Identifying Warning Behaviors of the Individual Terrorist
April 8, 2016
By J. Reid Meloy, Ph.D.
Tactical and often strategic, terrorist actions also are attention-seeking; the audience can be as important as the target. These acts are intentional, instrumental, and predatory, as well as planned, purposeful, and offensive.1 But, they may be rationalized as defensive. For instance, young ISIS recruits may believe falsely that the West is at war with Islam and that all Muslims must engage in violent jihad against unbelievers everywhere.
Traditional violence risk factors—history of such behavior, psychiatric disorder, or drug abuse—are somewhat useless in predicting the risk of lone terrorist acts. Most individuals identified as terrorists by such risk factors would be false positives, wrongly labeled as such.
For the past six years, I have worked with my colleagues to identify patterns of behavior closely related in time to acts of targeted violence, such as terrorism.2 Targeted violence differs from typical violence—emotionally charged, impulsive, and reactive—encountered by law enforcement.3 It entails a decision to act violently against a particular person, group, or institution. Persons carry it out in a planned manner as illustrated by such acts as the San Bernardino, California, terrorist attack, which killed 14 people on December 2, 2015.4
We believe these patterns of conduct—warning behaviors—can provide an investigative template to help law enforcement agencies focus their attention on subjects of concern previously identified through intelligence gathering or other counterterrorism efforts. These behavior patterns can help the investigator step back and see the bigger picture, rather than focus on just one variable, such as the purchase of a firearm or one visit to a Mosque where a particular Salafist imam preaches violent jihad.
However, these warning behaviors do not predict violence. Officers should not use them as a risk-assessment tool, only as an investigative template. In fact, the rare occurrence of terrorist violence makes its prediction seemingly impossible. But, prevention does not require prediction. The purpose of identifying these behaviors is to detect proximal indicators of concern for law enforcement that can narrow the focus of an investigation, prioritize cases, and help plan a timely risk-management intervention.
WARNING BEHAVIORS
Pathway
Subjects engage in various behaviors that encompass part of research, planning, or preparation for a terrorist act or implementation of such an attack.5
On June 5, 1968, on the first anniversary of the Six Day War, Sirhan Sirhan carried out the meticulously planned assassination of Senator Robert F. Kennedy. After months of preparation, he conducted the attack following Kennedy’s vote to sell 50 Phantom jet fighter-bombers to Israel in January 1968. Although not Muslim Sirhan identified closely with the Palestinians and viewed Kennedy’s vote as a betrayal of his people.6
In the 5 months leading up to the date, he secured a .22-caliber revolver, practiced at a shooting range, made at least four approaches—perhaps failed attempts or efforts to see how close he could get—to Kennedy in a public venue and, finally, shot him multiple times while hiding in the pantry at the Ambassador Hotel in Los Angeles, California, as Kennedy walked past him.7 There were 77 people in the pantry at the time, but there also was no U.S. Secret Service policy in place to protect aspiring presidential candidates until after this assassination.8
Fixation
Certain behaviors indicate someone’s increasingly pathological preoccupation with a person or cause.9 There is an accompanying deterioration in relationships or occupational performance.
Malik Hasan, the U.S. Army major who conducted a mass murder at Ft. Hood, Texas, on November 5, 2009, became increasingly fixated by his belief that the United States was at war with Islam. During his residency and fellowship at Walter Reed Army Medical Center in Washington, D.C., he openly articulated his beliefs to other psychiatric residents, fellows, and supervisors.10 Hasan gave two presentations entitled “The Koranic Worldview as It Relates to Muslims in the Military” and “Why the War on Terror Is a War on Islam.”11
In the months preceding the killings, the fixation continued with efforts to avoid deployment to Iraq or Afghanistan by retaining an attorney; he also communicated via e-mail with Anwar al-Awlaki, an American spiritual sanctioner and recruiter for al Qaeda in the Arabian Peninsula (AQAP) in Yemen.12 He inquired whether killing American soldiers and officers was a religiously legitimate act.13 The arguing and preaching stopped during this period, but clandestine operational planning likely continued.14 His fixation was a cause, but also was deeply personal because his grievance against the wars in the Middle East went unheeded.15
Identification
Persons have a psychological desire to be a “pseudocommando” or have a “warrior mentality.” This includes closely associating with weapons or other military or law enforcement paraphernalia, identifying with previous attackers or assassins, or proclaiming themselves as agents to advance a particular cause or belief system.16
Anders Breivik carried out the July 22, 2011, bombings on several Norwegian government buildings and, within hours, killed another 69 people—mostly adolescents—on the island of Utoya. He identified himself as a contemporary reincarnation of the Knights Templar, the militant spear of the 12th-century Christian Crusades against the Muslims.17
Breivik designed homemade uniforms, emblematic of his identification, to wear in photographs and also found an affinity for U.S. terrorists Ted Kaczynski and Timothy McVeigh.18 He plagiarized the writings of Kaczynski in his own “2083—A European Declaration of Independence” and wrote that McVeigh probably felt as he did while constructing his bombs.19 Breivik considered himself a soldier fighting to free his people from multiculturalism and the Islamic immigration into Europe.20
Novel Aggression
For the first time, subjects commit an act of violence that appears unrelated to any pathway behavior. They do so to test their ability to become violent.
On October 22, 2014, Michael Zehaf-Bibeau murdered Corporal Nathan Cirillo, a Canadian soldier, and injured three others. Then, he attacked the Canadian Parliament, wherein he was killed by law enforcement. Three years earlier, in December 2011, he had walked into the Royal Canadian Mounted Police (RCMP) field office in Burnaby, British Columbia, and said he wanted to be arrested for an armed robbery he committed a decade earlier; no such recorded crime existed.21 The next night, he tried to rob a McDonald’s restaurant with a pencil, then waited for the police to arrive.22 He told them, “I’m a crack addict and at the same time a religious person, and I want to sacrifice freedom and good things for a year maybe, so when I come out I’ll appreciate things in life more and be clean.”23
Energy Burst
An increase in the frequency or variety of noted activities—even if relatively innocuous—related to the target occurs, usually in the hours or days before the attack.
On January 8, 2011, in Tucson, Arizona, Jared Loughner tried to assassinate U.S. Congresswoman Gabrielle Giffords and committed mass murder.24 In the 12 hours before the attack, beginning before midnight, he dropped off a roll of 35-mm film to be developed at a local drug store and later picked up the photos, checked into a motel, and intermittently searched the Internet, using the key words “assassin” and “lethal injection.”25 He left a telephone message for a friend and, at 4:12 a.m., posted to his social media page a photo of his Glock pistol with the words “goodbye friends….”26
At 7:27 a.m., he visited two department stores and purchased 9-mm full metal jacket ammunition and a diaper bag.27 Later, police stopped him for running a red light; he was released with a warning after crying and apologizing.28 Loughner went home, then ran away from his father when confronted.29 He returned to a department store, then took a cab to the shopping center where Congresswoman Giffords was speaking, insisting on getting correct change for the cab driver because he only had a $20 bill.30 A few minutes later at 10:10 a.m., he opened fire, killing 6 people and wounding 13. He had taken the time to put his driver’s license, credit card, and money in a small plastic baggie.31
Leakage
When planning to harm a target through an attack, persons communicate such intent to a third party.32
On August 8, 2014, Abdurasul Juraboev, a resident of Brooklyn, New York, and a citizen of Uzbekistan, wrote on a website, “Greetings! I am in U.S. right now, but we don’t have any arms. But, is it possible to commit ourselves as dedicated martyrs anyway while here? What I’m saying is to shoot Obama and get shot ourselves, will it do? That will strike fear in the hearts of infidels.”33 In February 2015 he was indicted with two other individuals and currently awaits federal prosecution for attempt and conspiracy to provide material support to the Islamic State of Iraq and the Levant (ISIL).34
Last Resort
Subjects demonstrate through word or deed a violent action or time imperative or display increasing desperation or distress.35 To such individuals, there is no alternative other than violence, and the consequences are justified.
On June 17, 2015, 21-year-old Dylann Storm Roof committed mass murder at Emanuel African Methodist Episcopal Church in Charleston, South Carolina. He killed nine African-Americans during a Bible study meeting, including the senior pastor and Senator Clementa Pinckney, and wounded several others.
Days after the shooting, his website, The Last Rhodesian, was discovered, including a manifesto.36 Roof had written, “I have no choice. I am not in the position to, alone, go into the ghetto and fight. I chose Charleston because it is most historic city in my state, and at one time had the highest ratio of blacks to Whites in the country. We have no skinheads, no real KKK, no one doing anything but talking on the Internet. Well, someone has to have the bravery to take it to the real world, and I guess that has to be me.”37
Directly Communicated Threat
Individuals communicate a direct threat to the target or law enforcement before a violent action.
On December 11, 2010, Taimour al-Abdaly, a 28-year-old Iraqi Sunni living in Sweden since age 10, carried out a car bombing and then prematurely detonated his own suicide vest in downtown Stockholm, killing no one else. He sent an audiotaped message in several different languages to Swedish broadcast media shortly before his targeted violence.
"You have Lars Vilks—the pig Lars Vilks—to blame, and yourselves for these actions. Your quietness for the painting and your support for your soldiers, now understand, brought you to this unpleasant situation.
The Islamic state, may Allah protect it, and its people have now begun to fulfill its promises. And do know one thing: we are not—we are not a lie or imagination, we are for real and do now exist among you, Europeans. So stop your drawings and—stop your drawings of our prophet Muhammad [Arabic], withdraw your soldiers from Afghanistan and no more oppression against Islam or Muslims will be tolerated in any way or any means.
Last but not least, I say to all mujahedeen: please do not forgive [sic] me in your prayers, may Allah accept me as a martyr and my request from you is to pray [Arabic phrase] for me as the Muslims are so humiliated here in Sweden and other places in Europe that they sometimes pray for non-Muslims. And to all hidden mujahedeen in Europe, and especially in Sweden: it’s now the time to strike, even if you only have a knife to strike with, and I do know you that have more than that."38
INVESTIGATIVE USEFULNESS
Although these warning behaviors appear to be proximal indicators of accelerating risk in individual terrorists, further scientific testing is necessary. Some efforts already have begun. In a small study comparing German school shooters with other students of concern, five of the warning behaviors—pathway, fixation, identification, novel aggression, and last resort—significantly discriminated the shooters from the other students who had no intent to act.39 These differences showed a large effect size, indicating a strong relationship between the shooter’s violence and the five warning behaviors. Recent research has demonstrated striking similarities between individual terrorists, mass murderers, and active shooters.40
In two other studies, the Swedish Defence Research Agency recommended and outlined a method to employ three of the warning behaviors—fixation, identification, and leakage—to potentially identify “lone wolves” through the use of forensic linguistic analysis and data mining on the Internet.41 The warning behaviors also appear to have ecological validity—a real-world fit—across several different domains of targeted violence perpetrators, including German school shooters, German and American public figure attackers or assassins, and spousal homicide malefactors.42
The author and his colleagues are in the process of analyzing data concerning individual terrorists—religious and secular motivations—in North America and Europe. In a study of 22 European terrorists, five warning behaviors (pathway, fixation, identification, energy burst, and last resort) were found in more than 90 percent of the cases. In another larger study of 111 lone-actor terrorists in the United States and Europe, pathway, fixation, identification, and leakage were present in 77 to 96 percent of all subjects. Such efforts will demonstrate whether these behaviors have value as part of an instrument for risk-assessment efforts.
CONCLUSION
These proximal warning behaviors can be used to make decisions concerning whether a case should be monitored or mitigated for risk management. The absence of all warning behaviors following a detailed investigation—always remembering that insufficient information does not mean absent information—would suggest that monitoring and intelligence gathering continue, but that active risk management for targeted violence is unnecessary. The presence of one warning behavior could indicate that active risk management should be pursued and specific interventions developed within the fact pattern of the individual case. Although these warning behaviors were developed to identify indicators for targeted violence, they appear to complement specific interactive patterns recently promulgated by the National Counterterrorism Center concerning ISIL- or al Qaeda-inspired violence and can function best as another investigative tool as further operational research accumulates.43
For additional information the author may be contacted at reidmeloy@gmail.com.
Dr. Meloy is a clinical professor of psychiatry at the University of California, San Diego, and a consulting forensic psychologist to the FBI.
