Pre-Incident Indicators of Terrorism Events

1. Terrorism Research Center in Fulbright College, University of Arkansas Pre-Incident Indicators of Terrorism Events Brent L. Smith University of Arkansas Kelly R. Damphousse University of Oklahoma Jackson Cothren University of Arkansas Paxton Roberts University of Arkansas Portions of this research were funded by the National Institute of Justice (Grant Number 2003-DT-CX-0003) and the National Memorial Institute for the Prevention of Terrorism in Oklahoma City (Grant Number MIPT 106-113-2000-064) through the Department of Justice and the Department of Homeland Security. The opinions presented here do not represent the official position of the DOJ, the DHS, the MIPT, or the NIJ.

2. Primary/Immediate Victims Pecuniary/Heat of Passion Motives Spontaneity No Preparatory Crimes Secondary/Instrumental Targets Political Motives Considerable Planning Series of Preparatory Crimes Differences in Traditional Crime and Terrorism Traditional Criminality Terrorism

3. Major Findings of the American Terrorism Study • Terrorist group members engage in significant criminal conduct en route to committing a terrorist incident. • They are learning from us, just as we learn about them. • They modify their behavior to avoid FBI terrorism investigations.

4. Terrorist Tactics That Emerged in the Early 1990s • Leaderless resistance • Use of the internet • Website “hit lists” of potential targets • “Fatwahs” • All of which gave rise to “lone wolves” and “elves”

5. Despite These Changes • A number of preparatory crimes have to occur to commit most terrorist incidents. • They may be committed by fewer group members and fewer meetings may occur: • But that may allow local law enforcement to be more easily alerted to the activities of a single individual as opposed to a group which may disperse the preparatory duties. • If these behaviors are routinized, patterns of conduct may be identified that might allow early intervention.

6. Terrorism in Time and Space • These behaviors probably occur in routinized temporal and spatial patterns. • What are these patterns? • Even the most rudimentary questions about terrorist group planning activities have not been addressed.

7. Background • The American Terrorism Study began in 1988 in collaboration with the FBI’s Terrorist Research and Analytical Center. • The FBI compiled the names and court case numbers of persons indicted since 1980 to begin the project.

8. Authorization Sponsorship: Since the mid-1990s, the project has been “sponsored” by the House of Representatives Judiciary Subcommittee on Crime and the Senate Judiciary Committee. Legal Review: Release of the data has been approved by the FBI Office of General Counsel and Congressional review.

9. Methodology • Utilizes “official” FBI measures of terrorism. • Thereby, accepting: • The FBI “academic” definition of terrorism • The AG regulatory definition when applied

10. FBI Definition of Terrorism The unlawful use of force or violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.

11. FBI Regulatory Definition of Terrorism • Dictated and put into practice by: • For Domestic Terrorism: • The Attorney General Guidelines on General Crimes, Racketeering Enterprises, and Domestic Security/Terrorism Investigations and subsequent editions (1983, 1989, 2002). • For International Terrorism: • The Attorney General Guidelines for FBI Foreign Collection and Foreign Counterintelligence Investigations.

12. Characteristics of the ATS Databases Currently includes information on: 9,071 federal criminal counts 641 “indictees” 575 persons 71 terrorist groups Representing approximately 90 percent of the population of indicted terrorists during for the period 1980-August 15, 2002 and approximately 50 percent of indicted terrorists for the period August 16, 2002 – August 15, 2004.

13. Number of Persons and Cases

14. Data Collection • Information on 75 variables: demographic and group characteristics, target information, count and case outcomes, conviction rates, sentencing data. • Court case documents: dockets, indictments, motions, judgment orders. • Temporal and spatial data: 285 variables relating to addresses of terrorists and targets, locations of preparatory crimes, and sequencing of events. • Summary of each case

15. Proposed Structure Pre-incident Data Spatial and Temporal Court Case Data Demographic and Group Post-Indictment Data Prosecutorial & Defense strategies Case and Count Outcomes Web-based Oracle Spatial Database • Statistical database • Spatial Information (point records) • Court documents • Related articles & references • Case narratives

16. The American Terrorism Study & The Terrorism Knowledge Base (www.tkb.org)

18. Searching by names

23. Searching by keyword

32. Can we identify spatial patterns of antecedent criminal conduct that will increase the probability of successful early intervention before actual terrorist incidents occur? What are the temporal dimensions of terrorist group planning? How many activities are typically involved? And do these activities vary by group type? Pre-Incident Indicators Project Objectives

33. Major Temporal and Spatial Dimensions of Terrorism Recruitment Membership in extremist group Attendance at rallies or demonstrations Exposure to Internet sites Personal recruitment Accessing extremist literature Planning and Preliminary Organization Identification and clarification of roles in group Exposure to terrorism training manuals Discussion of potential targets Drawing schematics Assignment of tasks Preparatory Activities Theft of explosives, detonation cord, or weapons Counterfeiting/ laundering money to support group activities Procurement of false IDs Modifications to semi-automatic weapons to fire automatic Buying of ANFO or other bomb materials such as timers and electrical components Establishment of bomb making labs Terrorist Incident Bombings Assassinations “Ecotage” Hostage taking Hoaxes Threats Hijackings Establishment of Residences Residential Locations May be correlated with other geo-political or census data T1 Time T2 T3 T4 Time T5 T6 T7 D1 Distance/Location D3 D4, D5 D2 Distance/Location D4, D5 D6

34. Project Methods for NIJ Project:Pre-Incident Indicators of Terrorism Activities

35. Project Methods for Current NIJ Project • Select case studies for collection of data. • For each case study, identify one or more terrorist incidents for collection of spatial and temporal data (not necessarily an exhaustive or even unbiased sample). • Collect data using open source documents. • Input information into (first Access, then) Oracle 10g database. • Geo-code incidents to create spatial data using ESRI’s ArcGIS suite. • Conduct spatial and temporal analysis by leveraging the power of the geodatabase using Intergraph’s GeoMedia Professional, ESRI’s ArcGIS, and Matlab. • Provide trainers with a tool for educating law enforcement personnel on patterns of terrorist activities and provide researchers with the database for further analysis.

36. Category • Number of Case Studies • International • 11 • Single Issue • 17 • Right Wing • 27 • Left Wing • 8 Case Study Selection • Collected 63 case studies for the period 1980 to 2002 from the four main terrorism group types using open source data • Sources for selecting case studies: • 1. American Terrorism Database contained information from 1980- mid • 1998 at that time • 2. List from FBI sent to ATS added period: mid 1998- August 15, 2002 • 3. Suggestions by members of research team and consultants

37. Single Issue Right Wing Coronado MSU Arson Clayton Lee Wagner Dr. Robert Goldstein EcoRaider ELF Long Island Arsons Ellerman Utah Bombing Fairfield Snow Bowl Free Critter Eugene Arson Griffin Florida Assassination Hill Florida Assassinations Kopp Amherst Assassination Nebraska Golf Vandals Santa Cruz 2 Sherman Oregon Firebombing- 2 Tucson Vandals Unabomber Vance Assassination Wisconsin mink release Oklahoma Constitutional Militia Order- 2 Phineas Priests Ruby Ridge Seace Conspiracy Third Continental Congress Up the IRS- 3 Washington State Militia White Patriot Party Woodring Homrich Aryan Nations Aryan Peoples Republic Bixby SC Covenant Sword & Arm of the Lord Felton Chase Jewish Defense League KKK- 3 Krar IDC Minnesota Patriots Council Ohio Unorganized Militia Oklahoma City Bombing International Left Wing El Rukns EPB-Macheteros FALN- 4 May 19 Communist Order- 3 New African Freedom Fighters Nyack Armored Car Robbery United Freedom Front Yahweh Abu Nidal Organization Hezbollah Japanese Red Army Lackawanna Six Millennium Conspiracy New York City Conspiracy 1994 New York Subway Bombing Omega 7 Provisional Irish Republican Army- 2 World Trade Center Bombing 1993

38. Data Table • Number of Variables • Person • 85 • Planning • 84 • Activities • 84 • Incident • 61 • Terrorist Group • 36 • Terrorist Cell • 30 • Above Ground Group • 24 • Total • 404 Variables Demographic- age, sex, education, occupation, income, etc. Spatial- address, city, state, zip Temporal- hour, day, week, month, year Miscellaneous- target type, incident damages & deaths, aliases

40. CIRAT Database Development

41. CIRAT Database Development

42. CIRAT Database Development

43. Types of Data • Records Collected • Records Geocoded • Records Geocoded • Residence Locations • (residences, safe houses) • 415 • 165 • 40% • Planning Locations • (meetings, phone calls) • 184 • 54 • 29% • Preparatory Activities • (crimes, travel, surveillance) • 179 • 122 • 68% • Incidents • (acts of terrorism) • 246 • 190 • 77% • Total • 893 • 515 • 58% Data Collection Results Records are geocoded using street address and sometimes zip codes. ESRI StreetMap data used for geocoding (this round). Accuracy is currently be assessed independently from a sufficiently large sample.

44. Temporal Patterns • How long is it from the time members are recruited into a terrorist cell before they actually begin conceiving and planning for an incident? • How long do terrorist groups plan and prepare before committing a terrorist incident? • How many, and what types of, crimes do they commit while preparing for a terrorist incident?

45. Temporal Patterns Terrorist Incident When Recruited Cell Origination 1st Known Activity Planning and Preparatory Behaviors avg. 58 / *12 days avg. 41 / *25 days avg. 99 / *54 days avg. 1205 days (3.3 years) Unknown due to small sample size Unknown due to small sample size n=34 /*n=30 excludes outliers n = 191

46. Breakdown of Incidents by Day of Week n = 236

47. Breakdown of Incidents by Time of Day n = 57

48. General Spatial Patterns • Conventional criminals typically commit their crimes within five miles of their place of residence. • Sources: Thomas Reppetto, Residential Crime, 1974; Richard Wright and Scott Decker, Burglars on the Job, 1996; Richard Wright and Scott Decker, Armed Robbers in Action, 1997. • Do terrorists reflect similar patterns of behavior?

49. General Spatial Patterns • Major terrorist incidents in the U.S. typically involved perpetrators from places other than the site of the target. Timothy McVeigh Oklahoma City, OK September 11 Attackers New York City, NY Eric Rudolph Birmingham, AL