In late 2018, the FBI completed a review of 18 international terrorism homeland attacks involving some 20 attackers between 2015 and March 2018. The review was based on comprehensive interviews with investigative personnel, as well as research-identified, pre-incident commonalities among attackers. For this review, the FBI defined international terrorism homeland attacks as acts of violence ideologically motivated by Sunni violent extremism.
At the 126th annual International Association of Chiefs of Police conference, an FBI Senior Intelligence Analyst provided an in-depth look at the commonalities identified among the attackers, and suggestions for how local and state law enforcement can use this information to help detect and disrupt future threats.
Memorable quotes on homegrown violent extremists
Here are four memorable quotes from the presentation:
“The homegrown violent extremist threat is a threat of individuals. They don’t act rationally as a group in concert with some grand strategy.”
“The shift to civilian targets, using easily obtainable weapons and encrypted communications, means there are fewer and fewer opportunities for bystanders, federal and local law enforcement to identify an individual who might be mobilizing to violence.”
“We have seen time and time again in successful attacks and previous plots the important role that bystanders can and oftentimes do play, so we need to push out information on what to look for so they can be best informed as to whether they need to alert something to law enforcement.”
“ISIS has been very successful at pushing a message that resonates with a younger audience who is vulnerable and looking for a sense of belonging.”
Key takeaways on identifying homegrown violent extremists
The FBI views homegrown violent extremists (HVEs) as the primary international terrorism threat facing the U.S. today. These individuals – inspired by the global Jihad – are based and radicalized primarily in the United States. They are not receiving individualized direction from an overseas-based terrorist organization.
By looking at the data to determine patterns or gaps that existed, the FBI identified the following key commonalities that could have investigative and actionable implications. During the session, the following takeaways were identified:
1. Eleven of the 20 attackers (55%) had prior contact with at least one FBI subject before the attacks
These figures highlight the importance of what the FBI calls in-case targeting, essentially fully identifying all of an individual’s contacts and associates from available communications and social media information through the service of both legal process and publicly available information. While HVEs typically act as a threat of individuals and not necessarily a cohesive group, many are in contact with each other, so it is important to determine who these individuals are talking to or have contact with.
2. Fourteen of the 20 attackers (70%) were isolated from their peer networks
Isolation from peer networks is significant for two reasons:
- Lack of exposure to alternative viewpoints means there is less potential for others to have a mitigating influence on radical views;
- Isolation from a peer network limits the number of potential bystanders who might witness changes in behavior that could be reported to local or federal law enforcement.
3. Twelve of the 20 attackers (60%) traveled overseas at some point before their attacks
Potentially nefarious travel overseas to conflict zones has long been an established indicator of radicalization or mobilization to violence. FBI researchers were surprised at the number of individuals who had traveled before their attack. While there is no information the travel was derogatory, investigators could not rule out that travel was linked to the radicalization process. In many instances, it can be easy to assign rational reasons for travel, such as returning to visit family, which underscores the importance of fully investigating an individual’s activities to include overseas travel.
4. Eight of the 20 attackers (40%) are known to have possessed and used mobile messaging applications with encryption capabilities
The FBI has observed a significant decline in access to the content of terrorist communications due to the widespread adoption of mobile messaging applications that employ encryption. This creates serious challenges for law enforcement seeking access to content, which will only get worse as end-to-end encryption increases.
5. Ten of the 20 attackers (50%) selected familiar targets – including schools, workplaces or other locations frequented by the attackers
Attack targets since 2016 have included a sleepover, a high school cafeteria, college campuses, a bus terminal, a restaurant and a nightclub. This is a very different target set from what was seen in the years after 9/11, when most attackers sought out more significant U.S. government, military and law enforcement targets.
In many cases, the attackers had personal connections to or grievances against their ultimate target, showing a confluence of radical ideology and personal factors.
The selection of targets familiar to the attackers is concerning as it essentially reduces the potential opportunities for detection. Because the attackers are familiar with their targets, they don’t necessarily have to conduct pre-operational surveillance of the targets, which reduces the possibility that such pre-surveillance could be reported as suspicious activity to law enforcement.
6. Nineteen of the 20 attackers (95%) legally obtained the weapons they used, including knives, guns, a vehicle and explosive materials
Since about 2014 there has been a shift in attack aspirations from more spectacular explosive devices toward easily available weapons, which has paralleled the messaging strategy of al-Qaeda and ISIS for attackers to do what they can where they are.
The deadliest HVE attacks in the United States have been active shooter operations such as the Pulse nightclub shooting and the San Bernardino and Ft. Hood shootings. This shift to easily obtainable weapons has again reduced the opportunities for detection.
7. Fourteen of the 20 attackers (70%) intended to conduct martyrdom operations; of those 14 attackers, nine made end-of-life preparations
While leaving wills and manifestos has been a long-standing indicator of mobilization to violence, the FBI researchers were surprised by the number of “practical” considerations some of these attackers made in the anticipation of ending their lives.
Some repaid debts to family and friends, which is presumably according to the Islamic belief that debts must be paid before entering heaven. The FBI also saw individuals take steps to ensure future childcare for the children they would leave behind.
Some of these warning signs are consistent with the same warning signs for suicide, so there is the need for law enforcement to evaluate existing mobilization indicators to consider these other behaviors as potential indicators of a potential terrorist attack. These preparations are often made just days or even hours before the attack.
8. Bystanders have observed indicators of radicalization or mobilization for 18 of the 20 attackers (90%), but in not all cases did those individuals come forward
While family members and close friends are best positioned to identify radicalization and mobilization indicators, they are often resistant to sharing their concerns with local law enforcement. Community authority figures and commercial company employees were the most likely to report suspicious activities, but are not as well-positioned as family and friends to observe suspicious behaviors.
HVE Mobilization Indicators booklet
No one individual or agency is positioned to observe all of the indicators that a person is mobilizing toward violence, which underscores the importance of information sharing and collaboration at all levels – between federal, state, local law enforcement, private sector, community and foreign partners.
Community bystander reporting is also a key element in successfully disrupting homeland plotters. Recognizing there is a need to push out information on what to look for, the FBI, National Counterterrorism Center and DHS created the Homegrown Violent Extremist Mobilization indicators booklet. Recently updated, the booklet includes a pullout sheet of indicators and can be downloaded here.
