Homegrown radical terrorism and mass casualty events such as active shooter incidents in public spaces and schools remain real, prevalent threats to national security, to the security of private entities and their employees, to the economy, and to the values of a democratic society. There have been over 30 successful or attempted radical Islamist terror attacks on U.S. soil since 2009, in addition to multiple terrorist incidents stemming from other ideological motivations. There have also been dozens of mass shootings and school shootings during that same period. These types of incidents have cost hundreds of Americans their lives just in the past year.

Being able to respond to attacks is not enough. Instead, we can best protect ourselves by proactively detecting and preventing these threats from being realized, integrating cutting edge technology into our efforts. Individuals looking to commit terrorist attacks or other acts of violence do not operate in isolation – they leave indicators in their discussions, their behaviors, and their online activities. Using technology to identify these indicators and find these individuals before they can commit heinous acts is of the utmost importance for ensuring the security of our society and of private entities that may be at risk.

Detecting Online Radicalization

Since 9/11, America has experienced a shift in the type of threat posed by radical Islamist terrorism to the homeland. While the country’s major concern was once highly coordinated terrorist plots emanating from and directed by terrorist groups abroad, recent events, such as the Boston Marathon Bombing and the Orlando and San Bernardino shootings, have proven that homegrown terrorism and attacks carried out by single individuals or small groups are the more pressing concern. The Internet and social media have enabled terrorist groups like ISIS to reach and radicalize individuals and direct or inspire attacks around the globe, including in America. As a result, we need better methods to detect online radicalization of potential homegrown terrorists in order to prevent further attacks.

As of 2015, the FBI had 900 active investigations into homegrown violent extremists in all 50 states. Additionally, over 250 Americans have tried or succeeded at travelling to Syria to join the conflict there. 4 28 States and the District of Columbia have brought ISIS-related charges against individuals, and since the first arrests in 2014, 157 individuals have been charged in the U.S. for ISIS-related offenses. 5 Yet perhaps the most important statistic is that the majority of people charged in the U.S. for ISIS-related offenses are U.S. citizens or permanent residents.  These individuals were mainly radicalized in America through terrorist groups’ adept use of the Internet and social media. Terrorist groups create online communities and propaganda that exploit and legitimize the grievances of isolated or angry individuals with radical leanings and push them towards full-fledged radicalization. Many of these individuals are searching for a purpose or for a way to avenge what they see as discrimination against or attacks on their community, religion, or homeland.  Terrorist groups are therefore quick to offer belonging, purpose, status, recognition, and a chance for revenge to those who join their ranks. 9

The majority of people charged in the U.S. for ISIS-related offenses are U.S. citizens or permanent residents.

Before the Internet age, terrorist groups used recruiters who physically travelled to find individuals sympathetic to their cause. However, they are now able to recruit and radicalize online through widespread dissemination of their propaganda and through a plethora of online extremist discussion forums where they target vulnerable individuals in the West. These individuals are mainly first or second-generation Muslims living in non-Muslim majority countries who may feel disconnected from both their cultural and current homelands. 10 The terrorist recruiters push an “us” versus “them” ideology that further isolates these susceptible individuals from their communities, and both the recruiters and other participants in online extremist discussion forums rationalize the use of violence by capitalizing on the grievances these individuals feel against their Western home, often due to experienced discrimination or opposition to U.S. foreign policy in the Middle East. 11

In the past, after becoming radicalized, individuals plotting terror attacks often met in person to plan, which helped law enforcement track their communications and meetings. Some also traveled abroad to receive training in the Middle East, which allowed the intelligence community to follow their movements and connections with foreign terrorist groups. However, the advent of encrypted communication technology, such as Telegram, and prevalent use of social media has enabled terrorists to conduct their communication, planning, and attack training online in mediums largely untraceable by law enforcement. Due to the changes in the threat posed by radical Islamist terrorism and in the process of radicalization, the key venue for identifying radicalized individuals who are planning to strike the U.S. is now online. As the terrorists shift to this platform, so must efforts to prevent terrorist attacks.

Clues to Far-Right Extremist Behavior

In addition to radical Islamist terrorism, right-wing terrorism remains a prevalent security threat in the U.S. From 9/11 through 2014, far-right extremists killed over twice as many people in the U.S. as radical Islamist extremists. Right-wing extremism not only poses a threat to civilians, but also to law enforcement as at least 57 officers have been killed in right-wing attacks since 1990. 14 The number of terrorist attacks in the U.S. attributed to right-wing extremism rather than to other ideological motivations has increased from 6% of total attacks in 2010 to 35% in 2016. Incidents in recent years include the Emanuel African Methodist Episcopal Church shooting in Charleston, South Carolina that killed nine people, the Sikh temple attack in Wisconsin that killed six, and the killing of Heather Heyer during the Charlottesville rallies in Virginia. These attacks remind us that the threat of right-wing terrorism remains prevalent and must be taken as seriously as that of radical Islamist terrorism. And just like Islamist radicalization, right-wing radicalization has also moved to the Internet where individuals can become radicalized without attending group meetings or interacting in-person with other right-wing extremists in scenarios that are easier to monitor. Susceptible individuals can access discussion forums and a plethora of material about right-wing beliefs from their bedrooms.

The number of terrorist attacks in the U.S. attributed to right-wing extremism rather than to other ideological motivations has increased from 6% of total attacks in 2010 to 35% in 2016.

Both Keith Luke and Dylann Roof were radicalized online prior to their shooting sprees that targeted ethnic and religious minorities including African Americans and Jews. Widespread use of the Internet and social media means that this threat will persist. 17 One study on right-wing terrorism in America found that “right-wing terror incidents occur consistently because the movements from which they emanate are mature extremist movements with deep-seated roots. The Internet has made it easier for extremists to meet each other (and thus engage in plots), as well as to self-radicalize and become lone wolf offenders.”18 But like potential radical Islamist terrorists, potential right-wing terrorists leave clues about their radicalization and intentions in their online behaviors and discussions. The enhanced role of the Internet in radicalization and attack planning for both right-wing and radical Islamist terrorism emphasizes the necessity for technological innovation to combat these threats. Older methods of detecting and monitoring terrorist threats are no longer sufficient – the people looking to cause harm can be intelligent, cunning, and cautious. As the nature of these threat changes, so must our approach to fighting it. Only the use of threat-targeted technology will enable us to maintain public safety in this digital age.

Predicting Mass Casualty Events

In addition to terror attacks, the U.S. has witnessed a recent surge in mass casualty events such as mass shootings and school shootings. From 1966 to 2015, there were 146 mass shootings across 40 states and Washington D.C., resulting in 1,048 deaths. There have been 55 mass shootings since 2007 and 11 in 2017 alone. Statistical evidence shows that the frequency of mass shootings is increasing. Since 2011, the rate of mass shootings in the U.S. has tripled to an average of at least one event every 64 days. Yet, in many cases, the shooters have no connection to their victims or to their target locations that could provide a clue to their intentions. Over 71% of active shooter situations in the U.S. from 2000 to 2013 occurred in publicly accessible spaces including businesses, malls, schools, health care facilities, and houses of worship. 23

Furthermore, victims of U.S. mass shootings are of every age, gender, race, and religion with no clear patterns. 24

This lack of generalized predictive information regarding who may commit these violent acts, where they may do so, and who they may target means that we must find new ways to detect and prevent mass casualty planning behavior. Schools are implementing active shooter safety drills and commercial facilities and organizations have new security measures and training to prepare for these scenarios. However, many of these mass casualty events occur in less than five minutes, meaning that training may not be enough to avoid fatalities. 25 Stopping these attacks before they occur is key to averting mass casualties. Yet, mass shootings can be extremely difficult to predict or prevent due to the individualized nature of each attack, the relative ease of access to firearms in the U.S., and the minimal planning required.

Therefore, we need new technological capabilities that can identify specific indicators of these threats before they actualize. For example, it has come to light since the Parkland school shooting that the shooter had previously posted comments on social media about carrying out a school shooting and that his social media accounts contained pictures of guns, ammunition, and other violent or concerning content. We must deploy technology that senses the Internet for these types of threats and language as these may be readily available clues to a shooter’s intentions prior to an attack. Furthermore, school shooters often conduct extensive research into prior school shootings and often try to emulate components of previous attacks based on this research. Such topical investigations can and should be monitored and correlated with other online behavioral patterns to identify individuals who demonstrate attack-planning behavior and thus pose high-risk threats, distinguished from people conducting general research. This activity can also identify the particular web signatures of users engaging in attack-planning behavior. As a result, only users truly engaging in extreme, outlier behavior will be identified, making threat identification a fact-based process rather than one that could be biased on prior knowledge of a suspect individual. Similarly, this type of sensing can detect threats posed by individuals who may not be on law enforcement’s radar.

As new technologies and weapons are developed and more information becomes accessible online, the potential severity of threats to our country and its citizens increases. We must similarly change the way we approach detecting and preventing these violent threats in order to adequately address the enhanced capabilities and methods of those seeking to do us harm.

Many of these mass casualty events occur in less than five minutes, meaning that training may not be enough to avoid fatalities.


In today’s world, there are far too many Westminster and Nice vehicular attacks, Orlando shootings, Brussels airport bombings, Las Vegas massacres, Sandy Hook, and Parkland school shootings that occupy our news cycle and the front of our minds. The individuals who carry out these devastating and heinous acts seek to undermine our way of life, our sense of security, our freedoms, and our belief in our government. They also become increasingly hard to detect as they are radicalized through social media and carry out attack planning in online forums or encrypted apps where they are not easily identified or monitored. The UK Home Office found that in 2017, ISIS followers published propaganda on 400 different platforms, including 145 new ones between July and December alone. 27These terrorists and other violent actors must be met head on by the best possible tactics and tools to detect and prevent such threats before they are carried out. Indeed, both the public and private sectors are embracing the power of technology in this realm, particularly related to artificial intelligence and machine learning. At Lumina Analytics, we’re using these tools to understand threat-specific behavioral patterns and predicatively identify threats to society and national security, as well as to private corporations, venues, and events.