The Asymmetric Threat of Self Initiated Violent Actors

By: Jonathan D. Greenstein In a previous article I proffered the term: Self Initiated Violent Actors (SIVA1) and my rationale for its inclusion into the lexicon applied to typing of individuals who seek to or engage in violent acts under the auspices of terrorism. This article is a continuation of and possibly part of a longer series of articles that will speak to the asymmetric threat posed by SIVAs. Background: SIVAs are defined as individuals who engage in acts of violence under the umbrella of terrorist causes without specific tasking by a higher authority. While they may undertake target specific attacks as proffered by the group to which they follow; their actions are not directed. They likely maintain a high degree of support; commitment; and possibly their intent to pursue martyrdom (shahada2). Their backgrounds can be quite varied; educational, socioeconomic and religious adherence can span the scale as can their ethnicity, race, age and gender. Granted this wide inclusion of potential SIVA candidates may seem overly broad, but by reviewing historical data the reader will quickly appreciate the fact that violent actors can come from any background. While the primary focus of attention and discussion tends to be on those individuals who align themselves with Al Qaida (AQ), one of its associated groups such as Al Qaida in the Arabian Peninsula (AQAP), Al-Shabaab or similar groups such as Tehrik-i-Taliban Pakistan (TTP), a SIVA can self associate with any group, with any cause. Their affiliation or alignment can be with racist, separatist or political groups that use criminal violence. What differentiates SIVAs from direct affiliates or supporters of a terrorist group is their self initiation of violent acts. This includes individuals who collaborate in attack planning, logistical or financial support provided their activity is initiated of their own volition. A SIVA does not include individuals who are mission tasked by a higher authority. While this is a somewhat complex construct to articulate; for the purposes of this article I will rely on the general framework of a tasked individual being someone who is selected and steered towards action. Thus, an individual who is selected and indoctrinated with the specific intent to utilize them in act of terrorism would not be a classified a SIVA. The asymmetric threat posed by SIVAs is not a new concept. The threat is that they will engage in an act of violence; the asymmetry is that they act alone and as such remove some of the traditional detection tools. ___________________________________
1- The term Self Initiated Violent Actor and acronym SIVA was first coined by the author in the course of professional research and development in 2011. 2- The word shahada is derived from the Arabic verbal root shahada, which means to 'see', to 'witness', to 'testify', to 'become a model and paradigm'. Shahada therefore literally means to 'see', to 'witness', and to 'become a model'. A shahid is the person who sees and witnesses, and he is therefore the witness, as if the martyr witnesses and sees the truth physically and thus stands by it firmly, so much so that not only does he testify it verbally, but he is prepared to struggle and fight and give up his life for the truth, and thus to become a martyr. In this way, and by his struggle and sacrifice for the sake of the truth, he become a model, a paradigm, and an example for others, worthy of being copied, and worthy of being followed.

Before delving into some potential indicators it is important to remind the reader that these are potential indicators only. While in a law enforcement context the observation of one or more of these potential indicators may the initiator to engage a person in a consensual contact, they fall short of probable cause. Ensure you follow established policies and procedures before applying anything borne out of this information. Behavioral Indicators Some of these behavioral indicators cover both SIVAs and tasked actors. Given that a SIVA acts on their own accord and without the benefit of some traditional sources of threat reporting, the awareness of these potential indicators is critical in assessing and mitigating their unique threat. New or increased violent rhetoric. Particularly following a significant event; such as a victory by their group. Just as important is a drastic change following a loss suffered by their group. Victories can include successfully attacks, high profile media coverage or measured capitulation by their perceived enemies. Losses can include disrupted plots, deaths of leadership, notable sways in public opinion and bad press. It should be noted that these are subjective and what is viewed in one light by us can be viewed from a completely different perspective by a SIVA. Obsession with violent Jihad depictions. This is where a SIVA shares some common elements with other violent actors; they seek out videos and first-hand accounts that portray the glorious aspects of battle. Like a drug, they use it to sustain themselves. Shunning of non-violent ideals. Both SIVAs and those tasked by higher authorities are likely to align themselves with postulators of violence; be it religious or other justification. Where a SIVA may bear a unique indicator is that they may never seek formal council. While they subscribe to a particular group mission statement they may never actually communicate directly with the group; opting to act on their own. Pre-Operational Indicators As with other criminals, a SIVA will usually engage in pre-operational activities. This is a critical stage for frontline law enforcement, security and the first responder. While we may never be able to quantify the number of attacks that were deterred or prevented, failing to recognize potential indicators of pre-operational activity will surely provide us with the evidence of a plot; after it comes to fruition. Interest in high profile locations. These can be previous attack locations or those that hold significance to the SIVA and/or their affiliated group. As evidence by recent online postings 3; target lists are constantly being updated.

___________________________________
3-In early June 2011, Al Qaeda Central (AQC) and several jihadist forums provided in-depth discussion and postulated targeting of individuals.

Engaging in surveillance activity. As demonstrated by evidence uncovered following the Times Square VBIED 4 Plot; the ability to conduct remote target selection and initial surveillance through publically accessible platforms remains a viable tool for actors. Even with remote capabilities, it is very likely that a SIVA will conduct in-person target site assessments. This is the period when most acts can be either deferred or detected. Seeking employment at, with, or access to potential targets. Like any other criminal, a SIVA will likely seek out opportunities to gain insight to a target location. If the SIVA is planning an inside job, the most probable route will be through employment at the target location or in a position that will provide access. Despite the austere job market, when other potential indicators are coupled with a drastic divergence from one type of work to one that provides access to a facility of interest5, you may have cause for concern and increased interest. Possession of unusual documents, maps, photos and related materials. This can be indicative of operational planning or an aspiration. A SIVA who poses an insider threat concern could be an individual who seeks out or is found to have these materials or information outside the scope of their role within an organization. This, coupled with potential behavioral indicators would likely be cause for further inquiry. Of obvious note would be maps that indicate attack routes, critical points, have time notations and the like. Further, photos of targets taken from a distance or which focus on critical points would be cause for concern. Acquisition or attempts to acquire precursor chemicals, excessive ammunition and weapons. This is another critical point in pre-operational activities when plots are detected and disrupted. Frequently, it is during the process of assembling the tools needed to execute their mission that SIVAs and mission tasked actors are identified and subsequently apprehended. Unfortunately, the ability to detect actions at this stage has been highlighted by the simplicity of recent attacks, the use of readily available and seemingly innocuous implements. Increased secrecy about activities and associates. While a SIVA may closely associate with a particular group prior to their self initiated action; openly posting on public forums, attending meetings, hosting group members or otherwise maintaining a visible affiliation, it is probable that such contacts will show a marked decrease as they reach a point just prior to acting. A caveat is that the decision to act can be predicated by any number of factors and is largely driven by the individual and their mindset at the time. Though the act may appear spontaneous, it was likely well thought out beforehand. A marked change in their public profile may be indicative of action in the near-term. ___________________________________
4-Open source reporting notes that the suspect used publically accessible web-cam feeds and Google Earth during his pre-operational target selection and to identify the best time at which to place and detonate the VBIED. 5-A drastic change would include seeking/accepting menial labor or other behind-the-scenes positions that fall below the SIVAs capabilities and available positions at or near the potential target.

I believe that even if given the opportunity to examine the individual paths taken from detached person to self initiated violent actor, I am unsure that we will identify common elements beyond those highlighted. Given the dynamics of individual behaviors and the myriad of influences that chart the course of daily life, I question the viability of even the most refined clinical tool as being truly predictive of a persons move from bystander to violent actor in the context of terrorism. Despite an individuals alignment with a particular group, as a SIVA, by virtue of being self-initiated, they are acting on their own. How do we counter the asymmetric threat posed by SIVAS? I believe it will be a deeper appreciation of human behaviors as they play out before us. Simply opening their eyes to the behavior of others that has ensured our survival as a species, we may very well see that we have at our disposal something better than any data mining system can provide. Absent an encounter with a sociopath, guilty people manifest indicators that can be leveraged to further investigative contact. I stress the need to remain attuned to indicators of undue nervousness, deception and deflection; it is these cues that come from our core instincts. When someone is purposefully deceptive it takes effort on their part to maintain the lies; mentally and physically. While passing a causal white-lie is not an extraordinary feat for most, combine the added stressors a SIVA is likely feeling with the inquisitive probing of a focused law enforcement officer and you have a recipe for detection. Given that between 60 to 80 percent of human communication can be non-verbal; there is certain value in recognizing potential indicators of deception. As the foundation for a future article in development, I provide the following potential indicators of deception: Inability to maintain eye contact. A key indicator immediately following a critical question and during a subjects response. Noted is that just because someone looks you in the eyes does not mean they are being truthful. Answering questions with questions. A stalling technique and an opportunity for the subject to formulate the right answer. They may also provide an unrelated answer. Shifting weight Tugging at clothing Defensive posture Fidgeting

Rapid eye movement Increased respiration/perspiration Hand to Face Gestures. These have been defined as: Hand to nosecant stand the smell of their lies. Hand to eyesI dont want to be here right now. Hand to earsI dont want to hear what you are saying to me Hand to mouthbe careful what you say, dont let the truth slip out

In closing this article, I do not proffer that these or any other tool by themselves is the answer, what I maintain is a need to blend traditional law enforcement techniques with fresh approaches to threat detection and deterrence. One of my early initiatives in pursuit of this attainable goal was the new term Self Initiated Violent Actor (SIVA) being added to the lexicon. My subsequent contributions include simplified reference indicators covering radicalized behaviors, pre-operational activities and operational indicators. This article continues the course of looking at the asymmetric threat a little differently; perhaps unconventionally. My hope is that in this endeavor we will realize success.

References/Further Reading __________________________________ Notice: The presence of links, citations of references or further readings is not an endorsement of a product, process or otherwise. Internet links are subject to change. HUMAN BEHAVIOR AND DECEPTION DETECTION, By: Mark G. Frank and Melissa A. Menasco and Maureen OSullivan Location: http://www.cl.cam.ac.uk/~rja14/shb10/frank2.pdf Studying Liars: Tips for Detecting Deception, By Paul Francois & Enrique Garcia Location: http://www.tdcorg.com/download/StudyingLiars-03-24-07.pdf The Mind of the Terrorist - A REVIEW AND CRITIQUE OF PSYCHOLOGICAL APPROACHES By: JEFF VICTOROFF, Department of Neurology and Psychiatry, University of Southern California School of Medicine Location: http://www.psci.unt.edu/jbooks/TerrorBib_files/Psychology%20of%20Terrorism/VictoroffThe%20Mind%20of%20the%20Terrorist.pdf

This article was written as part of a professional development exercise and does not reflect the official position or policies of the authors employer. Inferences and conclusions are the authors own. This article may be copied and shared with the understanding that it is not to be used as part of a commercial enterprise.

The author may be contacted via: jonathan.greenstein@leo.gov