Skip to main content
SearchLoginLogin or Signup

A Mixed Method Examination of Law Enforcement Investigatory Strategies Used in Jihadi and Far-Right Foiled Terrorist Plots Before and After 9/11

This is the online version of the article. To access a print version with page numbers for citation and reference purposes, select "Download" to the right and then choose "Formatted PDF."

Published onJan 01, 2019
A Mixed Method Examination of Law Enforcement Investigatory Strategies Used in Jihadi and Far-Right Foiled Terrorist Plots Before and After 9/11


Empirical research on the law enforcement strategies used to prevent terrorism has increased since the September 11, 2001 terrorist attacks. Yet, few studies have examined how these preventative approaches vary based on terrorists’ ideological affiliations and across time. This study thus explores the similarities and differences in law enforcement investigatory strategies used to thwart global jihadi and far-right terrorist violence prior to and since the 9/11 terrorism events. Employing a convergent parallel mixed method research design, our study analyzes both quantitative and qualitative data on 86 terrorism enterprise investigations from the U.S. Extremist Crime Database (ECDB). The quantitative data analyses examine patterns relating to how investigations are initiated, the agencies involved, and the roles of human intelligence in foiling terrorist violence. Complementary qualitative case narratives are then used to explore in more detail the investigatory process for a subset of cases. We discuss several noteworthy findings that have implications for both law enforcement practitioners as well as future scholarly research.


Since 2001, homeland security efforts in the United States have understandably been oriented toward disrupting global and homegrown jihadists and preventing the next 9/11 terrorist attacks. After 9/11, the Federal Bureau of Investigation (FBI) made thwarting terrorist attacks its top priority and state, local, and tribal (SLT) law enforcement were asked to become active participants in the national counterterrorism mission. Nonetheless, it is invariably the terrorist attacks that come to fruition and are successfully executed which capture the attention of media and policymakers. Despite a dramatic increase in empirical terrorism studies published since 9/11, few scholarly studies highlight the characteristics of terrorism plots and almost no work explores what law enforcement do to foil them. Consequently, little is known about the general attributes of terrorist plots, such as the agencies involved and the strategies used, or about the nuanced investigatory processes encompassing how plots are initiated and unfold. Further, research has yet to explore how the nature of investigations may have changed over time, specifically since 9/11, and differ by the type of terrorists being investigated. In other words, how might investigations of jihadists since 9/11 compare to those of far-right terrorists who were increasingly active during the 1990s and have reemerged as a serious threat to the U.S.?

We address these questions by examining 86 violent terrorist plot investigations from the U.S. Extremist Crime Database (ECDB), an open-source project that contains systematically codified data as well as thousands of pages of raw information for each plot (Freilich, Chermak, Belli, Gruenewald, & Parkin, 2014). While interested in overall patterns of terrorism investigations, we also compare the similarities and differences in how law enforcement agencies foil terrorist plots involving far-right and global jihad terrorists before and after the 9/11 terrorist attacks. Employing a convergent parallel mixed-method design, we utilize quantitative and qualitative methods to explore the investigatory strategies used by law enforcement to thwart terrorist attacks in the U.S. Quantitative, descriptive analyses are conducted to uncover general patterns of plot investigations across time and terrorist ideology. We also conduct complementary qualitative analyses to develop a more comprehensive understanding of dynamic investigatory processes—including sequenced interactions between law enforcement, terrorists, and their situated environments —involved in foiled terrorist plots.

Background and prior research

Law enforcement practices were significantly impacted by the 9/11 terrorist attacks (Davis, Pollard, Ward, Wilson, Varda, Hansell, & Steinberg, 2010; Gruenewald, Klein, Chermak & Freilich, 2016), but little is known about if and how relevant changes have impacted the strategies used to foil terrorism plots. Key changes, for example, include the FBI altering its reactive, crime-fighting focus to make preventing terrorism its top priority (Bjelopera, 2013) while expanding domestic and international counterterrorism efforts. Other significant post 9/11 changes within the FBI include the hiring of a large number of agents and intelligence analysts, restructuring of the organization, revamping training strategies, and attempts to improve engagement with the intelligence cycle (Cumming & Masse, 2004). In addition to these organizational changes, revisions to the U.S. Attorney General Guidelines in 2002 and 2008 removed restrictions to provide the FBI with more discretion to proactively initiate long-term investigations on persons suspected of plotting terrorist acts against the U.S. (Berman, 2011). At the same time, the passage of the USA Patriot Act gave agents more power to conduct secretive searches, monitor modern forms of communication, and access third-party records to intercept terrorist plots (Bjelopera, 2013). Identifying sharing gaps across the nation’s fragmented law enforcement structure, policies and procedures were changed to significantly expand the role of SLT law enforcement agencies, fundamentally changing how information is shared both horizontally and vertically between agencies (Carter, Carter, & Chermak, 2013; Carter, Carter, Chermak, & McGarrell, 2017). In response, many SLT law enforcement agencies have since expanded their intelligence gathering practices, and there have been fundamental changes in the national, state, and local information sharing infrastructure.

American SLT law enforcement agencies remain concerned about affiliates of both far-right extremism and jihadism (Chermak, Freilich, & Simone, 2010; Freilich, Chermak, & Simone, 2009; Levitt, 2017). Findings from the U.S. Extremist Crime Database (ECDB) reveal that supporters of Al Qaeda and affiliated movements have committed over 50 homicide incidents that have claimed over 3,000 lives since 1990. Far-right terrorists have committed over 210 ideologically motivated homicide events claiming over 450 lives in this same period (Freilich et al., 2014). Strom et al. (2017), who studied terrorism plots foiled between 1995 and 2012, conclude that both jihadists and far-rightists accounted for the majority of actors planning to attack the U.S. and that each ideological movement engaged in a similar number of the identified plots.

Importantly, though, scholars have yet to investigate whether distinct investigatory strategies are utilized for intercepting terrorists who are driven by different ideologies. Extreme far-rightists and jihadists have attacked, or have planned to attack, a diverse list of targets using various strategies (Drake, 1998; Kaplan, 2012; Legault & Hendrickson, 2009; Lemanski & Wilson, 2016; Gruenewald et al., 2016). While some attacks are carried out by multiple offenders associated with formal groups, far-right and jihadi lone actor events are also of major concern and may be on the rise in the U.S. (Gruenewald, Chermak, & Freilich, 2013; Michael, 2012; Pantucci, 2013; Spaaij, 2010; Strom et. al, 2017). Law enforcement must be concerned about both international and homegrown threats, including "foreign fighters" who travel abroad and return to the U.S. better trained and more motivated for violence, including suicide attacks (Bergen, 2016; Freilich, Parkin, Gruenewald, & Chermak, 2017; Silber, 2012).

Prior relevant research

Though limited, there is some research examining terrorist plots in the U.S. that can provide a framework for the current study and highlight the importance of building upon what has already been discovered (Bjelopera & Randol, 2010; Brooks, 2011; Carafano, Bucci, & Zuckerman, 2007; Dahl, 2011; Difo, 2010; Gruenewald, et. al, 2016; Jackson & Frelinger, 2009; Jenkins, 2011; Klein, Gruenewald, & Smith, 2017; McCleskey, McCord, Leetz, & Markey, 2007; McNeil, Carafano, & Zucker, 2010; Mueller, 2016; Muslim Public Affairs Council, 2012; Oots, 1989; Sandler & Scott, 1987; Sharif, 1995, Silber, 2012; Strom, Hollywood, & Pope, 2017). One of the few studies that relies on empirical data and focuses on investigatory tactics is McCleskey et al. (2007) who completed eight case studies of attacks on passenger rail or commercial aviation facilities. They concluded that plots are most likely to be foiled during the pre-execution stage. The key factors associated with foiled plots included poor terrorist operation security, an observant public, effective law enforcement/security services, terrorist profile indicators, and law enforcement intelligence and information sharing. The researchers also found that public tips and leads played are an important part in these investigations.

Similarly, Dahl (2011) examined 176 terrorist plots against American targets that have occurred in the last 25 years. Dahl specifically explored whether human intelligence, interrogation, chance encounters with police, signals intelligence, overseas intelligence, other law enforcement actions, and public threats or announcements contributed to an attack being unsuccessful. He concluded that most terrorist acts fail because of law enforcement intervention, usually through some form of human intelligence, but he did not explore variations in strategies across ideological types.

Difo’s (2010; see also Hamm, 2007; Strom, Hollywood, & Pope, 2017) analysis of 32 thwarted terrorist attacks occurring since 9/11 also found that in most cases “traditional” policing techniques, such as actions taken by regular citizens and police surveillance, played an important role in foiling a terrorist plot. In over 20 percent of cases, proactive contributions from civilians helped to thwart plots. This report concluded that law enforcement efforts to prevent terrorism should develop “multi-layered strategies and resist overemphasizing individual counterterrorism methods or policies [and] continue to support local law enforcement in their efforts to develop community-derived intelligence and informants” (Difo, 2010, p. 2). Bolstering their conclusions, another study published by the Muslim Public Affairs Council (2012) found that almost 40 percent of Al Qaeda related plots in the U.S. were thwarted because of assistance provided by the Muslim American community.

Strom et al.’s (2017) more recent analysis of 150 Al Qaeda and far-right attempted and completed attacks found that most were foiled due to law enforcement’s investigative work or because of help from the general public. The use of information from perpetrators, suspicious activity reports, and intelligence analysis were also identified as initiating an investigation that lead to a foiled plot. The researchers also concluded that almost all of the plots identified needed significantly more investigative work once identified, but surprisingly initial reports were rarely able to be linked to other known terrorist operations. In most cases, there were no additional clues that were received in advance, and the plot was foiled in a reactionary manner (Strom et al., 2017). While this study helps us to begin to understand the types of investigative work contributing to foiled plots, it does not address how the results might vary across time or by terrorist ideology.

Despite clear evidence that law enforcement agencies play a critical role in keeping the nation safe (Dahl, 2011; Difo, 2010; Gruenewald et al., 2016; McCleskey et al., 2007; Strom et al., 2017), there has yet to be a comparative study of law enforcement’s investigatory strategies used to prevent far-right and jihadi terrorism plots before and after the 9/11 terrorist attacks. One explanation for this gap could be the unavailability of data as, until recently, there was no data source capable of simultaneously providing quantitative data on violent plots and rich qualitative accounts of investigatory processes. As a result, existing research has generally relied on theoretical or case study analyses, examined only a small sample of cases, only looked at post 9/11 cases, examined mostly Al Qaeda and ISIS plots while excluding similar far-right plots, and has tended to overlook investigative strategies (Mueller, 2016; Muslim Public Affairs Council, 2012). As such, the current study seeks to contribute to the literature on terrorism investigations by filling these gaps in research.

The current study

This mixed method study extends prior research by integrating quantitative and qualitative data to comparatively examine similarities and differences in investigatory strategies between terrorists’ ideological affiliations before and after the 9/11 terrorist attacks. We begin by exploring whether changes in the law enforcement and intelligence community’s mission and organizational structure following the attacks impacted investigations associated with foiled terrorism plots. On one hand, we might expect significant changes as the amount of resources devoted to new personnel, intelligence analysis, and training should lead to innovative investigative strategies. Some prior research indeed finds that the number of foiled terrorism plots has increased, and that law enforcement has been more successful at thwarting attacks since the 9/11 terrorist attacks, validating the expenditure of governmental resources (Muslim Public Affairs Council, 2012; Strom et al., 2017). However, terrorism was not ignored prior to the 9/11 terrorist attacks, and one of the best predictors of future behavior could be what has happened in the past. As law enforcement was expected to do more to effectively respond to terrorism, one would expect them to rely on proven strategies and techniques from their past investigations. That is, law enforcement might utilize investigatory strategies relied upon in the past while honing them to new terrorism environments.

We also examine whether investigatory strategies used to disrupt extreme far-right and jihadi plots are significantly different. We agree with Strom et al. (2017, p. 468) who suggest that, "learning from thwarted plots and unsuccessful attacks and including all ideologies and motivations can prove to be highly valuable in understanding and replicating what counterterrorism measures work best and how policies and resources can be used to collectively improve security." Past research indicates that, while terrorists are generally more likely to engage in planning activities and to commit preparatory crimes compared to traditional criminals, patterns of preparatory behaviors vary by type of terrorist group (Cothren, Smith, Roberts, Damphousse, 2008; Smith, Cothren, Roberts, & Damphousse, 2009). For example, domestic far-right terrorists are more mobile than international terrorists (including jihadist extremists) and tend to commit crimes farther from their homes. In contrast, international terrorists—including jihadists operating in the U.S.—live, plan, and commit their acts closer to the intended target than other types of terrorists. Far-rightists also tend to operate in rural areas, while far-leftists are more likely to carry out their activities in urban locations (Smith, 1994). By identifying patterns in how terrorists plan and carry out terrorist activities, prior research points to the possibility that law enforcement may use different strategies to respond.

Other research also reveals different patterns of terrorist activities by ideological affiliation. For instance, Chermak and Gruenewald (2015) found that jihadist extremists are significantly more likely to commit terrorist acts as lone wolves compared to far-rightists. In addition, Hamm (2007) finds that international jihad terrorists are statistically more likely to commit aircraft violations, motor vehicle crimes, violations of explosions, and some types of firearms violations. In contrast, domestic far-right terrorists are more likely to commit crimes including mail fraud, racketeering, robbery, burglary, and violations of destructive devices. He stresses that both international jihad groups and domestic far-right terrorists come into contact with SLT law enforcement in the normal course of criminal investigations. Hamm concludes that these “different crimes require different skills and opportunities and identifying these differences may take law enforcement a step closer to prevention” (p. 19; see also Clarke & Newman, 2006; Freilich & Newman, 2009; Freilich, Gruenewald & Mandala, 2018).

It is also possible that we will discover little variation in investigative strategies used for terrorists with differing ideological backgrounds. Successful investigations are likely to be contagious, such that strategies shown to successfully foil a particular terrorist plot will breed an expectation about what strategies work more generally. Moreover, some may argue that the targets of terrorists and the strategies needed to carry out terrorist acts are not substantially different. For example, the extreme far-right frequently targets racial, ethnic, and religious minorities, while anti-government extremists target government buildings and public officials (e.g., law enforcement officers). Supporters of jihadi groups, Al Qaeda and ISIS have also attacked both religious and other minorities (e.g., Jews and gays) and government interests, such as military bases or recruitment centers, as well as iconic civilian targets. Both terrorist types primarily target people rather than places, with guns being the weapon of choice to commit violent crimes, and suicide-attack strategies have been used to accomplish ideological objectives for far-rightists and jihadists (Chermak & Gruenewald, 2015; Freilich, Parkin, Gruenewald, & Chermak, 2017; Gruenewald, Klein, Chermak, & Freilich, 2016). Although jihadist perpetrators are somewhat more likely to be lone attackers, there are many examples of far-rightists who attack as loners as well (Gruenewald, Chermak, & Freilich, 2013). The point here is that while there may be some variations in the types of offenses and tactics used by far-rightists and jihadists, such differences might have little impact on law enforcement strategies.

In sum, by studying how the nature of investigations may have changed over time, specifically since 9/11, and differ by the type of terrorists being investigated, this study contributes to criminological knowledge of counterterrorism in several ways. First, we systematically document variations in investigatory strategies across time, which can provide future scholars and practitioners with critical insights into (a) which strategies have been utilized most often over the past 25 years, (b) those specific counterterrorism practices and investigatory tools that have been most effective, and (c) how terrorism investigations can be enhanced to more efficiently thwart future attacks. Second, by examining how the methods to fight terrorism might differ by ideological background, our study can also provide law enforcement with critical knowledge on whether specific investigatory strategies are equally effective in preventing terrorism with differing motivations as well as inform practitioners on whether and how vital counterterrorism resources can be tailored to specific terrorist environments and threats. In the following sections, we describe our research design and sources of data used to address these research aims.

Mixed method design

To understand how law enforcement responds to planned terrorist attacks perpetrated by jihadists and extreme far-rightists, and whether these investigation strategies vary across time, this study uses both qualitative and quantitative analytic strategies. The utilization of mixed method approaches to address research objectives has recently increased in the social sciences (Creswell & Plano Clark, 2011; Tashakkori & Teddlie, 2003), and in the field of criminal justice specifically (Maruna, 2010; Brent & Kraska, 2010; but see also research from Decker, 1996; Meithe & Drass, 1999; Weisburd et al., 2006). The key advantage of mixed method analysis lies in its pragmatic utility, as it provides researchers with the necessary methodological latitude to more comprehensively study social phenomena by simultaneously drawing on the strengths of qualitative and quantitative procedures (Campbell, Shaw, & Gregory, 2017; Creswell & Plano Clark, 2011). In essence, mixed method approaches can afford us the tools for understanding complex criminal justice processes more completely.

Our study employs a convergent parallel mixed methodology (Creswell, 2014; Creswell & Plano Clark; 2011), which allows for the triangulation of quantitative and qualitative data while placing the collection and analysis of all data types on equal footing. According to Creswell and Plano Clark (2011, p.77), this design is most appropriate for research objectives seeking to “… synthesize complimentary quantitative and qualitative results to develop a more complete understanding of a phenomenon…” under a single empirical study. Due to the multifaceted and dynamic nature of policing terrorist crimes in the U.S., we believe this design is the best means for providing a more comprehensive picture of the strategies used to successfully thwart acts of terrorism. Indeed, this approach not only allows us to make generalizations about common law enforcement practices but also to uncover the nuanced ways in which terrorist investigations materialize and end. In the remainder of this section, we describe our mixed method approach by discussing the data sources used, as well as our case inclusion criteria, and then explaining our quantitative coding and measures. We then describe our complimentary qualitative analytic procedures.


We use data from the U.S. Extremist Crime Database (ECDB), an open-source, relational database that houses event- and offender-level information on criminal activities of jihadi and far-right terrorists, along with the strategies law enforcement employ to investigate these crimes (Freilich et al., 2014). Sources of information originate from publicly available records, such as print and Internet news media accounts, advocacy group reports, scholarly publications, in addition to government reports, court documents, and correctional system reports. The database provides a unique opportunity for conducting a mixed method study because the diverse array of open-sources offers rich, detailed descriptions of terrorists’ criminal activities and law enforcement investigative responses from which quantitative variables can also be operationalized and measured. The EDCB has been shown to be a valid data source for studying violent and non-violent American terrorism and extremism (Chermak, Freilich, Parkin, & Lynch, 2012; Chermak, Freilich & Suttmoeller, 2013), including past studies that have used these data for quantitative (Chermak & Gruenewald, 2015; Gruenewald & Pridemore, 2012; Parkin & Freilich, 2015), qualitative (Freilich & Chermak, 2009; Freilich, Chermak & Caspi. 2009; Kelley & Gruenewald, 2015), and mixed method research (Gruenewald, Dooley, Suttmoeller, Chermak, & Freilich, 2015). For the current study, we analyze 86 law enforcement investigations into planned ideologically motivated violent incidents perpetrated by individuals who adhere to elements of jihadi1 (n=51) and far-right2 (n=35) extremist belief systems inside the U.S. between 1990 and 2014.3

Case inclusion criteria

The ECDB’s case identification process occurs in several stages (see Freilich et al., 2014; Parkin & Freilich, 2015). First, various open-source online newspaper articles, reports, and publications—such as the Southern Poverty Law Center’s (SPLC) Intelligence Report, Anti-Defamation League reports, the Global Terrorism Database (GTD), the FBI’s Terrorism in the United States annual reports, and academic publications—are used to identify ideologically motivated violent crimes. Such crimes include offenders officially charged for committing a homicide, attempted homicide, or plotting to carry out a violent crime4 between 1990 and 2014 in the U.S. Researchers then systematically apply important indicators of jihadi and far-right extremist ideologies to all terrorism incidents for inclusion in the database.5 Next, more than 30 open-source search engines and online databases are used to exhaustively collect all publicly available information on the characteristics of each crime, offender, victim, and government response. In the final stages, all open-source materials for each case are comprehensively reviewed to verify that incidents meet the ECDB’s inclusion criteria.

The unit of analysis for our study is the terrorism enterprise investigation. We use the term “enterprise investigation” loosely, defined in this context as a formal law enforcement inquiry into one or more planned ideologically motivated violent crimes targeting the U.S. and committed by one or more supporters of jihadi and far-right extremist ideologies. Several criteria must be satisfied for a case to be included in this study. In particular, the terrorism enterprise investigation must (1) involve one or more planned violent crimes that target a specific or general person or location inside the U.S.,6 (2) be a discrete scheme of interrelated criminal acts that work toward accomplishing a specific terrorist goal and involve the same individual or group of offenders, (3) lead to a law enforcement response in which criminal charges are brought, (4) only involve plots that are prevented through law enforcement actions,7 and (5) be committed between 1990 and 2014. For every terrorism enterprise investigation included in our study, we coded quantitative variables relating to law enforcement investigation practices and, in addition, constructed complimentary in-depth narratives on a subset of 13 select enterprise investigations to provide a more complete understanding of how federal, state, and local law enforcement investigate and prevent planned acts of terrorism in the U.S.

Quantitative coding and measures

Based on our review of the literature, and past evidence on how law enforcement disrupts and thwarts far-right and jihadi terrorist activities, we focus on several variables to capture how investigatory strategies are utilized by federal, state, and local (FSL) police. Our first set of measures relates to the temporal attributes of terrorism enterprise investigations. To capture variations in investigations across time, we dummy code investigations occurring pre- and post-September 11, 2001 as (1) post-9/11 investigations (2001-2014) and (0) pre-9/11 investigations (1990-2000). Also included is a variable for the investigation length, measured as the number of days between the first evidence of law enforcement engaging in investigation activities related to the prevented plot and the capture or arrest of the terrorists.8

The next group of variables captures the characteristics of how the investigation is initiated, or how the terrorists’ criminal activities are brought to the attention of FSL law enforcement. Our first variable measures whether the investigation involved reports or tips from the public that assisted in the investigation as (1) evidence of a public tip or (0) no evidence of a public tip. Second, we measure whether the unsuccessful plot investigation originated from FSL law enforcement activities into another, unrelated criminal case as (1) investigation originated from other unrelated case and (0) investigation did not originate from other unrelated case.

Also included are a set of variables capturing the role of federal, state, local and foreign law enforcement in leading to the detection and arrest of terrorist plotters. The first variable measures whether federal law enforcement or intelligence agencies were involved in the investigation as (1) evidence of one or more federal agencies or (0) no evidence of federal agencies. A second variable captures whether state or local law enforcement were involved in the investigation, coded as (1) evidence of one or more state/local agencies or (0) no evidence of state/local agencies.9 The third variable is a measure of whether foreign government or intelligence agencies assisted in the investigation, which is coded as (1) evidence of one or more foreign agencies or (0) no evidence of foreign agencies. Next is a variable that captures whether multiple FSL agencies partnered during the terrorism enterprise investigation, which is measured as (1) evidence of multiple agencies or (0) no evidence of multiple agencies.

The final group of variables encapsulates the specific investigative strategies used by FSL law enforcement for thwarting planned terrorism incidents. First, we capture whether the investigation involved one or more federal undercover agents or operatives as (1) use of federal undercover agent and (0) no use of federal undercover agent, in addition to whether the investigation employed one or more federal confidential informants, coded as (1) use of federal confidential informant and (0) no use of federal confidential informant. Third, we include a variable that measures whether one or more undercover state or local law enforcement officers were involved in the investigation as (1) use of state/local undercover agent and (0) no use of state/local undercover agent. The final variable captures whether one or more state or local law enforcement confidential informants were involved in the investigation, which is coded as (1) use of state/local confidential informant and (0) no use of confidential informant.

Qualitative analytic procedures

We aim to present a more complete understanding of the different aspects of law enforcement prevention and investigatory tactics. Thus, we complement our quantitative variables with in-depth qualitative case narratives on a subset of 13 terrorist enterprise investigations that are drawn from the 86 quantitative cases discussed previously. To select these narratives, we rely on a maximal variation sampling technique (Creswell & Plano Clark, 2011), which involves purposefully choosing enterprise investigations that represent a diverse array of situations and strategies used by law enforcement to foil planned attacks. These strategies include changes in investigatory responses across time, how investigations originate, the roles of FSL law enforcement, and the roles undercover agents and confidential informants play in intercepting violent acts of terrorism. Relying on maximal variation sampling offers many benefits over other purposive sampling strategies because it allows for sample representativeness as well as robust case diversity for investigating key theoretical comparisons (Teddlie & Yu, 2007). The construction of case narratives relied upon information in publicly available court records—such as criminal complaints and indictments—augmented by journalistic accounts and watch-group (e.g., SPLC, ADL) reports. Our narrative findings are intended to contextualize the nature of investigatory approaches, providing a temporal arranging of events whereby the similarities and differences between jihadi and far-right investigations are illustrated.


The presentation of our findings begins with a discussion of how the law enforcement investigation strategies compare across jihadi and far-right terrorists. Based on a series of bivariate statistical tests (Chi-square analysis), results from Table 1 suggest a number of noteworthy similarities and differences in law enforcement approaches to preventing terrorism. First, we find that investigations into far-right terrorist enterprises have remained relatively constant over the 25-year time period of our study. Yet, unsurprisingly, results suggest that investigations into jihadi terrorist activities are significantly more likely to occur after the 9/11 terrorist attacks, as over 96 percent of thwarted jihadi violence occurred since 2001, compared to 54 percent of prevented far-right attacks. Our bivariate findings indicate no statistical differences in the temporal length of the investigation between jihadi and far-right terrorist enterprises, with the majority of investigations lasting six months or less.

Table 1. Bivariate statistics for jihadi and far right extremist investigations


Jihadi extremist (n=51)

Far-right extremist (n=35)








Temporal attitudes






   Time period






Pre-9/11 investigations






   Post-9/11 investigations






Investigation length






   0-6 months






   6-12 months






   1 year or more






Investigation origins






   Public tip






   Other unrelated case





Federal, state, local law enforcement






   1 or more federal agency involved






   1 or more state/local agency involved





   1 or more foreign agency involved





   Multiple agencies involved






Role of human intelligence





   Use of federal undercover agent






   Use of federal confidential informant






   Use of state/local undercover officer






   Use of state/local confidential informant






Note: *p ≤ .05. **p ≤ .01. ***p ≤ .001. NS=Not Significant. Fisher’s exact test was used for cell sizes less than 5.

In contrast, the findings from Table 1 show significant differences in terms of how investigations are initiated. We find that tips from the public are proportionately more likely to launch investigations into far-right activities than jihadi crimes. Evidence suggests that information from the public preempted just over 71 percent of foiled far-right plots compared to nearly 36 percent of thwarted jihadi attacks. Additionally, we find that jihadi investigations are proportionately more likely to originate from other unrelated criminal cases relative to far-right enterprise investigations. On average, nearly 47 percent of jihadi investigations stem from law enforcement inquiries into unrelated crimes compared to 20 percent of far-right investigations.

Our study is also interested in the role that federal, state, local and foreign law enforcement plays in uncovering and preventing planned terrorist attacks. Not surprisingly, we find that federal law enforcement, usually the FBI, is involved in investigating over 90 percent of all planned jihadi and far-right violence incidents. State and local law enforcement are involved in significantly fewer jihadi terrorism investigations compared to investigations into far-right terrorist crimes. In fact, around 51 percent of investigations into jihadi plots have state or local police involvement, while over 76 percent of far-right investigations include state or local police participation. We also find investigatory assistance from foreign law enforcement to be relatively rare across movement types. Less than 22 percent of jihadi investigations involved assistance from foreign agencies and, expectantly, no far-right investigations received help foreign police or intelligence organizations. Regarding across agency partnerships, findings suggest most terrorist enterprise investigations involve assistance from multiple federal, state, local, or foreign agencies.

A final key component of anti-terrorism investigations of interest is the role of human intelligence, namely the use of undercover agents (UAs) and confidential informants (CIs) to prevent terrorist attacks. Interestingly, the results from Table 1 indicate no statistical differences between jihadi and far-right investigations. We find that the use of federal UAs and CIs, usually handled by the FBI, is a common investigatory practice across movement types. More specifically, findings reveal that over 40 percent of jihadi investigations rely on federal undercover agents, as do approximately 37 percent of far-right investigations. In addition, we find that even more investigations involved the use of confidential informants, specifically over 53 percent of investigations into jihadi crimes and more than 67 percent of far-right investigations. Lastly, state or local law enforcement use of UAs and CIs is a relatively uncommon practice. State or local UAs and CIs were involved in 12 percent and over 8 percent of jihadi investigations, respectively, while far-right investigations employed UAs in over 17 percent of investigations and CIs in nearly 3 percent of cases.

Qualitative case narratives

To complement these findings, we present case narratives on 13 enterprise investigations. Informed by the quantitative results, the presentation of qualitative findings is organized into several thematic foci, which include the (a) investigative strategies used to prevent attacks over time, (b) ways in which enterprise investigations originate, and (c) the utilization of federal, state, local, and foreign law enforcement in thwarting attacks. We note that because the roles of undercover agents and confidential informants are well represented throughout the case narratives, we choose not to include a separate section detailing the contribution of human intelligence for preventing terrorism. The aim of our qualitative analysis is not to present an exhaustive collection of all possible investigative approaches, but rather to contextualize the investigation process by demonstrating the similarities and differences in key counterterrorism methods used across time and terrorist movements.

Variations Pre- and Post-9/11

The first group of cases illustrates the idiosyncrasies in law enforcement responses to terrorism across time. We begin with a discussion of pre-9/11 investigations of which we then identify similarities and differences in post-9/11 investigatory strategies. For each time period, we also provide case narratives on the foiled plots of both jihadi and far-right terrorists to demonstrate investigatory discrepancies by ideological type. Our first case below represents a pre-9/11 thwarted jihadi attack that arose situationally from a chance encounter with police.

On December 14, 1999, U.S. Customs and Border Agents arrested a jihadist plotting to bomb the Los Angeles International Airport (LAX). The suspect entered the United States at Port Angeles, Washington after crossing the U.S. border from Victoria, British Columbia. Prior to the suspect’s entry into the U.S., pre-clearance Immigration and Naturalization Service (INS) agents initially searched the suspect’s vehicle but found no illicit items, so he was permitted to board the ferry for passage into America. Upon entry into Port Angeles, a U.S. customs agent grew concerned with the suspect’s hesitation and general nervousness to answering routine questions. The agent then ordered a search of the suspect’s vehicle, which revealed explosives hidden inside the trunk’s spare tire well. The suspect was later arrested after attempting to flee the scene, and an ensuing FBI inquiry retrospectively uncovered that he was an al Qaeda affiliate who had been planning, with others, the LAX bombing since the summer of 1999.

This pre-9/11 investigation reveals how the intuition of a trained officer during routine screening procedures thwarted a terrorist attack in the U.S. This case also showcases the importance of the reactive side of law enforcement whereby investigators rely on situational evidence and opportunity, as well as police vigilance, to uncover and prevent forthcoming attacks. However, not all pre-9/11 investigations are reactionary in nature. In fact, the only other prevented jihadi incident during this time period resulted instead from undercover work conducted by the FBI and New York Police Department, which preempted the terrorists’ 1997 plot to attack the New York Subway system. Likewise, since at least the early 1990s, investigators have utilized proactive strategies to counter domestic far-right violence, as the following narrative illustrates.

In late July 1994, federal agents with the Bureau of Alcohol, Tobacco, Firearms, and Explosives agency (ATF), along with the Virginia State Police and Pulaski Police Department, intercepted a plot by a far-right extremist group (the Blue Ridge Hunt Club) to wage war against the American government. The investigation began when an associate of the Blue Ridge Hunt Club’s leader became concerned with his increasingly radical anti-government rhetoric and illegal manufacturing of weapons. The alarmed citizen first informed local police of these activities and was later linked with agents of the ATF, who ultimately enrolled him as a confidential informant (CI). During his time as a CI, he recorded the group’s numerous privately held meetings, as well as facilitated the group’s buying and selling of illegal firearms as part of their overall terrorist plot. As the investigation progressed, the CI and ATF uncovered the suspects’ aspirations to blow up bridges, airports, radio stations, telephone relay stations, and fuel storage lines, in addition to their openness to killing political figures, police officers, and U.S. troops. With this information and the evidence linking the group to illegal firearms transactions, ATF agents and local police detained the suspects in late July 1994 on various weapons charges, preventing their plans from ever materializing.

In this case, key strategies employed include the use of human intelligence and the vertical sharing of information between agencies. Also, a striking feature of this and other pre-9/11 far-right investigations is the prominent role of the ATF in subverting terrorist violence. Our data suggest the ATF is often the lead agency tasked with investigating planned far-right crimes during the 1990s; however, since the 9/11 terrorist attacks their role has become mostly secondary, relegated to providing operational and investigatory assistance to the FBI and other agencies.

The next two case narratives represent post-9/11 changes in investigatory practices. For the most part, we find congruency across time in that the use of human intelligence, law enforcement partners, and information sharing networks are still mainstays of counterterrorism investigations. However, some more recent strategies for preventing terrorist violence also seem to emulate the post-9/11 organizational and legislative changes (e.g., the 2002 and 2008 U.S. Attorney General Guidelines, the U.S.A. Patriot Act) that afford law enforcement greater discretion in the monitoring of modern types of communication. The following case narrative, for example, demonstrates how investigators have come to rely upon online surveillance for the initial gathering of vital information on suspected jihadi terrorists.

The FBI was first alerted to the lone suspect in 2009 after he communicated in a FBI monitored online forum his intention to commit violent jihad inside the U.S. After several months of conversations with two undercover online FBI agents (UAs), the suspect continuously expressed his interest in conducting terrorist attacks on behalf of al Qaeda. Perceiving the suspect to be a legitimate threat, the FBI introduced him to a third UA posing as an operational soldier in an al Qaeda sleeper cell. The suspect and third UA soon began meeting in person at a Dallas hotel, during which time specific plans for attacking a financial target emerged. Upon conducting online and physical surveillance of multiple buildings with and without the UA present, the suspect settled on a high-rise bank building in Dallas, Texas. The plan was to remotely detonate a vehicle-borne improvised explosive device (VBIED) as it sat in a parking garage beneath the building. Unbeknownst to the suspect, the VBIED was inert, as FBI agents had rendered it inoperable. On September 24, 2009, the suspect, under FBI surveillance, parked the inert VBIED inside the building’s underground garage and subsequently got into the UA’s awaiting vehicle. The UA and suspect then drove to a location a safe distance away whereby the suspect attempted to remotely detonate the fake car bomb using a cellular phone. As he dialed the cell number, FBI JTTF agents immediately swarmed the suspect and placed him under arrest.

Similarly, the subsequent probe of a planned far-right attack also stemmed from secret law enforcement reconnaissance of terrorists’ online activity.

On January 23, 2014, the FBI began monitoring online chat discussions among a group of far-right extremists who expressed interest in carrying out attacks in the

U.S. Two FBI JTTF confidential informants (CIs) participated in the suspects’ encrypted online conversations, as well as met in person with members of the group to report on their violent intentions. FBI JTTF agents also conducted surveillance of one suspect's home, in addition to employing mobile surveillance teams to further observe the group's criminal activities. During the investigation, the FBI cooperated with multiple local police agencies that provided operational and investigative assistance necessary to build a case against the suspects.10 Through these efforts, the investigators discovered that the group was planning to conduct a bombing campaign against power grids, water treatment facilities, local police vehicles, and other federal and local government targets in an effort to incite war against the U.S. government. It was eventually discovered that the suspects sought to obtain pipe bombs and thermite devices in order to execute their plans, and they ultimately came to rely on the CI to attain these items. On February 15, 2014, the CI provided the suspects with the requested weapons, which were rendered inert by the FBI. Upon transferring the inert explosives to the suspects, FBI agents placed the group under arrest with assistance from local law enforcement.

While the clandestine monitoring of terrorists’ Internet communications is a unique feature of post-9/11 investigations, we find homogeneity in how strategies are used across ideological movements. Additionally, we find much overall stability in counterterrorism strategies across time for all types of investigations. As our case narratives show, and in corroboration with our quantitative findings, over the past 25 years or so jihadi and far-right plot investigations have mostly relied upon human intelligence, surveillance, multi-agency partnerships, and to some extent, routine police activities to subvert planned terrorist crimes.

Investigation origins

In addition to identifying and monitoring suspected terrorists online, counterterrorism investigations originate from a variety of other sources, including tips from the public and other ongoing criminal investigations. In this section, we provide case narratives detailing some of the ways in which law enforcement become alerted to planned acts of violent terrorism. For example, the case below highlights the important contribution citizens play in uncovering jihadi terrorists’ suspicious activities.

On July 27, 2011, local police arrested a jihadi terrorist in Killeen, Texas, thwarting his plan to attack the Fort Hood military base. The arrest stemmed from a Texas gun store employee's tip that the suspect had bought an unusually large quantity of smokeless powder, multiple boxes of shotgun ammunition, and a magazine for a handgun. The employee grew suspicious of the suspect for his generally aloof behavior, as well as his ostensibly little background knowledge of firearms and the proper uses for smokeless gunpowder. After the suspect departed the store in a taxicab, the employee recorded the cab's license plate number and alerted the Killeen police department. Police later tracked the suspect to a hotel room and arrested him on an outstanding warrant. Upon searching his possessions, police found multiple weapons, bomb-making supplies and manuals, and jihadi materials. After sharing this information with the FBI, a federal investigation was initiated, and agents confirmed that the materials found could be used to manufacture a destructive device. FBI agents then interviewed the suspect, securing a confession that he planned to use a bomb to attack the Fort Hood military base, and subsequently charged him with possession of a destructive device.

Similarly, attentive private sector employees have also been involved in preempting jihadi violence. Consider the case below, for example.

On February 1, 2011, the FBI received a tip from employees associated with a biological supply company about a suspicious purchase of the chemical phenol, which along with a variety of legitimate uses, can be used to make the trinitrophenol (T.N.P) explosive. FBI agents began investigating the purchaser, conducting a physical search of his apartment in secret and launching an electronic surveillance operation of his online activities. The ensuing investigation retrospectively uncovered that the suspect had posted extremist messages online, conducted research on potential targets and explosives, acquired materials for constructing an explosive chemical device, and was planning to conduct terrorist attacks inside the U.S. Due to this information, the FBI arrested the suspect on February 23, 2011, for attempting to use a weapon of mass destruction.

Indeed, tips from the general citizenry, such as store clerks, acquaintances, and other concerned individuals, are a prevalent theme across terrorist movement types. One observable difference between jihadi and far-right cases, however, is that the latter often involves public tipsters who are at least loosely associated with the extremist movement itself. Though not entirely absent in jihadi cases, we observe more far-right cases in which other extremist affiliates, independent of initial law enforcement involvement, informed on their comrades. Take the following case narrative, for example.

In March 1998, a concerned citizen approached the FBI with information regarding an individual who was affiliated with the extremist group known as the Republic of Texas (ROT). The ROT member had requested assistance from the citizen, who was a computer consultant, with the typing of ROT legal documents along with other secretarial matters. The citizen agreed to help but became increasingly troubled by the anti-government diatribes of the group, in addition to their requests for running illegal criminal warrant checks against ROT members. The citizen approached the FBI with this information, but they were reluctant to open an official investigation based on the available evidence. Between March and late April 1998, the citizen attended private ROT meetings, during which time the group expressed interest in conducting a biological attack against government targets. Again, the citizen relayed this information to the FBI, but agents maintained that there was insufficient evidence to warrant an investigation, though they did direct him to acquire more information about the ROT's proposed plans. After accepting an official position within the ROT a month later, the citizen obtained a written letter from other ROT members detailing a proposed biological attack as well as a declaration of war, which he provided to the FBI. Based on this information, the FBI subsequently opened an official investigation and employed the citizen to serve as a confidential informant (CI). The CI and FBI then began gathering evidence on the suspects' planned violence. As the progression of terrorist activity reached the point of attempting to manufacture a fatal biological device, FBI agents arrested the ROT members on July 1, 1998, for conspiracy to use a weapon of mass destruction, ending their proposed plan for war against the federal government.

Along with an observant public, we find that investigations are initiated through police work into other crimes. These can include receiving information and intelligence from foreign law enforcement partners or the military, stumbling across evidence in raids and searches of other terrorist suspects, and convincing already captured terrorist suspects to inform on their associates. The following case illustrates these latter circumstances.

The FBI was first notified of the jihadi suspect’s planned terrorist attack against a Columbus, Ohio shopping mall in the spring of 2003. At the time, an al Qaeda affiliate was under FBI scrutiny for providing material support to terrorists, a charge for which he was later convicted. To reduce his sentence length, the supporter decided to cooperate with the FBI, providing information on al Qaeda’s intended terrorist activities inside the U.S. He advised the FBI that one of his former al Qaeda contacts had been preparing for an assault against an Ohio shopping mall since 2002. The FBI’s Joint Terrorism Task Force (JTTF) immediately launched an investigation into the suspected attacker, learning that he had a history of traveling overseas to train with jihadi militants, as well had plans to conduct an attack inside the U.S., corroborating the informer’s tip. Fearing the proposed plot was imminent, on November 28, 2003 JTTF investigators collaborated with Immigration and Customs Enforcement (ICE) agents to arrest the suspect on immigration and material support to terrorism charges, foiling the intended attack.

Additionally, evidence indicates that terrorist plots can be foiled through more routine chance encounters with police. The far-right terrorism case below is one example.

In November 2002, Los Angeles County Sheriff’s officers arrested a far-right suspect after investigating him for an unrelated string of car thefts. Upon searching the suspect’s stolen truck, police discovered two pipe bombs in the back and consequently opened an additional investigation in partnership with the ATF. Local and federal investigators later found a cache of weapons and explosives stockpiled in the suspects’ storage facility, in addition to jet fuel, false identification documents, anti-government literature, and written plans for attacks against unnamed targets. Law enforcement later charged the suspect for possession of an unregistered destructive device.

Interestingly, some terrorist plots are foiled through a combination of an observant public and chance encounters with police, as indicated below.

Two far-right extremists were arrested on April 19, 2001, for attempting to pass a counterfeit $20 bill at an East Boston doughnut shop. When the store employee refused to accept the fake currency, they showed it to a local Boston police officer who happened to also be waiting in line. The officer immediately placed the suspects under arrest, and ensuing searches of the pair’s apartment revealed plans and materials to conduct a terrorist attack. Federal investigators, including the FBI, ATF, and Secret Service, soon became involved in the investigation and discovered that one suspect was affiliated with the White supremacist group called the White Order of Thule, and linked him to a Boston area bank robbery. Investigators determined that the pair of suspects had plans to conduct a series of attacks in order to instigate a race war.

Despite the disparity in investigation origins illustrated above, once the terrorists' planned violence is unveiled to law enforcement standard investigatory practices tend to take over. Investigators often come to rely on ordinary police work to build evidence against the suspects, usually by employing human intelligence sources or retrospectively piecing together information on suspected terrorists' past activities, which mirrors our quantitative results. Further, law enforcement will often collaborate to more effectively and efficiently collect vital information.

The next section provides more detail on the contributions of federal, state, local, and foreign law enforcement partners.

Role of federal, state, local, and foreign agencies

As already discussed, federal law enforcement, usually the FBI, tend to be involved in the overwhelming majority of terrorist enterprise investigations. However, it is rare for federal agencies to work alone. Typically, they elicit investigative assistance from other federal, state or local, or foreign partners. Although frequently unspecified in source materials, operational aid can include assisting with arrest warrants, conducting searches, or sharing relevant background information throughout the course of the investigation. Other times, local law enforcement partners uncover a potential plot and subsequently turn the investigation over to the FBI, as the case below demonstrates.

The investigation of the suspected jihadist began on August 15, 2007, when he violated his parole agreement relating to prior aggravated assault and robbery charges. Upon searching the suspect's vehicle, parole officers discovered written material related to violent jihadism, including references to a letter that was penned to a convicted Taliban militant, and shared this information with the FBI’s joint terrorism task force (JTTF). After the suspect was discharged from prison for a parole violation, JTTF agents, including a federally deputized Decatur police officer, interviewed him about the letter, later releasing him but not after opening a formal investigation. The JTTF agents and officer subsequently deployed a confidential informant (CI) who recorded conversations and meetings with the suspect over the next several months. As the suspect began expressing interest in receiving training to fight against Israel in the Gaza Strip, he was introduced to an undercover FBI agent (UA) posing as a low-level al Qaeda operative. After establishing an acquaintanceship, the suspect and UA began planning an attack inside the U.S. instead, which included the selection of targets and means of executing the incident. The suspect eventually settled on using a vehicle-borne improvised explosive device (VBIED) to blow up a Springfield, Illinois federal building. The FBI supplied the suspect with an inoperable VBIED, and on September 23, 2009, he made the final preparations for detonation. Upon parking the fake VBIED in front of the target, the suspect drove away in the UAs vehicle to a safe distance, dialed the remote cellular phone detonator, and was then arrested by JTTF personnel.

In addition to receiving support from local partners, a unique feature of jihadi investigations is that federal agencies often take advantage of overseas information sharing networks. In most cases, foreign law enforcement organizations, as well as U.S. agencies operating in foreign countries (e.g., CIA, military), provide intelligence on individuals suspected of engaging in overseas terrorist activities. As these suspects attempt to enter the U.S., investigators are then tipped off, and a counterterrorism investigation usually ensues.11 Contrastingly, federal probes into far-right violence tend to involve information sharing with state or local police, as illustrated by the following case narrative.

Members of the FBI’s JTTF, along with the Tremonton Police Department, began investigating a lone suspect in February 2014 after receiving a public tip that he intended to blow up a local Bible study group. With the aid of a confidential informant (CI) developed by Tremonton Police, investigators discovered that he was an anti-government extremist who, instead of planning to assault the church had plans to attack local police targets in an effort to spark an anti-government revolution. Over the next four or so months federal and local police built their case against the suspect, utilizing CIs and an undercover FBI agent (UA) who reported on his criminal activities. During the undercover operation, the CI met with the suspect to discuss explosives, and eventually purchased a USB drive from him with instructions on manufacturing drugs, explosives, and booby traps. The CI then introduced the suspect to the UA, who was posing as a member of an anti-government militia group looking to recruit someone who could build bombs for the group. Believing he was the right fit for the role, the suspect began meeting with the UA to discuss his new bomb-making responsibilities. Later, the CI informed Tremonton police that the suspect had built an explosive device. Provided with this information, the CI and UA then set up a meeting with the suspect on July 10, 2014, at a local Tremonton restaurant. During the meeting, the suspect sold the UA a notebook with schematics on how to manufacture explosives and was subsequently arrested by investigating officers, ending his planned violence plot.

In this case, local officers play a more substantial role in conducting the daily operations of the investigation alongside agents with the FBI. However, occasionally local law enforcement will independently conduct counterterrorism investigations. We find evidence that in rare instances local police will investigate jihadi or far-right plots without the aid of the FBI or other police departments. The following far-right case is an example of this anomaly.

In August 2013, the Las Vegas Police Department (LVPD) arrested two sovereign citizens plotting to abduct and kill LVPD officers. The investigation was a culmination of several months of undercover work whereby a LVPD officer secretly collected evidence on the pair’s violent intentions. The suspects first came to the LVPD’s attention after investigators linked one of them to a series of crimes. When police made contact with the suspect, he voiced his sovereign citizen beliefs, maintaining that he was not subject to the laws of the U.S. To investigate further, LVPD officers then inserted an undercover officer who attended numerous meetings and training sessions with the suspects. During the operation, the officer discovered that the pair had plans to kidnap and murder police officers as means of gaining momentum for their sovereign citizen movement. As part of the plot, the suspects bought a vacant house and converted it into an improvised jail, which they intended to use as a holding cell for the abducted officers. With this evidence, LVPD police arrested the pair at a warehouse in August 2013, charging them with conspiracy to commit murder and kidnapping.

When considered together, the above case narratives illustrate that although federal organizations lead counterterrorism investigations, there is substantial heterogeneity in the contributions of state, local, and foreign police agencies in foiling planned attacks. However, a stable characteristic across cases is law enforcement’s reliance upon intelligence sharing networks, in addition to confidential informants and undercover agents, to detect and thwart planned acts of violence. Indeed, and as demonstrated throughout the qualitative findings, the utilization of human intelligence is a common proactive policing strategy that varies little by time or terrorist movement, and in many ways represents the modal investigatory response to terrorist violence.

Discussion and conclusion

This study contributes to the small but growing literature on investigatory strategies employed by law enforcement to foil terrorist plots in the U.S. before and after 9/11, and to examine how strategies might vary across terrorists’ ideological backgrounds. To begin, we found several consistencies across jihadi and far-right plots. In particular, law enforcement tends to rely on tested investigatory strategies that are most familiar to them, including a combination of reactive and proactive responses to terrorism regardless of terrorists' ideological orientation. Supporting prior research (Dahl, 2011), we found that terrorism investigations were generally led by federal law enforcement, usually the FBI, and relied heavily on human intelligence sources and surveillance to thwart terrorism regardless of time period or ideology of terrorists. The FBI did not usually work alone when intervening in terrorist plots but instead partnered with other agencies.

By integrating qualitative case narratives into our analysis, our findings helped illuminate the processes by which law enforcement identify possible plots and gather and share information during investigations of both far-right and jihadi terrorists. For instance, narratives revealed the increasingly important role of the Internet in identifying radicalized persons who may have an interest in carrying out an attack. Since 9/11, the FBI has used online forums and social media to lure jihadists and far-rightists further into sophisticated plots before arresting them. It appears that post-9/11 counterterrorism legislation (e.g., USA Patriot Act and 2002 and 2008 Attorney General guidelines) may have broadened law enforcement’s investigatory scope, enabling them to net would-be terrorist attackers. However, findings from this study suggest that although law enforcement has increasingly utilized the Internet as a tool in thwarting and investigating terrorism, substantive counterterrorism practices (e.g., the utilization of human intelligence and the mixture of reactive and proactive strategies) have remained relatively the same. As noted previously, the modal investigatory response to terrorism in the U.S. over the past 25 years involves federally-led investigations that stem from public tips and information, and intelligence gathered from confidential informants and undercover agents. Thus, it is possible that our findings here are just an artifact of advancements in 21st-century online technology, rather than a significant alteration to time-tested counterterrorism methods. As the Internet and social media have become more prominent in American society, it is plausible that law enforcement has simply integrated online intelligence gathering opportunities with more traditional proactive policing strategies to arrest would-be terrorists.12

While the overall consistencies observed in our qualitative and quantitative findings are generally supportive of much past evidence on patterns of counterterrorism investigations (Dahl, 2011; Difo, 2010; Strom, et al., 2017), we also observed several notable differences in investigatory strategies across terrorist ideologies, such as in how investigations are initiated. In particular, case narratives suggested that persons close to far-right plotters tip off police, while this is less likely for jihadi plotters. These differences may have unique policy implications for investigators that are dependent upon terrorist ideology. Local law enforcement should continue fostering trust and keeping open lines of communication with individuals and groups on the extreme far-right. As most far-right extremists have no interest in committing acts of terrorism, they can serve as a key line of defense against the nefarious plans of their more violent confederates.

Our qualitative analysis revealed that jihadi plots involving public tips are usually not reported by confederates, but rather concerned citizens and private sector employees. This finding lends support to the utility of public awareness campaigns, such as “if you see something, say something,” as well as the advantages of building trust between the police and community-based business partners (Clarke & Newman, 2006). Perhaps even more important though is fostering healthy relationships with members of the Muslim American community, as it is they who may be in positions to see or hear something and notify law enforcement. Though not a leading factor in detecting terrorist plots in the current study, past research findings indicate that Muslim Americans are key contributors to reporting suspected terrorist activity (Muslim Public Affairs Council, 2012; see also Clarke & Newman, 2006). It remains critical to preventing future terrorism that law enforcement be viewed as allies to such communities.

Relatedly, we found that jihadi investigations are significantly less likely to involve local law enforcement partners than far-right investigations. This could be interpreted as federal investigators underutilizing their state and local partners in jihadi plot investigations. Involving local law enforcement in investigations in the future could help to set a precedent for continued inter-agency cooperation and the two-way, vertical sharing of intelligence. In fact, local law enforcement may be in the best position to cultivate relationships with American Muslims, as well as other community members and business partners. As our case narratives illustrated, local police were vital in relaying tips from the public to federal agencies, and in developing confidential informants, efforts which ultimately led to the prevention of several far-right plots. Investigations into suspected jihadi activity would do well to also incorporate such investigatory strategies.

It is worth reiterating that jihadi plots are less likely to be initiated by information from members of the public than far-right plots. Instead, jihadi plots are much more likely to be uncovered during the course of an unrelated jihadi investigation. Such discoveries have usually occurred after convicted jihadists were transformed into confidential informants for the FBI, though new queries arose out of ongoing investigations under other circumstances as well. Again, what these findings suggest more generally is that while law enforcement rely on traditional investigatory strategies and good police work to thwart terrorist plots, the specific investigatory tools believed to be most effective depend on the type of terrorist suspect.

Limitations and directions for future research

Of course, our findings and implications for law enforcement practices should be considered in light of the limitations of our study. Specifically, despite the advantages of our mixed method design, our research relied solely on open-source data (e.g., court documents, media reports). As such, we were unable to fully explicate the process of sharing intelligence between federal, state, local, and foreign law enforcement partners. Case studies based on information from official investigations would undoubtedly help fill the gaps in what is known about investigatory processes. A critical avenue for future research is to perhaps rely on interviews or ethnographic observations to provide even richer descriptions of inter-agency collaborations and the transformation of information into intelligence within the context of a terrorism investigation. Doing so would provide further insights into (a) those specific policing practices that are employed most often and most successfully, and (b) why and how law enforcement utilizes certain strategies to uncover and thwart terrorist threats across time.

Moreover, we limited our mixed-method analyses to terrorist plots that were foiled by police in advance, excluding investigations into completed acts of terrorism and plots that were attempted but failed due to terrorists' error. Accordingly, our findings provide little information on how investigatory successes relate to the ostensible shortfalls that law enforcement may experience in stopping terrorist attacks. Additional research should work to address this limitation to provide a more adequate understanding of the best practices for preventing jihadi and far-right terrorism.

Another limitation is that our study did not address issues relating to entrapment by federal law enforcement or wrongful conviction cases. Critics of preemptive approaches to countering terrorism have often accused the government of inventing terrorist plots and ensnaring individuals who provide no serious danger to the public. One study of post-9/11 terrorism prosecutions estimated that only about nine percent of foiled jihadi plots represent “authentic” terrorist threats (Norris & Grol-Prokopczyk, 2015). As our study mostly relied on mainstream media, criminal justice, and other government-related source materials, our case narratives under-represent these issues. Future work is needed to disentangle the law enforcement strategies used to disrupt legitimate terrorist plots from illegitimate ones and explore how these approaches vary by terrorists' ideological backgrounds and across time.13

Lastly, our findings are not necessarily generalizable to other forms of terrorist plots, such as non-violent terrorism and eco-terrorism, or the plot investigations occurring in other settings (e.g., Canada, Europe). Future research employing a similar mixed method approach can expand upon the findings of the current study by comparatively examining other types of terrorism occurring in other settings.

This study explored the similarities and differences in law enforcement investigatory strategies used to foil jihadi and far-right terrorism before and after the 9/11 terrorist attacks. Using a mixed method research approach, we uncovered important variations in key aspects of terrorist plots, including the role technology played, how investigations are initiated, and the contributions of state and local police in foiling plots across time and terrorists’ ideological affiliations. Importantly, though, we also found that once suspected terrorist activity is uncovered, law enforcement tends to rely on more traditional reactive and proactive policing strategies—namely the utilization of human intelligence, surveillance, and the retrospective gathering of evidence—to build cases against suspects and prevent acts of terrorism. Evidence from both quantitative findings and complimentary qualitative case narratives contributes to a more comprehensive understanding of the modal law enforcement responses to terrorism over the past 25 years. On this point, it is our hope that this research informs law enforcement strategies for preventing the nation’s two top terrorist threats, as well as future scholarship on the counterterrorism investigatory process. In the end, it is through partnerships between the academic community and law enforcement that promising evidence-based policing practices can be used to better subvert future terrorist threats and promote public safety. With the recent rise of the Islamic State (ISIS) and continued threats posed by American far-right terrorists, understanding how law enforcement can best protect communities against such threats is an increasingly important endeavor.


Bergen, P. (2016). United States of jihad: Investigating America’s homegrown terrorists. New York City: Crown Publishers.

Berman, E. (2011). Domestic intelligence: New powers, new risks. Brennan Center for Justice at New York University School of Law.

Bjelopera, J. (2013). The Federal Bureau of Investigation and terrorism investigations. Washington, D.C.: Congressional Research Service.

Bjelopera, J. & Randol, M.A. (2010). American jihadist terrorism: Combating a complex threat.Washington, D.C.: Congressional Research Service.

Brent, J. J., & Kraska, P. B. (2010). Moving beyond our methodological default: A case for mixed methods. Journal of Criminal Justice Education, 21(4), 412-430.

Brooks, R.A. (2011). Muslim ‘homegrown’ terrorism in the United States: How serious is the threat? International Security, 36(2), 7-47.

Campbell, R., Shaw, J., & Gregory, K.A. (2017). Giving voice—And the numbers, too: Mixed methods research in community psychology. In M.A. Bond, I. Serrano-Garcia, C.B. Keys, & M. Shinn (Eds.), APA handbook of community psychology: Methods for community research and action for diverse groups and issues, Vol. 2, (pp. 139-153). Washington, DC: American Psychological Association.

Carafano, J.J., Bucci, S., & Zuckerman, J. (2007). Fifty terror plots foiled since 9/11: The homegrown threat and the long war on terrorism. Washington, D.C: The Heritage Foundation.

Carter, J., Carter, D., & Chermak, S. (2013). Law enforcement intelligence. Law Enforcement Executive Forum, 13(2), 1-18.

Carter, J., Carter, D., Chermak, S. & McGarrell, E. (2017). Law enforcement fusion centers: Cultivating an information sharing environment while safeguarding privacy. Journal of Police and Criminal Psychology, 32(1), 11-27.

Chermak, S. M., Freilich, J. D., Parkin, W. S., & Lynch, J. P. (2012). American terrorism and extremist crime data sources and selectivity bias: An investigation focusing on homicide events committed by far-right extremists. Journal of Quantitative Criminology, 28(1), 191-218.

Chermak, S., Freilich, J.D., & Simone, J., Jr. (2010). Surveying American state police agencies about lone wolves, far-right criminality, and far-right and Islamic jihadist criminal collaboration. Studies in Conflict & Terrorism, 33, 1-23.

Chermak, S., Freilich, J., & Suttmoeller, M. (2013). The organizational dynamics of far-right hate groups in the United States: Comparing violent to non-violent organizations. Studies in Conflict and Terrorism, 36(3), 193-218.

Chermak, S. & Gruenewald, J. (2015). Laying the foundation for the criminological examination of right-wing, left-wing, and al Qaeda inspired extremism in the United States. Terrorism & Political Violence, 27(1), 133-159.

Clarke, R. V. G., & Newman, G. R. (2006). Outsmarting the terrorists. Westport, Conn: Praeger Security International.

Cothren, J., Smith, B., Roberts, P., & Damphousse, K. (2008). Geospatial and temporal patterns of preparatory conduct among American terrorists. International Journal of Comparative and Applied Criminal Justice, 32(1), 23-42.

Creswell, J. W., & Plano Clark, V. L. (2011). Designing and conducting mixed methods research (2nd ed.). Los Angeles, CA: SAGE Publications.

Creswell, J. W. (2014). Research design: Qualitative, quantitative, and mixed methods approaches (4th ed.). Thousand Oaks, California: SAGE Publications.

Cumming, A., & Masse, T. (2004). FBI intelligence reform since September 11, 2001: Issues and options for congress. Washington, DC: FBI.

Davis, L.M., Pollard, M., Ward, K., Wilson, J.M., Varda, D.M., Hansell, L. & Steinberg, P. (2010). Long-term effects of law enforcement's post-9/11 focus on counterterrorism and homeland security. Santa Monica, CA: RAND Corporation.

Dahl, E. J. (2011). The plots that failed: Intelligence lessons learned from unsuccessful terrorist attacks against the United States. Studies in Conflict and Terrorism, 34(8), 621-648.

Decker, S.H. (1996). Deviant homicide: A new look at the role of motives and victim-offender relationships. Journal of Research in Crime and Delinquency, 33(4), 427-449.

Difo, G. (2010). Ordinary measures, extraordinary results: An assessment of foiled plots since 9/11. Washington, D.C.: American Security Project.

Drake, C.J.M. (1998). The role of ideology in terrorists’ target selection. Terrorism & Political Violence, 10(2), 53-85.

Freilich, J.D., & Chermak, S.M. (2009). Preventing deadly encounters between law enforcement and American far-rightists. Crime Prevention Studies, 25, 141-172.

Freilich, J. D., & Newman, G. R. (Eds.). (2009). Reducing terrorism through situational crime prevention. New York: Criminal Justice Press.

Freilich, J.D., Chermak, S. M., Belli, R., Gruenewald, J., & Parkin, W. S. (2014). Introducing the United States Extremist Crime Database (ECDB). Terrorism & Political Violence, 26(2), 372-384.

Freilich, J. D., Gruenewald, J., & Mandala, M. (2018). Situational crime prevention and terrorism: An assessment of 10 years of research. Available online first in Criminal Justice Policy Review.42.

Freilich, J., Chermak, S., & Caspi, D. (2009). Critical events in the life trajectories of domestic extremist groups: A case study analysis of four violent white supremacist groups. Criminology and Public Policy, 8(3), 497-530.

Freilich, J.D., Chermak, S.M. & Simone, J., Jr. (2009). Surveying American state police agencies about terrorism threats, terrorism sources, and terrorism definitions. Terrorism & Political Violence, 21(3), 450-475.

Freilich, J.D., Parkin, W. S., Gruenewald, J., & Chermak, S. M. (2017). Comparing extremist perpetrators of suicide and non-suicide attacks in the United States. Available online first in Terrorism and Political Violence.

Gill, P. 2015. Lone-Actor terrorists: A behavioural analysis. New York: Routledge.

Gruenewald, J., Chermak, S., & Freilich, J.D. (2013). Distinguishing “loner” attacks from other domestic extremist violence: A comparison of far-right homicide incident and offender characteristics. Criminology and Public Policy, 12(1), 63-91.

Gruenewald, J., Dooley, K. M. G., Suttmoeller, M. J., Chermak, S. M., & Freilich, J. D. (2015). A mixed-method analysis of fatal attacks on police by far-right extremists. Police Quarterly, 19(2).

Gruenewald, J., Klein, B.R., Chermak, S., & Freilich, J. (2016). American jihadi terrorism: A comparison of homicides and unsuccessful plots. Available online first in Terrorism & Political Violence.

Gruenewald, J., & Pridemore, W. A. (2012). A comparison of ideologically-motivated homicides from the new extremist crime database and homicides from the supplementary homicide reports using multiple imputation by chained equations to handle missing values. Journal of Quantitative Criminology, 28(1), 141-162.

Hamm, M.S. (2007). Terrorism as crime: From the Order to Al-Qaeda and beyond. New York: New York University Press.

Kaplan, E.H. (2012). Estimating the duration of Jihadi terror plots in the United States. Studies in Conflict & Terrorism, 35(12), 880-94.

Kelley, K., & Gruenewald, J. (2015). Accomplishing masculinity through anti-lesbian, gay, bisexual, and transgender homicide: A comparative case study approach. Men and Masculinities, 18(1), 3-29.

Klein, B.R., Gruenewald, J., & Smith, B.L (2017). Opportunity, group structure, temporal patterns, and successful outcomes of far-right terrorism incidents in the United States. Crime & Delinquency, 63(10), 1224-1249.

Jackson, B.A. & Frelinger, D.A. (2009). Understanding why terrorist operations succeed or fail. Arlington, VA: RAND Corporation.

Jenkins, B. (2011). Stray dogs and virtual armies: Radicalization and recruitment to Jihadist terrorism in the United States Since 9/11. Santa Monica, CA: RAND Corporation.

LaFree, G. (2012). Policing terrorism. Ideas in American Policing series. Washington D.C.: Police Foundation.

Legault, R. L., & Hendrickson, J. (2009). Weapon choice and American political violence: A comparison of terrorists and other felons in federal custody. Criminology and Public Policy, 8(3), 531-559.

Lemanski, L., & Wilson, M. (2016). Targeting strategies in single-issue bomb attacks. Security Journal, 29(1), 53-71.

Levitt, M. (2017). Defeating ideologically inspired violent extremism: A strategy to build strong communities and protect the homeland. Report of a bi-partisan Washington Institute Study Group. Washington, DC: The Washington Institute for Near East Policy.

Maruna, S. (2010). Mixed method research in criminology: Why not go both ways? In A.R. Piquero & D. Weisburd (Eds.), Handbook of quantitative criminology, part 1 (pp. 123-140). New York, NY: Springer New York. doi:10.1007/978-0-387-77650-7_7

Miethe, T. D., & Drass, K. A. (1999). Exploring the social context of instrumental and expressive homicides: An application of qualitative comparative analysis. Journal of Quantitative Criminology, 15(1), 1-21. doi:10.1023/A:1007550704282

McCleskey, E., McCord, D., Leetz, J., & Markey, J. (2007). Underlying reasons for success and failure of terrorist attacks: Selected case studies. Final report prepared for the Department of Homeland Security Science and Technology Directorate.

McNeil, J. B., Carafano, J.J., & Zucker, J. (2010). 30 terrorist plots foiled: How the system worked. The Heritage Foundation.

Mueller, J. (Ed.). (2016). Terrorism since 9/11: The American cases. The Educational Publisher / Biblio Publishing.

Michael, G. (2012). Lone wolf terror and the rise of leaderless resistance. Nashville, TN: Vanderbilt University Press.

Muslim Public Affairs Council. (2012). Policy report: Data on post-9/11 terrorism in the United States. Washington, D.C.

Norris, J. J., & Grol-Prokopczyk, H. (2015). Estimating the prevalence of entrapment in post-9/11 terrorism cases. Journal of Criminal Law and Criminology, 105(3), 609-677.

Oots, K.L. (1989). Organizational perspectives on the formation and disintegration of terrorist groups. Terrorism, 12(3), 139-159.

Pantucci, R. (2013). A typology of lone wolves: Preliminary analysis of lone Islamist terrorists. United Kingdom: The International Centre for the Study of Radicalisation and Political Violence.

Parkin, W. S., & Freilich, J. D. (2015). Routine activities and right-wing extremists: An empirical comparison of the victims of ideologically- and non-ideologically-motivated homicides committed by American far-rightists. Terrorism & Political Violence, 27(1), 182-203.

Sandler, T., & Scott, J. L. (1987). Terrorist success in hostage-taking incidents: An empirical study. Journal of Conflict Resolution, 31(1), 35-53.

Sharif, I. (1995). The success of political terrorist events: An analysis of terrorist tactics and victim characteristics, 1968-1977. Lanham, MD: University Press of America.

Silber, M. (2012). The Al-Qaeda factor: Plots against the west. Philadelphia: University of Pennsylvania Press.

Spaaij, R. (2010). The enigma of lone wolf terrorism: An assessment. Studies in Conflict & Terrorism, 33(9), 854-870.

Smith, B., Cothren, J., Roberts, P., & Damphousse, K. (2009). Terrorism in time and space. Final report for NIJ Award #2005-IJ-CX-0037. Washington, D.C.: National Institute of Justice.

Smith, B. L. (1994). Terrorism in America: Pipe bombs and pipe dreams. Albany: State University of New York Press.

Strom, K.J., Hollywood, J.S., & Pope, M.W. (2017). Terrorist plots against the United States: What we’ve really faced, and how we might best defend against it. In G. LaFree & J.D. Freilich. (Eds.), Handbook on the criminology of terrorism (pp. 468-481). Hoboken: Wiley-Blackwell.

Tashakkori, A., & Teddlie, C. (2003). Handbook of mixed methods in social & behavioral sciences. Thousand Oaks, CA: SAGE.

Teddlie, C., & Yu, F. (2007). Mixed methods sampling: A typology with examples. Journal of Mixed Methods Research, 1(1), 77-100.

Weisburd D, Wyckoff, L.A., Ready J., Eck, J.E., Hinkle, J.C., & Gajewski, F. (2006). Does crime just move around the corner? A controlled study of spatial displacement and diffusion of crime control benefits. Criminology, 44, 549-592.


Brent R. Klein is a doctoral candidate in the School of Criminal Justice at Michigan State University and former student board member of American Society of Criminology’s Division of Terrorism and Bias Crimes. His research interests include school violence, terrorism and extremist crime, bias-motivated crime, and crime prevention. Brent’s recent work has appeared in Justice Quarterly, Crime & Delinquency, Terrorism & Political Violence, The Sociological Quarterly, and Studies in Conflict & Terrorism.

Jeff Gruenewald is an associate professor in the School of Public and Environmental Affairs at Indiana University-Purdue University, Indianapolis. His research interests include issues of terrorism and extremism, homeland security, homicide, and media representations of violence. His work has appeared in journals such as Justice Quarterly, Crime & Delinquency, Criminology & Public Policy, Journal of Quantitative Criminology, and Terrorism & Political Violence.

Steven M. Chermak is a Professor in the School of Criminal Justice at the Michigan State University, an investigator for the National Consortium for the Study of Terrorism and Responses to Terrorism, and Creator and co-Director of the United States Extremist Crime Database (ECDB). He studies domestic terrorism, media coverage of crime and justice issues, and the effectiveness of specific policing strategies. Recent publications have appeared in Terrorism & Political Violence, Crime & Delinquency, and the Journal of Quantitative Criminology.

Joshua D. Freilich is a member of the Criminal Justice Department at John Jay College. He is a Creator and co-Director of the Extremist Crime Database (ECDB), an open source relational database of violent and financial crimes committed by political extremists in the U.S.; a Creator and co-Director of the School Shooting Database (SSDB), an open source relational database of school shootings in the U.S. resulting in at least 1 injury; and the Chair (2017-19) of the American Society of Criminology’s Division on Terrorism and Bias Crimes. Professor Freilich’s research has been funded by the Department of Homeland Security (DHS) and the National Institute of Justice (NIJ).


This research was funded by grants from the U.S. Department of Homeland Security (DHS) Science and Technology Directorate's University Program Division, and the Resilient Systems Division both directly and through the National Consortium for the Study of Terrorism and Responses to Terrorism (START). Funding was also provided by a grant from John Jay College's Office of Advancement of Research. The views and conclusions contained in this document are those of the authors and should not be interpreted as necessarily representing the official policies, either expressed or implied, of DHS, START or John Jay College.

No comments here
Why not start the discussion?