Terrorist Use of the Internet by the Numbers: Quantifying Behaviors, Patterns, and Processes

Research Summary Public interest and policy debates surrounding the role of the Internet in terrorist activities is increasing. Criminology has said very little on the matter. By using a unique data set of 223 convicted United Kingdom–based terrorists, this article focuses on how they used the Internet in the commission of their crimes. As most samples of terrorist offenders vary in terms of capabilities (lone-actor vs. group offenders) and criminal sophistication (improvised explosive devices vs. stabbings), we tested whether the affordances they sought from the Internet significantly differed. The results suggest that extreme-right-wing individuals, those who planned an attack (as opposed to merely providing material support), conducted a lethal attack, committed an improvised explosive device (IED) attack, committed an armed assault, acted within a cell, attempted to recruit others, and engaged in nonvirtual network activities and non-virtual place interactions were significantly more likely to learn online compared with those who did not engage in these behaviors. Those undertaking unarmed assaults were significantly less likely to display online learning. The results also suggested that extreme-right-wing individuals who perpetrated an IED attack, associated with a wider network, attempted to recruit others, and engaged in non-virtual network activities and non-virtual place interactions were significantly more likely to communicate online with co-ideologues.

5 variations in Internet behavior across subsets of terrorists. Younger offenders were significantly more likely to engage in both virtual learning and virtual interaction than were older offenders. Non-U.S.-based offenders were significantly more likely to learn through virtual sources, which may be a function of U.S. offenders having greater access to firearms and, therefore, not needing to go online to source these. They also found a significant positive correlation existed between those who virtually interacted with co-ideologues and those who interacted with co-ideologues face to face. Lone-actor radicalization is not, therefore, a dichotomy of either offline or online but a dichotomy of interaction with others versus no interaction with others.

Violent Online Political Extremism Database
Data-driven studies on online radicalization have been rare. Even for a field as bereft of empiricism as terrorism studies, the striking lack of data is surprising. As an illustration, the first 200 abstracts from a Google Scholar search of "online radicalization OR online radicalisation" shows only 6.5% used some form of data. Primary data existed in 2% of the studies. These mostly focused on extremist forums and social media and, therefore, captured radicalized individuals (and not necessarily individuals prepared to engage in terrorist acts). 3 For this article, we set out to develop a database of terrorist offenders focused on their online behaviors. To maximize the potential utility of this endeavor and its scientific rigor, we considered several potential pitfalls. First, the initial goal of our study was to examine those individuals who radicalized online. Nevertheless, if our study focused only on individuals reportedly radicalized via the Internet, we could not look at the correlates of terrorists' decisions to use the Internet because the data would exclude cases in which the perpetrator did not use the Internet. In other words, we would be unable to falsify our claims or test hypotheses based on the arguments of the wider literature. Therefore, we decided to build a database of terrorist actors and code for numerous Internet-related activities and their presence or absence. By doing so, we could capture a continuum of Internet-inspired actors from those who were completely uninspired to those who were fully inspired and plot intervening positions.
This decision had implications for how far we could realistically spread our scope geographically and ideologically. Including those who radicalized offline necessitated tightening the search in other areas to allow for the data collection needed to conduct this study. We required our observation pool to be sufficiently large to allow for the application of inferential statistical methods. We also decided the actor dictionary should be limited to a single country to minimize potential open-source reporting bias and the need for crossnational data. In other words, some countries may report (online) radicalization in different ways; to avoid the vagaries of culturally distinct reporting methods, then, we settled on a single-country focus. A single country with a sufficient number of terrorism cases was, therefore, deemed the most appropriate choice. Access to open sources is the key to building such a database, so English-language texts were crucial. This left us with two countries, the United Kingdom and the United States. We chose the United Kingdom for two reasons: (1) prior research by Gill and Corner (2015) showed higher levels of online behaviors in the U.K. sample versus the U.S. sample of lone-actor terrorists and (b) terrorism actor dictionaries were more available.
Individuals were identified through several pre-existing actor dictionaries. Simcox, Stuart, and Ahmed's (2010) study listed all al-Qaeda-inspired individuals convicted in the United Kingdom. We updated this list to the end of 2014 and widened the scope to reflect very early Islamic State of Iraq and Syria (ISIS)-related activities. The data do not account for the large wave of activities from 2014 to date connected with ISIS and its social media activity.
Because of the addition of some early ISIS-related activity, we collapsed both al-Qaeda-and ISIS-related actors into one Jihadist-inspired actor category for the analyses that follow. We added additional extreme-right-wing names through tailored search strings developed and applied to the LexisNexis "All English News" option. Although aggregated to the single category of "extreme right wing," these offenders are stratified across numerous grievances, including anti-immigration, anti-government, anti-Muslim, and anti-Jewish. Additional individuals were identified through the U.S. National Consortium for the Study of Terrorism and Responses to Terrorism's (START) Global Terrorism Database (GTD). Various publications on right-wing extremism in the United Kingdom and lone-actors identified through previous studies (Gill et al., 2014) were also included. We decided to limit the population to post-1990 events because large portions of our data were sourced from the LexisNexis 4 archive, which remains limited before 1990. Irish Republican actors were also omitted from data collection as their online activities were rarely, if ever, mentioned in opensource reporting. Left-wing extremists were next to impossible to identify in a rigorous manner because of the lack of existing research on this phenomenon and because U.K. legislation tends to treat these offenders under criminal damage statutes. They are, therefore, subsumed under a wider category of non-politically oriented offenders. We restricted our scope to those who were either convicted in the United Kingdom or died in the commission of a terrorist act in the United Kingdom. Foreign fighters in Syria and elsewhere were therefore omitted.
In total, 223 offenders fit the geographical, temporal, and operational criteria for our study.
The variables spanned sociodemographic information (e.g., age, gender, occupation, family characteristics, relationship status, occupation, and employment), network behaviors (e.g., number of co-offenders and training location), event-specific behaviors (e.g., attack method(s), target(s)), and post-event behaviors and experiences (e.g., claim(s) of responsibility and arrest/conviction details). Data were collected on demographic and background characteristics and radicalization-linked behaviors by examining and coding information contained in open-source news reports, sworn affidavits, and when possible, publically available first-hand accounts. Most data were collected from press reports via tailored LexisNexis searches. Additional information was gathered from online public record depositories (e.g., documentcloud.org), terrorist biographies, and relevant scholarly articles.
The variables related to online activities were developed in two stages. The first stage emerged from Gill and colleagues' previous lone-actor terrorism research (Gill and Corner, 2015;Gill et al., 2014). Gill et al. (2014) addressed two questions related to online behavior: Did the individual learn about the attack plans from virtual sources? Did the individual interact with co-ideologues online? Gill and Corner (2015) unpacked these two questions further and outlined a series of illustrative examples to show that the types of learning and interaction differed from case to case. The second stage involved an iterative coding process that developed new questions as the data were collected and reviewed.

Two coders examined all available open-source information on each individual. In cases
where coders could not agree on the correct values for particular variables (e.g., one coder marked it as a "yes" and one marked it as a "no"), differences were resolved based on examination of the original sources that the coders relied on to make their assessments. Such decisions factored into the comparative reliability and quality of the sources and the sources cited in the report. To aid these decisions, each source was plotted on a continuum of reliability. Court transcripts and associated documents were deemed most reliable as these documents recorded final judicial decisions. Competency evaluations, sworn affidavits, and indictments were deemed reliable as these were carried out after arrest and before trial when initial investigations had been made. Statements (verbal or written) by the terrorist/affiliated group were deemed only somewhat reliable as there may be a drive for dishonesty. Warrants and expert witness reports (in the context of trials) were also reasoned to be somewhat reliable as warrants are produced prior to arrest and like expert witness reports are subject to unreliability and bias. Media articles were then placed on a separate continuum within the less reliable end of the spectrum, with personal opinion blogs at the least reliable end of the scale and non-tabloid newspapers at the most reliable.
Some limitations exist in the sources used. First, the sample only includes information on individuals who planned or conducted attacks that led to convictions or death in the perpetration of the attack. It does not include plots intercepted or disrupted by security forces without a conviction. Second, data collection was limited to what could be collected from open sources for each terrorist offender; police, intelligence, classified, and/or closed-source files were unavailable to the researchers.
Third, it is often difficult to distinguish between missing data and variables that should be coded as "no" or "not present." Given the nature of newspaper and open-source reporting, it is unrealistic to expect each biographically oriented story to contain lengthy passages that list behaviors the offender did not engage in (e.g., the offender was not a substance abuser, a former convict, or recently exposed to new media). Definitive "no" answers were a rarity (less than 5%) within the data collection process. This percentage was generally uniform across most variables. Usually these "no" answers only occurred in response to incorrect reporting earlier in the news cycle about a particular offender. If definitive "no" answers were more prevalent, it would have been possible to consider using multiple missing data imputation methods (Scheffer, 2002). Current research by the first two authors in collaboration with the Greater Manchester Police has suggested that regularly finding definitive "no" answers necessitates access to closed-source data. Therefore, each variable in the analysis is treated dichotomously (e.g., the response is either a "yes" or not enough information to suggest a "yes" and, thus, a "no"). Unless otherwise stated, each percentage reported is of the whole sample (N = 223). There is precedent for this in previous research on attempted assassinations of public figures, fatal school shootings, and targeted violence affecting higher education institutions and terrorism (Fein and Vossekuil, 1999;Gill et al., 2014;Gruenewald, Chermak, and Freilich, 2014;Vossekuil, 2002).
Fourth, it was difficult to get consistently complete data on the temporal ordering of the variables. This is usually because the behaviors are not reported in this manner within our data sources (instead they are usually listed as present). Where possible, illustrative examples of what these orderings looked like in various cases are presented.
Finally, although the level of available granular behavioral data were greater than for some other types of issues that could be equally important (such as family upbringing or other factors associated with exposure to extremist narratives), this granularity does not go so far as to outline consistently the online spaces (e.g., websites, forums, and social media platforms) relied on, exact information gathered online, or frequency of Internet activity.
Despite these limitations, open-source accounts can provide rich data. This has been validated in other studies focusing on the sociodemographic characteristics, operational behaviors, and developmental pathways of members of formal terrorist organizations and lone-actor terrorists (Gill and Horgan, 2013;Gill et al., 2014). Reporting (and, hence, data availability) also tends to be richer when terrorism incidents are rare. For example, Gill et al.'s (2014) study of lone-actor terrorists (N = 119 over a 22-year period) obtained educational data on 65% of the sample, whereas in Gill and Horgan's (2013) study of provisional IRA members (N = 1,240 over a 29-year period), similar data were obtained on less than 10% of the sample.
Analogous research also has indicated accessible information is more readily available in rare violent events (Duwe, 2000(Duwe, , 2005.

Methods
To compare those actors who engaged in online activities with those who did not, we followed the procedures in Gruenewald et al. (2013). We first conducted a series of bivariate tests such as chi-square analyses and, where appropriate, Fisher's exact tests. The significant differences between these subsets are discussed as follows. A series of odds ratios were then calculated.

Descriptive Findings
The offenders captured in this database were overwhelmingly male (96%). They ranged in age from 16 to 58 years old with a median age of 27, a mode of 22, and a mean of 28. One third were unemployed at the time of their arrest/attack, a further one third worked in the service or administrative sectors, and 14% were students. Twenty-two percent had some university education. Half of the convictions were related to a planned attack, whereas the other half were related to facilitative behaviors (e.g., financing or distributing propaganda).
Only 14% of the convictions were related to a completed attack. A total of 62% were associated with a wider network of co-ideologues, 83% were associated with an attack cell, 22% attended a terrorist training site, and 9% had front-line experience in foreign insurgencies.
When turning attention to online activities, in 61% of cases, there was evidence of online activity related to their radicalization and/or attack planning. As mentioned, we disaggregated these behavior types, which are rank ordered by prevalence in the following discussion.
Slightly more than half (54%) of all actors used the Internet to learn about some aspect of their intended activity. Since 2012, this figure has increased to 76%, indicating it is becoming more prevalent (even if the number of offenders year on year has not risen substantially).
This finding is perhaps unsurprising given the ubiquity of Internet usage in most benevolent activities across wider society. Extremist media were found or downloaded and subsequently reported on in open sources for 44% of the perpetrators. In half of these cases (21%), the content was reportedly videos with a smaller percentage reported for audio lectures (7%) and photographs (6%). The content itself ranged broadly and included extremist-produced video montages of 9/11 and attacks on Western coalition forces in Iraq; beheadings and executions; crimes against Muslims in Chechnya, Afghanistan, and Iraq; news footage of bombings; interviews with and speeches by Anwar al-Awlaki, Osama bin Laden, Abu Hamza, and radical preachers; pro-Jihad rallies; Jihadist texts; bomb-making instruction videos; and terrorist training videos.
A third (32%) prepared for their attacks by using online resources. These included bombmaking instruction videos; poison manuals; downloaded copies of Inspire magazine; surveillance advice; an assassination guidebook; torture techniques; suicide vest production; body disposal; plans for the London Underground, Buckingham Palace, and other symbolic landmarks; military police voting records; and terrorist training manuals.
At least 30% accessed extremist ideological content online. In many cases, arguably too much material was downloaded for any one individual to consume and understand thoroughly. One perpetrator had 17,779 computer files of ideological material, 1,152 of which contained extremist content. This may be typical for those individuals that download materials in large volumes via BitTorrents. 5 Slightly less than a third (29%) of actors communicated with other radicals virtually, half of whom did so via e-mail (15%). Fewer actors communicated with others via online discussion forums (8%) and chat rooms (9%). Some of these interactions circled around the legitimacy of target selection. In one case, the interactions involved discussion of the comparative legitimacy of targeting civilians as opposed to civil servants or the police. In other cases, the interactions involved discussion of the intricacies of carrying out an attack. For example, one case involved a detailed discussion around the making of the highly explosive organic compound hexamethylene triperoxide diamine (HMTD) and how to develop the correct concentration of hydrogen peroxide.
Fifteen percent of actors disseminated propaganda online. This content was usually created by others and recirculated by the actors in our sample. Some of these individuals set up specific websites for this purpose. For example, the administrators of the Aryan Strike Force website are included in the offender data set. Others attempted to publish manuals concerning firearms and explosives on the Internet to incite others.
Our results suggest that 14% of offenders opted to engage in violence after witnessing something online. For example, on May 14, 2010, Roshonara Choudhry stabbed Stephen Timms, a Labour Party Member of Parliament, causing him serious bodily injury. During her police interview, Choudhry referred to a specific YouTube video of Sheikh Abdullah Azzam that made her understand that "even women are supposed to fight" and that she had an obligation to engage in violence. According to police interviews, Choudhry made this realization at some point in April and soon after began her preparations for the attack. Five percent also signaled online their plans to engage in attacks prior to the attack itself. In most cases, it was only possible to identify whether the Internet was used. The number of times actors used Internet sources or the hours spent online were impossible to determine.
Isolated cases do provide some insight, but this is variable and not generalizable. One actor began researching bomb-making techniques weeks before engaging in his attack, whereas others reportedly spent months on Internet research, with one actor spending possibly 6 hours a day watching extremist footage and videos. In most plots, we see many of these outlined activities occurring at the same time.

Bivariate Analysis
First, we examined the differences between those who learned online and those who did not. Table 1 outlines these results.
The bivariate results suggest that extreme-right-wing individuals, those who planned an attack (as opposed to merely providing material support), conducted a lethal attack, committed an improvised explosive device (IED) attack, committed an armed assault, acted within a cell, attempted to recruit others, and engaged in non-virtual network activities and non-virtual place interactions were significantly more likely to learn online compared with those who did not engage in these behaviors. Those undertaking unarmed assaults were significantly less likely to display online learning. Odds ratios 6 indicate extreme-right-wing offenders were 3.39 times more likely to learn online than were Jihadist-inspired individuals.
This finding may be a function of the differing circumstances these ideological movements experience in the United Kingdom. The United Kingdom's violent extreme-right movement tends to use the Internet for recruitment, communication, and information dissemination (Thornton, 2015), and compared with Jihadist-inspired lone-actors, extreme-right-wing terrorist activity is more likely to be conducted online in the United Kingdom (Gill, 2015).
The bivariate results showed some interesting findings with regard to target choice. Those who plotted to attack a government target (as opposed to the civilian population) were 4.50 times more likely to learn online. Indeed 83% of those who plotted to attack a government target displayed online learning traits. Given the additional security around government targets (compared with civilian ones), it is a riskier and more arduous practice. The need to go online and learn, therefore, is consistent with our thinking around how different subsets of offenders use Internet affordances differently.
We also found evidence of differing utilization of affordances with regard to attack type. Of all those who actually plotted an attack, those who used/planned to use an IED were 3.34 times more likely to have learned online. This reflects both the greater complexity in IED manufacturing compared with other weapons coupled with the relative ease of availability of online bomb-making manuals and YouTube videos that provide helpful demonstrations. On the other hand, those who used more primitive attack types, like arson or unarmed assaults, were significantly less likely to have learned online.
The bivariate analyses likewise found differing utilization of affordances with regard to the offender's immediate co-offending network. Lone-actors were 2.64 times more likely to learn online than were members of a cell. This may be a reflection of the fact that within a cell, there is a likely pooling of human, social, technical, and financial capital, the absence of which leads individuals to go online to learn how to conduct attacks and for other purposes.
The corresponding finding that lone-actors who tried to recruit others (and failed) were 5.00 times more likely to have learned online also lends credence to this interpretation.
Those who targeted the military were significantly less likely to have communicated online.
Only 7.4% of those who plotted against the military communicated online with coideologues. This may run counter to our expectations regarding affordances. It is probably a marker of greater operational security among these offenders.
The evidence also suggests that communicating with co-ideologues online was significantly more likely to have been accompanied by face-to-face interactions with nonviolent coideologues. Those who communicated online were 3.89 times more likely to have experienced non-virtual network activity and 3.17 times more likely to have experienced nonvirtual place interaction. Of those who plotted an attack, the individuals who attended training camps were also significantly more likely to have communicated online.

Multivariate Analysis
The bivariate results highlighted that extreme-right-wing offenders were significantly more likely to learn online than were Jihadist-inspired individuals. We hypothesized that the lack of collective action within the extreme-right-wing movement in the United Kingdom may lead individuals to seek answers online because they are not available offline. We therefore conducted binary logistic regression analyses for the five different types of learning outlined in the Data and Methods section to see which could significantly predict individuals as rightwing extremists (Table 3). The results illustrate that the sole difference in terms of the instrumentality of the learning was in attack preparation. Extreme-right-wing offenders were look at behaviors, intentions, and capabilities. Offenders hampered by their co-offending environment or the ambitions of their plot are afforded opportunities online. We found significant differences across targeting strategies, ideologies, network forms, and actors' propensity to engage in online learning and communication. Selection of harder targets was strongly associated with online learning. Technically more difficult attacks such as IEDs led to more online searching compared with primitive or simpler attacks. Lone-actors required more online learning because they lacked the pooled human talent typically associated with an attack cell. Extreme-right-wing offenders were more likely than Jihadist-inspired offenders in the United Kingdom to learn and communicate online. This may be a result of geography and the structural unavailability of co-offenders in their local area, as well as of their increased likelihood of being "lone-actors." This study also highlights the fact that there is no easy offline versus online violent radicalization dichotomy to be drawn. It may be a false dichotomy. Plotters regularly engage in activities in both domains. Often their behaviors are compartmentalized across these two domains. For example, plotters may engage in face-to-face interaction regarding the ideological legitimacy of their actions while engaging in virtual communication regarding the technical specificity of bomb-making. Threat management policies would do well to understand the individuals' breadth of interactions rather than to rely on a dichotomous understanding of offline versus online, which represent two extremes of a spectrum that regularly provide prototypical examples in reality. A preoccupation with only checking online behaviors may lead an intelligence analyst to miss crucial face-to-face components of a plot's technical development or a perpetrator's motivation.
Perhaps policy debates in this area have been focused on the wrong things and in the wrong place. Policy seems fixated on the location in which the radicalization played out. We regularly see new proposals focused on different radicalization locales (e.g., online, prison, university, school, or place of worship). Our results suggest that often online and offline interactions go hand in hand. Policy and practice may benefit from adopting insights from emerging research arguing in favor of disaggregating our conception of the "terrorist" into discrete groups (e.g., foreign fighters vs. homegrown fighters, bomb-makers vs. bombplanters, and group-actors vs. lone-actors; Gill and Corner, 2013;LaFree, 2013) rather than of disaggregating the radicalization process into discrete groups (e.g., online radicalization and prison radicalization). We need to understand the drives, needs, and forms of behavior that led to the radicalization and attack planning and why the offender chose that environment rather than purely looking at the affordances the environment produced.
As illustrated throughout, cases in which all transactions were conducted online are rare.
Face-to-face interactions were still the key to the process for most actors even if they were aware of, and made use of, the bounty of ideological and training material available online.
Indeed, much recent investigative reporting of ISIS recruitment of Western individuals has highlighted the importance of face-to-face interactions via Skype (Microsoft Corporation, Redmond, WA) and other online platforms (Callimachi, 2015;Erelle, 2015). Violent radicalization should therefore be framed as cyber-enabled rather than as cyber-dependent while underlining that enabling factors differ from case to case depending on need (i.e., who or what to attack and what tactic to use) and circumstance (i.e., availability of co-offenders, expertise, and ideology). The use of the Internet was largely for instrumental purposes whether it was pre-attack (e.g., surveillance, learning, practice, or communication) or postattack (e.g., disseminating propaganda). There is little evidence to suggest that the Internet was the sole explanation prompting actors to decide to engage in a violent act. Instead, it was just one factor among many that helped crystallize motivation, intent, and capability at the same time and place. Our results further suggest that many went online not to have their beliefs changed but rather to have them reinforced. This falls in line with von Behr et al.'s (2013) previously cited research. Take, for example, Ian Davison who in 2010 was the first Briton to be convicted for producing a chemical weapon (ricin). In the aftermath of his trial (in which his son was also convicted on other offenses), police sources noted that Davison's "views developed over time. After going online he accessed websites and started to look at places where those kinds of views were shared with other people." By looking at the Internet as an affordance opportunity that some forms of terrorist or terrorist violence require more so than others, the focus is shifted from the radicalization process toward an understanding of how crimes are committed. In other words, we are looking at crime events rather than at the underlying dispositions behind the criminality. This, of course, is the main thinking behind situational crime prevention approaches (Clarke, 1980;Clarke and Newman, 2006). Not all situational crime prevention approaches are easy to implement within the virtual realm where large social media organizations have displayed resistance or apathy, until recently, to increase the effort and risk of radicalizers and the radicalized to operate freely on their platforms. For example, see Twitter's ongoing battle with ISIS-related accounts (Berger and Perez, 2016). Cooperation between these organizations and state bodies is crucial in combatting the affordances provided to would-be terrorists. State policies may potentially need to reframe this cooperation as a battle against opportunities for violence rather than as a battle against expressions of radical ideas and thoughts, which has recently dominated discourse on both sides of the Atlantic.