January 16, 2015

TSG IntelBrief: The Known Wolves of Terror

 • Recent high-profile terrorist attacks have been conducted not by random unknown individuals but rather by individuals with well-known patterns of violent extremist or criminal behavior and connections

• That these individuals were on the radar of both local law enforcement as well as intelligence services and still able to conduct their respective attacks highlights the difficulties of detecting and then deterring extremists that operate on the edge of permissible behavior

• Another issue is determining whether and when an individual with an extensive criminal background or history of violent mental illness might merge his or her personal tendencies with the larger violent extremist ideology of bin Ladinism

• As with conventional crime, a small percentage of repeat actors tend to conduct the most and the worst terrorist attacks, which helps drain the pool of potential terrorist actors to a more manageable number—though it doesn’t rule out devastating actions by truly unknown people

• The January 15 counterterrorism raids by Belgian authorities may represent a successful example of where detecting and mapping an extremist network leads to disruption and prevention.


Many of the recent high-profile Western terrorist attacks have been conducted by people well-known to local law enforcement and even international intelligence services. These individuals, acting alone or in small groups, are “known wolves” who have been on the radar of various agencies and organizations, highlighting the difficulty of effectively monitoring and managing people at the nexus of criminality and terrorism.

Chérif Kouachi, one of the perpetrators of the Paris attacks, was well-known to authorities due to his extensive ties to local and Yemeni-based extremists and terrorists. He had been investigated and arrested several times on terror charges.

Chérif ’s older bother, Said Kouachi, had never been arrested but was so well-known for extremist connections and travel that he was on the U.S. and U.K. watch lists, as was Chérif.

Amédy Coulibaly was arrested three times for armed robbery and met Chérif Kouachi in prison, where he was apparently radicalized amongst known extremists. Prison (along with social media) is often where criminals take active steps to become terrorists.

Sydney hostage taker Man Haron Monis had both a long criminal record and a documented history of espousing violent extremist ideology. According to Prime Minister Abbott, Monis had "a long history of violent crime, infatuation with extremism, and mental instability”—the trifecta of warning signs.

Ottawa shooter Michael Zehaf-Bibeau had a lengthy criminal record, with 12 convictions in Québec alone between 2001 and 2011. He reportedly had no diagnosed mental illness nor solid extremist sympathies or connections, with drug addiction fueling his criminal activity. Social media likely was his bridge between the two worlds; the ideology of bin Ladinism finds receptive audiences among criminals and those on the margins of society.

Zale H. Thompson of last year’s NYPD hatchet attack had been arrested several times but was not on anyone’s radar in terms of violent extremism. His case is particular troubling, in that he hadn’t traveled abroad to connect with established groups, nor had he espoused violent extremist ideology. Rather, he had merged his troubled life with violent ideology through merely visiting extremist sites, highlighting the difficulties of monitoring and assessing vulnerable people.

As in conventional crime, a handful of extremists commit the majority of terror-related crimes. Unfortunately, these people also tend to conduct the most horrific crimes, given their long histories and experience with violence. This helps law enforcement and intelligence services better focus their limited resources on the most realistic threats in specific areas. For example, it is counter-productive to speak of France’s five million Muslims as a sign of a potentially enormous target pool, when it’s likely only several dozen people—most of whom with known associations and offenses—that should be the highest priority target set.

Establishing the nexus of criminality and terrorism is important for local communities, and will increasingly be a primary challenge for law enforcement and intelligence services. This entails better community relations, as full-time or even part-time surveillance and the meaningful monitoring of dozens of people is impractical for many reasons. Disruption of a growing threat can involve many tactics that don’t necessarily include arrest, with the goal of prevention superseding reaction. The new spectacular terrorist attacks thrive on overreaction, and anything communities and governments can do to shift the equation in their own favor is worth considering.

While details are still unfolding in Belgium, it appears authorities successfully merged intelligence on extremist travel and violent ideology with intelligence on individuals with criminal backgrounds, resulting in several raids designed to preempt possible attacks. Disrupting the plans of “known wolves” is a primary challenge for 2015 and beyond, as extremist ideology and criminal behavior continue to merge.


For tailored research and analysis, please contact:

Screen Shot 2013-10-21 at 9.32.42 AM