A Mixed Method Examination of Law Enforcement Investigatory Strategies Used in Jihadi and Far-right Foiled Terrorist Plots Before and After 9/11

Article (PDF Available) · December 2017with 78 Reads
Cite this publication
A Mixed Method Examination of Law Enforcement Investigatory Strategies Used in Jihadi
and Far-right Foiled Terrorist Plots Before and After 9/11
Manuscript prepared for the Journal of Qualitative Criminal Justice and Criminology (JQCJC)
(forthcoming in the special issue on terrorism and extremism).
Manuscript with copy edits accepted on 12.11.2017
*Brent R. Klein
School of Criminal Justice
Michigan State University
655 Auditorium Rd. Room 557
East Lansing, MI 48824
Jeff Gruenewald, PhD
School of Public and Environmental Affairs
Indiana University-Purdue University, Indianapolis
Steven M. Chermak, PhD
School of Criminal Justice
Michigan State University
Joshua D. Freilich, JD; PhD
Department of Criminal Justice; Doctoral Program in Criminal Justice
John Jay College, CUNY
*Corresponding Lead Author
Funding Acknowledgment: This research was funded by grants from the U.S. Department of Homeland
Security (DHS) Science and Technology Directorate’s University Program Division; and the Resilient
Systems Division both directly and through the National Consortium for the Study of Terrorism and
Responses to Terrorism (START). Funding was also provided by a grant from John Jay College's Office
of Advancement of Research. The views and conclusions contained in this document are those of the
authors and should not be interpreted as necessarily representing the official policies, either expressed or
implied, of DHS, START or John Jay College.
Empirical research on the law enforcement strategies used to prevent terrorism has increased
since the September 11, 2001 terrorist attacks. Yet, few studies have examined how these
preventative approaches vary based on terrorists’ ideological affiliations and across time. This
study thus explores the similarities and differences in law enforcement investigatory strategies
used to thwart global jihadi and far-right terrorist violence prior to and since the 9/11 terrorism
events. Employing a convergent parallel mixed method research design, our study analyzes both
quantitative and qualitative data on 86 terrorism enterprise investigations from the U.S.
Extremist Crime Database (ECDB). The quantitative data analyses examine patterns relating to
how investigations are initiated, the agencies involved, and the roles of human intelligence in
foiling terrorist violence. Complementary qualitative case narratives are then used to explore in
more detail the investigatory process for a subset of cases. We discuss several noteworthy
findings that have implications for both law enforcement practitioners as well as future scholarly
Since 2001, homeland security efforts in the United States have understandably been
oriented toward disrupting global and homegrown jihadists and preventing the next 9/11 terrorist
attacks. After 9/11, the Federal Bureau of Investigation (FBI) made thwarting terrorist attacks its
top priority and state, local, and tribal (SLT) law enforcement were asked to become active
participants in the national counterterrorism mission. Nonetheless, it is invariably the terrorist
attacks that come to fruition and are successfully executed which capture the attention of media
and policymakers. Despite a dramatic increase in empirical terrorism studies published since
9/11, few scholarly studies highlight the characteristics of terrorism plots and almost no work
explores what law enforcement do to foil them. Consequently, little is known about the general
attributes of terrorist plots, such as the agencies involved and the strategies used, or about the
nuanced investigatory processes encompassing how plots are initiated and unfold. Further,
research has yet to explore how the nature of investigations may have changed over time,
specifically since 9/11, and differ by the type of terrorists being investigated. In other words,
how might investigations of jihadists since 9/11 compare to those of far-right terrorists who were
increasingly active during the 1990s and have reemerged as a serious threat to the U.S.?
We address these questions by examining 86 violent terrorist plot investigations from the
U.S. Extremist Crime Database (ECDB), an open-source project that contains systematically
codified data as well as thousands of pages of raw information for each plot (Freilich, Chermak,
Belli, Gruenewald, & Parkin, 2014). While interested in overall patterns of terrorism
investigations, we also compare the similarities and differences in how law enforcement agencies
foil terrorist plots involving far-right and global jihad terrorists before and after the 9/11 terrorist
attacks. Employing a convergent parallel mixed-method design, we utilize quantitative and
qualitative methods to explore the investigatory strategies used by law enforcement to thwart
terrorist attacks in the U.S. Quantitative, descriptive analyses are conducted to uncover general
patterns of plot investigations across time and terrorist ideology. We also conduct
complementary qualitative analyses to develop a more comprehensive understanding of dynamic
investigatory processes – including sequenced interactions between law enforcement, terrorists,
and their situated environments – involved in foiled terrorist plots.
Background and Prior Research
Law enforcement practices were significantly impacted by the 9/11 terrorist attacks
(Davis, Pollard, Ward, Wilson, Varda, Hansell, & Steinberg, 2010; Gruenewald, Klein, Chermak
& Freilich, 2016), but little is known about if and how relevant changes have impacted the
strategies used to foil terrorism plots. Key changes, for example, include the FBI altering its
reactive, crime-fighting focus to make preventing terrorism its top priority (Bjelopera, 2013),
while expanding domestic and international counterterrorism efforts. Other significant post 9/11
changes within the FBI include the hiring of a large number of agents and intelligence analysts,
restructuring of the organization, revamping training strategies, and attempts to improve
engagement with the intelligence cycle (Cumming & Masse, 2004). In addition to these
organizational changes, revisions to the U.S. Attorney General Guidelines in 2002 and 2008
removed restrictions to provide the FBI with more discretion to proactively initiate long-term
investigations on persons suspected of plotting terrorist acts against the U.S. (Berman, 2011). At
the same time, the passage of the USA Patriot Act gave agents more power to conduct secretive
searches, monitor modern forms of communication, and access third-party records to intercept
terrorist plots (Bjelopera, 2013). Identifying sharing gaps across the nation’s fragmented law
enforcement structure, policies and procedures were changed to significantly expand the role of
SLT law enforcement agencies, fundamentally changing how information is shared both
horizontally and vertically between agencies (Carter, Carter, & Chermak, 2013; Carter, Carter,
Chermak, & McGarrell, 2017). In response, many SLT law enforcement agencies have since
expanded their intelligence gathering practices, and there have been fundamental changes in the
national, state, and local information sharing infrastructure.
American SLT law enforcement agencies remain concerned about affiliates of both far-
right extremism and jihadism (Chermak, Freilich, & Simone, 2010; Freilich, Chermak, &
Simone, 2009; Levitt, 2017). Findings from the U.S. Extremist Crime Database (ECDB) reveal
that supporters of Al Qaeda and affiliated movements committed over 45 homicide incidents that
claimed over 3,000 lives since 1990. Far-right terrorists have committed over 190 ideologically
motivated homicide events claiming over 450 lives in this same period (Freilich et al., 2014).
Strom et. al (2017), who studied terrorism plots foiled between 1995 and 2012, conclude that
both jihadists and far-rightists accounted for the majority of actors planning to attack the U.S.
and that each ideological movement engaged in a similar number of the identified plots.
Importantly, though, scholars have yet to investigate whether distinct investigatory
strategies are utilized for intercepting terrorists who are driven by different ideologies. Extreme
far-rightists and jihadists have attacked, or have planned to attack, a diverse list of targets using
various strategies (Drake, 1998; Kaplan, 2012; Legault & Hendrickson, 2009; Lemanski &
Wilson, 2016; Gruenewald, et al., 2016). While some attacks are carried out by multiple
offenders associated with formal groups, far-right and jihadi lone actor events are also of major
concern and may be on the rise in the U.S. (Gruenewald, Chermak, & Freilich, 2013; Michael,
2012; Pantucci, 2013; Spaaij, 2010; Strom et. al, 2017). Law enforcement must be concerned
about both international and homegrown threats, including "foreign fighters" who travel abroad
  • Article
    This study seeks to provide a metric for validating the Nationwide Suspicious Activity Reporting (SAR) Initiative’s (NSI) sixteen-category instrument, which is designed to guide law enforcement in the collection and analysis of suspicious behaviors preceding serious crimes, including terrorist attacks. Data on suspicious preoperational activities and terrorism incident outcomes in the United States between 1972 and 2013 come from the American Terrorism Study (ATS). Using a mixed method approach, we conduct descriptive and multivariate analyses to examine the frequencies of the least and most prevalent suspicious activities (or SAR indicators) and how they predict the likelihood of terrorism prevention. In addition, we contextualize how configurations of SAR indicators are associated with the successful thwarting of terrorism incidents by law enforcement using an analytical method known as Conjunctive Analysis of Case Configurations (CACC). Our study reveals several key findings. First, certain behaviors categorized as suspicious, such as making threats, occur more frequently than others. Second, some suspicious activities (e.g., acquiring expertise) are more related to law enforcement interdiction than others. Third, making threats, conducting surveillance, and terrorist recruitment/financing predict law enforcement interdiction in terrorism plots, while misrepresentation (or the manufacturing and use of false documents) is more associated with terrorist success. Fourth, prevalent SAR indicators operate differently in the context of various combinations of suspicious activities to shape the likelihood for law enforcement interdiction. The current study’s findings may not be generalizable to other forms of violent extremism and terrorism outside of the United States. This study illuminates opportunities for the NSI to provide law enforcement with the necessary tools to reduce terrorism risk and prevent future attacks. To our knowledge, no scholarly work to date has assessed how observable behavioral indicators of suspicious preoperational activities affect the outcomes of terrorist plots.
  • Chapter
    This chapter describes the results of an analysis of 150 completed and foiled terrorist plots against the United States from 1995 to 2012 to better understand the true nature of the terrorist threat faced by the United States. The findings focus on the types of terrorist ideologies and motivations most represented, the magnitude of attacks, how plots are most often thwarted and by whom, and the missed clues in successful attacks. Overall, the United States has been more successful at thwarting terrorist plots in the years since 9/11 than compared to the 6 years prior. From 1995 to 2012, plots by Al Qaeda and affiliated related movements (AQAM) constituted almost 40% of all plots. White Supremacist-related and Militia/Anti-Government-related plots combined accounted for about another 40%, with the remaining plots due to a variety of motivations.
  • Article
    This study explores differences in perpetrators of suicide attacks and non-suicide attacks in the United States. The study uses data on far-right and Al Qaeda and affiliated/inspired terrorists between 1990 and 2013 from the United States Extremist Crime Database. Our analysis estimates logistic regression models to test whether suicide attackers were more likely to have exhibited specific risk factors for suicidality, while examining other prominent claims regarding patterns of suicide terrorism. Suicide attackers were no more likely than non-suicide attackers to have previously attempted suicide or to have been diagnosed as mentally ill. Suicide attackers were more likely, though, to have a history of substance abuse, to be loners, have served in the military, participated in paramilitary training, and be more ideologically committed to the cause. We found that Al Qaeda affiliated/inspired attackers were more likely than far-right attackers to have engaged in a suicide mission. With the current focus on Americans traveling to Syria and Iraq to receive training and fight for jihadist movements (e.g., the Islamic State), our findings appear relevant. Observers have expressed concern that these fighters may return and then commit attacks in their homeland. Law enforcement could make use of this study’s findings.
  • Article
    Full-text available
    How many of the terrorism convictions since September 11, 2001 have been the product of entrapment? Some scholars and journalists have suggested that the number is quite high. One report went so far as to claim that only 1% of terrorism prosecutions involve “real” terrorism. The government’s defenders, at the opposite extreme, come close to saying that entrapment in a terrorism case is a contradiction in terms. Little empirical basis exists for evaluating these competing claims. Existing literature on terrorism and entrapment is typically based on detailed discussions of a few egregious cases, rather than systematic analysis of the phenomenon. Yet estimating the prevalence of entrapment is critical for evaluating the ethics and effectiveness of contemporary counterterrorism policies. This Article remedies this dearth of information by creating and analyzing a database of terrorism prosecutions since 9/11 (n=580), and coding each of the cases involving an informant (n=317) for twenty indicators of potential entrapment. An analysis of the database reveals that entrapment indicators are widespread among terrorism cases, and that the most serious cases, involving specific plots to commit attacks, have significantly more indicators. Cases with several indicators account for a sizable proportion of all cases, especially among alleged cases of jihadi and left-wing terrorism. These results show that facts and allegations supporting an entrapment defense are not confined to a small number of cases, but rather are quite widespread in post-9/11 terrorism cases. The Article also examines the suggestion by a journalist that only 1% of terrorism cases have represented a real security threat. It estimates that the proportion of terrorism prosecutions likely to have thwarted genuine terrorism threats is somewhat higher, though still small—about 9% of all jihadi cases and 5% of jihadi cases involving informants. In light of these findings, the Article recommends that authorities rethink current counterterrorism strategies, concentrating on passive surveillance instead of attempts to coax law-abiding Muslims into terrorist schemes, and shifting more resources toward preventing right-wing terrorism. Finally, the Article proposes reforms that would require the government to have a reasonable suspicion of criminal activity before inducing a suspect into committing a crime, and that would base the entrapment defense on the defendant’s realistic likelihood of committing an offense without government prompting.
  • Article
    Full-text available
    While the number of American jihadi terrorist attacks remains relatively rare, terrorist plots thwarted by law enforcement have increased since September 11, 2001. Although these law enforcement blocks of would-be terrorists are considered counterterrorism triumphs by the FBI, human rights and civil liberty watch groups have conversely suggested that those who plan for attacks alongside government informants and undercover agents may be unique and essentially dissimilar from terrorists. Underlying this debate is the empirical question of how planned yet unsuccessful attacks and their plotters compare to successful terrorist homicides and their perpetrators. The current study addresses this question by comparatively examining jihadi terrorist homicides and unsuccessful plots occurring in part or wholly on U.S. soil between 1990 and 2014. Data for this study come from the U.S. Extremist Crime Database (ECDB), an open-source database with information on terrorism and extremist crimes. Based on these data, descriptive statistics are provided for several incident, offender, and target variables across three jihadi terrorist violence categories, including homicides, plots with specified targets, and plots with non-specific targets. We find several important differences across categories of terrorist violence, suggesting that unsuccessful plotters and their intended crimes vary from their more successful terrorist counterparts.
  • Article
    Full-text available
    Terrorism prevention has become the top priority among law enforcement and homeland security officials. To date, however, little empirical research has been conducted that directly compares the characteristics of successful terrorist attacks to failed and foiled terrorism incidents. To address this limitation in prior research, the current study examines the impact of opportunity, group structure, and temporally patterned precursor activities on far-right terrorism outcomes in the United States using data from the American Terrorism Study (ATS). Our findings partially support expectations that attractive and vulnerable targets, loners, conventional weaponry, and relatively fewer precursor activities are significantly associated with successful incidents.
  • Article
    The national network of fusion centers, of which there are currently 78 nationwide, was created in response to the terrorist attacks of September 11, 2001 and continue to play an integral role in contemporary law enforcement. Their mission, put simply, is to facilitate information sharing across disparate agencies and organizations. Despite a significant presence within the law enforcement landscape, fusion centers have received relatively minimal scholarly attention. This limited literature alludes to operational challenges and public concerns that inhibit fusion center effectiveness. More specifically, little information is known about how fusion centers develop relationships with external partners as well as institute mechanisms to safeguard against violations of individual privacy. The present research employs a combination of national survey data and three in-depth case studies of fusion centers in Florida, Nevada, and Michigan to provide initial answers to these questions. Implications for improved policy and practice are discussed.
  • Article
    Car bombing, suicide bombing, abduction, smuggling, homicide, and hijacking are all profoundly criminal acts. In Terrorism as Crime Mark S. Hamm presents an understanding of terrorism from a criminological point of view, arguing that the most successful way to understand, detect, prosecute and deter these acts is to use conventional criminal investigation methods. Whether in Oklahoma City or London, Terrorism as Crime demonstrates that criminal activity is the lifeblood of terrorist groups and that there are simple common denominators at work that can remove the mystery surrounding many of these terrorist groups. Once understood the vulnerabilities of these organizations can be exposed. This important volume focuses in on six case studies of crimes committed by jihad and domestic right wing groups, including biographies of more than two dozen terrorists along with descriptions of their organizations, strategies, and terrorist plots. Terrorism as Crime offers an original and significant framework for explaining international and domestic terrorism, as well as how future acts might be detected or exposed.
  • Article
    On July 22, 2011, Anders Behring Breivik detonated a car bomb in downtown Oslo, Norway. He didn't stop there, traveling several hours from the city to ambush a youth camp while the rest of Norway was distracted by his earlier attack. That's where the facts end. But what motivated him? Did he have help staging the attacks? The evidence suggests a startling truth: that this was the work of one man, pursuing a mission he was convinced was just. If Breivik did indeed act alone, he wouldn't be the first. Timothy McVeigh bombed a federal building in Oklahoma City based essentially on his own motivations. Eric Robert Rudolph embarked on a campaign of terror over several years, including the Centennial Park bombing at the 1996 Olympics. Ted Kaczynski was revealed to be the Unabomber that same year. And these are only the most notable examples. As George Michael demonstrates in Lone Wolf Terror and the Rise of Leaderless Resistance, they are not isolated cases. Rather, they represent the new way warfare will be conducted in the twenty-first century. Lone Wolf Terror investigates the motivations of numerous political and ideological elements, such as right-wing individuals, ecoextremists, foreign jihadists, and even quasi-governmental entities. In all these cases, those carrying out destructive acts operate as "lone wolves" and small cells, with little or no connection to formal organizations. Ultimately, Michael suggests that leaderless resistance has become the most common tactical approach of political terrorists in the West and elsewhere.