In the aftermath of an attack, people who had previously been in contact with the perpetrator almost always cite instances of "well, now that you mention it" or "now that I think about it" regarding their behavior.

The Las Vegas Joint Terrorism Task Force arrested a 23-year-old man Aug. 8 who was allegedly plotting to attack Jewish houses of worship and bars frequented by the LGBTQ community in the city. In 2017, he began to frequent websites peddling a narrative that people who shared his extremist views were under attack. And as he began to relate to that narrative, he started frequenting online forums and social media groups that peddled even more radical messages that contained urgent and overt calls for violence. This eventually mobilized him to gather bombmaking materials and firearms, as well as establish contact with like-minded individuals to discuss potential targets and attack tactics. But little did he know that the co-conspirators he thought were his allies were actually undercover FBI agents who had been monitoring his online activity.

In many ways, the Las Vegas man's actions and path to radicalization were quite similar to those of the jihadist security guard in Orlando who shot up the Pulse nightclub in 2016. This suspect, however, was radicalized not by the Islamic State but by U.S.-based white supremacist groups like Atomwaffen Division. This highlights that terrorism is not owned by a particular organization or ideology. Rather, it's a tactic deployed by anyone looking to use violence for some political or religious aim. And having not only government officials but everyday people understand that is key to catching additional would-be attackers before it's too late. 

Different Ends, Same Means

Terrorist tactics such as bombings, armed assaults or vehicular assaults are used by militants who ascribe to a wide array of radical belief systems. Militants have also long copied successful propaganda techniques used by other groups, such as using the internet to radicalize, mobilize and operationalize attackers. This neutrality means that tactics used to combat one strain of terrorism can be effectively employed against others. Sting operations like the one used to catch the Las Vegas man, for example, have been successfully used against jihadists, anarchists and white supremacists alike in recent years.

Likewise, the steps a would-be attacker takes before conducting an attack — known as the terrorist attack cycle — are thus also ideologically agnostic in nature. The planning cycle for a vehicle bombing will, of course, look different from that of a mass shooting. But while the specific cycles may vary in length and complexity, those planning an attack must all progress through the same motions in the same order — that is, selecting a target; planning out their attack; conducting surveillance; conducting the attack; escaping the scene (if it's not a suicide mission); and then exploiting their attack themselves or allowing it to be exploited by others. And at each step of the way, they are vulnerable to detection. 

Lone-Wolves Still Rarely Act Alone

Security forces in the United States, as well as the West in general, have gotten very good at disrupting terrorism connected to professional terrorist cadres associated with hierarchical groups, which is why radicals of various stripes have turned to the leaderless resistance model. Some have claimed that this model of terrorism makes the attack cycle obsolete, though I believe the opposite is true. In his article "Leaderless Resistance," white supremacist Louis Beam wrote that it "becomes the responsibility of the individual to acquire the necessary skills and information as to what is to be done." However, this is easier said than done. 

Such "lone-wolf" or grassroots attackers usually lack the type of training and sophisticated tradecraft of professional terrorist cadres, and thus often struggle with tasks such as planning, surveillance, operational security and bombmaking. As a result, most would-be attackers either reach out to other people for help first, or telegraph their intent to others through direct threats or statements, or more indirect means. This is what's referred to as "leakage," and it's helped lead to dozens of sting operations in recent years that have stopped aspiring attackers before they cause harm. 

As illustrated by the Las Vegas case, a factor that drives such terrorists to seek help is that they're often looking to conduct large, spectacular attacks that go far beyond their individual capabilities. The suspect had reportedly not only briefly served in the U.S. military, but had likely been experimenting with bombmaking for years. Yet despite having more applicable experience than most grassroots terrorists, it was still not enough to single-handedly pull off the kind of large-scale bloodshed he so desired — hence his decision to reach out for support.  

The suspect also allegedly told the undercover FBI employee that he intended to recruit enough people to form three squads of gunmen to attack a nightclub in Orlando. But the chances of recruiting this many people to participate in a terrorist plot without being detected — or infiltrated by an informant — are very slim in a place like the United States, where authorities are very effective at stopping such attacks. Consequentially, the attacker was identified and arrested before he had much opportunity to recruit confederates, as he was progressing through the early portions of his attack cycle.

The Importance of Civilian Surveillance  

Unfortunately, however, we cannot rely on law enforcement to monitor everything and everyone all the time. Their limited resources are primarily focused on detecting threats emanating from professional terrorist cadres due to the greater danger such groups pose to society at large. Thus, terrorists will inevitably slip through the cracks from time to time, and succeed in launching an attack. But in almost every case, there are pre-attack indicators that are either seen but not recognized, noted but not reported, or reported and then dismissed.

In the aftermath of an attack, people who had previously been in contact with the perpetrator almost always cite instances of "well, now that you mention it" or "now that I think about it" regarding their behavior. And indeed, the Las Vegas suspect had also long exhibited signs that he was isolated and troubled — with many of his high school classmates considering him "strange" or a "bit off," especially in his interactions with women. 

Because of this, it is extremely important to educate people about what pre-attack behaviors look like — whether its making bombs, acquiring arms or conducting surveillance on a potential target (like an LGBTQ nightclub). Just as an educated and empowered workforce is the key to combating insider threats to companies and organizations, an educated and empowered citizenry is vital to helping combat the grassroots terrorist threat. We have already seen many cases in which a terrorist plot was successfully detected or thwarted by everyday civilians — or "grassroots defenders" — who reported suspicious behavior.

But the keyword here is "behavior." In teaching people what to look out for, it's equally important to stress that a certain ethnic or religious background does not a terrorist make, and should thus not be considered a red flag in and of itself. To effectively preempt an attack, it's much more important to focus on the "how" of terrorism, rather than the "who." As evidenced by the Las Vase case, terrorists can take any shape or form. But their actions are often predictable and in turn detectable.

The Mark of a Terrorist Is Behavior, Not Ideology is republished with the permission of Stratfor Worldview, a geopolitical intelligence and advisory firm.

Image: Reuters