What Do Closed Source Data Tell Us About Lone Actor Terrorist Behavior? A Research Note

ABSTRACT This article contributes to the growing body of knowledge on lone-actor terrorism with the incorporation of closed-source data. The analyses presented investigate the antecedent behaviors of U.K.-based lone-actor terrorists leading up to their planning or conducting a terrorist event. The results suggest that prior to their attack or arrest the vast majority of lone-actor terrorists each demonstrated elements concerning (a) their grievance, (b) an escalation in their intent to act, (c) gaining capability—both psychologically and technically and (d) attack planning. The results also disaggregate our understanding of lone-actor terrorists in two ways. First, we compare the behaviors of the jihadist actors to those of the extreme-right. Second, we visualize Borum’s (2012) continuums of loneness, direction, and motivation. Collectively the results provide insight into the threat assessment and management of potential lone actors.


Introduction
Recent reviews of the literature demonstrate terrorism studies is becoming increasingly empirical. 1 Much of the empiricism on offender-oriented studies derives from opensource data collection endeavors. 2 For example, lone-actor terrorist research spans issues such as motivation, 3 capability, 4 radicalization pathways, 5 sociological and/or behavioral profiles, 6 attack planning, 7 and mental disorder. 8 Closed source restricted data have yet to inform such analyses beyond single case studies. 9 Noted terrorism expert, Marc Sageman warns that open-source analyses may be flawed in the absence of detailed, privileged data from police and intelligence sources. 10 Sageman's assumption is that privileged access will uncover additional layers of nuance and a closer understanding of causality than could be inferred from open-sources. We put this to the test by replicating a previous study of open-source study of lone-actor terrorists. 11 This research note utilizes closed-source data which incorporates police and intelligence files and interviews with practitioners familiar with the cases. The analyses presented investigate the antecedent behaviors of U.K.-based lone-actor terrorists leading up to their planning or conducting a terrorist event. The results suggest that prior to their attack or arrest the vast majority of lone-actor terrorists each demonstrated elements concerning (a) their grievance, (b) an escalation in their intent to act, (c) gaining capability for violence in different ways and (d) attack planning. The results also disaggregate our understanding of lone-actor terrorists in two ways. First, we compare the behaviors of the jihadist actors to those of the extreme-right. Second, we visualize Borum et al.'s continuums of loneness, direction, and motivation. 12 Collectively the results provide insight into the threat assessment and management of potential lone actors.
Lone-actor terrorist radicalization, and attack planning Our later analysis primarily focuses upon behavioral indicators related to lone-actor terrorist radicalization and attack planning. The following two sub-sections summarize the existing knowledge on these two areas.
The focus of available studies on lone-actor terrorist radicalization varies across studies. Individual case studies and small-n approaches examine biographical trajectories which, in turn, develop broad typologies or models. 13 While informative as a first approach to the phenomenon, these studies tend to be descriptive rather than explanatory and the external validity of their conclusions is limited. Other studies examine the ideological narratives that promote lone actor terrorism, 14 the radicalizing materials lone-actors accessed 15 and the first-hand writings of lone-actor terrorist manifestos. 16 Such approaches help explain the strategic orientation of movement leaders, the materials the offenders consume, as well as the psycholinguistic markers of the perpetrators themselves (compared to control and comparison groups).
Other studies utilize larger-n open-source datasets. 17 While a significant improvement in terms of generalizability, the findings often remain descriptive. In the absence of control groups, the data is unsuitable for causality claims. 18 These analyses are largely concerned with behavioral indicators, some of which have found themselves included in various threat assessment tools 19 and informing other areas of practice. 20 These types of studies largely focus on perpetrator characteristics, and their association with the attack target 21 and its location. 22 Research on radicalizing settings receives much less attention with the exception of the online space. 23 Collectively, these analyses point toward the lack of a consistent profile although the following can be discerned (a) a relatively high rate of prior criminal records, distal risk factors and proximate stressors (b) a significantly higher rate of particular mental disorders 24 (c) a greater reliance on the online space than group terrorists (d) distinguishable differences between ideological sub-group 25 (e) varying degrees of social embeddedness with physical and virtual radicalized milieus 26 and (f) similarities with analogous types of offenders such as school shooters. 27 Within the relatively small body of literature on lone-actor terrorism, the specific subjects of attack preparation and planning, and of attack commission, have received even less dedicated attention. Research on the characteristics of lone-actor attacks is distinctly limited in size and scope with a general focus on what weapons were used and who was targeted; suggesting that this may differ from group terrorists in content and lethality. 28 Research further suggests lone actor attacks are "rarely sudden and impulsive." 29 Although planning and preparation is common, it varies across offenders. 30 Studies suggest a general low level of sophistication characterizing the weapons and methods utilized in lone-actor attacks which are driven by a variety of ideological motives. As Bakker and De Graaf (2010) have argued, lone actor attacks are characterized by a "wide variety in target selection, use of weapons and modus operandi" *(4).
In terms of indicators of an attack developing, research demonstrates the high degree to which others not connected to the plot had some level of awareness of the offender's plans, 31 the importance of the internet as an online learning environment, 32 hostile reconnaissance 33 and weapons acquisition.

Sample
The sample includes forty-nine individuals who engaged in or planned to engage in loneactor terrorism 34 within the United Kingdom between the years of 1995 and 2015. These individuals were ultimately charged and convicted for a spectrum of offenses under U.K. Terrorism Act legislations but their behavior must have involved the active plotting or commission of a violent terrorist act.
There are no shortages of competing definitions and terms for what constitutes lone-actor terrorism. As Gill 35 notes: "Even for a field as disunited in its discussion of definitions as terrorism studies is, I doubt there is a subject that has so little written about it as lone actor terrorism that maintains such a wide repertoire of potential terms and definitions." Since this is a replication of procedures of Gill et al., we utilize the same definitions and include lone-actor terrorists, solo-terrorists, and isolated dyads. 36 As such, the inclusion criteria match other expansive interpretations of what constitutes lone-actor terrorism. 37 Lone-actor terrorists operate autonomously and independently of a group (in terms of training, preparation, and target selection etc.). In some cases, the individual may have radicalized toward violence within a wider group but left and engaged in illicit behaviors outside of a formal command and control structure. Solo terrorists on the other hand are trained and equipped by a group-which may also choose their targets-but attempt to carry out their attacks autonomously. Isolated dyads include pairs of individuals who operate independently of a group. They may become radicalized to violence on their own (or one may have radicalized the other), and they conceive, develop, and carry out activities without direct input from a wider network. 38 The expansive inclusion criteria was inspired by both practical concerns of enriching our sample size and future research involving comparing these three sub-types once a sufficient sample size for each is collected.

Data collection and analysis
The list of variables coded were previously developed by other open-source research endeavors. 39 The initial codebook was developed based on a review of literature on individuals who conduct a wide range of violent and/or high-risk behaviors as well as a review of other existing codebooks used in the construction of terrorism-related databases. The variables included in the codebook span socio-demographic information (age, gender, occupation, family characteristics, relationship status, occupation, employment, etc.), antecedent event behaviors (aspects of the individual's behaviors toward others and within their day-today routines), event-specific behaviors (attack methods, who was targeted) and post-event behaviors and experiences (claims of responsibility, arrest/conviction details, etc.). Additional questions were added for the purposes of this article. They spanned additional areas of operational interest and other matters that arose after a number of the cases had been analyzed. In the instances where questions were developed following initial case analysis, the original cases were then re-examined to determine answers to the new questions. Each behavior can be objectively measured and there is little to no subjectivity in terms of how the variable questions were crafted (e.g. questions like "to what extent … "). This codebook is available upon request from the first author.
The project was initiated by Counter Terrorism Policing North West who sought to validate and enrich existing open-source research on lone-actors conducted elsewhere before it could be operationalized. 40 Counter Terrorism Policing North West is part of the National Counter Terrorism Police Network in the U.K. It has responsibility for counter terrorism policing in the North West of England. The project had national overnight as it was part of the National Counter Terrorism Police Network's response to the threat from lone-actor terrorism in the U.K.
The two lead authors (both full-time academics) devised the codebook and coding procedures based on previous open-source data collection endeavors. 41 The sample was identified by sifting through all cases that had been charged with planning/committing acts of terrorism in the United Kingdom. The included cases were identified jointly by both the academics and practitioners engaged in the project. No cases were excluded if data was available. The two lead authors provided coding training to the individuals tasked with collating and coding the data. These coders were full-time intelligence researchers who are paid law enforcement personnel and employed by the national police counter terrorism network and housed at Counter Terrorism Policing North West. The unit's Detective Superintendent mandated the coders to work on the project based on their academic backgrounds and skillsets. These coders collected and coded the data from information contained in police data files, psychological reports (when available), interviews with case officers, intelligence reports, court reports, investigative interviews, telecoms, biographical data, and first-hand statements for further context within each case. These data sources are unprecedented in the academic study of terrorism in the U.K. Once each case was completely coded, it was cross-checked for validity by two of the practitioner coauthors of this research note. Once verified, the data was then deidentified, scrubbed of identifying information and handed over to the two lead authors for the analysis that follows.
For the descriptive analysis, where possible, we do report or distinguish between missing data and "no" answers, but it should be kept in mind that the likely result is that "no" answers are substantially undercounted in the analysis. In the comparisons among lone actors based on their ideologies, we treat each variable in the analysis dichotomously (e.g. the response is either a "yes," or not enough information to suggest a yes). Unless otherwise stated, each of the below reported figures are of the whole sample (49 individuals).

Basic demographics
The lone-actor terrorist sample is heavily male-oriented. In total, 87.8% are male. All six females were classified as being jihadist-inspired as opposed to being extreme right-wing ideologues. 69% were single individuals who had never married. A few (6.1%) were in relationships but had not yet married. A fifth (20.4%) were married, and a further 4% had either separated from their spouse or were divorced (2%).
In total, approximately a quarter (24.3%) never completed secondary education. A further 36.7% completed secondary education. Just over a fifth (22.4%) experienced some form of university education, with 6.1% holding an undergraduate degree as their best educational achievement, and a further 2% holding a Masters, and 2% holding a PhD. In sum, there is a generally even distribution across the spectrum of educational achievement.
Examining employment patterns highlighted disproportionately high levels of unemployment (46.9%), with a further 14.3% still engaged in full time education. Unemployment rates within the United Kingdom between 1995 and 2015 fluctuated between 5% and 8.5%. Just over a quarter of the sample became unemployed just prior to their attack planning. The remaining third of the sample were employed and this was mainly concentrated within the service industry (18.4%). Related to these employment patterns, 18.4% of actors experienced financial problems, and 22.4% changed address within the five years prior to their terrorist event planning or execution. Also of note within the sample, 16.3% of individuals had been employed within a military entity. Of this subset, only one individual had remained within the army at the time of their attack/arrest. All of these experiences point toward the necessity of examining dynamic factors within the individual's life at the time they become exposed to, or incentivized to act for, an extremist ideology. Often this exposure and action-orientation occurs at a time when their life is in flux, under a period of change or after the loss of a protective factor or environment.
Criminal and illicit activities 46.9% of the sample had previous criminal convictions. Approximately half of these individuals served prison time. Offenses included criminal damage, possession of indecent images, fraud, theft, possession of an offensive weapon, assault, driving offenses, drug offenses, robbery, drunk driving, drunk and disorderly, blackmail, affray, and forgery. Within this subset, 30.6% had been arrested as juveniles. Of the full sample 44.9% had previously engaged in violent behaviors. Unlike contemporary studies that allege some form of sinister "crimeterror" nexus, 42 our interpretation is that lone-actor terrorism is often just the latest manifestation of a criminal career and/or violent past. As with other "vulnerability" indicators, the relevance of a single factor's presence differs from case to case. For some in the dataset, their "ordinary" criminal career preceded prison-the site of their exposure to a radicalizing message. For others, their "ordinary" criminal career involved violence (see below) and perhaps a self-selection for other violent activities (in this case terrorism).
More than a fifth (22.4%) had a history of substance abuse. Within the sample, 28.6% of individuals engaged in what the coding analysts deemed deviant sexual behaviors or interests. This includes factors such as extreme sexual practices, sexual-trophy gathering, possession and viewing of child and/or animal pornography, sexual harassment of elderly females, and indecent exposure. Many of the lone actors therefore engaged in "extreme" activities in parts of their life and parts of their history that had nothing to do with their ideological outlook and belief system.

Mental health
Just less than a third (32.7%) had a history of mental illness or personality disorder. In the vast majority of these cases, the diagnosis had been made before the individual engaged in terrorism-related activities. One third of those with a history of mental illness (10.2% of the full sample), were diagnosed with schizophrenia. A further third (12.2% of the full sample, were diagnosed with a mood disorder). The rest were an assorted collection of personality disorders (2%), intellectual disabilities (4.1%) and unknown. These confirm earlier findings regarding the elevated level of mental disorders, especially schizophrenia, within lone-actor terrorist samples compared with national base rates. 43

Ideological justifications
The lone-actor terrorists in our sample had a range of ideologies. Religiously inspired lone actors constituted the largest subset at 51%. Those inspired by right-wing ideologies constitute the second largest group representing just under a third of the total sample (30.6%). The remaining cluster is made up of individuals driven by nationalist ideas (unrelated to the extreme-right wing), left-wing and other single issue causes.

Awareness of intentions
In the majority of cases, other individuals knew something concerning some aspect of the offender's grievance, intent, beliefs, or extremist ideology prior to the event or planned event. In 26.5% of cases, the offender produced letters or public statements prior to the event outlining his/her beliefs (but not necessarily his/her violent intent). This behavior was largely confined to extremist forums. In 83.7% of the cases, other people were aware of the individual's grievance that spurred the terrorist plot, and in 87.8%, other individuals were aware of the individual's commitment to a specific extremist ideology. In 59.2% of the cases, family and friends were aware of the individual's intent to engage in terrorism-related activities because the offender verbally told them. These figures only include individuals that were recipient of this information and did not, as far as we could tell, hold sympathetic views toward the grievance or ideology. Recipients included an imam, a son, friends, work colleagues, wives, sisters, and school friends. In many cases, these individuals did not understand the relevance of the information that they had or what they should do about it.
For 63.3% of the sample, there was an identifiable bystander to the individual's planning/ preparation behaviors. These are typically individuals who witnessed concerning behaviors (e.g. seeing the offender looking at bomb-making manuals at work) but were not privy to the individual's specific plans and were also not sympathetic to the individual's goals. In 73.5% of cases, the offenders expressed a desire to hurt others. This desire was communicated through either verbal or written statements. These findings suggest therefore that friends and family can play important roles in efforts that seek to prevent terrorist plots. Of those who were married or in a relationship, half had spouses or partners who were members of a wider network associated with the ideology that inspired the lone-actor terrorist. Finally, in 10.2% of the cases, the individual provided a specific pre-terrorist event warning.
There is also evidence to suggest that others were aware of the individual's disposition but not necessarily their intent. In 61.2% of the cases, the offender was characterized by close friends/family as an angry individual. Within this subsample, there is a suggestion that the offender's anger was noticeably increasing.

Pre-event behaviors
This section provides an overview of our findings concerned with the behaviors the individual engaged in prior to the terrorist event or planned event. A small proportion (6.1%) of the total sample converted to a religion before engaging or planning to engage in an event. The religiosity of 32.7% of the jihadi-inspired lone-actor terrorists noticeably increased in the buildup to their terrorist event or planned event (e.g. through a change in religious observance, dress, etc.). In a similar vein, 44.9% of the full sample's adherence to their ideology also intensified. 51% of actors actively screened out narratives that would dismiss their beliefs (e.g. ignoring, blocking, deleting information that went against their perspective).
At least 57.1% of the full sample was characterized as suffering from long-term sources of stress, and 40.8% were characterized as being under a recently elevated level of stress. The results highlighted this stress may have been due to a number of reasons that may have served as a catalyst for the subsequent intended violence. At least 24.5% of the sample felt degraded by others, 32.7% felt like victims of an injustice and half felt disrespected in some way. Many individuals (42.9%) demonstrated worsening work performance, and 12.2% dropped out of education before their attack or planned attack. Again, these point toward the need to understand dynamic risk within the context of the individual's routine activities and how they may act as a force multiplier for the subsequent radicalization by lessening individual resilience.
Falling in line with other research on lone actors, more than half of actors (55.1%) were characterized as socially isolated, with 32.7% of individuals withdrawing or changing their social activities prior to their attack or apprehension. Linked to this finding, 12.2% adopted their radical ideology when living away from home in another town, city, or country, and at least 30.6% lived alone at the time of their event planning and/or execution.
On occasion, lone-actor terrorists experienced problems with personal relationships. In these cases, social isolation was not a long-standing occurrence but instead was derived from more recent inter-personal conflict. For example, 71.4% experienced problems in close personal relationships (e.g. family, romantic relationships). At least 18.4% of the full sample experienced being ignored or treated poorly by someone important to them in the months to their terrorist event or planned event. Additionally, 26.5% experienced someone important demonstrating that they did not care about the individual in the buildup to their offense.

Links to a wider network
One in six actors (16.3%) sought legitimization from religious, political, social, or civic leaders prior to the event they planned. A similar figure (14.3%) had previously engaged in fundraising or financial donations to a wider network of individuals associated with either licit pressure groups or illicit groups who espoused violent intentions. Alongside this, many had family members or close associates known to have been involved in political violence (32.7%) or criminality (53.1%). There was also evidence of less direct interactions. 34.7% of actors made online postings citing aspirations to copy other terrorists, 87.8% read or consumed literature or propaganda from a wider movement, and 28.6% read or consumed literature or propaganda concerning other lone-actor terrorists.
Importantly, 42.9% of the sample had moved beyond these interactions, to join a wider group, organization or movement that engaged in contentious politics. Many of these groups engaged in legal activities but shared similar ideologies to those the lone actor used to justify planning or conducting his/her terrorist activity. Around a third (30.6%) characterized their actions as associated with a wider group or movement or claimed to be part of a wider group (e.g. they possessed ISIS flags, posted allegiances to certain terrorist group leaders or movements online, referred to their actions as being on behalf of particular groups in claims of responsibility or police statements). Just over half (51%) interacted face-to-face with members of a wider network and a larger number (59.2%) did so virtually. There is evidence to suggest that some (8.2%) displayed wider command and control links specifically associated with the violent event that was planned or carried out. Two of the actors had been either rejected or ejected from a wider network or group.
In terms of the planning of the terrorist event itself, there is evidence that others were aware of the offender's specific intent of engaging in terrorism-related activities. In over a third of the cases (38.8%) the lone actor had tried to recruit others or form a group prior to the event. In 77.6% of cases, other individuals possessed specific information about the lone actor's research, planning and/or preparation prior to the event itself. And in nearly a quarter of cases (22.4%), other individuals were involved in procuring weaponry or technology that was used (or planned to be used) in the terrorist event but did not themselves plan to participate in the violent actions.

Attack and plot related behaviors
Training for the plots typically occurred through a number of ways. Some (20.4%) noticeably increased their physical activities and outdoor excursions in the build up to their terrorist event. 16.3% received some form of hands-on training, while 81.6% learned through virtual sources (a mixture of textual and video sources). In 71.4% of cases, investigators found evidence of bomb-making manuals within the offender's property. In 34.6% of the cases, individuals created a safe space to conduct their planning/preparatory behaviors. This included bedrooms, hidden cupboards, garages, and separate flats to the family home. The fact that much strategic and tactical planning goes into lone-actor terrorist events is demonstrated by the finding that 38.8% of offenders engaged in dry-runs of their intended activities (also since not all of the sample had chosen a specific target at the point of the disruption, this finding would likely be even higher if we excluded those who did not manage to actualize their violent plans). Around a third of these individuals recorded their reconnaissance attempt, and 44.9% became progressively secure in their planning activities (for example increasingly used encryption as the plot developed). All of these behaviors point toward detection opportunities and insight into what constitutes a step-change in the risk for violence (as opposed to risk for vulnerability or risk of radicalization).

Comparing subgroups of lone-actor terrorists
The descriptive analysis of the data illustrates that there is no reliable profile of a loneactor terrorist. In this section we examine specific subgroups of lone-actor terrorists to explore whether the individual characteristics and behaviors of lone-actor terrorists differ across ideological groups. The two most prevalent ideologies held by members of our lone-actor terrorist dataset were right-wing, and jihadi-related ideologies. In Table 1, we outline the major differences in individual characteristics and antecedent event behaviors associated with lone actors who held these ideologies. The jihadist cohort were significantly more likely to withdraw from social activity, express a desire to hurt others, and become progressively more secure in their planning activities. They were also more likely to also be unemployed and experience a work-related stressor. Right-wing inspired individuals were significantly more likely to engage in face to face interactions with coideologues and later express regret about their actions. They were also more likely to experience feelings of inadequacy, live alone, have joined a wider group or movement.
The results therefore suggest that while many indicators may be just as likely in both cohorts, there are crucial differences which could impact counter-terrorism practice. For a start, it might demonstrate that some violent extremist risk assessment tools may be better placed to look at one particular ideological sub-group than the other. The differences in inter-group contact (e.g. through encrypted communications vs. face-to-face gathering) may also necessitate different approaches to intelligence enrichment (e.g. human intelligence vs. signals intelligence).

Lone-actor terrorist continuums
Borum et al. make the case that instead of debating definitions, it may be more useful to view each key feature along a continuum. 44 "Analyzing cases by their features, rather than by their types, might better aid the investigative process, particularly if each dimension is linked to a key facet of the attack and tracked across the spectrum of attack-related activity from idea to action." 45 Borum et al. forward three such features; loneness, direction, and motivation. Loneness measures independence of activity. The loneness continuum plots the degree to which offenders received assistance in initiating planning, preparing for, and executing the attack. Direction measures the level of autonomy the lone actor displayed in decision-making. It plots the degree to which the offender received instruction or guidance on issues concerning whether to attack, what to target and the attack type to deploy. The motivation continuum plots the degree to which the action is ideologically or personally driven. Borum et al. make the case that very few offenders will be placed on the extremes of a continuum but are likely to be found somewhere between the polar opposites.
We put this theorizing to the test by plotting each of our lone-actor terrorists on a three-dimensional space. Each offender was assigned a score for each of the three continuums. We adapted Borum et al.'s continuums slightly to make a finer distinction between the loneness and direction continuums. For the loneness continuum, we included behaviors related to the degree to which the individual had prior contact with co-ideologues prior to the plot's inception as well as whether others were aware a plot was being developed. Basically, the loneness continuum captures the degree to which bystanders may have noticed something in the individual's violent radicalization trajectory. Each behavior is coded dichotomously (e.g. it either occurred or did not occur) and not coded in terms of intensity (e.g. subjective interpretations of how often these occurred) due to data constraints. Note the same is also true for the direction and motivation continuums. For the loneness continuum, we included behaviors such as whether or not the individual (a) raised finance for a wider movement (b) had recently joined a wider pressure group or movement (c) made verbal statements to others about their intent to commit violence (d) expressed intentions to hurt others (e) had other individuals in their close social network involved in violent activity for a group/cause (f) had a spouse involved in a wider group/cause (g) engaged in face to face interactions with co-ideologues (h) engaged in virtual interactions with co-ideologues (i) attempted to recruit others (j) was rejected from a wider group/movement (k) an identifiable bystander was aware of the individual's planning/preparation. For each behavior carried out by the offender, they received 1 point. For each continuum, the maximum score is 10 points so each point is worth ten divided by the number of indicators per continuum. Those scoring high here are therefore not very lone, those scoring low are very lone (until the point of plotting).
The direction continuum looks at the degree of external help/coordination/direction provided from the point of plot inception to the point of the attack (remember that to be included in this dataset they needed to carry out or plan to carry out the attack alone). We included behaviors such as whether or not the individual (a) sought legitimization from epistemic authority figures for their attack (b) received training (c) learned aspects of their attack from virtual sources (d) downloaded bomb-making manuals (e) other individuals procured the weaponry on their behalf (f) other individuals helped build the IED for them (g) others had knowledge about the attack planning (h) displayed evidence of command and control links. For each behavior carried out by the offender, they received 1.25 points.
At one end of the motivation continuum are those individual's that are purely ideologically motivated. At the other end are those purely motivated out of personal grievances. We included behaviors such as whether they (a) directly communicated a stated ideology (b) wrote letters/publications espousing an ideology (c) made verbal statements to friends/ family about their ideology (d) had other people be aware of their grievance (e) had other people be aware of their extremist ideology (f) consumed propaganda from a wider group/ movement (g) claimed the attack on behalf of a group (h) became increasingly focused on their ideology prior to the attack (i) screened out narratives dismissive of their beliefs. They received 0.909 points if any of these behaviors were apparent. They were deducted 0.909 points if either of the following behaviors were apparent (a) a recent stressor or (b) chronic stress. The motivation scale therefore initially ran from −1.818 (personally motivated) to 7.27 (ideologically motivated).
We were then left with scores for each offender across each continuum. As an illustration, the first observation in the dataset scored 4 on loneness, 5 on direction and 5.45 on motivation. The second scored 3, 0 and 1.81 on the same continuums.
For the below visualizations, we computed the motivation scores to resemble the 0-10 scale in the other two continuums. Figure 1 plots all lone-actor terrorists on the three dimensional space. The results highlight the diversity of lone-actors across these three simple continuums. The average score on the loneness continuum was 4.04. Some individuals did score very highly with one fifth of the sample scoring 6 points or more. While one individual scored 0 (indicating complete loneness), one individual scored 9 (demonstrating that although he/she conducted or planned to conduct the attack alone, much of the radicalization happened in a very social setting). The average score on the direction continuum also approached 4 (3.97) but with outliers on both ends of the spectrum. Two individuals scored 0, indicating a complete autonomous direction whereas one individual scored 10. The average motivation score was 4.47 indicating that many of the individuals were halfway on the political vs. personal motivations spectrum. Although Figure 2 depicts a large cluster of individuals low on both the Loneness and Direction continuums, a great deal of outliers spring from that cluster in every direction. This neatly visualizes the diversity of behaviors within our sample.

Discussion
This article focused on forty-nine lone-actor terrorists and the behaviors that underpinned the development and/or execution of their plots. There were no uniform variables that characterized all, or even a majority of the lone-actor terrorists in terms of their demographic characteristics. Thus, no clear profile emerged from the data, validating the work of Gill et al. 46 Even if such a profile were evident, however, an over-reliance on the use of such a profile would be unwarranted because many more people who do not engage in lone-actor terrorism would share these characteristics while others might not but would still engage in lone-actor terrorism.
The results highlight that in the time leading up to most lone-actor terrorist events, other people generally knew about the offender's grievance, extremist ideology, views and/ or intent to engage in violence. These findings suggest that friends, family, and coworkers can play important roles in efforts that seek to prevent or disrupt lone-actor terrorist plots. In many cases, those aware of the individual's intent to engage in violence did not report this information to the relevant authorities. It is important therefore to provide information to the wider public on the behavioral indicators of radicalization to violence as well as appropriate outlets for this information to be reported and subsequently investigated. In any event, this finding may have significant implications for the development of operational investigations. Indeed, most of the variables related to others having knowledge of the lone actor's views and intent were far more common across lone actors than any sociodemographic characteristics. This implies that lone-actor terrorists should largely be characterized by what they do rather than who they are.
Behaviorally, the lone-actor terrorist sample was also diverse in terms of the degree to which they were alone in their radicalization, received direction in their planning, and the degree to which they were ideologically fueled and/or personally aggrieved. Many of the sample regularly engaged in a detectable and observable range of activities with a wider pressure group, social movement, online or terrorist organization. Much of the concern regarding lone-actor terrorism stems from the particular challenges of detecting and intercepting lone-actor terrorist events before they occur. Though they vary significantly in their effectiveness, there is a common perception that lone-actor plots are virtually undetectable. The traditional image of a lone-actor terrorist is that of an individual who creates his/her own ideology, and plans and executes attacks with no help from others. Our findings suggest however that many lone-actor terrorists regularly interact with wider pressure groups and movements either face-to-face or virtually. This suggests that traditional counter-terrorism measures (such as counter-intelligence, HUMINT, interception of communications, surveillance of persons etc.) may have applicability to the early detection of certain lone-actor terrorists at specific moments in their pathway toward violence. While the signals may not be as strong or numerous as group-based plots, they are present. Additionally, the results demonstrate the need for communities and partner agencies to be more aware of indicators of radicalization and extremist behaviors. People do not know what they do not know. One of the main challenges will be to reduce the taboo and stigma associated with reporting suspicions of terrorism. This could involve conceptualizing this as a safeguarding issue (in the same vein that child sexual exploitation, trafficking and domestic abuse has done) rather than a religious or ideological one.
In terms of indicators, the vast majority of lone-actor terrorists each demonstrated elements concerning (a) their grievance, (b) an escalation in their intent to act, (c) gaining capability-both psychologically and technically and (d) attack planning.
With regards to grievance, the authors coded at least eight relevant behaviors that indicated an individual held one. These covered issues such as whether the individual published letters or other posts outlining the grievance, made verbal statements to friends and family, made verbal statements to wider audience, whether others were aware of the grievance, whether others were aware of their extremist ideology, whether others were aware the individual's anger around the grievance was escalating, whether a bystander was apparent, and whether the individual experienced a recent stressor. Of these eight factors, all but three individuals displayed at least two, with twenty-eight lone-actors displaying five or more of these factors.
Moving to escalation in their intent to act, again at least eight behaviors were coded. These include whether others noticed an intensification of the individual's ideological and or religious orientations, whether the actor reached out to epistemic authority figures regarding the legitimacy of their plan, if they denounced others, expressed an intention to hurt others, communicated with co-ideologues either face-to-face or virtually, or screened out influences that ran counter to their ideology. All but six of the lone-actors displayed two or more of these behaviors. Half of the lone actors displayed four or more of these behaviors.
We looked at nine behaviors relevant to building the psychological and/or technical capability for an attack. These included receiving training, using virtual sources, withdrawing from other social activities, downloading bomb-making manuals, engaging in foreign travel, being involved in violent behavior previously, trying to recruit others, increasing their security as the plot develops and maintaining a safe space. All but two individuals displayed two or more of these characteristics. Half displayed four or more behaviors.
For attack planning, the authors examined seven behaviors, including whether the actors issued a warning about an impending attack, conducted hostile reconnaissance, acquired the necessary materials for the attack, received help in procuring weaponry or building the IED, others had knowledge of the attack plans, and whether the individual displayed command and control links. All but three individuals displayed more than one behavior here. Half displayed three or more of these behaviors.
In total, six of the lone-actors appear to be outliers in terms of how few indicators they demonstrated, scoring 8 or lower (the average across the sample was 15 out of 32). Given the fact the researchers worked with deidentified data, it is difficult to assess why this might be the case but it certainly warrants greater attention.

Conclusion
This research has presented a preliminary empirical investigation into forty-nine U.K. based lone-actor terrorists. This research is novel as it is the first empirical research the authors are aware of that uses closed source data to examine the behavior of loneactor terrorists. The results highlight important indicators which may be useful to prevention and disruption initiatives. The results also provide validation for research findings that utilized open source information. This study replicated broadly similar prevalence rates as identified in others with more expansive open-source data collection efforts. 47 Each of these cited open-source data collection initiatives conducted strict contingency procedures during collection, coding, reconciliation, and analysis. As such, we might conclude that outcomes from open source data, when properly collected and handled, may be of more worth than commonly perceived. This might only be true in the lone-actor domain however, where openly available data tends to be far richer than that of group-based plots or terrorist-related activities that did not produce convictions (e.g. those who successfully traveled to Syria to fight for ISIS). Open-source data collection initiatives also offer the bonus of replicability of process (compared to replicability of outcome) which is difficult to conduct within a completely closed-source data collection protocol. Collating closed-source data was an onerous and time-consuming task and surprisingly more complex than comparable open-source initiatives. Each U.K. police force maintained their internal data and reporting systems in idiosyncratic ways and this slowed the merging of data into a single repository. However, closed-source data did provide a more granular insight into aspects concerned with leakage, bystanders, and radicalizing behaviors which allowed for a deeper dive into particular questions and behaviors of interest.
Moving forward, more research should focus on how these behaviors are sequenced in order to get an empirically-sound sense of how these radicalization pathways look in practice. We have also only examined whether particular behaviors occurred or not measured the scale or intensity of these behaviors. This warrants "intensity" of behavior being a central dependent variable for future research and necessitates the development of validated scales and inter-coder reliability tests to measure and weight such behaviors. This was, unfortunately, beyond the parameters of this initial study. The holy grail for validated risk assessment factors will absolutely need data on prevalence rates of these key behaviors from different samples including (a) a nationally represented sample and (b) a sample of individuals who warranted sufficient concern to be fully investigated by police and intelligence but were deemed low risk. In the absence of access to such data, validated putative risk factors for terrorist involvement will remain elusive.
Data collection should also continue given the knowledge yield in particular areas (like leakage) where the finer detail is often lost in open-source narratives. It could also be worth widening the scope toward indicators of traveling to theaters of jihad.

Disclosure statement
No potential conflict of interest was reported by the authors.