Lone Wolves No More

The tactics used by British terrorist Khalid Masood in his horrifying attack on Wednesday outside London’s Parliament were typical of the self-proclaimed Islamic State, or ISIS: an attacker plowing a vehicle through a crowd of pedestrians before slashing at police officers with a knife. Soon after the strike, ISIS claimed credit, although it did not provide any details that weren’t already public.

The generic nature of ISIS’s comments encouraged some skeptics. London’s Independent, for example, claimed that the phrasing of the group’s statement suggests that it “did not directly orchestrate [the] atrocity.” But skeptics’ voices have been noticeably quieter than in the past. The caution that commentators generally exhibited by refraining from declaring ISIS uninvolved in the London attack stood in stark contrast, for example, to the reaction to last summer’s truck attack in Nice—when observers immediately branded it the work of a “lone wolf” who was not really linked to ISIS. The public understanding of lone-actor terrorism may finally be changing for the better. 

Not So Lonely

When my colleague Nathaniel Barr and I wrote “The Myth of Lone-Wolf Terrorism” in these pages shortly after the Nice attack, our purpose was to challenge a then-dominant reflex among observers: declaring single-attacker terrorist incidents to be the work of so-called lone wolves. (These are individuals who lack substantial connections to ISIS or other groups and carried out their operations without the assistance of others.)

In fact, we argued, previous lone-attacker plots often had some organizational involvement—and ignoring that fact was costly. As intrepid journalist Rukmini Callimachi reported in the New York Times last year, a series of attacks in Europe from 2014–15 carried out by men including Sid Ahmed Ghlam and Ayoub El-Khazzani were written off at the time as the work of lone wolves. They were, in fact, anything but: Abdelhamid Abaaoud, who later served as the ground commander of the November 2015 Paris attacks that claimed 130 lives, had directed Ghlam, Khazzani, and several others to carry out strikes in Europe even as he prepared the Paris operation. Because counterterrorism analysts and officials viewed Ghlam, Khazzani, and other attackers as unrelated to one another or to broader networks, they missed their best chance to identify ISIS’s operational infrastructure in Europe prior to the Paris operation.

Commentators did not immediately absorb the lesson from this failure. Barr and I were alarmed that, following the Nice attack and in numerous other instances (for example, a July 24 suicide bombing in the German city of Ansbach and the July 26 slaughter of a priest in the French city of Rouen), analysts, journalists, and scholars were quick to label each perpetrator as a lone wolf.

Over the past nine months, however, the public understanding of the strikes has demonstrably shifted. There is growing awareness that individuals labeled lone wolves are often in communication with other militants, sometimes using encrypted services. In several prominent cases, the lone attackers communicated with “virtual planners”—ISIS operatives, often based in Syria, who offer would-be terrorists all the services once provided by physical networks. Enabled by a combination of social media and the recent boom in end-to-end encryption, virtual planners scout for recruits, work to radicalize and spur them to action, provide operational guidance, and even give operatives critical technical assistance, such as advice on the construction of explosives. 

Emblematic of the virtual planner model is the late French national Rachid Kassim, whom analyst Bridget Moreng has profiled in Foreign Affairs. In September 2016, French authorities arrested a group of female terrorists who attempted (and failed) to set off a car bomb near Paris’s Notre Dame Cathedral. (One of them stabbed a police officer outside a rail station as authorities made the arrest.) Before this plot, none of the women had any relationship to each other. They had been brought together by Kassim.

In connecting the women, Kassim merged two lines of terrorist effort in different parts of France. And it was all because of one operative’s cold feet. Sarah Hervouët, a 23-year-old Muslim convert who was planning an attack in the commune of Cogolin, had been in communication with Kassim using the app Telegram app. Acting on Kassim’s orders, Hervouët drafted her will, wrote farewell letters to relatives, and made a video proclaiming her allegiance to ISIS. But she lost her appetite for the “suicide-by-police” attack that Kassim had envisioned for her. So he connected Hervouët with the other two women, forming a cell that would undertake a more traditional plot involving explosives. Although these operatives ultimately failed to carry out the attack that Kassim had hoped for, the case demonstrates the agility with which virtual planners can operate. Kassim, for his part, has had a notable share of successes, having orchestrated several gruesome plots that claimed innocent lives.

The virtual planner model has helped transform lone attackers who rely heavily on the Internet from the bungling wannabes of a decade ago to something much more dangerous today. Virtual planners allow ISIS to maximize the impact and propaganda value of attacks waged in its name, making sure they are seamlessly incorporated into the group’s strategy.

A New Sense of Caution 

In a groundbreaking article for the New York Times last month, “Not ‘Lone Wolves’ After All: How ISIS Guides World’s Terror Plots from Afar,” Callimachi outlined the phenomenon of virtual planners in painstaking detail. Similarly, the most recent issue of CTC Sentinel, published by West Point’s Combating Terrorism Center, features an article comprehensively examining virtual planners’ role in U.S. plots.

Of course, it is unclear at this point whether Masood was connected to ISIS’s virtual planners, a true lone wolf, or something else. At 52 years old, he doesn’t fit the profile of a young operative radicalized over social media, but that doesn’t mean he couldn’t have figured out how to use encrypted online communications. And contacting major ISIS figures isn’t exactly rocket science.

The bottom line is that we don’t know what Masood’s relationship to ISIS was. That is why commentators are much more cautious about declaring him a lone wolf now than they would have been in the past. The most rigorous work on the topic has warned observers to be wary that there may be connections that are not immediately discernible. Such caution is correct analytically. It is also correct pragmatically. In the past, lack of caution may well have cost lives.

Daveed Gartenstein-Ross is a senior fellow at the Foundation for the Foundation of Democracies. Follow him on Twitter @DaveedGR.