By Lisa Kaati and Fredrik Johansson
Lone wolf terrorists can come in a variety of shapes and backgrounds and they are in general very hard to detect before they attack. As argued by previous research, there are no clear profiles for lone wolf terrorists since they have a large variation in factors such as social status, ideology, and personality type. Even though intelligence agencies do their best to keep track of individuals who are violence-prone and have radical ideas and thoughts, it has repeatedly been shown that attacks often come from directions that are not expected beforehand, for example the attacks carried out by Anders Behring Breivik in Norway or the various attacks from born-and-raised Americans in the United States.
In this post, we will discuss how computerized decision support systems and various computational techniques can be used to analyze and understand weak signals of an upcoming terrorist attack from a lone actor. More specifically, we will mainly focus on how various kinds of social media monitoring and analysis techniques can help in this process. Before discussing this in further detail, we would like to point out that technological solutions alone are no golden bullets that will stop terrorist attacks from happening. What technical solutions potentially can accomplish or add is that they can support intelligence analysts in their work of protecting the society by detecting potential lone wolf terrorists and try to stop terrorist attacks before they take place.
Technology nearly always comes with a price and technological solutions for making the society more secure are a double-edged sword that may have implications on peoples´ privacy. More or less the same techniques that can be used in attempts to protect the society against terrorism in a democratic country may be used to monitor the opposition in a more repressive regime. It is therefore of fundamental importance that legal and ethical considerations are taken into account before using technological means for fighting lone wolf terrorism. The techniques we will discuss or suggest here are intended to have as low impact on the privacy of individuals as possible, but all kinds of social media monitoring analysis are affecting peoples‘ privacy, no matter what if the purpose is to discover potential lone wolves or if it is to market a new product.
Internet and Lone Wolf Terrorists
Internet and social media have an enormous effect on the modern society. People can search for and find information fast on nearly any topic, and it is easy to communicate and keep in touch with relatives and friends living far away. It is also easy to discuss and communicate political views and opinions using various forms of social media. Today there exist many different kinds of social media services and new services are constantly being developed.
Several terrorist organizations have a presence on the Internet and are spreading their propaganda through micro-blogs such as Twitter, social networking sites such as Facebook, and various discussion forums. According to many reports, several of the recent examples of “home-grown terrorists” have been influenced and encouraged by recruiters and motivators such as Anwar al-Awlaki (including Nidal Malik Hasan who carried out the Fort Hood shootings in the United States). The magazine Inspire, produced by Al-Qaeda in the Arabian Peninsula (AQAP) is spread worldwide using various social networks, blogs, jihadist forums, and file-sharing websites[1] . Inspire is to a large degree focusing on the recruitment and training of young Western Muslims to fight unbelievers by carrying out lone wolf attacks. Likewise, videos encouraging terrorism are spread via various social media services such as YouTube and discussion forums. The development of Internet and social media shrinks the world so that it becomes easier to communicate with like-minded, no matter if the topic for discussion is modern art or how to make a bomb in your mothers’ kitchen using household items.
There are many examples of how lone wolf terrorists have been using various forms of social media for communication and inspiration. This is of course nothing strange since very many people make use of social media. What is of interest is that the use of social media and the Internet in many cases leave digital traces that can be gathered and analyzed. The use of encryption techniques and password-secured sites may be used for exchanging sensitive information, but in most circumstances, the actual aim for the individuals or terror organizations is to reach a wider audience, making it likely that those who want to encourage violent extremism will remain using social media services that are accessible by everyone, including the intelligence services.
One example of a lone wolf terrorist who used social media is Anders Behring Breivik. Brevik made use of several different social networking sites, including Facebook and Twitter. He also posted the manifesto “2083 – A European Declaration of Independence” on the Internet before he carried out his terror attacks in Norway. An analysis of the content posted by Breivik reveals that many of his postings where indicating that he had radical beliefs. It should be noted that radical belief is not a crime, but in combination with other knowledge (such as the acquisition of chemicals that can be used for bomb making) the expression of radical beliefs could have worked as warning signs.
Another example is Mohamed Merah who in 2012 killed several Jewish schoolchildren and a Rabbi. According to Weimann[2], Merah used a camera strapped to his chest to record the killing of all his victims and posted the footages online before he was shot to death by a police sniper. Although the postings of Breivik’s manifesto and Merah’s footages were posted too late to be useful for predicting or revealing the attacks, there are many examples of how people who have carried out lone wolf attacks or school shootings have posted revealing content online way before their attacks[3]. If it was possible to detect these postings before the actual attacks the material could have served as weak signals of an upcoming attack. If purely manual means are used, it is highly unlikely to find such content but if semi-automated or automated methods for searching for this kind of material are used, the possibility to detect such material before an actual attack increases.
Keeping track of what individuals who are sending terrorism propaganda and who their followers are is at least in theory a valuable tool for finding out potential lone wolves, since even though lone wolves are carrying out their attacks in isolation, this does not mean they are not communicating with or influencing each other. In fact, according to Sageman[4], most lone wolves are part of online forums, making digital traces of uttermost importance when trying to identify threats to the society. As stated by Weimann[5] “In nature, wolves do not hunt alone: they hunt in packs. So, too, with the lone-wolf terrorists: there is a virtual pack, a social network, behind them. They may operate alone, but they are recruited, radicalized, taught, trained and directed by others”. Hence, even though they carry out their attacks on their own, this does not mean that they are not communicating with others. In fact, it is often claimed that nearly all radicalization of lone wolf terrorists is taking place on the Internet.
Social Media Monitoring and Analysis
Monitoring and analyzing various social media sites has become an important task for many different reasons. By using a variety of state-of-the-art techniques online content from social media services can be gathered and analyzed. The goal of the analysis can for example be to get information about the public opinion on a certain topic or to get information about the members and the sub-groups of a social network. When using social media monitoring and analysis to detect threats towards the society that are posed by individuals, the goal is to identify weak signals indicating that someone is planning a terror attack. A weak signal can be seen as an early warning for an upcoming event. There are few events that do not have any prior warning signs; the problem is to find the right signals and to analyze them properly.
The ability to identify weak signals that are present on the Internet requires tools for monitoring of extremist web sites and social media accounts belonging to known terrorist groups. Similar tools exist and are currently being used by companies for marketing purposes. We will here not go into any technical details on how such tools can be implemented, but rather briefly describe various functionalities that can be of importance when searching for weak signals that can be used to detect potential lone wolf terrorists in social media.
The main challenges when it comes to social media monitoring and analysis are 1) to collect data or information that may be of potential interest and 2) make further analysis of the collected information. While human analysts are much better on analyzing the actual content of text than machines are, it is a well-known fact that the amount of user-generated content on the Internet grows so quickly that it is impossible for humans to read and process all data. Various degrees of automatic processing is therefore necessary, although the final assessments and judgments always should be performed by an analyst.
Weak Signals
There are many different kinds of weak signals that might precede a terror attack that are possible to detect. For example it might be feasible to detect weak signals indicating that someone has intent to commit an attack, that someone has capability of committing an attack or that someone has opportunity to commit an attack. Typically, it is of interest to identify weak signals such as someone with radical beliefs and extreme hate, knowledge about how to produce homemade explosives, and interest in firearms and signs of rehearsal (explosive or shooting). Apart from these kinds of quite concrete signals, it is also possible to search for more complex signals that represent certain warning behaviors.
Available literature on lone wolves and school shooters shows that there are various warning behaviors that have been empirically proven to precede terrorist attacks and school shootings[1]. Meloy et al.[2] propose the following list of warning behaviors that precede acts of targeted violence, relate to targeted violence, or may predict it:
- Pathway warning behavior
- Fixation warning behavior
- Identification warning behavior
- Novel aggression warning behavior
- Energy burst warning behavior
- Leakage warning behavior
- Directly communicated warning behavior
- Last resort warning behavior
Pathway warning behaviors include the planning, preparation and implementation of an attack. Part of the planning and preparation can be the acquisition of the required knowledge and material to carry out the attack, e.g., searching and downloading material in order to learn how to build a pipe bomb or ordering fertilizers. Fixation behavior is by Meloy et al. described as behaviors indicating an increasingly pathological preoccupation with a person or a cause, which, e.g., can be instantiated as an increasingly negative characterization of the object of fixation, coupled with an angry emotional undertone. Identification warning behavior can e.g., be expressed as someone having a warrior mentality, associating closely with weapons, or identifying oneself with previous attackers or assassins. Novel aggression warning behavior relates to behavior that shows the capacity of violence, while energy burst warning behavior relates to an increase in the frequency or variety of activities related to the target when the day of attack is approaching. Leakage warning behavior is expressed when the intent of carrying out an attack is communicated to a third party, which is similar to the directly communicated warning behavior; except for that in the second case is a direct threat. Finally, last resort warning behavior can be seen as an expression of an increasing desperation or distress, where the person see no way out other than taking violent action.
While some of those behaviors are most likely to be detected using physical interaction, many of the behaviors can also be identified in social media posts or other kinds of Internet-related activities. Some of the behaviors relate to the capability to carry out an attack, some of them relate to the intent to carry out an attack, and some relate to the opportunity to carry out an attack. It is most likely that some of the warning behaviors can be identified using various automated analysis techniques. More specifically, natural language processing can be used to find out concepts to which the author seems to be fixated, or express a very negative or positive sentiment. In the same manner, by looking for word patterns containing auxiliary verbs signaling intent together with words expressing violent actions, leakage or directly communicated warning behavior may be detected. While text analysis may be very useful, it is also common that images or videos contain clues to whether someone shows warning behaviors. As an example, it is not uncommon that attackers have posted images or videos where they pose with weapons long before they have carried out their attacks. For detecting such information, various content-based image retrieval algorithms can be applied, even though they so far have a too low accuracy to be used with high precision in large-scale environments.
Computer support is an important component when analyzing social media due to the enormous amount of information that is available. The development of natural language processing techniques make it possible to at least in theory extract various weak signals and warning behaviors such as if someone is planning and preparing an attack, identifies oneself with previous attackers, or express very negative or hateful sentiments toward certain groups of people. By combining the domain knowledge of social scientists, the psychological aspects from psychologist and the technical knowledge from computer scientists it is possible to design algorithms and analysis methods for large scale computerized qualitative analysis.
Privacy
Searching and collecting digital traces on the Internet can of course be seen as a threat towards peoples’ privacy. There is nearly always an ongoing debate about privacy issues when it comes to surveillance (whether it is about surveillance cameras, wiretapping or looking into bank account details data). Just because something is possible or doable, it does not necessarily mean it is a good idea. Social media monitoring is associated with several privacy concerns, and we can expect this debate to continue in the future. We are not attempting to present any solutions to how to find the right balance between privacy and security. Rather, we are here only attempting to present techniques that could be efficient for finding lone wolf terrorists. Before such techniques are implemented and put into use, it is extremely important to investigate all issues regarding privacy versus security more carefully to make sure that all aspects of this problem are considered, as well as looking at the problem from legal and ethical point of views.
Fredrik Johansson is a senior researcher at the Swedish defence research agency (FOI) and Lisa Kaati is a senior researcher at the Swedish defence research agency (FOI) and the director Arena security at Uppsala University. This post is part of the chapter “Countering Lone Wolf Terrorism: Weak Signals and Online Activities” in the book Understanding Lone Actor Terrorism – Past Experience, Future Outlook, and Response Strategies edited by Michael Fredholm
[1] Edan Landau,”And Inspire the Believers”, International Institute for Counter-Terrorism, IDC Herzliya, Israel, 2012.
[2] Gabriel Weimann , ”Lone Wolves in Cyberspace”, Journal of Terrorism Research, vol. 3, issue 2, 2012.
[3] Alexander Semenov, Jari Veijalainen, Jorma Kyppö, “Analysing the presence of school-shooting related communities at social media sites”, International Journal of Multimedia Intelligence and Security, vol. 1, issue 3, 2010.
[4] Marc Sageman, “Understanding Terror Networks”, University of Pennsylvania Press, 2004.
[5] Gabriel Weimann , ”Lone Wolves in Cyberspace”, Journal of Terrorism Research, vol. 3, issue 2, 2012.
[6] Katie Cohen , “Who will be a lone wolf terrorist?” Technical report: FOI-R—3531—SE, 2012
[7] Reid Meloy, Jens Hoffmann, Angela Guldimann, David. James , ”The Role of Warning Behaviors in Threat Assessment: An exploration and Suggested Typology”, Behavioral Sciences and the Law, vol. 30, issue 3, pp. 256-279, 2012.