Date Posted: 09-Dec-2010 Jane's Intelligence Review

Lone wolf - The threat from independent jihadists Chris Jasparro

Key Points  The threat that individuals could carry out independently motivated terrorist attacks was highlighted by the November 2009 Fort Hood shootings in the US.  'Lone wolf' attacks pose a risk because the absence of a cell or major external links may make it difficult for the authorities to detect and deter potential attackers.  However, an analysis of this type of attack over several decades suggests it is rarely effective and so poses a lower level of risk than might be supposed.

Over the past decade, attacks by independent operatives and weakly connected cells have increasingly contributed to the jihadist threat against the West. Chris Jasparro assesses the potency of such actions and their potential to pose significant problems in the future.

The threat of grass-roots terrorism in the West is attracting renewed interest in the wake of the November 2009 shooting at Fort Hood military base, Texas, which left 13 United States military personnel dead. This event seems to have galvanized the attention of security officials, jihadist leaders and media alike, with Al-Qaeda and its Yemen-based affiliate, Al-Qaeda in the Arabian Peninsula (AQAP), calling on their supporters to carry out similar attacks. Contrary to some recent reporting, there is nothing new about these calls for independent jihad or the phenomenon of grass-roots, home-grown terrorism. Although such cases appear to be on the rise, much media and analytical coverage tends to focus on specific incidences, such as the Fort Hood shootings in 2009. However, when the cumulative record of this type of terrorism over several decades is analyzed, it seems that independent terrorists have a poor record of success and that the most serious threats are still posed by established jihadist groups or cells that are closely connected to such groups or wider jihadist networks.

Categorization One of the difficulties in assessing 'lone wolf' is determining the actual extent of an individual or cell's independence from wider terrorist networks or formal organizations and external direction. Furthermore, as cases are investigated, links previously not suspected may emerge, while in others suspected links may be dismissed. Although the state of knowledge is constantly shifting, loose categories of cell type can be distinguished that exhibit persistent characteristics. From an examination of 48 plots and actual and attempted jihadist attacks in the US since 1977, as well as the 16 attempted and successful attacks that have occurred in western Europe since 2003, three common types of actor emerge: individual lone wolves, weakly connected cells and connected cells. Individual lone wolves and weakly connected cells are single people or small groups that have independently prepared and plotted attacks without external direction, assistance or training. They may have been influenced by ideologues or propaganda external to their social network and in some cases may have weak or past ties to wider terrorist networks or organizations. Connected cells are those that include at least some individuals who have received training, assistance or direction related to an operation from a formal organization or individual acting on behalf of such an organization. For example, Faisal Shahzad, who was sentenced to life imprisonment on 5 October 2010 for charges relating to his attempted vehicle bombing in New York's Times Square five months earlier, carried out his failed operation at the behest of the Pakistani Taliban. This category also covers self-starters who are deeply embedded in and connected to wider jihadist networks from which they may have obtained information, skills, training, resources, ideas or inspiration beyond that which members could have generated on their own accord. For example, while the March 2004 Madrid train bombers appear to have formed a self-starter cell that was not under the control of Al-Qaeda or another formal terrorist organization, many of its key members were deeply connected to wider jihadist networks in Europe and North Africa.

Case studies An examination of published US government and legal documents, media reporting and academic sources reveals that, since 1977, Sunni jihadist groups or individuals acting in line with a Sunni jihadist ideology have formulated a total of 48 specific plots (defined as active planning, training and targeting), including attempts (instances where attackers commenced their operation but failed to reach or engage their targets) in the US. This total does not include instances of financing, espionage, proselytizing or actions committed by US nationals outside the US. Of these, 40 had an operational home-grown element, where key operational cell members were US citizens or legal residents, the cell involved was formed in the US or one or more cell members were radicalized in the US. At least 12 of the European attacks examined have a home-grown element (see Table 2: European lone wolves). Only 22 of the 48 US incidences actually proceeded to the point of execution, with 13 being successfully executed. Lone wolves account for 14 of these attempts and eight of the 13 successfully executed (see Table 1: US lone wolves). Therefore, these statistics reveal that nearly half of all successful Islamist extremist attacks in the US over the past 30 years have been home-grown, lone wolf attacks. However, these attacks produced 19 deaths, excluding suspects. Connected jihadist cells killed around 3,000 people in the 11 September 2001 attacks on the US and six in the 1993 World Trade Center bombing, while numerous disrupted plots had the potential to kill many more. Conventional wisdom suggests that contemporary jihadists are often sophisticated and well-adjusted members of society, who are unknown to the authorities (so-called 'clean skins') and turn against their home countries under the influence of extreme religious ideology. Grass-roots jihadists are particularly feared by security officials and sought after by militant leaders because their lack of ties to extremist organizations makes them difficult to detect and, in theory, allows them to appear anywhere to carry out surprise attacks. However, so far individual attackers have proven to be singularly maladapted. In all 14 US lone wolf cases, political and personal grievances against the US government were the main motivations or justifications given by the operatives for the attacks. The primary justification in all 14 cases was anger at US actions in the Middle East and towards , especially the invasions of and and US policy towards the Israeli-Palestinian conflict. For example, Michael Finton, a convert to Islam charged with attempted murder and attempted use of a weapon of mass destruction, told an FBI informer that as a young man he wanted to join the army to get training so he could establish a militia to fight the government, according to his indictment. These long-held anti-government feelings appear to have heightened after he converted to Islam. The indictment said he tried to detonate a vehicle bomb outside the federal building in Springfield, Illinois, on 24 September 2009 in the hope it would result in the US withdrawing its troops from Iraq and Afghanistan. He denies the charges. Few fit the stereotype of well-adjusted, religiously devout but fanatical individuals that currently pervades much of the public debate over home-grown terrorism. Analyses reveal considerable diversity of character between jihadists that defies simple profiling and categorization. However, individual actors in the US have displayed a remarkable set of similarities. At least nine of the suspected lone wolves have been described by investigators or friends and family as loners. Ten had experienced significant life crises, including marital problems, deaths of parents, unemployment or job issues, financial troubles and drug abuse. Seven, including Finton, had criminal records. At least six appear to have suffered from mental illnesses, ranging from bipolar disorder and schizophrenia to depression. Of the cases that have come to trial, no courts or juries accepted mental illness as an excuse or explanation for the suspects' specific actions and decision to launch their attacks. Many of the suspects became increasingly angry and radical as their personal and psychological problems deepened, whereupon they began to externalize their grievances, blaming them on outside causes. These grievances were ultimately shaped and sharpened by extremist ideologies. The actual point at which they were religiously radicalized varied widely; in some cases radicalization developed over an extended period, while in others it occurred rapidly.

Table 1: US lone wolves

Attack Date Suspect Target/location Result mode

CIA Headquarters, Two CIA employees were killed. Kasi was 25-Jan-93 Mir Aimal Kasi Shooting Langley, Virginia executed in 2002.

Member of a Jewish sect, One person killed. Baz was sentenced to 1-Mar-94 Rashid Baz Shooting Brooklyn Bridge, New 141 years in prison. York

Light aircraft Bank of America Tower, 5-Jan-02 Charles Bishop suicide Only the suspect was killed. Tampa, Florida attack

El Al counter at Los Hedayat killed an El Al ticketing agent and Hesham Mohamed 4-Jul-02 Shooting Angeles International a bystander before being shot dead by a Ali Hedayat Airport, California security officer.

Disrupted by informant. Reynolds was convicted of plotting to blow up energy Michael Curtis Dec-05 Bombing Unspecified oil pipeline installations, attempting to enlist help on Reynolds the internet and possessing a hand grenade.

University of North Mohammed Reza Vehicle No fatalities. Taheri-Azar was convicted on 3-Mar-06 Carolina campus, North Taheri-Azar ramming two counts of attempted murder. Carolina

Jewish center, Seattle, One person killed, five wounded. Haq was 28-Jul-06 Naveed Afzal Haq Shooting Washington sentenced to life plus 120 years.

Derrick Shareef Shooting, Shopping mall in Disrupted by informant. Shareef was Dec-06 (Talib Abu Salam grenades Rockford, Illinois sentenced to 35 years in prison. Ibn Shareef)

Carlos Bledsoe (Abdulhakim Military recruiting center, One person killed, one wounded. Bledsoe 1-Jun-09 Shooting Mujahid Little Rock, Arkansas has pleaded guilty and awaits sentencing. Muhammad)

Hosam Maher Skyscraper in Dallas, Disrupted by informant. Smadi was 24-Sep-09 Bombing Husein Smadi Texas sentenced to 24 years in prison.

Plot to bomb federal 24-Sep-09 Michael Finton Bombing Finton has pleaded not guilty to charges of building in Springfield, (Talib Islam) Illinois attempted murder

13 people killed, 30 injured. Hasan has Maj Nidal Malik been charged with multiple counts of 5-Nov-09 Shooting Fort Hood, Texas Hasan murder and attempted murder, but has yet to register a plea.

Disrupted by informant. Ahmed has been Metro stations in charged with attempting to provide Oct-10 Farooque Ahmed Bombing Washington, DC material support to terrorists. He has not entered a plea.

Mohamud has been charged with Mohamed Osman Public square, Portland, 26-Nov-10 Bombing attempting to use a weapon of mass Mohamud Oregon destruction. He has pleaded not guilty.

Religious identity The suspects varied widely in their religious backgrounds and identities and their degrees of religiosity. In all cases, religion does not appear to have been an initial driver of the suspects' anger and radicalization, but helped to shape and direct their thinking and individual struggles. Although all 13 of the suspects cited political motivations in line with Al-Qaeda or similar extreme Sunni jihadist ideologies, only Major Nidal Malik Hasan, who has been charged with multiple counts of murder following the Fort Hood shooting, had a life history of devout Sunni practice. His radicalization appears to have begun after his parents' deaths and his entry into the US military. Nine of the suspects were either not born Sunni Muslims and/or struggled to form their religious identities. Rashid Baz, who opened fire on a van carrying Hasidic Jews on the Brooklyn Bridge, New York, in March 1994, was born into a Lebanese Druze family and came to the US as a refugee. He later wrestled with his religious, ethnic and immigrant identities before gravitating towards Sunni radicalism. Naveed Afzal Haq, who forced his way into a Jewish center in Seattle, Washington State, in July 2006 and opened fire with two automatic pistols, was brought up as a Muslim in a Pakistani-American family. However, he also struggled with his religious identity and even converted to Christianity shortly before his attack. Mohammed Reza Taheri-Azar, who was convicted on two counts of attempted murder after he deliberately rammed pedestrians with his vehicle at the University of North Carolina in 2006, was raised a Shia in an Iranian-American family, but later in life became influenced by Sunni Islamist anti- US political rhetoric. Other Muslims described his religious practice as "unorthodox". Finton and two other lone wolf suspects are converts who gravitated to radicalized forms of Islam after soul searching, in part related to run-ins with the law or time served in prison. While Charles Bishop was raised as a Christian, he voiced support for and the 11 September 2001 attacks on the US in a note found in the wreckage of the stolen light aircraft he crashed into a skyscraper in Tampa, Florida, on 5 January 2002. While the note expressed motives in line with Al-Qaeda ideology, there remains uncertainty as to whether this was an actual political statement or just a ploy to attract attention. This highlights the difficulty in assessing and analyzing cases of individual jihad, as it can be difficult to sharply delineate motives or to distinguish between acts of emotional disturbance, prejudice, routine criminal intent and actual ideological fervor. This has led some commentators to classify nearly any violent crime committed by US Muslims as terrorism.

Clean skins One advantage of lone wolf terrorism that is often cited is the presumed ability of operatives to avoid scrutiny and detection. The reality is more complex, with suspects demonstrating varying degrees of exposure. Except for weapons purchases, individual operators have demonstrated little consistency in terms of the extent of pre-operational planning. In some cases, attacks were spontaneous or near- spontaneous actions, while in others suspects had conducted planning for up to several months. However, as mentioned previously, many of the suspects had criminal records or prior run-ins with law enforcement. At least five of the eight successful attackers had expressed radical sentiments or discussed taking violent action in the presence of friends, family or co-workers. Another five exhibited behavioral changes before taking action. Both Hasan and Carlos Bledsoe, who carried out a shooting at a military recruiting office in Little Rock, Arkansas, attracted the attention of federal law enforcement and intelligence agencies before they were arrested in connection with attacks because of their contacts with known radicals. Few of the successful attackers were completely clean and many had acted in ways that attracted attention either to their mental states or their intentions. The six suspects who failed to successfully execute their attacks were all compromised by law enforcement informants or sting operations. All exhibited behaviors such as internet activities, talk, travel and attempts to contact known jihadists that ultimately attracted the attention of authorities. At least four of these six were in part exposed by their internet activities. The majority of unconnected cells and at least eight of the 14 solo jihadist suspects made or tried to make external contacts either to train and fight overseas or to seek support and justification for their aspirations.

Attack modes Six of the eight successful attacks were shootings. Taheri-Azar decided to use a vehicle to run down students only after his attempt to purchase a handgun was thwarted by local firearms regulations. Semi-automatic handguns were the primary weapons employed, followed by assault rifles. All the shooters carried large amounts of ammunition and at least five of the six possessed multiple firearms, although in most cases only one weapon was fired in the attack. This choice of attack mode is one reason why solo jihadists have had a high attack execution rate. Firearms are relatively easy and inexpensive to procure in the US and require much less premeditation, preparation and skill to operate, while producing fewer indicators and warnings than production of explosive devices. Vehicle collision attacks also are low-skill, expedient methods. Both methods are well-suited for individual operators who may be emotionally or mentally unstable at the time of attack and who lack connection to people or organizations able to assemble or procure explosive devices and components. However, method and lack of skill also explain why individual attacks have had little impact. Suicide was used only in the Tampa attack and it appears that Bishop chose the method primarily to enable himself to commit suicide, rather than choosing suicide for tactical and strategic reasons. In two cases, shooters surrendered to the authorities.

European cases As in the US, lone attackers account for a high share of actual attacks in Europe, but like their US brethren, the attacks were limited in scope and impact. Five such attacks occurred between 2003 and November 2010. In a departure from the US pattern, knives and axes were the primary weapons (four cases), while individuals figured prominently as targets: three media figures associated with cartoons or films considered insulting to Muslims and one parliamentarian. One incident, in December 2003, when an emotionally troubled Palestinian set fire to himself and his vehicle outside a synagogue in Modena, Italy, may have been a suicide rather than a politically motivated attack. Of the five suspects, one person had experienced emotional problems, a second had suffered a series of life crises and anger issues before being radicalized, and a third committed suicide in prison after carrying out his attack. Two of the five suspects were known to intelligence services because of their existing ties with known radicals, and one of them also had a criminal record. Only two suspects potentially fit the profile of well-adjusted individuals who were radicalized quickly under the radar. Roshonara Choudhary, who stabbed British parliamentarian Stephen Timms in March 2010, was a seemingly successful and well-adjusted student who became radicalized quickly via the internet. Her internet research was preceded by a religious turn, the causes of which are unknown. Amer Cheema, who tried to stab Die Welt editor Roger Koppel in March 2006 and committed suicide in prison shortly after his arrest, was an engineering student seeking to avenge the publication of cartoons of the Prophet Muhammad. Little is known about his path to radicalization or emotional state before his attempted attack.

Table 2: European lone wolves

Attack Date Suspect Target/location Result mode

Shafiq was killed when he set fire to Possible his propane-fuelled car, which Muhammad Synagogue, Modena, 11-Dec-03 vehicle exploded. It remains unclear whether al-Khatib Italy bombing he intended to carry out an attack or just commit suicide.

McDonalds Moustafa Vehicle Chaouki died after opening gas 28-Mar-04 restaurant, Brescia, Chaouki bombing cylinders in his vehicle, which ignited. Italy

Cheema was arrested before he could Amer Editor of Die Welt, 20-Mar-06 Stabbing reach his target and committed suicide Cheema Berlin, Germany in prison.

Theo Van Gogh, Mohammed Van Gogh was killed. Bouyeri was 2-Nov-06 Shooting Amsterdam, Bouyeri jailed for life. Netherlands

Timms was stabbed, but survived. Roshonara Stephen Timms, 14-May-10 Stabbing Choudhary was sentenced to life in Choudhary , UK prison.

Cell structures Weakly connected cells have contemplated or attempted more ambitious operations than individuals, but have a lower success rate. In all but a few cases they have demonstrated considerable incompetence and lack of skill. Self-starter cells that lacked or had only weak connections to jihadist organizations and networks account for 12 of the 48 US plots and attacks. In only two cases did they succeed in hitting their target. Many analysts consider the 1977 Hanafi siege to be the prototype of a grass-roots jihadist operation in the US. Twelve African-American converts to Islam seized three buildings and 149 hostages in Washington, DC, but then surrendered to authorities. Their leader had previously been discharged from the US army on grounds of mental illness. The 1990 assassination of the radical rabbi Meir Kahane was conducted by a small cell believed to be loosely affiliated with the Egyptian cleric Omar Abdul Rahman. Lead suspect El Sayyid Nosair was acquitted of murder but convicted and jailed on weapons charges. He was later convicted on charges related to the 1993 World Trade Center bombing. The other nine incidences never matured beyond the plotting stage and at least eight of them were disrupted by informant and sting operations. The severity of many of these cases is unclear, as it is often difficult to determine how willing and able cells would have been to carry out attacks if they had not been infiltrated by law enforcement. On the other hand, there is a risk that even disorganized self-starter cells can become a threat if they manage to connect with formal organizations or skilled operatives. For example, the suspects in the Kahane murder were all implicated in the 1993 World Trade Center bombing, in which a group of self- starters was transformed into a more highly connected cell and, with the help of Ramzi Yousef (an Al- Qaeda-trained explosives expert), carried out a significant attack. The cells involved in these cases have not been particularly 'clean'. Ten of the 12 cells contained members with criminal pasts and numerous cells contained members of dubious emotional stability. Many of the cells also had members who were known to law enforcement or intelligence agencies because of their connections or attempts to connect with known extremists. Weakly connected European cells have fared little better than their US counterparts. At least three attacks by such cells have reached the execution stage since 2003. In June 2007, doctor Bilal Abdulla and engineer Kafeel Ahmed, having failed to detonate crude car bombs in London, rammed their vehicle into Airport and set it on fire. Ahmed was severely burned and subsequently died, but Abdulla survived and was convicted in December 2009 of conspiracy to murder and sentenced to life imprisonment. No one else was seriously injured. In July 2009, three men were sentenced to jail terms of four and a half years for trying to set fire to the London home of Martin Rynja, the publisher of a controversial book about the Prophet Muhammad's daughter, by pouring diesel fuel into his letter box in September 2008. One of the men, Ali Beheshti, was an unemployed former convict who was the subject of a widely known photograph in which he is seen holding his daughter, dressed in an Al-Qaeda T-shirt, aloft at a protest. In October 2009, Libyan Mohamed Game blew off his hand and eyes in an attempted suicide bombing on a Carabinieri barracks in Milan, Italy. He had recently lost his job, was believed to have been suffering from depression and may have previously been involved in a stolen goods case. Another Libyan and an Egyptian were successfully prosecuted as his accomplices. Another possible example is that of Muslim convert Nicky Reilly, described in media reports as having Asperger's syndrome and a mental age of 10. Reilly injured only himself in a failed attempt to bomb a restaurant in Exeter, UK, in May 2008. Reilly pleaded guilty to attempted murder and preparing an act of terrorism and was sentenced to life imprisonment but no accomplices have ever been identified or prosecuted. However, the UK authorities have said Pakistan-based extremists used the internet to encourage Reilly to carry out an attack and provide instructions to build his crude device.

CONCLUSION Self-starter cells with home-grown elements have conducted the majority of attempted and actual attacks in the US since the late 1970s and in Europe since at least 2003. However, the attack record by individual and grass-roots cells with weak connections to the wider jihadist world is unimpressive. In 2009, Time magazine ranked five of the cases analyzed for this article in the top 10 most inept terrorist plots of all time. Furthermore, the suspects were less 'clean' and less off the radar than conventional wisdom might have asserted. External attackers or cells and individuals who connect with established networks and formal organizations remain the greater danger. This does not mean the threat should be taken lightly. Past experience has shown that weakly connected and even fairly unskilled groups can carry out deadly attacks if they make the right connections. Furthermore, even when accounting for increased aggressiveness by law enforcement and security agencies, the emergence of lone wolves and highly independent cells appears to be increasing. If this trend continues, the likelihood that attackers will get lucky or skilled and competent personnel will join a cell will increase along with the odds of a significant attack. However, such attacks are most likely to remain isolated incidences rather than developing into a systematic and strategic threat. Enhancing and continuing proactive law enforcement, intelligence, and community outreach activities could enable governments to manage and minimize the threat. Nonetheless, such efforts can benefit terrorists by consuming government resources, while a delicate balance must be struck to avoid alienating communities and bolstering acceptance of extreme ideologies.