Philip Grindell, Threat Intelligence Specialist, CEO and Founder, Defuse® will be speaking on Countering Fixated and Lone Actor Threats at the International Security Conference on Tuesday, 27th September at 15:15-16:00 at International Security Expo in London. Here he talks about tackling the threat from lone actors.
In 2007, research suggested that people who pursue public figures pose a greater risk of death or serious injury to their targets than do terrorist groups or criminals.
Much has changed since then. Whilst the threat from terrorism is as prominent as ever, it is less focused on ‘terrorist groups’ such as the IRA and even AQ, with the primary focus now on lone actors.
When I was tasked with setting up and running the investigative unit to protect UK MPs after the assassination of Jo Cox MP, one of my key tasks was to prevent the next attack. To do so, I researched how public figures were targeted and attacked.
Much of the research base that I introduced into our processes emanated from the US Secret Service’s Exceptional Case Study Research Project (ECSP) and was subsequently advanced by some of the most well-recognised thought leaders. That research was based on various behavioural and linguistic warning behaviours that may be associated with a physical threat. The indicators were prevalent in cases of people fixated on public figures. It is unlikely that all of these indicators will be seen in a single case, with some being more commonly observed that others.
I assessed these indicators against the attacks on UK MPs attacked since 2000, identifying a clear pattern. What was clear was that ‘Lone Actors’ could also be considered fixated individuals and mirrored many of the behaviours of stalkers and those researched by the ECSP when targeting the prominent, powerful or wealthy.
This is witnessed as a ‘pathological fixation’ which effectively means that these people are focussed on a person or issue from the minute they wake up to when they go to bed. This fixation can be evidenced by any behaviour that indicates an increasing preoccupation with the target individual or issue, such as talking of nothing else and a deteriorating social or occupational functioning.
One evening in 2017 I was passed a note with five lines on it. It recorded a third-hand threat directed at Rosie Cooper MP. Based on the behavioural and linguistic indicators I was now familiar with, I assessed that threat to be genuine, which I then communicated to the head of national CT. Their investigation successfully prevented the attack on Ms. Cooper resulting in a life sentence for the National Action member Jack Renshaw.
One of the key elements of this methodology is that such individuals don’t snap, they plan and prepare and often follow a process, referred to as ‘The Pathway of Targeted or Intended Violence’. (See above image)
This process is initiated by a grievance which may be personal or ideological. Once they decide that the grievance cannot be resolved, they develop violent ideation, which means that they believe that the only way to solve their grievance is through violence. This is where they form the intent necessary for any threat to be genuine.
Research tells us that those who make directly communicated threats, such as death threats, rarely pose a genuine threat. Dr Reid Meloy, one of the world’s preeminent experts stated on Defuse’s podcast, The Online Bodyguard, (https://www.buzzsprout.com/1253126) that a directly communicated threat resulted in violence in less that five per cent of cases.
However, ‘last resort’ or ‘end of tether’ language may be an indication that a person of concern was escalating along ‘The Pathway’. This may be evidenced by such phrases as “You leave me no other choice” or “I have no other option”. This may be a sign of distress or desperation and can be an indicator of time imperative of an impending attack. In the case of Renshaw’s threat, it was evidenced when his plan included him describing his desire to martyr himself by ‘suicide by cop’. Another example concerns Khalid Masood who attacked Parliament and murdered my colleague, Keith Palmer. A few days before the attack and after many years of being estranged from his family, Masood visited his parents one last time. He left that last meeting, telling his mother, “They will say I am a terrorist – but I am not.”
Another commonly witnessed indicator is termed ‘identification’. A common factor witnessed in lone actors is their associating themselves with a terrorist group, such as ISIS. Very often there is no evidence of any such association, however the group will often corroborate this as it supports their cause. This is to identify oneself as an agent to advance a particular cause or belief. It has also been described as pseudo commando or warrior mentality. This is evidenced by the person identifying with the military or law enforcement or studying and copying previous assassins. A good example of this is Anders Breivik who dressed up in uniforms.
Another example is the possession of the book, Catcher in the Rye. After Chapman murdered John Lennon, he remained at the scene reading The Catcher in the Rye until he was arrested by the police. Hinckley also had a copy when he attempted to assassinate Reagan, as did Robert Bardo who stalked and murdered Rebecca Schaeffer.
Very often when law enforcement is researching a potential person of concern, they look at their previous convictions or arrests. Often dismissed are unrelated or random acts that don’t immediately appear to be relevant. This can be an indicator of novel aggression. This is best described an act of violence or aggressive behaviour via which the subject is testing their ability to act in such a way. It is usually not directly related to the ‘pathway’ on which they are travelling and can be totally out of character.
On October 22, 2014, Michael Zehaf-Bibeau murdered a Canadian soldier and injured three others. He then attacked the Canadian Parliament and was killed by law enforcement. In December 2011, he walked into the Police Station and confessed to an armed robbery he committed a decade earlier; no such recorded crime existed. The next night, he attempted to rob a McDonald’s restaurant with a pencil, then waited for the police to arrive, possibly testing their response and to gain an understanding of the processes.
Any surveillance or research may also identify a sudden burst of activity, known as energy burst. This is a key indicator that the intention is escalating and can occur in the hours, days or weeks before the actual event. It is characterised by an increase in pre-attack activity and can be signs of final preparations, purchasing equipment or conducting hostile reconnaissance or internet activity. A decrease in their usual social media activity may also be an indicator, a sign of them further preparing.
Prior to Choudhary attacking Stephen Timms MP, she demonstrated such behaviour by taking a bus to the bank. She paid off her student loan and closed her account and sorted her financial affairs. She also purchased knives for her attack. Her rationale was because she didn’t want the state to have any hold over her family after her attack. She was preparing for the end.
As has been described, some of the indicators may be contrary to common sense and all too often direct threats are seen as a sign of a genuine threat resulting is assets being wasted such as additional security measures or close protection being deployed. They will always need to be taken seriously, but with the recognition that they are a low probability indicator.
The lesson is that fixated people, stalkers and lone actors follow a process and they can be identified by behavioural and linguistic indicators. Without knowledge of these indicators, the best researchers will either miss or misinterpret them.
Defuse’s one day Behavioural Threat Assessment Programme titled ‘Countering Fixated and Lone Actor Threats’ has been accredited for CPD by The CPD Standards Office.
For further details email Defuse® at [email protected]
Philip Grindell, Threat Intelligence Specialist, CEO and Founder, Defuse® will be speaking on Countering Fixated and Lone Actor Threats at the International Security Conference on Tuesday, 27th September at 15:15-16:00 at International Security Expo in London. For more information about this year’s event or to register to attend visit: https://ise-2022.reg.buzz/pr-counter-terror-
businesshttps://counterterrorbusiness.com/features/tackling-lone-actors-behavioural-threat-indicators
LinkedIn: https://www.linkedin.com/in/specialists-in-protecting-prominent-people-a…
Email: [email protected]
