This post is Part 1 of 3.
Background
Previous research on terrorist use of the Internet generally discusses the opportunities offered by the Internet to terrorist groups. Such accounts implicitly view the interaction between the Internet and the user as uni-directional (i.e. exposure to Internet content may cause behaviour change). This lacks an acknowledgement that not every potential user will make use available opportunities, nor use these in the same way. The degree to which an individual makes use of an opportunity is modulated based upon their goals, plans, values, beliefs, and experiences.
At present, there are only three data-driven studies examining how convicted terrorists have used the Internet: Von Behr et al., 2013, Gill et al., 2014, and Gill and Corner 2015. These studies shift the focus from the Internet as a potentially causal factor to how individuals use the Internet based upon their motivations, needs, expectations, and histories. They acknowledge, in other words, the way in which the interaction between Internet and user is a two-way person-situation interactive process in which the individual leads the way.
In this post we summarise a large scale analysis based on open source data that builds significantly upon the above-described research.
Data and Methods
For the purposes of this research, a database of 223 terrorist actors who were either convicted or died in the commission of a terrorist act in the UK between 1990 and 2014 was constructed and coded for the presence or absence of a number of Internet-related activities. Early IS-related activities and Simcox et al’s (2011) list of al-Qaeda-inspired individuals were collapsed into one Jihadist-inspired actor category (updated to the end of 2014). Additional individuals were identified through tailored search strings in LexisNexis, the Global Terrorism Database (GTD), publications on UK right-wing extremism, and previous studies on lone-actors (e.g. Gill et al., 2014).
The variables analysed span sociodemographics, network behaviours, event-specific behaviours, and post-event behaviours and experiences. Data were collected using open-source news reports, sworn affidavits, publicly available first-hand accounts, online public record depositories, terrorist biographies, and scholarly articles. The procedures in Gruenewald et al. (2013) were followed to compare actors who engaged in online activities with those who did not.
Results
The sample consisted of both jihadists (89%) and right-wing extremists (11%). The offenders captured in this database were overwhelmingly male (96%), ranging in age from 16 to 58 (mean = 28). One third were unemployed at the time of their arrest/attack; one third worked in service or administrative sectors. Fourteen per cent were students, with 22% having a university education.
Half of convictions related to a planned attack, half to facilitative behaviours (e.g. financing, distributing propaganda), and 14% to a completed attack. Sixty two per cent were associated with wider networks of co-ideologues, 83% with an attack cell. Twenty two per cent attended a terrorist training site, and 9% had front-line experience in foreign insurgencies.
In 61% of cases, there was evidence of online activity related to radicalisation and/or attack planning. Fifty four per cent used the Internet to learn about some aspect of their intended activity, with an increase to 76% from 2012 onwards.
According to open-sources, extremist media was found or downloaded by 44% of perpetrators. Half of the content was reportedly videos, with smaller percentages reported for audio lectures and photographs. Content included montages of 9/11 and attacks on Western coalition forces; executions; crimes against Muslims; radical speeches; terrorist training videos, etc.
Thirty two per cent prepared for attacks by accessing online resources such as bomb-making and suicide vest instructions, maps of iconic sites, MP voting records, and terrorist training manuals. At least 30% accessed extremist ideological content online, with some collecting an excessive—even unmanageable—amount of such information. Fourteen per cent of offenders opted to engage in violence after witnessing something online.
Twenty nine per cent of actors communicated with other radicals through email, discussion forums, or chat rooms. Interactions regarded matters such as the legitimacy of target selection and intricacies of carrying out an attack.
Fifteen per cent of actors disseminated propaganda online, while others attempted to publish manuals concerning weapons in order to incite others. One in ten of the sample used online resources to overcome hurdles they faced in attack planning.
While a third of the sample prepared for some aspect of their attacks online, 9% specifically chose their target after conducting online research. Six per cent of perpetrators provided material support (money donation, selling of material) to others online. Five per cent sought legitimisation for future actions from religious, social, or political authority figures online. Five per cent signalled via the Internet plans to engage in attacks. In most plots, the above outlined activities were concurrent.
In the vast majority of cases, the number of times actors utilised Internet sources or exact hours spent online was impossible to determine. Isolated cases do provide insight, but this is variable and not generalisable.
Those who planned an attack (as opposed to providing material support), conducted a lethal attack, committed an improvised explosive device (IED) attack, committed an armed assault, acted within a cell, attempted to recruit others, or engaged in non-virtual network activities and place interactions were significantly more likely to learn online compared to those who did not engage in these behaviours.
Extreme right-wing offenders were 3.39 times more likely to learn online than Jihadist inspired individuals. Those who plotted to attack a government target were 4.50 times more likely to learn online, and 83% of this subgroup displayed online learning traits. Those who used/planned to use an IED were 3.34 times more likely to have learned online, reflecting complexity in IED manufacturing and the availability of online bomb-making manuals / demonstrations. Those who used more primitive attack types, e.g. arson, were significantly less likely to have learned online.
Lone actors were 2.64 times more likely to learn online than members of a cell and lone actors who tried to recruit others were 5 times more likely to have learned online.
Those who learned online were 4.39 times more likely to have experienced non-virtual network activity and 3.17 times more likely to experience non-virtual place interaction.
Of those who plotted an attack, the individuals who attended training camps were significantly more likely to have learned online. Those targeting the military and using knife attacks were significantly less likely to communicate online.
Extreme right-wing offenders were 2.41 times more likely to have communicated online with co-ideologues than Jihadist inspired individuals. Communicating with co-ideologues online was significantly more likely to have been accompanied by face-to-face interactions with non-violent co-ideologues. Those who communicated online were 3.89 times more likely to have experienced non-virtual network activity and 3.17 times more likely to experience non-virtual place interaction. Of those who plotted an attack, individuals who attended training camps were significantly more likely to have communicated online.
Violent extreme-right movements in the UK tend to use the Internet for recruitment, communication, and information dissemination (Thornton, 2015), which may explain the disparity in online communications across ideologies. Extreme-right wing offenders’ had greater propensity to use extremist online forums. There was no difference in terms of email or chat room usage, or in extreme-right wing actors’ propensity to communicate online with other cell members or terrorists. A final predictor of this disparity was extreme right offenders’ greater likelihood of having used the Internet to disseminate propaganda compared to radical Jihadists. There was no significant difference in terms of reinforcing prior beliefs, seeking legitimisation for future actions, disseminating propaganda, providing material support to others, or attack signalling.
Dr. Paul Gill is Senior Lecturer in the Dept. of Security & Crime Science at University College London, which is a VOX-Pol partner. Follow him on Twitter: @paulgill_ucl
The open source analysis synopsised in this post was first published as an open access VOX-Pol report entitled What are the Roles of the Internet in Terrorism? Measuring Online Behaviours of Convicted UK Terrorists in November 2015. A revised and updated version of that report appeared under the title ‘Terrorist Use of the Internet by the Numbers: Quantifying Behaviors, Patterns and Processes’ in the scholarly journal Criminology and Public Policy in January 2017.