View this email in your browser

Research Digest

February 2020                                   Issue 9


Since its launch in February 2015, CTED’s Global Research Network (GRN) has grown from its initial 28 members into a flourishing and diverse network of over 100 leading research institutions from around the world.

Over the past five years, evidence-based research produced by GRN members has been integrated into a range of CTED activities and a growing number of analytical publications, helping to keep the Security Council’s Counter-Terrorism Committee and the global counter-terrorism policymaking community abreast of emerging terrorism and counter-terrorism trends.

In recognition of the GRN’s five-year anniversary, this edition of CTED’s Research Digest looks back at five of the key trends from the past decade, synthesizing and summarizing the findings of the global research community into a concise, analytical overview of each trend.

The evolving landscape

Although the past decade saw significant fluctuations in the size, nature and geographic centre of the terrorist threat, by its end, terrorism was a genuinely global phenomenon.

In 2018, for example, the enduring international challenge posed by both ISIL and Al-Qaida (particularly through their affiliates in West Africa and the Sahel) saw 103 Member States record at least one terrorist incident. By the end of the decade, this threat co-existed alongside the growing transnational challenge posed by extreme right-wing terrorist groups and lone actors (also referred to as far right or racially/ethnically motivated terrorism by researchers and Member States), creating a more diverse and diffuse terrorist landscape.

However, despite being a global phenomenon, research has shown that many of the grievances and drivers that fuel radicalization to terrorism are local. As the decade progressed, both ISIL and Al-Qaida affiliates or franchises began to focus on local issues and narratives (whether due to adverse circumstances or a conscious shift in strategy), co-opting or adopting local concerns to increase recruitment, and to strengthen quasi-governance initiatives.

Research suggests that this localization may have increased the durability of ISIL or Al-Qaida-affiliated groups, with the absence of a single hierarchical leadership structure helping to insulate them from the fallout caused by the relatively frequent deaths of senior leaders in both groups.

The distinct local characteristics of these affiliated groups or networks, and their diverse (and often rapid) geographical spread, also made it difficult for the international community to effectively prioritize support for impacted Member States with limited capacity and resources, or to deliver multiple, tailored responses simultaneously.

Analysis of the characteristics of extreme right-wing terrorist groups and individuals suggests that they followed the opposite trajectory. From being viewed in a predominantly national, domestic context at the beginning of the decade, by 2019, research had provided increasing evidence of transnational connectivity across a range of thematic issues – often driven by online communities - including financing, training and shared narratives or inspiration for attacks.

Research suggests that the absence of formalized group structures – particularly across national boundaries - made it challenging for Member State Governments and the international community to respond as the threat increased, with different terminology and approaches also undermining efforts to mount a coordinated response.

Common across research into both sets of threat actors was an increased recognition of the roles of women and the importance of gender in terrorist narratives and structures.

Both Al-Qaida and ISIL developed gendered propaganda materials that targeted men and women in distinct ways, seeking to tap into their specific grievances, needs and vulnerabilities, and exploiting gendered power structures. Narratives espoused by extreme right-wing terrorist actors also continued to exploit gender inequality and promote misogynistic worldviews, while women were nonetheless shown to be playing increasingly important roles as fundraisers, recruiters and activists.

Counter-terrorism and countering violent extremism (CVE) responses attempted to keep pace with this evolving picture, with the international community repeatedly emphasizing the need for comprehensive, whole-of-society responses and the development of new or closer partnerships with civil society and community actors.

As a result, the second half of the decade saw a rapid global spread of CVE/preventing violent extremism (PVE) initiatives, while new efforts were introduced to counter terrorist narratives, including through the development of counter or alternative narratives (both online and offline). Although many of these initiatives have shown promising results, the research community has continued to emphasize the need to build-in comprehensive monitoring and evaluation, for greater transparency, and for these initiatives to more effectively integrate gender and to be human rights compliant.

Despite the recent decline in terrorist violence, many of the underlying grievances and contributory factors remain, and the cohort of terrorist actors is significantly larger than when the decade began. This has led researchers to conclude that the "war on terrorism" is not over, but entering a new phase.

Foreign Terrorist Fighters (FTFs)

Although the foreign terrorist fighter (FTF) phenomenon was not new, the past decade saw an unprecedented number of FTFs from across the world travel to Iraq, the Syrian Arab Republic and Libya between late 2011 and 2016. Smaller numbers of FTFs were, and continue to be, located with terrorist groups in South and South-East Asia and North, West and East Africa.
The scale and diversity of those who travelled - in terms of nationality, age, gender, motivation for travel, and experience in the conflict zone – meant that for many Member States, FTFs were perhaps the most significant counter-terrorism issue of the past decade, driving changes to national and international counter-terrorism architecture and impacting a wide range of thematic policy areas.
Although their most immediate impact was felt within those conflict zones - where FTFs exacerbated the conflict and were responsible for extreme acts of violence - FTFs also impacted their countries or regions of origin, playing a central role in globalizing the terrorist threat.
Studies indicate that FTFs helped build connections between the ISIL core and its growing number of affiliates outside the conflict zones (notably in South-East Asia), and created innovative attack methodologies, including “virtual planning”, with FTFs often central to the domestic activities of those who, post-2015, found it increasingly difficult to travel to the conflict zones.
As the scale of the challenge posed by FTFs became apparent, the international community took steps to respond, driven by Security Council Resolution 2178 (2014), which instructed Member States to criminalize a range of FTF-related conduct, adopt enhanced border-control measures to prevent FTF travel, and improve information-sharing at the national, regional and international levels. Some Member States also began to introduce a range of administrative measures to prevent individuals from travelling, while a small number took steps to deprive certain FTFs of their nationality.
From 2015 onwards, when military operations began to curtail ISIL’s activities and control of territory in Iraq and the Syrian Arab Republic, the attention of the policy and research community turned to the likely return or relocation of FTFs and their accompanying family members, including large numbers of children born in the conflict zones.
Security Council Resolution 2396 (2017) added a range of requirements for Member States, focused on potential FTF return or relocation, including the introduction of advance passenger information/Passenger Name Records (API/PNR) systems and watch lists, alongside longer-term, comprehensive responses. These included the introduction of gender-sensitive prosecution, rehabilitation and reintegration (PRR) strategies in response to the multiple and overlapping roles played by women associated with ISIL, who provided direct support through fundraising, recruiting, and online propagandizing, but were often both victims and perpetrators.
Despite fears that FTFs would return or relocate en masse, their short-term impact has so far been less significant than many anticipated. However, despite the collapse of ISIL’s so-called Caliphate, by late 2019, a sizeable proportion of the surviving FTF contingent remained in the conflict zones (with most believed to be detained), and thousands of foreign ISIL-associated women and children are interned in camps in northern Syrian Arab Republic.
Looking ahead, researchers have identified several future challenges posed by those FTFs, their accompanying family members who remain in the conflict zones, and individuals who have already returned or relocated. These include:

  • Uncertainty regarding the fate of male FTFs currently detained in northern Syrian Arab Republic, with ongoing evidentiary and jurisdictional issues delaying attempts to extradite or prosecute them;

Trends in terrorist attack methodologies

The past decade has seen both the use of longstanding terrorist attack methodologies and the development of new methodologies, as terrorist actors have continued to innovate in response to counter-terrorism measures and technological developments.

Although terrorism is a global phenomenon, the vast majority of terrorist activity has continued to be concentrated within a relatively small number of conflict-affected countries. This concentration is reflected in the most prevalent tactics used by terrorist groups globally, with relatively easy access to weaponry and explosives resulting in a significant percentage of attacks using armed assaults or bombings, often against “hard” targets including military, police and government personnel.

Many of these methodologies were not new, but terrorist groups operating in conflict zones did innovate throughout the decade, with some of these innovations subsequently being adopted or adapted by terrorist groups and terrorists operating in more urban environments.

Research showed that between 2011 and 2017, a majority of Boko Haram suicide bombers were women. This tactic was increasingly used in combination with attacks against “soft” targets - including marketplaces, educational institutions and internally displaced persons (IDP) camps - with both women and girls used as attackers (often involuntarily), due to their ability to approach targets with less scrutiny from security forces.

Another example is ISIL’s commitment of significant time and resources to the development of weaponized unmanned aerial systems (UAS) between 2014 and 2017. The use of UAS by terrorist actors in attacks, in disruption, and for surveillance or propaganda purposes, is a potential issue of concern for Member States in the years ahead.

Terrorist attacks committed outside conflict-affected areas also demonstrated both continuity and innovation. Aviation, transport hubs and other critical infrastructure sites continued to be targets of terrorist attacks. There were several recurrences of the marauding, siege-like attack methodology used in the 2008 Mumbai attacks, and the decade was book-ended by two deadly attacks by extreme right-wing lone actors (in Oslo and Christchurch).

The decade began, however, with a 2010 attempt by Al-Qaida to move away from the directed plots that had typified much of the previous decade. The first two editions of Al-Qaida in the Arabian Peninsula’s Inspire online magazine provided supporters with instructions on how to “Make a Bomb in the Kitchen of Your Mom” and encouraged them to use vehicles as weapons. ISIL senior leadership shared similar messaging from late-2014 onwards, calling for the targeting of civilians using vehicles and knives.

These types of methodologies (which were increasingly used by ISIL or Al-Qaida-inspired attackers around the world in the second half of the decade) were also copied by extreme right-wing terrorists. These attacks were often carried out by lone actors with limited formal connection to a recognized terrorist group or network, making them more difficult to detect and resulting in increased scrutiny of the role of the Internet in enabling access to propaganda and instructional material.

The international community’s response to this diversification and amplification of terrorist threats was similarly broad. The Security Council and CTED provided guidance on better protecting both critical infrastructure and “soft” targets through public-private partnerships and the development of national risk assessments, with a more recent focus on specific types of target, including places of worship and sports events. Some States have also used physical architecture to minimize or deter certain attack types (notably the use of vehicles), while others have used regulatory or licensing measures to, for example, limit access to UAS.

Although Member States and the research community continue to seek to identify future shifts in terrorist methodologies - with 3D printed weapons, UAS and the user of cyber-attacks or AI all areas of potential concern – the past decade suggests that longstanding attack methods will also continue to be utilized, particularly where terrorists have easy access to weaponry and explosives.

Exploitation of ICT for terrorist purposes

Throughout the past decade, terrorists continued to use the Internet for three broad purposes: (i) to communicate with one another (for operational activities including attack planning, financing, and the sharing of training materials); (ii) to communicate with potential new recruits; and (iii) to communicate with a broader audience, including the media.

However, the past decade saw dramatic shifts (in both directions) in their relative ability to achieve each of these aims, and the relative resources devoted to each element. While these shifts were driven by terrorist decision-making and counter-terrorism responses, they were also influenced by the ongoing transformation in the relationship between the individual and the Internet, which became increasingly mobile, affordable, and secure.

It is therefore unsurprising that countering use of the Internet for terrorist purposes was one of the major policy issues for many Member States between 2010 and 2019, and a significant focus for the research community.

In contrast to the previous use of access-controlled web forums, communications couriers, and hard-copy distribution of messages and propaganda material by Al-Qaida, the exploitation of technological advancements (including the rise of ubiquitous encryption) and control of territory allowed ISIL to revolutionize how terrorists used the Internet.

During the middle part of the decade, terrorists’ exploitation of major social media platforms - notably Twitter – gave them direct access to a global audience. Their propaganda often dominated global news cycles, and FTF recruiters were able to interact with interested individuals, radicalizing, recruiting and facilitating both travel and attack planning.

The brazen nature of this activity, and indications that ISIL’s online activities had helped mobilize both travel to the conflict zones and numerous terrorist plots, led to a significant and global response, with innovative public-private partnerships at its heart. CTED, through its Tech against Terrorism initiative, and with the Global Internet Forum to Counter Terrorism (GIFCT), helped to develop mechanisms enabling technology companies to share “fingerprints” of terrorist material - leading to its blocking or removal - and established processes for improving engagement between private companies and law-enforcement agencies.

These initiatives complemented those of some regional bodies (particularly in Europe) and Member States, but this issue also drove other more repressive policy responses. New offences were introduced, including for accessing or possessing terrorist propaganda, and some States used terrorist events or threats as a pretext for blocking access to specific material, entire technology platforms, or the entire Internet, raising serious human rights concerns.

Despite progress achieved in removing ISIL or Al-Qaida-related material from mainstream online platforms, significant challenges remain.

Research suggests that technology companies have been slower to respond to the rise of extreme-right wing terrorist movements, which continue to use smaller platforms, including those explicitly established to protect free speech. This trend, and frequent shifts by ISIL or Al-Qaida-affiliated individuals to new or small platforms (often driven by law-enforcement or coordinated policy responses), have limited access to terrorist propaganda and networks, but may also make it more difficult for Member States to seek to remove material or monitor relevant activities.

The end of the decade also saw increasing innovation in the use of the Internet for terrorist purposes, with several terrorist attacks by extreme right-wing lone actors being live-streamed, and the footage and their manifesto being subsequently stored and re-shared, highlighting some of the challenges relating to the proliferation of file sharing/storage services.

In response, several Member States have taken steps to regulate how private companies respond to the removal, retention and sharing of terrorist material on their platforms. Research suggests that this trend will continue, raising further concerns regarding the human rights and ethical risks of outsourcing State responsibilities to private companies (each of which has its own definitions, approaches and rules regarding transparency).

Looking ahead, use of the Internet for terrorist purposes is likely to persist as a significant policy concern and a focus for the research community, including within the framework of the GIFCT’s GNET initiative. Terrorists and terrorist groups will continue to rely on the Internet to communicate with and to their multiple audiences, and researchers suggest that they will therefore continue to innovate and find new methods or platforms to do so.

Human rights impacts

Both terrorism and counter-terrorism continued to have a significant impact on human rights throughout the past decade, with the global intensification of terrorist violence - including widespread and systematic human rights abuses – followed by enhanced counter-terrorism responses, often with human rights-related impacts.

ISIL was responsible for human rights abuses on an unprecedented scale in Iraq and the Syrian Arab Republic, including potential war crimes that included widespread sexual and gender-based violence, mass killings, crimes against humanity, and genocide.

Although ISIL’s use of sexual slavery and trafficking of persons - especially women and minors – was widely reported, this did not result in a substantial response, with the United Nations Secretary-General repeatedly highlighting the lack of prosecutions by Member States for ISIL’s crimes of sexual violence. By the end of the decade, victims of ISIL’s sexual crimes were still waiting, not only for justice, but also for the necessary support to survivors, including lifting sociocultural stigma, health care, psychosocial support and reparations for survivors.

ISIL and other terrorist groups - including both ISIL and Al-Qaida affiliates - engaged in the kidnapping and brainwashing of youth and children, especially girls, recruiting them into conflict and abusing them as perpetrators. Children and youth were also targeted in terrorist attacks on, or terrorist threats against, educational establishments, resulting in thousands of children being denied their right to education.

Simultaneously, State actors were also responsible for human rights abuses or overreach, with overly securitized counter-terrorism responses, including instances of extrajudicial killings, the use of torture, enforced disappearances, arbitrary detention, and other forms of unlawful deprivation of liberty. Serious human rights challenges were posed by the use of overly broad definitions of terrorism and violent extremism; intrusive or expansive CVE programmes with adverse human rights impacts; and other infringements on fundamental rights, including the right to privacy, nationality and freedom of conscience and religion.

These often occurred in the context of other human rights abuses, including mass killings, forced displacement, internment of civilians, and the persecution of dissidents. Human rights experts called attention to a global shrinking of civil society space, resulting in part from repressive counter-terrorism measures, reprisals against human rights defenders, and a backlash against human rights principles and organizations.

These trends raised concerns that such responses were not only in breach of Member States’ human rights obligations, but could also fuel or create new grievances, leading to a cycle of radicalization and reprisal. The Security Council continued to emphasize that counter-terrorism measures cannot succeed without ensuring human rights and dignity for all, including ex-combatants.

The proliferation of violence by non-State actors in the counter-terrorism context also led to renewed discussion of the parameters of international law (including international humanitarian law) in determining an appropriate legal framework for military intervention, protection of vulnerable populations, and ensuring justice for victims of human rights abuses.

The potential misuse of emerging technologies (both by States and by terrorist elements) was another area with significant human rights implications. The past decade saw the use of new technologies to conduct mass surveillance and enable the collection of biometrics and metadata on an unprecedented scale, opening up new frontiers for potential human rights violations, including threats to the rights to privacy, freedom of association and movement and, in some instances, freedom of expression and religion.

The international community took steps to address some of these concerns, with CTED (in collaboration with other United Nations agencies) issuing the United Nations Compendium of Recommended Practices for the Responsible Use and Sharing of Biometrics in Counter-Terrorism

Although the use of big data, AI and biometrics promise potentially significant counter-terrorism benefits, it is also likely to raise significant human rights concerns, particularly with respect to privacy and data protection. Managing these risks will be a key part of developing a comprehensive approach that seeks to address the root causes of violence and radicalization, reduce grievances (including in relation to human rights violations), and provide victims of terrorism with justice and the necessary support.


The Counter-Terrorism Committee Executive Directorate (CTED) launched its Global Counter-Terrorism Research Network (GRN) in February 2015. The GRN - which now brings together over 100 leading research institutions from across the globe - helps CTED keep abreast of emerging terrorism trends, and to identify and share good practices in the implementation of the relevant Security Council resolutions by Member States.

GRN members and other researchers with research relevant to CTED are encouraged to contact us at

Reading List


Short reads

Long reads

Visit the CTED Facebook page
Follow CTED Twitter
Visit the research focus page on the CTED website
Email us
Forward to a friend


If you have any questions about the research included in this Digest or about the Global Research Network, please contact
Copyright © 2020 United Nations Counter-Terrorism Committee Executive Directorate, All rights reserved.

Want to change how you receive these emails?
You can update your preferences or unsubscribe from this list.