolitan Police Service’s Assistant Commissioner for Specialist Operations Mark Rowley, who is also the National Police Chiefs’ Council (NPCC) lead for counterterrorism, stated that since the murder of Lee Rigby in May 2013, authorities had disrupted 13 terrorist plots. In defining the nature of the plots, Rowley stated “some of them have been more sophisticated [in their] planning looking to attack public spaces, or police offices or the military, not that dissimilar to some of the attacks we have seen in Belgium and France and elsewhere. There is a whole range from the simple to the complicated.”4 This built on comments by then-Prime Minister David Cameron in the wake of the Paris attacks of 2015 in which he stated that agencies had disrupted at least seven plots in the previous six months, “albeit attacks planned on a smaller scale.”5

The Westminster Bridge Attack
Notwithstanding this tempo of disruptions and public statements about the terrorist menace, Khalid Masood’s attack on Parliament on March 22, 2017, still shocked the British public. Using a Hyundai Tucson SUV rented in Birmingham a day earlier,6 Masood drove through the crowds of mostly tourists crossing Westminster Bridge at 2.40 PM. Hitting numerous pedestrians and knocking some into the river, he drove into the gates in front of the Houses of Parliament and then ran at a police officer standing guard, stabbing him with a knife. Masood was then shot dead by the close protection team of Defence Secretary Michael Fallon, who happened to be leaving Parliament at that moment.7

In the wake of the attack, which killed five people, authorities undertook a number of arrests near locations where Masood had lived, detaining 12 people in total. All were subsequently released.8 Born Adrian Russell Elms, Masood was a troubled 52-year-old who had lived an itinerant life, married three times, and had four children by two different women. He appears to have converted in prison while serving time for assault.9 He was twice incarcerated and arrested numerous other times for incidents involving attacking others. His case was of such concern to Sussex Police that in 2009, they filed a report highlighting the escalating nature of his violent behavior.10

In addition, Masood had featured in counterterrorism investigations. Prime Minister Theresa May confirmed that he had surfaced on the fringes of previous cases, stating “he was once investigated by MI5 in relation to concerns about violent extremism. He was a peripheral figure. The case is historic. He is not part of the current intelligence picture.”11 He was investigated after his telephone number was found among the contacts of a member of a cell of individuals from Luton who were jailed in 2013 for planning to bomb an Army barracks.12But he was not a priority of the investigation, and greater attention has been placed on his further radicalization more recently in Birmingham.13

Nevertheless, there has been little evidence produced that Masood was linked to any other co-conspirators or that he had conducted his assault with any external direction. He sent a WhatsApp message shortly before his assault reportedly stating his attack was a response to Western interventions in the Middle East, but the person he sent it to was cleared by authorities of any prior knowledge of the attack or culpability.14 A claim issued by the Islamic State in the wake of the attack was also dismissed as it showed no evidence of being anything but opportunistic. The group has praised Masood in subsequent publications, including quite specific incitement to people to emulate his attack, but the group has never demonstrated any access to information pertaining to him that was not already in the public domain. Authorities have concluded that Masood most likely acted alone and that the full extent of his motivations may never be known.15 As Neil Basu, NPCC’s senior national coordinator for counterterrorism, put it, while the police “found no evidence of an association with Islamic State or al-Qa`ida, there is clearly an interest in jihad.”16 While it is unlikely that Masood was completely isolated, the lack of any subsequent arrests or any charges issued as well as some fairly telling statements by police that his motivations may never be known highlights that, for authorities, the case is largely closed.

The Manchester Bombing 
The contrast between the Westminster attack and the bombing exactly two months later on May 22 in Manchester by Salman Abedi is stark. Using a device that he appears to have constructed himself in Manchester using tools that are publicly available,17 Salman Abedi, a 22-year-old British national of Libyan descent, walked into a crowd of families and children as they left an Ariana Grande concert and detonated a well-built bomb made of TATP and packed with shrapnel.18 Killing himself and 22 others, Abedi’s attack immediately sparked something of a panic among U.K. authorities. Concerned about the sophisticated nature of the device and the fact that Abedi was a known figure with deep extremist contacts, counterterrorism agencies immediately feared that a bomb maker might be on the loose. A wide net was cast, and the terrorist threat level was raised by the Joint Terrorism Analysis Center (JTAC) to its highest level, ‘critical,’ meaning an “attack is expected imminently.”19


Emergency response vehicles parked outside the scene of the terror attack in Manchester, England, on May 23, 2017. (Paul Ellis/AFP/Getty Images)

Nevertheless, while over 20 arrests were carried out, no charges have been issued. In early July, Greater Manchester Police held a press conference at which they highlighted that while they believed Abedi may not have acted alone, he was not part of a larger network. “We don’t have evidence of a large network. We do, however, suspect others were either aware [of] or complicit in the knowledge of this attack … We do believe that there are other people potentially involved in this … further arrests are possible,” Detective Chief Superintendent Russ Jackson, head of the North-West Counter Terrorism Unit (NWCTU), stated. 20

Abedi is reported to have had significant connections in radical circles in Manchester. Many of Abedi’s links tie back to the community of young men from the city going to fight in Syria. He reportedly visited wheelchair-bound (following injuries sustained during his involvement in the 2011 uprising in Libya) Abdal Raouf Abdallah, another Libyan-British national, in jail a number of times in early 2017. Abdallah had been jailed for his role in facilitating the travel of others to Syria.21 He was also reportedly in close contact with Raphael Hostey, a prominent British Islamic State fighter from nearby in Manchester, who used the kunya Abu Qaqaa and was the sponsor for numerous Britons who joined the group.22

It is, however, Abedi’s links in Libya that have raised the most scrutiny. His father, Ramadan Abedi, a prominent onetime member of the now-defunct Libyan Islamic Fighting Group (LIFG), reportedly returned to fight—bringing his son Salman with him—in the revolution that overtook the country in 2011.23 A long-time and committed member of the LIFG, he was well-connected in the community around the jihadi group and was also reportedly seen in Bosnia a number of times during the civil war in that country in the 1990s.24

British authorities have made clear they wish to question Abedi’s brother Hashem.25 On May 24, 2017, the Special Deterrence Force, a Tripoli-based militia under the nominal control of the Interior Ministry, released a statement saying it had detained Abedi’s father and brother Hashem. The militia claimed that Hashem had confessed while in detention that both he and Salman were members of the Islamic State and that Hashem had admitted he had been in the United Kingdom during the planning phase of the attack, had been aware of the plot, and had been “constantly in touch” with his brother. Hashem also reportedly admitted to helping to purchase the bomb components. On May 25, a spokesperson for the militia stated on Libyan television that the two brothers had been in contact by phone just 15 minutes before the bombing.26 Questions remain over these confessions, including over whether they were made under duress. Hashem is still in Libya and has not been charged in the United Kingdom. Analysis of his social media accounts show he was in contact with Hostey’s brother.27

According to the Greater Manchester Police, the two Abedi brothers both left for Libya on April 15, with Salman returning to the United Kingdom on May 18, just four days before the bombing. It was the latest in a number of trips Abedi had made back and forth to Libya. Investigators believe bomb-making materials were obtained before the trip to Libya and stored in a car and that when Salman Abedi returned to Manchester, he purchased other materials for the device including nuts as shrapnel and quickly assembled the bomb.28 The high volatility of TATP—the quick speed at which it evaporates or sublimes and thus becomes useless as an explosive—meant he almost certainly made the explosive substance in the days between his return from Libya and the attack, sources told CNN.29

It remains unclear whether Abedi received training while in Libya. Abedi appeared to be single-mindedly focused on building the bomb when he returned to the United Kingdom, suggesting it is possible he received training or final instructions on his last trip.

Similar to Masood’s attack, the Islamic State issued a statement praising Abedi’s act, but it demonstrated no proof of any prior knowledge.30 Notwithstanding the alleged declarations by his brother to the Tripoli militia, had Salman been closely linked to the Islamic State in Libya, it would be surprising that he would not have recorded a martyrdom video and left it with the group, or least some photographic evidence showing his connections. At the same time, investigators continue to believe that he had some greater degree of links to terrorist groups abroad than Masood. However, the exact nature of these links remains unclear.

The London Bridge and Borough Market Attack 
On June 3, 2017, less than two weeks after the Manchester bombing, London was struck once again. On a balmy evening, Khuram Butt, Rachid Redouane, and Youssef Zaghba drove a van they had rented earlier in the afternoon into the Saturday night crowds gathered near London Bridge. Ramming the van into a fence adjacent to the pavement near the end of the bridge, the trio then leapt out of the vehicle and started attacking passersby in the adjoining Borough Market area with long knives they had bound to their wrists with leather straps. They wore plastic bottles covered in black tape wrapped around their bodies to give the impression of wearing suicide vests and had a number of Molotov cocktails made up in the van.31 Within eight minutes of police receiving the call, armed response officers arrived and shot and killed the three men, though not before eight revelers had been killed and 48 injured.32

One of the attackers was almost immediately identified as a figure well-known to the security services. Butt, who authorities believe was the ringleader of the group, was a prominent and active member of the al Muhajiroun network of extremists that has been at the center of the United Kingdom’s violent Islamist terrorist threat for the past two decades. Butt himself had been repeatedly featured at the center of investigations and was most recently on bail for ‘low-level’ fraud for which he was not ultimately going to be prosecuted.33 More embarrassingly for British authorities, he had been featured in a widely viewed documentary called The Jihadis Next Door, which followed a number of prominent al Muhajiroun members, including Siddartha Dhar, also known as Abu Rumaysah (who fled to Syria with his family soon after filming and was believed to have become a new “Jihadi John” figure in Islamic State films34), as well as others who have been convicted of a variety of terrorism and extremism charges.35

The other two were less well known to British investigators, though it rapidly emerged that the Moroccan-Italian Zaghba had been flagged to British authorities through a European intelligence sharing system as someone of concern to Italian authorities after he was stopped at Bologna airport in March 2016 on his way to Turkey. Carrying a small bag, little money, a telephone with Islamic State videos on it, and a one-way ticket, he raised suspicions by telling authorities that he wanted to head to Syria.36 Nevertheless, he was released after being turned back. He subsequently traveled onto his native Morocco and then ultimately London, where he took on part-time work in the services industry.37 The third attacker, Redouane, appears to have led an equally peripatetic life, alternatively claiming to be Moroccan or Libyan and stating his birthdate was in 1986 and 1991 on different documents.38 He had married an Irish woman and had a child with her, who he appears to have visited at his estranged partner’s home in Barking the night prior to the attack after a lengthy hiatus.39

Planning for the event appears to have taken place over a two- to three-week period prior to the attack.40Police believe Redouane’s bedsit in Barking was the location where plotting occurred,41 though the men appear to have also congregated in a number of sporting locations, including an outdoor pool42 and a gym that was established by a pair of brothers who had previously been identified as being involved in al Muhajiroun activity.43

It remains unclear the degree to which the London Bridge attackers may have been directed by the Islamic State or any other extremist group, though the Islamic State did again claim the attack.44 Given Butt’s known association with individuals who have gone on to become prominent figures within the Islamic State, like Abu Rumaysah (who is still suspected to be at large and was featured in the same British television documentary), he would have had ample opportunities to establish contact with the group. Senior leadership figures within al Muhajiroun, like Anjem Choudary and Mizanur Rahman, have been prosecuted for supporting the Islamic State.45 Others like Abu Rahin Aziz,46 Shahan Choudhury,47 Mohammed Reza Haque,48 and Hamza Yaqub49have been publicly identified as having fled to join the group. Many others have tried going to Syria and been caught at various stages of their journeys. Given the close contact the group’s members maintain with those back in the United Kingdom even after they have gone over to Syria, it seems likely that Butt would have had at least some contact at some point with Islamic State operatives in Syria.

While the Islamic State’s immediate claim contained no information that was not already in the public domain, the group’s subsequent mention of the attack in the 10th edition of its magazine Rumiyah did offer battlefield names (kunyas) for the fighters, which had not been discussed in the public domain, identifying them as Abu Sadiq al-Britani, Abu Mujahid al-Britani, and Abu Yusuf al-Britani.50 The accuracy of this information is unclear, however, with it contrasting with Butt’s known kunya of Abu Zeitoun.

Observations on the Three Attacks 
One key question for authorities is the degree to which the three cases were connected.51 Thus far, no evidence has been made public to show any level of connectivity, beyond the potential that the three plotters were somehow inspired in their timing by each other’s actions.a The available evidence suggests the attacks were carried out by individuals or small cells who, though possibly inspired by the Islamic State’s ideology, were either not connected to the group (Westminster) or only loosely connected (Manchester and London Bridge). There is no indication that the Westminster and London Bridge attackers trained overseas. In the London Bridge plot, at least two of the attackers, Butt52 and Zaghba, were frustrated travelers to Syria. In the Manchester plot, Abedi is known to have traveled to Libya a number of times (though the exact nature of these trips is complicated by his Libyan heritage). Abedi’s single-minded focus in constructing a device just a few days after returning from Libya suggests it is possible he traveled to Libya for the purpose of learning how to build a device.53 The New York Times, citing U.S. and European intelligence sources, reported Abedi met with members of Katiba al-Battar, a Libyan Islamic State brigade, at some point while in Libya and kept in touch with the group on trips back to the United Kingdom, but this has not been confirmed by British authorities.54Given that Abedi reportedly participated in fighting against Muammar Qaddafi, one possibility is he received bomb-making training while spending time with a militia group in Libya. There was some public speculation Abedi may have traveled to Syria as well, but this has not been substantiated.55 No evidence has yet surfaced of external direction, and it cannot be ruled out that Abedi learned to build the bomb off the internet given there is evidence he viewed various online videos on bomb making.56 But the relative sophistication and effectiveness of the device, and the trickiness of making TATP, points to the possibility of at least some bomb-making training or practice overseas.

Increased Tempo
In the wake of the Westminster attack, there was a noticeable uptick in the tempo of arrests being conducted by police disrupting active attack planning. In June, Commissioner Dick said about one person a day was being arrested in counterterrorism investigations.57 The reasons for this increase are not totally clear, but it is likely the result of both lower tolerance of risk by British authorities and a growing threat. In the first instance, a successful attack highlighting a failure in intelligence would change counterterrorism agencies’ perspectives on ongoing investigations, making them reconsider various subjects of concern. Second, police concerns of copycat attacks likely sped up arrests of subjects of interest who had been under surveillance for some time. A third likely reason is the increasing push and resonance of Islamic State messaging about individuals staying home to launch attacks. This is a phenomenon that has been obvious since Abu Muhammad al-Adnani’s speech in May 2016 in which he stated, “The smallest action you do in the heart of their land is dearer to us than the largest action by us, and more effective and more damaging to them … And if one of you wishes and tries hard to reach the Islamic State, then one of us wishes to be in your place to hurt the Crusaders.”58 As it has become harder to travel to Syria and the group has been losing territory, more supporters of the group in the United Kingdom are becoming frustrated travelers who are responding to this messaging.

British police thwarted five plots in between the Westminster Bridge and Manchester attacks.59 Just over a week after Masood’s attack, police in Birmingham arrested brother and sister Ummariyat Mirza and Zainub Mirza, who were accused of planning a beheading attack.60 Two weeks later, Ummariyat Mirza’s wife, Madihah Taheer, was arrested and charged with supporting her husband in his plot.61 At around the same time, police arrested a 17-year-old girl of Moroccan origin from London for allegedly plotting to launch some sort of attack under direction of a fighter from Coventry who was killed in April by a drone strike in Syria. The teenager, who cannot be named for legal reasons, was apparently married to the fighter through Skype and had sought to obtain guns and grenades to launch an attack in the United Kingdom under explicit direction from the Islamic State.62

Even more alarmingly, 27-year-old Khalid Ali was detained in Whitehall, a short month after Khalid Masood’s attack on Westminster, in a dramatic mid-afternoon swoop as he walked around with a bag full of knives and shortly after throwing his phone into the river. He was charged with bomb making linked to activity he undertook in Afghanistan years before, as well as the alleged plan he was in the midst of when he was arrested in Whitehall.63

The same day that Ali was detained along Whitehall, police in Willesden in northwest London and Kent undertook a series of raids, detaining six people in what they believed was another cell actively plotting attacks. The case was deemed of such concern that authorities stormed the premises using CS gas and guns. One woman was shot during the entry.64 The initial reporting indicated a cell of six were involved, including an individual who had been stopped in Turkey alongside two teenagers who were reportedly en route to Syria.65 In the end, however, the failed traveler was not charged, and three women (including a mother and daughter) were presented in court for allegedly planning an unspecified knife attack.66 Finally, five days prior to Abedi’s attack, police in East London arrested four men for planning an alleged car bomb and knife attack in central London reportedly inspired by Masood’s actions.67 The four men were arrested on May 17.b

This intense spate of arrests presaged the Manchester and London Bridge attacks and reflected a changed threat assessment by authorities as they sought to roll up a number of cells that had been under surveillance for some time. As noted above, in many cases, authorities feared that Masood’s abrupt success might stimulate others to emulate him—something that had been seen historically after successful attacks. The murder of Lee Rigby in May 2013 by two extremists linked to al Muhajiroun helped stimulate others to attack, including an extremist who the very next day attacked a French soldier patrolling in the La Defence area of Paris. More generally, the attack model deployed against Rigby is one that has become a template many British extremists seek to emulate, often themselves making direct reference to that 2013 attack.

Arrests have continued at a high rate in recent weeks. Three men were picked up on the day of the general election, June 8, with one charged on an unspecified plot. The 33-year-old man in question, Irfan Khan, was allegedly a long-time consumer of online radical material and had allegedly recently viewed material linked to the London Bridge attack when he was arrested, demonstrating the potential inspirational effect of that attack.68 Later in June, police in Birmingham arrested Tarik Chadlioui, a 43-year-old Moroccan cleric who was wanted on terrorism charges in Spain for being the spiritual leader of a cell supporting the Islamic State.69 One of his followers in Majorca is accused of planning a stabbing attack of pedestrians on the island.70

A Constant Threat 
None of this, however, points to large-scale attack planning in the United Kingdom. While a number of the disruptions suggest plots approaching the scale of the London Bridge or Manchester attacks, there was little evidence presented in court of conspiracies with the capability to launch larger Paris-style assaults. Unlike disruptions on the continent in Europe, where cells in possession of automatic weapons and with clear evidence of individuals who have been to foreign battlefields are regularly disrupted, so far there is no evidence that has been made public of this model of plot in the United Kingdom.

More typical have been plots similar to that mounted by a cell of individuals from Birmingham who were planning a knife and bomb attack in the United Kingdom before their arrest in late 2016. Although the so-called “three Musketeers” behind this plot were potentially dangerous, and two had, five years previously, very briefly made it to a training camp in Pakistan, there was no evidence presented at the trial that their plot was directed from overseas; it emerged at trial that the conspirators joked about their inadequate skills, with one likened to one of the useless extremist characters from the film Four Lions, a satirical movie that pokes fun at some of more inept practices of British jihadis.c

The earliest disrupted plot linked to Syria, that of Erol Incedal, included accusations of a planned marauding gunman scenario with some direction from overseas.71 Incedal was cleared of these charges and ultimately convicted of possession of a bomb-making manual.72 But beyond this, the attack planning seen in the United Kingdom has been fairly consistently small cells or isolated individuals seeking to launch low-grade attacks on soft targets around the country. While there are often links to known extremists or networks, where there has been direction, it has been in the form of remote guidance by extremists based in Syria and Iraq.73

None of this is to say that authorities do not continue to see aspiration and intent by terrorist groups to launch more sophisticated plots in the United Kingdom. Thus far, however, the threat has mainly consisted of small-scale unsophisticated plots. While this suggests terrorist groups like the Islamic State have been facing difficulties in infiltrating directed cells into the United Kingdom, authorities are still confronted by a challenging threat picture and one that is in many ways more complicated with these scattered and disparate cells, which are difficult to track. Adding to the challenge is the unpredictability of individuals or small cells autonomously deciding to act using very low-tech methods and weapons, which makes it a very difficult to manage and prioritize threats accurately.

Managing Risk 
The question of prioritization is the key issue at the heart of considerations about how to manage the current U.K. threat picture.d In all three of the cases featured in this article, attackers were known and had been investigated—to varying degrees—by authorities. In at least two cases, Abedi and Butt, they had been a focus of investigations, but no prosecutable case had materialized, leading investigators to move on to other cases that appeared to be of higher priority. With limited resources, such choices have to be made.

The volume of activity that U.K. security services are currently focused on was illustrated most clearly in the wake of the Manchester bombing when Security Minister Ben Wallace revealed on the BBC’s flagship Today program that authorities had 500 investigations underway, involving some 3,000 subjects of interest. In addition, he revealed, there were a further 20,000 former subjects of interest (i.e. former targets of counterterrorism investigations in the post-9/11 period) who remained of peripheral interest to the security services. The numbers have since grown even higher, according to British police. Butt, the London Bridge ringleader, was among the 3,000 current subjects of interest. But it was from the 20,000 considered to be only a residual risk that the Manchester and Westminster attackers had come.74 This larger pool includes individuals who have featured in investigations over the past almost two decades of counterterrorism cases in the United Kingdom. Some are individuals who were on the fringes of plots; others are those who have been charged, convicted, served their sentences, and are now free once again. However, due to their observed activity, they are not deemed to be current priorities and have therefore been relegated by security services who instead focus their attention on those who have been demonstrating a higher level of alarming activity or potential attack planning. Given limitations in security services resources, only about 3,000 individuals can be focused on, and while the others are not forgotten, they are allocated a lower prioritization.75

In the wake of the two London and Manchester attacks, questions are being raised about whether this prioritization has been accurately calibrated.76 After the London Bridge attack, Prime Minister May stressed police and the Security Service MI5 would be reviewing their methods and more generally “how the terror threat is evolving, the way that terrorism is breeding terrorism and the increased tempo of attacks … in a way we haven’t seen before.”77 It has been reported that after the Manchester bombings, Britain’s security services began reevaluating the risk level of individuals categorized as former subjects of interest. One idea reportedly under consideration is to create systems for counterterrorism agencies to share information about former subjects of interest with the broader police force, taking advantage of the general police’s greater numbers of eyes and ears inside local communities. “It’s that wider cohort [of 20,000] that we have to keep an eye on as well; to see if any of them that reactivate, so to speak, and become dangerous again,” Mark Rowley, head of National Counter Terrorism Policing, stated in an interview earlier this month. “We’re going to have to improve what we do, but it is going to take a whole system effect—not simply counter terrorist specialists and MI5, but local policing, councils, and the public—to be able to deal with something which is becoming more of a cultish movement and less of a small terrorist organisation.”78

The U.K. threat picture is populated with seemingly disparate cells of individuals or clusters who are in some cases receiving direction from abroad through encrypted applications or social media, but in many cases are made up of perpetrators, as Prime Minister May stated, “inspired to attack not only on the basis of carefully constructed plots after years of planning and training—and not even as lone attackers radicalized online—but by copying one another and often using the crudest of means of attack.”79 The fact that the United Kingdom is also grappling with a threat from right-wing and anti-Muslim extremism risks provoking the sort of social tensions the Islamic State has long hoped would boost its appeal in the West.

It is, of course, still early days in the investigations into the London Bridge and Manchester attacks. It is possible more will be uncovered to show their connectivity to wider networks and plots. The plotting activity observed so far in 2017 points to a deeply diffuse and complicated threat picture in the United Kingdom, which is causing security services to revisit their methodologies and leading to arrests at increasingly early stages of the attack cycle. This can complicate subsequent convictions, but it is an imperative at a time when many plots are being carried out through low-tech means already in most citizens’ possession—cars and knives—and at a time when the flash-to-bang in plots can be counted in days rather than years.

Atop this complex domestic picture is the potential threat posed by the growing number of British jihadis who are expected to be returning home from Syria and Iraq. Exact numbers are impossible to know, but with hundreds already back,e authorities are already bracing themselves for an even more challenging threat environment when these battle-hardened veterans and their families return.     CTC

Raffaello Pantucci is Director of International Security Studies at the Royal United Services Institute (RUSI) and the author of We Love Death As You Love Life: Britain’s Suburban Terrorists. Follow @raffpantucci

Substantive Notes
[a] This certainly seems to have been the case in the subsequent anti-Muslim terrorist attack launched by Darren Osborne, a 47-year-old who drove a van into the crowd outside Finsbury Park mosque on the morning of June 19, killing one. A long-troubled individual, Osborne was reported by neighbors to have been incensed by the London Bridge attack. No evidence has publicly surfaced that he was linked to extreme right groups. And it is suspected that Osborne may have intended to strike an al-Quds, pro-Palestine march through central London earlier in the day, but had been too late and chose the mosque instead. Osborne was reported to have been raving drunkenly at a local pub the night before the attack and to have been flagged to police as drunk and asleep in his vehicle later the same evening. Martin Evans, Ben Farmer, Hayley Dixon, and Hannah Furness, “Finsbury Park terror suspect ‘planned to attack’ Muslim march in London but was too late, it is claimed,” Telegraph, June 20, 2017.

[b] The four were charged on May 25. One was not charged with terror offenses but instead for seeking to “possess any firearm or imitation firearm with intent to cause fear of violence.” “Update: Four charged following Counter Terrorism investigation,” Metropolitan Police press release, May 25, 2017.

[c] The most disturbing aspect of the plot was that three of the plotters had been convicted and served time for previous terrorism offenses. Two of those convicted, Naweed Ali and Khobaib Hussain, had been previously arrested for going to training camps in Pakistan. They were also linked to a cell arrested in 2011 in Birmingham that was seeking to launch an al-Qa`ida-directed attack in the United Kingdom and helping others get to training camps in Pakistan. Mohibur Rahman, the third convicted “Musketeer,” had been previously convicted for possession of extremist material. He was initially arrested as part of a cell that pleaded guilty of plotting in 2010 to bomb the London Stock Exchange. The three “Musketeers” had met and re-radicalized during their prison sentences, raising questions around prison radicalization. “Operation Pitsford: The 11 men,” BBC News, April 26, 2013; “Terrorism gang jailed for plotting to blow up London Stock Exchange,” Telegraph, February 9, 2012; “Three Musketeers’ guilty of planning UK terror plot,” BBC News, August 2, 2017; Dominic Casciani, “Birmingham terror plot: Inside the sting that caught four jihadis,” BBC News, August 2, 2017.

[d] The issue of prioritization is also key in several other Western countries facing a significant threat, including the United States. For example, Orlando nightclub shooter Omar Mateen had been the subject of an FBI counterterrorism investigation, but the case was closed before he carried out the attack. Matt Apuzzo and Eric Lichtblau, “After FBI’s Enquiry into Omar Mateen, A Focus on What Else Could Be Done,” New York Times,June 14, 2016.

[e] While there are no official figures, most reports say that some half of the 850 U.K. nationals reported to have gone to Syria and Iraq have returned home. Martin Chulov, Jamie Grierson, and Jon Swaine, “ISIS faces exodus of foreign fighters as its ‘caliphate’ crumbles,” Guardian, April 26, 2017.

Citations
[1] Cressida Dick, “Commissioner gives key note speech at Mansion House,” MetPolice Blog, July 20, 2017.

[2] Raffaello Pantucci, “The Islamic State Threat to Britain: Evidence from Recent Terror Trials,” CTC Sentinel9:3 (2016).

[3] Ibid.

[4] Matthew Weaver, “UK police have thwarted Paris-style terror plots, top officer says,” Guardian, March 6, 2017.

[5] Matt Dathan, “David Cameron to recruit 2,000 new spies amid claims UK foiled seven terror attacks in six months,” Independent, November 16, 2015.

[6] “Car used in Westminster terror attack was hired from Enterprise in Spring Hill,” Birmingham Updates, March 23, 2017.

[7] Ewan MacAskill, “Westminster attacker acted alone and motive may never be known, say police,” Guardian, March 25, 2017.

[8] Chris Johnston, “All 12 people arrested over Westminster attack released without charge,” Guardian, April 1, 2017.

[9] “Killer Khalid Masood left jail a Muslim, says childhood friend,” Press Association, March 25, 2017.

[10] Alice Ross, “Westminster attacker had record of increasingly violent attacks,” Guardian, May 15, 2017.

[11] Rowena Mason, “Theresa May’s statement – key extracts,” Guardian, March 23, 2017.

[12] “Four ‘planned to bomb Territorial Army base’ with toy car,” BBC NewsApril 15, 2013.

[13] Xantha Leatham and Omar Wahid, “Westminster terror attacker was radicalised in Birmingham in the past 12 months, sources claim,” Mail on Sunday, April 2, 2017.

[14] Kim Sengupta, “Last message left by Westminster attacker Khalid Masood uncovered by security agencies,” Independent, April 27, 2017.

[15] Vikram Dodd, “Westminster attack: Masood did act alone, police conclude,” Guardian, April 13, 2017.

[16] Robert Booth, “Westminster attacker Khalid Masood had interest in jihad, say police,” Guardian, March 27, 2017.

[17] Nick Hudson, “Manchester suicide attack: Abedi bought most bomb parts ‘himself,’” Policeprofessional.com, May 31, 2017.

[18] Paul Cruickshank, “London attack ringleader was under active investigation at time of assault,” CNN, June 8, 2017; C.J. Chivers, “Found at the Scene in Manchester: Shrapnel, a Backpack and a Battery,” New York Times, May 24, 2017.

[19] “Threat levels,” Security Service, MI5.

[20] “Manchester Arena suicide bomber Salman Abedi may not have acted alone, police say,” Telegraph, July 6, 2017; Neal Keeling, “Police suspect others were involved in Manchester Arena attack – and may make further arrests,” Manchester Evening News, July 6, 2017.

[21] Joe Thomas, “Manchester Arena bomber visited terror convict in Liverpool prison,” Liverpool Echo, June 25, 2017.

[22] Andy Hughes, “Manchester suicide bomber Salman Abedi linked to key UK IS recruiter,” May 25, 2017.

[23] Nazia Parveen, “Bomber’s father fought against Gaddafi regime with ‘terrorist’ group,” Guardian, May 24, 2017; Jonathan Ungoed-Thomas and Dipesh Gadher, “Salman Abedi: the Manchester killer who was bloodied on the battlefields of Libya and brought evil back home,” Sunday Times, May 28, 2017.

[24] “Otac teroriste iz Mancestera bio kod mudzahedina u BiH,” Glas Srpske, May 31, 2017.

[25] “Manchester Arena suicide bomber Salman Abedi may not have acted alone, police say.”

[26] Bel Trew, “Salman Abedi’s brother bought parts for Manchester bomb,” Times, June 9, 2017; “Manchester bomber’s brother and father arrested in Tripoli,” Libya Herald, May 24, 2017; Laura Smith-Spark and Hala Gorani, “Manchester suicide bomber spoke with brother 15 minutes before attack,” CNN, May 26, 2017.

[27] Josie Ensor, “Manchester bomber’s brother was ‘plotting attack on UN envoy in Libya,’” Telegraph, May 27, 2017.

[28] “Latest Statement from Detective Chief Superintendent Russ Jackson, Greater Manchester Police,” June 11, 2017. The statement is available at https://twitter.com/gmpolice/status/873926655059927041 and https://twitter.com/gmpolice/status/873926742553112578; Lizzie Dearden, “Salman Abedi travelled through Turkey and Germany four days before launching Manchester suicide attack,” Independent, May 25, 2017.

[29] Cruickshank, “London attack ringleader was under active investigation at time of assault.”

[30] SITE Intel Group, “#ISIS releases English-language version of claim for #Manchester bombing,” Twitter, May 23, 2017.

[31] “Terror ringleader ‘tried to hire 7.5 tonne lorry hours before London attack,’” ITV News, June 10, 2017.

[32] “London attack: What happened where in eight minutes of terror,” Sky News, June 5, 2017.

[33] Ralph Blackburn, “London Bridge terrorist Khuram Butt taught primary school children in Ilford,” Barking and Dagenham Post, August 2, 2017.

[34] Richard Kerbaj, “Jihadi Sid told sister: I’ll die for ISIS,” Sunday Times, January 10, 2016.

[35] “The Jihadis Next Door,” Channel 4; Vikram Dodd, Matthew Taylor, Alice Ross, and Jamie Grierson, “London Bridge attackers were regulars at Sunday afternoon pool sessions,” Guardian, June 7, 2017.

[36] Fiorenza Sarzanini, “L’Italia segnalo il killer di Londra fermato a Bologna per terrorismo,” Corriere della Sera, June 6, 2017.

[37] Ibid.

[38] “Update: London Bridge terror attack investigation,” Metropolitan Police press release, June 16, 2017.

[39] Sarah Knapton, Martin Evans, Nicola Harley, Harry Yorke, Ben Farmer, and Robert Mendick, “Khuram Butt, Rachid Redouane and Youssef Zaghba named: Everything we know about the London Bridge terrorists,” Telegraph, June 6, 2017.

[40] Paul Cruickshank and Nic Roberts, “London ringleader Khuram Butt was intensely investigated,” CNN, June 6, 2017.

[41] “Appeal for information on knives used in London Bridge terrorist attack,” Metropolitan Police Press Release, June 9, 2017.

[42] Dodd, Taylor, Ross, and Grierson.

[43] Neil Johnston, Georgie Keate, John Simpson, and Katie Gibbons, “Police were warned two years ago that gym was ‘training jihadists,’” Times, June 9, 2017.

[44] Francesca Gillet, “London attack: ISIS claims responsibility for London Bridge horror which left seven dead, Islamist State media agency confirms,” Evening Standard, June 4, 2017.

[45] Raffaello Pantucci, “Al-Muhajiroun’s European Recruiting Pipeline,” CTC Sentinel 8:8 (2015).

[46] Ruth Sherlock, “British man who joined Islamic State to skip bail ‘killed’ in Syria,” Telegraph, July 5, 2015.

[47] Dipesh Gadher, “Housing benefit funds family’s dash to ISIS,” Sunday Times, March 19, 2017.

[48] Josh Barrie, “The Giant: Second British extremist ‘identified in ISIS video,’” Independent, January 17, 2017.

[49] C vs. HM Treasury, before The Hon Mr Justice Cranston, judgment handed down August 5, 2016.

[50] Rumiyah 10, June 2017.

[51] “PM statement following London terror attack,” Downing Street press release, June 4, 2017.

[52] Damien Gayle and Jamie Grierson, “London attack: Khuram Butt’s family stopped him going to Syria, says cousin,” Guardian, June 8, 2017.

[53] Cruickshank, “London attack ringleader was under active investigation at time of assault.”

[54] Rukmini Callimachi, “Manchester Bomber met with ISIS unit in Libya, Officials say,” New York Times, June 3, 2017.

[55] Saim Saeed, “French interior minister: Salman Abedi had ‘proven’ links with Islamic State,” Politico, May 24, 2017.

[56] Fiona Hamilton and Alexi Mostrous, “Manchester Arena killer Salman Abedi used YouTube to build bomb,” Times, June 24, 2017.

[57] “London Bridge attack latest: Terrorists named as police say they were not under surveillance as they posed ‘low risk,’” Telegraph, June 6, 2017.

[58] Paul Cruickshank, “Orlando shooting follows ISIS call for U.S. Ramadan attacks,” CNN, June 13, 2016.

[59] “UK security services have thwarted five plots since March Westminster attack: source,” Reuters, May 25, 2017.

[60] Darren Campbell, “Two arrested in Alum Rock Road charged with multiple terror offences,” Birmingham Mail, April 5, 2017.

[61] Charlotte Paxton, “Birmingham wife of alleged extremist is charged with terror offenses,” Birmingham Mail, April 25, 2017.

[62] Vikram Dodd, “Teenage girl accused in court of plotting terror attack in UK,” Guardian, July 26, 2017.

[63] Martin Evans, “Westminster terror suspect appears in court charged with bomb making offences,” Telegraph, May 10, 2017.

[64] “Willsden shooting: Police foil ‘active terror plot,’” BBC News, April 28, 2017.

[65] Dipesh Gadher, Robin Henry, Rebecca Myers, and Luke Mintz, “Banned Saudi preacher link to raided ‘house of terror,’” Sunday Times, April 30, 2017.

[66] Danny Boyle, “Mother and daughter in terror plot case ordered to lift veils by magistrate who demands to see their eyes,” Telegraph, May 11, 2017.

[67] Steve Robson and Rachel Burnett, “Three men ‘plotted London terror attack involving car bomb driven through Westminster Bridge inspired by Khalid Masood atrocity,’” Mirror, May 27, 2017.

[68] “Man arrested in east London charged with terror offences,” Metropolitan Police press release, June 20, 2017, and “Terror suspect viewed London Bridge attack material before arrest,” Court News UK, June 21, 2017.

[69] Ben Farmer and James Badcock, “Birmingham counter-terror arrest: Alleged ‘spiritual leader’ of Majorca-based cell is held,” Telegraph, June 28, 2017.

[70] Fernando J. Perez, “Uno de los yihadistas detenidos en Mallorca planeo una ‘matanza’ en Inca,” El Pais, June 30, 2017.

[71] “Erol Incedal: terror accused enjoyed billionaire’s lifestyle secret trial files reveal,” Telegraph, December 11, 2015.

[72] Tom Whitehead, “Erol Incedal jailed for three-and-a-half years over bomb-making manual,” Telegraph, April 1, 2015.

[73] See Raffaello Pantucci, “The Islamic State Threat to Britain: Evidence from Recent Terror Trials,” CTC Sentinel 9:3 (2016).

[74] “23,000 people have been ‘subjects of interest’ as scale of terror threat emerges after Manchester attack,” Telegraph, May 27, 2017; Cruickshank, “London attack ringleader was under active investigation at time of assault;” “AC Mark Rowley discusses the threat of terrorism,” Metropolitan Police, August 11, 2017.

[75] Dominic Casciani, “Manchester attack: The bewildering complexity of a terror inquiry,” BBC News, May 25, 2017; Sean O’Neill, “Spies gather to focus on biggest threats,” Times, June 8, 2017.

[76] Francis Elliott and Sean O’Neill, “May tells MI5 to ‘keep up’ with changing terror threat,” Times, June 5, 2017.

[77] Rowena Mason, “MI5 to review handling of London Bridge attack, says Theresa May,” Guardian, June 6, 2017.

[78] Cruickshank, “London attack ringleader was under active investigation at time of assault;” “AC Mark Rowley discusses the threat of terrorism.”

[79] “PM statement following London terror attack.”

Advertisements

More catching up, this time a literature review paper done with RUSI colleagues Clare Ellis and Lorien Chaplais as part of a larger project we are working on looking at Lone Actor terrorism. Lots more on this project to come in the first quarter of next year. In the meantime, spoke to the BBC about a Chinese national who went to fight alongside the YPG against ISIS (which is where the picture comes from), the Wall Street Journal about the year in terrorism, Deutsche Welle about terrorism and gun control in the US, Voice of America about China and international cooperation in terrorism, and to the Independent about the UN resolution on Syria. The entire paper can be found here, below is the brief introduction.

Bai Si Pan YPG_Dec 2015

Lone-Actor Terrorism: Literature Review

Lone-actor terrorism is not a new phenomenon; however, research suggests the threat is increasing as pressure from security services forces a tactical adaptation and groups call on those who share their ideology to act alone without direction or support

This paper is the first publication in the Countering Lone-Actor Terrorism (CLAT) project, which aims to improve understanding of, and responses to, the phenomenon of (potentially) violent lone actors through analysis of comprehensive data on cases from across Europe.

Despite recent depictions within the media, lone-actor terrorism is not a new phenomenon; however, research suggests the threat is increasing as pressure from security services forces a tactical adaptation and groups – including Daesh (also known as the Islamic State of Iraq and Syria, ISIS) – call on those who share their ideology to act alone without direction or support. This paper examines the current state of knowledge surrounding the phenomenon, assessing the limitations of the literature and identifying where further research should focus to add real value to countering the threat. Three recommendations are made: first, increased methodological rigour in empirical research; second, focus on process as well as perpetrators; and third, specific examination of the confluence between returning foreign fighters, domestic Daesh supporters, and the lone-actor threat.

A new review essay for my home institution RUSI’s own RUSI Journal. It covers a series of books written by three different individuals who managed to penetrate different parts of al Qaeda on behalf of security forces, and lived to tell their tales. The books are written with journalists and are all a good read – for different reasons in each case. I particularly enjoyed the pacey nature of Morten Storm’s account which ducks and weaves around al Qaeda globally, as well as the detailed and deeply personal look at some of the history around Finsbury Park Mosque that I had covered in my book in Reda Hassaine’s (that one would have been useful while I was working on the book I  should add, in fact Morten Storm’s as well given the interesting revelations about some historical cases like Hassan Tabbakh), while Mubin Shaikh’s is a very personal and emotional read. The point of the review was both to try to explore the particular cases and stories, but also more generally the phenomenon of these men who are drawn to serve in this dangerous role. The article is behind a paywall, but can be accessed here, and I have pasted the first few paragraphs below. If you cannot access it, do get in touch and I can see what I might do to help. This aside, been doing bits of talking to the media, but been travelling a lot too. So far, can only find some comments I made to Voice of America on the recent Tunisia attacks and the New Scientist on online radicalisation.

Radicalism and Terrorism

Raffaello Pantucci reviews

Agent Storm: My Life Inside al-Qaeda
By Morten Storm with Tim Lister and Paul Cruickshank

and

Abu Hamza: Guilty; The Fight Against Radical Islam
By Réda Hassaïne and Kurt Barling

and

Undercover Jihadi: Inside the Toronto 18 – Al Qaeda Inspired, Homegrown Terrorism in the West
By Anne Speckhard and Mubin Shaikh

Paranoia, fantasy, omniscience and glory are a combustible mix of emotions. Stoked by handlers keen to advance their own goals, this list provides a snapshot insight into the mindset driving individuals who choose to become undercover agents. Drawn into action through disaffection, a sense of need to improve the world around them or through manipulation by others, they have repeatedly played key roles in the War on Terror. At the heart of almost every disrupted plot is an undercover agent. The three books under review tell a clutch of these tales, exposing the seamy side of the intelligence war against Al-Qa’ida.
The agents at the heart of these tales all became undercover agents through different routes and at different times, though the enemy remains, broadly speaking, the same throughout. Morten Storm (an agent for Danish, British and American intelligence) and Mubin Shaikh (an agent for Canadian authorities) were drawn towards Al-Qa’idist ideology in Europe and Canada respectively in the late 1990s and early 2000s. This marked the beginning of their struggle to counter Al-Qa’ida and its offshoots from within. For Morten Storm this was the beginning of a globetrotting life focused on Al-Qa’ida in the Arabian Peninsula, Al-Shabaab and their European contacts, while for Mubin Shaikh it was the entry point into an immersion into Canada’s radicalised community. In contrast, Réda Hassaïne (who worked for Algerian, French and British services) was coerced into the world of espionage and counter-terrorism by a manipulative and brutal Algerian state that saw the young journalist and sometime political activist as a useful tool to be used and disposed of at will. All three had begun with little intention of becoming agents, but after being drawn into radical milieus, found themselves being targeted by security agencies.

A guest column in this weekend’s Sunday Times looking at the question of lone actor terrorism and how it fits into perceptions of the threat picture at home. Given the work I have done on this topic, it might seem I am contradicting myself, but I think the point is that all of these threats have to be kept into perspective. Lone actor terrorism is going to be a growing priority (as the end of this year has brought into sharp focus), but when held up against the sort of plotting we have seen in the past (and might still face in the future), we are dealing with a very different threat and this ought to be reflected in threat perceptions. This aside, spoke to the International Business Times about ISIS’s year.

Stand firm, the lone-wolf strike is a sign of reduced terror

Despite isolated incidents of extremism, we are safer than we think, writes Raffaello Pantucci

The Sunday Times Published: 28 December 2014

The year has ended with a sharp increase in “lone wolf” terrorist attacks. A threat that had been growing for some time finally found its feet in 2014’s closing months with incidents in Canada, America, Australia and France as well as disrupted plots in Britain and elsewhere. Yet while it feels like the threat is on the rise and security services are working at full strength to counter the risk, we are actually safer from the threat of terrorism at home.

None of this is to say that lone terrorists are not a danger. Sometimes these individuals are able to summon the wherewithal to launch attacks that kill many. The Norwegian mass murderer Anders Behring Breivik is the best example with his 2011 bombing and shooting campaign in Oslo and on Utoya island that killed 77 within a few hours. However, he is a rarity and most lone-wolf plots pale in comparison with al-Qaeda’s former ambitions.

For example, in August 2006 British police disrupted an al-Qaeda plan to bring down transatlantic flights with liquid bombs. But while the security services continue to worry about such ambitious plots, they are able to disrupt them. Plots involving lots of people mean communications and other activities that set off intelligence tripwires.

In contrast, an individual planning to stab a random policeman using a knife he already has at home is a hard target to pick up unless he has told someone else. And it is not always the case that the person he is telling will report it or realise what they are being told. This sort of threat slips under the radar, as in the case of the men responsible for the murder of Fusilier Lee Rigby last year in Woolwich, southeast London, or like Man Haron Monis, the Sydney siege gunman, this month. In the first case the two attackers were hard to separate from the larger antisocial, but legal, community of radicals in the UK. The Australian case shows the difficulty of spotting prior to an attack an individual angry at society who adopts the appearance of a terrorist to express himself more loudly.

The real question, though, is whether we should react in the same way to these incidents as we did to the July 7, 2005, bombings of London’s transport system. The deaths of more than 50 commuters is surely more menacing to society than the death of a single off-duty soldier in Woolwich, as tragic as any loss is. Almost a decade since the July 7 bombings we are now facing a terrorist threat that is only really able to express itself in the form of lone-wolf attacks. And while such attacks will lead to great suffering for those directly involved, they will affect many fewer people than, for example, the September 11, 2001, attacks on New York and Washington.

Abroad, it remains a different matter. As the year ended, the Pakistani Taliban launched an attack on a school in Peshawar, killing more than 140, and Boko Haram murdered dozens and kidnapped another 180 people in Nigeria. Terrorism on a large scale is still the aim but it is a goal that is increasingly hard to achieve in western countries and capitals. Instead groups push for their supporters to carry out attacks without direct communication.

Individuals who are part of networks, and who are launching attacks with terrorist motives and intent, become confused with deranged or unstable people who see lone-wolf terrorism as their way of joining a larger cause or bringing attention to themselves. However, while the attacks seem more frequent, the casualties at home are less. If work by the security services has managed to reduce the threat down to lone-wolf terrorists or deranged individuals then things are not necessarily as bad as they seem.

The concern caused by lone-wolf terrorism is understandable. The rash of seemingly random incidents towards the end of the year gives the impression of a rising tide. But it must be kept in context. Terrorist groups continue to want to attack the West, yet find it increasingly hard to do so.

The lone-wolf terrorists we have seen are a mix of individuals with connections to other terrorists (but little evidence of direction in launching their attacks), or socially awkward, troubled individuals who demonstrate little ability to do much more (in most cases) than kill or injure a couple of people and try to dress it up as an organised plot.

Terrorist groups continue to be unable to carry out large plots on the scale of the July 7 bombings, though they continue to try. In fact it is even possible that the hyperventilation around lone wolves is helping to attract more people to the idea and exacerbating the problem. If people notice that these sorts of attacks attract attention, then they might want to emulate them to direct some of the spotlight onto their own personal cause. The current lone-wolf panic might ultimately be instigating the very sort of incidents we are all worried about.

Raffaello Pantucci is director of international security studies at the Royal United Services Institute

First of all: Happy holidays to anyone who is reading this!

A brief hiatus over the holiday period after a slowdown towards the end of the year for a variety of reasons, but will be hopefully back to more regular output next year. In the wake of Sydney (and subsequent events in France) had a spate of conversations with journalists about the phenomenon of lone actor terrorism, including for the Financial Times, Telegraph, Huffington Post, Newsweek and New York Times. The Guardian in the meantime solicited the below piece. I am sure (and know) there will be more on this topic in the new year, in particular as am in the midst of projects on this very topic in a variety of different directions.

The Sydney siege fits the new, confusing global norm: the ‘lone actor’ attack

How do we know if ‘lone actors’ are unstable individuals, or acting under direction from a group? Counter-terrorist planning will increasingly grapple with this question

theguardian.com, Wednesday 17 December 2014 03.31 GMT

Jump to comments (186)

man haron monis

‘Isolated individuals who launch attacks using rudimentary weapons are difficult for security forces to detect.’ Man Haron Monis in 2011. Photograph: AAP

Lone actor-style terrorism is becoming the new normal. Groups like al-Qaeda and Islamic State (Isis) have been pushing it most recently, but it has been a feature of terrorist narratives and strategic thinking for some time.

Isolated individuals who launch attacks using rudimentary weapons are difficult for security forces to detect using their traditional methods. The same factors that make it hard to intercept such individuals make it equally hard to know for sure that what is being looked at is a genuine terrorist attack, or a deranged person who adopts the garb of a terrorist to publicly exorcise personal demons.

Monday’s attack in Sydney by Man Haron Monis was an archetypal case of how confusing this picture can get. A clearly troubled individual tried to draw some of Isis’s brand and spotlight to himself, and ended up leaving the world wondering the degree to which he can be considered associated or connected to the group in any way.

Lone actor (the preference by governments is to not use the term “lone wolf” as it is seen as glorifying) terrorism is not new. Right wing extremists have long liked the idea, drawing back to Cold War thinkers who were keen to prepare America for the possibility of an invading force that would require loyal survivors to take to the hills to wage an undercover insurgency against invaders.

Initially developed under the concept of “leaderless resistance” in the 1960s by a US Army Cold Warrior called Ulius Louis Amoss, the ideas were further advanced by a Ku Klux Klan member called Louis Beam in the 1980s. For Beam, the concept of single man (or small cell) fighting units was a perfect way around the need to fight a strong and pervasive state – because there were fewer opportunities for security forces to intercede.

Moving into our current age of sacred terror, the concept of networks of extremists with few connections launching a global insurgency was advanced by an al-Qaeda ideologue named Abu Musab al Suri. He spoke of a group structured like a “system, not organisation” – whereby different cells had their roles, but did not speak to each other in any direct way, each knowing their job and role without the need for compromising contact.

Largely ignored by the broader al-Qaedaist community, his ideas were picked up with great verve by al Qaeda in the Arabian Peninsula (Aqap) who used their Inspire magazine to push the idea of a self-starting jihad whereby individuals simply launch attacks using weapons easily to hand against any target they could find.

In one issue they advocated people simply taking a jeep with knives welded to the front of it and driving it into a crowd of people. Track forwards to today and Isis leader Muhammad al Adnani gave a speech in which he called for people to “kill a disbelieving American or European – especially the spiteful and filthy French – or an Australian, or a Canadian, or any other disbeliever from the disbelievers waging war … in any manner or way however it may be”.

As al Adnani put it, cause murder and mayhem wherever you are, without asking “for anyone’s advice” or “anyone’s verdict. Kill the disbeliever whether he is civilian or military”.

While groups have long pushed in this direction, it is not clear how successful they have been in actually driving people in this direction. There has been a noticeable increase in lone actor style terrorist attacks whereby people launch attacks seemingly without any clear direction or command and control from a specific group. It is not clear that this is something that a group, like Isis or al-Qaeda, could really claim credit for.

In a British context, the first real lone actor terrorist plot took place in the form of Andrew Ibrahim, a troubled young man from Bristol who was reported to authorities by the local community when he showed up to his local mosque with quite serious burns on his hands. A self-proclaimed Muslim convert, Ibrahim had led a troubled youth dabbling in drugs, the rave scene and steroids.

At the time of his arrest Ibrahim seemed to be primarily making his money on welfare and selling the Big Issue. Somewhere along the way he decided to adopt the garb of extreme Islam.

Ibrahim spent some time trying to connect with extremists around the UK, while he would show off videos of Osama bin Laden to his friends. When police moved to arrest him they were shocked to find viable homemade explosives in his fridge, a homemade suicide vest behind his door and a well thought-out plan of the Princesshay shopping mall, which he apparently intended to target in a suicide terrorist attack.

With no connections or direction from known extremists, Ibrahim was the first in a number of cases in the UK where individuals launched seemingly random attacks in which they would refer to the language and rhetoric of violent Islamism without having any connection to it.

When prying into their motivations, often the appearance was of an individual who was angry at the world and was looking for some way to express this anger. The bright light of violent Islamism sometimes offers the best way to express this rage.

While we still do not know the full picture with Man Haron Monis, it increasingly seems as though we are dealing with a similar individual who is troubled and angry at society for his own personal reasons, and who saw the bright light of Isis’s brand as the best way to get his message out there.

The problem is that while he may have had no connection to the group, his choice of using its rhetoric and approach to express himself meant that his plot captured the world’s attention. A man, angry at society, quickly escalated into a potential terrorist incident, with potential links to Isis.

This both bolsters the group and the individual. Separating these incidents out and establishing how to properly respond to them is going to be at the heart of counter-terrorist planning for the near future.

With apologies for the silence, it has been a very busy and hectic time in a number of different directions. Things ramping up in many different ways for the end of the year, so am only now getting around to posting my latest journal article for my institutional home’s in-house publication the RUSI Journal. It looks at Lone Actor terrorism in the UK in the wake of the Woolwich attack, something that abruptly became very relevant again recently as a result of a number of disparate attacks in Canada and now Australia. More on this topic to come.

Over the past few weeks have also spoken to a few journalists, including the Los Angeles Times about the UK’s counter-radicalisation efforts, the Financial Times and Jewish Chronicle about the difficulties posed to counter-terrorists across Europe due to the free movement around the EU, to the Guardian about the ongoing chaos in Libya, to NBC about ISIS, and the Financial Times and Telegraph about events in Sydney and lone actors. On the other side of the docket, spoke to Bloomberg about the Silk Road Economic Belt and Li Keqiang’s visit to Kazakhstan, to Voice of America about Xi Jinping’s anti-corruption drive in the wake of the charging of Zhou Yongkang, and to the Associated Press and South China Morning Post about terrorism in Xinjiang. Finally, I was on the BBC’s Newsnight about the Sydney attack last night, which can be seen here for the next month.

The RUSI Journal article is freely available online here, and rather than post it on this site

A Death in Woolwich: The Lone-Actor Terrorist Threat in the UK

RUSI Journal, Oct 2014, Vol. 159, No. 5 

By Raffaello Pantucci

OBM RUSI Journal

Recent events in Syria and Iraq have shown in horrifying starkness the increased participation of British jihadists in terrorist fighting in the Middle East. In response, many have called for increased measures against home-grown radicals, to prevent them from travelling abroad to fight for the Islamist cause and, crucially, to stop them from carrying out attacks upon their return. Raffaello Pantucci analyses the difficulties of identifying potential terrorists among the many individuals who move within radical Islamist circles, and the even more challenging task of pinpointing those susceptible to self-radicalisation who could, without direct guidance, carry out dangerous acts of lone-actor terrorism.

A new post for RUSI earlier in the week, this one touching upon the fact that the infamous Abu Qatada was deported on the anniversary of the July 7, 2005 London bombings. Likely a coincidence, but an interesting one nonetheless that helps mark out a period of British jihadist history. Unrelated, but showing how the threat continues to evolve, I was quoted in this BBC piece about the decision to add Nigerian Boko Haram and British Minbar Ansar Deen to the proscribed terror list in the UK.

Abu Qatada Leaves the United Kingdom

RUSI Analysis, 9 Jul 2013By Raffaello Pantucci, Senior Research Fellow

Abu Qatada symbolised an era of British jihadism that relied on radical preachers to motivate a generation of terrorists. Alongside a general degradation of Al-Qa’ida’s capacity to launch large-scale plots, Qatada’s departure marks an end of an era that peaked during the 7 July 2005 attacks on London.

Abu Qatada cropped

The departure of Abu Qatada from British soil on the eighth anniversary of the 7 July bombings in London marks something of a marker for a period of British jihadism. From a coordinated threat directed by Al-Qa’ida that drew on a community of young British Muslims fostered by radical preachers leading to plots like the 7/7 attack, the menace has now evolved. Expressions in the form of attempted attacks or thwarted plots continue to appear, but gone is both the easy and public coordination at home epitomised by the radical preacher community in the UK, and gone is ability of Al-Qaida core in Waziristan in particular to manipulate large scale plots through this particular network to strike on British soil.

Radical Preachers

Abu Qatada was the last of four prominent preachers in the United Kingdom around whom young radicals from around the world gathered and who formed the nub of what was publicly derided as ‘Londonistan.’ A period in the 1990s when Britain became the home away from home for a number of preachers and activists from across the Muslim world agitating for change, both violent and non-violent, in their home countries. Many of these individuals presented (and continue to present) no specific threat to the UK, and are focused very much on events abroad.

Abu Qatada’s role within this community was an interesting one. Largely focused abroad, he nevertheless had authority over this sub-community in the UK. In particular, he was reported to have told security services that he could ‘wield powerful, spiritual influence over the Algerian community in London.’ He also acted as a teacher figure to younger men Abu Hamza and Abdullah el-Faisal, both of whom were characterised as his students at one time or another. He seems to have had a less direct relationship with Omar Bakri Mohammed, the fourth of the radical preachers, though it seems clear the men moved in similar circles in London. Abu Qatada’s credentials as a scholar and his links to one the fathers of modern Salafism, Muhammad Nasiruddin al-Albani set him apart from the other three who lacked such credentials. Unlike the other three, his impact seems to have been more ideological, while the others fostered networks and communities from which a number of terrorist plots emerged.

Al Qa’ida Orchestration

The most successful of these plots was 7/7 bombings carried out by four men, at least two of whom had been trained by Al-Qa’ida in Waziristan. This plot, like a number of others that were disrupted before and since, involved Britons who had been radicalised in part under the tutelage of the radical preacher community, managed to establish connections with Al Qa’ida core and were directed to carry out attacks in the West. Numerous other plots were disrupted from this network, including the August 2006 plot codenamed ‘Overt‘ that aimed to bring down somewhere in the region of eight flights on transatlantic routes with a potential casualty count higher than the 11 September 2001 attacks.

These plots drew their footsoldiers from the radical communities that the UK-based preachers fostered. Recruiters for Al-Qa’ida or other extremists used this space  to seek out funding and followers. Going abroad, most of these men were initially seeking to fight and die on foreign battlefields. However, once there, some were re-directed back to conduct attacks at home as Al-Qa’ida realised their potential as a community that could penetrate deep into Western society. Key individuals like British national Rashid Rauf became the connective tissue providing a link between the senior echelons of Al-Qa’ida and the British recruits, helping them get around Waziristan and then providing managerial control over operations.

Over time, however, this connection has come under increasing scrutiny as  Western intelligence services realised its magnitude and increasingly became able to intercept its communications, penetrate its structures and remove key players from the field. This led to a gradual degradation of the network, though there is evidence that the community of individuals eager to travel back and forth to seek training continues to exist.

Most recently this connection was seen in a case in Birmingham in which a number of Britons travelled to Pakistan’s lawless provinces, trained alongside groups close to Al-Qa’ida before receiving loose direction to return home to carry out an incident of some sort. This is a world apart from the Operation Overt cell from 2006 where multiple elements were in repeated contact with masterminds back in Pakistan who had provided specific training and targeting and helped them along the trajectory of the plot. By 2011, the level of orchestration from afar was much harder to identify with Irfan Naseer – the plot leader of the Birmingham cell – giving little indication of being in regular touch with someone abroad. In a comment overheard by a security listening device he said that his guidance was more rudimentary than that: ‘they said yeah, the knowledge they gave us, they want that to spread to Europe.’ There was little evidence offered during the case (or any of the other cases linked to the core cell around IrfanNaseer) that anything was being orchestrated from afar. As was commented at the time, the approach seemed to be ‘fire and forget.’

Threat Shifting Overseas

But as groups in Pakistan in particular come under increasing pressure and lose their reach back to the UK, the threat elsewhere abroad has been growing, and the potential remains for foreign networks to use the continuing flow of British fighters to places like Syria to launch attacks back home. Currently, groups leading the fight in Syria have demonstrated no interest in launching a terrorist attack in the UK (or anywhere else in particular for that matter – their interest seems focused on toppling Bashar al Assad’s regime), but it is an open question how this will develop in the future.

Beyond foreign battlefields, the Internet has helped spread radical ideas and made them more accessible. Lone actor terrorism is a novel phenomenon that has shown an ability to express itself in a random and violent manner. And actions by extremist Islamist groups in Europe have led to a counter-reaction by extremists on the other end of the spectrum. We have now evolved, though not entirely passed, from a time when people sought out the community of radical preachers such as Abu Qatada, and from them were recruited by groups to go and fight abroad.

This evolution has come about for a number of reasons. Primary amongst these was the removal of the radical preachers (Abu Hamza through jail and then deportation to the US, Abdulla el Faisal through jail and then deportation to Jamaica, and Omar Bakri Mohammed through a self-imposed exile) and the removal of the open space in which they could operate. Abu Qatada’s departure from Britain for Jordan’s courts marks the conclusion of a long process by successive British governments that sought to expel these figures from the UK. New charismatic leaders and preachers have since emerged, but current legislation means that they are much more circumspect in their comments and openness in actively pushing people to go and fight abroad. Individuals are still drawing ideas from this ideological pool and some are electing to go and fight abroad, but the direct linkages are now far more discreet.

The other side to this coin is found in Pakistan where Al-Qa’ida’s ability to direct plots and plotters has been substantially degraded. The pressure of drone strikes and a growing western intelligence footprint means that key figures like Rauf and numerous other Al-Qa’ida figures have been taken off the battlefield. Those that are left are having to provide guidance and training in far more constrained environment, and once people have left the camps they are largely being left to simply get on with attempting to carry out attacks. The age of large-scale orchestrated plots from Pakistan seems to have passed.

Additionally, the emergence of Al-Qa’ida affiliates and battlefields of competing interest has given individuals a number of different locations where they can seek to find the adventure and thrill of jihad or play their role in fighting to protect the ‘ummah.’ How these different battlefields will impact the threat picture in the UK is a developing story, but at the moment they do not pose the same sort of threat that Al-Qa’ida’s grand plans directed from Pakistan did.

Coming exactly eight years after Al-Qa’ida’s last successful attack on the west, Abu Qatada’s deportation marks the end of an era in British counter-terrorism. But as one era seems to come to a close, a new one may be being forged on foreign battlefields and the internet marking an evolution of a problem many in the UK may consider removed with Abu Qatada’s departure.