Islamic State’s Virtually Planned Terror Plots: A Note on Current and Future Research

Earlier this month (9 Nov.), Hassan Khalif Shire Ali (30) carried out a terrorist attack on Bourke Street mall in Melbourne, Australia in which he stabbed one person to death and injured two others. Attention immediately turned to whether Shire Ali was in direct–potemtially online–contact with so-called ‘Islamic State’ (IS). The Australian Federal Police later said it was believed Shire Ali was “inspired” by Islamic State rather than having direct links with the organisation.

In this week’s Blog post, Australian PhD researcher Andrew Zammit provides an overview of recent research on virtually planned terrorist attacks, with an emphasis on Australian plots and attacks. He also has a follow-up piece on the AVERT Network‘s site asking ‘Which Australian terrorist plots have been directly connected to Islamic State, and how?‘ [Ed.]

By Andrew Zammit

Journalists, scholars and counter-terrorism practitioners have recently drawn attention to a particular strain of Islamic State terror attacks which have been described as “virtually planned”.

This refers to terror plots where the perpetrators are guided through sustained online communication with Islamic State operatives who provided encouragement, instructions or advice. These plots are also characterised by the absence of physical connections that might make them more directly planned than the term “virtual” would imply, such as one of the perpetrators having trained or fought with Islamic State.

Thomas Hegghammer and Petter Nesser appear to be the first authors to note this as a distinctive type of plot. In 2015 they created a six-part typology to categorise jihadist plots in the West, and Type 4 was “remote communication with directives”. From 2016 onwards authors  such as Daveed Gartenstein-Ross, Madeleine Blackman, Nathanial Barr, Bridget Morang, Rukmini Callamachi, Kim Cragin and Ari Weil popularised the term “virtual planning” to describe these plots.

Other authors explored the same concept but used different terms. Thomas Jocelyn and Peter Neumann described them as “remote-controlled” plots, Seamus Hughes and Alexander Melagrou-Hitchens referred to “virtual entrepreneurs” (capturing that Islamic State’s virtual planners also play a number of online roles other than plotting attacks, such as providing advice on how to travel to Syria) while John Mueller used the term “cyber coaching” (to refer specifically to virtual planners teaching the perpetrators which methods to use for their attacks). I tend to stick with “virtual planning”, and explored Australian examples with articles on the 2015 Anzac Day plot and the alleged 2017 Sydney plane plot.

Since then, Katrina Zorzi and I have been doing quite a bit of research on virtual planning, as a side-project, to interrogate and contribute to the further development of the concept. We’re looking at the extent to which such plots are genuinely new, widespread, and significant, and what they tell us about various debates within terrorism studies, such as those over online radicalisation and lone wolves. We also hope to examine how virtual planning has created opportunities for women to be more involved in Islamic State’s external attacks, even during periods when their propaganda appeared to eschew combat roles for women, and if broader contextual factors have helped enable the development of virtually planned attacks. We’re also interested in what aspects of Islamic State’s strategy and military doctrine made it particularly open to adopting this approach, and why other jihadist organisations have so far used this approach far less (which also involves revisiting al-Qaeda’s small number of virtually planned attacks).

We will post some intermittent updates about it on this blog, but first I wanted to share this table summarising existing estimates of how widespread such plots are.

This table lists the number of virtually planned plots various authors have noted in particular regions at particular times, and where possible how large a proportion of all Islamic State-associated attacks they accounted for.  At the end of the table I added my own estimates for Australia.

Table I

Not all the figures in these articles match up. For example, Cragin and Weil state that that Islamic State carried out fifty-one virtually planned plots across the world (that is, in countries that did not contain an Islamic State Wilayat) between January 2014 and December 2017, and that seventeen of these were in the West. However, the figure of seventeen seems too low given evidence of six virtually planned plots in Australia, sixteen in Europe and eight in the United States, either within the same time period or within even shorter periods.

Nonetheless, these various sets of figures indicate that Islamic State’s virtually planned terror plots have been quite prevalent, amounting to between a fifth and half of all Islamic State plots depending on the region.

It will be interesting to how Islamic State’s loss of territory inside Syria and Iraq changes that. I’ve previously expressed scepticism that this territorial loss will have much impact on virtually planned attacks, on the grounds that that “virtual encouragement or direction has been provided to plotters in the West by individuals in Somalia, Libya, and the United Kingdom”, but I hope that scepticism turns out to have been misplaced.

[1] For Europe, Nesser, Stenersen and Oftedal’s did not explicitly estimate the number of virtually-planned attacks, but noted that nineteen of their plots involved “involve online instruction from members of IS’s networks”. Three of these nineteen involved returned foreign fighters, but the remaining sixteen fit the criteria for virtually planned plots. See their article here along with Appendix 1 and Appendix 2.

[2] For Australia, my estimate of six virtually-planned plots from January 2014 to December 2017 is based on the February 2015 Sydney plot (NSW JCTT Operation Castrum), the 2015 Anzac Day plot (Vic JCTT Operation Rising), the 2015 Mother’s Day plot (Vic JCTT Operation Amberd), the 2016 Anzac Day plot (NSW JCTT Operation Vianden, but this is an extremely tentative inclusion), the alleged September 2014 Sydney plot (Operation Appleby) and the alleged July 2017 Sydney plane plot (NSW JCTT Operation Silves). My estimate of nineteen total IS-associated plots in Australia during this period is based on the sixteen incidents listed here along with the June 2017 Brighton siege, the alleged July 2017 Sydney plane plot, and the alleged November 2017 Melbourne plot.

Update 1: I have now removed the 2016 Anzac Day plot, which was tentatively included based on reports of possible instructions the perpetrator received from abroad. Last week he was sentenced and it turns out both of the people he was communicating with overseas were undercover police officers (see paragraphs 11-13 of his sentencing). For this reason, it cannot be counted as one of the Islamic State’s virtually planned plots, so my estimate for such plots in Australia during this period has changed from six to five, and I have updated the table to account for this.


Andrew Zammit is a PhD candidate at Monash University, researching political violence. You can follow him on Twitter: @Andrew_Zammit

This article was originally published on AndrewZammit.org website. Republished here with permission from the author.

Leave a Reply