No one will ever forget the September 11th terrorist attacks: nearly 3,000 dead, two towers felled, a War on Terror waged.[1] Or the 2008 Mumbai assaults. A series of terrorist actions across India’s largest city killed 175 people, injuring at least 300 more.[2] Or the 2015 incursions in Paris. Roughly 130 people died and more than 400 were injured when suicide bombers and others attacked theatres, restaurants, and the Stade de France.[3]
These events have seared global memory.
Less often remembered are the smaller acts of terrorism that more frequently occur across the globe. In 2023, a Tunisian National Guard member opened fire at a pilgrimage to the El Ghriba Synagogue in Djerba, killing five people.[4] Later that same year, a terrorist killed one man and injured two others in a knife-and-hammer assault near the Eiffel Tower.[5] In two separate occurrences on London Bridge, terrorists stabbed 10 people to death.[6]
Terrorism — ideologically or politically motivated acts of violence perpetrated against non-combatants — is a worldwide malady. It takes two forms: coordinated attacks committed by organized cells, networks or groups; and smaller attacks typically committed by “lone wolf” terrorists. Elimination of terrorism depends on investigators’ ability to spot and stop both types of actors before the violence starts. The use of open-source intelligence (OSINT) can help.
Investigating terrorism by type
Combatting terrorism is a complex, multi-pronged effort, typically involving strategies and tactics coordinated by a variety of government agencies. These agencies strive for national collaboration, and to share intelligence with similar agencies operating in their ally countries across the globe.
Programs run the gamut from traditional investigations and physical surveillance (such as CCTV monitoring) to community engagement. In virtually all cases, digital intelligence is a vital component of counterterrorism efforts. Investigative agencies monitor the internet, particularly social media and dark web forums, to track the communications and activities of suspected terrorists.
What are they looking for? What are the signs of a potential terrorist at work?
The answer is: It depends. Organized terrorist groups and lone wolves use the internet in different ways.
Penetrating organized terrorist groups
Organized terrorist networks, cells, and groups use social media platforms and dark web forums for the dissemination of propaganda, for planning, and for general communications.
Take Hamas as an example. Hamas is a political/military organization governing the Gaza Strip. Many nations (including the United States, the United Kingdom, and member nations of the European Union)[7] consider Hamas a terrorist organization. Hamas used the popular messaging app Telegram as one of its primary communications platforms. Some Hamas-dedicated channels had hundreds of thousands of users and contained calls to action for Hamas members.[8] (Under intense political pressure, Telegram eventually shut down these channels.[9])
But for Hamas and similar organizations, online communications cannot replace real-world recruitment, radicalization, and training.
To bolster their numbers, members of organized terrorist organizations engage in face-to-face recruitment of friends, family, and neighbors. They exploit potential recruits’ existing political and religious views and grievances. They target the disenfranchised — including young people and people suffering from poor mental health — with promises of comradeship. They imbue potential recruits with a sense of purpose.
Recruits typically become members though a radicalization process that occurs in real-world locales. Hamburg’s Blue Mosque is one example. In 2023, Germany’s Federal Administrative court upheld a ruling that the mosque operates as a “extremist Islamic organization” pursuing “anti-constitutional objectives.”[10] At the mosque and similar sites worldwide, recruits are subject to intensive ideological education. Camps and safehouses provide physical space for training in weapons, explosives, and guerrilla warfare. Larger terrorist groups typically have an almost martial chain of command, and, as members rise through the ranks, they learn how to plan and execute terrorist acts.[11]
Online communications and recruiting activities constitute only one part of an organized network’s recruitment and training strategy. Still, it’s an important part. And because law enforcement now so closely monitors suspected terrorist sites in the physical world, counterterrorism organizations believe that organized groups’ reliance on the internet will only grow.
Tracking lone wolves
Lone wolves typically don’t use the internet as part of a broader terror strategy. Rather, the digital arena may provide these terrorists with their sole connection to the extremist ideologies of like-minded people. And this connection need not be “live.” While chatroom interactions certainly inspire would-be lone-wolf terrorists, so do static encounters such as reading extremist blogs or watching terrorist videos.
“Lone wolves” are defined as one or two terrorists working without the assistance of an organized terrorist network. They often prove hard for law enforcement to spot.
Counterterrorism professionals monitor known terrorist locales — physical and virtual. In Germany, they watch the Blue Mosque. In the United States, they can follow the comings and goings at known militia compounds: Elohim City in Oklahoma, the Bundy Ranch in Nevada, the Aryan Nations Compound in Idaho.[12] Online, investigators monitor chat sites and dark web forums where members of organized terrorist groups congregate.
But a lone wolf typically has no physical location to visit, no organized group to exchange instant messages with, no elders to consult. He may independently decide, as one terrorist did, to strap on an automatic rifle and shoot up a Washington, D.C. pizzeria in an attempt to save the non-existent victims of a fictious child sex-tracking ring while simultaneously exposing the political leaders he believed to be running the apocryphal cabal.[13]
It is important to note that while lone wolves may have no direct contact with organized terrorist networks, organized terrorist groups regularly institute one-way communications with the public. They do this to create lone wolves dedicated to terrorist causes.[14] In this way, organized terrorist organizations behave much like spammers. Spammers know that if you email enough people, someone, somewhere, will believe you’re a Nigerian prince willing to share your untold millions for a small processing fee. Similarly, terrorists believe that if you produce enough propaganda, you’ll convert someone to your cause. Two such converts may have been the perpetrators of the 2015 mass shooting at a San Bernadino disability center. The husband-and-wife shooters, an American citizen and a United States green card holder, had pledged their allegiance to ISIS leader Abu Bakr al-Baghadi.[15] Fourteen people died in the attack.
In addition to merely inspiring would-be lone-wolf terrorists, the internet provides them with information needed to commit their crimes. In the past, a terrorist may have wanted to blow up St. Peter’s Basilica, but have no idea how to do so. Today, The Anarchist’s Cookbook is available as a free PDF download. You can search the internet for instructions on “how to build a bomb.” You can buy precursor chemicals online. (In the United States, FBI Operation Tripwire works closely with gun store owners, chemical companies and others to track questionable shipments.) You can purchase illegal weapons on the dark web.
Lone-wolf terrorism now “poses a serious emerging threat to the United States.”[16] How serious? Consider this. In many cases, lone wolves become lone wolves because they are too radical for more established anti-government or terrorist populations.[17] Oklahoma City bomber Timothy McVeigh is an example. He considered joining the Michigan Militia, a private paramilitary organization opposing what it views as overreach by the United States government. McVeigh reportedly found the group insufficiently radical and quit after only a few meetings.[18]
Clearly, technological innovations have helped create, inform, and arm lone-wolf terrorists. But counterterrorism professionals can also use technology to find them, and to stop them. OSINT — or intelligence gleaned from the processing and analyses of publicly available information and commercially available information (PAI/CAI) — helps counterterrorism professionals find and react to these activities. When used in conjunction with prevalent counterterrorism technologies such as closed-circuit television, facial recognition, and biometrics, OSINT can potentially stop terrorism before it starts.
OSINT technologies detect lone wolves’ activities on social media. They can spot lone wolves who often:
- Enter chat rooms devoted to fringe or terrorist causes
- Create Facebook pages dedicated to their beliefs
- Post videos
- Blog
- Write manifestos, and publish them online
- Publicly discuss their travel to red-flag countries
- Openly complain about their expulsion from organized radical or extremist groups
All these activities may signify future terrorist action.
Why Babel Street?
Babel Street Insights is an OSINT solution providing persistent searches of a vast array of PAI and CAI sources. These include more than a billion top-level domains, along with real-world interactions generated on chats, social media posts, online comments, and message boards. Insights understands more than 200 languages (including Arabic, Chinese, Russian, and other languages rendered in non-Latin scripts), and translates information found into the user’s language of choice.
These capabilities help counterterrorism professionals:
Detect extremism and stem recruitment
Babel Street Insights continuously monitors social media sites and the dark web for signs of recruiting activity. It rapidly detects evidence of recruitment campaigns — including distorted narratives, deepfakes, and bot amplification. Its natural language processing capabilities also reveal influence operations unfolding across social media sites worldwide. Its algorithms can extract signs of extremism percolating in written materials, videos, chat communities, and technical forums. Using Insights, counterterrorism analysts can pinpoint influence cells that are manipulating perceptions and conversations. With this information in hand, they can mobilize targeted counter-messaging.
Analyze terrorist networks
Babel Street Insights can help unravel terrorist networks, cells, and groups. Insights extracts terrorism clues from online communications. Understanding standard languages, regional dialects, and slang, Insights algorithms detect coded language, threats, and other terrorism indicators.
Babel Street Insights Synthesis
Babel Street Insights Synthesis can help map relationships among terrorists, and among terrorists and those they try to recruit. Synthesis charts key connections among people, locations, and events. To do so, it examines hundreds or thousands of associations within a specific social network or discussion group, uncovering previously unknown or hidden relationships, and identifying those participants who wield the most influence. (Visualizations of these relationships are also provided.) Once influencers are identified, Babel Street Synthesis empowers users to delve deeper into those influencers’ online profiles, activities, and associates.
Dismantle terror plots
Much as Babel Street Insights helps spot radicalization efforts, it can also empower analysts to find and dismantle terrorism plots. Babel Street Insights’ search capabilities help counterterrorism professionals infiltrate dark web forums, chatrooms, and other sites where terrorists gather. There, they can uncover coalescing threats — pinpointing extremists discussing potential targets, weapons sourcing, maneuvers, and vulnerabilities. Using this insight, counterterrorism professionals can disrupt or halt these activities.
Track and stem the flow of money
Organized networks, cells, and groups need cash for major, coordinated acts of terror. According to the U.S. Department of the Treasury’s 2024 report on terrorist financing,[19] they have no problem asking for it. “The most common financial connections between individuals in the United States and foreign terrorist groups entail individuals directly soliciting funds for, or attempting to send funds to, foreign terrorist groups utilizing cash, registered money services, businesses, or in some cases, virtual assets,” the report says. Terrorists and their sympathizers solicit funds from “witting and unwitting donors worldwide.”[20]
Babel Street Insights can spot these solicitations when they are instituted or conducted via social media, in chatrooms, or on the deep web. With this visibility, government agencies can take appropriate action. In addition, Babel Street Insights anti-money laundering solutions are already in use at banks worldwide, helping bank investigators better comply with AML mandates. In doing so, Babel Street Insights helps to significantly reduce instances of terrorist financing.
These capabilities are not theoretical. Before the 2023 Formula 1 Grand Prix in Las Vegas, a private security firm worked with Babel Street to uncover and mitigate risks to the venue, guests, and drivers. Babel Street was able to help this firm identify a group of individuals, based in Las Vegas, who planned to disrupt the event. Babel Street accomplished this by uncovering patterns and connections among these individuals. These connections were hidden within massive data sets. That same year, a Babel Street client spotted a post in which the writer threatened a mass shooting — even naming the individuals he planned to target. Using pivotal information generated by Babel Street Insights, law enforcement officials tracked down the would-be murderer. The man, who had access to firearms and hand grenades, was arrested before he could put his plan into action.
More recently, Babel Street worked with the Institute for the Study of War to develop an analysis of the Hamas order of battle. (“Order of battle” is a military term used to tabulate units, commanders, and equipment in a theater of operations, and to track armed forces and machinery across a specific geographic area.) Calling on Babel Street Insights’ ability to surface a wide range of observations from PAI and CAI, the Institute was able to better investigate five Hamas brigades and their subordinate battalions; assess Hamas strength, and identify commanders
Spotting and stopping terrorists — whether organized cells or lone wolves — is vital to ensuring the safety of nations and individuals worldwide. By delivering advanced data and analytics solutions that transform diverse data sources into actionable insights, Babel Street can help the counterterrorism cause.
End Notes
1. Blinken, Anthony J., “Press Statement: 22nd Anniversary of the September 11, 2001 Attacks,” United States Department of State, September 2023, https://www.state.gov/22nd-anniversary-of-the-september-11-2001-attacks/#:~:text=On%20September%2011%2C%202001%2C%20terrorists,homeland%20in%20our%20nation's%20history
2. Wikipedia, “Mumbai Attacks,” accessed July 2024, https://en.wikipedia.org/wiki/2008_Mumbai_attacks
3. Wikipedia, “November 2015 Paris Attacks,” accessed July 2024, https://en.wikipedia.org/wiki/November_2015_Paris_attacks
4. Ministère De L’Europe Et Des Affaires Ètrangères, “Tunisia – Attack in Djerba,” accessed July 2024, https://www.diplomatie.gouv.fr/en/country-files/tunisia/news/article/tunisia-attack-in-djerba-10-05-23
5. BBC, “Paris attack near Eiffel Tower leaves one dead and two injured,” December 2023, https://www.bbc.com/news/world-europe-67604591
6. BBC, “London Bridge: What we know about the attack,” December 2019, https://www.bbc.com/news/uk-50594810
7. Wikipedia, “Hamas,” accessed July 2024, https://en.wikipedia.org/wiki/Hamas#:~:text=Argentina%2C%20Australia%2C%20Canada%2C%20Israel,to%20condemn%20Hamas%20was%20rejected
8. Allyn, Bobby, “The Telegram app has been a key platform for Hamas. Now it's being restricted there,” NPR, October 2023, https://www.npr.org/2023/10/31/1208800238/the-telegram-app-has-been-a-key-platform-for-hamas-now-its-being-restricted-ther#:~:text=Now%20it's%20being%20restricted%20there,-October%2031%2C%202023&text=Matt%20Slocum%2FAP-,Telegram%20has%20removed%20popular%20Hamas%2Dlinked%20accounts%20from%20the%20messaging,to%20take%20down%20the%20channels.
9. Ibid
10. VOA News, “German Court Categorizes Islamic Center as ‘Extremist Islamic Organization’,” July 2023, https://www.voanews.com/a/german-court-categorizes-islamic-center-as-extremist-islamic-organization-/7163231.html
11. Simon, Jeffrey D., “Lone Wolf Terrorism,” Prometheus Books, 2013
12. Ibid
13. Wikipedia, “Pizzagate conspiracy theory,” accessed July, 2024, https://en.wikipedia.org/wiki/Pizzagate_conspiracy_theory
14. Simon, Jeffrey D., “Lone Wolf Terrorism,” Prometheus Books, 2013
15. Ahmed, Saeed, “Who were Syed Rizwan Farook and Tashfeen Malik?” CNN, December 2015, https://www.cnn.com/2015/12/03/us/syed-farook-tashfeen-malik-mass-shooting-profile/index.html
16. Simon, Jeffrey D., “Lone Wolf Terrorism,” Prometheus Books, 2013
17. Ibid
18. Ridley, Gary, “Michigan Militia still active 20 years after Oklahoma City bombing,” Michigan Live, April 2015, https://www.mlive.com/news/flint/2015/04/militias_remains_active_20_yea.html
19. U.S. Department of the Treasury, “2024 National Strategy for Combating Terrorist and Other Illicit Financing,” May 2024, https://home.treasury.gov/system/files/136/2024-Illicit-Finance-Strategy.pdf
20. Ibid
Disclaimer:
All names, companies, and incidents portrayed in this document are fictitious. No identification with actual persons (living or deceased), places, companies, and products are intended or should be inferred.
