Europe experienced a significant wave of jihadi terrorism in the last decade, with 106 attacks between 2014-2022, yet the threat seemed to be waning in the past five years. Not only did the attacks’ level of sophistication decrease significantly, the number of attacks was also on a downward trajectory besides a brief uptick in 2020.
However, since the outbreak of an armed conflict in the Middle East on 7 October 2023, counter-terrorism officials have become increasingly concerned of a resurgence, often said to be driven by the Islamic State Khorasan Province (ISKP) and minors. This article looks into these claims and explores recent trends in attacks and plots based on a researched in-house dataset.
Attacks
Relative attack surge since 7/10, but recent attack frequency remains below average
In terms of successful attacks, there is no new wave so far since 2022 compared to the past decade. Since 2022, the number of attacks (4,4/year on average) remains significantly below the average number of attacks (13/year on average) seen between 2014-2021. In fact, 2022 and 2024 (so far) are two of the least eventful years regarding jihadist attacks in Europe, and even 2023 ranks lower than 75% of the years between 2014-2021. However, comparing a 9-month time period before and after 7/10, attacks are up 200% (7 January 2023 — 7 October 2023: 2 attacks │ 8 October 2023 — 8 July 2024: 6 attacks).
Minor changes in modus operandi / perpetrator profiles
Comparing the 11 successful attacks since 2022 with attacks between 2014-2021, most features of jihadist attacks have remained constant with no or only minor changes. The few notable differences are (1) the recent shift from police officers and soldiers being targeted (-20%) towards specific targets (+23,81%) selected for ideological reasons (e.g. LGBTQ, Jewish/Christian targets) and ongoing developments (e.g. perceived blasphemy); the (2) slight increase (+4,7%) in the share of minors among attackers, although their overall share still remains low (10%); and (3) the recent absence of multi-perpetrator attacks (compared to 10,57% between 2014-2021).
Plots
Despite some similarities, most features of successful attacks and thwarted plots since 2022 largely differ. While the direct comparison of successful attacks and plots has numerous limitations and require careful interpretation, plots’ patterns still offer valuable insights about the jihadist threat. The following trends can be outlined based on 47 jihadist plots in Europe between January 2022 and June 2024:
1) The Islamic State (or Daesh) and its affiliates dominate European jihadism
After a few years of the IS-linked threat seemingly waning (mid-2020 to late-2023) and “independent jihad” emerging, the tide has turned in recent years with 89,36% of jihadist plots being linked to IS and its affiliates (IS-Somalia, ISKP) again. This is also reflected in recent successful attacks: IS-related attacks outnumber the rest by eight to three since 2022.
2) The comeback of jihadist cells
The phenomenon of “independent jihad” correlated with the dominance of “lone wolves” (individual perpetrators), yet this trend is also changing, with 51,06% of recent plots involving multiple individuals. Even during the peak of IS in Europe in 2016, only 35,29% of the attacks were carried out by jihadist cells, with individual perpetrators being behind the rest.
Cells tend to inflict significantly higher casualties on average (90/attack) than individual perpetrators (20/attack) in the past decade, likely due to the more complex modus operandi.
3) The ISKP-threat to Europe is smaller than its hype suggests in terms of prevalence
IS-linked plots outnumber ISKP-linked plots by 33 to 9. Despite dominating headlines recently, the low number of publicly reported plots in Europe linked to ISKP suggests that jihadist violence is much more likely to be linked to IS.
However, the overall number of plots is only one metric. Other statistics suggest that ISKP-linked jihadism in Europe is likely to be more complex and more lethal. The overwhelming majority (77,78%) of the nine ISKP plots involve “online planners” and have a significantly higher share (88,89%) of cells being involved. Multi-perpetrator attacks historically resulted in more complex, high casualty attacks (see 2) above). ISKP-linked plots are also more likely to consider IEDs.
In sum: there is less chance of an ISKP-linked attack than an IS-linked attack, but if it does occur, it is more likely to be highly lethal due to the involvement of multiple perpetrators.
4) Most plots are still inspired, not guided
Less than a third (29,8%) of plots involved online contact with “virtual planners” for the purpose of aiding, guiding or instructing violence (see 3) above). No plot involved operatives directly fielded by either group. The majority of plots were inspired by (pro-)IS online propaganda.
5) Surge in underage jihadist plotters
A significant share of the 47 plots (44,68%) involves minors, although only 27,82% of all 115 plotters are minors. To a smaller extent, the same trend has been observed in successful attacks, where the share of minors among attackers has slightly increased from 5,3% (2014-2021) to 10% (2022-2024).
The average age of plotters is also significantly lower (21,1 years old) compared to perpetrators of attacks (28,21 years old). This difference may be partially attributed to young jihadists being less capable of implementing plots, whether due to the lack of experience, poor operational security, or other factors.
6) Emerging Central Asian contingent exclusively linked to ISKP
Russian citizens make up the largest contingent among all plotters with 11,4%, followed by Belgians (8,77%), Germans (8,77%), and Tajiks (7,89%). While Central Asian nationals (Tajik, Uzbek, Kyrgyz, Afghan, Turkmen) were barely involved in successful attacks in the past decade, there has been a notable uptick in their involvement in recent plots. All Central Asian plotters were linked to ISKP plots, but their share among the suspects of ISKP-linked plots is still only 44,12%. (Disclaimer: the citizenship of 30,7% of the perpetrators is unknown.)
7) Absence of the jihadism-mental health nexus among plotters
Mental health issues are almost completely absent among plotters (1 out of 114 plotters, less than 1%), in contrast to perpetrators of attacks (29,58%). There are various explanations for this:
underreporting of mental health issues for plotters in media
individuals with mental health issues overwhelmingly opt for spontaneous attacks without planning
there is a high share of groups among recent plotters, whereas groups historically tend to not involve any individuals with mental health issues.
8) Plotters prefer IEDs, but that might just be wishful thinking
Improvised explosive devices (IEDs) are the most frequently considered (27,9%) weapons in plots, followed by firearms (23%) and knives (19,7%), with 19,7% being unknown. These numbers are in sharp contrast to successful attacks, where knives still dominate (2014-2021: 55,3% │ 2022-2024: 66,7%) and IEDs are the exception (2014-2021: 13,2% │ 2022-2024. 8,3%). The high share of IEDs in plots is likely a result of wishful thinking, a potential increase in the number of tutorials circulated online recently, and the different natures of plots (careful planning) and attacks (often spontaneous in the past decade, with a resort to the most easily and quickly accessible weapon).
9) Selective targeting on the rise, without Jewish targets surging despite 7/10
The target selection of plotters is closely aligned with ideological grievances and instructions by IS, its affiliates and supporters, with random civilians making up only 25,8% of the considered targets. Out of all plots’ targets, 30,6% were perceived ideological enemies: 11,3% were linked to the Christian community, 12,9% were linked to the Jewish community, and 6,5% were LGBTQ. Symbols of the state made up another 29% of all targets, led by police officers (16,1% of all targets), state (e.g. parliament, 8,1% of all targets) and soldiers (4,8% of all targets).
This, too, needs to be seen in the specific context of plots, keeping in mind that they are in different stages and often involve wishful thinking instead of careful considerations of feasibility. However, the same trend can be seen in successful attacks: with the share of ideologically-driven targeting rising from 17,86% (2014-2021) to 41,67% (2022-2024). Recent attacks’ targets aligned with ideological grievances and IS instructions were members of the LGBTQ community, targets linked to perceived blasphemy (politician, Swedish fans related to Quran burnings), and members of religious communities.
Although there has been an increase in the share of Jewish targets in plots since 7/10 (pre-7/10: 6,3% │ post-7/10: 20%), such targets are still not predominant.
Recommendations and Implications: So What?
The number of attacks remaining low does not necessarily mean that the threat is not elevated. The number of plots recently certainly indicates high activity among European jihadists. It might also mean that European authorities and societies have grown more resilient after the mid-2010s wave of terror attacks, which is why so many attacks were thwarted before they could materialise. In other words: current counter-terrorism measures and strategies seem to be working. Yet especially during times where authorities under pressure with many ongoing tactical investigations and leads, taking a step back and assessing the bigger strategic picture may not be prioritised when allocating resources.
Intelligence cycles are constantly adjusted, starting with re-defining the priorities and requirements for collection. Most investigations have significant gaps initially, with more unknowns than knowns. The trends identified in this paper can help make the right tactical decisions during investigations, e.g. how to expand the scope of collection, what to prioritise. Based on the data, the following measures are recommended:
1) Re-assess whether there is sufficient oversight in place over purchases of ingredients listed in propaganda for constructing IEDs
The recent significant increase in plotters considering IEDs built at home using frequently circulated instructions provided by IS and its ecosystem should be taken seriously. This also offers an avenue for detecting and disrupting plots by directing more attention to the bulk purchase of ingredients listed in the most often distributed IED-building guides. Continuously monitor these instructions, update the list of flagged substances, and evaluate whether measures in place are sufficient for detecting suspicious purchases of the mentioned ingredients in time. Both online and physical retailers should receive training on recognizing and flagging suspicious purchases.
2) Systematically integrate blasphemy-related incidents in daily threat assessments
Perceived blasphemy appears to be a trigger for plots and attacks and can thus serve as a valid and reliable indicator. Moreover, it also seems to result in specific targeting recently. To capitalise on this trend, pay close attention to any incidents that can be perceived as blasphemy and is likely to be picked up on by the jihadist scene. Such incidents should be integrated as a threat elevating factor and lead to the proactive reinforcement of the protection of specific places/individuals linked to the respective incident.
3) Expand and strengthen open source intelligence desks
The majority of plots involved multiple perpetrators, and almost a third of the plots involved a trail of online communication with virtual planners. This provides an avenue for authorities to detect and disrupt attacks in the planning phase compared to lone wolves that are harder to detect. The importance of sufficient resources dedicated to open source intelligence desks and international cooperation on exchanging intelligence has never been higher. To capitalise on this trend, open source intelligence collection needs to be equipped with the rights, tools and skills needed to efficiently monitor relevant platforms.
4) To disrupt ISKP-plots, initiate international exchange with experts and relevant authorities on organised crime regarding fake Russian passports
Russian citizens are the largest contingent among recent plotters, thus allocating more resources to them pays off. However, some reports indicate that at least some of these are actually Central-Asian nationals that purchased fake Russian passports. Develop and maintain up-to-date indicators for detecting fake passports by cooperating with and learning from experts from other fields and countries that have more experience and expertise on the topic. Use these insights and indicators to regularly train immigration and customs officials as well as organised crime specialists on detecting fraudulent documents.
5) Do not overinflate the importance of recommended targets featured in propaganda
Recommended targets featured in propaganda do not automatically translate into plots and attacks. It is also crucial to differentiate between official IS/ISKP propaganda and the output of supporter ecosystems when determining the credibility of such threats. While such propaganda can be sufficient to inspire attacks regardless of the source, so far, the data indicates that they are rather a way to provoke fear in European societies and/or to test authorities’ reactions and measures with the purpose of finding gaps and exploiting these later. For threats that make it into public discourse, develop proactive communication plans on how to minimise their psychological impact on society and reinforce the public’s perception of safety.
6) Reevaluate the security concepts of societal groups that are more frequently targeted
Recent plots and attacks have a higher share of specifically picked targets related to ideological grievances. These mainly include Christian, Jewish, and LGBTQ communities, both in terms of plots and successful attacks. Reevaluate the security concepts for these communities and their events (particularly mass gatherings) to determine whether they live up to the heightened threat. Use the trends on modus operandi identified above to tailor the preventive and counter-measures.
7) Push for more frequent and quicker takedowns of online content, support T&S teams by facilitating training and AI tools
Most plots remain inspired, not guided, thus removing propaganda by IS and its media ecosystem is one of the most effective measures to prevent attacks. This includes not only social media, but also websites. Data supports efforts to continue pushing for such campaigns and for the stricter enforcement of European laws regarding removing extremist and terrorist content. As the second pillar, complement the legal pressure on platforms with initiating sustainable public-private partnerships that support platforms’ trust and safety (T&S) teams by facilitating frequent trainings on the latest trends in online extremism. These can include trilateral exchanges between T&S representatives, intelligence analysts, and specialised researchers. Considering that smaller platforms likely do not have the resources for sufficiently large T&S teams and tools, Western governments should also support the development of customizable, not-for-profit AI tools that aid extremist content moderation.
8) Streamline resource allocation and investigation priorities to the specifics of the ISKP threat
Data does not support claims that the threat emanating from ISKP and its supporters is currently the highest, not even when considering the expected complexity of ISKP-linked operations. At the same time, ISKP-linked plots seem to have unique characteristics that can help tailor the intelligence cycle: they almost always include multiple individuals and a trail of online communication with a “virtual planner”. On a related note, Central-Asian suspects are highly likely to be linked to ISKP, even though they are not the majority among ISKP plotters. Prioritise, but do not restrict ISKP-related investigations to them.
Furthermore, given that these nationals have only recently become a significant part of the threat landscape, there is less prior experience with them, and general knowledge on their background, grievances and the root causes of their radicalisation is likely to be limited. Cross-collating intelligence from other desks working on Central-Asian matters unrelated to counter-terrorism, as well as initiating or expanding intelligence sharing with Central-Asian countries may help fill these gaps. Individuals from the region flagged as potential terror threats should then be re-screened using this new information.
As a third line of defense, establishing or maintaining good ties with communities remains crucial, too, without demonising or blankly associating them with the terror threat. The diaspora’s knowledge of regional customs, societal and cultural norms, and behavioral patterns is a key resource. This also requires steady investment in civil societal efforts to prevent radicalisation.
In Conclusion
Based on an in-house dataset of 115 jihadi terror attacks in the European Union, the United Kingdom, Norway, and Switzerland between 2014-2024, and 47 jihadi terror plots in the same spatial scope between January 2022 - June 2024, several trends emerge with major implications.
In terms of attacks, the profiles and modus operandi of recent attacks’ perpetrators (2022-2024) are mostly identical to the perpetrators of attacks between 2014 and 2021. Still, there are a few slight differences worth noting:
The number of successful attacks in recent years (2022-2024) remains below the average number of attacks between 2014-2021, though the recent heightened activity in the scene hints at the potential beginning of a new wave since 7 October 2023.
There has been a recent increase (+23,81%) in the selective targeting of specific communities (e.g. LGBTQ, Christians, Jews) instead of civilians.
There has been a slight increase (+4,7%) in the involvement of minors.
Unlike in the last decade, there has been a lack of attacks involving multiple perpetrators.
For the 47 recent plots (2022-2024), the main trends are as follows:
The Islamic State and its affiliates are associated with the overwhelming majority (89,36%) of plots in a shift from “independent jihad” in the late-2010s.
Despite warnings, ISKP’s role in recent attacks and plots appears to be minor compared to IS.
There is a shift from the trend of lone actors towards multi-perpetrator cells planning attacks.
Most (70,21%) plots are still inspired, not virtually guided by IS and affiliates.
An increasingly high share of plots (44,68%) involves minors.
Central Asian citizens are increasingly involved in plots, exclusively linked to ISKP.
Homegrown suspects (EU citizens) account for a third of the plotters.
There is an almost complete absence of mental health issues among plotters.
IEDs are the preferred weapons of choice (27,9%) among plotters.
Selective targeting is on the rise, but Jewish targets are not surging, against expectations.
The Path Forward
Re-assess whether there is sufficient oversight in place over purchases of ingredients listed in propaganda for constructing IEDs.
Systematically integrate blasphemy-related incidents in daily threat assessments.
Expand and strengthen open source intelligence desks.
To disrupt ISKP-plots, initiate international exchange with experts and relevant authorities on organised crime regarding fake Russian passports.
Increase investment in civil society- and research-based radicalisation prevention efforts.
Reevaluate the security concepts of societal groups that are more frequently targeted recently.
Push for more frequent and quicker takedowns of online content, support Trust & Safety teams by facilitating training and the development of AI tools.
Streamline resource allocation and investigation priorities to the specifics of the ISKP threat.
Erik Hacker is research fellow at SCENOR focusing on violent extremism, terrorism and radicalisation, especially on the web, its structures, dynamics and discourses. He holds an LL.M. of the Vrije Universiteit Amsterdam in law and politics of international security and a BA in political science of the Universtiy of Vienna.
Comments