The timing of terrorist attacks: An optimal stopping approach

Abstract

I use a simple optimal stopping model to derive policy relevant insights on the timing of one-shot attacks by small autonomous terrorist units or “lone wolf” individuals. A main insight is that an increase in proactive counterterrorism measures can lead to a short term increase in the number of attempted terrorist attacks because it makes it more risky for existing terrorist units to pursue further development of capabilities. This is consistent with the events in London in 2005 where a terrorist attack on 7 July was followed by a similar but unsuccessful attack two weeks later.

Introduction

In this short note I use a simple optimal stopping model to study the timing of one-shot attacks by small autonomous terrorist units or “lone wolf” individuals. The threat of such attacks constitutes a substantial part of the current terrorist threat against Europe and the United States. The model addresses how the timing of attacks depends on the achieved striking capability of the terrorists (the level of damage they are able to cause in an attack) and the potential for further development of this capability.

A main finding is that terrorists will not attack as soon as their striking capability reaches the level where the benefits from attacking outweigh the costs. Rather, if the net benefit from attacking now is small they will pursue further development in the hope of launching a larger attack in the future. Therefore, a terrorist unit that currently works on developing its capabilities may well be willing to quickly launch an attack at its current striking capability (because its net benefit from such an attack can be positive) if further development suddenly becomes more risky and therefore less attractive. This insight is important for counterterrorism policymaking. If authorities intensify their proactive counterterrorism efforts then further development of capabilities becomes more risky for existing terrorist units. Thus, the policy change can lead to a short term increase in the number of attempted attacks because it can make it optimal for some units (or individuals) to attack now rather than wait.

A large attempted terrorist attack, successful or not, typically leads to substantial increases in proactive counterterrorism measures. Thus, following the arguments above, the standard policy response to such an attack can increase the short term risk of another attack, which is likely to be of a smaller scale. This insight, which will be discussed in more detail later on, is consistent with the events in London in 2005 where the successful attack on 7 July was followed by an unsuccessful attack two weeks later.

I am not aware of other papers that study the timing of terrorist attacks from the optimal stopping perspective chosen here. Related dynamic models of terrorism include Keohane and Zeckhauser (2003), Jacobson and Kaplan (2007), Faria (2011), Jensen (2011), and Faria and Arce (2012). Clauset et al. (2007) propose a toy model that shares some features with the model presented here, but does not explicitly consider how terrorists decide when to attack. For overviews of the analytical terrorism literature see, for example, Bueno de Mesquita (2008) and Sandler (2014).

The model

Consider a terrorist unit and let $S(t)$ denote its striking capability at time $t\ge 0$ . That is, $S(t)$ is the expected damage if the unit attacks at time t and no defensive (as distinct from proactive) counterterrorism measures are in place. Absent any proactive counterterrorism policies by authorities, $S(t)$ increases exponentially with growth rate $\alpha >0$ :

$$S(t)=S_0\exp (\alpha t)$$

where $S_0=S(0)$ . ¹

Because of proactive counterterrorism policies the terrorist unit may be detected by the authorities. During any infinitesimal time interval $dt$ there is a probability $\lambda dt$ that the unit is detected, which leads to full dismantling, that is, its striking capability jumps to zero and stays there. $\lambda \ge 0$ is a parameter and represents the intensity of the proactive policies. Note that the probability that a terrorist unit is not detected during a finite time interval of length $T$ is $\exp (-\lambda T)$ . ²

Defensive counterterrorism policies reduce the probability that a terrorist attack is successful. We let $p\in (0,1)$ denote the probability that a terrorist attack fails because of defensive measures. Thus, if the terrorist unit attacks at time $t$ then the expected damage is $(1-p)S(t)$ . ³

The terrorist unit’s problem is, at any instant, to decide whether to attack at the current striking capability or continue to develop its capabilities. If the terrorists decide to attack at time $t$ they will cause the expected damage $(1-p)S(t)$ , but will also incur a fixed cost of attack $C>0$ . Their utility from launching an attack is equal to the expected damage (a proxy for their perceived contribution to their cause) minus the cost:

$$(1-p)S(t)-C$$

$C$ may simply represent the monetary costs of launching an attack. But it can also include terrorists’ valuation of a normal future life (especially relevant for suicide terrorists) or their opportunity cost of not being able to contribute to their cause in more peaceful ways after having committed a terrorist act.

The final parameter of the model is the discount rate of the terrorists, $\rho >0$ . It is assumed that $\lambda +\rho >\alpha .$

Solution and comparative statics

The solution to the terrorists’ optimal stopping problem is given by a critical striking capability $S^{\ast }$ such that they will attack as soon as $S(t)$ reaches $S^{\ast }$ . In the appendix it is shown that

$$S^{\ast }=\frac{\lambda +\rho }{(1-p)(\lambda +\rho -\alpha )}C$$

It immediately follows that $S^{\ast }>C$ . So even at striking capabilities where launching an attack will provide a net benefit, it is possible that terrorists find it optimal to continue development in the hope of launching a larger attack in the future. This finding is well known from the literature on investment under uncertainty (e.g. Dixit and Pindyck, 1994): a firm will not necessarily make an investment when the net present value is positive if it has the option of waiting.

An immediate comparative statics result is that

$$\frac{\partial S^{\ast }}{\partial C}=\frac{\lambda +\rho }{(1-p)(\lambda +\rho -\alpha )}>1$$

Thus, not only does $S^{\ast }$ increase when the cost of an attack increases, but the interval from $C$ to $S^{\ast }$ also widens. For the other parameters we have

$$\frac{\partial S^{\ast }}{\partial \alpha }>0,\frac{\partial S^{\ast }}{\partial \lambda }<0,\frac{\partial S^{\ast }}{\partial \rho }<0,\mathrm{and}\frac{\partial S^{\ast }}{\partial p}>0$$

The least intuitive of the comparative statics results is that more effective defensive counterterrorism measures (a higher $p$ ) make terrorists wait for a higher striking capability before they attack. An increase in $p$ reduces both the utility of attacking now and in the future, but because of discounting and the probability of detection the negative effect on the utility of a future attack is smaller.

Implications of the model and conclusion

We saw that an increase in $\lambda$ causes $S^{\ast }$ to decrease because it makes continued development of capabilities more risky for the terrorists. Suppose there exists a “ sea” of active terrorist units (and/or lone wolf individuals). If authorities intensify proactive counterterrorism efforts then the critical striking capability for each unit will decrease, which may well make it optimal for some units to attack immediately. Thus, a change in policies that increases $\lambda$ can lead to a short term increase in the number of attempted attacks. This is an important observation, especially because this effect is not due to a policy failure. It is precisely the effectiveness of the policy change that may cause some terrorists to attack sooner.

One thing the authorities could do to reduce the increased short term risk of terrorist attacks after an increase in $\lambda$ is to also increase defensive counterterrorism measures that make attempted attacks less likely to succeed. We saw that $S^{\ast }$ increases with $p$ , so the effect of an increase in proactive measures can in principle be countered by appropriately chosen defensive measures. However, some types of terrorist attacks are very hard to defend against, for example relatively low-tech attacks on public transportation or public places, so in practice it may not be feasible to substantially increase $p$ .

Actual terrorist attacks often lead to abrupt increases in proactive counterterrorism measures. Thus, by the argument above, new attacks become more likely in the aftermath of an attack, especially new attacks of types that are difficult to feasibly defend against. The timing of the two terrorist attacks in London in July 2005 fits well with this argument. On 7 July, members of a small terrorist unit successfully detonated homemade bombs on underground trains and a bus. Only two weeks later, on 21 July, another terrorist unit attempted a similar attack, but their bombs did not detonate as intended and there were no casualties. It is plausible that the authorities’ proactive reactions to the first attack led the second unit to carry out a previously planned attack sooner, even though the failure of the bombs to detonate suggests that an attack could have been more effective with more time and planning. Of course, other explanations such as copy-cat motives and increased media attention to terrorism after the first attack are also possible.

To sum up the arguments above, the model highlights how changes in counterterrorism policies can have important and perhaps unintended short term effects due to rational responses by terrorists. It is important that authorities take this into account when making policy changes that are thought to be beneficial in the long run. For example, it may be necessary to implement temporary measures along with the main new policy in order to counter unwanted short-term effects. It is also important to be aware of such short-term effects when evaluating new policies after implementation. Otherwise they could be seen as the main consequence of the policy change, which may lead to abandonment of policies that are beneficial in the long run.

Finally, the problem of optimal counterterrorism has not been considered here. While it is clearly important that authorities are aware that more intensive proactive counterterrorism measures may cause some terrorists to attack sooner than they originally planned and thus increase the short term risk of attempted attacks, this does not imply that authorities should necessarily avoid such a change of policy. In fact, it may even be positive to have earlier attacks because they will typically be of a be smaller scale. A thorough analysis of the problem of optimal dynamic counterterrorism must consider the expected damage over time (and counterterrorism costs) and is beyond the scope of this note. However, the simple dynamic model of a small autonomous terrorist unit presented here could serve as a building block in future work on optimal policies when many such units exist and new ones continue to form.