Home 2016 April Perspective: Identifying Warning Behaviors of the Individual Terrorist

Perspective: Identifying Warning Behaviors of the Individual Terrorist


Identifying Warning Behaviors of the Individual Terrorist

By J. Reid Meloy, Ph.D.

Young man in a crowd.jpg


Tactical and often strategic, terrorist actions also are attention-seeking; the audience can be as important as the target. These acts are intentional, instrumental, and predatory, as well as planned, purposeful, and offensive.[1] But, they may be rationalized as defensive. For instance, young ISIS recruits may believe falsely that the West is at war with Islam and that all Muslims must engage in violent jihad against unbelievers everywhere.

Traditional violence risk factors—history of such behavior, psychiatric disorder, or drug abuse—are somewhat useless in predicting the risk of lone terrorist acts. Most individuals identified as terrorists by such risk factors would be false positives, wrongly labeled as such.

For the past 6 years, I have worked with my colleagues to identify patterns of behavior closely related in time to acts of targeted violence, such as terrorism.[2] Targeted violence differs from typical violence—emotionally charged, impulsive, and reactive—encountered by law enforcement.[3] It entails a decision to act violently against a particular person, group, or institution. Persons carry it out in a planned manner as illustrated by such acts as the San Bernardino, California, terrorist attack, which killed 14 people on December 2, 2015.[4]

We believe these patterns of conduct—warning behaviors—can provide an investigative template to help law enforcement agencies focus their attention on subjects of concern previously identified through intelligence gathering or other counterterrorism efforts. These behavior patterns can help the investigator step back and see the bigger picture, rather than focus on just one variable, such as the purchase of a firearm or one visit to a Mosque where a particular Salafist imam preaches violent jihad.

However, these warning behaviors do not predict violence. Officers should not use them as a risk-assessment tool, only as an investigative template. In fact, the rare occurrence of terrorist violence makes its prediction seemingly impossible. But, prevention does not require prediction. The purpose of identifying these behaviors is to detect proximal indicators of concern for law enforcement that can narrow the focus of an investigation, prioritize cases, and help plan a timely risk-management intervention.



Subjects engage in various behaviors that encompass part of research, planning, or preparation for a terrorist act or implementation of such an attack.[5]

On June 5, 1968, on the first anniversary of the Six Day War, Sirhan Sirhan carried out the meticulously planned assassination of Senator Robert F. Kennedy. After months of preparation, he conducted the attack following Kennedy’s vote to sell 50 Phantom jet fighter-bombers to Israel in January 1968. Although not Muslim Sirhan identified closely with the Palestinians and viewed Kennedy’s vote as a betrayal of his people.[6]

In the 5 months leading up to the date, he secured a .22-caliber revolver, practiced at a shooting range, made at least four approaches—perhaps failed attempts or efforts to see how close he could get—to Kennedy in a public venue and, finally, shot him multiple times while hiding in the pantry at the Ambassador Hotel in Los Angeles, California, as Kennedy walked past him.[7] There were 77 people in the pantry at the time, but there also was no U.S. Secret Service policy in place to protect aspiring presidential candidates until after this assassination.[8]

Open quotes

 The purpose of identifying these behaviors is to detect proximal indicators of concern for law enforcement that can narrow the focus of an investigation, prioritize cases, and help plan a timely risk-management intervention.


Certain behaviors indicate someone’s increasingly pathological preoccupation with a person or cause.[9] There is an accompanying deterioration in relationships or occupational performance.

Malik Hasan, the U.S. Army major who conducted a mass murder at Ft. Hood, Texas, on November 5, 2009, became increasingly fixated by his belief that the United States was at war with Islam. During his residency and fellowship at Walter Reed Army Medical Center in Washington, D.C., he openly articulated his beliefs to other psychiatric residents, fellows, and supervisors.[10] Hasan gave two presentations entitled “The Koranic Worldview as It Relates to Muslims in the Military” and “Why the War on Terror Is a War on Islam.”[11]

In the months preceding the killings, the fixation continued with efforts to avoid deployment to Iraq or Afghanistan by retaining an attorney; he also communicated via e-mail with Anwar al-Awlaki, an American spiritual sanctioner and recruiter for al Qaeda in the Arabian Peninsula (AQAP) in Yemen.[12] He inquired whether killing American soldiers and officers was a religiously legitimate act.[13] The arguing and preaching stopped during this period, but clandestine operational planning likely continued.[14] His fixation was a cause, but also was deeply personal because his grievance against the wars in the Middle East went unheeded.[15]


Persons have a psychological desire to be a “pseudocommando” or have a “warrior mentality.” This includes closely associating with weapons or other military or law enforcement paraphernalia, identifying with previous attackers or assassins, or proclaiming themselves as agents to advance a particular cause or belief system.[16]

Anders Breivik carried out the July 22, 2011, bombings on several Norwegian government buildings and, within hours, killed another 69 people—mostly adolescents—on the island of Utoya. He identified himself as a contemporary reincarnation of the Knights Templar, the militant spear of the 12th-century Christian Crusades against the Muslims.[17]

Breivik designed homemade uniforms, emblematic of his identification, to wear in photographs and also found an affinity for U.S. terrorists Ted Kaczynski and Timothy McVeigh.[18] He plagiarized the writings of Kaczynski in his own “2083—A European Declaration of Independence” and wrote that McVeigh probably felt as he did while constructing his bombs.[19] Breivik considered himself a soldier fighting to free his people from multiculturalism and the Islamic immigration into Europe.[20]

Novel Aggression

For the first time, subjects commit an act of violence that appears unrelated to any pathway behavior. They do so to test their ability to become violent.

On October 22, 2014, Michael Zehaf-Bibeau murdered Corporal Nathan Cirillo, a Canadian soldier, and injured three others. Then, he attacked the Canadian Parliament, wherein he was killed by law enforcement. Three years earlier, in December 2011, he had walked into the Royal Canadian Mounted Police (RCMP) field office in Burnaby, British Columbia, and said he wanted to be arrested for an armed robbery he committed a decade earlier; no such recorded crime existed.[21] The next night, he tried to rob a McDonald’s restaurant with a pencil, then waited for the police to arrive.[22] He told them, “I’m a crack addict and at the same time a religious person, and I want to sacrifice freedom and good things for a year maybe, so when I come out I’ll appreciate things in life more and be clean.”[23]

Energy Burst

An increase in the frequency or variety of noted activities—even if relatively innocuous—related to the target occurs, usually in the hours or days before the attack.

On January 8, 2011, in Tucson, Arizona, Jared Loughner tried to assassinate U.S. Congresswoman Gabrielle Giffords and committed mass murder.[24] In the 12 hours before the attack, beginning before midnight, he dropped off a roll of 35-mm film to be developed at a local drug store and later picked up the photos, checked into a motel, and intermittently searched the Internet, using the key words “assassin” and “lethal injection.”[25] He left a telephone message for a friend and, at 4:12 a.m., posted to his social media page a photo of his Glock pistol with the words “goodbye friends….”[26]

At 7:27 a.m., he visited two department stores and purchased 9-mm full metal jacket ammunition and a diaper bag.[27] Later, police stopped him for running a red light; he was released with a warning after crying and apologizing.[28] Loughner went home, then ran away from his father when confronted.[29] He returned to a department store, then took a cab to the shopping center where Congresswoman Giffords was speaking, insisting on getting correct change for the cab driver because he only had a $20 bill.[30] A few minutes later at 10:10 a.m., he opened fire, killing 6 people and wounding 13. He had taken the time to put his driver’s license, credit card, and money in a small plastic baggie.[31]


When planning to harm a target through an attack, persons communicate such intent to a third party.[32]

On August 8, 2014, Abdurasul Juraboev, a resident of Brooklyn, New York, and a citizen of Uzbekistan, wrote on a website, “Greetings! I am in U.S. right now, but we don’t have any arms. But, is it possible to commit ourselves as dedicated martyrs anyway while here? What I’m saying is to shoot Obama and get shot ourselves, will it do? That will strike fear in the hearts of infidels.”[33] In February 2015 he was indicted with two other individuals and currently awaits federal prosecution for attempt and conspiracy to provide material support to the Islamic State of Iraq and the Levant (ISIL).[34]

Open quotes

In a small study comparing German school shooters with other students of concern, five of
the warning behaviors…significantly discriminated the shooters from the other students who had no intent to act....

Last Resort

Subjects demonstrate through word or deed a violent action or time imperative or display increasing desperation or distress.[35] To such individuals, there is no alternative other than violence, and the consequences are justified.

On June 17, 2015, 21-year-old Dylann Storm Roof committed mass murder at Emanuel African Methodist Episcopal Church in Charleston, South Carolina. He killed nine African-Americans during a Bible study meeting, including the senior pastor and Senator Clementa Pinckney, and wounded several others.

Days after the shooting, his website, The Last Rhodesian, was discovered, including a manifesto.[36] Roof had written, “I have no choice. I am not in the position to, alone, go into the ghetto and fight. I chose Charleston because it is most historic city in my state, and at one time had the highest ratio of blacks to Whites in the country. We have no skinheads, no real KKK, no one doing anything but talking on the Internet. Well, someone has to have the bravery to take it to the real world, and I guess that has to be me.”[37]

Directly Communicated Threat

Individuals communicate a direct threat to the target or law enforcement before a violent action.

On December 11, 2010, Taimour al-Abdaly, a 28-year-old Iraqi Sunni living in Sweden since age 10, carried out a car bombing and then prematurely detonated his own suicide vest in downtown Stockholm, killing no one else. He sent an audiotaped message in several different languages to Swedish broadcast media shortly before his targeted violence.

You have Lars Vilks—the pig Lars Vilks—to blame, and yourselves for these actions. Your quietness for the painting and your support for your soldiers, now understand, brought you to this unpleasant situation.

The Islamic state, may Allah protect it, and its people have now begun to fulfill its promises. And do know one thing: we are not—we are not a lie or imagination, we are for real and do now exist among you, Europeans. So stop your drawings and—stop your drawings of our prophet Muhammad [Arabic], withdraw your soldiers from Afghanistan and no more oppression against Islam or Muslims will be tolerated in any way or any means.

Last but not least, I say to all mujahedeen: please do not forgive [sic] me in your prayers, may Allah accept me as a martyr and my request from you is to pray [Arabic phrase] for me as the Muslims are so humiliated here in Sweden and other places in Europe that they sometimes pray for non-Muslims. And to all hidden mujahedeen in Europe, and especially in Sweden: it’s now the time to strike, even if you only have a knife to strike with, and I do know you that have more than that.[38]


Although these warning behaviors appear to be proximal indicators of accelerating risk in individual terrorists, further scientific testing is necessary. Some efforts already have begun. In a small study comparing German school shooters with other students of concern, five of the warning behaviors—pathway, fixation, identification, novel aggression, and last resort—significantly discriminated the shooters from the other students who had no intent to act.[39] These differences showed a large effect size, indicating a strong relationship between the shooter’s violence and the five warning behaviors. Recent research has demonstrated striking similarities between individual terrorists, mass murderers, and active shooters.[40]

In two other studies, the Swedish Defence Research Agency recommended and outlined a method to employ three of the warning behaviors—fixation, identification, and leakage—to potentially identify “lone wolves” through the use of forensic linguistic analysis and data mining on the Internet.[41] The warning behaviors also appear to have ecological validity—a real-world fit—across several different domains of targeted violence perpetrators, including German school shooters, German and American public figure attackers or assassins, and spousal homicide malefactors.[42]

The author and his colleagues are in the process of analyzing data concerning individual terrorists—religious and secular motivations—in North America and Europe. In a study of 22 European terrorists, five warning behaviors (pathway, fixation, identification, energy burst, and last resort) were found in more than 90 percent of the cases. In another larger study of 111 lone-actor terrorists in the United States and Europe, pathway, fixation, identification, and leakage were present in 77 to 96 percent of all subjects. Such efforts will demonstrate whether these behaviors have value as part of an instrument for risk-assessment efforts.

Open quotes

These proximal warning behaviors
can be used to make decisions concerning whether a case should be monitored or mitigated for risk management.


These proximal warning behaviors can be used to make decisions concerning whether a case should be monitored or mitigated for risk management. The absence of all warning behaviors following a detailed investigation—always remembering that insufficient information does not mean absent information—would suggest that monitoring and intelligence gathering continue, but that active risk management for targeted violence is unnecessary. The presence of one warning behavior could indicate that active risk management should be pursued and specific interventions developed within the fact pattern of the individual case. Although these warning behaviors were developed to identify indicators for targeted violence, they appear to complement specific interactive patterns recently promulgated by the National Counterterrorism Center concerning ISIL- or al Qaeda-inspired violence and can function best as another investigative tool as further operational research accumulates.[43]

For additional information the author may be contacted at reidmeloy@gmail.com.


[1] J. Reid Meloy, “Violent True Believers,” FBI Law Enforcement Bulletin, July 2011, accessed December 18, 2015, https://leb.fbi.gov/2011/july/perspective-violent-true-believers.

[2] J. Reid Meloy, Jens Hoffmann, Angela Guldimann, and David James, “The Role of Warning Behaviors in Threat Assessment: An Exploration and Suggested Typology,” Behavioral Sciences and the Law 30, no. 3 (May/June 2012): 256-79, accessed February 1, 2016, https://www.researchgate.net/publication/222104783_The_Role_of_Warning_Behaviors_in_Threat_Assessment_An_Exploration_

[3] J. Reid Meloy, “Empirical Basis and Forensic Application of Affective and Predatory Violence,” Australian and New Zealand Journal of Psychiatry 40, no. 6-7 (June/July 2006): 539-47, accessed February 12, 2016, https://www.researchgate.net/publication/7025647_Meloy_JR_Empirical_basis_

[4] U.S. Department of Justice, Office of Justice Programs, National Institute of Justice, Threat Assessment: An Approach to Prevent Targeted Violence, by Robert Fein, Bryan Vossekuil, and Gwen Holden, NCJ 155000, July 1995, accessed January 6, 2016, https://www.ncjrs.gov/pdffiles/threat.pdf.

[5] Frederick S. Calhoun and Stephen W. Weston, Contemporary Threat Management (San Diego, CA: Specialized Training Services, 2003).

[6] J. Reid Meloy, “Revisiting the Rorschach of Sirhan Sirhan,” Journal of Personality Assessment 58, no. 3 (July 1992): 548-570.

[7] Ibid.

[8] J. Reid Meloy and Jens Hoffmann, eds., International Handbook of Threat Assessment (New York, NY: Oxford University Press, 2014).

[9] Paul E. Mullen, David V. James, J. Reid Meloy, Michele T. Pathe, Frank R. Farnham, Lulu Preston, Brian Darnley, and Jeremy Berman, “The Fixated and the Pursuit of Public Figures,” The Journal of Forensic Psychiatry and Psychology 20, no. 1 (February 2009): 33-47, accessed January 7, 2016, http://fixatedthreat.com/perch/resources/the-fixated-and-the-pursuit-of-public-figures.pdf.

[10] U.S. Senate Committee on Homeland Security and Governmental Affairs, A Ticking Time Bomb: Counterterrorism Lessons from the U.S. Government’s Failure to Prevent the Fort Hood Attack, by Joseph I. Lieberman and Susan M. Collins, February 3, 2011, accessed February 12, 2016, http://fas.org/irp/congress/2011_rpt/hsgac-hood.pdf.

[11] Ibid.

[12] Peter Bergen, The United States of Jihad (New York, NY: Crown Publishers, 2016)

[13] Ibid.

[14] Ibid.

[15] Ibid.

[16] J. Reid Meloy, Kris Mohandie, James L. Knoll, and Jens Hoffmann, “The Concept of Identification in Threat Assessment,” Behavioral Sciences and the Law 33, no. 2-3 (June 2015): 213-37, accessed January 7, 2016, http://onlinelibrary.wiley.com/doi/10.1002/bsl.2166/abstract.

[17] Ryan Lenz, “The Terrorist Who Slaughtered Norway’s Children Was Heavily Influenced by American Anti-Muslim Extremists,” SPLC: Southern Poverty Law Center, August 24, 2011, accessed February 12, 2016, https://www.splcenter.org/fighting-hate/intelligence-report/2015/christian-crusader.

[18] Ibid.

[19] Christian Skaug, “Forensic Psychiatric Statement-Anders Behring Breivik,” Febuary 9, 2012, accessed February 12, 2016, https://www.document.no/2012/02/forensic-psychiatric-statement-anders-behring-breivik-i/.

[20] Ibid.

[21] “Independent Investigation Into the Death of Michael Zehaf-Bibeau,” Royal Canadian Mounted Police, October 22, 2014, accessed February 12, 2016, http://www.rcmp-grc.gc.ca/en/independent-investigation-death-michael-zehaf-bibeau.

[22] Ibid.

[23] Ibid.

[24] Although Loughner’s acts do not fit the FBI’s definition of terrorism, in the midst of a severe mental illness diagnosed as schizophrenia, he was drawn to the philosophy of nihilism and harbored the delusional belief that the government was controlling the English language. His case is used here to clearly illustrate energy burst as a warning behavior.

[25] Ross Levitt and Susan Candiotti, “Police: Loughner Up All Night at Walmarts, Circle Ks Before Shooting,” CNN, January 14, 2011, accessed February 16, 2016, http://www.cnn.com/2011/CRIME/01/14/arizona.shooting.investigation/.

[26] Ibid.

[27] Ibid.

[28] Dennis Wagner, “Records Detail Shooter’s Agitation Before Arizona Rampage,” USA Today, March 27, 2013, accessed February 16, 2016, http://www.usatoday.com/story/news/nation/2013/03/27/gabby-giffords-shooting-records/2024589/.

[29] Ibid.

[30] Ibid.

[31] Ibid.

[32] J. Reid Meloy and Mary Ellen O’Toole, “The Concept of Leakage in Threat Assessment,” Behavioral Sciences and the Law 29, no. 4 (June 2011), accessed January 7, 2016, http://www.continuityinsights.com/sites/continuityinsights.com/files/legacyimages/B14_ConceptofLeakage_Handout.pdf.

[33] U.S. Attorney’s Office, Eastern District of New York, Three Brooklyn Residents Charged with Attempt and Conspiracy to Provide Material Support to ISIL, Federal Bureau of Investigation, February 25, 2015, accessed February 16, 2016, https://www.fbi.gov/newyork/press-releases/2015/three-brooklyn-residents-charged-with-attempt-and-conspiracy-to-provide-material-support-to-isil.

[34] Ibid.

[35] Kris Mohandie and James E. Duffy, “Understanding Subjects with Paranoid Schizophrenia,” FBI Law Enforcement Bulletin, December 1999, 8-16, accessed January 7, 2016, https://leb.fbi.gov/1999-pdfs/leb-december-1999.

[36] “Here’s What Appears to Be Dylann Roof’s Racist Manifesto,” Mother Jones, June 20, 2015, accessed February 16, 2016, http://www.motherjones.com/politics/2015/06/alleged-charleston-shooter-dylann-roof-manifesto-racist.

[37] Ibid.

[38] Robert Mackey, “Audio of Threat ‘to Sweden’ Sent Before Bombing,” New York Times, December 13, 2010, accessed February 16, 2016, http://thelede.blogs.nytimes.com/2010/12/13/90259/?_r=0.

[39] J. Reid Meloy, Jens Hoffmann, Karoline Roshdi, and Angela Guldimann, “Some Warning Behaviors Discriminate Between School Shooters and Other Students of Concern,” Journal of Threat Assessment and Management 1, no. 3 (2014): 203-11, accessed January 7, 2016, http://www.apa.org/pubs/journals/features/tam-0000020.pdf.

[40] Clark McCauley, Sophia Moskalenko, and Benjamin Van Son, “Characteristics of Lone-Wolf Violent Offenders: A Comparison of Assassins and School Attackers,” Perspectives on Terrorism 7, no. 1 (2013), accessed January 7, 2016, http://www.terrorismanalysts.com/pt/index.php/pot/article/view/240/html.

[41] Joel Brynielsson, Andreas Horndahl, Fredrik Johansson, Lisa Kaati, Christian Martenson, and Pontus Svenson, “Harvesting and Analysis of Weak Signals for Detecting Lone-Wolf Terrorists,” Security Informatics 2, no. 11 (2013), accessed January 7, 2016, http://www.security-informatics.com/content/2/1/11; and Kate Cohen, Fredrik Johansson, Lisa Kaati, and Jonas Mork, “Detecting Linguistic Markers for Radical Violence in Social Media,” Terrorism and Political Violence 26, no. 1 (2014): 246-56.

[42] J. Reid Meloy, Jens Hoffman, Karoline Roshdi, Justine Glaz-Ocik, and Angela Guldimann, “Warning Behaviors and Their Configurations Across Various Domains of Targeted Violence,” in International Handbook of Threat Assessment, ed. J. Reid Meloy and Jens Hoffmann (New York: Oxford University Press, 2014), 39-53, accessed February 1, 2016, https://books.google.com/books?id=2AFNAgAAQBAJ&pg=PA39&lpg=PA39&dq=Warning+Behaviors+and+their+Configurations+Across+Various+Domains+

[43] Office of the Director of National Intelligence, National Counterterrorism Center, Behavioral Indicators Offer Insights for Spotting Extremists Mobilizing for Violence, July 22, 2011, accessed January 8, 2016, https://info.publicintelligence.net/NCTC-SpottingHVEs.pdf.



In Depth twitter-bird-light.png
Featured Articles
- Using Human Sources in Counterterrorism Operations: Understanding the Motivations and Political Impact
- Perspective
Identifying Warning Behaviors of the Individual Terrorist
- Officer Survival Spotlight
The 4,000-Pound Bullet
- Leadership Spotlight
The Responsibilities of Command:
Doing the Right Thing for the Right Reasons

Bulletin Highlights
BN_Photos of Officers.jpg Bulletin Notes Officers Steve Walters and T.J. Jacik, La Vista, Nebraska, Police Department
Emergency workers providing medical aid_BR Rail.jpg Bulletin Reports – Victims of Mass Violence and Terrorism
ViCAP Alert

Cookeville, TN | Allenstown, NH | West Chester, OH | Oscoda, MI | Conewago Township, PA | Jackson County, WI

Topics in the News
See previous LEB content on:
Active Shooter
Suicide Prevention
               Officer-Involved Shootings
Patch Call




The patch of the Bel Air, Maryland, Police Department prominently features the coat of arms of the town it serves. More

The patch of the Macomb County Sheriff’s Office features an outline of the state in blue behind a six-point sheriff’s star. More
About LEB
- History
- Editorial Staff
- Author Guidelines
- Editorial Release Form
- Web and Print
LEB Updates Red Envelope
Subscribe to receive monthly updates listing articles featured on this website. Details