The Largest Security-Cleared Career Network for Defense and Intelligence Jobs - JOIN NOW


Table of Contents


Terrorism as a Unique Form of Crises

Research conducted on international terrorist Incidents from 1946 to 1980 identified several unique characteristics of terrorism Incidents as contrasted with "crisis" events of a conventional nature.

  • Terrorist crises are of very short duration.
  • The pre-crisis activities of authorities tends to be routine rather than at alert or pre-alert stages.
  • Relatively little warning, if any, is discerned prior to terrorist actions.
  • The threat in terrorist crises develops much faster than in other crises.

In addition, the distinctive character of terrorism was suggested by the experiences of U.S. and allied governments in responding to terrorist incidents:

  • Terrorists operate covertly but within civilian populations, making conventional investigative responses difficult and sensitive,
  • Terrorist organizations are fundamentally nongovernmental bodies, not susceptible to most normal, political, economic, or investigative efforts,
  • Communications and response channels between governments and terrorists are unconventional (e.g., on the scene negotiators, victim, or media), and
  • Responses to terrorism require interdepartmental multidisciplinary support, (e.g., intelligence, linguistics, logistics, psychology, and unconventional warfare forces) to deal with the problem.

Terrorism as Stylistic Behavior

Several developments in recent research efforts in this field have caused a substantial modification in the approach that terrorism research takes. Most of the research efforts to date have concentrated on incident oriented data collections and comparisons across incidents. The authors' research findings indicate that this approach forces investigators into a reactive mode of operation. Research results suggest that governments will never be able to prevent or deter attacks if analytical expertise remains at the level of merely studying incidents after the fact. In fact, the only approach.that allows for aggressive research aimed at early detection, interdiction, and prevention is that which focuses on the group. It is at this level that research begins to show the stylistic and patterned forms that the behavior takes. For example, patterns show up in the following categories:

  • Target selection,
  • Tactics, operational and strategic.
  • Training methods,
  • Weapons selection, acquisition, and use,
  • Joint operations,
  • Name date use,
  • Incident contagion between and among groups.

These patterns are subject to systematic. analysis. Research and collection efforts can be successfully directed toward the management and prevention of terrorist?induced crises, and a crisis management aid specifically designed to deal with terrorism can produce important benefits to the analytical team.

For example, one pattern emerging across incidents is the size of the operating teams different groups use. It appears that the size of the team will be dictated by the type of operation being undertaken and the "intelligence assessment" done by the group on its chosen target. For instance, the Italian Red Brigades uses a three person unit for most maimings, utilizing two team members as assailants and the third for escape and cover. The German RAF uses two to four people for bombings and at least five for kidnappings. The typical Palestinian assassination team consists of five people -- an observer/spotter, one lay-off man who maintains communication with a headquarters unit, sad a three man attack team to actually carry out the assassination. This pattern was used in the assassination of the Prime Minister of Jordan, Wasfi Tal and the bombing of the Israeli Ambassador's residence in Rome.

There are also indications of learning processes at work in the development of team sizes. The Japanese Red Army's first major incident was a hijacking executed by a nine-man unit. All nine members were detained at the plane's final destination and have not been heard from or seen since. Thereafter, the JRA never used more than five people in any one incident.

Patterns apparently also carry across groups, particularly when groups have trained together. The Black September Organization invariably fielded teams with instructions to take no independent action. The team was to await instructions during incidents. In the barricade and hostage incident at Khartoum in which Black September killed two U.S. diplomats and Belgian Attache, orders to execute the hostages emanated directly from PLO leader Yasir Arafat in. Beirut. When a mixed team of Palestinians and Japanese hijacked an airliner out of Amsterdam and destroyed It at Benghazi, Libya, orders for the plane's destruction reportedly were received over the plane's radio, in German, from Switzerland. Later, when a mixed German and Palestinian team hijacked a French airbus to Entebbe in June of 1976, the team reportedly was in constant contact with PFLP leader Wadi Hadad, based in Magadishu, Somalia. The four organizations involved -- BSO, PFLP, JRA, and RAF-- share many tactical similarities. Moreover, members of each trained in various Palestinian camps in Lebanon, Jordan, and South Yemen.

The sheer number of groups and individuals training together controverts what once was common wisdom among terrorism researchers. It was postulated long ago that the intense ideological commitment required of terrorists inhibited exchanges among them. Terrorists were thought to be doctrinaire and unyielding in arguments on strategy and tactics. Communications and cooperation among groups was thus thought unlikely. Ideological divisions would run deeper than the perception of a common goal.

This belief was supported by a large number of examples. Groups frequently splintered over tactical considerations. Internecine conflict was frequent. This pattern has not held over time and the level of exchange among groups is increasing rather than decreasing. Cooperation is observed among groups with common ideologies and goals, as well as across ideological and tactical divisions. Groups exchange members, weapons, and explosives. Terrorists train together and share Intelligence data, arrange secure staging locations and provide support for one another, and participate in joint operations. Although terrorist groups still factionalize, splinter, and follow separate tactical paths, cooperation, coordination of effort, and imitation now appear to be the rule. Determining how this exchange affects group actions, what changes in the terrorists' environment have occurred to promote inter-group interaction, and examination of patterned relations across incidents are all questions that remain to be answered, but are within the scope of capabilities the analyst can provide on group assessments.

Shifting the Unit of Analysis

The overall problem with existing data collections is their approach. They view individual incidents as the core element of terrorism research, and believe that terrorist behavior can be understood by studying terrorist acts (Mickolus, 1976). Although individual incidents are coded. extensively, the nature of the data limits the nature and scope of the questions they can realistically be expected to answer.

During the research study, it became evident that incidents are not the core element in terrorism research. Incidents very likely are a function of group objectives, capabilities, motivation, goals, and desires. The need to shift the focus of terrorism research from incidents to groups is based on a number of observations about the nature of terrorism, and the kinds of questions currently being asked by the terrorism research community:

  • Incidents do not occur in a vacuum. They are planned, organized, and carried out by individuals acting alone or in groups. The nature of the incident, its target, the level of force used, the types of weapons used, the number of people involved, and the behavior of the perpetrators will be dependent on the nature of the group.
  • Once a target is chosen, weapons choice and requisite force levels will probably be dependent on the nature of the target.
  • Forecasting trends in terrorist activity presently relies on extrapolations from past trends. These become poor predictors, however, as changes occur in the environment in which terrorists act. Improving security systems, decreasing the vulnerability of targets, and increasing public awareness of how to avoid becoming a terrorist victim will have an impact on future activity. As terrorism becomes more sophisticated and "costly," predictions about terrorist behavior increasingly will fall into the realm of terrorist capabilities (Can they do it?) and motivation (Do they want to do it?).

Responding directly to the terrorist threat requires more than information about past incidents. Indeed, the response should not be directed at the incident but at its perpetrators. This requires redefining the unit of analysis and asking new kinds of questions. Analyses should focus on the terrorist group, including its size, capabilities, motivations, goals, targeting practices, relations with host and target countries, support networks, and in particular:

  • The impact of capability and ideology on targeting practices
  • The impact of training on:
    - Capability
    - Incident outcome
    - Target selection
    - Time dedicated to planning and staging
    - Group reaction to adversity and success
  • The impact of factional divisions on later group activity and capability
  • The speed with which groups can acquire new capabilities
  • The impact of reorganization on cell autonomy, security patterns, authority structures, and intra-group communications and decision-making
  • The interaction between the group and support elements, and its impact on:
    - Planning
    - Movement
    - Staging

Incident data and the findings of incident-focused research are not abandoned when the focus shifts to groups; rather, they are incorporated into the research. The group focus does, however, open new areas for research and data collection by broadening the unit of investigation.


A Database is any structured collection of information about an identified subject.


  • Bring together diverse or fragmentary bits of information for storage in central location
  • Determine which data are useful for a particular analysis, and which may be discarded as extraneous
  • Place data in a uniform format
  • Prepare data for analysis

Minimum functions:

  • Storage
  • Retrieval


Some databases go considerably farther:

  • Provide a framework for analysis
  • Perform preliminary data analysis
  • Provide analytical techniques for interpreting results

Added functions:

  • Update
  • Cross-walking
  • Interactive software
  • Common language instructions
  • Use of Graphics

Database design and contents will vary according to its function and use:

  • Political reporting
  • Incident management
  • Group interdiction
  • Crime suppression/deterrence


Organization follows form:

Group files-substantive data and evaluation of group behavior, leadership, ideology and goals capabilities, and modus operandi

Incident files-detailed information on terrorists victims, weapons, times, dates, locations M.O, pre-incident indicators. '

Biographical filescomprehensive data on individual group members with complete social psychological, operational background.

Country files-quick reference files on factors that may affect group-to-country relations and counterforce operations.


  • Idealogy and goals
  • Countries of operation
  • Connections to national governments
  • Safe havens
  • Connections to other groups
  • Headquarters and training sites
  • Active strength
  • Support and recruitment base
  • Leadership

Capabilities and M.O. in:

  • Incidents
  • Weapons use
  • Explosives use
  • Communications
  • Signal intelligence
  • Security
  • Vehicles use
  • Propaganda dissemination
  • Intelligence
  • Organization penetration
  • Cover documentation
  • Finance sources
  • Medical support sources
  • Equipment sources
  • Treatment of hostages
  • Negotiating behavior


  • Incident type
  • Date and time
  • Location
  • Group involved
  • Number of terrorists/team composition
  • Disposition
  • Number of victims/status
  • Victim affiliation (nationality, job, role, etc.)
  • Facility type
  • Target security level
  • Damage level
  • Weapons used
  • Explosives used
  • Disguises
  • Protective equipment
  • Government response
  • Pre-Incident indicators
  • Summary
  • Sources


  • Identification -Names, aliases -Date of birth, place of birth
  • Physical characteristics
  • Documents used
  • Group membership
  • Residences
  • Vehicles
  • Personal characteristics
    -Posture -Use of disguise
  • Medical history
  • Psychological makeup
  • Affiliations
    -Within group
    -Across groups
  • Incident history/role
  • Training/expertise
  • Travel
  • Military history-employment background
  • Arrest record


  • Major active groups
  • Country relevant name dates
  • Group relevant name dates
  • Counterterrrism capability
  • Status of relations with the U.S.
  • Previous government experience with terrorism/terrorist groups
  • Attitude of majority population towards terrorist groups


Files developed according to threat:

  • International groups that have targeted U.S.
  • International groups that have threatened U.S.
  • International groups with operational capability to threaten U.S.
  • Others

Part 4 The Analytical Tools

Join the mailing list

One Billion Americans: The Case for Thinking Bigger - by Matthew Yglesias