Blurred Lines

​As Americans tried to make sense of the worst mass shooting in recent history, the Islamic State saw an opportunity. After a shooter opened fire from a high-rise hotel in Las Vegas upon a crowd of concertgoers below, killing at least 58 before ending his own life, ISIS claimed responsibility for the attack. The Amaq News Agency, an outlet linked to ISIS, reported that the shooter had converted to Islam a few months prior and followed instructions to carry out an attack on the Las Vegas Strip. So far, however, authorities say there is no connection between the shooter and the international terrorist organization—although his motive for the shooting remains unclear.

This is a common move by ISIS, especially while the organization continues to lose territory in Iraq. The extremist organization has claimed responsibility for several deadly incidents this year—including the killing of 37 at a Manila casino in June, the August vehicle attack in Barcelona, and the attempted London subway bombing in September—but authorities say there were no concrete connections between ISIS and the perpetrators of those events.

And even after events where there is a discernable link between the attacker and a terrorist organization, the verbiage surrounding the motive can be confusing—phrases like "inspired by," "affiliated with," or "radicalized by" can create more questions than answers.

"The sorts of attacks ISIS has claimed responsibility for are all over the place in terms of the accuracy of those claims," says Peter Mandaville, a George Mason University professor and senior fellow with the Brookings Institution. "It's a strategic communications or political calculation on its part for it to step forward and claim an attack, whether or not it had anything to do with it at all."

The National Consortium for the Study of Terrorism and Responses to Terrorism (START)—a leading resource for global terrorism research and attack data—has designated four classifications for ISIS-related terrorism. ISIS predecessors are organizations that were part of ISIS prior to adoption of its name in 2013; affiliated attacks are conducted by organizations that have declared allegiance to ISIS; inspired attacks are by individuals who have indicated that they were motivated by allegiance to ISIS; and an attack by ISIS itself is carried out by operatives of the core of the organization, primarily based in Iraq and Syria.

In its recent overview of terrorism in 2016, START researchers note that classifying predecessors and affiliates was a difficult process. "Perhaps the most significant challenge is the fact that links between these groups exist on a continuum ranging from formally established, operational coordination and cooperation to more abstract, ideological support," a methodological note in the report states. "Further complicating matters is the fact that often little detail about the exact nature of these relationships is available in open source materials, and the terminology used by both the media and the group leaders is extremely imprecise. Terms such as 'link,' 'allegiance,' 'alliance,' 'support,' 'loyalty,' and 'endorse' are used interchangeably."

Additionally, researchers must conduct a thorough review of direct evidence from an attack—such as statements to authorities from the perpetrator or their postings on social media—to accurately classify individual attackers as inspired by, but not linked to, ISIS.

But in the immediate aftermath of a crisis, trying to classify an attacker's relationship—if any—with an extremist group can feel frivolous. During an investigation, as with the Las Vegas shooter, initial links with extremists that are later disproved can spark government coverup conspiracy theories. And if ISIS is increasingly falsely claiming responsibility for incidents, how much attention should be paid to its claims?

"It matters from the point of view of how you assess the level of risk that the attacker represents and how you deal with it," Mandaville says. "If someone is a lone wolf attacker who is operating in an inspired mode and carries out a low-tech attack, and otherwise has no operational connections to one of these movements, then you deal with that person in a different way than someone who is actually a figure within a network of operatives present in your country that has actual organizational connections to one of these groups. In that case, that suggests evidence of a more systematic threat that law enforcement and security services need to respond to in a more thorough way."

START researchers' exhaustive analysis of each attacker's motives for some 1,400 terrorist incidents in 2016 also helps provide a bigger-picture understanding of the threat. For example, START's 2016 terrorism overview report maps out attacks by the four categories of ISIS attackers. The graph shows a rapid leap in ISIS-affiliated attacks in early 2015 but a gradual decline over 2016, signaling Boko Haram's rise and fall as an ISIS affiliate.

The data can help point counterterrorism and investigation efforts in the right direction, as well as illustrate to researchers the aims—and struggles—of extremist organizations.

"In a sense, we're dealing with what you might call the human resources problem that these groups face," Mandaville explains. "It's a calculus of the cost and risks associated with training and directly deploying operatives in an operational way, versus achieving their goals by trying to inspire individuals that otherwise have no connection to them to try to undertake these kinds of attacks."

Mandaville, who was born in the Middle East and advised various government agencies following 9/11, says the struggle of recruiting versus inspiring attackers is not new—and cites al Qaeda as an example.

When the global jihadist movement first started to come together in Afghanistan in the 1980s, al Qaeda operated in a classic guerilla warfare style with a clear command structure. However, the 9/11 attacks were divisive among the jihadist movement, creating a shake-up in the structure of the extremist organization, Mandaville says.

"Al Qaeda lost a lot of its best trained followers, people who disagreed with the attacks, and it had to rely on amateur jihadis, self-starters, and people it couldn't directly reach but only inspire and provide minimal direction," Mandaville tells Security Management. "That element of needing to take what it could get is certainly very relevant here."

After ISIS recently lost control of Mosul—which it took over and declared a caliphate three years ago—experts say they are seeing more desperation from the extremist group, including laying claim to attacks that had nothing to do with it.

"Where this goes in the next phase of the counter-ISIS strategy really depends on what sorts of calculations ISIS makes as the current operations against it really seem to get close to its core areas of control in Syria," Mandaville explains. "It could voluntarily give up territory and simply revert to a more conventional insurgency guerilla mode in order to continue surviving. We maybe regain the territory it controls, but ISIS continues to exist in some form."

Mandaville notes that as ISIS continues to lose physical ground, more foreign recruits are going to be displaced, potentially creating a new type of terrorist that defies existing categorization.

"No matter how this goes in the next few months, one of the key questions facing the national security community right now is what happens to the thousands of foreign fighters who went to Syria to work with them?" Mandaville says. "While regaining ISIS-controlled territories is certainly a positive development, it's actually going to also confront us with new risks and new sorts of policy conundrums."

Another uncategorized extremist player that often flies under the radar is what Mandaville calls the online fanboy—the person who has no interest in carrying out attacks in the name of ISIS, but contributes to the cause by retweeting extremist propaganda and amplifying its message.

"The various roles that people can play in helping these groups reach other people, including potential recruits for violent or kinetic activity—you have to understand there's an ecosystem that's much broader than just the people who carry out the attacks themselves, or the people who represent the jihadi groups that try to recruit them," Mandaville says.