by Daveed Gartenstein-Ross, March 27, 2017

The tactics used by British terrorist Khalid Masood in his horrifying attack on Wednesday outside London's Parliament[1] were typical of the self-proclaimed Islamic State, or ISIS:[2] an attacker plowing a vehicle through a crowd of pedestrians before slashing at police officers with a knife. Soon after the strike, ISIS claimed credit, although it did not provide any details that weren't already public.

The generic nature of ISIS's comments encouraged some skeptics. London's Independent, for example, claimed[3] that the phrasing of the group's statement suggests that it "did not directly orchestrate [the] atrocity." But skeptics' voices have been noticeably quieter than in the past. The caution that commentators generally exhibited[4] by refraining from declaring ISIS uninvolved in the London attack stood in stark contrast, for example, to the reaction to last summer's truck attack in Nice—when observers immediately[5] branded it the work of a "lone wolf" who was not really linked to ISIS. The public understanding of lone-actor terrorism may finally be changing for the better.


When my colleague Nathaniel Barr and I wrote "The Myth of Lone-Wolf Terrorism"[6] in these pages shortly after the Nice attack, our purpose was to challenge a then-dominant reflex among observers: declaring single-attacker terrorist incidents to be the work of so-called lone wolves. (These are individuals who lack substantial connections to ISIS or other groups and carried out their operations without the assistance of others.)

In fact, we argued, previous lone-attacker plots often had some organizational involvement[7]—and ignoring that fact was costly. As intrepid journalist Rukmini Callimachi reported in the New York Times[8] last year, a series of attacks in Europe from 2014—15 carried out by men including Sid Ahmed Ghlam and Ayoub El-Khazzani were written off at the time as the work of lone wolves. They were, in fact, anything but: Abdelhamid Abaaoud, who later served as the ground commander of the November 2015 Paris attacks that claimed 130 lives, had directed Ghlam, Khazzani, and several others to carry out strikes in Europe even as he prepared the Paris operation. Because counterterrorism analysts and officials viewed Ghlam, Khazzani, and other attackers as unrelated to one another or to broader networks, they missed their best chance to identify ISIS's operational infrastructure in Europe prior to the Paris operation.

Virtual planners allow ISIS to maximize the impact and propaganda value of attacks waged in its name, making sure they are seamlessly incorporated into the group's strategy.

Commentators did not immediately absorb the lesson from this failure. Barr and I were alarmed that, following the Nice attack and in numerous other instances (for example, a July 24 suicide bombing in the German city of Ansbach and the July 26 slaughter of a priest in the French city of Rouen), analysts, journalists, and scholars were quick to label each perpetrator[9] as a lone wolf.[10]

Over the past nine months, however, the public understanding of the strikes has demonstrably shifted. There is growing awareness that individuals labeled lone wolves[11] are often in communication with other militants, sometimes using encrypted services. In several prominent cases, the lone attackers communicated with "virtual planners"—ISIS operatives, often based in Syria, who offer would-be terrorists all the services once provided by physical networks. Enabled by a combination of social media and the recent boom in end-to-end encryption, virtual planners scout for recruits, work to radicalize and spur them to action, provide operational guidance, and even give operatives critical technical assistance, such as advice on the construction of explosives.

Emblematic of the virtual planner model is the late French national Rachid Kassim, whom analyst Bridget Moreng has profiled[12] in Foreign Affairs. In September 2016, French authorities arrested a group of female terrorists[13] who attempted (and failed) to set off a car bomb near Paris's Notre Dame Cathedral. (One of them stabbed a police officer outside a rail station as authorities made the arrest.) Before this plot, none of the women had any relationship to each other. They had been brought together[14] by Kassim.

In connecting the women, Kassim merged two lines of terrorist effort in different parts of France. And it was all because of one operative's cold feet. Sarah Hervouët, a 23-year-old Muslim convert who was planning an attack in the commune of Cogolin, had been in communication with Kassim using the app Telegram[15] app. Acting on Kassim's orders, Hervouët drafted her will,[16] wrote farewell letters to relatives, and made a video proclaiming her allegiance to ISIS. But she lost her appetite for the "suicide-by-police" attack that Kassim had envisioned for her. So he connected Hervouët[17] with the other two women, forming a cell that would undertake a more traditional plot involving explosives. Although these operatives ultimately failed to carry out the attack that Kassim had hoped for, the case demonstrates the agility with which virtual planners can operate. Kassim, for his part, has had a notable share of successes, having orchestrated several gruesome plots that claimed innocent lives.[18]

The virtual planner model has helped transform lone attackers who rely heavily on the Internet from the bungling wannabes[19] of a decade ago to something much more dangerous today. Virtual planners allow ISIS to maximize the impact and propaganda value of attacks waged in its name, making sure they are seamlessly incorporated into the group's strategy.


In a groundbreaking article for the New York Times last month, "Not 'Lone Wolves' After All: How ISIS Guides World's Terror Plots from Afar,"[20] Callimachi outlined the phenomenon of virtual planners in painstaking detail. Similarly, the most recent issue of CTC Sentinel, published by West Point's Combating Terrorism Center, features an article comprehensively examining virtual planners' role in U.S. plots.[21]

Of course, it is unclear at this point whether Masood was connected to ISIS's virtual planners, a true lone wolf, or something else. At 52 years old, he doesn't fit the profile of a young operative radicalized over social media, but that doesn't mean he couldn't have figured out how to use encrypted online communications. And contacting major ISIS figures isn't exactly rocket science.

The bottom line is that we don't know what Masood's relationship to ISIS was. That is why commentators are much more cautious about declaring him a lone wolf now than they would have been in the past. The most rigorous work on the topic has warned observers to be wary that there may be connections that are not immediately discernible. Such caution is correct analytically. It is also correct pragmatically. In the past, lack of caution may well have cost lives.























Daveed Gartenstein-Ross is a Senior Fellow at the Foundation for Defense of Democracies. His professional focus is on understanding how violent non-state actors (VNSAs) are transforming the world, and how states are in turn trying to adapt to this challenge. Gartenstein-Ross has specialized in jihadist movements, including undertaking detailed research into al-Qaeda, the Islamic State (ISIS), Ansar al-Sharia in Tunisia, Boko Haram, and ISIS's Wilayat Sinai. He is also the Chief Executive Officer of Valens Global, a consulting firm focused on the challenges posed by VNSAs, as well as a Fellow with Google's Jigsaw, an Associate Fellow at the International Centre for Counter-Terrorism — The Hague, and an Adjunct Assistant Professor in Georgetown University's Security Studies Program. He is the author or volume editor of twenty-one books and monographs and has published widely in the popular and academic press. This article appeared March 27, 2017 in Foreign Affairs and is archived at
It is archived at Think-Israel at

Return _________________________End of Story___________________________ Return