EXTREMISM AND INTELLIGENCE: A THREAT ANALYSIS Julian Richards, University of Buckingham Abstract Contemporary extremist threats encompass a widening spectrum, whereby long- standing threats are supplemented by the stubborn persistence of historical threats, and by the emergence of new threats and Violent Transnational Social Movements (VTSMs). For security and intelligence agencies, the management challenges posed by the evolving picture are complex and multi-faceted. Probably the most difficult challenge is that of prioritisation and the allocation of resources across the spectrum of investigation. Other challenges include those of recruiting and retaining staff with the right cutting-edge skills, especially in such fields of social media exploitation; and a fundamental definitional question of how to define some of the newly emerging threats, avoiding questions of surveillance crossing over into inappropriate suppression of legitimate dissent in a liberal democracy. Introduction There is no doubt that a range of violent transnational social movements (VTSMs) has been substantially changing the security picture across the developed world in an accelerating fashion in recent years. The acceleration pertains not just to the number of attacks and incidents, but also to the complexity of groups, movements, and ideologies. Through the late 1990s and early 2000s, intelligence and security services in the West, in particular, were primarily concerned with the rise of millenarian jihadist ideology and the new ways in which it appeared to be able to inspire, recruit and mobilise. Other, older extremist ideologies were still on the radar screen but occupied a diminishing portion of it. The new era seemed to be primarily about jihadism (accepting the complexities of that particular term). Parallel developments in some areas added to the shifting picture. In the UK, for example, the signing of the Good Friday Agreement in Northern Ireland in 1998 suggested to many that the long period of nationalist “troubles” in the province were finally at an end. Much-needed intelligence and security resources could be deployed elsewhere; the imperative of countering jihadist ideology seemed to trump all others. Regrettably, the latter part of the first decade of the 21st century has shown the optimism about yesterday’s extremist problems to be premature. The new picture appears to be one of a broadening spectrum of security considerations. Old Julian Richards 23 The Journal of Intelligence, Conflict, and Warfare Volume 2, Issue 3 problems persist, and are joined by new threats, including violent groups on the populist extremes; racist and xenophobic groups and individuals; and new and perhaps bizarre movements such as the “incels”. This paper considers two key implications of the changes. The first is the question of how exactly the extremist threat picture is changing and where it is likely to go in the future. The second concerns management issues for security and intelligence services and machineries in responding appropriately to the changes. The argument presented here is that fundamentally new questions are being asked of the intelligence sector in this evolving environment, and many of these questions—far from being resolved—are only just being identified. Many of these are management questions concerning prioritisation and the allocation of resources across a wide spectrum of extremist threats, some of which defy existing methods of categorisation. The Transforming Threat Picture With the rise of the Islamic State in Iraq and Syria (ISIS) and the subsequent declaration of the new Caliphate by Abu Bakr al-Baghdadi in 2014, global jihadist ideology showed itself to be not waning, but merely transforming in new directions. ISIS was the “new black” for angry young men and women across the globe and attracted the highest number of foreign fighters to a conflict since the Spanish Civil War of the 1930s (Malet, 2015). Pressing questions about the threat posed by returning fighters began to dominate the security agenda, particularly in those European countries that seemed to have supplied a disproportionate number of jihadist foreign fighters (JFFs); notably Belgium, France, Germany, and the UK (Soufan Group, 2015). The more recent collapse of the territorial presence of ISIS in Iraq and Syria, followed by the death of al-Baghdadi in October 2019, have raised questions about the longer-term threat of the movement. While the West has seen a sharp decline in ISIS-inspired or associated attacks since a high in the 2015-17 period, the United Nations is among many to assess that the threat is far from over and could see a resurgence in activity (UNSC, 2019). Sporadic attacks still occur, such as the stabbing attack on London Bridge in November 2019 which killed two people. The likely longer-term impact of returning JFFs is difficult to predict, but it seems reasonable to suggest that it could be a threat with a long tail, as it may take a long time for all of the dangerous individuals to return from the theatre of war and to decide to take violent action “at home”. Previous analysis of similar Julian Richards 24 The Journal of Intelligence, Conflict, and Warfare Volume 2, Issue 3 situations is spearheaded by the seminal work of Thomas Hegghammer (2013). It is significant to note that Hegghammer’s earlier estimate of the number of jihadist returnees who will carry out attacks, namely one in nine (11 percent) has not yet manifested itself in the post-2015 dataset of terror attacks in Western source countries of JFFs. Aside from the major terror attacks in Paris and Brussels in November 2015 and March 2016 respectively, in which militants with recent combat experience in Iraq and Syria appeared to have played a major part, JFFs do not appear to have featured significantly in recent attacks associated with ISIS and other jihadist groups. However, on the question of the effect of returning jihadists within the threat landscape, the functional observations made by Hegghammer (2013) that such returnees are generally more organised, violent, and successful in the attacks they conduct, are broadly borne out when considering the attacks in Paris and Brussels, which collectively killed more than 160 people. Meanwhile, the case of Salman Abedi, who undertook a suicide bombing at a music concert in Manchester in May 2017, suggests that the sorts of more organised and planned jihadist attacks seen earlier in the 2000s, are not yet a thing of the past. Abedi had clearly travelled to Libya in the months prior to the attack and appears to have had links with militants there, although whether he personally fought for jihadist groups in Iraq or Syria remains uncertain at the time of writing (Doward et al., 2017). His attack appears to have been a lone-actor operation in its execution, but the sophistication of the explosive device suggests that it should be viewed in a different category from the low-sophistication attacks that characterise the more recent period. It also suggests that a wider jihadist organisational involvement in the planning and preparation of the attack seems likely, even if it was nothing to do with ISIS. To the jihadist threat must now be added the spectre of threats from radical-right and radical-left groups, which are becoming an important element of the general populist transformation in Western politics in recent years. The radical left has been a source of considerable violence in other geographical contexts and times, such as under the Red Brigades in Italy, the Weather Underground Movement in the US, or the Naxalites in India, to name but a few. In the more recent Western context, it is generally considered that radical-right groups are more likely to be the source of extreme violence (in the sense of terrorism) than is the case with radical-left groups coalescing around broader issues such as environmentalism or anti-globalisation. This is not to say that the picture could not change in the future, however, and it might be foolish to discount the possibility that contemporary populist left-wing extremist movements in the West could produce Julian Richards 25 The Journal of Intelligence, Conflict, and Warfare Volume 2, Issue 3 a more violent strand that goes beyond what some have described as “soft violence” (Kelshall & Meyers, 2019, p. 40). The historical examples mentioned above show that radical-left movements have sometimes shown the potential for extreme violence in the shape of kidnappings, assassinations and bombings (Windisch, Ligon & Simi, 2019, p. 563). Such considerations aside, the radical-right has shown itself to be a much more immediate source of extreme violence in the recent period. Attacks such as that by Anders Breivik in Norway in July 2011, and Brenton Tarrant in New Zealand in March 2019, which collectively killed 132 people, underline the murderous potential of committed militants espousing extreme right-wing ideology. While such attacks have thankfully remained relatively rare, a hinterland of extreme- right ideology and mobilisation involving a bewildering range of organisations is causing considerable concern to Western security officials. Complicating the picture is a general rise in hate-speech crimes, and a troubling “mainstreaming” of radical-right rhetoric and sentiment in some political circles. A recent report in the French media suggested that security agencies across Europe are expressing great concern about the rise of the radical-right terror threat. In the UK, the Security Minister, Ben Wallace, recently revealed that approaching 50 percent of all cases in the government’s counter-radicalisation programme now involved individuals connected with far-right extremism (France24, 2019), when the programme had historically been dominated by cases involving potential jihadists. As is the case with all populist movements, the perpetrators of extreme violence are at one end of a complex spectrum that also encompasses “soft violence” pressure groups, internet communities of interest and mainstream political parties. Many of the latter on the radical-right of politics have recently made impressive electoral gains, such as Vox in Spain, Alternative für Deutschland (AfD) and the Sweden Democrats. Extreme ideologies and conspiracy theories such as the “Great Replacement” theory espoused by the likes of the Christchurch attacker, feed into broad and growing movements such as identitarianism. Traditionally, right-wing extremism in many countries in the twentieth century was confined to the unpalatable fringes of political society, lurking within marginalised and largely ineffectual communities and rejected as beyond the pale by the majority of the electorate. Historical memories of Nazism and other fascist movements added to the pariah status of the far right. More recently, however, groups such as Generation Identitaire have shown they are attracting to their Julian Richards 26 The Journal of Intelligence, Conflict, and Warfare Volume 2, Issue 3 membership not just marginalised skinheads, but the university educated and the middle-class youth. The longer-term effects of this partial rehabilitation of radical-right ideology are difficult to predict, but the process contains within it some considerable dangers of violence, if history is any sort of measure. More specifically, notions of radicalisation pathways, hitherto considered more commonly in the jihadist milieu, should arguably now be applied to VTSMs emerging from broader populist ideologies. Alongside such threats on the right and left must be added a perplexing array of loosely associated threats, which are as complex as they are unpredictable. A classic case is that of the “incels” (involuntary celibates), whose loose and incoherent ideology (if it can be described as such) has shown itself to be no less dangerous in terms of the violence that can be effected. It remains to be seen whether figures such as the so-called “Supreme Gentleman”, Elliot Rodger, who killed six people in Isla Vista in California in May 2014, becomes the rallying point for a broader movement of violence. Alex Minassian’s attack in Toronto, which killed 10 people in April 2018, certainly paid homage to Rodger, and could presage a broader movement of violence. Aside from these threats, an array of others cannot be discounted. Single-issue causes such as animal liberationism or anti-abortion groups have shown themselves to be violent from time to time and could resurge. Some of these groups are described – rather problematically as will be discussed below – as “domestic extremism” or similar. A striking example was the attack in Jersey City in December 2019 by two individuals apparently connected with the Black Hebrew Israelite movement, in which 9 individuals including the attackers ultimately died (CASIS Vancouver, 2019). Local officials categorised the attack as “domestic terrorism”, although the alleged manifesto for the attack was “rambling and gave no clear motivation” (Nir, 2019). Meanwhile, residual Irish Republican terrorism has shown itself to still have active roots in the sectarian divide in Northern Ireland, despite twenty years of relative calm since the Good Friday Agreement. In March 2019, a group calling itself the IRA (believed by security officials to be a dissident faction known as the Real IRA) said it had sent five letter bombs to targets in the UK, four of which were subsequently discovered (Dodd and Siddique, 2019). No injuries were sustained, but the incident underlined the stubborn persistence of the threat. It is possible that events such as Brexit could worsen the situation. Julian Richards 27 The Journal of Intelligence, Conflict, and Warfare Volume 2, Issue 3 Structural Questions The early post-9/11 work on the global jihadist movement quickly recognised the organisational changes that were being developed and capitalised upon in the “new wave” of terror (Laqueur, 1998), as typified by Sageman’s “leaderless jihad” thesis (Sageman, 2008). The new terror groups were following many of the best-practice principles of business in late modernity, whereby flatter global management structures and devolved decision-making into smaller cellular units was allowing for great reach, flexibility and speed of action. There seems little doubt that technology greatly assisted these transformations, in that, through social media and the internet, individuals could more easily locate and communicate with one another across broad geographical boundaries. Such developments have been noted in organised crime groups as much as in VTSMs (NCA, 2019). Such processes could lead in time to a galaxy of “polycentric, reticulate and segmentary” VTSMs (CASIS Vancouver, 2019, p. 4). The benefits for such movements are clear in terms of reach and expanding membership, but there are also pitfalls. These include “participatory crowding” by splinter movements and groups that complicate the management of a particular organisation, as has been identified with some recent radical-right movements (Morrow & Meadowcroft, 2019: 540). It can also lead to a variability and complexity of individual motivations for joining any particular movement (Richards, 2013: 182), with implications for long-term organisational coherence and resilience; and to difficulties in identifying how and why a particular attack came about and the underlying motivations of those involved. (The recent Black Hebrew Israelite attack in Jersey City, for example, could just as well have been a “drug deal gone bad” as pertaining to any grand ideological movement (CASIS Vancouver, 2019, p. 4).) Meanwhile, the predominant power of social media needs to be viewed very carefully, and research continues to be divided about just how significant it is in VTSMs in relative terms alongside physical contact between individuals. It is clear that many of the movements such as the “incels” place a premium on cross- community propaganda and communication using less mainstream channels such as 4chan and 8chan, and that whole cultural and ideological strands of dialogue develop in such fora and bind the community together. It is the case that radical- right groups such as the English Defence League are starting to recognise and bolster their links with other extra-territorial groups in more effective ways than before, through increasingly sophisticated use of the internet for recruitment and Julian Richards 28 The Journal of Intelligence, Conflict, and Warfare Volume 2, Issue 3 fund-raising (Robinson, 2015, p. 314). The significance of these mechanisms to contemporary movements cannot be underestimated, of course. At the same time, some studies of JFF recruitment and mobilisation have suggested that face-to- face peer-group socialisation is potentially as important as any other factor, including social media networking (Reynolds & Hafez, 2017, p. 682). Where the different socialisation mechanisms come in at different stages of the process will be fruitful subjects of further research. Management Questions for Security and Intelligence Services Online tracking and surveillance of all VTSMs will be increasingly significant strands of activity for law enforcement agencies. Dividends will continue to be both active and passive, in the sense of identifying targets of interest and mechanisms of propaganda; and disrupting operations and generating court- evidential material. In the organised crime environment, there is evidence that use of the Dark Web, use of encryption and cryptocurrencies, and the exploitation of anonymisation services are all crucial to the operation of successful groups (NCA, 2019). VTSMs – while not necessarily having direct links with criminal groups – will surely learn from their techniques and be considering the same methods for evading the attentions of the authorities. For security and intelligence agencies, exploiting the same technologies in terms of undercover work in the virtual environment will be increasingly important both in tracking, surveillance and gathering evidence to disrupt and interdict. The immediate management challenge here is one of recruiting and retaining sufficient numbers of personnel with the right cutting-edge skills and having technological assets that can operate in the virtual environment in a safe and suitably covert way. None of these are trivial challenges. Of course, the more organised and expansive VTSMs will have larger digital footprints, while relatively isolated or lone actors may be particularly difficult to anticipate. There is evidence, for example, that the Christchurch shooter, Tarrant, announced his intention to launch his attack and livestream it just ten minutes before the attack actually commenced (Doyle, 2019). With such anticipatory challenges in mind, a related question is whether and how security and intelligence services can or indeed should have the capability and resource to trawl the online environment looking for potential flashpoints, especially if some of those do not yet relate to existing operations or knowledge. Traditional models of operational intelligence tend to follow a priority scale of cases and groups evaluated for their potential risk to society. Wider trawling of Julian Richards 29 The Journal of Intelligence, Conflict, and Warfare Volume 2, Issue 3 the environment and examination of potential leads is a much more difficult and resource-intensive activity in the face of pressing operational priorities. In a speech at the end of 2017, the head of the Britain’s MI5 intelligence agency, Andrew Parker, said his agency was running 500 live counter-terrorism operations, encompassing 3000 individuals (Corera, 2017a). He alleged that 20 attacks had been foiled in the previous four years, all of them related to jihadist threats (ibid). It is difficult to know the overall resource impact of these live operations, but it can reasonably be assumed to be very considerable and to allow little spare capacity for fishing expeditions. The risk of letting just one major attack through also suggests that an intense tempo on current investigations assessed to be of priority is likely to drive the agenda. A related challenge for contemporary security and intelligence agencies operating in these environments is the complicated question of how to properly balance security with liberty, and particularly with privacy in the online environment. Most European countries have been attempting to update their surveillance legislation in recent years to ensure continued capability against the online activities of targets can be maintained, and all have faced considerable push-back from civil liberties organisations concerned about creeping state powers. In many cases, old thinking about fixed-line telephony interception has to be applied to the challenge, but this is increasingly looking outdated and inappropriate for the digital environment. A further concern for liberal democracies is how they classify VTSMs, and whether and how such threats can be the grounds for surveillance. Many Western countries are grappling with such terms as “domestic extremism” or “domestic terrorism”, or, in the North American context, “homeland security”. In Canada, “multi-issue extremism” (MIE) is used to try to encompass the fluidity of such VTSMs. But questions are being asked by some as to where legitimate national security concerns could bleed over into inappropriate monitoring of groups exercising a lawful right to protest. Retaining the trust and cooperation of the public is crucial for security and intelligence services in discharging their work, especially when much of the critical intelligence will originate from the grass- roots. Thus, avoiding accusations of being a Big Brother state are increasingly important for contemporary security agencies in liberal democracies. Writing in the aptly-named journal, Surveillance and Society, Harbisher, for example, took issue with the “mission creep” of American Department of Homeland Security (DHS) intelligence “fusion centres”, whereby an “ambiguity of their activities” was purportedly allowing a drift away from terrorism per se Julian Richards 30 The Journal of Intelligence, Conflict, and Warfare Volume 2, Issue 3 and towards a more general “spying” on the population (Harbisher, 2015, p. 475). Similar concerns were levelled at Canada’s use of MIE intelligence fusion centres to target single-issue protest groups (Harbisher, 2015, p. 476). Whatever the merits of such concerns, there are risks to manage in balancing a preventative approach to the “polycentric and segmentary” nature of VTSM threats, with tipping-over into a more generalised surveillance of the population and an intolerance towards soft as well as hard violence. Questions of appropriate prioritisation and resourcing relate not only to balancing fire-fighting with fire prevention, but also to working out how to allocate – and indeed to reallocate – resources on current operations as new and evolving threats emerge. Returning to the example of the UK’s MI5 and counterterrorism, the UK parliament’s Intelligence and Security Committee revealed in its annual report of 2017 that approximately 18 percent of MI5’s operational and investigative resources were deployed on the Northern Ireland target, while 64 percent were deployed against “international terrorism” (namely the global jihadist threat; Corera, 2017b). This is a fairly unprecedented level of detail on internal resource balancing, and it is difficult to know whether and how this has changed over the years, but it seems likely that this has moved back towards the Northern Ireland target to some extent, since the early 2000s when 9/11 had happened and the Good Friday Agreement had only just taken effect. These figures do not say anything about resource going into threats from the radical-right or other extremist threats, but France’s director of counterintelligence, Patrick Colver, was quoted in 2016 as saying that the intelligence services were indeed busy channelling resources into looking at the Far Right (France24, 2019). Germany’s domestic intelligence chief also spoke of a considerable uplift in investment in the intelligence services’ efforts on the Far Right (ibid), not least following the arrest of a number of individuals in October 2018 belonging to a group called Revolution Chemnitz, that was planning serious attacks on foreigners, politicians and civil servants (Embury-Dennis, 2018). A widening spectrum of threats leads to very difficult resourcing questions for intelligence and investigation teams within security and intelligence services. This is especially so when the tempo of existing threats, such as those from jihadist groups and returning JFFs remains high, and when the effects of a successful terrorist attack can be so devastating. Strategically, it is very difficult to decide which targets to examine when there are so many, and when the array of VTSMs in question are so fluid and amorphous. The challenges of keeping on top of the situation will be in many areas, from recruitment and retention of the Julian Richards 31 The Journal of Intelligence, Conflict, and Warfare Volume 2, Issue 3 right skills to technological solutions that deliver near-real time surveillance at scale while properly taking account of privacy concerns. Many of these challenges are only just being fully identified. Julian Richards 32 The Journal of Intelligence, Conflict, and Warfare Volume 2, Issue 3 References CASIS Vancouver. (2019). Black Hebrew Israelites: From Soft Violence to Kinetic Action. Briefing Note, December 11, 2019 Corera, G. (2017a, October 17). MI5 boss Andrew Parker warns of ‘intense’ terror threat. BBC News, Retrieved 9 January 2020 from: https://www.bbc.co.uk/news/uk-41655488 Corera, G. (2017b, December 21). MI5 warnings on Brexit, terror and Russia. BBC News, Retrieved 9 January 2020 from: https://www.bbc.co.uk/news/uk-42434767 Dodd, V. and Siddique, H. (2019, March 12). Group calling itself IRA says it sent five bombs to British targets. The Guardian, retrieved 9 January 2020 from: https://www.theguardian.com/uknews/2019/mar/12/group- calling-itself-ira-claims-it-sent-parcelbombs-uk-addresses Doward, J., Cobain, I., Stephen, C., & Quinn, B. (2017, May 28). How Manchester bomber Salman Abedi was radicalised by his links to Libya. The Guardian, Retrieved 9 January 2020 from: https://www.theguardian.com/uk-news/2017/may/28/salman- abedimanchester-arena-bomber-radicalisation Doyle, G. (2019, March 15). New Zealand mosque attacker’s plan began and ended online. Reuters, Retrieved 9 January 2020 from: https://www.reuters.com/article/us-newzealand-shootoutinternet/new- zealand-mosque-attackers-plan-began-and-endedonline- idUSKCN1QW1MV Embury-Dennis, T. (2018, October 1). Revolution Chemnitz: German police uncover far-right ‘terrorist’ group. The Independent, Retrieved 9 January 2020 from: https://www.independent.co.uk/news/world/europe/revolutionchemnitz- germany-far-right-terrorist-group-police-detainedrevolution-chemnitz- racism-a8563211.html France24. (2019, March 19). European intelligence services see far-right extremism as growing threat. Retrieved 9 January 2020 from: Julian Richards 33 The Journal of Intelligence, Conflict, and Warfare Volume 2, Issue 3 https://www.france24.com/en/20190319-europe-intelligence-farright- extremism-growing-threat-christchurch Harbisher, B. (2015). Unthinking Extremism: Radicalising Narratives that Legitimise Surveillance. Surveillance and Society, 13(3/4), 474-86 Hegghammer, T. (2013). Should I stay or should I go? Explaining Variation in Western Jihadists’ Choice between Domestic and Foreign Fighting. The American Political Science Review, 107(1), 1-15 Kelshall, C. M., & Meyers, S. (2019). PREPARED: A program to educate on the prevention and reduction of extremist discourse. Burnaby, BC: Simon Fraser University Laqueur, W. (1998). No End to War: Terrorism in the Twenty-first Century. New York: Continuum Malet, D. (2015). Foreign Fighter Mobilization and Persistence in a Global Context. Terrorism and Political Violence, 27(3), 454-73 Soufan Group. (2015). Foreign Fighters: An Updated Assessment of the Flow of Foreign Fighters into Syria and Iraq. The Soufan Group: New York Morrow, E. A., & Meadowcroft, J. (2019). The Rise and Fall of the English Defence League: Self-Governance, Marginal Members and the Far Right. Political Studies, 67(3), 539-56 NCA (National Crime Agency). (2019). National Strategic Assessment of Serious and Organised Crime, 2019. Retrieved 9 January 2020 from: https://nationalcrimeagency.gov.uk/ Nir, S. M. (2019, December 11). Black Hebrew Israelites: What We Know About the Fringe Group. New York Times, Retrieved 9 January 2020 from: https://www.nytimes.com/2019/12/11/nyregion/black- hebrewisraelites-jersey-city-suspects.html Reynolds, S. C., & Hafez, M. H. (2017). Social network analysis of German foreign fighters in Syria and Iraq. Terrorism and Political Violence, 31(4), 661-86 Julian Richards 34 The Journal of Intelligence, Conflict, and Warfare Volume 2, Issue 3 Richards, J. (2013). Reactive community mobilization in Europe: the case of the English Defence League. Behavioral Sciences of Terrorism and Political Aggression, 5(3), 177-93 Robinson, T. (2015). Enemy of the State. Batley: The Press News Sageman, M. (2008). Leaderless Jihad: Terror Networks in the Twenty-First Century. Philadelphia: University of Pennsylvania Press UNSC. (United Nations Security Council). (2019). Letter dated 15 July 2019 from the Chair of the Security Council Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015) concerning Islamic State in Iraq and the Levant (Da’esh), Al-Qaida and associated individuals, groups, undertakings and entities addressed to the President of the Security Council. Retrieved 9 January 2020 from: https://digitallibrary.un.org/record/3813209?ln=en Windisch, S., Ligon, G.S. and Simi, P. (2019). Organizational [Dis]trust: Comparing Disengagement Among Former Left-Wing and Right-Wing Extremists. Studies in Conflict and Terrorism, 42(6), 559-80 This work is licensed under a Creative Commons Attribution- NonCommercial-NoDerivatives 4.0 International License. © (JULIAN RICHARDS, 2020) Published by the Journal of Intelligence, Conflict, and Warfare and Simon Fraser University Available from: https://jicw.org/ http://creativecommons.org/licenses/by-nc-nd/4.0/ http://creativecommons.org/licenses/by-nc-nd/4.0/ https://jicw.org/