خارطة ا�خاطر Terrorism and new ideologies
By Jonathan Wood & Shawn van Slyke Compiled with data from CORE
201 2017 New ork Burkina aso 0 If you’re looking for good news about the global terroristWashington threat, this is it: the overall number of terrorist incidents Colombia 217 2 worldwide,2002-201 as well as the number201 -2017 of estimated casualties,Chicago declined in 2017 compared to 2016, according to Control Egypt 7 20 Risks data. The essential drill down reveals the inevitable os ngeles nuance. The decrease was broad, but uneven and multiple countries experienced increased terrorist activity dueOther to shifting conflictGermany and militant 7 group dynamics. 1 Greece 0 ibya 1 0
Phillippines 1 07 The emphasis on the high impact acts of terror carried out by Islamist extremists in Spainwestern cities, notably Islamic State (IS), has0 deflected attention from other ideological actors, especially right- and left-wing extremists,Thailand compounding177 the difficult and delicate7 challenge of detecting and responding to radicalisation. Furthermore, ondon the convergence of ideological and personal motivations in Turkey 1 0 violent attacks remains among the most challenging aspectsParis of the evolving terrorism threat environment. U 17 2 2002-201 201 -2017 msterdam Copenhagen Fortunately, corporate responses, including insider threat programmes and workforce active assailant training, are relatively agnostic: Other they work regardless of the ideological motivation of extremists. However, the challenge for organisations continues to be finding all the dots and connecting them within the constraints of business ethics and the law.
Source: Control Risks CORE © Control Risks 2017
Fig.1 Number and lethality of terrorist attacks Fig.2 Selected country trends
100 201 2017 ehicle 1 ,000 New ork 0,000 Burkina aso 0 Washington nife 12,000 Colombia 217 2 7 2002-201 201 -2017 Chicago 10,000 0,000 Egypt 7 20 irearm os ngeles ,000 Other Germany 7 1 IE 0 20,000 Greece 0 ,000 Rocket missile ibya 1 0 ,000 10,000 Phillippines 1 07 BIE 2,000 2 Spain 0 Incendiary Thailand 177 7 201 201 201 201 2017 ondon Suicide bombing Turkey 1 0 Paris 2002 200 200 200 200 2007 200 200 2010 2011 2012 201 201 201 201 2017 Incidents Fatalities U 17 2 0 100 1 0 200 2002-201 201 -2017 msterdam Copenhagen
Other ehicle nife Bomb irarm Other Incidents executed
Copyright © Control Risks. All rights reserved. This document cannot be reproduced without the express written permission of Control Risks. Any reproduction without authorisation shall be considered an infringement of Control Risks’ copyright.
Total Total Immigrants rson of which Greece of which Germany Government Other Other 100 ehicle 1 ,000 0,000 1 nife 12,000 1 11 2 7 10,000 72 2 irearm 0,000 0 0 1 ,000 IE 27 7 20,000 0 ,000 17 1 21 7 1 1 1 Rocket missile 1 1 0 01 11 ,000 10 1 0 1 11 2 11 0 0 2 07 10,000 02 1 07 2 BIE 1 11 17 1 0 0 0 1 2 0 2,000 12 12 0 01 0 2 17 0 0 11 0 0 0 07 12 1 Incendiary
201 201 201 201 2017 Suicide bombing 2002 200 200 200 200 2007 200 200 2010 2011 2012 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 201 201 201 Incidents201 2017 Fatalities 0 100 1 0 200
ehicle nife Bomb irarm Other Incidents executed
Total Total Immigrants rson of which Greece of which Germany Government Other Other
1
11 2 1 72 2 0 0 1 27 7 17 1 21 7 1 1 1 0 01 11 1 1 10 1 0 1 11 2 11 0 0 2 07 02 1 07 2 1 11 17 1 0 0 0 1 2 0 12 12 0 01 0 17 0 0 11 0 0 0 07 12 1 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 The global picture .the overall number of terrorist attacks was the rapid collapse of IS controlled territory in Iraq and Syria during 2017 خارطة down ا�خاطرDriving However, an IS-inspired insurgency in southern Philippines intensified into a regional jihadist front, while the actions of the army in Myanmar turned the Rohingya’s plight into a jihadist cause celebre. In addition, Islamist extremists associated with both IS and al-Qaida sustained a high operational tempo across the Sahel and Horn of Africa regions. Finally, IS continued to incite and inspire multiple high-profile attacks in Western countries, particularly in Australia, Finland, Spain, Sweden, the UK, and the US. Ethno-nationalist and Marxist guerrilla movements continued to define the terrorism threat in several countries. In Colombia, the decline in FARC activity was offset by a surge in ELN attacks intended to gain leverage in peace talks. In Turkey, a heavy-handed counter-insurgency against Kurdish separatists substantially reduced the frequency and severity of attacks in western cities. In India, Marxist insurgents remained an active but localised threat. In Thailand, the long-running ethno-religious Malay insurgency continued, amid fruitless peace talks.
In Western Europe and North America, meanwhile, the scope and severity of right- and left-wing extremist attacks increased. Greek militant anarchists escalated and internationalised their anti-austerity campaign with a series of letter bomb attacks targeting banks, international institutions, and politicians. In London, Paris and Charlottesville (US), meanwhile, right-wing extremists appropriated vehicle ramming as a tactic. Elsewhere in Europe, right-wing extremism tracked changes in irregular migration patterns: we recorded a sharp fall in arson attacks against refugee centres in Germany, while the number of anti-immigrant attacks increased in Italy.
Diversification of violent extremism
Islamist extremists, ethno-nationalist insurgents, and leftist guerrillas will remain the main sources of terrorist violence in most countries in 2018. But the fringes of a wider range of ideological movements appear to be embracing extremist violence. These include lone individuals accessing extremist ideology online but acting outside organised groups.
Right-wing extremist sentiment – focusing on anti-immigrant, anti-Semitic, and ethno supremacist themes – is increasingly overt in Europe and North America. This is reflected in the rising number of reported hate crimes, including vandalism and harassment, even in the absence of significant violent attacks. Left-wing extremists – chiefly in the guise of militant anarchist and anti-fascist groups – have also increasingly tolerated violence in reaction to government social, economic and security policies. For both right- and left-wing extremists, online propaganda and social media allow individuals to participate in political movements without formal organisational ties. As with homegrown Islamist extremists, this has made the threat environment less predictable: lone actors are less likely to come to the attention of law enforcement than organised groups, and their attacks are more likely to reflect personal motivations than a group strategy. In another parallel with Islamist extremists, rising public concern about these 201 2017 networks is reflected in both increased voluntary and regulatory efforts to clamp down on both left- and right-wing extremistNew forums ork Burkina aso 0 and propaganda. Washington Colombia 217 2 2002-201 201 -2017 Chicago Egypt 7 20 os ngeles Source: Control Risks CORE © ControlOther Risks 2017 Germany 7 1 Greece 0 Fig.3 Terrorist plots and attacks in the US by city Fig.4 Terrorist plots and attacks in Europe by city ibya 1 0
Phillippines 1 07 Spain 0
201 2017 Thailand 177 7 New ork ondon Burkina aso 0 Turkey 1 0 Washington Paris Colombia 217 2 U 17 2 2002-201 201 -2017 Chicago 2002-201 201 -2017 msterdam Egypt 7 20 os ngeles Copenhagen Other Germany 7 1 Other Greece 0 ibya 1 0
Phillippines 1 07 Spain 0 Thailand 177 7 ondon Turkey 1 0 Copyright © Control Risks. All rights reserved. This document cannotParis be reproduced without the express written permission of Control Risks. 100 U 17 2 Any reproduction2002-201 without authorisation 201 -2017shall be considered an infringement msterdam of Control Risks’ copyright. ehicle 1 ,000 Copenhagen 0,000 nife Other 12,000 7 10,000 irearm 0,000 ,000 IE 20,000 0 ,000 Rocket missile ,000 10,000 BIE 2,000 2 Incendiary 100 ehicle 1 ,000 201 201 201 201 2017 Suicide bombing 0,000
2002 200 200 nife200 200 2007 200 200 2010 2011 2012 201 201 201 201 2017 12,000 0 200 Incidents Fatalities 7 100 1 0 10,000 irearm 0,000 ,000 IE ehicle nife Bomb irarm Other Incidents executed 20,000 0 ,000 Rocket missile ,000 10,000 BIE 2,000 2 Total Total Immigrants rson Incendiary of which Greece of which Germany Government Other 201 201 201 201 2017 Suicide bombing Other 2002 200 200 200 200 2007 200 200 2010 2011 2012 201 201 201 201 2017 Incidents Fatalities 0 100 1 0 200 1
11 ehicle nife2 Bomb irarm 1 Other Incidents executed 72 2 0 0 1 27 7 17 1 21 7 1 1 1 0 01 11 Total Total Immigrants 1 rson 1 10 1 0 1 11 2 11 0 0 2 of which Germany Other 07 02 1 07 2 of which Greece Government 1 11 17 1 0 0 0 1 2 0 12 12 0 01 0 17 Other 0 0 11 0 0 0 07 12 1
1 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 11 201 201 2 201 201 2017 1 72 2 0 0 1 27 7 17 1 21 7 1 1 1 0 01 11 1 1 10 1 0 1 11 2 11 0 0 2 07 02 1 07 2 1 11 17 1 0 0 0 1 2 0 12 12 0 01 0 17 0 0 11 0 0 0 07 12 1 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017 Diversification of targeting
of violent extremism also expands the geography and nature of potential targets. As Islamist extremist activity shifted خارطة diversification ا�خاطرThe towards less-sophisticated homegrown extremists in Western countries, for example, it also shifted away from capital and other major cities to smaller towns and local assets familiar to the attacker. Major cities are still targets, including of transnational terrorist groups, but they are no longer the main targets. This dynamic is likely to persist in 2018, as IS seeks to incite retaliation for the loss of its territorial ‘caliphate’.
Targeting by right- and left-wing extremists has traditionally followed different rules. Broadly, right-wing extremists target government buildings and personnel, Jewish and Islamic places of worship, ethnic and racial minorities, individuals and assets associated with immigration, and law-enforcement installations and personnel. By contrast, left-wing extremists target industrial, commercial and retail assets, financial institutions (especially ATMs), government buildings and personnel, law-enforcement assets (especially vehicles) and personnel, prisons and private security firms, and – of course – right-wing demonstrators. Left-wing attacks globally – excluding Marxist guerrilla movements – have been similarly concentrated against banks, and government buildings in Greece.
As with Islamist extremism, lone actors potentially confound this traditional distribution of attacks. Two incidents in the US in 2017 are instructive: in June, a left-wing extremist travelled 1,400 km (865 miles) to Washington, DC, to plan and conduct a shooting attack against members of the US Congress (federal legislature). In August, a right-wing extremist travelled 875km (545 miles) to Charlottesville (Virginia) to participate in a rally, where he conducted a lethal vehicle-ramming attack against counter-demonstrators in the city centre. (Unlike the left-wing shooting attack, it remains unclear if the right-wing vehicle-ramming attack was opportunistic or planned.) In both cases, the long-distance travel to the attack location and unconventional targets suggest that lone actors at the extremist fringes of both right- and left-wing movements are expanding the range of potential attack scenarios.
Source: Control Risks CORE © Control Risks 2017
Fig.5 Global patterns of right- and left-wing extremist attacks
Total of which Germany Immigrants Government Other rson Other
1 11 2 1 2 0 0 1 72 21 0 0 7 01 11 12 1 0 02 0 07 07 1 2 0 0 07 0 12 11
201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017
Total of which Greece Immigrants Government Other rson Other
27 17 1 1 7 1 1 1 1 10 1 1 11 2 11 0 17 0 0 2 0 0 1 11 12 0 01 1 2 0 0 1 17
201 201 201 201 2017 201 201 201 201 2017 201 201 201 201 2017
Diversification of tactics
Recent ideological extremist attacks also indicate an increasingly diverse portfolio of tactics, techniques and procedures. This has been extensively documented among Islamist extremists, who have adopted low-tech, low-cost tactics such as knife assaults and vehicle-ramming. Such attacks are more frequently executed successfully than more complex tactics, even if the impacts are more localised and often smaller-scale. As a result, they increased to nearly half of known plots and attacks in Western countries in 2017. For both right- and left-wing extremists, arson (including both Molotov cocktails and timed incendiary devices) has been a dominant
Copyright © Control Risks. All rights reserved. This document cannot be reproduced without the express written permission of Control Risks. Any reproduction without authorisation shall be considered an infringement of Control Risks’ copyright. 201 201 20172017 NewNew ork ork tactic over the last five years. Beyond arson, and in line with their differential target sets, right-wing extremists have tended to favour BurkinaBurkina aso aso 0 0 WashingtonWashington violent assaults and firearm attacks, while left-wing extremists emphasise sabotage and vandalism. ColombiaColombia 217217 2 2 خارطة ا�خاطر ChicagoChicago 201 -2017201 -2017 2002-201 2002-201 EgyptEgypt 7 7 20 20 os os ngeles ngeles Left-wing extremists, however, have indicated renewed interest in improvised explosive device (IED) attacks Right-wing extremists, GermanyGermany OtherOther 7 7 meanwhile,1 1 indicate persistent interest in explosive attacks, even if these tend to exceed their limited capabilities. GreeceGreece 0 0 ibya ibya This1 0 could1 0 change in the future: the Charlottesville attack, as well as two earlier vehicle ramming attacks targeting Muslim PhillippinesPhillippines 1 1 worshippers 07 07 in Paris and London, highlight the diffusion of violent methods from Islamist extremists to right-wing actors. The Finsbury SpainSpain Park0 0 attack, for example, was apparently styled specifically as retaliation for an Islamist extremist vehicle ramming attack on London ThailandThailand 177177 Bridge7 7 two weeks earlier. It is likely that the heightened profile of vehicle ramming attacks is contributing to their use by non-Islamist ondon ondon TurkeyTurkey 1 01 0 ParisParis extremists. More generally, vehicle ramming as a tactic is likely to be generally attractive to violent extremists of any stripe for the U U 1717 same2 2 reasons it appeals to Islamist extremists: minimal training, experience, and planning required. 2002-201 2002-201 201 -2017201 -2017 msterdam msterdam CopenhagenCopenhagen OtherOther
Source: Control Risks CORE © Control Risks 2017
Fig.6 Proportion of Islamist extremist incidents in Fig.7 Rate of executed Islamist extremist attacks by tactic Western countries by method, 2002-17 in Western countries, 2002-17
100 100 ehicle ehicle 1 ,0001 ,000 0,000 0,000 nife nife 12,00012,000 7 7 10,00010,000 irearm irearm 0,000 0,000 ,000 ,000 IE IE 20,00020,000 0 0 ,000 ,000 RocketRocket missile missile ,000 ,000 10,00010,000 BIE BIE 2,0002,000 2 2 IncendiaryIncendiary
201 201 201 201 201 201 201 201 20172017 SuicideSuicide bombing bombing 2002 2002 200 200 200 200 200 200 200 200 2007 2007 200 200 200 200 2010 2010 2011 2011 2012 2012 201 201 201 201 201 201 201 201 2017 2017 IncidentsIncidents FatalitiesFatalities 0 0 100100 1 01 0 200200
ehicle ehicle nife nife BombBomb irarm irarm OtherOther IncidentsIncidents executed executed
Detecting lone wolf threats TotalTotal TotalTotal ImmigrantsImmigrants rson rson of ofwhich which Greece Greece of ofwhich which Germany Germany GovernmentGovernment OtherOther The FBI’s Behavioral Analysis Unit (BAU) recently concluded a study of lone actor attackers, an in depth examination OtherOther of offenders from across the ideological spectrum. The study reinforced the notion that attacks often followed a trail of observable behaviours and escalation, with increasingly extreme views and hostile attitudes evident to those with whom they 1 1 interacted. For the most part, ‘lone wolf’ attackers appeared to be drawn to extremism to express and legitimise underlying 11 11 2 2 1 1 feelings of inadequacy, frustration, anger and hostility. 7272 2 2 0 0 0 0 1 1 Just as important, the study found that an average of more than a year elapsed between the offender’s first involvement in an 2727 7 7 extremist cause and an attack, indicating an extended period of time during which intervention could have been attempted. 17171 1 2121 7 7 1 1 1 1 1 1 0 0 0101 1111 1 1 1 1 10101 1 0 0 1 1 1111 2 2 11110 0 0 0 2 2 0707 0202 1 1 0707 2 2 1 1 11111717 1 1 0 0 0 0 0 0 1 1 2 2 0 0 1212 1212 0 0 0101 0 0 1717 0 0 0 0 1111 0 0 0 0 0 0 0707 1212 1 1
Copyright © Control Risks. All rights reserved. This document cannot be reproduced without the express written permission of Control Risks. 201 201 201 201 201 201 201 201 2017 2017 201 201 201 201 201 201 201 2017 201 2017 201 201 201 201 201 201 201 201 2017 2017 201 201 201 201 201 201 201 201 2017 2017 201 201 201 201 201 201 201 201 2017 2017 201 201 201 201 2017 201 201 201 201 2017 Any reproduction without authorisation shall be considered an infringement of Control Risks’ copyright. خارطة ا�خاطر
The corporate response
Going into 2018, preventing mass casualty attacks and active shooter incidents at facilities globally continues to be a top priority for Control Risks’ clients. The shift towards low-tech attacks against public spaces has stretched traditional concepts of duty of care and operational disruption. In addition, the overlap between workplace violence incidents and threats involving radicalised employee insiders creates a more complex threat environment for companies and their employees.
There is no one-size-fits-all recommended intervention approach, but ensuring that an organisation’s managers and security professionals have all available information pertaining to the threat posed by a potentially violent insider is critical. This reinforces the need for a multi-disciplinary approach to insider threat assessment and management from a corporate perspective – the hallmark of a mature and effective insider threat programme. Complex underlying issues pertaining to perceived harassment, as well as rights to privacy and religious expression in the workplace, require close collaboration between leadership from Security, Legal, Human Resources, and Information Technology. A well trained and closely coordinated Threat Management Team with representation from across these business functions enables an organisation to maximise its potential to initially identify emerging situations of concern, evaluate the totality of circumstances, and devise a tailored threat mitigation plan.
Well-developed mitigation plans will enable the organisation to better detect any behaviours which could be indicative of escalation toward a potential attack. Observations take on even greater relevance in the workplace when supervisors are proactively engaged to be vigilant at earlier stages in the assessment process. Unlike casual and occasional observation by acquaintances, well- developed insider threat programmes create systematic and routine opportunities for recognition and reporting of pre-attack planning or preparation-related behaviours that might not otherwise be detected.
Copyright © Control Risks. All rights reserved. This document cannot be reproduced without the express written permission of Control Risks. Any reproduction without authorisation shall be considered an infringement of Control Risks’ copyright. Such behaviours, which could include contextually inappropriate acquisition of weapons or escalation in target practising, preparation message using an online platform, deletion or masking of certain social media content, or unusual travel or financial خارطة a will or final ا�خاطرof activity, may provide us with a key behavioural indicator that an individual of concern may be progressing toward an attack.
Jonathan Wood Shawn VanSlyke Director Director [email protected] [email protected]
About Control Risks CORE CORE provides incisive analysis and forecasting on geopolitical and security issues, comprehensive country risk ratings, an extensive database of incidents, plus visualisation and analytics tools.
Copyright © Control Risks. All rights reserved. This document cannot be reproduced without the express written permission of Control Risks. Any reproduction without authorisation shall be considered an infringement of Control Risks’ copyright.