on security

It Takes a Village to Stop a Lone Wolf

Scott Stewart
VP of Tactical Analysis, Stratfor
8 MINS READJul 21, 2016 | 08:02 GMT
How to prevent lone-wolf terrorist attacks.
Lone-wolf attacks usually inflict less damage than those planned by terrorist organizations (the 2016 Nice attack was a notable exception), but they are also more difficult for police to detect.

The recent attacks in Dallas, Nice, Baton Rouge and Wurzburg have again raised public awareness of lone attackers unaffiliated with an organized terrorist group. I am constantly asked how governments can defend against this new threat. But that question is misguided: Lone attackers operating under a model of leaderless resistance is not a new phenomenon. Stratfor has been tracking the devolution of the jihadist movement from a hierarchical structure to a more grassroots one for more than a decade. Though leaderless resistance is by design more difficult for authorities to detect and deter, those who practice it are still bound by the vulnerabilities in the terrorist planning cycle

The Origins of Leaderless Resistance

Understanding the difference between hierarchical and leaderless resistance operational models is important when considering how to deter potential lone-wolf attackers. The concept of leaderless resistance has been around for many years. White supremacists, animal rights and environmental groups have used the model for decades. Nor is the idea new in jihadist circles. Ideologue Abu Musab al-Suri began promoting the idea in the early 2000s, and al Qaeda in the Arabian Peninsula began to heavily promote it in 2009. The group even created the English-language web magazine Inspire specifically to help radicalize grassroots jihadists and to equip them to attack their countries of residence without the support of a hierarchical organization.

Unsurprisingly, Inspire frequently features long excerpts of al-Suri's writings. The magazine is widely read and has directly influenced countless grassroots jihadists. The bombmaking instructions contained in various editions of the magazine were followed in a number of plots and in attacks such as the Boston Marathon bombing and San Bernardino. The al Qaeda core group jumped onto the leaderless resistance bandwagon in May 2010 when it published a video featuring American al Qaeda spokesman Adam Gadahn urging American jihadists to follow the example of Fort Hood shooter Nidal Hasan by buying a gun and attacking targets near their homes.

The Islamic State initially called on jihadists living in the West to travel to Iraq and Syria, and thousands responded to that call. But as the U.S.-led coalition began to strike the group, and as travel to Syria and Iraq became more difficult, that message changed. In September 2014, Islamic State spokesman Abu Mohammed al-Adnani published a message in which he encouraged jihadists living in the West to conduct simple attacks using whatever means they had available. A flurry of attacks followed al-Adnani's call, but, like al Qaeda's attempts, it was unable to create the sustained wave of attacks in the West that Islamic State leaders had hoped for.

So the concept of leaderless resistance is certainly not new, and it is also by no means confined to the jihadist movement. Would-be terrorists of any persuasion — white supremacist Phineas Priests, radical animal rights supporters and black separatists, among others — follow its precepts. Indeed, the attacks in Dallas and Baton Rouge are reminders that there is also a non-jihadist domestic terrorist threat that often involves lone attackers and small independent cells operating under the principles of leaderless resistance.

The Difficulties of Detection

It is crucial to remember that the concept of leaderless resistance was developed in response to police pressure. It is more difficult to detect and disrupt one person's plans than those of a large group. But leaderless resistance is also at its essence an admission of weakness by attackers. Hierarchical groups are far more efficient, so leaderless resistance is practiced only when the group is ineffective. Leaders who call for lone-wolf attacks are admitting that they are incapable of conducting attacks themselves and so are asking others to do so for them.

Leaderless resistance, by reducing the need for coordination and communications that could be intercepted and traced, affords a greater level of operational security. But many people fail to understand that attacks conducted under the leaderless resistance model are not completely spontaneous. Would-be terrorists still need to follow the steps of the terrorist attack cycle, and there are places throughout that cycle where they are vulnerable to detection.

I would even take this one step further: The operational security benefits of operating alone come at a steep price. Grassroots attackers operating under that model generally possess far less sophisticated terrorist tradecraft than their professional counterparts who belong to organized groups and have received training. Because of this, grassroots attackers are even more vulnerable to detection as they run through the steps of the terrorist attack cycle than a professional terrorist cadre. Furthermore, if they are acting alone, they must conduct every step of the attack cycle themselves, rather than assign individual steps to different personnel to reduce vulnerability.

Many people fail to understand that attacks conducted under the leaderless resistance model are not completely spontaneous. Would-be terrorists still need to follow the steps of the terrorist attack cycle, and there are places throughout that cycle where they are vulnerable to detection.

The limits of working alone also mean that solo attacks — such as the July 18 ax attack in Wurzburg, Germany — tend to be smaller and less damaging than those conducted by professional terrorists. There are exceptions, of course, including the July 14 truck attack in Nice, France, or Anders Breivik's 2011 deadly vehicle bomb and gun attack in Norway. But most solo attackers tend to be more like stray mutts than lone wolves. This is especially true when they make amateur mistakes, particularly in areas such as pre-operational surveillance and weapons acquisition.

Poor tradecraft has led to a number of thwarted plots. It has led others to seek help acquiring weapons or explosives, luring them into government sting operations. But the government cannot be everywhere at once. The number of dedicated counterterrorism agents is limited. These agents also, naturally, tend to focus most of their efforts on preventing large-scale attacks by professional operatives. Judging from the lack of such attacks (at least in North America and Australia), they are doing a good job.

The limits of dedicated counterterrorism forces highlight the importance of what we call grassroots defenders. Perhaps the most important grassroots defenders are police officers on patrol. Consider that there are fewer than 14,000 FBI agents in the United States, with only a portion dedicated to counterterrorism, while there are some 34,000 officers in the New York City Police Department alone — and an estimated 800,000 local and state law enforcement officers across the United States.

Though the vast majority of police officers are not assigned primarily to investigate terrorism, they often encounter grassroots militants who make operational security errors or who are in the process of committing crimes in advance of an attack, such as document fraud, illegally obtaining weapons or illegally raising funds for an attack. Cops simply doing their jobs have thwarted a number of terrorist plots, and police officers need to be trained to spot indicators of pre-operational terrorist activity. But police are not the only grassroots defenders. Other people, such as neighbors, store clerks, landlords and motel managers, can also notice operational planning activities, including people conducting pre-operational surveillance, creating improvised explosive mixtures, and purchasing bombmaking components and firearms.

Ordinary people exercising common sense and good situational awareness can — and have — saved lives.

In July 2011, an alert gun store clerk in Killeen, Texas, alerted police after a man who exhibited unusual behavior came into the store to buy smokeless gunpowder. Police officers found him and, after questioning, learned he was planning to detonate a pressure cooker bomb and conduct an armed assault at a restaurant popular with soldiers from nearby Fort Hood. The clerk's situational awareness and decision to call the police likely saved many lives.

Based on sheer numbers, terrorists operating under the leaderless resistance model are simply far more likely to be seen by an ordinary citizen than they are by a dedicated counterterrorism agent. So it is important for citizens to be educated about terrorist behavior — one of the things Stratfor hopes to accomplish — and for them to report it when they see it.

It is unrealistic to expect the government to uncover and thwart every plot. There are too many potential actors and too many vulnerable targets. Individuals need to assume some responsibility for their own security and for the security of their communities. This does not mean living in fear and paranoia but rather just understanding that there is a threat and that the threat can be spotted by alert citizens. Ordinary people exercising common sense and good situational awareness can — and have — saved lives. Grassroots defenders are an indispensible tool in the struggle against grassroots terrorists of all ideological stripes.

Connected Content


Article Search

Copyright © Stratfor Enterprises, LLC. All rights reserved.

Stratfor Worldview


To empower members to confidently understand and navigate a continuously changing and complex global environment.