Analysis of Weak Signals for Detecting Lone Wolf Terrorists Joel Brynielsson, Andreas Horndahl, Fredrik Johansson, Lisa Kaati, Christian M˚ artenson, Pontus Svenson Swedish Defence Research Agency (FOI) Stockholm, Sweden Email: firstname.lastname@foi.se Abstract—Lone wolf terrorists pose a large threat to modern society. The current ability to identify and stop these kind of terrorists before they commit a terror act is limited since they are very hard to detect using traditional methods. However, these individuals often make use of Internet to spread their beliefs and opinions, and to obtain information and knowledge to plan an attack. Therefore, there is a good possibility that they leave digital traces in the form of weak signals that can be gathered, fused, and analyzed. In this work we present an analysis method that can be used to analyze extremist forums to profile possible lone wolf terrorists. This method is conceptually demonstrated using the FOI Impactorium fusion platform. We also present a number of different technologies that can be used to harvest and analyze information from Internet, serving as weak digital traces that can be fused using the suggested analysis method, in order to discover possible lone wolf terrorists. Index Terms—intelligence analysis; natural language process- ing; NLP; text mining; affect analysis; weak signals I. I NTRODUCTION Today, one of the most challenging and unpredictable forms of terrorism are violent terror acts committed by single in- dividuals, often referred to as lone wolf terrorists or lone actor terrorists. These kinds of terror attacks are hard to detect and defend against by traditional police means such as infiltration or wiretapping, since the lone wolves are planning and carrying out the attacks on their own. The problem of lone wolf terrorism is according to many officials presently on the rise and viewed as a greater threat towards society than organized groups. Even though available statistics suggest that lone wolf terrorists accounts for a rather small proportion of all terror incidents [20], they can often have a large impact on the society [8]. Moreover, many of the major terrorist attacks in the United States (with exception for the 2001 attacks against World Trade Center, the Pentagon and the White House) were executed by individuals who were sympathetic to a larger cause—from the Oklahoma City bomber Timothy McVeigh to the Washington area sniper John Allen Muhammad. A similar development can be seen in Europe, where several terrorist attacks have been executed by lone wolf terrorists during the last years. One of the most terrifying acts was the two 2011 terror attacks in Norway committed by Anders Behring Breivik, killing 77 persons in total. Even though lone wolf terrorists in general cannot be captured by traditional intelligence techniques, this does not imply that there is nothing counterterrorist organizations can do to prevent them. In fact, many lone wolf terrorists are only loners in their offline life, making the Internet an incredibly important source for finding them. According to Sageman [18], most lone wolves are part of online forums, especially those who go on to actually carry out terrorist attacks. The Internet gives isolated lone wolves the opportunity to be a part of a community, something which they often are longing for. There are several communities that encourage and influence individuals to act alone, and individuals that act alone are also often influencing these communities. Online extremist forums and web sites allow for aberrant beliefs or attitudes to be exchanged and reinforced, and creates environments in which otherwise unacceptable views become normalized [21]. In ad- dition to give a possibility of becoming a part of a community, the Internet is also a platform where lone wolves can express their views. The 2010 suicide bomber in Stockholm, Taimour Abdulwahab al-Abdaly, was for example active on Internet and had a YouTube account, a Facebook account and searched for a second wife on Islamic web pages. Anders Behring Breivik used several different social networking sites such as Facebook and Twitter and posted his manifesto “2083, A Declaration of Independence of Europe” on the Internet before committing the two terror attacks in Norway. The actual possession of several social media accounts is obviously perfectly normal, but the content of lone wolf terrorists’ social media sites is often far from normal. One of the major problems with analyzing information from the Internet is that it is huge, making it impossible for analysts to manually search for information and analyze all data concerning radicalization processes and terror plans of possible lone wolf terrorists. In addition to all material that the analysts can find through the use of various search engines, there are also enormous amounts of information in the so called hidden or Deep Web, i.e., the part of Internet that is not indexed by the search engines’ web spiders (e.g., due to password protection or dynamically generated content). To produce fully automatic computer tools for finding terror plans is not possible, both due to the large amounts of data and the deep knowledge that is needed to really understand what is discussed or expressed in written text (or other kinds of data available on the Internet, such as videos or images). However, computer-based support tools that aid the analysts in their investigation could enable them to process more data and give better possibilities to analyze and detect the digital 2012 European Intelligence and Security Informatics Conference 978-0-7695-4782-4/12 $26.00 © 2012 IEEE DOI 10.1109/EISIC.2012.20 197