Investigative Simulation: Towards Utilizing Graph Pattern Matching for Investigative Search

This paper proposes the use of graph pattern matching for investigative graph search, which is the process of searching for and prioritizing persons of interest who may exhibit part or all of a pattern of suspicious behaviors or connections. While there are a variety of applications, our principal motivation is to aid law enforcement in the detection of homegrown violent extremists. We introduce investigative simulation, which consists of several necessary extensions to the existing dual simulation graph pattern matching scheme in order to make it appropriate for intelligence analysts and law enforcement officials. Specifically, we impose a categorical label structure on nodes consistent with the nature of indicators in investigations, as well as prune or complete search results to ensure sensibility and usefulness of partial matches to analysts. Lastly, we introduce a natural top-k ranking scheme that can help analysts prioritize investigative efforts. We demonstrate performance of investigative simulation on a real-world large dataset.Comment: 8 pages, 6 figures. Paper to appear in the Fosint-SI 2016 conference proceedings in conjunction with the 2016 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining ASONAM 201

Automatically Detecting the Resonance of Terrorist Movement Frames on the Web

The ever-increasing use of the internet by terrorist groups as a platform for the dissemination of radical, violent ideologies is well documented. The internet has, in this way, become a breeding ground for potential lone-wolf terrorists; that is, individuals who commit acts of terror inspired by the ideological rhetoric emitted by terrorist organizations. These individuals are characterized by their lack of formal affiliation with terror organizations, making them difficult to intercept with traditional intelligence techniques. The radicalization of individuals on the internet poses a considerable threat to law enforcement and national security officials. This new medium of radicalization, however, also presents new opportunities for the interdiction of lone wolf terrorism. This dissertation is an account of the development and evaluation of an information technology (IT) framework for detecting potentially radicalized individuals on social media sites and Web fora. Unifying Collective Action Framing Theory (CAFT) and a radicalization model of lone wolf terrorism, this dissertation analyzes a corpus of propaganda documents produced by several, radically different, terror organizations. This analysis provides the building blocks to define a knowledge model of terrorist ideological framing that is implemented as a Semantic Web Ontology. Using several techniques for ontology guided information extraction, the resultant ontology can be accurately processed from textual data sources. This dissertation subsequently defines several techniques that leverage the populated ontological representation for automatically identifying individuals who are potentially radicalized to one or more terrorist ideologies based on their postings on social media and other Web fora. The dissertation also discusses how the ontology can be queried using intuitive structured query languages to infer triggering events in the news. The prototype system is evaluated in the context of classification and is shown to provide state of the art results. The main outputs of this research are (1) an ontological model of terrorist ideologies (2) an information extraction framework capable of identifying and extracting terrorist ideologies from text, (3) a classification methodology for classifying Web content as resonating the ideology of one or more terrorist groups and (4) a methodology for rapidly identifying news content of relevance to one or more terrorist groups

Domestic Terrorism in the United States

Lone wolf terrorism has received considerable media attention, yet this phenomenon has not been sufficiently examined in an academic study. National security officials must distinguish between terrorist activities carried out by lone wolves and those carried out by terrorist networks for effective intervention and potential prevention. The purpose of this qualitative study was to explore the phenomenon of the leaderless lone wolf terrorist and the underlying mechanisms and processes that lead individuals to be drawn to or away from an existing radical movement. The theoretical framework for this study was leaderless resistance theory. Secondary data from interviews, field notes, and surveys from the RAND-MIPT Terrorism Knowledge Base and the Global Terrorism Database were analyzed using open and selective coding. Findings revealed 3 individual-level underlying mechanisms and processes (personal and political grievance, risk and status seeking, unfreezing) that lead individuals to be drawn to or away from an existing radical movement and to act unilaterally without direction toward violent ends. Findings also indicated that no single typology fits all perpetrators. The findings benefit national security officials and intelligence agencies by identifying lone wolf individuals, weighing the actual threat versus the perception, developing better counterterrorism strategies for the lone wolf phenomenon, and enhancing relations with outside agencies. Results may improve understanding of lone wolf terrorism and may be used to develop new policies to predict and track future threats

End of the Lone Wolf: The Typology that Should Not Have Been

This research note argues that the “lone wolf” typology should be fundamentally reconsidered. Based on a three-year empirical research project, two key points are made to support this argument. First, the authors found that ties to online and offline radical milieus are critical to lone actors' adoption and maintenance of both the motive and capability to commit acts of terrorism. Second, in terms of pre-attack behaviors, the majority of lone actors are not the stealthy and highly capable terrorists the “lone wolf” moniker alludes to. These findings not only urge a reconsideration of the utility of the lone-wolf concept, they are also particularly relevant for counterterrorism professionals, whose conceptions of this threat may have closed off avenues for detection and interdiction that do, in fact, exist

Lone-Actor Terrorist Target Choice

Lone-actor terrorist attacks have risen to the forefront of the public’s consciousness in the past few years. Some of these attacks were conducted against public officials. The rise of hard-to-detect, low-tech attacks may lead to more public officials being targeted. This paper explores whether different behavioral traits are apparent within a sample of lone-actor terrorists who plotted against high-value targets (including public officials) than within a sample of lone-actors that plotted against members of the public. Utilizing a unique dataset of 111 lone-actor terrorists, we test a series of hypotheses related to attack capability and operational security. The results indicate that very little differentiates those who attack high-value targets from those who attack members of the public. We conclude with a series of illustrations to theorise why this may be the case

The Lone Actor Terrorist and the TRAP-18

An open source sample of 111 lone actor terrorists from the United States and Europe were studied through the lens of the Terrorist Radicalization Assessment Protocol (TRAP-18). This investigative template consists of 8 proximal warning behaviors and 10 distal characteristics for active risk management or active monitoring, respectively, by national security threat assessors. Several aspects of criterion validity were tested in this known outcome sample. Seventy per cent of the terrorists were positive for at least half or more of the indicators. When the sample was divided into Islamic extremists, right wing extremists, and single issue terrorists, there were no significant differences across all eighteen indicators except for four. When the sample was divided according to successful vs. thwarted attackers, the successful attackers were significantly more fixated, creative and innovative, and failed to have a prior sexually intimate pair bond. They were significantly less likely to have displayed pathway warning behavior and be dependent on a virtual community of likeminded true believers. Effect sizes were small to medium (phi = 0.190-0.317). The TRAP-18 appears to have promise as an eventual structured professional judgment risk assessment instrument according to some of the individual terrorist content domains outlined by Monahan (2012, 2016)

Influences and vulnerabilities in radicalised lone-actor terrorists UK practitioner perspectives.

The threat to national security from terrorists acting on their own initiative is a challenge for law enforcement and intelligence agencies in the UK and elsewhere. The UK Parliament’s 2014 threat assessment noted ‘a trend towards ‘low signature’ terrorism by small, self-directed groups and lone actors’ [House of Commons Home Affairs Committee (2014) Counter-Terrorism – Seventeenth Report of Session 2013–14]. Lone actors have become a higher priority for counter-terrorism professionals (UK police, Prevent practitioners and security agencies), but there is a paucity of research into the views and awareness of these professionals. This qualitative study examined how Prevent practitioners perceived the radicalisation and motivations of lone-actor terrorists they had encountered. Participants were an opportunity sample of five Prevent practitioners; all had served as police officers with varying employment backgrounds and counter-terrorism experience. A thematic analysis of semi-structured interviews identified perceived general characteristics of lone-actor radicalisation. Three themes clustering around the concept of becoming a terrorist are discussed: mechanisms of radicalisation, vulnerability to radical discourse, and individual motivation. Participants construed radicalisation as a process over time, accelerated in the presence of generalised criminality or extensive Internet use. Vulnerability was seen as inherent, as well as a product of social context. Participants adopted folk-psychological explanations with mental health problems, social isolation and relative deprivation cited as prominent vulnerability factors. Lone actors were seen as motivated by grievances (e.g. deprivation), pressure from external sources (e.g. rational prospectors) or personal reward (e.g. sensation-seeking). Practitioners’ perceptions of the process over time had parallels with a diathesis–stress model, although there was some support for social movement theory