Key Trends in Terrorism

1. TATP: The Hydrogen Peroxide-Based Bomb of Choice¹

Since 2014, there have been 14 attacks in the West involving explosives. Of those, six involved TATP, triacetone triperoxide, an explosive that has long been the bomb of choice for jihadists in the West due to the ease of acquiring the components to make it, as compared to military-grade explosives. It can be built using the common household ingredient hydrogen peroxide, which is used to bleach hair.

Table 1: Jihadist Attacks Involving TATP in the West

Table 2: Jihadist Attacks Involving Explosives Other Than TATP in the West

Making a TATP bomb is tricky because the ingredients are highly unstable and can explode if improperly handled. The danger of building TATP bombs without training can be seen in the case of Matthew Rugo and Curtis Jetton, 21-year-old roommates in Texas City, Texas.² They didn’t have any bomb-making training and were manufacturing explosives in 2006 from concentrated bleach when their concoction blew up, killing Rugo and injuring Jetton. The pair had no political motives: They had just wanted to blow up vehicles for fun.

TATP therefore often indicates that a perpetrator received training or direction from a foreign terrorist group. Indeed, three of the six attacks involving TATP since 2014 — the 2015 Paris bombings, the 2016 bombings of the Brussels metro and airport by the same ISIS cell, and the 2017 bombing of an Ariana Grande concert in Manchester, England — were directed by ISIS. This accounts for half of the attacks known to have been directed by foreign terrorist organizations in the West since 2014 and all of the directed attacks that involved explosives.

The three other attacks since 2014 involving TATP — the September 2017 bombing at the Parsons Green tube station in London in which the bomb failed to fully explode, the August 2017 attacks in Barcelona where traces of TATP were found at a suspected bomb factory tied to the plot, and a June 2017 failed bombing of the Brussels metro that killed only the perpetrator —had no known operational link to ISIS.³ These attacks account for less than 5 percent of all inspired or enabled attacks and only a third of inspired or enabled attacks involving explosives.

Six ISIS-inspired attacks and two ISIS-enabled attack in the West since 2014 used other explosives. For example, Tashfeen Malik and Syed Rizwan Farook, who killed 14 people in San Bernardino, California, had built pipe bombs using Christmas lights and smokeless powder.⁴ The bomb recipe they used was learned from Inspire, the English-language propaganda magazine of Al-Qaeda in the Arabian Peninsula, whose article “Make a Bomb in the Kitchen of Your Mom” was also used by the Boston Marathon bombers.⁵

2. The Rise of Vehicular Attacks⁶

Since 2014, vehicular ramming attacks have emerged as a key example of jihadist innovation on the lower end of sophistication, yet with a demonstrated capacity for causing mass casualties. The tactic, which had sporadic appearances in the past, has spread to those motivated by ideologies other than jihadism, becoming a staple of the modern terrorist threat to an extent not seen before.

Since 2014, there have been 16 vehicle ramming attacks in the West conducted by jihadists, which have killed a total of 145 people.⁷ On October 31, 2017, Sayfullo Saipov killed eight people in New York City when he drove a truck into a crowd — the first deadly vehicular ramming by a jihadist inside the United States.

Table 3: Jihadist Vehicular Ramming Attacks in the West

The death tolls from vehicular ramming attacks are highly variable. On July 14, 2016, Mohamed Lahouaiej Bouhlel drove a truck through a crowd gathered in the French city of Nice to celebrate Bastille Day. Bouhlel’s attack killed 86 people — the second most deadly jihadist attack in the West since 2014, surpassed only by the ISIS-directed and highly sophisticated 2015 Paris attacks. Yet unlike those attacks, Bouhlel’s attack lacked operational direction from ISIS.

On the other hand, numerous vehicular rammings have failed to kill anyone. For example, on September 30, 2017, Abdulahi Hasan Sharif, a 30-year-old Somali refugee, drove a truck into pedestrians, injuring four people but not killing anyone, after he also attacked a police officer in Edmonton, Canada.⁸

Despite the failure of some vehicular attacks to kill anyone, the potential for extremely deadly attacks with little need for coordination has made vehicular attacks particularly appealing to ISIS. None of the vehicular rammings were directed by ISIS, demonstrating the lack of training or specialization required to conduct such an attack. In September 2014, Abu Muhammad al-Adnani, the ISIS spokesman, called upon people in the West to conduct attacks with whatever means they had — specifically mentioning vehicular attacks.⁹

ISIS’ leaders are not the only ones to have taken notice of the wave of vehicular attacks and their impact. The tactic has been adopted by individuals in the West motivated by ideologies other than jihadism. In April 2018, Alek Minassian killed 10 people when he drove a van into a crowd in Toronto, Canada, after posting to Facebook that the attack was part of an “Incel Rebellion.”¹⁰ In June 2018, Gregory C. Wagner, a 58-year-old Republican councilman in Bell Acres, Pennsylvania, was charged with having driven his car into a crowd protesting a police shooting.¹¹ In June 2017, a man killed one person and injured 11 when he rammed a vehicle into a group of Muslims outside a mosque in north London; the man allegedly shouted, “I want to kill all Muslims — I did my bit.” ¹² Also, as noted above, a right-wing extremist killed a woman in Charlottesville, Virginia, in August 2017 when he rammed a car into a group of people protesting a white nationalist rally.

The potential for extremely deadly attacks with little need for coordination has made vehicular attacks particularly appealing to ISIS.

Vehicular attacks are not new. Al-Qaeda in the Arabian Peninsula called for such attacks in 2010, in Inspire magazine. In 2006, Mohammed Taheri-Azar injured nine people when he drove an SUV into people on the University of North Carolina Chapel Hill campus, and Palestinian militants have made frequent use of the tactic. However, such attacks have become a key part of today’s terrorist threat to an extent not seen before.

3. The Use of Armed Drones by Terrorist Groups

The United States should expect the use of armed drones by terrorist groups and other non-state actors to expand and remain a substantial aspect of the threat environment. Already, ISIS has made widespread use of drones in Iraq and Syria.

ISIS has deployed drones extensively. Eric Schmitt of the New York Times reported that over the course of December 2016 and January 2017, ISIS deployed more than 80 drones in combat in Iraq.¹³ In January 2017, ISIS announced in its newsletter al-Naba’ the establishment of the “Unmanned Aircraft of the Mujahideen,” an operational unit organized to engineer and deploy drones in combat.¹⁴ The terror network has been experimenting with drone technology since at least 2015, when Kurdish fighters in Syria shot down two small commercial drones reportedly belonging to the group — both of which were armed with explosives.¹⁵ ISIS’ military defeats in Iraq and Syria dealt a substantial blow to its drone operations, but the ISIS campaign foreshadows a future in which non-state use of drones is common.¹⁶

The Houthi rebels in Yemen also have drones. In January 2017, a maritime drone operated by the Houthis crashed into a Saudi ship in the Red Sea, killing two Saudi sailors. Vice Adm. Kevin Donegan, commander of the U.S. Navy Fifth Fleet, described the drone to Defense News as a “remote-controlled boat of some kind” that was loaded with explosives.¹⁷

Though ISIS and the Houthis are the clearest cases of sustained armed drone campaigns by non-state actors, numerous other groups have used drones in combat or maintain the capability to do so. In January 2018, Russia claimed that one of its military bases in Syria was attacked by a swarm of improvised drones, though the responsible group is unknown.¹⁸ In July 2018, Venezuelan President Nicolas Maduro was the target of a botched assassination attempt utilizing two quadcopter drones rigged with explosives.¹⁹ Also in July 2018, drones carrying improvised explosive devices targeted the residence of the public safety secretary of Baja California, Mexico.²⁰ In October 2017, Mexican Federal Police arrested four men with a quadcopter drone connected to an improvised explosive device, raising concern about the adoption of such techniques by drug cartels.²¹

Hezbollah and Hamas were early adopters of drone technology and maintain an armed drone capability. In 2004, Hezbollah flew a military-grade drone, reportedly acquired from Iran, over Israeli airspace.²² The Lebanese militant group also conducted strikes in Syria in 2014 with an armed drone and in 2016 with over-the-counter drones armed with small explosives.²³

Terrorist use of drones, whether as part of military campaigns or for one-off attacks, is likely to continue and be an important site of terrorist innovation to monitor.

4. The Threat to Airports and Aviation

Jihadist terrorists continue to target airports and aviation. Three main threats to this sector deserve focus: attacks against aircraft involving explosives or other weapons taken past security; insider threats at airports that can allow terrorists to bypass security efforts; and attacks on unsecured parts of airports.

Attacks on aviation through the development of explosives that can be taken past security systems remain a persistent concern for the United States. In July 2018, Homeland Security Secretary Kirstjen Nielsen stated, “We still worry very much about aviation,” adding that the department continues to see terrorists “perfecting their opportunities to attack us through aviation.”²⁴ In 2018, the Transportation Security Administration rolled out new, more extensive screening procedures for powders in carry-on luggage as a response to the foiled terrorist plot to bomb an Australian flight.²⁵

John Kelly, previously secretary of homeland security and now White House chief of staff, made airline and airport security a primary area of focus during his short tenure as secretary. In March 2017, the Department of Homeland Security imposed a ban on laptops, tablets and other devices larger than a mobile phone carried by passengers on flights coming from 10 Muslim-majority countries as a result of a believed ISIS threat; the ban was revoked in July.^{26 27} Al-Qaeda managed to transport explosives past security in the 2001 “shoe bomber” plot and again in the 2009 Christmas Day “underwear bomber” plot, and while neither attack succeeded in killing anyone, they could have killed hundreds if the explosives had detonated properly.

Though technical innovations allowing attackers to take explosives through security remain a major concern, jihadists have had more success in bypassing security by taking advantage of insider threats. On October 31, 2015, ISIS’ Sinai affiliate bombed a Russian airliner, killing all 224 people on board. ISIS reportedly relied upon employees at the airport to move the bomb past security and place it on the plane.²⁸ In 2016, al-Shabaab bombed a flight out of Mogadishu airport in Somalia, reportedly relying on bombs concealed in laptops and on insiders who helped the bomber pass security. The bomb detonated early and killed only the bomber, but illustrates the threat of terrorist innovation and insiders who can enable bypassing of security.²⁹

The threat of insider attacks is not restricted to flights outside the West. Since 9/11, there have been at least five Americans involved in jihadist activity who worked at airports. In the United Kingdom in 2010, British Airways IT expert Rajib Karim conspired with Anwar al-Awlaki to place a bomb on a plane headed to the United States. In correspondence with al-Awlaki, Karim wrote, “I do not know much about US I can work with the bros to find out the possibilities of shipping a package to a US-bound plane.”³⁰

Jihadists have had more success in bypassing security by taking advantage of insider threats.

The third threat targets unsecured areas of airports for attacks. In 2017, there were two attacks with connections to jihadist ideology in unsecured locations at airports in the West; there have been no such incidents reported in 2018. In March 2017, Ziyed Ben Belgacem, a French national of Tunisian descent, was shot dead after assaulting a security guard at France’s Orly airport outside Paris. Belgacem, who had been in trouble with the law previously for a slew of offenses, likely radicalized in prison.³¹ The other case, mentioned previously, was Amor Ftouhi’s stabbing attack at the Flint, Michigan, airport in June 2017. Outside of the West, attacks on airports have also been common, often featuring more sophisticated and organized assault tactics.³²

5. The Continued Absence of CBRN Attacks by Jihadists in the West ³³

Weapons of mass destruction have continued to be absent in attacks by jihadist terrorists in the West. Of 91 attacks conducted by jihadists in the West since 2014, none involved chemical, biological, radiological or nuclear weapons (CBRN). In its 2018 report, Europol notes, “As in previous years, no terrorist attacks using chemical, biological, radiological or nuclear (CBRN) substances were recorded in the EU in 2017.”³⁴ Of the 449 people in the United States accused of jihadist terrorism-related crimes since 9/11, none acquired such weapons.

Historically, al Qaeda-linked attackers have lacked backgrounds that would aid in the development of biological weapons. An examination of the educations of the 79 terrorists responsible for some of the worst anti-Western al-Qaeda attacks³⁵ — the World Trade Center bombing in 1993, the Africa embassy bombings in 1998, the 9/11 attacks of 2001, the Bali nightclub bombings in Indonesia in 2002 and the London bombings on July 7, 2005 — found that only one had obtained a degree in biology. One of the three masterminds of the Bali bombings, Aris Sumarsono, better known as Zulkarnaen, had studied biology at an Indonesian college and is among the top leaders of the al-Qaeda affiliated group Jemaah Islamiyah.³⁶

Of 91 attacks conducted by jihadists in the West since 2014, none involved chemical, biological, radiological or nuclear weapons.

Other evidence points to a continued lack of sophistication when it comes to CBRN weapons. Europol noted that most of the propaganda urging CBRN attacks in Europe focused on dual-use toxic chemicals that could be obtained by unsophisticated plotters, rather than more sophisticated weapons.³⁷ ISIS had the opportunity to acquire cobalt-60, a highly radioactive material that it could have used to build a radiological “dirty bomb” when it overran Mosul in 2014, but did not take advantage of the opportunity.³⁸ Actual nuclear weapons remain well beyond the development capabilities of jihadist groups.

Terrorists instead continue to prefer the old standby weapons of bombs and firearms. The innovation that has occurred in weaponry and tactics used in attacks in the West has been almost entirely on the low end, through the adoption of vehicle rammings and stabbings. This is likely because such methods have proved themselves just as effective at creating mayhem and murder with far less need for technical know-how or training.

Despite the lack of CRBN attacks and greater innovation and interest on the low but deadly end of terrorist technology, jihadists have little compunction about using such weapons, as demonstrated by a series of recent plots.

For example, in 2018 there were at least two terrorism cases in the West with a connection to the biological toxin ricin. In June 2018, the United States arrested Waheba Dais, a 45-year-old woman and legal resident who helped spread instructional material regarding ricin online.³⁹ Also in June 2018, German authorities arrested a Tunisian man who allegedly had successfully created ricin and was plotting to use it in an attack in Germany.⁴⁰

The threat from jihadists interested in ricin should not be exaggerated. Ricin makes a poor mass casualty weapon, as it has to be ingested to be deadly.⁴¹ Though numerous militants have expressed interest in ricin or even produced it, there have been few if any deaths in ricin attacks: A 2010 Department of Homeland Security document lists only one such case — the 1978 assassination of Bulgarian dissident Georgi Markov in London.⁴²

However, a more concerning recent plot involving chemical weapons is the 2017 Sydney plot in which Australian law enforcement discovered hydrogen sulfide precursors among the materials held by plotters in communication with a senior ISIS figure and virtual recruiter located in Syria.⁴³

ISIS has also used chlorine on the battlefield in Syria and Iraq. Interestingly, despite this use of chemical weapons, it has seen little coverage in ISIS’ often detailed propaganda on its military operations, suggesting that using such weapons may be a low priority for ISIS with limited resonance in propaganda terms.⁴⁴

Finally, it is worth noting that there is also a threat in the United States from chemical and biological weapons from individuals motivated by other ideologies. For example, William Krar and Judith Bruey, two anti-government extremists arrested in 2003, possessed precursor chemicals for hydrogen cyanide gas, while Michael Alan Crooker, another anti-government extremist, pleaded guilty in 2011 to possessing the biological toxin ricin and threatening an officer of the U.S. government.⁴⁵

6. Prison Releases

The scheduled release of large numbers of individuals convicted of terrorism-related crimes who have served their sentences, in addition to those previously released, could shape the terrorist threat in coming years. If these released individuals return to jihadist activity, they could reconstitute and expand the networks that helped fuel ISIS’ recruitment and attacks in the West.

Europe is at particular risk for such an occurrence, given the greater development and size of its jihadist networks to begin with and the existence there of serious prison radicalization problems.

An analysis by the Guardian found that 40 percent of terrorism sentences handed down in the United Kingdom between 2007 and 2016 will run out by the end of 2018, and additional convicted individuals may eligible for parole.⁴⁶ Among the British extremists reportedly eligible for parole by the end of 2018 is Anjem Choudary, a preacher and founder of the banned radical Islamist organization Al-Muhajiroun, who has been linked to several terrorism cases.⁴⁷

According to France’s Ministry of Justice, France will release about 50 people sentenced for terrorism crimes and 400 individuals sentenced for other crimes but deemed to have radicalized in prison by the end of 2019.⁴⁸

If these released individuals return to jihadist activity, they could reconstitute and expand the networks that helped fuel ISIS’ recruitment and attacks in the West.

In the United States, the problem is less severe — in accordance with the less severe state of the overall threat — but likely will also pose a challenge. At least 88 Americans who have been convicted of terrorism-related crimes since 9/11 have been released, according to New America’s research. An additional 72 are scheduled to be released by the end of 2025.

The individuals released by the United States so far range widely in terms of the seriousness of their crimes. They include Ali al-Marri, who was arrested in December 2001 but later held as an enemy combatant before being returned to the civilian justice system; he pleaded guilty to conspiracy to provide support to al-Qaeda, having been dispatched to the United States prior to 9/11 by Khalid Sheikh Mohammed.⁴⁹ He was released in January 2015 and deported to Qatar.⁵⁰ Those released also include members of the so-called Liberty City Seven, one of the most questionable FBI sting operations and one of the extremely small number of cases in which individuals accused of jihadist terrorist activity were acquitted.

Releases also include individuals convicted for more recent ISIS-related crimes. For example, Daniela Greene, an FBI translator who went to Syria and married Denis Cuspert, a German ISIS fighter and recruiter, was released in August 2016.⁵¹

So far, the United States has not seen a substantial threat from released jihadists, and individuals who have served their time should not be permanently ostracized from society due to a prior terrorism-related conviction. Some of the released individuals were convicted as a result of questionable informant-driven investigations while others appear to have been rehabilitated, and some have lent their knowledge and experience to efforts to counter the terrorist threat.⁵² For example, Jesse Morton, who was convicted in relation to his role in Revolution Muslim, through which he played an important role in jihadist recruitment in the United States, was released early and began working as an informant.⁵³

However, the United States should be wary of overconfidence regarding the reintegration of released extremists. First, there is little if any developed infrastructure to support individuals upon their release.

There is little if any developed infrastructure to support individuals upon their release.

Even individuals who have cooperated substantially with the United States have struggled upon their release. Morton, for example, after having been released and working as an informant and then on counter-extremism issues, was arrested on charges related to having brought drugs to a meeting with a prostitute.⁵⁴ Bryant Neal Vinas, who joined al-Qaeda in Pakistan and who after his arrest cooperated with the government, providing extensive insight into the internal workings of al-Qaeda, upon his release was left without protection, struggled to find a job and became reliant on Medicaid and food stamps.⁵⁵

The challenges of reintegration are not limited to those who offer extensive information or value to terrorism investigations. Paul Rockwood, who was released in September 2017 after having pleaded guilty to making false statements in a terrorism investigation related to his having drawn up a kill list, wrote to one of the authors, stating: “Because I am faced with so many uncertainties upon release, it is difficult for me to make any definitive plans. Not having a plan causes me considerable anxiety.”⁵⁶ It is not surprising that Rockwood expressed concern. According to a court document filed in March 2016, a bit over a year before his release, he had only $5 in savings, was reliant upon a $1,000 monthly pension to support his wife and two children, and had $30,000 in debt.⁵⁷ Rockwood also noted that the Bureau of Prisons “has no deradicalization program(s) for inmates convicted of terror related offenses.”

Another individual, Craig Baxam, who pleaded guilty to having traveled to join Al Shabaab, had no permanent residence when scheduled for release and absconded from his halfway house.⁵⁸ According to court records, he had written a letter in which he threatened the government.⁵⁹

Second, though there is little evidence of a threat from U.S. individuals who have been released after serving time for terrorism charges, there are a small number of cases that point to problems related to the prison system that might escalate in the future. For example, Ali Muhammad Brown, who killed four people in a shooting spree across Washington state and New Jersey in 2014 inspired in part by jihadist ideology, was in the midst of a “downward spiral of criminality,” according to the judge in his case; he had been convicted of assault in 2008 and communication with a minor for immoral purposes in 2012 as well as bank fraud in 2005 and had served prison time.⁶⁰ The FBI believed that the bank fraud case was related to terrorism, but prosecutors failed to prove so in court.⁶¹

Similarly, Elton Simpson, one of the attackers in the Garland, Texas, shooting in which only the perpetrators were killed, had been convicted in 2011 of making a false statement to investigators. The government alleged the false statement was terrorism-related, but Simpson was acquitted on that count as the judge ruled that the government had failed to prove that point.⁶²

Policymakers should not jump to conclusions regarding a threat from released extremists. Many pose no threat or are actively supporting government efforts to counter terrorism

These two cases, involving violence after convictions for crimes in which the government failed to prove an alleged terrorism nexus, point to the risks of recidivism and need for study of post-arrest paths of alleged extremists.

Another set of warning signs involves recent charges for activity within prisons. In March 2016, the United States charged Alex Hernandez, a 31-year-old inmate at the Old Colony Correctional Center in Bridgewater, Massachusetts, with threatening to kill the president. Hernandez allegedly told an undercover agent that he was “fighting to uphold the laws and structure of the caliphate in the Middle East.”⁶³ In 2017, the United States charged Clark Calloway, a 38-year-old ex-Marine, with federal firearms charges as a result of an investigation sparked by pro-ISIS statements on Facebook.⁶⁴ According to the complaint in his case, Calloway repeatedly emphasized on Facebook his having served time in prison and stated that he had “met Al Qa‘ida members” there.⁶⁵ In another case, Casey Charles Spain pleaded guilty in 2017 to possession of a firearm as a felon, and according to his plea had radicalized while in prison, swearing loyalty to ISIS’ leader.⁶⁶

Policymakers should not jump to conclusions regarding a threat from released extremists. Many pose no threat or are actively supporting government efforts to counter terrorism. In the past, claims regarding prison radicalization in the United States have often proved to be overblown. However, given the larger number of individuals passing through the justice system on terrorism charges in recent years and the changes in the nature of the threat, a reassessment of efforts at deradicalization, alternatives to incarceration and reintegration efforts for extremists upon release is warranted.

At the same time, a reassessment is warranted to evaluate whether the government is doing enough to enable released extremists to reenter society and live their lives at a time when a criminal conviction for crimes with much lesser stigma than terrorism can exert a profound and destabilizing influence upon an individual’s life, even after the person has reformed. This will be particularly important in an age where young children and other vulnerable individuals have become increasingly the subject of terrorism investigations and the target of terrorist recruitment.