By Scott Stewart
Vice President of Analysis
The April 15 Boston Marathon bombing has rekindled interest in the topic of grassroots terrorism, specifically the kind conducted by grassroots jihadists. We define grassroots jihadists as individuals who have been inspired by the al Qaeda core or franchise groups but who are not members of these groups.
Some grassroots operatives, such as Najibullah Zazi, who pleaded guilty to charges related to a New York City Subway bomb plot in 2009, travel to places, such as Pakistan, Somalia or Yemen, where they receive training from jihadist franchise groups. Other grassroots jihadists, such as accused Fort Hood shooter Maj. Nidal Malik Hasan, communicate but have no physical interaction with members of a franchise group. Some grassroots militants have no direct contact with other jihadist elements. Lastly, some would-be grassroots militants seek out other jihadist elements but accidentally make contact with government informants. In recent years, such cases have been occurring more frequently, resulting in sting operations and arrests.
Stratfor first began discussing the threat posed by grassroots jihadists in 2005, when we described how the al Qaeda threat was devolving from one based on the core al Qaeda group to a wider movement. But in the big picture, grassroots actors are not just a jihadist phenomenon. We've also extensively discussed the move to leaderless resistance operational models by both left- and right-wing extremists.
Grassroots operatives are a very big problem for government counterterrorism efforts. Indeed, that is why militant ideologues promote the leaderless resistance model. That doesn't mean that such operatives cannot be stopped, but in order to stop them, citizens must think differently about counterterrorism. In the face of a growing grassroots threat there is a growing need for what Stratfor calls "grassroots defenders."
In recent decades, governments have become fairly efficient at identifying and gathering intelligence on known groups that could conduct violent attacks. This is especially true in the realm of technical intelligence, where dramatic improvements have been made in the ability to capture and process huge amounts of data from landline, cellphone and Internet communications. Governments have also become quite adept at penetrating known groups and recruiting informants. Even before 9/11, government successes against militant groups had led white supremacist and militant animal rights and environmentalist groups to adopt a leaderless resistance model for their violent and illegal activities.
In the post-9/11 world, intelligence and security services dramatically increased the resources dedicated to counterterrorism, and the efforts of these services have proved very effective when focused on known organizations and individuals. In fact, because of these successes we have seen jihadist groups, such as al Qaeda in the Arabian Peninsula and the al Qaeda core, since 2009 encourage aspiring militants to undertake lone wolf and small-cell activities rather than travel to places like Pakistan and Yemen to link up with the groups and receive training in terrorist tradecraft.
We see no sign that this trend toward leaderless resistance will reverse in the near future, and our forecast is that the grassroots threat will continue to grow, not only from the jihadist realm but also from far-right and far-left actors.
As noted above, most counterterrorism intelligence efforts have been designed to identify and track people with links to known militant groups, and in that regard such efforts are fairly effective. By contrast, counterterrorism efforts have been largely ineffective in identifying those grassroots militants who do not contact known terrorist entities. The focus on identifying and monitoring the activities of someone connected to an established militant group is understandable given that operatives belonging to groups such as Hezbollah or al Qaeda have access to much better training and far greater resources than their grassroots counterparts. Simply put, counterterrorism agencies focus more of their attention on the more potent threat.
However, grassroots operatives can and do kill people. Although they tend to focus on softer targets than operatives connected to larger groups, some grassroots attacks have been quite deadly. For example, the July 2005 London bombings killed 52 people, and Anders Behring Breivik was able to kill 77 in his July 2011 twin attacks in Norway. While the Boston Marathon bombing killed only three, it wounded hundreds.
One problem for most counterterrorism agencies is that counterterrorism is not their sole mission — or in some cases even their primary mission. Often, as is the case with MI5 in the United Kingdom, the primary counterterrorism agency also has substantial foreign counterintelligence responsibilities. In the case of the FBI, it has not only counterterrorism and foreign counterintelligence missions but also a host of other responsibilities, such as investigating bank robberies, kidnappings, white-collar crime, online crime and public corruption. Also, while counterterrorism was the primary focus of almost every law enforcement and intelligence agency immediately after 9/11, as time has passed, the emphasis on counterterrorism has lessened.
The resources of the primary counterterrorism agencies are also quite finite. For example, the FBI has fewer than 14,000 special agents to fulfill its many responsibilities, and while counterterrorism has become its top mission in the post-9/11 era, only a portion of its agents (estimated to be between 2,500 and 3,000) are assigned to counterterrorism investigations at any time. Some FBI contacts also tell us that counterterrorism assignments are not viewed as career enhancing, and thus many billets remain vacant.
Counterterrorism investigations can also be very labor intensive. Even in a case in which a subject is under electronic surveillance, it takes a great deal of manpower to file all the paperwork required for the court orders, monitor the surveillance equipment and, if necessary, translate conversations and run down or task out additional investigative leads developed during the monitoring. Seemingly little things like conducting a "trash cover" on the subject (sifting through a subject's trash for evidence and intelligence) can add hours of investigative effort every week. If full, 24/7 physical and electronic surveillance is put in place on a subject, it can tie up as many as 100 special agents, surveillance operatives, technicians, photographers, analysts, interpreters, lawyers and supervisors.
It is also important to recognize that the bar is set pretty high for the FBI to investigate people. The FBI cannot just open an investigation on someone on a whim. It needs an identifiable objective and purpose in order to open a preliminary inquiry into a potential suspect, what is referred to as an "assessment." The FBI can't open a case based on activity protected by the First Amendment or on a subject's race, ethnicity, religion or national origin. Even once an assessment is launched, it can't become a full field investigation unless it finds some indication that there is a potential criminal violation. Assessments also have a limited time frame and must be closed unless an indication of a criminal violation is found.
Again, given the potential threat posed by known or suspected al Qaeda, Hezbollah or domestic terrorist suspects, it is understandable that most of the counterterrorism resources would be devoted to investigating and neutralizing that threat. However, the problem with the focus on known actors is that it leaves very little resources for proactive counterterrorism tasks such as looking for signs of potential operational activities, including pre-operational surveillance and weapons acquisition, conducted by previously unknown individuals. Such efforts are a huge undertaking for agencies with limited resources.
Furthermore, in the case of a lone wolf or small cell, there simply may not be any clear-cut chain of command, a specific building to target or a communication network to compromise — the specialties of Western intelligence agencies. The leaderless resistance organization is, by design, nebulous and hard to map and quantify. This lack of structure and communication poses a problem for Western counterterrorism agencies. Also, since the grassroots threat can emanate from a variety of actors, it is impossible to profile potential militants based on race, religion or ethnicity. Instead, their actions must be scrutinized for indicators of radicalization and attack planning.
Law enforcement has thwarted many grassroots plots, but in those plots the suspects have either planned an attack that was beyond their means, leading them to seek assistance from someone who turned out to be a government informant, or they have contacted a known militant actor and, in doing so, come to the attention of the authorities. Grassroots actors who do not seek assistance and who do not get caught communicating with known terrorist entities can often launch their attacks undetected. In those cases, the attack will either fail, like the 2010 Times Square bombing, or succeed, like the Boston Marathon bombing.
All grassroots militants engage in activities that make their plots vulnerable to detection. Due to the limited number of dedicated counterterrorism practitioners, these indicators (and sometimes blatant mistakes) are far more likely to be witnessed by someone other than an FBI or MI5 agent. This fact highlights the importance of what we call grassroots defenders — that is, a decentralized network of people practicing situational awareness who notice and report possible indications of terrorist behavior such as acquiring weapons, building bombs and conducting preoperational surveillance.
It is important to note that grassroots defenders are not vigilantes, and this is not a call to institute the type of paranoid informant network that existed in East Germany. It is also not a call to Islamophobia — the Muslim community is an important component of grassroots defense, and many plots have been thwarted based upon tips from the Muslim community. Grassroots defenders are citizens who take responsibility for their own security and for the security of society and who report possible terrorist behavior to the authorities.
The most important pool of grassroots defenders is police officers on patrol. While there are fewer than 14,000 FBI agents in the entire United States, there are some 34,000 officers in the New York City Police Department alone and an estimated 800,000 local and state police officers across the United States. While the vast majority of these officers are not assigned primarily to investigate terrorism, they often encounter grassroots militants who make operational security errors or who are in the process of committing crimes in advance of an attack, such as document fraud, illegally obtaining weapons or illegally raising funds for an attack.
For example, in July 2005, police in Torrance, Calif., thwarted a grassroots plot that was uncovered during the investigation of a string of armed robberies. After arresting one suspect, Levar Haney Washington, police searching his apartment uncovered material indicating that Washington was part of a small jihadist cell that was planning to attack a number of targets. Hezbollah's multimillion-dollar cigarette smuggling network was uncovered when a sharp North Carolina sheriff's deputy found the group's activities suspicious and tipped off the Bureau of Alcohol, Tobacco, Firearms and Explosives, launching the massive Operation Smokescreen investigation.
Traffic stops by regular cops also have identified several potential grassroots jihadists. In August 2007, two Middle Eastern men stopped by a sheriff's deputy for speeding near Goose Creek, S.C., were charged with possession of a destructive device. Likewise, a traffic stop in September 2001 in Alexandria, Va., led to an investigation that uncovered the so-called Virginia Jihad Network. In fact, at the time of the 9/11 attacks, the operation's leader, Mohamed Atta, was the subject of an outstanding bench warrant for failing to appear in court after being stopped for driving without a license.
But police are not the only grassroots defenders. Other people, such as neighbors, store clerks, landlords and motel managers, can also notice operational planning activities. Such activities can include purchasing bombmaking components and firearms, creating improvised explosive mixtures and conducting pre-operational surveillance.
On July 27, 2011, an alert gun store clerk in Killeen, Texas, called the local police after a man who came into the store to buy smokeless powder exhibited an unusual demeanor. They located the individual and, after questioning him, learned he was planning to detonate an improvised explosive device and conduct an armed assault at a local Killeen restaurant popular with soldiers from nearby Fort Hood. The clerk's situational awareness and decision to call the police likely saved many lives. There are reports that just last week authorities in Montevideo, Minn., arrested a man who was reportedly preparing to conduct an attack. Concerned neighbors alerted authorities of his suspicious behavior. The man, a convicted felon, was reportedly affiliated with a militia group. Authorities allegedly found an AK-style rifle, Molotov cocktails and pipe bombs during a search of his home.
Ordinary citizens exercising situational awareness can and have saved lives. This reality has been the driving force behind programs like the New York Police Department's "If You See Something, Say Something" campaign, a program subsequently adopted by the U.S. Department of Homeland Security as a means of encouraging citizens to report potential terrorist behavior.
It is unrealistic to expect the government to uncover and thwart every plot. There are too many potential actors and too many vulnerable targets. Individuals need to assume some responsibility for their own security and the security of their communities. This does not mean living in fear and paranoia, but rather living with a relaxed level of situational awareness, being cognizant of potential dangers and alert to indicators of them. People who accept this responsibility and who practice this awareness are the true grassroots defenders.