The steady stream of terrorist attacks over the last two months has seen the worst fears of many terrorism analysts realised, and called into question the fundamentals of how governments 'do' counter-terrorism.
The investigative ethos at the heart of counter-terrorism is fairly simple. Intelligence agencies ask two broad questions: is this person or group linked to people we already know are terrorists, and does their visible activity include behavioural precursors that have been reliably linked to terrorism in the past?
These two questions lie at the heart of both the triaging of new leads and active investigations. In the case of the latter, agencies have created 'tripwires' to identify suspicious behaviour, such as suddenly buying large quantities of fertiliser or making unexpected plans to travel overseas.
In the current climate, where most agencies have more targets than investigative capacity, drawing a negative on both of these questions means an investigation is unlikely to go any further. Yet from what we know so far about the staggering number of individuals and groups behind attacks over the past eight weeks and beyond, for some the answers to these questions would have drawn a blank.
This is in large part due to a shift in terrorism strategy articulated by al Qaeda in their Inspire magazine in 2010 but brought to life by ISIS: open-source jihad. By encouraging attacks in which the attacker alone identifies the target, timing and method, it removed the requirement for pre-attack coordination with known terrorist entities.
In many ways, the conflict in Syria (while an obvious fillip for Islamist extremism across the world) delayed the advent of these types of attack. Why focus domestically when you could travel to Syria and Iraq instead? But as Western governments began to realise the scale of what was unfolding in the Middle East, it became more difficult to travel to those locations. As a consequence, radicalised individuals unable to leave their own country (such as Numan Haider in 2014 in Melbourne) shifted the target of their violence inwards. [fold]
The subsequent media coverage and ISIS's praise for such attackers as martyrs for their cause have had real consequences. The dual factors of posthumous media infamy and the pardoning of previous sins has attracted individuals beyond those connected to known terrorists or with terrorist-like behaviours, individuals for whom intelligence agencies would have drawn a blank.
We saw this in Orlando in June. Omar Mateen was neither meaningfully connected to known extremists or behaving like one. Based on what we know so far, neither was Nice attacker Mohamed Bouhel. Instead, analysis has focused on issues of identity, sexuality, mental health and a violent past (and, in Bouhel's case, on further evidence of the connection between persistent criminal behaviour and a subsequent shift towards extremism).
These factors may be useful in understanding which individuals already under investigation might take extreme and violent actions, but they are not unique behavioural indicators of use to intelligence agencies. In a practical sense, any attempt to overlay them on top of the existing counter-terrorism investigative approach would be unworkable.
If our understanding of what a terrorist looks like is starting to shift, so too is the judgment intelligence agencies must make about whether links to known terrorists are an important factor in deciding whether an attack is likely to succeed, and how lethal it will be.
This second point has also historically been central to counter-terrorism strategy. Operational experience and statistics showed that an attack plot involving returned foreign fighters or instruction from terrorist groups overseas would be significantly deadlier than those that did not. While lone actors or self-starters were certainly a concern, they typically struggled to build explosive devices or get access to weaponry without contacting known terrorist or criminal entities.
Unfortunately, isolated actors and their cheerleaders overseas have realised this too. As Nice, Orlando and potentially Wurzburg all demonstrate, these unconnected individuals or networks are instead focusing on softer and typically more local targets. And utilising an attack methodology that challenges intelligence agency notions of what behaviour makes an individual 'look like a terrorist'. After all, possessing a knife or renting a truck is no obvious precursor to a terrorist attack.
Yet both Nice and Orlando have proved deadlier than many previous attacks directed by terrorist networks overseas or carried out by returning foreign fighters. Their tragic impact will not have gone unnoticed by the rest of the would-be terrorist community.
Terrorist attacks over the past two months have challenged many counter-terrorism pre-conceptions. The Australian Government is right to review existing processes to counter these 'new' threats, and in particular, look at the safety of public events. But attempts to draw a wider net, and include mental health records, links to criminality and addiction, are no guarantee of success. What is certain is that, in the short-term, there are unlikely to be any easy answers.
Photo: Flickr/European Parliament