Lone-actor vs. Remote-Controlled Jihadi Terrorism: Rethinking the Threat to the West

April 20, 2017

For special access to experts and other members of the national security community, check out the new War on the Rocks membership.

At approximately 2:40 in the afternoon of March 22nd, British-born Khalid Masood — a violent criminal who had previously been investigated by MI5 for links to extremists — deliberately drove into pedestrians making their way across Westminster Bridge. He killed a mother on her way to collect her children from school, a pensioner, and two tourists. After crashing the rented vehicle into the gates of Parliament, Masood ran into New Palace Yard and stabbed an unarmed policeman to death before being shot and killed by plainclothes officers. In contrast to other recent attacks in Western nations, which have frequently (sometimes incorrectly) been labeled acts of “lone-actor” terrorism, Masood’s assault was followed by a volley of articles with titles such as “Remote-Control Terror,” “Don’t Bet on London Attacker Being a Lone Wolf,” and “The Myth of the ‘Lone Wolf’ Terrorist.” Analysts were keen to point out that “lone-actors” are very rarely truly alone and that instead they tend to emerge from within broader, extremist milieus. Moreover, what sometimes seems like lone-actor terrorism at first glance turns out to be connected to, if not directed by, foreign terrorist organizations. Yet the official word on Masood is that, regardless of his associations, he acted “wholly alone.” To accurately understand the nature of terrorism today, patient, measured analysis and consistent use of terminology are necessary. It is therefore important to re-examine the concept of lone-actor terrorism and to try and appreciate where it fits within the overall spectrum of jihadist terrorist activity in the West.

Many, if not most “lone-actor” jihadists (including Masood), are indeed connected to other extremists and terrorists in some shape or form. Such connections have been greatly facilitated by the growth of social media and encrypted communication applications, which have also enabled the rise of virtual “planners” or “entrepreneurs” and so-called “remote-controlled” or “enabled” attacks, such as those in Würzburg and Ansbach, Germany, in July last year. Moreover, the number of jihadists with bona fide connections to foreign terrorist organizations, including training and combat experience abroad, has risen sharply since the outbreak of conflict in Syria and Iraq. Western security services are currently bracing for a potential surge in the number of returning foreign fighters.

Nevertheless, lone-actors have not suddenly gone extinct. Recent dismissals of lone-actor terrorism are partly a reaction against widespread and often inaccurate use of the phrase “lone-wolf” in the media. However, these reactions are suggestive of quite rigid interpretations of a term, which refers to a varied and complex phenomenon and should not be taken literally. For instance, the observation that lone-actors are never truly alone is hardly a revelation, nor does it automatically invalidate the term. As researchers from the Dutch Institute of Security and Crisis Management noted a decade ago, lone-actors

often identify or sympathize with extremist movements. They may at one time have been a member or affiliate of an extremist organization or [even] have obtained some training or support.

The existence of connections to others, particularly members of terrorist organizations, is certainly significant. But especially in today’s social media-saturated world where connections to others are more easily-achieved than ever before, we must be careful not to overemphasize the nature of such links. The danger is that we exaggerate the power and reach of groups like the self-proclaimed Islamic State and assist them in achieving their goals by magnifying the threat.

So, What is Lone-Actor Terrorism?

At face value, the term “lone-actor” suggests someone operating in social isolation, absent any form of encouragement, support or control. However, the reality is more complex. As Daniel Byman, Rafaello Pantucci, and others have pointed out, there is a continuum of connections to likeminded extremists and most lone-actors display varying levels of communication and affiliation with others who share their worldview. Nidal Malik Hasan, for instance, was in contact with Anwar al-Awlaki — yet the nature of that contact was limited to ideological justification for, rather than planning of acts of violence. It thus appears that Hasan conceived and conducted his attack entirely on his own. Yassin Salhi, who decapitated his boss at a chemical plant in Lyon in June 2015, had been affiliated with extremists in France for many years. He was in contact with a friend named Yunes Sébastien located in Syria, who may even have influenced him to some degree. Yet the information we have suggests that he planned and conducted his attack by himself. Lone-actors occasionally even receive partial assistance from others who seem to have limited knowledge of their plans. In the case of the Nice attacker, Mohamed Lahouaiej Bouhlel, French authorities have laid charges against nine suspected accomplices. However, it remains unclear whether any of them actually knew what he was planning. As far as we currently know, he ultimately acted alone in the absence of operational support or control. This is quite different to someone like the Jewish Museum attacker, Mehdi Nemmouche, who had trained with the Islamic State and was acting as a lone operative for that organization.

Crucially, the mere existence of connections to other extremists does not by itself mean that a person was acting as part of a broader network. We must look at the nature and content of those connections to know whether the person was acting independently or not. Even then — as the above examples illustrate — there are still many grey areas and it may often be debatable whether the lone-actor label is appropriate. With this in mind, most terrorism analysts focus on the issue of operational autonomy and specifically the absence of command and control as the central, defining feature of lone-actor terrorism. The question then becomes a matter of where contact ends and control begins, which is not always an easy call to make.

What difference does it make? From a psychological perspective, there are questions about what makes a person more-or-less independently decide to conduct an act of terrorism without the encouragement and support of likeminded peers (though this may or may not include contact with a terrorist organization). Very few jihadis appear to reach the stage of mobilization without some form of relevant social interaction and, in this sense, the “lone-actor” label is somewhat tenuous. But from a more practical standpoint, there are at least three additional pertinent issues that reveal the relevance of the term: visibility, predictability, and capability.

Despite a tendency to reveal their beliefs and sometimes even their plans to other people (referred to as “leakage”), lone-actors tend to be less visible due to their absence from or comparatively peripheral position within known extremist networks. This reduces the chances of detection or else obfuscates threat assessments, thereby limiting the likelihood of intervention. Ayanle Hassan Ali, who attacked soldiers at a Canadian Forces recruiting center in Toronto in March 2016 and was previously unknown to police, falls into this category. Lone-actors (such as Masood and Omar Mateen) also tend to be unpredictable, so that even when they show up on security services’ radar, frequently there are insufficient grounds for intervention and surveillance has to be dropped, only for them to conduct an attack weeks, months, or even years later. Finally, on a more positive note, due to lack of training, lone-actors also tend to be much less capable on the whole and typically rely on readily-available, low-tech weaponry.

Taking all three factors (visibility, predictability, and capability) into consideration, lone-actors are more likely to slip through the counter-terrorism net and actually execute their plans, but are less likely to achieve large-scale destruction and fatalities. Indeed, although Petter Nesser and his colleagues found that the majority of recent planned attacks within Europe were connected to the Islamic State, most of these were thwarted. My own research has shown that the majority of jihadist attacks which are executed in Western nations are done so by lone-actors who are lacking organizational support. Moreover, these attacks result in a much lower average rate of fatalities, compared to those committed by terrorist organizations.

Rethinking the Threat to the West

Based on the above discussion, we can conclude that lone-actor terrorists are untrained individuals who act independently of any terrorist organization to plan and conduct attacks largely by themselves. More broadly, homegrown jihadist terrorism in the West consists of a spectrum of actors and activities. A common approach is to divide this into three levels: inspired, enabled, and directed. Although not without utility, this method of categorization glosses over the complexity of connections between actors. Using a four-tier system (as depicted in table below), we can distinguish between those who are more-or-less socially isolated and inspired by the ideology; those who are connected to others yet operationally independent from them; those who are networked in the sense that they are embedded within and coordinate their activities together with broader extremist networks; and finally those who are organizationally supported, meaning they are trained, funded, and logistically supported by (networked) foreign terrorist organizations such as the Islamic State or al-Qaeda.

Spectrum of home-grown Islamist terrorism in Western countries (FTO = foreign terrorist organization).

Lone-actors, as well as autonomous dyads and groups (such as the murderers of Lee Rigby), straddle the inspired and connected categories, depending on their particular connections. Remotely-enabled operatives are distinguished from lone- or other autonomous actors by the nature and degree of their connections to terrorist organizations. The encouragement and guidance they receive almost certainly makes a difference to their willingness to conduct attacks and to their operational decision-making.

In at least one such case in India described by Rukmini Callimachi, the degree of support has extended to include arranging access to weaponry in addition to the facilitation of in-country connections, which is indicative of tangible organizational support. This level of assistance has yet to be clearly documented in the West. In light of their more extensive connections with terrorist organizations, remotely-enabled attackers are at least theoretically more visible than lone-actor terrorists (despite their frequent use of encrypted communications) and are potentially more capable. Importantly, however, this potential has yet to be realized and (as depicted in the third column of the figure below) the average number of fatalities in remotely-enabled attacks is actually less than for lone-actors and autonomous groups. Of course, this difference in fatalities is small, the salient point being that remotely-enabled attacks are closer to acts of lone-actor terrorism in terms of physical destruction than to organizationally supported attacks.

By far the most devastating form of jihadist terrorism — yet also the most frequently thwarted — are attacks committed by organizationally supported operatives who have been trained in camps abroad and have received ongoing financial and logistical support. Importantly, this often includes continued, remote advice regarding the construction of improvised explosive devices. This appears to have been key to the success of the 7/7 bombings in London and may also have played a role in the Brussels attacks last year. However, notwithstanding outliers like the simple-yet-spectacular attack in Nice, there is no substitute for face-to-face training with weapons and explosives. Granted, it is possible, if not likely, that future remotely-enabled attacks will eventually result in mass casualties, but there is no concrete reason at present to believe they will become more effective on the whole. Indeed, jihadist terrorist attacks executed in the West remain largely amateur despite the mushrooming of connections to terrorists in the Middle East.

Jihadist attacks in Western Europe, North America and Australia. (January 2012–March 2017). Numbers in brackets refer to number of fatalities vs number of attacks. Source: Author’s database.

Why Does All This Matter?

There is a need for a degree of analytical clarity and consistency among terrorism researchers. There is no doubt that we are faced with a complex and varied threat and it is quite rare for any given case to fit neatly into a particular analytical category. Precisely because of this, it doesn’t make sense to treat categories as if they are literal or absolute descriptions of reality that are somehow mutually exclusive of one another. Lone-actor, remotely-enabled, organizationally supported — these are all relative terms and the lines between them are blurred. Moreover, the classification of any given case (and any conclusions we subsequently draw from this) is dependent on sufficient information, which is very often lacking, especially in the immediate aftermath of an attack and particularly concerning the existence, nature, and extent of any connections to terrorist organizations or others.

Perhaps the more important implication relates to how the threat is portrayed. By downplaying the role of lone-actors and autonomous groups, while emphasizing the controlling influence of the Islamic State, the threat of jihadist terrorism in the West appears even bigger and badder than it really is. Connections between terrorists are indeed common (more so in Europe than the United States), but this does not mean that lone-actors (untrained, largely autonomous individuals) don’t also play an important role. Remotely-enabled attacks are certainly an increasing issue of concern and they are indeed the work of the Islamic State, but not exclusively so. As Alexander Meleagrou-Hitchens and Seamus Hughes point out, they represent a hybrid, a midway point between lone-actors and truly organizationally supported operations — a marriage of convenience if not necessity — and their extremely limited outcomes so far reflect this. If there is a myth that needs dispelling, it is not related to the reality of lone-actor terrorism, but rather to the belief in the omnipotent presence of the Islamic State. Groups like the Islamic State and al-Qaeda undoubtedly shape the ideological landscape and their tentacles reach far beyond their immediate territory. We are faced by a threat that is largely dominated by interconnected, ever-evolving and extremely dangerous transnational networks. Yet despite sporadic, devastating attacks, the majority of jihadist violence in Western countries is — thanks to the work of police and intelligence services — more “lone-actor” than it is the work of Islamic State external operations. In contrast to Khalid Masood, the recent truck attack in Stockholm appears to have been internationally connected, if not supported. The perpetrator, Rakhmat Akilov, claims to have been following direct orders from the Islamic State and was in contact with fellow extremists on WhatsApp. However, Swedish security services described Akilov as a “marginal character” within known extremist networks and the end result was much the same as in London. Indeed, Akilov displayed only the most basic level of skill, incapable of constructing a working improvised explosive device.

The threat to the West is real and we cannot afford to let down our guard, but our adversaries’ intent is far greater than their capabilities. Moreover, this is an indicator of largely successful counter-terrorism. Members of the general public and policymakers alike should understand and appreciate this.


Dr. Sam Mullins is a professor of counter-terrorism at the George C. Marshall European Center for Security Studies, Germany, and an honorary principle fellow at the University of Wollongong, Australia. He is the Author of ‘Home-Grown’ Jihad: Understanding Islamist Terrorism in the US and UK. The views expressed in this article are solely those of the author and do not represent the official position of the Marshall Center, the U.S. government, or the German government.

Image: CC, Prioryman

We have retired our comments section, but if you want to talk to other members of the natsec community about War on the Rocks articles, the War Hall is the place for you. Check out our membership at warontherocks.com/subscribe!