The Modus Operandi of Jihadi Terrorists in Europe, by Petter Nesser and Anne Stenersen

Abstract

This article provides the most thorough overview yet of how jihadis have plotted terrorist attacks in Europe. Drawing on a database of 122 incidents, we review trends in weapon types, attack types and target types in the period 1994–2013. The overall finding is that jihadi terrorism in Europe is becoming more discriminate in its targeting while attack types and weapons are becoming progressively more diverse. The most likely scenarios in the coming three to five years are bomb attacks and armed assaults against sub-national entities, communities and individuals. A majority of the terrorist attacks will be limited in scope, but mass-casualty terrorism cannot be excluded. Foreign fighters from Syria are likely to influence the threat level in Europe, but we do not expect them to alter patterns in modus operandi dramatically.

Key Words: Tactics, targeting, foreign fighters, Europe, jihadist terrorism networks

Perspectives on Terrorism is  a journal of the Terrorism Research Initiative and the Center for Terrorism and Security Studies

ISSN  2334-3745 (Online)

Introduction

While we are starting to learn more about the “who” and “why” of jihadi terrorism in Europe, very few studies have dealt with the “how.”[1] The modus operandi of jihadis in Europe ranges from simultaneous mass casualty bombings such as those in Madrid on 11 March 2004, to crude attacks such as the killing of a British soldier in Woolwich on 22 May 2013. Considering the continuous threat of jihadi terrorism in Europe and the sizeable contingent of European fighters in Syria, there is an urgent need for research-based knowledge about the modus operandi of European jihadis. This article makes three contributions. First, we offer the most thorough overview yet of how jihadis have plotted terrorist attacks in Western Europe. Secondly, we propose tentative explanations as to why the terrorists have altered their weapon types, attack types and target types over time. Thirdly, we discuss what modus operandi to expect three to five years from now. The study is explorative. We do not aim to formulate or test theory in a strict sense. Our main objective is to create an empirical basis for further theorizing on why terrorists alter their modus operandi.

Two overall trends have been identified. First, targeting is becoming more selective. In the 1990s and early 2000s, jihadi terrorism in Europe was dominated by random mass casualty attacks on transportation, exemplified by the Madrid bombings. In recent years it has become more common to target Jews, artists involved in the Prophet Mohammed cartoons affair, or soldiers in uniform. Secondly, weapons and tactics are becoming more diverse. In the 1990s and early 2000s, jihadis in Europe operated in groups and planned bomb attacks with certain types of explosives. In recent years, more terrorists have worked alone and they used a broader repertoire of weapons, including knives, axes and handguns. Our data suggest that a majority of jihadis in Europe still prefer to work in groups and carry out bomb attacks, but that an increasing number resort to single actor terrorism and crude weapons to avoid detection.

When discussing the data, we compare the period before and after 2008. The year 2008 was chosen for methodological reasons, as explained in the method and data section. However, when interpreting the results it is worth noting that the time around 2008 was characterized by certain developments in the jihadi field that were bound to influence international terrorism. From 2008 onward, al-Qaida’s central organization was weakened by a drastic increase in drone attacks in northwestern Pakistan.[2] At the same time, regional al-Qaida affiliates in the Middle East and Africa were on the rise, and some of them began to dabble in international terrorism on al-Qaida’s behalf. In addition, since 2008 more independent sympathizers were drawn toward jihadism via new social media such as Facebook, Twitter and YouTube.[3]

We propose two overall explanations for the changes in modus operandi. We contend that the trend towards more discriminate targeting reflects al-Qaida’s need for legitimacy and support in a situation when the organization is weakened by counter-terrorism and faces competition from other jihadi groups. By focusing on discriminate targets, the organization may have hoped to win broader sympathy and make up for some of the criticism it faced following mass-casualty attacks that killed Muslims. Such an approach resembles, to some extent, what Neumann and Smith refer to as ‘strategic terrorism,’ which implies that terrorist groups will eventually shift away from indiscriminate violence and move towards activities designed to boost the group’s legitimacy.[4] However, al-Qaida’s trajectory deviates from the framework because it has not abandoned mass-casualty terrorism altogether. Instead - probably to fulfill a dual need of upholding its reputation as the world’s most dangerous terrorist organization on one hand, and to win sympathy on the other hand - the organization has widened its repertoire of tactics to include both discriminate and indiscriminate attacks. As for the trend towards diversity in weapons and tactics, we contend that it first and foremost reflects how jihadi networks have had to adapt their modus operandi in response to Western counter-terrorism measures. However, we also surmise that this diversity reflects a more heterogeneous landscape of actors.

Based on the trends we identify here, we expect bomb attacks and armed assaults to be the most likely terrorism scenarios three to five years from now. The most likely mass-casualty scenario is a bomb attack in a crowded area. The most likely tactical innovation is a combination of several crude methods such as arson, armed assaults and small bomb attacks. We expect that jihadis in Europe will prefer attacking sub-national entities, communities and individuals with symbolic value, rather than societies at large. However, certain elements within al-Qaida and like-minded groups will continue to plot indiscriminate mass killings.

Al-Qaida has so far been instrumental in shaping the threat from jihadi terrorism in Europe, but as of 2014, new and powerful actors are on the rise. The Islamic State (IS) and other jihadi outfits in Syria and Iraq may also affect the modus operandi of jihadi terrorism in Europe. We have been tracking terrorist incidents with alleged links to IS in 2013-2014, but at the time of writing, they do not constitute a solid basis for generalization. Looking ahead, blowback from the war in Syria and Iraq may influence jihadi terrorism in Europe in several ways. Returning foreign fighters may bring with them new technologies and tactics, or they may introduce a sectarian dimension to attacks, targeting Shias or Kurds. The most dangerous scenario is that IS or like-minded groups launch a top-down organized campaign of international terrorism as a response to Western military involvement in the conflict. But the most likely effect in the short to medium-term is contagion of attack methods broadcast widely in media, such as public beheadings and other revenge-driven executions.

Definitions and Scope

The article surveys jihadi terrorist plots in Western Europe. By “terrorist plot” we mean planned, prepared, and executed terrorist attacks. The criterion for including a terrorist plot in the dataset is that there are strong indications in open sources that an identifiable jihadi group or individual planned to attack one or several targets. We did not set as a criterion that the evidence should hold up in court and lead to convictions, as many terrorist plots were disrupted at an early stage. Although terrorism is a highly contested concept, we see no reason to problematize it here. The essence of terrorism is violent attacks to spread fear, ultimately with a view to sending a political message.[5] With this in mind we see little ambiguity concerning the cases addressed in this study, which mostly involve plans to conduct bombings or shootings against non-combatants inside peaceful European societies.

As for the adjective “jihadi”, it refers here to militant individuals, groups, networks and ideologies emanating from the Arab-based foreign fighter movement of the Afghan jihad in the 1980s.[6] The “Afghan-Arab” movement represented an internationalization of post-colonial Islamist insurgencies against Arab dictators. It gave rise to the idea of global jihad, which meant that in order to defeat Arab dictators, jihadis had to target the U.S. and Israel first. Ideologically, Al-Qaida and like-minded movements are referred to as “salafi-jihadis.” Put simply, this means that they combine revolutionary Islam originating from Egypt with fundamentalist Islam as practiced in Saudi Arabia (Salafism or Wahhabism).[7]

The salafi dimension has implications for the modus operandi, in the sense that any act of violence by jihadis must find justification and precedent in the traditions of the Prophet (hadith). For example, a verdict by a recognized salafi scholar on the individual duty of Muslims to kill people who insult the Prophet Mohammed has had direct effects on the threat situation in Europe. It should also be underscored that jihadis’ dependence on religious justification by no means contradicts strategic thinking. On the contrary, the movement has a strong tradition of producing strategic texts and evaluating the fruitfulness of its methods of struggle.[8] In jihadi thought, religious tenets and strategy go hand-in-hand as the militants consider it a religious duty to mimic the warfare strategies and tactics pursued by the first Muslims.

Geographically we limit our survey to Western Europe. We do not include Eastern Europe or Russia, and we refer to jihadi activity in other Western countries only for context. The main reason for these limitations is capacity. Gathering data for this kind of study is work intensive and we have not been able to monitor other regions closely enough to produce data suitable for systematic comparison at this point.

Existing Literature

The literature on terrorists’ modus operandi is relatively small and scattered. Most studies of jihadi terrorism in Europe focus on radicalization and pay limited attention to operational aspects. The few studies that address the modus operandi of jihadis in Europe concentrate on certain dimensions, such as the scope and distribution of terrorist plots, the kind of explosives used, and the complexity of attacks, rather than broader trends in the use of weapons and choice of tactics.[9] Most standard works on terrorism address terrorists’ modus operandi, but rarely as a separate topic or in real depth. They provide examples of attack methods, targets and weapons preferred by different terrorist organizations, but usually as part of a broader discussion of the origins and rationale for those particular organizations.[10] Other studies concentrate on macro-trends such as the impact of globalization and technological progress, the transition from “old” to “new” forms of terrorism (which includes the emergence and spread of suicide terrorism), and, last but not least, terrorists’ interest in, and possible use of weapons of mass destruction (WMD).[11] While these studies are taken into account when we discuss possible determinants of European jihadis’ modus operandi, they have a different objective than that of this article, either operating at a higher level of generalization (historical macro-trends), or focusing narrowly on certain attack modes or weapons (e.g., suicide terrorism or WMD).

There are only a handful of studies that specifically focus on the modus operandi. Some of them provide a general overview of trends based on open source databases.[12] However, most available databases in the terrorism research field (including those maintained by RAND, MIPT, or the START Center’s Global Terrorism Database) do not systematically include failed or foiled terrorist plots. In studies of the modus operandi, this constitutes a problem, because we are not only interested in what types of attacks terrorists have pulled off, but also what they might want to do and try to do. Others have combined databases and case studies to examine “lone wolf” terrorism, terrorist innovation, weapons choice and target selection.[13] These studies produce relevant insights that will be taken into account in this study. For example, Adam Dolnik highlights how countermeasures influence terrorist innovation, and C.J.M. Drake theorizes how terrorists pragmatically narrow the scope of targets when they realize what is doable with the resources at hand.

Method and Data

Our trend analysis is based on a dataset containing 122 jihadi terrorist plots in Europe between 1994 and 2013.[14] The dataset starts in 1994 because this is when the first incident of jihadi terrorism in Europe took place. The complete dataset and definitions of the variables are published online at the website provided in the end note.[15] Due to space limitations, we do not provide details about individual plots in this discussion. Instead we refer to plot names (for example, “Crevice Fertilizer Plot”), which correspond to the entries in the dataset. Each entry in the dataset provides a reference to a newspaper article or other source containing an outline of the terrorist plot in question.

Due to the low number of plots each year (from zero to ten) it was meaningless to undertake a year-to-year analysis. Therefore, we divided the dataset into three time intervals of approximately equal length: 1994–2000, 2001–2007, and 2008–2013. This allowed us to identify and visualize changes in the quantitative output.

There are methodological challenges associated with data reliability. When attacks have been foiled, there is often incomplete information regarding key variables such as weapons choice, target selection and attack method. In an attempt to reduce the problem of missing information we distinguish “well-documented plots” (n=93) from “vague plots” (n=29). The distinction is based on how well each plot fulfills the following criteria of documentation: 1) known jihadi perpetrator(s), 2) identified target(s) and 3) concrete evidence (such as bomb materials and suicide notes). The quantitative output we present is based on the 93 well-documented plots, unless otherwise specified.

Vague plots have been used in the qualitative analysis to cross-check the absence of certain attack modes. For example, there is only one example of a plot to hijack and crash an airplane into a target after 2001.[16] The absence of such plots, even when including vague cases, strengthens the observation that this particular modus operandi was rarely considered by jihadis in Europe.

Even when we focus on well-documented plots, there is considerable variation in their scope and nature. We do not distinguish plots that were disrupted at an early stage from launched attacks. We do not distinguish small and amateurish attacks that led to no casualties as different from the Madrid bombings, which killed 191 people. This creates certain challenges when coding variables.

First, how do we code cases in which the attack planners have discussed several modus operandi, but not yet reached a final decision regarding the weapon, attack type or target? For example, in the “London Xmas Plot” of December 2010, the terrorists discussed a number of targets including the London Stock Exchange, the U.S. Embassy, unspecified Rabbis, and Boris Johnson, the Mayor of London. In such cases, we decided to code all options discussed because there is not enough information for us to decide which target was most likely. The same logic has been applied in cases where the terrorists discussed several weapons or attack types. Consequently, some weapon types, attack types and target types may be over-represented in the quantitative output. As highlighted by Drake, terrorists tend to discuss ambitious targets in the early stages of their planning, before ending up with something less ambitious, but more realistic.[17] Nevertheless, we consider it useful to register all scenarios assessed by the terrorists so as to be able to detect changes in their interest in different weapons, attack types and targets over time.

Secondly, how do we code cases in which the planned modus operandi changed after the attack was set in motion? Incidents where attackers barricade themselves to fight the police are typical examples. This occurred with plots such as the “Madrid Bombings” (2004), “Hofstad 1, Bouyeri” (2004) and “Mohammed Merah” (2012). We decided to code such incidents based on the original attack plan, for two reasons. First, we want to achieve as much consistency in the coding as possible between disrupted and launched attacks. Secondly, it is unclear whether violent acts against first responders qualify as terrorism in a strict sense. This point is well illustrated in the case of the “Bourgass Ricin Plot” (2003), when the terrorist suspect attacked and killed a police officer with a knife during his arrest. The original terrorist plan, which had prompted the arrest, was to carry out random killings in the U.K. using poison left in public places. It would be misleading to code the police murder as part of the terrorist plot.

There are borderline cases, such as that of Mohammed Merah, who ended his 2012 shooting spree in Southern France with a 32-hour barricade of his apartment. The incident bore the hallmarks of a planned barricade incident – a modus operandi associated with so-called “Mumbai-style” attacks.[18] The goal is to prolong the attack as much as possible, in order to increase media coverage and exhaust local emergency response resources. Merah was well armed and motivated to fight until death. In addition, he was in contact with the mass media an hour before the barricade started.[19] Nevertheless, it would be misleading to categorize the attack as a ‘barricade incident’. Merah was trapped in a corner after an eleven-day-long manhunt. It is likely that the barricade was an action of last resort, rather than indicative of a trend towards more barricade-style terrorist plots in Europe.

Having addressed some key methodological issues, we now turn to the results from our quantitative analysis of 93 well-documented jihadi terrorist plots in Europe.

           

Results

Weapon Type

Improvised explosive devices (IEDs) are the preferred weapon type among jihadis in Europe. 78% of all plots in 2001–2007 involved the use of IEDs, as did 65% of all plots in 2008–2013. Although the percentage has dropped in the last period, it is noteworthy that 65% of jihadi plots in Europe after 2008 involved IEDs in some form. But a majority of these plots were disrupted at an early stage. Only six IED attacks have been launched after 2008. None of them resulted in any casualties.[20]

Home-Made Explosives (HMEs) have become more common after 2008, while military and commercial explosives have become less common. Jihadi terrorists have widened their arsenal of HMEs over the years. Prior to 2001, jihadi bomb plots in Europe were dominated by the Armed Islamic Group’s (GIA) use of chlorate mixtures (a low-grade explosive) in closed containers such as gas canisters and pressure cookers. Peroxide-based mixtures (a high-grade explosive) came into use in 2001 and have occurred in plots regularly since then. Gas cylinders started appearing in plots in 2004, and were used in Germany in 2006 and in the U.K. in 2007. Fertilizer-based explosives started occurring in plots in 2004, and were used in Italy in 2009 and Sweden in 2010.

Two other weapons trends are worth mentioning. First, there has been an increase in plots involving knives and firearms. Knives and firearms were used in 7.3% of plots during 2001–2007, and in 33% of plots after 2008. Only one attack was launched using knives/firearms before 2008, compared to seven after 2008.

Secondly, there is a decrease in plots involving chemical, biological, radiological or nuclear (CBRN) materials. Use or attempted use of CBRN materials occurred in six plots in 2001–2007, but are absent from all plots after 2008, even when considering vague cases. Four of the six CBRN plots we registered in 2001–2007 involved poisonous chemicals or toxins. One plot involved a plan to create a “dirty bomb” from a radiological substance known as Americium-241. The last plot included a plan to bomb the Borssele nuclear power plant in Holland. While we use the abbreviation “CBRN” throughout this paper, it should be stressed that we have uncovered no plans to spread contagious diseases or to obtain crude nuclear weapons throughout the period studied.

On the one hand jihadis in Europe have diversified their arsenal of weapons over time. On the other hand, they have also stopped using certain types of weapons. Plots to use CBRN materials and rockets are virtually non-existent after 2008. Plots to hack computers to cause real-world damage are completely absent from the dataset, both before and after 2008. The general development is towards weapons that are technologically simpler. The exception is IEDs, where there is no clear trend. IEDs are becoming simpler in some cases and more advanced in other cases. We will come back to possible explanations for these developments.

Attack Type

Bombing is the dominant attack type, occurring in 65% of all plots after 2008. However, individual assassinations and armed assaults have become more common over the years. Plans to assassinate have increased from 4.9% of all plots in 2001–2007, to 25% of all plots after 2008.

The overwhelming majority of bomb plots are land-based. Out of 122 cases in the dataset there are only eight examples of air-based bomb plots and one example of a sea-based bomb plot. Seven out of the eight air-based bombings aim to explode planes in mid-air, while the last case is a plot to crash an airplane into Heathrow airport. The sea-based bomb plot is a vaguely documented plan to explode explosive-laden trucks onboard a passenger ferry.[21]

The scope of the bombing plots varies greatly, from involving bombs the size of hand grenades to plots to use large truck-size devices. Truck bombs have so far not been used successfully by jihadis in Europe, even though they have been employed by other terrorist groups and individuals in the region.[22] There have been several foiled plots to employ truck bombs by jihadis. The best documented is probably the “Fertilizer Plot” (Operation Crevice) in 2004, in which 600 kgs of Ammonium Nitrate and an unknown quantity of aluminum powder was seized. There are at least five other plots in the dataset in which perpetrators have considered using truck-size bombs, but only one of them appears to have moved from mere planning to actual weapons acquisition: Nizar Trabelsi’s plot to attack the Kleine Brogel Airbase in Belgium in 2001, where 100 kgs of “sulphur” and unknown quantities of other precursors were seized by police.

Another observation is that few hostage situations have been created by jihadis in Europe. During the period 1994–2013, there were a total of three hostage incidents. All of them occurred after 2008 and involved “Mumbai-style” plots where hostages were supposed to be held by teams of mobile gunmen inside buildings. It is somewhat surprising that this modus operandi has not become more widespread, especially with the media attention received by the Mumbai attacks in India, and the subsequent fear among European security services that such attacks would materialize in Europe. However, Mumbai-style attacks should not be discounted as a possible threat. Of the three plots mentioned, all were considered serious and potentially lethal cases. One of the cases, referred to as the “Europe Mumbai Plot” in the dataset, may have involved up to three separate attacks in different countries, according to intelligence leaks.[23]

Another dimension we looked at is the occurrence of single-actor vs. group plots. There is a significant increase in single-actor plots (from 12% to 38%) and a corresponding decrease in group plots in the period after 2008 (see Figure 1). However, groups of two or more terrorists remain the most common jihadi cell configuration, occurring in more than 60% of all plots after 2008.

A relatively high proportion of the single-actor plots are launched attacks. In the whole period, 14 out of 20 single-actor plots were launched. It is striking that single-actor terrorists go undetected in 70% of the registered cases while group plots go undetected in only 19% of the cases.

We caution that our break-down of single-actor vs. group plots may not accurately represent the typical size of a jihadi attack team. An attack may be planned and prepared by a network, or group, yet carried out by a single member. In some cases, there is concrete information that a group designated one of its members to carry out an attack. However, in many cases it is not entirely clear how many members of the group would participate in the attack.

Figure 1: Single-actor vs. group plots

Target Type

Next, we looked at the types of targets that jihadis in Europe prefer. Three trends are worth highlighting.

First, there is a slight increase in attacks on military targets after 2008. Before 2008 there were six plots to attack military targets, but none were launched. After 2008 there were seven plots of which five were launched. Four of the launched attacks targeted soldiers in public places, and a fifth was aimed at a military base in Italy.[24] The last two plots targeted military bases, but were disrupted at an early stage. According to Drake’s theory of terrorist target selection, it is possible that the cells would have settled for a less ambitious target.[25] In any case, there has been an increased tendency to target military personnel after 2008. This is especially apparent when we also consider interview data indicating that there has been a considerable spike in threats and hoaxes against military personnel over the last few years.[26] Attacks in other parts of the West, such as the Fort Hood incident in Texas, U.S. in 2009 and the recent attacks on soldiers in Canada in October 2014 point in the same direction.[27]

Attacking military personnel in public places is a new modus operandi among jihadis in Europe: starting with the Kosovar Arid Uka’s attack against a shuttle bus carrying U.S. soldiers at Frankfurt international airport in March 2011, and followed by Mohammed Merah’s killing spree in France in March 2012, and the soldier stabbings in the U.K. and France in 2013. There was only one similar plot before 2008. In January 2007, a U.K.-based cell planned to abduct and behead a British Muslim soldier who had served in Iraq, and to videotape the ordeal. It should be stressed that this particular cell drew inspiration from the beheading videos issued by Abu Mus'ab al-Zarqawi’s group in Iraq which were disseminated from 2004 onwards. There are concerns that the beheadings by the Islamic State in Syria and Iraq (IS) today could inspire out-of-theater terrorist attacks in a similar fashion.

A second targeting trend is that plots against aviation and public transportation have become less frequent. After 2008, there were only three plots targeting aviation and three plots targeting buses, trains or metro systems. However, there has been no similar decrease in the targeting of public places. Jihadis are still interested in targeting crowded areas, even if they do not seem to target public transportation and airplanes as often as before.

A third trend is that plots targeting public figures have increased. When we single out the victims of these plots we find that they are distributed as depicted in Table 1:

Target	No. of plots	Examples
Artists/publishers who insulted Islam	4	Kurt Westergaard, Lars Vilks, Martin Rynja
Politicians with anti-Islam views	2	Markus Beisicht, Lars Hedegaard
Politicians, general	2	Stephen Timms (British MP), Boris Johnson (Mayor of London)
Other/unspecified	3	Dalil Boubaker (Muslim cleric), “Public figures”

Table 1: Assassination targets mentioned in plots after 2008

The majority of the plots against public figures appear to have been motivated by revenge, especially against people who insulted the Prophet Mohammed or Islam in general. This attack mode was first employed among jihadis in Europe in November 2004, when Mohammed Bouyeri assassinated the Dutch filmmaker Theo van Gogh. It saw an upsurge after the first publication of the cartoons of the Prophet Mohammed by Jyllands-Posten in 2005 and amid re-publication of the cartoons by European media in following years.

Two other aspects of targeting we have looked at are target nationality and plot country. Target nationality is one of the most precise indicators of what enemy the terrorists want to harm, whereas plot country may not necessarily reflect the terrorists’ enemy perception fully. For example, although quite a few terrorist plots emerged in Germany, most were aimed at Jewish, U.S. or French targets rather than German ones. This could serve as one out of several indicators that Germany is considerably lower on the jihadis’ enemy ranking than the U.K., where almost every plot was aimed at British targets. However, at the same time the fact that plot after plot occurred in Germany tells us something about the presence of jihadis with the will and capacity to resort to terrorism in that country. In addition to being a country in which jihadis planned to launch attacks, Germany has also been a staging ground for attacks in other countries, most famously the Hamburg Cell’s preparation of the 9/11 attacks, but also other cases such as a cell in Frankfurt plotting to bomb the Christmas market in Strasbourg, France. As the variables tell us slightly different things we find it interesting to explore the relationship between target nationality and plot country.

Table 2 shows the top five regions in Europe to be exposed to jihadi terrorism. We decided to group some of the countries together in order to gain a more readable picture. Thus, we talk about Scandinavia as one region, even if most plots have occurred in Denmark. The U.K. and France have experienced the most plots over time, followed by Germany, Scandinavia and Italy. Plots in the U.K. have mainly targeted the U.K.; plots in France have been aimed at French, U.S., Jewish and Russian targets, whereas many plots in Italy and Germany have targeted U.S. or Jewish people and interests.

Plot country	No. of plots	Plot country was target	%
France	24	16	67 %
UK	23	19	83 %
Germany and Switzerland	12	3	25 %
Scandinavia	11	9	82 %
Italy	10	6	60 %

Table 2: Countries most exposed to jihadi terrorism 1994–2013

The most striking development in recent times is the threat in Scandinavia. This trend starts to show up in the statistics since 2005, and as many as 82% of the plots in Scandinavia were directed against Scandinavian targets. Nearly all of these plots were against people and institutions involved in the Prophet Mohammed cartoons affair. Still, there were a couple of incidents that were not immediately related to this incident, such as the 2010 Stockholm suicide bombings, or assassination plots against Swedish artist Lars Vilks and the Danish Islam-critic Lars Hedegaard.

We see an overall tendency towards fewer plots against U.S. targets compared to European targets. After 2008, most plots targeted the U.K. (30%) followed by Scandinavia (20%) and France (13%). Scandinavian targets appears to have surpassed French and Italian targets, which have historically been more prominent.

In addition to looking at target types and nationalities, we have examined how selective jihadi terrorists are when they choose their targets. Do they aim to target European society at large, or do they prefer to target specific sub-national groups and individuals? The results are shown in Figure 2. We see a clear tendency towards more discriminate plots.[28] In 2001–2007, 22% of all plots were targeting a specific sub-national group, profession or individual. After 2008, the proportion has increased to 55%. This is coupled with a similar decrease in random attacks.

Figure 2: Random vs. discriminate targeting

Having briefly reviewed several important patterns in the data, we now turn to possible reasons why jihadis in Europe have changed the ways in which they operate.

Main Changes and Possible Explanations

More Variety in IED Manufacturing Techniques

After 2008 there is increased variation in the bomb-making techniques employed by European jihadis. There is no clear trend regarding the technical sophistication of the devices. IEDs are becoming simpler in some cases, and more advanced in other cases. It appears that the most advanced IEDs are connected to training and assistance from abroad, while simpler devices are often based on recipes from the Internet.

The clearest example of IED innovation coming from abroad is probably the 7/7 and the 21/7 attacks in London in 2005. Both attacks relied on a bomb-making technique which had never been employed by jihadis in Europe before. It involved a main charge made out of hydrogen peroxide and an organic substance.[29] Initially, the 21/7 bombers were portrayed as mere “copycats” who had been radicalized at home. It was later revealed that the ringleader of the cell had received training in Pakistan at the same time as the 7/7 bombers, which would explain why both plots employed a device which was novel at that time.[30]

There have been at least three other cases in Europe during the period 2006–2009 which involved a similar peroxide and organic substance mixture.[31] All of these plots were linked to training in Pakistan, and all but one (the “Sauerland Cell”) have been linked to one of al-Qaida’s operational planners, Rashid Raouf.[32] The Sauerland Cell received support from an Uzbek group named the Islamic Jihad Union (IJU) based in North Waziristan. This group is believed to be part of al-Qaida’s network in the Afghanistan-Pakistan region, but direct links between the Sauerland Cell and al-Qaida’s central organization were never established.[33]

There are other examples of cases where technical assistance from al-Qaida is linked to IED use in Europe. For example, bombs made of TATP in combination with the military high explosive PETN (Pentaerythritol Tetranitrate) have only been used in three jihadi plots – the “Richard Reid Shoe Bomb” in 2001, the “Sajid Badat Shoe Bomb” in 2003, and the case of the “Underwear Bomber” in 2009. Reid and Badat were originally part of the same plot and they both received the bomb devices from al-Qaida handlers in Afghanistan or Pakistan in late 2001. The Underwear Bomber received the PETN and TATP device from al-Qaida in the Arab Peninsula (AQAP), based in Yemen.[34] Yet another example is the “Transatlantic Airliners Plot” in 2006. The novel idea of smuggling liquid explosives onboard planes was masterminded by al-Qaida’s operational planners in Pakistan.[35] This leads us to surmise that novel bomb-making techniques are usually introduced in Europe as a result of training and assistance from abroad.[36]

Another explanation for the increased variation in bomb-making techniques is that the Internet has made crude bomb recipes more accessible. This has so far produced a slight increase in crude and amateurish attacks, such as the “Nicky Reilly” plot in the U.K. in 2008, and the “London Xmas Plot” in 2010 which relied on making pipe bombs out of match heads. However, Internet resources can hardly explain why certain bomb-making techniques have been introduced in Europe at certain times. Peroxide and organic substance bombs were first used by jihadis in Europe in 2005, but instructions on how to manufacture such a device did not appear online until 2010.[37]

As jihadis continue to access conflict zones such as Syria, Iraq and Somalia, it is likely that the repertoire of bomb-making techniques will widen further. It is also likely that increasingly sophisticated and interactive Internet platforms will improve possibilities for online learning.[38] However, in the short to medium-term, the greatest and most dangerous innovations in bomb-making techniques in Europe will probably come as a result of training abroad, rather than online self-study.

Increase in the Use of Knives and Firearms

There has been a relative increase in plots involving knives and firearms in recent years. The first such attack was the assassination of an Imam by the GIA in France in 1995. The next example is the slaying of the Dutch filmmaker Theo van Gogh in Amsterdam in 2004. The assailant shot van Gogh numerous times with a semi-automatic pistol, and subsequently tried to decapitate him. After van Gogh’s murder, there were no knife or firearm attacks until 2010, when a Danish-Somali jihadi attempted to kill the cartoonist Kurt Westergaard with an axe (coded as knife in the dataset). In 2008–2013 there was a marked increase in plots to use knives and firearms among jihadis. 33% of the plots in this period involved a knife, firearms or both – sometimes in combination with explosives.

We first believed the increase in knives and firearms to be a direct consequence of the increase in individual assassination plots, because knives and firearms are more typical assassination weapons than bombs. However, when looking at the plots there is only a partial correlation. Only four out of the 13 knife and firearm plots in 2008–2013 could be defined as assassinations. While all knife plots involved attacking and killing a single person (either well-known individuals such as Kurt Westergaard, or representatives of religious or occupational groups, such as soldiers or Jews), the firearm plots covered the whole spectrum from assassinations to shooting sprees and complex, “Mumbai-style” attacks.

An alternative explanation is that the terrorists resort to knives and handguns simply because it has become more difficult to acquire precursors for explosives without alerting security services. There is some anecdotal evidence to support this. Consider the following statement by Mohammed Merah during a conversation with police negotiators while barricaded inside his apartment in Montauban, 2012. Regarding his weapons training in Waziristan he said:

“I was asked to make bombs. I did not want to, you see … I told them that the ingredients, the ingredients needed to make bombs are, they are under surveillance in France. I might get arrested even before having [inaudible] something. Are you listening? After this, I told them, train me [in the use of] guns.”[39]

It is possible that there are other cases where jihadis have decided on knives or handguns as the weapons of choice, based on similar reasoning. However, if this was the only reason we would expect a marked decrease in the use of explosives after 2008, making up for the increase in the use of knives and handguns. This is not the case. The number of plots involving knives and handguns increased by 26% after 2008, while the number of bomb plots decreased by only 13% in the same period.

A more general explanation is the effect of contagion. Terrorism research has shown how terrorists tend to emulate each other, a phenomenon accelerating in the age of social media.[40] It is highly likely that inspiration from successful attacks outside Europe has contributed to the increase in plots involving knives and handguns in Europe. The Mumbai attacks in India in 2008 are thought to have inspired at least three plots in Europe in recent years. Another high profile incident which may have served as inspiration is the Fort Hood shooting massacre in the U.S. in 2009. This was the first time that a jihadi carried out a successful mass killing with firearms in a western country.

Adding to the contagion effect, al-Qaida’s strategic leadership has celebrated such attacks in their propaganda. In the al-Sahab video “You are only responsible for yourself,” issued in June 2011, Adam Gadahn specifically encouraged Muslims in the West to use handguns to carry out attacks:  

“America is absolutely awash with easily obtainable firearms. You can go down to a gun show at the local convention center and come away with a fully automatic assault rifle, without a background check and most likely, without having to show an identification card. So what are you waiting for?”[41]

The ideas expressed in the al-Sahab video are far from new in al-Qaida circles. They are largely based on Abu Mus’ab al-Suri’s strategic writings, which were conveyed to al-Qaida recruits in Afghanistan in lectures and pamphlets throughout the 1990s.[42] Al-Suri and the al-Sahab video both point to several historical examples of jihadis who carried out individual attacks with simple weapons, starting with the gun attack on the Jewish politician, Meir Kahane, in New York in 1990 by an Egyptian Islamist.[43] Likewise, in 2004, Mohammed Bouyeri received massive media attention for shooting and killing Dutch filmmaker Theo van Gogh in Amsterdam. This illustrates the historical precedents for this attack mode long before the upsurge in 2008–2013, which lends credence to the contagion effect explanation.

In addition, we contend that the rise in knife and firearm plots is part of a more general trend towards diversification of attack types and choice of weapons among jihadis in Europe, a trend we partly ascribe to jihadis’ adaptation to counter-terrorism measures, and partly to a more heterogeneous actor landscape.

Increase in Single-Actor Plots

While group-based terrorist plots are still most common, there has been a steep increase in single-actor terrorism among jihadis in Europe since 2008. The increase is somewhat connected to the rise in assassinations, but not fully. There are several examples of group plots to assassinate, such as “Davud” (2010) and “Public Figures France” (2013). Likewise, there are examples of single–actor plots to launch mass casualty bomb attacks in public, such as “Nicky Reilly” (2008) and “Andrew Ibrahim” (2008). The scope of individual plots by jihadis in recent times is surprising, as terrorists generally tend to operate in groups, and attacks by single actors have historically been quite rare.[44]

Single-actor terrorism is usually traced to 19th century anarchists and their strategy of leaderless resistance, but right-wing extremists have been behind most single-actor incidents since the 1980s. Jihadi strategic thinkers began to promote leaderless resistance during the early 1990s, but it was only in the mid-2000s that al-Qaida leaders began to call upon followers to stage attacks on their own.[45] Today, the call for individual terrorism is a main feature of jihadi propaganda aimed at followers in the West. The rise in single-actor plots in Europe is linked to this propaganda, but we need to consider the underlying causes.

The literature on single-actor terrorism distinguishes between “solo-terrorists” and “lone wolves.”[46] The former operate alone, but are linked to and may receive support from an organized terrorist group. The latter act completely on their own and only draw inspiration from political movements.[47] A good example of solo-terrorism is Richard Reid who was trained and deployed by al-Qaida to bomb a transatlantic jet, whereas the Norwegian right-wing mass killer Anders Behring Breivik was a lone wolf without any organization behind him. Among solo-terrorists it is possible to distinguish between those who are tasked “from above” by a group and those who initiate something “from below”, reaching out to organized groups for guidance and assistance. While the distinction between solo-terrorists and lone wolves can be blurred, it must be kept in mind when searching for explanations of why more jihadis work alone in Europe.

Research has yet to identify a common profile among individually operating terrorists. However, characteristics such as social problems, loneliness, and mental illness are more common among lone wolves than among other terrorists. The latter do not systematically differ, socially or psychologically, from non-terrorists.[48] Also, whereas solo-terrorism is supposed to fulfill some strategic aim for organized groups (for example upholding a certain level of a terrorist threat when a group is under pressure from counter-terrorism), lone wolves tend to be driven by more elusive motives, mixing political grievances with personal ones.

Most single-actor terrorists in our data may be defined as “bottom-up” solo-terrorists, but some (such as Richard Reid) received orders and directions from al-Qaida or affiliated groups. At least three of them (Roshonara Choudry, Andrew Ibrahim and Arid Uka) resembled lone wolves. The majority of single actor terrorists in our data interacted with organized extremist environments in Europe, and many spent time with jihadi groups abroad. All of them drew inspiration from al-Qaida and acted in accordance with the group’s ideology although they rarely received direct operational support. Most of the terrorists seem to be relatively normal, but troubled young men. Several were known to have experienced psychological problems, but only one of them, Nicky Reilly (2008), had been diagnosed with a mental illness (Asperger syndrome), as far as we know.

Because extremist connections and ties to militant groups abroad have been commonplace among the perpetrators, we attribute the increase in single-actor plots in Europe mainly to strategic-tactical considerations by jihadis facing a difficult operating environment, and to ideological incentives.

Strategic texts by Abu Mus’ab al-Suri prescribing the use of independent cells and individual attackers in situations where jihadis are unable to establish territorial control have likely contributed to the rise in solo-terrorism. His ideas have been redistributed in AQAP’s Inspire magazine, which has been downloaded and read by multiple terrorists operating in Europe since the late 2000s. Moreover, multiple leaders and spokespersons within al-Qaida’s networks have called for individual attacks, including Osama bin Laden, Abu Yahya al-Libi and Anwar al-Awlaki. The latter has also guided two single actors in Europe aiming to down transatlantic airliners (“Underwear Bomber” and “Rajib Karim Heathrow Plot”), and was cited as a main inspiration by the Pakistani female student Roshonara Choudry who stabbed British MP Stephen Timms in 2010.

We further contend ideological-religious justifications for individual attacks have contributed to the rise in single-actor plots. Bin Laden’s reference to a religious text by Taqi al-Din Ibn Taymiyyah on how one of the Prophet’s men infiltrated a Jewish clan and assassinated a poet who once insulted the Prophet seems significant. Bin Laden’s reference to the text appeared in a speech that was published in 2006, but it was also cited a source of inspiration for Mohammed Bouyeri who murdered Theo Van Gogh in 2004. By using this reference, al-Qaida leaders ground a particular modus operandi in a verdict by an Islamic authority who is highly regarded among jihadis and non-jihadis alike. The effect of this should not be underestimated, especially when assessing triggers for solo-terrorists and lone wolves.[49]

In addition to strategy and ideology, the contagion effect of terrorism should be considered a factor.[50] The booming jihadi presence in social media may have contributed to the rise in single-actor plots. From around 2008, jihadis increasingly started to employ YouTube, Facebook and Twitter as propaganda platforms. In this way they managed to instantly reach out to new and far broader audiences than was the case with more exclusive and oftentimes password protected forums.

Operationally, single actors have certain advantages in that they are much harder to detect than groups. On the other hand, it is more challenging, both from a psychological and a logistical perspective, to operate alone. This may be a main reason why group plots are still more common than single-actor plots.

Decrease in the Targeting of Public Transportation

There has been a decrease in the targeting of both land-based and air-based public transportation after 2008. Initially, we thought that this was related to the increase in discriminate attacks, since attacks on public transportation must be considered random by definition. However, this line of reasoning is not supported fully by other patterns in the data. Notably, the occurrence of plots targeting public areas is constant - both before and after 2008. The majority of the plots were aimed at targets such as shopping centers, nightclubs, restaurants, crowded streets and even schools, and were bound to cause random mass deaths. Only a handful of plots against public areas were discriminate in nature (for example, “Tawhid Jewish Restaurant” in 2002 and “EDL plot” in 2012).

With regard to air-based targets, the terrorists may have been deterred by countermeasures, such as increased security at airports, and onboard the planes themselves. However, for land-based transportation this could hardly be the case. Buses and trains are not associated with the same strict security measures as airplanes. So why have there been so few plots to target land-based transportation after 2008, while plots to launch bombings in public remain quite common?

Failing to see any other reasonable explanations we suggest that contagion may have played a part. Plans to attack transportation may have been overrepresented in 2001–2007, due to inspiration from 9/11 and the bombings in Madrid and London.[51]

Decrease in the Targeting of U.S. Interests in Europe

In 2001–2003, there was a clear tendency among jihadis to target American interests across Europe.[52] This was in accordance with al-Qaida’s notion of a global jihad against the “far enemy” (U.S.A.), rather than European countries. The pattern started changing in 2003–2005, when jihadi terrorists increasingly targeted European interests. This was mainly a result of the involvement of European countries in the Iraq intervention.[53].

Over time, other motivations to attack European countries became apparent as well, such as the publication of the cartoons of the Prophet Mohammed in Denmark in 2005, and their re-publication in several European newspapers in subsequent years. 15% of all plots after 2008 were directly targeting Jyllands-Posten or the cartoonists, while only 10% of the plots in the same period targeted the U.S..

The increase in the targeting of European interests illustrates how al-Qaida’s global jihad came to involve America’s allies to a greater extent in the mid-2000s. This development was mainly a reaction to Europe’s contribution to the “War on Terror”, but it was accentuated by justifications in jihadi ideology. Before the Iraq war, many jihadis in Europe claimed to stay in the region under a “Covenant of Security,” a religiously defined security pact between Muslims living in non-Muslim countries and their “host states.” According to this pact, Muslims are forbidden to put a non-Muslim host state and its citizens in harm’s way, as long as they are free to practice their religion. [54]

However, in the mid-2000s jihadi ideologues annulled the pact on the grounds that European countries participated in the wars in Afghanistan and Iraq, insulted the Prophet Mohammed (Danish cartoons), and persecuted Muslims (arrests of radical Islamists). It is symptomatic that many jihadis in Europe have since stressed wars, persecution and insults when threatening Western countries, and that captured terrorists have justified their actions similarly. The Stockholm suicide bomber’s reference to the Swedish contribution in Afghanistan and anti-Islam artwork by Lars Vilks is one out of numerous examples.

More Discriminate Targeting

Our most intriguing finding is a relative increase in discriminate attacks among jihadis in Europe since 2008. The majority of such plots are directed towards institutions, artists and politicians perceived to be anti-Islam. Another category of plots focus on military targets, in particular military personnel in public areas. A third category involves plots against Jewish interests.

In the first category we find plots related to the cartoons of the Prophet Mohammed, targeting either Jyllands-Posten in general, or individual cartoonists. A related type of attack is assassination plans against artists or other media figures perceived as being anti-Islam. Here we find personalities such as Swedish artist Lars Vilks and Danish author and Islam-critic Lars Hedegaard.

Assassination plots in Europe generally target individuals with little or no strategic value. The most high-ranking politician to be targeted by jihadis in Europe is Boris Johnson, the Mayor of London. If we consider vague plots we also find Prince Harry, the third heir to the British throne, but more likely targeted for symbolic reasons as he served in the British Army in Afghanistan. Overall, the assassination plots seem to be motivated by ideologically justified revenge, rather than strategic considerations.

Al-Qaida leaders and spokespersons have, on multiple occasions, encouraged attacks against specific types of targets. Anwar al-Awlaki has talked about the permissibility of attacking Western soldiers in their home countries, and a number of leaders (including Osama bin Laden himself) talked about the permissibility and duty of attacking individuals who have insulted the Prophet Mohammed.[55] As for the targeting of Jews and Jewish interests, the struggle against Israel and its policies in Palestine has always been a core issue for al-Qaida and like-minded movements and among mainstream Muslims alike.

A trend towards discriminate attacks is somehow counter-intuitive. Randomness is a hallmark of terrorism which seeks to instill fear in larger populations. Discriminate attacks do not instill fear in larger populations the same way, but are easier to justify - politically and religiously - than random ones. Discriminate attacks speak to a larger segment of Muslims than the narrow and ultra-extreme folks that have traditionally been drawn to al-Qaida’s networks. Facing pressure in multiple conflict zones (as a result of U.S. drone attacks in Northwestern Pakistan and jihadi infighting in Syria and Iraq), leaders and thinkers of al-Qaida and its affiliates may want to reinvent themselves to resonate with new generations of recruits. In order to attract sympathy and support from a far-flung recruitment base which can be addressed via social media, an increased focus on undisputed targets and attacks that may attract at least some sympathy makes sense.

We do not see the tendency towards more discriminate attacks as a major change though. Al-Qaida has continued to plan mass-casualty attacks in Europe, in addition to calling for discriminate attacks. An article in a 2012 issue of Inspire magazine illustrates the dual recruitment strategy of al-Qaida and likeminded groups. An assassin should not just target “military personnel and political leaders,” but

“… anyone that the shari`ah allows him to eliminate. Thus, he is not afraid to study the movements of personalities that openly insult the religion, apostates that play a helping role for the enemy aggressors, and non-combatants in either selective hits – such as to obtain ghanimah [war booty] for further operations – or mass hits – to destroy an infrastructure of political and/or economic representation.”[56]

In this quote, AQAP speaks to several audiences, both the most extreme (who justify random mass killings, and attacks for the sake of financing future operations), and those closer to the “mainstream” (who justify the use of violence against certain enemies of Islam, for which there are clearer justifications to be found in Islamic Law).

Overall, we see the trend towards more discriminate attacks as yet another sign that the threat to the region is becoming more heterogeneous. This is important to keep in mind as we turn now to offer some informed projections regarding future trends.

Future Trends

What will jihadi terrorism in Europe look like in three to five years from now? The question is challenging because the jihadi actor landscape in Europe is becoming increasingly diverse. Up until now, jihadi terrorism in Europe has been dominated by al-Qaida and like-minded movements. While only a few terrorist attacks have been planned and directed by al-Qaida’s central organization, a majority of the plots have nevertheless corresponded to a large extent with al-Qaida’s guidelines. The rise of new and powerful actors in Iraq and Syria such as the Islamic State (IS) may change this pattern.

The IS does not take orders from al-Qaida, but presents itself as a rival organization. The Syrian conflict has so far attracted around 3,000 European foreign fighters, a number which is unprecedented in the history of jihadism. Many Europeans fight for IS and several of them have obtained high positions in the group. It is therefore likely that the rise of IS will affect jihadi terrorism in Europe, but the question remains how.

There are at least two possible scenarios. IS could launch a top-down organized terrorist campaign in Europe as a reaction to Western military involvement in Iraq and Syria. This is the most dangerous scenario. Alternatively, European veterans of the conflict in Syria will continue to plot scattered attacks on their own initiative following radicalization in the war theatre. This is the most likely scenario. In both cases, the modus operandi may, or may not, differ from the al-Qaida-inspired terrorism seen in the region so far.

Only a handful of plots in Europe have been traced back to Syria and Iraq since the beginning of the uprising in 2011. In March 2014, a Syria veteran was arrested in France with TATP explosives. In May, another Syria veteran shot and killed four people at the Jewish Museum in Brussels, Belgium. In July, Norway was put on a high terror alert due to information that a group of four individuals were on their way from Syria to Norway to carry out a terrorist attack. In October 2014, several men were arrested in the U.K., suspected of being in the early stages of preparing a terrorist attack in London.[57]

Plots are too few and vague to say much about the “IS-effect” on jihadi terrorism in Europe at this point. However, we note that none of them represent a new modus operandi. The best documented incident, the Jewish Museum shooting, is consistent with a trend toward discriminate targeting and hand-held weapons.

IS differs from al-Qaida in at least two ways, which could affect its modus operandi. First, the group has an extreme sectarian agenda, and secondly, it glorifies and celebrates brutal acts of violence, including beheadings on camera. These were also characteristics of its forerunner al-Qaida in Iraq (AQI), especially under Abu Mus’ab al-Zarqawi in 2004–2006. Al-Zarqawi’s beheading campaign probably inspired at least one beheading incident in Europe, the Theo van Gogh murder in Amsterdam in 2004. As far as we know, AQI’s campaign did not translate into any sectarian attacks in Europe. The difference between then and now is that IS attracts a much larger contingent of Europeans than AQI ever did. Moreover, IS’s clever use of new social media platforms ensures that violent acts are broadcast to a larger and more diverse audience than before.

In the short to medium-term, the most likely blowback effect from Syria and Iraq is scattered attacks by returning foreign fighters. We expect their modus operandi to roughly follow the trends outlined in this study. In addition we may see contagion of attack methods broadcast widely in media, such as public beheadings and other revenge-driven executions.

The blowback effect is taken into account when we suggest some concrete scenarios for future attacks below. We extrapolate the most likely scenarios from trends we have identified throughout the study.

Most Likely Modus Operandi

We believe bomb attacks and armed assaults to remain the most likely modus operandi for jihadi terrorists in Europe in the coming 3–5 years. Both suicide attacks, and attacks with remote-controlled or timed devices must be expected. As for plots involving knives and firearms, they are still less frequent than bomb plots. However, due to the relative increase in such plots in recent times we surmise that this modus operandi may soon match the frequency of bomb plots.

It could be argued that the trend towards more discriminate targeting would lead to a decreasing use of bombs, which imply random deaths. However, this is not necessarily so. More discriminate targeting may also imply a move towards “harder” targets which would actually increase the need to use bombs (the heavily protected offices of Jyllands-Posten being one such example). And there are still a considerable proportion of plots (28%) targeting randomly. Bombs in crowded places should therefore still be a concern for Western security services.

Most Likely Mass-Casualty Scenario

We suggest that the most likely mass-casualty (>10 deaths) scenario in the in the coming 3–5 years is a bomb attack against a crowded area. We regard this as more likely than “Mumbai-style” attacks, because it requires less coordination and may be carried out by individuals as well as groups.

The second most likely mass-casualty scenario is Mumbai-style attacks. Such attacks will probably involve teams of mobile gunmen who either take hostages and barricade themselves, or simply shoot and kill as many people as they can. They may combine shooting attacks with cruder forms of violence, such as arson or knife attacks, in order to disperse emergency response resources (the original Mumbai attackers used remote-controlled IEDs for this purpose).

 Attacks using advanced weapons such as rockets or chemical, biological, radiological or nuclear (CBRN) materials are within the realm of possibility for jihadis in Europe. However, we consider them the least likely of the mass-casualty scenarios. CBRN terrorism in crude forms cannot be ruled out, but jihadis in Europe have probably never possessed a capability to cause mass destruction with CBRN, and are unlikely to do so for the next five years.

The Syrian civil war and rise of jihadi groups such as IS can, in theory, represent a CBRN threat. However, there is so far scant evidence that IS have obtained chemical agents from Syria, or that the organization has planned to employ such agents in international terrorism. Due to the logistical difficulties and high risk of detection associated with moving a chemical weapon or an advanced rocket system to Europe, jihadis will probably consider conventional terrorist weapons and attack methods sufficient.

Most Likely Tactical Innovations

There are anecdotal examples in the dataset of innovative terrorist plans. In some cases information about such plans may reflect the concerns of Western counterterrorism agencies, rather than what jihadis actually aim to do. Nevertheless, discussions among terrorists about novel attack methods may be indicative of scenarios we might expect in the future. Even if information on innovative plans does not represent actual attack plans, the very fact that they were discussed in the media could give ideas to future terrorists.

Attacks using miniature model cars and airplanes have been discussed on jihadi forums since at least 2006.[58] The first example of a jihadi plot to use model airplanes occurred in the U.S. in 2011. A U.S. citizen of Bangladeshi origin was arrested and later convicted of plotting attacks on the Pentagon and the Capitol with model airplanes filled with explosives.[59]

The most serious case in Europe was probably the “New Chechen Cell” case in Spain in 2012. Three individuals of Russian and Turkish origin were arrested and charged with planning a terrorist attack. They had a video in their possession, showing them practicing with a model airplane, and 100 grams of an unknown explosive.[60] A second, but more vague, plot occurred in Germany in June 2013. German police arrested two Tunisian suspects and confiscated model airplanes “powerful and big enough to carry explosives,” according to the media.[61] Finally, the perpetrators in the “Pak-Bengali Plot Luton” in 2012 discussed attacking a Territorial Army (TA) base by driving a model car carrying explosives under the gate.[62]

Another scenario contemplated by jihadis is the use of vehicles as weapons. The method was first described in an infamousInspire magazine article from 2010 entitled “The ultimate mowing machine.”[63] It suggested welding steel blades on a pickup truck and then ramming it into a crowd of people, and following up with a handgun attack if possible. Reportedly, the perpetrators of the “Pak-Bengali Plot Luton” in 2012 discussed ramming cars into crowds of people, while making references to the idea presented in Inspire magazine.

There is one example in our material of a vehicle used as a weapon. The Woolwich assailants in 2013 first hit Drummer Lee Rigby with a car, before slaying him with a meat cleaver.[64] This attack method is generally not suitable for killing more than one or very few victims. The Inspire magazine article attempted to present a creative way of conducting “mass killing” by adding steel blades to the car, but it is surely hard to imagine such a vehicle driving in traffic without raising suspicion.

Based on our survey, we endorse Dolnik’s observation that “multiplication and synchronization of traditional tactics” is a more likely scenario than a move towards new tactics and weaponry.[65] We see arson in combination with other weapons as a possible future scenario which has potential to cause mass casualties. Our data encompasses only one well-documented case in which arson has been used as a weapon. Two individuals attacked the home of publisher Martin Rynja in London in 2008, attempting to set the house on fire.[66] Arson attacks have been promoted in several online texts offering strategic and operational advice to the jihadi movement. Abu Mus’ab al-Suri suggested using forest fires as a way to terrorize the enemy and causing economic damage, while Inspire magazine ran an article that suggested setting fire to cars in parking lots.[67] Neither al-Suri nor Inspire magazine have suggested using fire as a way of killing masses of people though.

However, fire in combination with other weapons represents an innovative and potentially dangerous scenario in Europe. Arson was used as a tactic in the Mumbai attacks in India in 2008. The purpose was apparently to kill hotel guests hiding in the upper floors of the Taj Hotel, after the attackers had barricaded themselves on the lower floors.[68] Needless to say, the fire created spectacular television images and the burning Taj became a signature image of the Mumbai attacks.

The last innovation we would like to draw attention to is the praxis of video filming crude attacks with action cameras so as to post them online. Both Mohammed Merah’s 2012 attacks in France and the 2014 Jewish Museum shooting by Mehdi Nemmouche exemplify this modus. The grizzly movies of beheadings by IS in Syria might inspire followers to carry out similar atrocities in front of the camera in Europe.[69] If scattered, crude attacks are filmed they could imply massive psychological impact even if the number of casualties is small.

Conclusion

Our main finding is that jihadi terrorism in Europe is becoming more discriminate in its targeting while attack methods are becoming more diverse. Overall, we surmise this reflects broader changes within the jihadi movement. Some of these changes have been initiated from above and some are pushed from below.

Jihadi terrorist plots in Europe involve cells controlled by al-Qaida, cells controlled by other jihadi groups, as well as independent cells, or individuals. Overall, it seems that even self-radicalized individuals who plot attacks on their own are sensitive to broad ideological and strategic guidelines emanating from al-Qaida’s central leadership.

We contend that the trend towards more discriminate attacks is partly a result of changed tactical guidelines from al-Qaida and its branches. Messages encouraging revenge attacks on individuals who insulted the Prophet Mohammed started appearing in 2006, after the crisis sparked by the cartoons of the Prophet Mohammed in Denmark. The new strategy was most clearly expressed in the 2011 al-Sahab video described earlier, which encouraged Muslims in the West to carry out individual acts of terrorism, rather than going to a conflict area and fighting, and eulogized the Fort Hood shooter as a role model. The video reflects deeper changes in al-Qaida’s approach to jihad in the West. By 2011, the U.S. drone campaign in northwestern Pakistan had killed a number of al-Qaida members including several leaders of al-Qaida’s External Operations branch. This reduced al-Qaida’s ability to stage top-down terrorist attacks in the West, and pressed the organization to rely more on individual sympathizers to carry out attacks on its behalf.

Individuals are more easily mobilized by emotional causes (such as insults against the Prophet Mohammed), than the lofty political strategies of global jihad. The shift towards more discriminate attacks therefore resonates with individual sympathizers while at the same time serving a strategic purpose. The crisis sparked by the cartoons of the Prophet Mohammed came at a convenient time for al-Qaida because it was exactly the kind of mobilizing cause that could speak to a larger segment of Muslims than the ultra-extreme group traditionally attracted to al-Qaida.

As for the diversification of attack types and weapons, we contend that it reflects a tactical adaptation to more effective counter-terrorism efforts by European security services. However, we also argue that this diversification has to do with new jihadi actors plotting attacks in the region. This diversification is likely to increase in the years ahead. While in the time period surveyed (1994–2013), terrorists linked to—or inspired by—al-Qaida have been most important in shaping the threat to Europe, new groups and individual terrorists are becoming a more important part of the threat picture.

The ongoing conflict in Iraq and Syria is going to affect the jihadi threat to Europe in coming years. Returning foreign fighters from Syria have already staged plots in Europe and more will come. We expect that a majority of plots will follow the trend toward more discriminate targeting and more diverse attack methods. However, we will also see plots targeting European society at large, especially when European nations contribute more to the U.S.-led coalition in Syria or Iraq.

About the Authors: Petter Nesser (Dr. phil., University of Oslo) petter.nesser@ffi.no and Anne Stenersen (Dr. phil., University of Oslo) anne.stenersen@ffi.no are researchers at FFI’s Terrorism Research Group. The authors have contributed equally to the article.

Notes

[1] Most studies of jihadis in Europe have focused mainly on patterns in radicalization and recruitment, see for example Alison Pargeter,  (Philadelphia: University of Pennsylvania Press, 2008), Magnus Ranstorp, Understanding Violent Radicalisation: Terrorist and Jihadist Movements in Europe (Routledge, 2010), or “Eurojihad Patterns of Islamist Radicalization and Terrorism in Europe | International Relations and International Organisations,” (Cambridge University Press, accessed November 21, 2014).

[2] Peter Bergen and Katherine Tiedemann, “The year of the drone: An analysis of U.S. drone strikes in Pakistan, 2004-2010,” New America Foundation, 24 February 2010.

[3] See, for example, “Youtube.com og Facebook.com - de nye radikaliseringsværktøjer,” (København: CTA, 2010) and “The transformation of jihadism in the Netherlands: Swarm dynamics and new strength,” General Intelligence and Security Service (AIVD), September 2014.

[4] Peter R. Neumann and M. L. R. Smith, “Strategic terrorism: The framework and its fallacies,” Journal of Strategic Studies28, No. 4: 571-595.

[5] For good reviews of the definitional debates consult also David J. Whittaker, The Terrorism Reader (London: Routledge, 2003), pp 14 ff, and Brynjar Lia,Globalisation and the Future of Terrorism: Patterns and Predictions(London and New York: Routledge, 2005), pp. 9 ff., and Bruce Hoffman, Inside Terrorism (New York: Columbia University Press, 2006), Chapter 1.

[6] For a well-informed account of the rise of the Arab-Afghan movement and al-Qaida, consult Camille Tawil, Brothers In Arms: The Story of Al-Qa’ida and the Arab Jihadists, trans. Robin Bray (London: Saqi Books, 2011).

[7] For a well-informed account of the rise of al-Qaida and global jihadism, consult Jarret M. Brachman, Global Jihadism: Theory and Practice, 1 edition (Routledge, 2008). For an introduction to Salafism and its influence on jihadis, consult Roel Meijer, (Ed)., Global Salafism: Islam’s New Religious Movement (New York: Oxford University Press, 2014).

[8] See for example Brynjar Lia and Thomas Hegghammer, “Jihadi Strategic Studies: The Alleged Al Qaida Policy Study Preceding the Madrid Bombings,” Studies in Conflict & Terrorism 27, No. 5 (September 1, 2004): 355–75 and Brynjar Lia, Architect of Global Jihad: The Life of Al-Qaeda Strategist Abu Mus’ab Al-Suri (New York: Columbia University Press, 2008).

[9] Javier Jordan, “Analysis of Jihadi Terrorism Incidents in Western Europe, 2001–2010,” Studies in Conflict & Terrorism 35, no. 5 (2012): 382–404; Petter Nesser, “Toward an Increasingly Heterogeneous Threat: A Chronology of Jihadist Terrorism in Europe 2008–2013,” Studies in Conflict & Terrorism 37, no. 5 (2014): 440–56; Jeffrey M. Bale, “Jihadist Cells and ‘IED’ Capabilities in Europe: Assessing the Present and Future Threat to the West,” Strategic Studies Institute, May 2009; Teun van Dongen, “The Lengths Terrorists Go to: Perpetrator Characteristics and the Complexity of Jihadist Terrorist Attacks in Europe, 2004–2011,” Behavioral Sciences of Terrorism and Political Aggression 6, No. 1 (2014): 58–80.

[10] See, for example, Bruce Hoffman, Inside Terrorism (New York: Columbia University Press, 2006), Alex P. Schmid et al., Political Terrorism: a New Guide to Actors and Authors, Data Bases, and Literature (New Brunswick, N.J.: Transaction Publishers, 1988), Martha Crenshaw, Terrorism in Context (Penn State Press, 2010).

[11] See, for example, Brynjar Lia, Globalisation and the Future of Terrorism: Patterns and Predictions (Routledge, 2007); Peter R Neumann, Old and New Terrorism: Late Modernity, Globalization and the Transformation of Political Violence (Cambridge, UK; Malden, MA: Polity, 2009); Robert Pape, Dying to Win: The Strategic Logic of Suicide Terrorism (Random House LLC, 2005); James J.F. Forest and Russell D. Howard, Weapons of Mass Destruction and Terrorism 2nd ed. (McGraw-Hill, 2013); Charles D. Ferguson and William C. Potter, The Four Faces of Nuclear Terrorism(Routledge, 2005); Gary Ackerman and Jeremy Tamsett (Eds.), Jihadists and Weapons of Mass Destruction (CRC Press, 2009). For a critical view of jihadi use of WMD, see Anne Stenersen, Al-Qaida’s Quest for Weapons of Mass Destruction: The History Behind the Hype(VDM Verlag, 2008).

[12] See, for example, Dan Sommer, Terrorist Modus Operandi (Lulu.com, 2010) and Brian A. Jackson and David R. Frelinger, “Rifling Through the Terrorists’ Arsenal: Exploring Groups’ Weapon Choices and Technology Strategies,” Studies in Conflict & Terrorism 31, No. 7 (2008): 583–604.

[13] Ramon Spaaij, Understanding Lone Wolf Terrorism: Global Patterns, Motivations and Prevention, 2012 edition (Springer, 2011); Adam Dolnik, Understanding Terrorist Innovation: Technology, Tactics and Global Trends (Routledge, 2009); C. J. M. Drake, Terrorists’ Target Selection (New York: St. Martin’s Press, 1998).

[14] The dataset is based on chronologies of jihadi terrorism in Europe by Petter Nesser. The original chronologies have been updated and expanded to include details about modus operandi. Petter Nesser, "Chronology of Jihadism in Western Europe 1994-2007: Planned, Prepared, and Executed Terrorist Attacks," Studies in Conflict & Terrorism, 31, 10, (2008): 924-946; Petter Nesser, “Toward an Increasingly Heterogeneous Threat: A Chronology of Jihadist Terrorism in Europe 2008–2013,” Studies in Conflict & Terrorism 37, No. 5 (2014): 440–56.

[15] Appendix A and B can be accessed via https://www.dropbox.com/s/vxy38sbnkr9fx81/AppendixAandB.xlsx?dl=0 .

[16] “Heathrow Airplane Crash,” November 2002.

[17] Consult C. J. M. Drake, Terrorists’ Target Selection (New York: St. Martin’s Press, 1998).

[18] A “Mumbai-style attack” can be defined in several ways – the most essential element being teams of mobile gunmen who attack civilians in crowded places or inside buildings. The gunmen may or may not be equipped with suicide vests or IEDs, and hostage-taking and barricading inside buildings may or may not be part of the operation. In this article, “Mumbai-style attack” refers to the modus operandi used in the original Mumbai attack in 2008 – it was carried out by several teams of gunmen against multiple targets simultaneously, it involved several weapon systems (handguns and IEDs) and hostage taking/barricading was part of the attack.

[19] “Toulouse siege: as it happened,” The Telegraph, 22 March 2012.

[20] Launched IED attacks after 2008: “Nicky Reilly” (2008), “Mohammed Game” (2009), “Underwear bomber” (2009), “Doukajev” (2010), “Abdulwahab Stockholm” (2010), “Kosher Supermarket” (2012).

[21] Air-based bombing plots: “GIA Hijacking” (1994), “Richard Reid Shoe Bomb” (2001), “Heathrow Airplane Crash” (2002), “Sajid Badat Shoe Bomb” (2003), “Transatlantic Airliners Plot” (2006), “El Al Plane Frankfurt” (2006), “Underwear Bomber” (2009), “Rajib Karim Heathrow Plot” (2010). Sea-based Bombing: “European Ferries” (2002). “Bouhrama GSPC” (2005) is also directed towards a sea-based target (cruise ship) but the weapon type is unknown.

[22] The largest bombings in Europe (truck bombs of 1,000-1,500 kgs.) were carried out by the Provisional IRA in England and Northern Ireland the 1990s. More recently, in 2011, right-wing terrorist Anders Behring Breivik set off a 950 kg truck-bomb outside the government quarter in Oslo.

[23] ”’Mumbai-style’ terror attack on UK, France and Germany foiled,” Guardian,29 September 2010.

[24] The five launched attacks are: Mohammed Game’s attempt to bomb an Italian military base (12 October 2009), Arid Uka’s shooting of U.S. soldiers on a shuttle bus in Frankfurt airport (2 March 2011), Mohammed Merah’s shooting campaign in Southern France (March 2012), the Woolwich attack on a U.K. soldier (22 May 2013), and the Paris soldier stabbing (27 May 2013).

[25] Consult C. J. M. Drake, Terrorists’ Target Selection (New York: St. Martin’s Press, 1998).

[26] Interview with European security officials, April 2014.

[27] See “Soldier Opens Fire at Ft. Hood; 13 Dead,” CBS News, 5 November 2009 and “Day of chaos in the capital leaves soldier and terrorist dead,” Ottawa Citizen, 23 October 2014.

[28] For definition of the “random vs- discriminate attack” variable, consult Codebook in Appendix B.

[29] “7/7 and 21/7 began at al-Qaida camp, court told,” The Guardian,24 March 2007.

[30] “How the threat has evolved,” MI5 Security Service home page, accessed May 2014.

[31] Transatlantic Airliners Plot (2006), Sauerland Cell (2007) and Easter Shopping Centre Plot (2009).

[32] “Arrest of 'Easter bombers' led to international al-Qaeda network,” Telegraph,18 May 2010.

[33] For more on the possible links between the Sauerland Plot and al-Qaida, see Guido Steinberg, German Jihad: On the internationalization of Islamist terrorism(Columbia University Press, 2013):94-95.

[34] As a side note, the same PETN and TATP combination was used by AQAP in the “Cargo Planes Plot” in 2010, where the explosives were hidden in printers on board of two cargo planes bound for the U.S. It is not included in the plot list because the plot itself did not affect Europe in any significant way. The Underwear Bomber plot is included, because the perpetrator boarded the plane in Amsterdam.

[35] “Document shows origins of 2006 plot for liquid bombs on planes,” CNN, 30 April 2012.

[36] The hypothesis is supported by other cases such as the “Fertilizer Plot.” Recipes for fertilizer bombs are easily accessible in open sources and online. However, European jihadis only started plotting attacks with fertilizer bombs in 2004, after receiving training in Pakistan. The cell behind the “Fertilizer Plot” reportedly met with al-Qaida representatives in Pakistan to discuss the plot. It is unclear who exactly provided the training to them, and why they chose to use a fertilizer bomb rather than peroxide-based explosive. Nevertheless, the case illustrates how training abroad seems to be an important factor in explaining how innovative IED manufacture techniques get transferred to Europe.

[37] Author’s observations based on searches in a comprehensive archive of online jihadi training manuals maintained by the Norwegian Defence Research Establishment (FFI).

[38] Note, however, that the current state of jihadi online learning is not particularly advanced. See Anne Stenersen, “‘Bomb-making for beginners’: Inside an al-Qaida e-learning course,” Perspectives on Terrorism7, No. 1 (2013).

[39] “Exclusif - Transcription des conversations entre Mohamed Merah et les négociateurs,” Libération, 17 July 2012.

[40] See for example M. Midlarsky et al., “Why Violence Spreads,” International Studies Quarterly, Vol. 24, No. 2 (Jun., 1980), pp. 262-298; Alex P. Schmid and Janny de Graaf. Violence and Communication: Insurgent Terrorism and the Western News Media (London: Sage, 1982); Brigitte L Nacos, “Revisiting the Contagion Hypothesis: Terrorism, News Coverage, and Copycat Attacks,” Perspectives on Terrorism 3, No. 3 (2009); and Christina Cliff & Andrew First, “Testing for Contagion/Diffusion of Terrorism in State Dyads,” Studies in Conflict & Terrorism 36, No. 4 (2013): 292–314.

[41] “You are only responsible for yourself,” al-Sahab, 2 June 2011.

[42] Brynjar Lia, Architect of Global Jihad: the life of al-Qaida strategist Abu Mus'ab al-Suri (London: Hurst, 2007).

[43] Al-Suri calls the phenomenon al-jihad al-fardi,or “individual jihad”, referring to what we would call “single actor”, “solo” or “lone wolf” terrorism in Western parlance.

[44] See, for example, Ramon Spaaij, Understanding Lone Wolf Terrorism: Global Patterns, Motivations and Prevention, 2012 edition (Springer, 2011)

[45] Brynjar Lia, Architect of Global Jihad: The life of al-Qaida strategist Abu Mus’ab al-Suri(New York: Columbia University Press, 2008): 102-105.

[46] See Ramón Spaaij and Mark S. Hamm, “Key Issues and Research Agendas in Lone Wolf Terrorism,” Studies in Conflict & Terrorism (forthcoming) and Center for Terroranalyse (CTA) “The threat from solo terrorism and lone wolf terrorism,” 5 April, 2011.

[47] Petter Nesser, “Research Note: Single Actor Terrorism: Scope, Characteristics and Explanations,” Perspectives on Terrorism 6, no. 6 (December 12, 2012).

[48] See Paul Gill, John Horgan, and Paige Deckert, “Bombing Alone: Tracing the Motivations and Antecedent Behaviors of Lone-Actor Terrorists,” Journal of Forensic Sciences 59, no. 2 (March 1, 2014): 425–35 and Ramon Spaaij, Understanding Lone Wolf Terrorism: Global Patterns, Motivations and Prevention, 2012 edition (Springer, 2011).

[49] The reference to the hadith was made in Osama bin Laden’s “Oh People of Islam”, al-Sahab, April 2006.

[50] For an overview of contagion theories, see for example Brigitte L. Nacos, “Revisiting the Contagion Hypothesis: Terrorism, News Coverage, and Copycat Attacks,”Perspectives on Terrorism 3, No. 3

[51] There are anecdotal examples in Europe of convicted jihadis who praised, and in some cases sought to emulate, past jihadi terrorist attacks. For example, one of the members of the Crevice cell in the U.K. was overheard praising the Madrid bombings shortly after they happened in 2004. Another example is the Jewish Museum shooter in 2014, who had previously bragged about carrying out a “five times Merah” attack (referring to the shooting spree of Muhammed Merah in Southern France in 2012). “Profile: Waheed Mahmood,” BBC, 30 April 2007; “Mehdi Nemmouche , ”Je vais faire cinq fois Merah au 14 Juillet” Libération,7 September 2014.

[52] Nine out of 16 plots in this period targeted U.S. interests.

[53] Petter Nesser, “Jihadism in Western Europe After the Invasion of Iraq: Tracing Motivational Influences from the Iraq War on Jihadist Terrorism in Western Europe,”Studies in Conflict and Terrorism 29, No. 4 (2006): 323-342; Thomas Hegghammer, “Global jihadism after the Iraq war,” Middle East Journal 60, No. 1 (2006): 11-32.

[54] Petter Nesser, “Ideologies of Jihad in Europe,” Terrorism and Political Violence 23, no. 2 (2011): 173–200

[55] Osama bin Laden, “Oh People of Islam,” al-Sahab, April 2006; Anwar al-Awlaki, “May our souls be sacrificed for you,” Inspire No. 1 (Summer 2010).

[56] “Qualities of an urban assassin,” Inspire No. 9 (Winter 2012), p. 37.

[57] “French Ex-Jihadist In Syria Found With Explosives,” Associated Press, 26 March 2014; Kjetil Stormark, “Derfor slo norske myndigheter terroralarm,” Makt og avmakt, 29 July 2014; “Met police arrest man over suspected terror plot linked to Isis,” The Guardian, 8 October 2014.

[58] “Important for all the Mujahidin from all the Brigades” (in Arabic), Muntadayat muhajirun al-islamiyya, 20 October 2006. On file with Author.

[59] “Rezwan Ferdaus held over Pentagon and Capitol bomb plot,” BBC, 29 September 2011.

[60] The alleged ringleader was a former Russian special forces soldier who allegedly spent time with jihadi groups, including the Islamic Jihad Union (IJU) and al-Qaida, in the Tribal Areas of Pakistan. “Spain: Model plane video evidence of terror plot,” Associated Press, 11 August 2012; “3 suspected Islamist terrorists arrested in France,”CNN, 1 March 2013.

[61] “German police foil Islamist terror plot to use remote controlled aircraft filled with explosives as guided missiles,” Daily Mail, 25 June 2013.

[62] “Jihadists planned to attack Luton TA base using remote controlled car packed with explosives,” Telegraph, 15 April 2013.

[63] “The ultimate mowing machine,” Inspire No. 2 (Fall 2010), pp. 53-57.

[64] There are several examples of attempts to use vehicles as weapons in countries outside Western Europe. In March 2006, Mohammed Reza Taheri-Azar attempted to drive a Jeep through a crowd at North Carolina University in the U.S. More recently, in October 2014, Martin Rouleau rammed his vehicle into two Canadian military personnel in Quebec, Canada. “Defendant offers details of Jeep attack at University,” New York Times, 8 March 2006; “Canadian soldiers run down in possible Quebec terror attack,” The Star, 20 October 2014.

[65] A. Dolnik, Understanding terrorist innovation, 53.

[66] “Two admit publisher attack plot,” BBC, 21 April 2009.

[67] “Torching parked vehicles,” Inspire No. 10 (Spring 2013), p. 51.

[68] Cathy Scott-Clark and Adrian Levy, The Siege: 68 hours inside the Taj Hotel (New York: Penguin, 2013): 157.

[69] In September 2014, an IS-linked plot to behead a person in public was allegedly thwarted by police in Australia. “Australian PM says police raids follow IS linked beheading plot,” Reuters, 18 September 2014.