680 WK6 1 and 2

succ.pdf

Home >Government homework help >680 WK6 1 and 2

Studies in Conflict & Terrorism, 34:367–382, 2011 ISSN: 1057-610X print / 1521-0731 online DOI: 10.1080/1057610X.2011.561469

Success, Lethality, and Cell Structure Across the Dimensions of Al Qaeda

SCOTT HELFSTEIN DOMINICK WRIGHT

Combating Terrorism Center United States Military Academy West Point, NY, USA

While experts understand that Al Qaeda’s attack patterns and operational qualities are changing, they struggle to identify and generate consensus on Al Qaeda’s strategic cen- ter of gravity. By defining different levels of Al Qaeda, core, periphery, and movement, this article engages current debates about the threat by focusing on the operational differences across these three levels. Contrary to conventional wisdom about opera- tional efficiency, the social movement has a higher success rate but the core imposes greater costs as measured by casualties. The cells or networks actually executing the attacks also display substantive differences. The social movement networks organize in smaller cells than either affiliated groups or the core; however, they display greater levels of connectedness. The affiliated and organization cells display fewer connections, suggestive of more disciplined operational procedure despite lower success rates. These patterns reflect fundamental differences across characterizations of Al Qaeda, and have significant implications for counterterrorism efforts.

Many in the counterterrorism community have observed that Al Qaeda is evolving. While experts understand that attack patterns and operational qualities are changing, they struggle to identify and generate consensus on Al Qaeda’s strategic center of gravity. Uncertainty regarding where its organizational, core strength lies is problematic because conventional military logic maintains the importance of targeting the enemy’s strategic center of gravity. Yet it is unclear whether Al Qaeda’s greatest source of strength is its leadership core or the cadre of motivated supporters.1 By defining different levels of Al Qaeda, core, periphery, and movement, this article engages current debates about the threat by focusing on the operational differences across these three levels. Such a focus helps adjudicate some of the existing disputes and reduces prevailing uncertainty by identifying patterns of organizational evolution and connecting these stages to trends in violence.

This article not subject to US copyright law. Received 18 March 2010; accepted 29 August 2010. The perspectives in this article are solely those of the authors and do not represent the United

States Military Academy, the Department of the Army, or the Department of Defense. The authors would like to thank Bill Braniff, Reid Sawyer, and anonymous reviewers for helpful

comments. All errors are the authors’ own. Address correspondence to Scott Helfstein, Combating Terrorism Center, United States Military

Academy, Lincoln Hall 119, West Point, NY 10996, USA. E-mail: [email protected]

367

368 S. Helfstein and D. Wright

Al Qaeda central (the core), ordinarily perceived as the most operationally efficient, is actually the least likely to carry out a successful attack. Plots tied to Al Qaeda senior leadership are only successful 50 percent of the time, whereas those produced by a social movement with an ideological affinity for global jihad and no direct connections to Al Qaeda, are much more likely to succeed. The finding contradicts conventional wisdom about operational efficiency, but it is not without an important caveat. Although the move- ment is operationally more efficient, the core is more lethal, producing far more casualties. This means that the social movement has a higher success rate while the core imposes greater costs. While these conclusions were drawn from assessing the historical period up to 2003, anecdotal evidence of movement success is evident from the shooting incidents at Fort Hood and Little Rock, Arkansas. Concurrently, the New York subway and Times Square plots tied to Al Qaeda and the Pakistan Taliban, respectively, were far larger in design.

Different levels of Al Qaeda display different operational capacities, and vary sys- temically in the way that groups self-organize into attack networks or cells. Movement sympathizers organize in smaller cells, averaging just above ten participants per attack, than either the groups on the periphery or the core with approximately fourteen and thirteen members, respectively. Sympathizer or social movement networks are not only smaller than their counterparts they are also more connected. Attack networks tied to the periphery and core of Al Qaeda display fewer connections than the movement cells, suggesting a more disciplined operational procedure despite lower success rates. Together, differences in cell output and organization across the different levels of Al Qaeda point to fundamental differences that may have significant implications for counterterrorism efforts.

The next section of this article defines the “levels” of Al Qaeda, combining substantive insights with the rigor of network theory to develop a typology of attack cells. With a framework for qualitatively distinguishing the cells in hand, the article then presents the attack sample under study. Next follows an assessment of network characteristics across the levels, starting with debates in the literature, and then examining how differences in cell type lead to differences in network structure. After this assessment, the article moves to evaluating the attack outcomes associated with the alternate Al Qaeda levels. Different Al Qaeda types display variance in the number of casualties they produce, the types of targets they select, and the relative success they experience in conducting operations. The final section looks at some of the broader trends and implications of the research.

Three Levels of Al Qaeda

In recent congressional testimony, Martha Crenshaw argued that Al Qaeda is a “complex organizational structure . . . somewhere between a centralized hierarchy and a decentralized flat network.”2 She identified three levels constituting Al Qaeda’s current structure: Al Qaeda central leadership, second-tier leadership, and individuals or cells. Her description for these three levels provides a useful starting place for this analysis. Al Qaeda central leadership, located in the Pakistan hinterland, includes figures like Osama bin Laden and Ayman al-Zawahiri that provide broad strategic guidance and ideological direction. The operational capability of the leadership has waned over time. The second-tier leadership consists of two groups: affiliated or merged organizations with their own interests and local leaders such as clerics in mosques and ideological upstarts in Western countries that drive recruitment for the organization’s various components. Examples of those in the second tier include Al Qaeda in the Islamic Maghreb (AQIM) as well as clerics like Anwar al-Awlaki who has played a vital role in motivating young men to violent action. Finally, Crenshaw

Success, Lethality, and Cell Structure of Al Qaeda 369

made note of those she labeled recruits and volunteers who include individuals from the West or can move easily to or from the West that adhere to Al Qaeda’s ideals.3

This three-level paradigm provides a useful way to capture Al Qaeda as it currently exists, which was the purpose of the testimony. The framework was not meant capture the evolution of and variation in relationships within Al Qaeda over time, which is a focus of this analysis. For example, the framework does not easily accommodate Arab mujahedeen, the original “base,” that fought in Afghanistan in the 1980s and 1990s or trained in Al Qaeda’s Afghan camps.4 This heterogeneous group of individuals, some of whom carried out attacks in the Middle East and Europe in the 1990s, was not part of any formal Al Qaeda organization, but they were not simply ideologically driven recruits either. They trained and fought with Al Qaeda elements throughout the organization’s early stages of development, before a hierarchical infrastructure emerged. Individuals like these do not nest easily into any of the categories Crenshaw outlined.

Analysis in this article preserves Crenshaw’s three-level framework and refines it to develop an operational definition for attacks or attack origination. It integrates the three- level with a concept known as the strength of relationships or ties. Mark Granovetter stated that “the strength of a tie is a combination of the amount of time, the emotional intensity, the intimacy [or mutual confiding], and the reciprocal services which characterize the tie.”5

He goes on to distinguish between three types of ties strength: strong, weak, and absent. Strong ties bind individuals that are close friends, weak ties link acquaintances, and absence implies no direct relationship. This framework is useful for characterizing the relationship between Al Qaeda and members of attack cells with alternate links to the network.

Categorization for attack cells depends upon the strength of association with the Al Qaeda senior leadership, as defined by Crenshaw.6 Cells designated as having strong ties, such as 9/11, contain members tightly associated with Osama bin Laden and Ayman al- Zawahiri. Senior leaders were aware of the plots and may have been involved in some aspect of operational planning. Cells with weak ties to Al Qaeda leadership are affiliate organi- zations, whose leaders loosely associate with Al Qaeda senior leadership. Alternatively, weakly associated cells can contain individuals linked to Al Qaeda leadership through attendance at their sponsored training camps or weak links through participation in violent jihad somewhere in the world. Examples of weakly tied attacks include the July 1995 bombing in Paris carried out by Armed Islamic Group (GIA) and the 1995 attack in Riyadh reportedly perpetrated by mujahedeen trained in an Al Qaeda Afghan camp.7 There are also attacks where Al Qaeda ideals of transnational jihad motivate the perpetrators absent a direct connection between the attackers and Al Qaeda leadership. There was significant growth in such plots over recent years.

Categorization of members in attack cells according to their strength of ties to Al Qaeda leadership proves useful for distinguishing operations from one another. If any member of an operation has a strong connection with Al Qaeda leadership, it is a part of the core. Operations with members that at best share a disparate, weak connection to the core are a part of the periphery. Operations whose members share no clear connection to the core are “isolates,” subject to indirect ideological influence and part of a social movement. This three-level categorization for attacks is consistent and useful for recognizing the proximity of Al Qaeda central to a variety of operations and displayed graphically in Figure 1. The framework sets the stage for evaluating whether qualitative differences in Al Qaeda levels translate into quantitative differences in network structure and, more importantly, significant differences in alternate characteristics of attacks. The next section outlines the twenty-three attacks analyzed using this three-level typology.

370 S. Helfstein and D. Wright

Figure 1. Defining core, periphery, and movement. (Figure provided in color online).

Attack Sample

This research bases itself on an assessment of twenty-three attacks, both successful and failed, from 1993 to 2003. Data analyzed in this article include information on the structure of the Al Qaeda network contained in the John Jay and ARTIS Transnational Terrorism (JJATT) dataset, supplemented here with additional information drawn from open sources.8

This additional information included data on the numbers of victims and casualties, target types, and relationship between the tactical cell and Al Qaeda. A complicating issue to the analysis is the absence of an agreed upon definition of Al Qaeda or Al Qaeda-inspired attacks. Additionally, no database comprehensively captures successful and failed plots. Conservatively, from 1998 to 2003, Al Qaeda central claimed credit for twenty successful attacks, four of which occurred in Iraq in 2003.9 Since this study seeks to look beyond Al Qaeda core, the sample here includes attacks by people tied to Al Qaeda through training camps, activated by affiliate groups, or motivated by Al Qaeda’s extremist ideology, despite lacking formal connection to the central organization. Given that Al Qaeda claimed credit for sixteen successful attacks (excluding Iraq) from 1998 to 2003, and this sample includes twenty-three attacks, it seems a reasonable size to look at for general patterns.10

A prominent feature of the sample is that it highlights the amorphous nature of the Al Qaeda threat. Al Qaeda, as a functional organization, did not become operational until 1998.11 While Al Qaeda may not have existed as an organization before 1996, some of its eventual members offered tactical training and ideological guidance to many that passed through Pakistan and Afghanistan throughout the late 1980s and early 1990s. The constellation of actors and assortment of relationships within Al Qaeda offer perspective

Success, Lethality, and Cell Structure of Al Qaeda 371

Table 1 Sample of attacks

Success Target Year Location Casualties Level (Yes = 1) (Hard = 1) Density 1993 U.S. 1006 Periphery 1 0 0.303 1994 Morocco 2 Movement 1 0 0.450 1995 France 108 Periphery 1 0 0.262 1995 Saudi Arabia 66 Periphery 1 1 1.000 1995 Japan/Phillipines 0 Periphery 0 0 0.733 1995 Ethiopia 0 Core 0 1 0.576 1996 France 84 Periphery 1 0 0.682 1997 Egypt 62 Periphery 1 0 0.571 1998 Albania 0 Periphery 0 1 0.309 1998 Kenya 5223 Core 1 1 0.265 1999 Jordan 0 Core 0 0 0.500 1999 U.S. 0 Core 0 0 0.353 2000 Germany 0 Core 0 0 0.225 2000 Yemen 56 Core 1 1 0.267 2001 France/U.S. 0 Core 0 0 0.667 2001 Afghanistan 3 Core 1 0 0.394 2001 France 0 Core 0 1 0.444 2002 UK/Morroco 0 Periphery 0 0 0.154 2002 Pakistan 1 Core 1 0 0.271 2002 Kenya 86 Core 1 0 0.600 2002 Tunisia 51 Core 1 0 0.500 2003 Saudi Arabia 235 Periphery 1 0 0.268 2003 Israel 23 Movement 1 0 1.000

beyond the organization. For example, Ramzi Youssef, whose participation was crucial in the 1993 World Trade Center bombing, was not formally part of the operationally inactive Al Qaeda core, but he associated with those that would play key operational and leadership roles later.12 A similar argument exists for the 1995 and 1996 attacks in France perpetrated by an Algerian terrorist group backed by Afghan Arabs who would assume leadership roles in Al Qaeda.13 The typology here focuses on the people, timing, and nature of relationships within Al Qaeda. The actual cases and summary statistics are found in Table 1, which shows the year, location, typology (core, periphery, movement), casualties (injured and dead), and the density (social network measure) of the cell.

The typological classifications of the attacks rely on the definition established above, and are driven by the position and connectivity (or lack thereof) within the network. Many incidents are straightforward, but a few warrant further justification before continuing to the analysis. Attacks with “strong ties,” classified as within two ties to Osama bin Laden and Ayman al-Zawhiri, are coded as belonging to Al Qaeda core. These attacks include the 1995 Ethiopia attack, the Kenyan embassy bombing, the cell in Amman in 1999, the plot against LAX, the attack on the U.S.S. Cole, the assassination of Ahmed Shah Massoud before 9/11, a thwarted plot in Paris, the 2001 shoe-bombing attempt, the killing of Daniel Pearl in 2002, the attacks against an Israeli owned hotel and plane in Mombasa 2002, and a Tunisia bombing logistically organized by Khalid Sheik Mohammad.14 One event in this group, Richard Reid’s attempted shoe-bombing, proved difficult to code. Reid received training

372 S. Helfstein and D. Wright

in Kandahar at the Hudeifa camp and attended the Finsbury Mosque in London. Neither of these events warrants coding the event as a core incident alone, but social network data suggest that there was an operational tie to Abu Zubaydah, one of Al Qaeda’s military chiefs. If that is true, it does tie the plot to the core. If not, it is better to classify it as a periphery attack. The empirical results are robust to either coding.

On the other extreme, there are instances where attack cells had no clear connections to constellation of people constituting the core or periphery. From a network perspective, these groups were unconnected to the broader terror network at the time of that attack but drew on its inspiration from the ideas of transnational jihad and a global caliphate. This sample only contains two attacks that clearly classify as unconnected: the 1994 attack in Morocco and the attack against Mike’s pub in Tel Aviv perpetrated by two British Citizens in 2003. In each of these cases, the individuals drew inspiration from Al Qaeda but lacked formal connections to the group at the time of the incidents.15 Despite the rigorous network- oriented definition of the Al Qaeda levels developed here, classification of events remains difficult. For example, Khalid Sheik Mohammad claimed to have beheaded Daniel Pearl in a hearing, which could be true or falsely claimed in an act of bravado. He was actually abducted by Lashkar-e-Jhangvi, a sectarian group operating in Pakistan with suspected ties to Al Qaeda. Given the confession, the incident was coded as a core attack, but if the claim is false, it would be better classified as movement attack. Once again, the empirical results reported below are robust to a reclassification.

Between the extremes of attacks by the core and the movement are those where members in the operation had access to Al Qaeda resources and training, or were members of Al Qaeda affiliates. What distinguishes them is that they lack direct connections to the core leadership. These are the “weak ties” discussed earlier and characterized by links to peripheral actors, such as trainers and suppliers, in the larger network. Eight attacks in the sample display weak ties: the 1993 World Trade Center attack, the 1995 Paris bombing by the GIA, the 1995 Bojinka plot organized by Ramzi Youssef (the nephew of Khalid Sheik Mohammad) with logistical support from Jemaah Islamiah operatives with resource ties to Al Qaeda, the bombing of the National Guard headquarters in Riyadh in 1995, the 1996 GIA attack in France, the attack at Luxor in 1997, arrest of a cell operating in Albania in 1998, a 2002 plot against NATO ships passing through the Strait of Gibraltar, and a 2003 bombing in Riyadh. Some of these, like the GIA bombings in France and the 2003 Riyadh bombing, are easily characterized by weak ties through an affiliate organization.16

The three hardest to classify are the 1993 World Trade Center attack, the 1995 Bojinka plot, and the 1995 Riyadh bombing. Omar Abdel Rahman masterminded the former, while Ramzi Youssef played a crucial logistical role. Youssef would go on to have links with many Al Qaeda operatives and Rahman was familiar with many of members of Islamic Jihad that would ultimately form the core of Al Qaeda. Despite the plethora of connections, Al Qaeda was not a functional organization, meaning the core did not sanction the attack, but the interpersonal connections make it difficult to label the plots as movement attacks. The most apparent interpersonal connection was the relationship between Youssef and Khalid Sheikh Mohammad, and the latter had direct ties to Al Qaeda senior leadership.17 The Bojinka plot, also organized by Youssef, is categorized as a peripheral attack, since Al Qaeda core did not direct the plot. The 1995 Riyadh attack is also difficult to classify, in large measure because there is so much uncertainty surrounding the incident.18 Three groups claimed responsibility for the bombing. The Saudi government arrested and executed four men for the attack, but there is little information available about these individuals. During interrogation, they claimed bin Laden inspired them. In 1996 Jamal Ahmed al-Fadl revealed Al Qaeda was

Success, Lethality, and Cell Structure of Al Qaeda 373

trying to smuggle weapons into Saudi Arabia, however, there are no clear links. Given this uncertainty, the attack received alternate coding of periphery and movement. Results presented below remain robust to the alterations noted earlier, including a reclassification of the Bojinka plot.19

Looking across these simple categorizations, a number of clear trends emerge including differences in casualties, success rates, target profile, and self-organizing characteristics.

Networked Al Qaeda

The intelligence and counterterrorism communities increasingly rely on network analysis to understand threats and find ways to counter them. Social networks are groups of people linked by interpersonal connections, which include everything from the casual acquaintance to close friendship or family-based ties.20 Connections also extend to include professional relationships (e.g., those of purchase and exchange or employer–employee) as well as virtual associations, such as the links formed on social media like Facebook and through Internet chat rooms. Social networking offers a way to think about and evaluate relationships according to their structure.

Network analysis can be a useful tool, but there tends to be an empirical theoreti- cal divide in many substantive areas. Studies of networks in terrorism are no different. Empirical studies on terrorist networks have aptly described a variety of trends among these organizations, but rarely offer generalized insights that travel far beyond the cases evaluated. Abstract theoretical models, both formal and informal, outline what structures terrorist networks should take without validating whether their predictions hold true across the conditions that they have specified. In this section, the article bridges the theoretical and empirical divide by assessing structures of Al Qaeda attack cells.

A wealth of empirical research has provided descriptions of the social processes giving rise to terror networks and sustaining them despite counter-network action. Explanations about how terrorists self-organize focus on structure and attack response. Marc Sageman produced a series of network maps depicting the Al Qaeda central leadership and its attack cells, finding they organized in clusters.21 These clusters often rested on geographic origin of operatives as well as friendship and family ties that existed long before mobilization for attacks. Using Jemaah Islamiyah as a case study, Stuart Koschade found that the 2002 Bali attack cell was relatively dense.22 Despite inevitable risks to operational security raised with such a large interpersonal “footprint” produces, the group exhibited a great number of ties, akin to a ball of string.23 Forwarding a theory about the growth of terrorist networks, Valdis Krebs argued that they thrive from provisional links that appear dormant until operationally expedient.24 Provisional links, he argues, arise because of the trust and strength of ties between fellow terrorists. Justin Magouirk, Scott Atran, and Marc Sageman describe these relationships further by evaluating the broader Jemaah Islamiyah network, finding that it filled leadership positions opened from counter-network action (e.g., arrests and assassinations) according to associations within a parallel kinship network.25 Beyond this handful of empirical analyses, there is little work looking across the actual structure of terrorist cells and even fewer works with generalizable conclusions. Do the groups always form tight clusters? Alternatively, does clustering arise from a mix of internal and external conditions that these empirical studies have not taken into account?

Walter Enders and Xuejuan Su along with Walter Enders and Paan Jindapon, take on the two issues of internal and external determinants for network structure directly.26

Using models of network growth based on rational actor assumptions, the authors argue that highly capable cells tend to form dense clusters because they need to transmit large

374 S. Helfstein and D. Wright

amounts of information efficiently throughout their membership. High levels of capability among members make these groups more likely to take on logistically difficult attacks, a point addressed further below. For now, it is important to see how these authors predict that capacity corresponds to increasingly dense networks. When mobilizing for attack under pressure from authorities, however, networks tend to be less dense regardless of their internal capacity. External pressure from authorities makes them form smaller “footprints” that are less likely to draw suspicion and raise the awareness of authorities.27 Although interesting in the abstract, these theories are informative when assessed relative to observed data.

Given existing arguments about rational cell structure, one can extrapolate expecta- tions for network structure across the three levels. In terms of capacity, attack networks produced from the core and affiliate groups should have more resources than those along the periphery. Whether the resource in question is material (e.g., access to technology, funds, and ordinance) or immaterial (e.g., logistical planning capabilities and situational awareness), core and affiliate components of the network should, on average, demonstrate a greater capacity than members of the movement do. According to this identification, if the proposed theories are correct, then core and affiliated networks should be denser than movement networks.

Analysis revealed that the cell structure differs across the different levels of Al Qaeda but not in ways proposed by extant theory. Network density, which describes the percentage of relationships that exist among members compared to the ones that could possibly exist, does not increase according to how close an attack cell is to the core of the outlined typology (Figure 2). In fact, cells tied to the core had the lowest density with an average of 42 percent of the potential ties actually realized. This result is in comparison to density levels of 48 percent and 73 percent among the affiliated and movement cells. Clearly, capacity and density do not conform to expectations. One explanation for this pattern stems from the standard empirical finding in network science that density tends to decrease with network growth. To see why this might be the case, consider patterns of relations between a group with five members versus one with twice that amount. For a network with five members to have a density of 50 percent, its members need to only average about two connections.

Figure 2. Cell size and density by type.

Success, Lethality, and Cell Structure of Al Qaeda 375

Contrast this with a group having ten members and a density of 50 percent. Such a group has to have more than twice the amount of connections (approximately four connections) to maintain a density of 50 percent. Does this explain the difference between density levels across the three levels of Al Qaeda?

The data provides mixed support for this alternative explanation. Cells tied to the movement are usually smaller than those associated with the periphery or the core, but core cells tend to be smaller and less dense than affiliated ones. Findings show that movement cells averaged ten (10.5) participants, those in the core averaged almost thirteen participants (12.7), and the periphery cells were largest with almost fourteen participants (13.8). These results suggest that attack cells across the different levels develop differently, most likely according to some form of group discipline.28

Relatively small cells of the movement, motivated by Al Qaeda’s rhetoric, tend to be groups of friends or acquaintances. Since they initially came together for social purposes, it is not surprising that most members know one another. There is less discipline in cell design, and little reason to assume that these movement cells go out of their way to design secure operational structures. Cells tied to the core developed with the express purpose of carrying out an operation or providing some sort of logistical support. These cells, which are opera- tionally secure in structure, seem to have developed with a greater concern for avoiding the attention of authorities. The cells tied to the periphery of the network have density measures closer to the core than the movement, despite being considerably larger. This similarity per- haps reflects a threshold of some sort, a reasonable level of density given discipline exhibited by trained individuals. From a counterterrorism perspective, the good news is that move- ment groups may be difficult to identify because they tend to spring from relatively benign circumstances, but they are relatively easy to track because they maintain the least secure operational tendencies. By contrast, core and affiliated cells have structures that prove harder to detect because they maintain smaller “footprints,” making them more secure.29

Explaining the size differential between the core and periphery is also important. Those tied to Al Qaeda core are, and in the history of the organization always have been, a very small group. While the core can resource an attack better than an inspired group, the core still operates under resource constraints. The core is a group of foreign nationals that have been through training and combat, but find moving valuable resources across borders difficult as well as dangerous. Alternatively, those in the periphery, particularly affiliated groups, often operate in specific areas of strength. For example, AQIM is consistently refreshing its pool of recruits in Algeria.30 They do not need to cross borders if they wish to mount an attack in Algeria. Algerian immigrants embedded in France as well as transplants from across the Mediterranean conducted the attacks in Paris. Individuals with weak ties to Al Qaeda and like-minded locals executed the attacks in Saudi Arabia and Egypt. Given the strain that Al Qaeda core operates under, it would not be surprising to see this trend continue into the future. The peripheral cells should have greater freedom of movement, and possibly access to more human capital, than the Al Qaeda core.

There are a few plausible explanations for these observed tendencies across Al Qaeda levels. First, cells inspired but unlinked to Al Qaeda are responsible for their own security. Adding an additional participant puts all the cell members at risk. This means they have little reason to expand their ranks unless operationally necessary. Studies of “homegrown” terrorists—a term that is increasingly problematic in the current climate given the movement of individuals—show that they are close-knit cells composed of individuals that radicalize together before mobilizing.31 Contrary to the “bunches of guys” in a small cell, attacks from the core and periphery may be staffed according to fundamentally different criteria. These groups can assess the needs of an operation, and select the optimal mix of participants and

376 S. Helfstein and D. Wright

skills to increase the chances of success. Attacks tied to the core, usually large plots, may require more participants than the small-scale attacks carried out by the movement. The core also has the capability to match individuals with little familiarity, because they both belong to the meta-network and have a focus on the operation at hand.

Who is the Deadliest of Them All?

There are two predominant theories that have circulated in recent years. The first argues that the biggest threat stems from unaffiliated individuals motivated by Al Qaeda’s message of transnational jihad.32 These “bunches of guys” lacking connection to Al Qaeda’s formal network can appear anywhere, complicating intercession and drastically increasing the burden on intelligence capabilities. A second perspective, as theorized by researchers like by Bruce Hoffman, Enders, Su and Jindapon, maintains that Al Qaeda central leadership, the core, continues to pose the biggest threat.33 Groups of these individuals are more capable, having the leadership, know how, resources, and motivation to conduct the most sophisticated, large-scale attacks.

Both arguments appear plausible, and rely on reasonable assumptions. Public opinion polls reflect declining support for Osama bin Laden and Al Qaeda in many countries, but the message of transnational jihad continues to spread through radical clerics, Internet forums, and social networks. The “bunches of guys” position captures the threat of those motivated to action through those messages, without having contact direct contact with Al Qaeda. These decentralized cells can appear almost anywhere, striking a target in the name of jihad and Al Qaeda at almost any time. Their flexibility, anonymity, and motivation make them a formidable adversary for the defense establishment. Historical assessment, however, suggests that Al Qaeda leadership presents a formidable enemy. This group is more centralized than the “bunches of guys,” allowing for more efficient operational planning. These senior ranks are also consist of well-trained personnel with years of operational experience, and continue to access relatively large resource pools from fundraising efforts Gulf region.

The assumptions underlying each argument, paint a very different “threat” picture when evaluated carefully. The unaffiliated cells benefit from freedom of movement, such as switching targets or means, and anonymity. These groups also have weaknesses such as informal command structure lacking in centralization, limited resources, and no formal training. Decentralized groups are very efficient at accomplishing simple tasks, but display difficulty accomplishing relatively complex tasks.34 This is amplified when groups lack the formal training or knowledge to carry out a task. Added to the resource constraints associated with start-up organizations, these cells should find it very difficult to execute complex tasks. If complex attacks involve either attacks on hardened government targets or large multi-agent coordinated mass casualty attacks, there is little reason to believe that these groups are capable of such mayhem. The unaffiliated groups, however, have the advantages of anonymity and freedom of action. If these groups abstain from suspicious behavior, they should avoid detection. It is reasonable to argue that these unaffiliated groups have a low probability of carrying out successful sophisticated attacks, but a high probability of carrying out simple operations.

Al Qaeda core also has its share of strengths and weaknesses. Following the logic on task efficiency, command structure or centralized planning should help to execute complex tasks efficiently. Not only can the centralized leadership help plan, but they can allocate sub-tasks to specific people, presumably those with the skill sets best suited. The command structure could prove beneficial in both planning and execution, making it

Success, Lethality, and Cell Structure of Al Qaeda 377

perfectly reasonable to argue that Al Qaeda leadership is better capable of successfully carrying a coordinate attack. Access to resources further contributes to the group’s capacity for a large-scale coordinated attacks or assaults against hardened targets. While central leadership may be most capable of pulling off such attacks, it is important to recognize that complex coordinate attacks or those against hardened targets are more likely to fail because of the sheer difficulty. Al Qaeda, however, operates under a microscope. Since 11 September, the group has been the target of relentless intelligence collection. Avoiding detection remains a primary operational concern. The threat from Al Qaeda leadership seems substantively different that of unaffiliated groups. Al Qaeda leadership enjoys a better position for carrying out large-scale, mass casualty attacks, but it is less likely to succeed because of detection and attack complexity. In theory, Al Qaeda leadership could attempt simple plots, but the detection risk is sufficiently high that it might offset any perceived benefits from the attack.35

This assessment helps to refine the notion of “deadly” or dangerous, highlighting the difference between attack size, target type, and probability of success. Unaffiliated groups should be more likely to carry out simple attacks successfully. Al Qaeda leadership, meanwhile, should be more likely to plot complex attacks, possibly against hardened targets, and less likely to successfully execute them. This does not mean that unaffiliated groups are incapable of executing large coordinated attacks or that Al Qaeda leadership will not rely on small attacks occasionally. Rather, it establishes a probabilistic argument about expected patterns. It is possible to conceive of danger as a function of the target (inclusive of size) and the probability of success. This distinction is central to understanding the threat from Al Qaeda across the three levels: core, periphery, and movement.

Within the sample of attacks studies here, there are clear patterns across the typology, many of which correspond to the risk-based theory developed above. Fourteen of twenty- three attacks (61 percent) are executed successfully, however, success rates vary greatly by attack cell type. An attack is successful if the perpetrators are able to access the target and inflict casualties. An attack is unsuccessful if authorities interdict it before the assault or its members fail at their tasks at the time of execution. Al Qaeda core is least likely to execute a successful attack, and only 50 percent of their attempts are successful. By contrast, the attacks tied to the movement have the highest success rate at 100 percent.36 Attacks associated with the periphery are successful 67 percent of the time, halfway between the core and the movement. As predicted, the core had a lower success rate than the movement. Reasons for the lower success rates revolved around the security constraints and surveillance targeting core members, the sophistication of the attack, and the nature of the target. Groups facing greater scrutiny, planning more complex operations, and selecting military or hardened targets should experience more thwarted and failed plots. Using success as a metric of risk, the movement appears to pose a greater risk than the core, but success rates are only one metric.

The movement is more capable of carrying out successful attack, but it is equally important to assess the nature of those attacks. Cells tied the movement, lacking central- ization and resources, should be more apt to carry out small-scale attacks. Those tied to Al Qaeda core should attempt to execute larger coordinated attacks. One average, attacks tied to the core killed and injured 452 people and those associated with the periphery 173. Plots from the movement-linked cells killed and injured thirteen people on average. The results are very sensitive to outliers, such that the organization is marked by a few large successes. Cells from the periphery produce more constant results, both in casualties and success, and those associated with the movement consistently deliver low levels of violence. This offers a more nuanced perspective of the Al Qaeda threat: the core has a

378 S. Helfstein and D. Wright

low probably of success punctuated by very deadly operations while the movement has a higher likelihood of carrying out smaller attacks. The periphery resides in the middle, ca- pable of sustaining violence levels greater than the movement with success rates above the core.

The theory developed above also suggested that typology might influence the choice of target, thereby impacting the success and casualty rates. Attacks cells tied to the core are much more likely to strike hardened targets than those in the periphery or movement. For purposes of this analysis, a target is classified as hard if it is military, police, or diplomatic in nature. The attacks on the U.S.S. Cole, U.S. embassy in Kenya, and the Program Office for the Saudi Arabia National Guard are coded hard. All others are classified as soft targets.37 Five of the attacks, 22 percent, aimed at hard targets. The core was responsible for four of those attacks, constituting 33 percent of their attempts. The periphery attacked the remaining hardened target, which was 11 percent of the periphery attacks. The movement cells did not attempt any attacks on hard targets.38 This suggests that attack cells tied to the core have bolder aspirations, and believe they have the capabilities to carry out such attacks. Since groups with greater central control should be capable of executing more complex tasks, this trend is not surprising. Attack cells tied to the core should have greater access to resources, know-how, and training, along with control mechanisms that should help to allocate resources effectively. The cells tied to the movement, lacking such resources, have little reasons to believe that attacks against hardened targets would be successful. Of the five attacks against hardened targets, three were executed successfully.

The question is not whether “bunches of guys” or Al Qaeda central pose the biggest threat, but rather what kind of threat each pose. Using the typology of core, periphery, and movement, it is clear that each type has strengths and weaknesses. The movement benefits from operating below the intelligence “radar,” which generates the time and space to carry out successful attacks. Since many of these individuals lack formal training and plots must be self-resourced, the ambitions of these actors are generally limited. They lack the operational experience to attack hardened targets or the resources for large coordinated attacks targeting civilian sites with rudimentary explosives or tactics. Cells tied to the core have the knowledge and resources to plan, and occasionally execute, large-scale attacks. These individuals, however, are prime intelligence collection priorities, making it more difficult to evade detection in the lead up to an attack. They also choose more symbolic or hardened targets, adding further operational pressure and reducing the likelihood of success.

Those from the periphery seem to get the best of both worlds. The link to the network increases the likelihood of access know-how and resources. The periphery access to or control over resources may not match the core, but it is sufficient to produce larger attacks. Since the activated individuals are in the periphery of the network, they may be subjects of intelligence collections, but the peripheral role may help mask their involvement given constrained national resources. Such collection is also complicated by the fact that current groups on the periphery of the Al Qaeda network such as Al Qaeda in the Islamic Maghreb or Al Qaeda on the Arabian Peninsula, operate in areas with few intelligence assets and a non-permissive collection environment. This mixture of anonymity and access may be a dangerous mix.

This analysis shows substantive differences in the attack capabilities and profiles according to cell origin. This also begs the question whether there are structural differences among the different cell types, which might be useful for intelligence or counterterrorism efforts.

Success, Lethality, and Cell Structure of Al Qaeda 379

Conclusions

The analysis shows that recent portrayals of Al Qaeda activity as new or novel actually demonstrate a continuation of past action. First, Al Qaeda consistently relies on existing group infrastructures. Such a tendency appears in the transition of the Salafist Group for Prayer and Combat (GSPC) to Al Qaeda in the Islamic Maghreb, the renewed Al Qaeda presence in Yemen, and even al-Shebab in Somalia. Each stands as evidence of Al Qaeda’s franchise strategy. Yet, the relationship between Al Qaeda core and AQIM is not drastically different from the relationship between the Afghan Arabs and the Armed Islamic Group (GIA) in the 1990s. This allegiance proved mutually beneficial until the GIA turned excessively violent and the Afghan Arabs ended cooperation between the groups.39

Other cases of Al Qaeda allegiance in the 1990s include material support for both Jemaah Islamyiah in Indonesia and Abu Sayyaf Group in the Philippines, and the later relationship was also terminated by Al Qaeda.40

Second, some point to the recent wave of small-scale plots planned by motivated supporters as evidence of a new trend. While this trend is disconcerting, it does not mark a radical departure from past activity. For example, Al Qaeda resourced a lone individual in the attempted LAX plot in 1999. Even at the height of their operational capabilities when they attacked the African embassies, the U.S.S. Cole, and 9/11, they were still resourcing smaller attacks by inspired individuals. While many of the recent thwarted attacks lack the material connections to the Al Qaeda core, these attacks are reminiscent of some early Al Qaeda efforts. These patterns help to highlight the fact that Al Qaeda has actively encouraged and supported violent jihad across the three different levels assessed here. Their support of other groups or lone individuals actually harkens back to the early days of their jihad.

Third, the study shows that the Al Qaeda core was most active, and operationally effective, from 1998 to 2001. Even during this period, however, the core group had a fair share of failures. Only 40 percent of the attacks assessed here were effective, but those that were elevated terrorism to a new level of violence. The other thing that is remarkable during this period was the group’s ability to plan numerous attacks simultaneously. At the same time that the core was planning the attack on the U.S.S. Cole and 9/11, they were also resourcing the LAX plot. Their ability to maintain parallel planning processes is significant and all the more disconcerting now that inspired followers are turning operational in increasing numbers. Since 2001, the periphery and movement have attempted more attacks, and this trend that may well continue. The recent period from 2009 to 2010 also offered increased variance in attack targets. Those tied to affiliate groups or trained abroad targeted civilians or civil infrastructure, evidenced by the Denver, Christmas, and Time Square plots. “Homegrown” terrorists have tended to shy away from civilian targets in recent years, aiming instead at military and government targets, but Derrik Sharref’s 2006 attempt to bomb the Cherryvale Mall highlights the variation in plot types across levels over time. This increases the number of operations that intelligence officials must track, making it important to identify characteristics associated with the different attack and cell types.

Finally, there is a weak relationship between cell size and attacks, whereby larger cells inflict more casualties. Larger coordinated attacks usually involve multiple bombers or attacks. The core is responsible for the largest attacks despite fewer participants than the periphery, but the movement linked cells are the smallest and produce the fewest casualties. While law enforcement and intelligence should note the relationship between cell size and outcome, they should also be cautious. The difference in average cell size

380 S. Helfstein and D. Wright

between those tied to the core and movement is about three people, but the difference in damage is drastic. This suggests that the expertise of those in the cells, where operatives in the core and periphery are usually for more proficient than those in the movement, is crucial.

Notes

1. Bruce Hoffman, “The Myth of Grass-Roots Terrorism,” Foreign Affairs (May/June 2008); Marc Sageman and Bruce Hoffman, “Does Osama Still Call the Shots? Debating the Containment of al Qaeda’s Leadership,” Foreign Affairs (July/August 2008).

2. Martha Crenshaw, “Assessing the Al-Qa‘ida Threat to the United States,” CTC Sentinel (January 2010).

3. Ibid. 4. For a discussion see Lawrence Wright, The Looming Tower: Al-Qaeda and the Road to 9/11

(New York: Alfred A. Knopf, 2006). 5. Mark Granovetter, “The Strength of Weak Ties,” American Journal of Sociology 78(6)

(1973), pp. 1360–1380. 6. Crenshaw, “Assessing the Al-Qa‘ida Threat to the United States.” 7. Most accounts of Al Qaeda leadership after the withdrawal of Soviet forces from Afghanistan

note the support offered to groups operating in other parts of the world such as the GIA. For a review of these attacks, see U.S. Department of State, Patterns of Global Terrorism: 1995 (April 1995).

8. Available at www.artisresearch.com. 9. Scott Helfstein, Nasir Abdullah, and Omar al-Obadie, Deadly Vanguards: A Report on

al-Qa’ida’s Violence Against Muslims (West Point, NY: Combating Terrorism Center, 2009). 10. The network data was gathered by another researcher, effectively making this a double blind

study. 11. Wright, The Looming Tower. 12. Daniel Benjamin and Stephen Simon, The Age of Sacred Terror (New York: Random House,

2002). 13. Note that Al Qaeda did break its ties with the GIA in Algeria as their violence grew

indiscriminate. For an account of the break in Europe see Omar Nasiri, Inside the Jihad: My Life with Al Qaeda (New York: Basic Books, 2008).

14. For a discussion of Bojinka, see Zachary Abuza, Militant Islam in Southeast Asia: Crucible of Terror (Boulder, CO: Lynne Rienner, 2003); on the Ethiopia attack see U.S. Department of State, Patterns of Global Terrorism: 1995 and Wright, The Looming Tower; see Wright, The Looming Tower for the Kenya embassy bombing; for the Amman cell, the LAX plot, and the U.S.S. Cole see Benjamin and Simon, The Age of Sacred Terror; on the Massoud assassination see Wright, The Looming Tower; for the Paris plot see CNN, “Sources: Bin Laden link to Paris Plot” (3 October 2001). Available at http://archives.cnn.com/2001/WORLD/europe/10/03/inv.paris.begal/index.html; for the Tunisia plot, see BBC News, “Two Jailed Over Tunisia Bombing” (February 2009). Available at http://news.bbc.co.uk/2/hi/europe/7873543.stm

15. One of the conspirators in the Mombasa attacks, Fazul Abdullah Mohammed, may also have played a role in the 1998 embassy bombing, but there is no evidence of a connection with Al Qaeda in 2002. For the Morocco attack see U.S. Department of State, Patterns of Global Terrorism: 1994; for the Daniel pearl killing see Daren Fonda, “On the Trail of Daniel Pearl,” Time (27 September 2003). Available at http://www.time.com/time/arts/article/0,8599,490640,00.html; for the Mombasa attack see U.S. Department of State, Patterns of Global Terrorism: 2002; on the Tel Aviv attack see Israeli Ministry of Foreign Affairs, “Details of April 30, 2003 Tel Aviv Suicide Bombing” (3 June 2003). Available at mfa.gov.il

16. In the 2001 shoe bombing, Richard Reid had crossed paths with Moussaui at Finsbury Mosque, been involved in prayer meetings with Abu Qatada, and trained in a camp, but there is little

Success, Lethality, and Cell Structure of Al Qaeda 381

evidence that Al Qaeda leadership had direct links to the plot. See BBC, “Who is Richard Reid?” (28 December, 2001). Available at http://news.bbc.co.uk/2/hi/uk news/1731568.stm.

17. Benjamin and Simon, The Age of Sacred Terror 18. U.S. Department of State, Patterns of Global Terrorism: 1995. 19. The trends identified in what follows are robust to the movement of any marginal case.

Categorizing incidents or individuals also suffers from some grey areas. The authors have tried to uphold the criteria identified earlier in as rigorous a way possible.

20. Marc Sageman, Understanding Terror Networks (Philadelphia: University of Pennsylvania Press, 2004).

21. Ibid. 22. Stuart Koschade, “A Social Network Analysis of Jemaah Islamiyah: The Applications to

Counterterrorism and Intelligence,” Studies in Conflict and Terrorism 29(6) (September 2006), pp. 559–575.

23. A qualification to this finding is that the data used portrays relationships and not behavior between members. Ideally, evaluation of operational security for a group assesses behavior among members and not the preexisting relationships that enabled the group to mobilize.

24. Valdis Krebs, “Uncloaking Terrorist Networks,” First Monday 7(4) (2002). From this per- spective, a highly dense network does not compromise operational security as long as members do not frequently use the connections among them.

25. Justin Magouirk, Scott Atran, and Marc Sageman, “Connecting Terrorist Networks,” Studies in Conflict & Terrorism 31(1) (January 2008), pp. 1–16.

26. Walter Enders and Xuejuan Su, “Rational Terrorists and Optimal Network Structure,” Journal of Conflict Resolution 51(1) (2007), pp. 33–57; Walter Enders and Paan Jindapon, “Network Externalities and the Structure of Terror Networks,” Journal of Conflict Resolution 53(1) (2009), pp. 1–19.

27. Scott Helfstein, “Governance of Terror: New Institutionalism and the Evolution of Terrorist Organizations,” Public Administration Review 69(4) (2009), pp. 727–739.

28. This could be because of a single coordinator organizing the attack or a set of protocols that members follow individually.

29. For a discussion of terrorist institutional dynamics tied to footprints and secrecy see Scott Helfstein, “Governance of Terror: New Institutionalism and the Evolution of Terrorist Organizations,” Public Administration Review 69(3) (2009), pp. 727–739.

30. Jean-Luc Marret, “Al-Qaeda in Islamic Maghreb: A ‘Glocal’ Organization,” Studies in Conflict and Terrorism 31(6) (2008), pp. 541–552.

31. For an analysis on “homegrown” terrorism see Mitchell D. Silber and Arvin Bhatt, Radical- ization in the West: The Homegrown Threat (New York: New York Police Department, 2007), but the variety of attacks and arrangements makes the concept difficult to apply in cases such as Najibullah Zazi.

32. Marc Sageman, Leaderless Jihad: Terror Networks in the Twenty-First Century (Philadel- phia: University of Pennsylvania Press, 2008).

33. Hoffman, “Does Osama Still Call the Shots? Debating the Containment of al Qaeda’s Leadership”; Enders and Su, “Rational Terrorists and Optimal Network Structure”; Enders and Jindapon, “Network Externalities and the Structure of Terror Networks.”

34. Ken Kollman, John H. Miller, and Scott E. Page, “Decentralization and Search for Policy Solutions,” Journal of Law Economics and Organization 16(1) (2000), pp. 102–228.

35. Additionally, it is likely that small attacks have too little impact for their taste. 36. Note that this result is true even if the Daniel Pearl result is coded as a movement attack. It

is equally important to note that the success rate of movement attacks has fallen since the end of this sample, best exemplified by the large number of domestic terrorist arrests in 2009.

37. In reality, hard and soft is not a dichotomous classification. There is a continuum whereby some hard targets are harder than others, and some soft targets are softer than others. Civilian airliners may be viewed as soft targets, but penetrating airport security at multiple airports to hijack multiple planes hardens that civilian target. On the other side, a police station might be a softer target than

382 S. Helfstein and D. Wright

a military outpost. Without a detailed assessment of target security before the bombing, the authors relied on the coding method used in the Global Terrorism Database.

38. This is true in the sample, but the 2009 domestic plots might offer an important turning point. Individuals part of the “homegrown” threat aiming to attack the United States often targeted military posts and federal buildings. People trained abroad and activated to attack the homeland, such as the Denver, Christmas, and Times Square plots continued to target civilian or civil infrastructure.

39. Omar Nisiri, Inside the Jihad: My Life with Al Qaeda. 40. Renato Cruz De Castro, “The Influence of Transnational Jihadist Ideology on Islamic

Extremist Groups in the Philippines: The Cases of the Abu Sayyaf Group and the Rajah Solaiman Movement” in Scott Helfstein ed., Radical Islamic Ideology in Southeast Asia (West Point, NY: Combating Terrorism Center, 2009), pp. 54–73; Greg Barton, “The Historical Development of Jihadi Islamist Thought in Indonesia,” in Scott Helfstein ed., Radical Islamic Ideology in Southeast Asia (West Point, NY: Combating Terrorism Center, 2009), pp. 30–53.

emailed to multiple sites or posted to a listserv without the copyright holder's express written permission.

However, users may print, download, or email articles for individual use.