No such thing as a lone wolf - inside the jihadist recruitment machine


Chat Jihad

No such thing as a lone wolf - inside the jihadist recruitment machine

No such thing as a lone wolf - inside the jihadist recruitment machine
No such thing as a lone wolf - inside the jihadist recruitment machine

Fady AlGhorra and Mahmoud Elsobky

22 maart 2018

Jihadist propaganda on the internet is often seen as one of the main drivers for pushing young people into committing terrorist attacks. The reality is more complex than that. ‘People radicalise in different ways.’

© Fady AlGhorra and Mahmoud Elsobky

© Fady AlGhorra and Mahmoud Elsobky​

Adam Deen made a remarkable journey in and out of extremism. For years he was with al-Muhajiroun, an islamist extremist group in the United Kingdom led by Anjem Choudary, a notorious islamist preacher who was convicted in 2016 for inciting people to join ISIS.

Deen is now the UK policy director of the Quilliam Foundation, a world-renowned anti-extremism organisation. He advises governments in Europe, South Asia and the Middle East on how to combat extremism and often speaks in media and other platforms.

Al-Muhajiroun counted many violent extremists in its ranks, including Kharam Butt, one of the perpetrators of the London Bridge vehicle attack in June 2017. London was still reeling from that attack when we went and met with Deen.

On the taxi into the British capital on a breezy August day, the driver pointed out how all the main bridges had been fitted with vehicle barriers to stop trucks or vans from running over pedestrians. At either edge of the main spans over the Thames, large oval vehicle obstacles were being installed. On Blackfriars Bridge, near our hotel, an emergency construction crew was doing a late shift, craning in the huge metal shapes and fixing them onto the bridge pavement with huge bolts.

The next day Deen met us for his video-interview in a nearby conference facility.


Quilliam was one of the first research and advocacy groups to counter extremism in the world. Founded by former radical Maajid Nawaz, it now has a global network of staff and volunteers dedicated to the fight against violent jihadism.

Quilliam extensively documented Al Qaeda’s and ISIS’ propaganda tactics over the years.

Since it foundation in 2008, it published several in-depth research reports focusing on topics like Al-Qaeda activities in prisons, on-line messaging of ISIS and recruitment of young people and women into jihadist groups in the United Kingdom and elsewhere.

Deen saw recruitment tactics change and intensify over the years. ’I joined Al-Muhajiroun around 1996, but we didn’t have the internet. We didn’t have social media’, he remembers. ’We had flyers. We’d go outside mosques or to the high street. We’d pass on a leaflet and maybe write somebody’s phone number down. Now that’s completely different. The problem we had then is immensely amplified now. Extremists can reach far greater audiences in a very short space of time with minimal resources.’

’I remember back with Omar Bakri Muhammad, who was the leader of Al-Muhajiroun at that point - we would travel up and down the country to give lectures. Now, you just use videoconferencing and you can reach the entire world. This industrial approach by ISIS has made it very difficult for organizations such as mine to counter extremism. And it has become an effective to optimal tool for recruitment.’

© Fady AlGhorra and Mahmoud Elsobky

© Fady AlGhorra and Mahmoud Elsobky​

The recruiting activities of ISIS and other jihadist groups led thousands to make the hijra, or immigration to the so-called ’caliphate’. At the height of the ISIS territorial expansion in 2015, according to some estimates, between 27,000 and 31,000 foreign fighters joined the ranks of the group in Iraq and Syria.

The recruitment networks of foreign fighters are known to operate on-line as well as with face-to-face recruitment. That was the case with al-Muhajiroun in the United Kingdom, Sharia4Belgium in Belgium, and recruits with links to islamist preachers like Pierre Vogel in Germany and Rachid Kassim in France, who was linked to several terrorist attack in that country.

Every European country seemed to have its own prominent radical recruiter. But they all spread the same message.

’Run him over with your car’

With the losses of ISIS in Iraq and Syria, ISIS’ recruitment strategy shifted away from attracting foreign fighters to travel to Syria and Iraq and more towards inciting people into staging attacks in Western countries. Those operations outside the ’caliphate’ have always been part and parcel of ISIS’ strategy, but the number of attacks went up as the group’s territorial expansion reached its maximum and a rapid decline followed.

As early as September 2014, when the international US-led military coalition started its anti-ISIS bombing campaign in Iraq and Syria, ISIS’ spokesperson Al-Adnani issued a global call for sympathisers to kill citizens and military personnel at random, with whatever means possible.

’If you are not able to find an IED (improvised explosive device, ME/FA) or a bullet, then single out the disbelieving American, Frenchman, or any of their allies’, he wrote in a propaganda piece. ’Smash his head with a rock, or slaughter him with a knife, or run him over with your car, or throw him down from a high place, or choke him, or poison him.’

© Fady AlGhorra and Mahmoud Elsobky

© Fady AlGhorra and Mahmoud Elsobky​

Random killing of civilians then became a core objective for IS. In the first issue of the IS magazine Rumiyah in September 2016, the point was made that killing all ’unbelievers’, even a flower vendor, is justified, in an article illustrated with a photograph of an elderly man selling flowers somewhere in Europe.

This call for random killing of civilians is believed to be the direct inspiration for a number of vehicle attacks in Western countries, most notably the Nice seaside and Berlin Christmas market truck attacks; the London Bridge, Westminster Bridge and London Borough attacks, and most recently the New York bicycle path attack.

These was no apparent pattern or a clear target in the attacks. Scores were killed just because they happened to be in the wrong place at the wrong time.

Foreign intelligence service

Researchers have shown, however, that these attacks are rarely the consequence of a process of self-radicalisation. ’There is no such thing as a lone wolf’, says Belgian jihadism researcher Pieter Van Ostaeyen. ’In most of the attacks committed in recent years, there was at least some contact, be it face-to-face or on-line, with operatives from a terror group.’

ISIS’s so-called foreign intelligence service Amn al-Kharji seems to play a central role in staging these attacks. Researcher Kyle Orton at British think-tank Henry Jackson Society (HJS) argued in a 2016 report that this division of ISIS had a firm hand in staging the large scale bomb and gun attacks in Paris in November 2015 and in Brussels in March 2016.

Orton cites various sources to make the case that preceding smaller-scale attacks, such as the Jewish museum shooting in Brussels in January 2015 and the foiled Thalys train attack in August 2015 were deliberate distractions to allow plotters like Abdelhamid Abaaoud to stage larger, coordinated attacks like the ones in Paris and Brussels.

’Not only had many terrorists in Europe who acted in IS’s name, done so under IS’s guidelines and in collusion with others, making it difficult to describe them as “lone wolves”, but the attackers had often directly coordinated, online or through an encrypted platform like Telegram and WhatsApp, with a guide from Amn al-Kharji’, according to Orton. It has since become clear that ISIS “handlers” had an active role in numerous other attacks and plots.

A German journalist went on-line and stumbled upon some of these terrorist guides.

© Fady AlGhorra and Mahmoud Elsobky

© Fady AlGhorra and Mahmoud Elsobky​

How to use a knife

We travelled back to Berlin, to the Zeitungsquartier, the area where all the major German newspapers have their newsrooms.

In the huge building of Germany’s largest newpaper Bild Zeitung we sat down with Björn Stritzel, an investigative journalist.

Stritzel has a long track record reporting on the German jihadi scene and visited some of the hotspots of jihadist activity in the Middle East and North Africa. An undercover venture in Germany brought him very close to ISIS’ on-line recruiting machine.

Stritzel went on-line and started scouring jihadi channels on messaging app Telegram, asking how he could do an attack and get a martyr video to the Amaq News Agency, one of ISIS’ main propaganda outlets and usually the tool ISIS uses to claim terrorist attacks.

Once Stritzel had regular contact with ISIS, they handed him over to German speakers. They then started really working on Stritzel to make him commit a terrorist attack.

Very soon, handlers purporting to be in Syria were on his case and started sending him instructions. ’They first suggested to switch to Wickr, which is a more secure app, more for one-on-one communication’, says Stritzel. ’They told me that Telegram is unsecure. There are certain ways for the authorities to check this app and to get into people’s accounts.’

Once the contact on Wickr was made, Stritzel’s IS handlers made sure their communications were as secure as possible, which made it hard for Stritzel to document everything that was going on.

‘Wickr notifies when someone takes a screenshot of your message so I actually took another phone to take snaps of the messages. Sometimes the self-destruction setting of the messages was set to only a few seconds, so I missed recording of some of the messages.’

Once Stritzel had regular contact with ISIS, they handed him over to German speakers. They then started really working on Stritzel to make him commit a terrorist attack.

’They advised me to do very simple attacks’, Stritzel says. ’When I first approached them, I suggested to do a big explosion but they told me no, akhi, you can just steal a car and run people over, that is much easier. So I told them I don’t have a drivers’ license, so what can I do?’

’They then suggested to just to grab a knife and kill persons. I responded I did not know how to use a knife and said I never used a knife to kill a person. I wanted to see which other ways of attack they would suggest to an apparent idiot like me who cannot use a knife and cannot drive a car.’

Soon, things took a grim turn.

© Fady AlGhorra and Mahmoud Elsobky

© Fady AlGhorra and Mahmoud Elsobky​

Stritzel: ’At one point one of the German instructors I was in contact with told me they would soon release a video which would show different ways to use a knife. So I was wondering if he was bluffing or not, whether or not ISIS was going to bring out such a video. But it turns out he wasn’t bluffing.’

’The next day ISIS released a video from Raqqa where ISIS instructors show how to use a knife and kill a person on camera. This video was specifically for attackers in foreign countries so they could learn how to kill people.’

A bit of searching on Telegram and other channels showed that the ’instruction video’ had been shared on many channels since Stritzel received it through his IS contacts. It is an extremely graphic piece. Two masked men first slice the wrists of a handcuffed prisoner and then slice the victim’s throat, while pointing at the victim’s body’s weak spots for knife attacks.

‘When I told them that, even after watching the instructional video, I was not sure I would be able to kill people with a knife, they suggested to go kill people in a hospital, where people are not able to resist.’

There were more instructions as well. ’In that same video there is a segment with a guy making a bomb in a kitchen’, says Stritzel. ’They did not suggest to me to watch that segment specifically,  because they know that making a bomb is still very difficult. You need the ingredients, you need the right equipment. There’s still a big chance of failure, as we’ve seen in the terrorist attack in Barcelona. Those guys tried to make an improvised explosive device and they blew their house up. So they just suggested to me to grab a knife and stab random people.’

Stritzel then kept stalling, but the handlers kept on pushing him. ‘When I told them that, even after watching the instructional video, I was not sure I would be able to kill people with a knife, they suggested to go kill people in a hospital, where people are not able to resist. So they told me, sometimes people are in a coma so it is easy to slaughter them. Or you can go to a retirement home where there are only old and weak people, so you can slaughter them.’

’So they really stuck to this knife attack idea.’

Stritzel eventually kept in contact with his ’handlers’ until his newspaper decided to publish.

’They were checking on me for some time, usually when someone was arrested under terror suspicion in Germany’, he recalls. ’Two hours later I would see messages on the phone to check if it was me who was arrested.’

’The contacts then gradually slowed down. I did this report between summer 2016 and summer 2017, when the Mosul offensive was going on. Sometimes they would not be in touch for four, five, six weeks and they would tell me they did not have an internet connection. ’

’When I published my reports in July 2017 they knew they had been cheated. They deleted their accounts Wickr and on Telegram. I think they felt embarrassed.’

Stritzel kept the German security services in the loop on his reporting. In the months after his reports were published, he saw that some of the on-line jihadis had become more cautious.

’German jihadis still instruct people for attacks but you now need a trusted source within ISIS which you can contact so they can make sure you are a known person’, says Stritzel. ’I think it’s harder for them now to instruct people that they don’t know at all.’

Terrorist manuals

ISIS seems to continue a long standing practice among the world’ main terrorist groups of inciting people to commit atrocities in the name of violent jihadist groups.

In 2010, Al-Qaeda in the Arabian Peninsula (AQAP) pioneered the dissemination of ’terrorist manuals’ in its on-line magazine Inspire, which contained instructions for bomb-making.

Manuals for knife attacks and vehicle attacks could also be found in ISIS’ more recent publications, notably the ’Just Terror’ series in its Dabiq magazine. ’Quite similar to what Al-Qaeda did with Inspire’, says Dutch jihadism researcher Pieter Nanninga of the University of Groningen.

To trace the recruiting mechanisms of terrorist groups in Western countries, we analyzed some 70 profiles of perpetrators of terrorist attacks. This resulted in a digital library of hundreds of articles, videos, books and other materials documenting in great detail how dozens of mainly young men were tempted to commit terrorist atrocities.

© Fady AlGhorra and Mahmoud Elsobky

© Fady AlGhorra and Mahmoud Elsobky​

We looked at the case of brothers Dzokhar and Tamerlan Tsarnaev, who committed the Boston Marathon bombing in April 2013, and ended with Sayfullo Saipov, the man who rammed a vehicle into a bike lane in New York City in October 2017, killing eight people. We chose this time frame to widen our focus and to include the period before ISIS came to global prominence in 2014.

Our sweep of publicly available sources confirms that terrorist propaganda is found with perpetrators in most cases. It confirms the ’no lone wolf theory’ of recent terrorist attacks. Most perpetrators have been found to have had direct contact, either on-line or face-to-face, with recruiters or, at least, with radical preachers or other inciting them to commit violent attacks.

The Tsarnaev brothers, for example, are said to have read instructions for their pressure cooker bombs in issues of AQAP’s Inspire magazine. At the same time, the elder brother, Tamerlan, is said to have visited a radical mosque during visits of his native Dagestan.


The difference between coordinated and planned attacks, suggested and endorsed attacks, and merely ’inspired’ attacks is a matter of debate. When you look at the profiles of recent attackers, it is clear that some networks have been directly guided and commanded by ISIS, like te Paris and Brussels attacks cell led by Abdelhamid Abaaoud, who spent some time in ISIS territory and appeared very prominently in ISIS propaganda.

Many other attacks involve terrorist group handlers or islamist recruiters, such as the priest murder in Rouen, France, in 2016 and a foiled gas bottle attack in Paris in that same year, which were both linked to recruiter Rachid Kassim.

The 2015 San Bernardino shooting perpetrators Syed Rizwan Farook and Tashfeen Malik were often said to be self-radicalised, but here, again, their profile manifestly contradicts the ’lone wolf’ theory.

Malik grew up in Pakistan and Saudi Arabia, and met Farook over the internet. They married in Saudi Arabia in 2014. Malik had a long history of training in the more extreme versions of islam and seems to have been very much down the path of violent radicalism before she even met Farook.

’People radicalise in different ways’, says Belgian jihadism researcher Pieter Van Ostaeyen. ’It is a very complex process in which countless things need to be taken into account.’

Van Ostaeyen’s work on Belgian foreign fighters and other studies confirm this wide diversity of profiles. In his research he came across both educated and less educated ISIS sympathisers, people from all walks of life, each with their own reasons to be receptive to violent jihadist ideology.

© Fady AlGhorra and Mahmoud Elsobky

Nikita Malik

© Fady AlGhorra and Mahmoud Elsobky​

Petty crime

There is, however, at least some sort of pattern emerging from the profiles of perpetrators.

In our analysis of perpetrators of terrorist attacks, we noticed that most perpetrators had a criminal record. Most were young men. Very young men in fact. The perpetrator of the August 2017 vehicle atack on the Ramblas in Barcelona, Younes Abouyaaqoub, was only 22. Some of his accomplices were as young as 17.

We went back to London and spoke to Nikita Malik, Director of the Centre for the Response to Radicalisation and Terrorism at the Henry Jackson Society (HJS), a global foreign policy think-tank. Malik is a world-renowned jihadism and extremism researcher and has done extensive work on radicalisation processes, especially in women an children.

’One of the things we tend to see quite clearly is a criminal background and by criminal I mean very petty crimes’

The Henry Jackson Society’s vast body of research seems to confirm what we found in our own, far more limited, study of perpetrator profiles.

HJS’ most comprehensive study was a profile of 269 perpetrators of islamist terror offences in the UK from 1998 to 2015. It showed that 93 percent of the perpetrators were male, three quarters had British nationality, the average age was only 22 years old, with more than a quarter having previous criminal convictions and 76 percent being previously known to police and intelligence authorities.

’One of the things we tend to see quite clearly is a criminal background and by criminal I mean very petty crimes’, says Nikita Malik. ’There is no indication that these elements will necessarily lead to radicalisation, but we definitely do see it in the profile.’

Many of the young perpetrators of terrorist crimes also spent at least some time in jails, where they are at risk of being radicalised even further.

Pieter Van Ostaeyen remembered witnessing young inmates getting radicalised very quickly when he was working in a Belgian prison. HJS data and a plethora of other studies in European countries show that radicalisation in jails is still problematic. And in our analysis of perpetrator profiles we read time and again how prison time and contact with radicals in prisons can tip people toward violent extremism.

That shows the importance of one-to-one contact.

Blame the internet

The HJS data from the UK confirms the continued role recruiters or radical ideologues play. ’Mosques have been targeted for a long time for radicalisation’, says Malik. ’But in fact young people are even becoming radicalized in places as social as the gym.’

The million dollar question is then what role internet propaganda plays and how important a driver it is for terrorist attacks. Researchers seem to agree now that the internet is an effective amplifier of violent extremist behaviour for those who are already receptive to the jihadist ideology, but rarely a tool that will push people to violence by itself.

‘A person does not go online and turn into a jihadist. There is definitely interest that occurs beforehand. But is it something that accelerate this process? Most certainly so.’

’One cannot say that individuals are only radicalised online’, says Nikita Malik. ’That is certainly not the case. A person does not go online and turn into a jihadist. There is definitely interest that occurs beforehand. But is it something that accelerate this process? Most certainly so.’

’Times have changed, young people are very much online constantly, their networks are online their thoughts are amplified online. We see this every day. People go on and create profiles and comment on things and say things that otherwise they wouldn’t say in real life.’

Malik is extremely concerned that the new on-line spaces create new hazards for young people. ’If I were to tend a rally and somebody was calling for death to the kuffar and says that non-Muslims deserve to die or, on the opposite spectrum, a far right group saying that all Muslims deserve to die, I would be offended and I would report to the police. Officers would turn up at that event and arrest that individual for inciting hate or violence.’

’But somehow it would strike us as very new and we would be very uncomfortable with the same thing occurring online.’

© Fady AlGhorra and Mahmoud Elsobky

© Fady AlGhorra and Mahmoud Elsobky​

Beheading videos

One of the main concerns is the brutal violence in much of the jihadist propaganda in that free on-line space. ’In our research of perpetrators in the UK we found that one out of ten individuals, that’s ten percent of the total, had watched he beheading video’, says Malik.

’Now again we can’t say that consumption of those videos is causing an individual to commit an Islamist related offence. But that information is there. And ten percent in our study, 26 people, had consumed those beheading videos or extremely violent graphic content very intensely in addition to instruction manuals available on-line on how to create a bomb, or how to commit a terrorist attack. So that violent material is extremely problematic.’

’Moreover, in social media spaces the onus of reporting and removing this violent content often falls on the user themselves, and that is very problematic. It is a huge task if we think about it.’

’Asking a young vulnerable person looking at a beheading video, looking at something graphic, and expecting them to do click a drop down arrow and saying ’report this’ and ’I don’t like this’ or ’remove this’ is putting too much pressure on that person’, says Malik. ’It’s asking for too much from a person already exposed to that content before even having to flag it and remove it.’

Rage against the regimes

Much of the focus of media in Europe understandably gravitates towards reporting on the recruiting mechanisms for terrorist attacks in Western countries. But recruitment of young people to push them into committing terrorist attacks has become a global phenomenon, with even more devastating effects in countries with larger terrorist insurgencies and large, ungoverned spaces.

Recent attacks in Afghanistan, the Sinai and other places across the Middle East and South Asia have claimed hundreds of lives. Studying recruitment mechanisms in those areas was not feasible for our small team. We did speak to a number of anti-terrorism activists in countries like Tunisia and Egypt, and we could speak in part from our experiences working these countries.

The mechanism behind the violence is the same.

‘oppression is probably a good part of the explanation why so many left Tunisia and Egypt to go fight in the Middle East and other regions’

Be it an attack in France, Belgium or the United Kingdom, groups like ISIS will claim them with the same logo, via the same media outlet, with the same terminology. The same propaganda will be produced to glorify the perpetrators.

’The only main difference between jihadist propaganda aimed at a Western audience and material aimed at the Arabic world is probably that more emphasis is being put on oppression by the Arabic regimes,’ says Pieter Nanninga. Many young men in countries like Tunisia and Egypt supported islamist political parties such as the Muslim Brotherhood or Ennahdah, but saw the ambitions of these movements thwarted by the return of military rule or watering down of the islamist agenda.

’Combine that with economic deprivation and massive unemployment, that oppression is probably a good part of the explanation why so many left Tunisia and Egypt to go fight in the Middle East and other regions’, says Pieter Van Ostaeyen.

Many, like former ISIS member Bird, whom we interviewed for this series, cited similar frustration with political and military oppression as a main reason to look for an islamist alternative in violent jihadist groups.

The circle is then squared easily.

Be it in the West, the Middle East or elsewhere, violent jihadism will continue to appeal to young persons. The effect of technology and the internet, then, is that it makes things even more complex and difficult.

This report was produced with support of the Fonds Pascal Decroos voor Bijzondere Journalistiek.