Terrorist Use of the Internet by the Numbers: Part II – Quantifying Behaviours, Patterns, and Processes Using Closed Sources

This post is Part 2 of 3; Part I is HERE.


Last week’s post—part I of three in this series—presented findings on convicted UK terrorists’ online behaviours from a large scale analysis based on open source data. Follow-up research on the antecedent behaviours, including online activities, of UK-based lone-actor terrorists leading up to their planning or conducting a terrorist event was subsequently undertaken and is the subject of this post. What sets this research apart from the research presented in last week’s post and the rest of the field is the privileged closed-source data that underpins the analysis.

Analysts at the UK police’s North-West Counter Terrorism Unit collected data on demographic and background characteristics and antecedent event behaviours by examining and coding information contained in police data files, psychological reports (when available), 3 interviews with case officers, intelligence reports, and open-sources for further context within each case. These data sources, unprecedented in the academic study of terrorism, were then de-identified and handed over to researchers in the Department of Security and Crime Science at University College London for this analysis. The sample composed 49 individuals who engaged in or planned to engage in lone-actor terrorism within the UK between 1995 and 2015. Included were individual terrorists (with and without command and control links) and isolated dyads.*


The lone-actor terrorists in this sample subscribed to a range of ideologies, as was also the case in last week’s post. Religiously inspired lone actors constituted the largest set of actors at 51%. This is perhaps unsurprising given how loosely connected al-Qaeda’s transnational network(s) became over time, coupled with the rise of so-called ‘Islamic State’ and their focus on lone-actor attacks. Right wing extremists constituted the second largest group, representing 30.6% of the total sample. The third largest grouping was a clustering of individuals driven by nationalist ideas (unrelated to the extreme-right wing), left-wing, and other single issue causes.

Our lone-actor terrorist sample was heavily male-oriented at 87.8%. As regards ideology, all six females were classified as jihadist-inspired.

With regard to online behaviours and activity, it was found that, in most cases, other people knew something concerning some aspect of the offender’s grievance, intent, beliefs, or extremist ideology prior to the attack or planned attack. In 26.5% of cases, the offender produced letters or public statements prior to the event outlining his/her beliefs (but not necessarily his/her violent intent); extremist online forums were the most popular choice for such pronouncements. While just over half (51%) of those in this sample interacted face-to-face with members of a wider network, an even larger number (59.2%) did so virtually.

Nearly 35% aspired, within their online postings, to copy other terrorists. In 87.8% of cases, there is evidence to suggest that the individual read or consumed literature or propaganda from a wider movement, including online. In fact, at times there appears to be direct knowledge diffusion amongst lone actors within our sample, with data suggesting that 28.6% read or consumed literature or propaganda concerning other lone-actor terrorists.

Attack training occurred in a number of ways. While just over 16% received some form of hands-on training, 81.6% learned through virtual sources. In 71.4% of cases, investigators found evidence of bomb-making manuals in the offender’s home or on his/her property.

* Individual terrorists operate autonomously and independently of a group (in terms of training, preparation and target selection etc.). In some cases, the individual may have radicalized towards violence within a wider group but left and engaged in illicit behaviours outside of a formal command and control structure. Individual terrorists with command and control links, on the other hand, are trained and equipped by a group – which may also choose their targets – but attempt to carry out their attacks autonomously. Isolated dyads include pairs of individuals who operate independently of a group. They may become radicalized to violence on their own (or one may have radicalized the other), and they conceive, develop and carry out activities without direct input from a wider network.

Although not technically ‘lone’ actors, we decided to include isolated dyads for a number of reasons. First, a key component of this project focuses upon the network qualities of terrorists who are not members of terrorist groups. Second, an initial review of our cases showed that isolated dyads often formed when one individual recruited the other specifically for the terrorist attack. The formation of a dyad, in some cases, may be a function of the type of terrorist attack planned. Finally, by including these cases, it added to our sample, making the types of inferential statistics used later more applicable.

Dr. Paul Gill is Senior Lecturer in the Dept. of Security & Crime Science at University College London, which is a VOX-Pol partner. Follow him on Twitter @paulgill_ucl.

The closed source analysis, a taster of which is supplied in this post will be published as an open access VOX-Pol report later in the year.

Leave a Reply