With a Little Help from my Friends: an Exploration of the Tactical Use of Single-Actor Terrorism by the Islamic State
In recent years there has been a growing focus on the threat from lone-actor terrorists; however, unless used with caution, the term can mask a more complex and nuanced situation. This article argues that in the era of the Islamic State (IS), a dichotomous classification of plots as either networked or ‘lone-actor’ is misleading, obscuring varied degrees of engagement. In addition to inspiring undirected attacks by its supporters, IS has produced a hybrid threat from individual attackers, detached from the broader network but able to benefit from its guidance and, in some cases, logistical support. In light of this finding, this article draws a distinction between inspired lone-actor- and other forms of single-actor- terrorism, offering a new framework for conceptualising individual attackers who act in the name of IS.
Publish date : 7/29/2017


In September 2014, Islamic State (IS) spokesman Abu Mohammed al-Adnani urged its supporters not to “let this battle pass you by wherever you may be”, encouraging them to “kill a disbelieving American or European…in any manner”.[1] This message was later echoed in the group’s English-language magazine Dabiq, which stated “[t]he smaller the numbers of those involved and the less the discussion beforehand, the more likely it will be carried out without problems... One should not complicate the attacks by involving other parties, purchasing complex materials, or communicating with weak-hearted individuals”.[2]

It is clear that the proposed attacks were to be committed by individuals, using readily available tools such as knives and cars. The focus was not on the externally directed, complex plots that had been the hallmark of al-Qaida throughout the early 2000s; instead, al-Adnani was alluding to the template subsequently established by al-Qaida in the Arabian Peninsula (AQAP), acknowledging that simple attacks were more likely to succeed.[3] Through such messaging, IS signalled a clear intent to adopt single-actor terrorism as a tactic.

At a time when the group’s resources were focused on its territory in Syria and Iraq, undirected, unconnected, and logistically unsupported attacks in the name of IS offered an attractive means of striking beyond the Caliphate’s borders and demonstrating its reach. However, it is important to recognise that this is only one tactic within a broad strategy. Examination of recent attacks reveals degrees of interaction, direction, and even logistical support from IS. Notwithstanding appearances, individual attackers are rarely alone.

Building on the author’s previous work as part of the Countering Lone Actor Terrorism (CLAT) project[4] and the recent work of Thomas Hegghammer and Petter Nesser,[5] this article examines the nature of the threat from radicalised individuals in Europe, and the implications of the decision by IS to adopt single-actor terrorism as a tactic. It will argue that in addition to inspiring undirected attacks by its supporters, IS has produced a hybrid threat from individual attackers, detached from the broader network, but able to benefit from its guidance and, in some cases, logistical support. In light of this finding, this article draws a distinction between inspired lone-actor- and other forms of single-actor- terrorism, offering a new framework for conceptualising individual attackers who act in the name of IS.

The article is structured in four parts: the first section presents the existing research upon which this work builds, section two presents the methodology, section three details the results, while section four considers the implications for our understanding of the threat from radicalised individuals in Europe.


CLAT was an eighteen-month study conducted by the Royal United Services Institute (RUSI), Chatham House, the Institute for Strategic Dialogue (ISD) and Leiden University. The research examined 120 instances of lone-actor terrorism across Europe between 1 January 2000 and 31 December 2014, aiming to improve understanding of perpetrator behaviour and activities in the period leading up to their intended attacks. However, the timing of the research was such that data collection ended shortly after what may prove to be an important moment in the jihadist lone-actor threat: the prominent calls by IS for individual attacks from September 2014 onwards. As mentioned earlier, the tactic of inspiring individual attackers had previously been established by AQAP; however, the decision by IS to emulate this model is likely to prove significant given the group’s substantial global appeal and increasing dominance in international jihadism. In their research examining the commitment of IS to attacking the West, Hegghammer and Nesser found evidence to support an evolving threat from this point:

“the number of “low-involvement plots” (or sympathiser attacks) has increased significantly in recent months. After two years with zero such plots, we had 21 in the last ten months of our timeframe (September 2014–June 2015). The cut-off date seems to be September 2014, which is exactly when IS spokesman Abu Muhammad al-Adnani issued the first call for sympathiser attacks in the West. The trend is so striking that we strongly suspect al-Adnani’s call contributed to the increase.”[6]

It should be noted that Hegghammer and Nesser’s article examined all attack plots linked to IS in the West, neither restricted to lone-actor terrorists, nor to Europe. Nevertheless, the increase in plots by sympathisers provides a strong indication of the impact of al-Adnani’s call.

Building on these previous works, this article therefore seeks to examine the nature of the jihadist threat from individual attackers in Europe from September 2014 onwards, examining case studies of recent plots and attacks that have been linked to IS.[7]


The sample examined includes plots and attacks in Europe by individual attackers with alleged linked to IS, occurring after al-Adnani’s speech in September 2014 and before August 2016. While acknowledging the continuing debates surrounding the definition of terrorism, this article takes a pragmatic approach and specifies only that attacks, or planned attacks, must be violent and intended to send a political message to a broader audience.[8] It is based on open-source research, using START’s Global Terrorism Database[9] and Internet searches to identify and examine potential cases through news reporting. To be included, positive evidence must suggest an attack was, or was meant to be, executed by a single actor [10] with alleged links to IS or its ideology. As the intention of the research was to examine the nature of these links and therefore determine the suitability of the label ‘lone-actor terrorism’, more stringent criteria were not applied at this stage. In total, fourteen plots and attacks were identified as suitable for the sample. Five additional attacks were excluded due to insufficient evidence in the public domain to either link them to IS, or to assess the nature of those links.

There are a number of limitations to this method. First, the sample size is naturally small given the relative rarity of the incidents and the short timespan studied. Second, it is based on publically available information, meaning that some details will be missing, and that plots abandoned, or disrupted at an early stage, are unlikely to have been included. Third, as the focus lies on the current threat, the incidents examined are of recent nature. It may be years after an incident before we can state with confidence that no further information is likely to be discovered. Subsequently emerging details could therefore significantly alter the categorisation of some of the plots.


Of the fourteen plots examined, six present no evidence to contradict their classification as lone-actor attacks with reported linked to IS, or its ideology, being conceived and carried out by an individual perpetrator. The following case has been selected as an illustrative example:

  • On 7 January 2016 a man tried to enter a Paris Police station wearing a fake suicide vest, brandishing a meat cleaver, and shouting “Allahu akbar”; he was shot dead by police. The attacker was later found to be carrying a piece of paper with the IS flag, a pledge of allegiance to al-Baghdadi, and a claim of responsibility for the attack in Arabic which said he was avenging the dead in Syria.[11]

However, in six cases, examination revealed allegations of varied degrees of personal encouragement and direction. The following case has been selected as an illustrative example:

  • In July 2016 27-year-old Mohammed Daleel detonated a suicide bomb near a music festival in Ansbach, south Germany, killing himself and injuring fifteen other people, four of them seriously. He had initially tried to gain entry to the festival, but was refused. Following the attack, IS released a video of Daleel pledging allegiance to the group and threatening new attacks. The Bavarian state’s interior minister subsequently revealed that Daleel received specific instructions over his mobile phone just moments before the attack, that, among other things, offered advice on what he should do after having been refused entry to the music festival.[12]

This form of direct interaction with IS would undermine the classification of an attack as lone-actor terrorism. As in other areas of terrorism research, there remains disagreement regarding the definition of lone-actor attacks; however most scholars agree that the absence of direction from a wider network is a critical element.[13] The reported interaction in two cases was found to extend yet further, including elements of logistical support:

  • In April 2015 French police arrested Sid Ahmed Ghlam on suspicion of planning terrorist attacks. Reports claim that he was communicating with IS members in Syria, who gave him directions to a car park where a vehicle was waiting containing firearms, ammunitions and tactical vests. The suggestion is that he did not meet directly with the local logistics network providing this support; instead, it was orchestrated remotely by members of IS, and he retrieved the items from an unattended vehicle. After obtaining the weapons, it is alleged that he shot and killed Aurelie Chatelain in Paris, in what prosecutors are claiming was a failed car-jacking as part of a plot to attack a church in Paris.[14]

There is increasing evidence that the external operations wing of IS has established procedures for encrypted communications with attackers in Europe, whether returning fighters or domestic supporters.[15] Wherever single-actor terrorists benefit from such mechanisms, it is clear that they cannot be considered as acting alone.

It is therefore suggested that the following typology provides a more differentiated understanding of the threat from radicalised individuals in Europe who plan attacks on behalf of IS:

  • Inspired lone-actor terrorist: individual attacker, inspired by IS propaganda and messaging, but receiving no personal direction or instruction from the group.
  • Remotely directed single-actor terrorist: individual attacker, receiving remote direction and personal instruction from IS.
  • Remotely directed and facilitated single-actor terrorist: individual attacker, receiving both remote direction and remotely orchestrated logistical support from the IS; the local logistics network remains somewhat detached from the attacker and therefore insulated in case of arrest.

This typology offers the means to continue distinguishing single-actor terrorists from networked cells, while equally recognising significant variations in the threat they pose. A key distinction between inspired lone-actor terrorists and other single-actors are that the former are undirected and uncontrolled by IS, while the latter are essentially a “tactical variant of group terrorism”[16] and may therefore be coordinated in the same manner as networked cells.


If we are to understand the scale and nature of the threat posed by radicalised individual supporters of IS in Europe, it is crucial that we distinguish between those attacks that are neither directed nor logistically supported by the group – inspired lone-actor terrorists – and those where various degrees of personal direction and support exist, albeit in the shadows. The typology presented here is intended to facilitate such a distinction.

The classifications proposed here capture key elements of the overall threat situation in Europe now. Moreover, each category presents security officials with distinct challenges for detection and disruption. The threat posed by inspired lone-actor terrorists is in some ways dependent upon their choice of weapon. Across the fifteen years studied, the CLAT research found substantial disparities in the lethality of attacks by lone-actor terrorists: bladed weapons resulted in 0.36 fatalities per attack, explosives in 0.57 deaths, and, in stark contrast, firearms caused an average of 6.65 deaths. Overall, however, it was found that 76 per cent of plots failed to cause any fatalities, illustrating that although lone-actor terrorists can have a devastating impact, only a small proportion will do so.[17]

Out of the three types identified, the unconnected single perpetrators are, however, often the most difficult to detect, as without command and control from a wider network they may evade many of the ‘tripwires’ that would usually bring them to the attention of security officials. Although not distinguishing between typologies of single-actor terrorists, research by Petter Nesser and Anne Stenersen highlights the increased difficulty of detecting perpetrators who act alone: examining jihadist plots from 1994 to 2014 they found that only 30 per cent of single-actor cases were detected by the authorities, in contrast to 81 per cent of group plots.[18]

However, as the CLAT research highlighted, lone-actor terrorists are neither as isolated nor as secretive as we might presume: only 9 per cent of ‘religiously-inspired’ perpetrators appeared to be in some way ‘socially isolated’,[19] while 43 per cent gave some advance indication of their extreme views, or even intention to act to those around them.[20] This mirrored earlier findings by Paul Gill, John Horgan and Paige Deckert; examining lone-actor plots in the United States and Europe, they found that in 79 per cent of cases, friends and family were aware of the individual’s commitment to a specific extremist ideology, and in 63.9 per cent of cases that they intended to engage in terrorism-related activities.[21] Therefore, while these indicators are rarely evident to security officials, those around the perpetrator such as friends, family and work colleagues are likely to encounter signs of their extremism or even intention to act; this creates opportunities for detection, provided they have both the means and the confidence to report their concerns.[22]

Remotely directly single-actor terrorists are in communication with members of the broader IS network. This has implications for the threat they present; however, it is not yet possible to draw specific conclusions, given the limited sample size. Remote instructions have the potential to either encourage simple attack methodology in order to increase the chance or success, or alternatively, offer guidance to facilitate more complex methods such as the use of explosive devices.

The possibility of the latter is of particular concern. Research for the CLAT project highlighted the extremely limited success rate of lone-actor terrorists in using such weapons, despite the various manuals and instructive literature available online.[23] In contrast, remotely directed single-actor terrorists can draw on the expertise of the broader network, increasing the potential impact of an individual attacker. Among the recent attacks, Daleel was able to produce an effective explosive device using components from a loudspeaker and a bicycle lamp, prompting speculation regarding the level of detail in the instructions received from IS.[24]

While their communications with a wider network creates possibilities for detection that do not exit with inspired lone-actor terrorists, such possibilities are somewhat constrained by the extensive use of encryption by IS through applications such as Telegram. Detailed discussion on this point is beyond the scope of this article, but their use of such technology, and the challenges this creates for intelligence and security officials, have both been well documented.[25]

Remotely directed and facilitated single-actor terrorists receive both direction and logistical support, increasing the likelihood that they will be able to access weapons, protective equipment, and false identity documents to facilitate evasion. This has significant implications for the threat posed. With regard to detection, they present a similar profile to the one in the previous category, using encrypted communication to correspond with IS in Syria. Although they receive material support from local logistics networks, there are indications that this is done with minimal direct communication; such networks remain detached and are therefore largely insulated in case of arrest. While members of the logistics network remain vulnerable to forensic analysis of the weapons or retrospective examination of security cameras near the delivery site, they can take precautions to mitigate such risks; the more unpredictable human element has been removed, with the attacking perpetrator unable to betray them.

It is worth noting, however, that that existence of such networks also creates a valuable investigative angle for security officials; if they can be uncovered and dismantled, there is an opportunity to have a disproportionate impact and disrupt multiple plots from this category of attacker.


In recent years there has been a growing focus on the threat from lone-actor terrorists across Europe. Commentators have been quick to label attacks by radicalised individuals as the manifestation of the feared ‘lone wolf’, while security officials have been rightly concerned about the unique challenges such attackers present in terms of detection and disruption. However, unless used with caution, the term ‘lone-actor’ can mask a more complex and nuanced situation. In the era of IS, it is now clear that a dichotomous classification of plots as either networked or ‘lone-actor’ is misleading, obscuring varied degrees of encouragement, direction and even logistical support. The categories of single-actor terrorism presented here are intended to offer a more differentiated view of the threat from radicalised individuals in Europe, offering greater scope to understand the nature of the threat posed and to devise effective strategies in response.

About the Author: Clare Ellis is a Research Fellow at the Royal United Services Institute for Defence and Security Studies (RUSI). Her primary research interests are counter-terrorism, organised crime, and the role of policing in tackling national security threats. She has undertaken research on behalf of the European Commission and the British and Danish governments, conducting fieldwork in the UK, Europe, and West Africa. A regular speaker at international conferences, she is also a guest lecturer at the University of York.


[1] Translation from the website of Pieter van Ostaeyen: Al-Adnani 22.09.2014 “Indeed Your Lord Is Ever Watchful”; URL: https://pietervanostaeyen.com/2014/09/25/abu-muhammad-al-adnani-ash-shami-indeed-your-lord-is-ever-watchful/

[2] The Failed Crusade’, Dabiq, (No. 4, October 2014), p. 4.

[3] Al-Qaida in the Arabian Peninsula’s English-language Inspire magazine has consistently aimed to encourage and facilitate lone-actor terrorist attacks in the West through instructive articles; while the article ‘How to Make a Bomb in Your Mom’s Kitchen’ is perhaps the best known, there have been numerous other examples.

[4] Co-funded by the Prevention and Fight against Crime Programme of the European Union and by the Dutch National Coordinator for Security and Counterterrorism (NCTV). Further information about the CLAT project and copies of the research reports is available via URL: www.rusi.org/CLAT

[5] Thomas Hegghammer and Petter Nesser, ‘Assessing the Islamic State’s Commitment to Attacking the West’, Perspectives on Terrorism (Vol. 9, No. 4, 2015); URL: http://www.terrorismanalysts.com/pt/index.php/pot/article/view/440/html

[6] Idem.

[7] One of the key findings of the CLAT research was that a substantial proportion of lone-actor terrorist plots were inspired by extreme right-wing ideologies. The focus of this article on only plots linked to the Islamic State is intended neither to overlook nor to dismiss the significance of this finding; instead, the more limited focus is an acknowledgment of the changing dynamic of the threat posed by radicalised individuals linked to IS, and the importance of ensuring that its specific characteristics are understood.

[8] The approach therefore mirrors that of previous research in this journal; see Petter Nesser and Anne Stenersen, ‘The Modus Operandi of Jihadi Terrorists in Europe’, Perspectives on Terrorism (Vol. 8, No. 6, December 2014), pp. 2-24; URL: http://www.terrorismanalysts.com/pt/index.php/pot/article/view/388

[9] National Consortium for the Study of Terrorism and Responses to Terrorism (START), ‘Global Terrorism Database’, College Park: START, University of Maryland, 2015.

[10] The CLAT research used a wider definition of lone-actor terrorism that also incorporated plots by dyads and triads, provided there was no direction, command or control from a wider network. This was a reflection of the broader scope of the study, and its specific objective to understand how attackers without links to terrorist networks may present opportunities to practitioners seeking to detect and disrupt their activity. The distinct focus of this article means that a narrow definition has been adopted, examining only single attackers. For a further discussion on the definition used in the CLAT research, see Edwin Bakker and Jeanine de Roy van Zuijdewijn, ‘Lone-Actor Terrorism: Definitional Workshop’, RUSI Occasional Paper (December 2015); URL: https://rusi.org/publication/occasional-papers/lone-actor-terrorism-definitional-workshop

[11] Henry Samuel, ‘Paris Shooting: Terrorist Wearing Fake Suicide Belt Shot Dead Outside Police Station on Charlie Hebdo Anniversary’, The Telegraph, 7 January 2016; URL: http://www.telegraph.co.uk/news/worldnews/europe/france/12086901/Paris-police-shoot-dead-knife-wielding-man-live.html ; Angelique Chrisafis, ‘Knife-Wielding an in Fake Suicide Vest Killed at Police Station’, The Guardian, 8 January 2016; URL: https://www.theguardian.com/world/2016/jan/07/paris-police-shoot-dead-man-near-police-station ; Inti Landauro and Noemie Bisserbe, ‘French Police Treating Knife Attack at Paris Police Station as Act of Terrorism’, The Wall Street Journal, 8 January 2016; URL: http://www.wsj.com/articles/french-police-shoot-man-who-tried-to-enter-paris-police-station-1452169931

12] Justin Huggler, ‘Ansbach Bomber and Wurzburg Axemen ‘were in Contact with Handlers in Middle East’ before Attacks’, The Telegraph, 29 July 2016; URL: http://www.telegraph.co.uk/news/2016/07/29/ansbach-bomber-and-wurzburg-axemen-were-in-contact-with-handlers/ ; Samuel Osborne, ‘Ansbach Suicide Bomber Mohammed Daleel ‘Fought for Isis and al-Qaeda’ before coming to Germany’, The Independent, 27 July 2016; URL: http://www.independent.co.uk/news/world/europe/ansbach-explosion-germany-isis-suicide-bomber-mohammed-daleel-al-qaeda-a7157961.html ; BBC News, ‘Ansbach Explosion: Syrian Asylum Seeker Blows Himself up in Germany’, 25 July 2016; URL: http://www.bbc.com/news/world-europe-36880758 .

[13] Raffaello Pantucci, Clare Ellis and Lorien Chaplais, ‘Lone-Actor Terrorism: Literature Review’, RUSI Occasional Papers (December 2015); URL: https://rusi.org/publication/occasional-papers/lone-actor-terrorism-literature-review .

[14] BBC Panorama, ‘Inside Europe’s Terror Attacks’, 23 March 2016; URL: http://www.bbc.co.uk/programmes/b07598xc ; Kim Willsher, ‘French Student Charged with Murder and Links to a Terrorist Organisation’, The Guardian, 24 April 2015; URL: https://www.theguardian.com/world/2015/apr/24/french-police-charge-student-links-terrorist-organisation ; Aurelien Breeden, ‘Piecing Together a Deadly Encounter in Paris’, The New York Times, 27 April 2015; URL: http://www.nytimes.com/2015/04/28/world/europe/piecing-together-a-deadly-encounter-in-paris.html ; Jean-Charles Brisard and Kévin Jackson, ‘The Islamic State’s External Operations and the French-Belgian Nexus’, The CTC Sentinel (Vol. 9, No, 11, 2016); https://www.ctc.usma.edu/v2/wp-content/uploads/2016/11/CTC-Sentinel_Vol9Iss11.pdf .

[15] Rukmini Callimachi, ‘How ISIS Build the Machinery of Terror Under Europe’s Gaze’, The New York Times, 29 March 2016; URL: http://www.nytimes.com/2016/03/29/world/europe/isis-attacks-paris-brussels.html; Jean-Charles Brisard and Kevin Jackson, ‘The Islamic State’s External Operations and the French-Belgian Nexus’, op. cit.

[16] Petter Nesser, ‘Research Note: Single Actor Terrorism: Scope, Characteristics and Explanations’, Perspectives on Terrorism (Vol. 6, No. 6, December 2012), p. 69; URL: http://www.terrorismanalysts.com/pt/index.php/pot/article/view/231 .

[17] Clare Ellis, Raffaello Pantucci, Jeanine de Roy van Zuijdewijn, Edwin Bakker, Benoît Gomis, Simon Palombi and Melanie Smith, ‘Lone-Actor Terrorism: Analysis Paper’, RUSI Occasional Papers (February 2016), pages 7-9; URL: https://rusi.org/publication/occasional-papers/lone-actor-terrorism-analysis-paper . Please note, these figures relate to all perpetrators, regardless of ideology.

[18] Petter Nesser and Anne Stenersen, ‘The Modus Operandi of Jihadi Terrorists in Europe’, op. cit.

[19] C. Ellis et al., ‘Lone-Actor Terrorism: Analysis Paper’, p. 16. To record the ideology of lone-actor terrorists, the project adopted the categories used by Europol in its ‘Situation and Trend’ reports: ‘religiously inspired’; ‘ethno-nationalist and separatist’; ‘left-wing and anarchist’; ‘right-wing’;‘single issue’; ‘other’; and ‘unknown’; Europol, European Union Terrorism and Situation Trend Report 2016 (The Hague: Europol, 2016).

[20] Unpublished finding from the CLAT research. Overall, 46 per cent of all perpetrators in the dataset gave some prior indication of their extremist views or intention to act. See: C. Ellis et al., ‘Lone Actor Terrorism: Analysis Paper’, op. cit.

[21] Paul Gill, John Horgan and Paige Deckert, ‘Bombing Alone: Tracing the Motivations and Antecedent Behaviors of Lone-Actor Terrorists’, Journal of Forensic Sciences (Vol. 59, No. 2, March 2014), pp. 425–35.

[22] Clare Ellis and Raffaello Pantucci, ‘Lone-Actor Terrorism: Policy Paper 4: ‘Leakage’ and Interaction with Authorities’, RUSI Occasional Papers (February 2016); URL: https://rusi.org/publication/occasional-papers/lone-actor-terrorism-policy-paper-4-%E2%80%98leakage%E2%80%99-and-interaction . For further discussion on the role of family and friends in countering violent extremism, and in particular the challenges of reporting, see Michael J. Williams, John G Horgan and William P Evans, ‘The Critical Role of Friends in Networks for Countering Violent Extremism: Toward a Theory of Vicarious Help-Seeking’, Behavioral Sciences of Terrorism and Political Aggression (Vol. 8, No. 1, October 2016), pp. 45–65.

[23] Clare Ellis et al., ‘Lone-Actor Terrorism: Analysis Paper’, op. cit., pp. 8-9 and 13.

[24] Spiegel Online International, ‘Terror in Germany: How Close Were Attackers’ Links to the Islamic State?’, 2 August 2016; URL: http://www.spiegel.de/international/germany/investigators-examine-possible-is-links-in-germany-attacks-a-1105636.html .

[25] See for example, Robert Graham, ‘How Terrorists Use Encryption’, CTC Sentinel (Vol. 9, No. 6, June 2016), p. 20; URL: https://www.ctc.usma.edu/v2/wp-content/uploads/2016/06/CTC-SENTINEL_Vol9Iss614.pdf . See also Nico Prucha’s article in this Special Issue.


Attached File
This file has been downloaded 261 times
Related Items
How Salim Rashid, a top student turned into Isis butcher
Is ISIS Making a Comeback in Libya?
ISIS is defeated. What becomes of the ‘Cubs of the Caliphate’ in Iraq?
Submit comment