Terrorism is a number of things: It is deadly, costly, constant, evolving, local, regional, global and unrelenting. Finally, terrorism is real.

Yet terrorism faces two major vulnerabilities: finance and communications. These two elements underscore the importance
of transforming financial intelligence into one of the most powerful weapons in the fight against terrorism. To maximize
effectiveness in counter-terrorist efforts, anti-money laundering/counter-terrorist financing (AML/CTF) professionals in the public and private sectors must identify and exploit relevant financial intelligence. In order to leverage such information, AML/CTF professionals must understand the threat environment, who is behind the threat, in what capacity, and how funds are being raised, moved, stored and spent.

The fight against terrorism has never been more important because the gravest threat AML/CTF professionals face is the threat from within their own homelands.

Terrorist Threats in the New Decade

The first year of a new decade is an opportune time to place the current terrorist landscape in the U.S. in perspective by studying the evolution and devolution of the threat environment over the last 10 years. By extension, the terrorist
risks applicable to the U.S. are applicable to most other countries, especially countries aligned with the U.S. In 2020, the most significant terrorist threats are foreign terrorist organizations (FTOs), homegrown violent extremists (HVEs) and
domestic violent extremists (DVEs).

FTOs are Islamist jihadist groups, driven by a warped ideology. HVEs are individuals who adapt the Islamist ideology of the FTOs and are inspired, enabled and/or directed by an FTO. DVEs adapt ideological goals from domestic biases, most notably white supremacy and the hate it spews. DVEs can generally be classified into five categories: racially motivated violent extremism, which is the most acute DVE threat; anti-government/ anti-authority extremism; animal rights/environmental extremism; abortion extremism; and other categories or sources of threat to include involuntary
celibates (also known as incels) and political extremism.

How Did FTOs, HVEs and DVEs Become the Greatest Current Terrorist Threats?

At the beginning of 2010, al-Qaida was the primary threat to national security. Other threats of concern were HVEs and
domestic terrorist groups. However, the dawn of the Arab Spring in 2011 began the devolution of al-Qaida. This decline was
further exacerbated by the death of Osama bin Laden.

As the Arab Spring gained momentum in 2012, al-Qaida further devolved. This led to the emergence of al-Qaida affiliate
groups, which were more regional threats. 2012 also saw a growing threat nexus between transnational criminal organizations and terrorist groups. 2013 led to the emergence of the Islamic State of Iraq and al-Sham (ISIS) as a significant threat. That threat intensified in 2014, when ISIS declared the establishment of a caliphate in Iraq and Syria. From 2014 through 2017, ISIS continued to evolve into a more prominent terrorist threat. During this time, ISIS amassed considerable wealth, further enhancing their level of threat. In addition, a significant number of foreign fighters migrated from their home countries to Iraq and Syria to join ISIS.

As ISIS began to devolve and lose territory, as a result of an offensive conducted by the U.S.-led coalition, there
was an exodus of foreign fighters returning to their home countries. This became a growing domestic security threat for many countries, particularly in Europe, Asia and Africa. Meanwhile, the U.S. and many countries were particularly concerned by the growth of the HVE threat through internet recruitment.

Prioritizing the threat posed by ISIS, returning foreign fighters and HVEs diverted resources from and lowered the priority of domestic terrorism. Unfortunately, deadly domestic right-wing terrorist attacks continued and the phenomenon of the internationalization of domestic terrorism, through internet and social media channels, flew under the radar of many intelligence agencies between 2014 and 2017.

During 2018, ISIS continued to devolve, but al-Qaida began to re-evolve. ISIS and al-Qaida aspired to attack the U.S. and U.S. allies, but they lacked the capacity. The national security threat emphasis in the U.S. and several other countries was on HVEs. In 2018, it became clear that DVEs, especially lone offenders, presented serious threats in numerous countries. In 2019, ISIS lost their caliphate entirely and devolved back to an insurgency group. In addition, their leader Abu Bakr al-Baghdadi was killed. Al-Qaida continued to re-evolve as a threat but suffered a setback when their emerging leader, Hamza bin Laden, son of Osama bin Laden, was killed. Nonetheless, ISIS, al-Qaida and other Islamist terrorist groups continued to pose serious security problems. At this point, HVEs and DVEs were recognized as more significant threats to national security in many nations.

The terrorist landscape over the last decade sets the backdrop for the current terrorist threat environment. ISIS and al-Qaida still present formidable threats and each aspire to carry out large-scale terrorist attacks in the U.S. However, both groups have devolved from the organizational strength and capability they possessed in their prime and neither has the capacity to launch significant attacks against the U.S. homeland. Because there are a large number of FTOs to be concerned with, the broader threats of FTOs (beyond ISIS and al-Qaida) should be considered more equal priorities in the immediate future. The more significant terrorist threats from within domestic boundaries now come from HVEs and DVEs.

The Internationalization of Domestic Terrorism

Over the last two years, more attention has been focused on domestic terrorism. This has been driven by the increase in
DVE lone offender active shooter incidents, not only in the U.S. but also in many countries around the world.

There has been an internationalization of domestic terrorism. Around the world, likeminded DVEs communicate with each
other through the internet and via social media platforms. They share their hate and tradecraft online. Before acting out,
many DVEs post their written manifesto online for others to build on or replicate. Many DVEs consider their manifesto to be their legacy—a way to memorialize their terrorist act. In some instances, DVEs even travel to other countries to train with other DVEs.

A troubling example of the internationalization of domestic terrorism can be drawn by examining five domestic attacks in four countries. The first inspired the second, which, in turn, inspired the next three. The first attack occurred in
July 2011 in Oslo, Norway. It was a two-stage attack where a DVE killed 77 victims and wounded hundreds more. In the first stage, the DVE detonated a bomb near a government building in Oslo. From there, he went directly to an island 20 miles away where a youth leadership conference was taking place. The DVE went on a 90-minute shooting rampage until he was apprehended by a SWAT team. The second attack took place in March 2019 in Christchurch, New Zealand. The DVE attacked and killed congregants at two mosques. The next attack was in April 2019 at a synagogue in Poway, California. The following attack took place in August 2019 at a Walmart in El Paso, Texas. The final attack was in October 2019 at a synagogue in Halle, Germany.

The links between all five domestic terrorist attacks were the manifestos of the DVEs, starting with the Oslo manifesto. While it was extremely long and convoluted, the Oslo manifesto inspired the Christchurch DVE to write a simplified version as his own manifesto. This then became the bible for the Poway, El Paso and Halle DVEs. Fearfully, the Oslo DVE and Christchurch DVE manifestos most likely inspired other attacks and will likely inspire more in the future.

As noted at the outset of this article, to maximize effectiveness in the fight against terrorism, relevant financial
intelligence must be identified and exploited. In order to leverage such information, AML/CTF professionals must understand the threat environment, who is behind the threat, in what capacity, and how funds are raised, moved, stored
and spent.

FTOs should be likened to corporations and assessed through the lens of their business model

What is the Current Threat Environment?

FTOs, HVEs and DVEs are the highest priority threats. HVEs and DVEs possess both similar and vastly different individual traits. While they are both driven by radical hateful ideologies, those ideologies differ in that HVE ideologies originate from international causes espoused by FTOs, whereas DVE ideologies are rooted in domestic issues.
One similarity is that both HVEs and DVEs tend to radicalize online. FTOs exploit the internet to recruit HVEs, while DVEs use the internet and social media to establish contacts and share best practices with likeminded radicals around the world, thus globalizing domestic terrorism. The ideology and threat generated by FTOs is from outside the homeland and
centered at the core of the FTO in a safe haven generally well offshore in Middle Eastern countries with weak governance
where the FTO can operate with impunity. Although international, they aspire to attack within U.S. and allied country
borders. HVEs operate within domestic boundaries in their homeland. They are driven by the FTO’s ideology and aspire to
carry out attacks in the homeland in the name of the FTO. DVEs are inspired or associated with domestic-based movements espousing domestic violence.

Who is Behind the Threat?

Are these groups or individuals? With FTOs, that means organizations and individuals within the organization. FTOs should be likened to corporations and assessed through the lens of their business model. Individual members of an FTO should be assessed as employees—each has a definable role. Such roles include leaders, facilitators, fundraisers, recruiters, couriers and fighters. HVEs are individuals who are radicalized by and adapt to the ideology of FTOs. Once
recruited, they are inspired, enabled or directed by the FTO to commit a terrorist act in the HVE’s home country. Most HVEs are lone actors. In some instances, they will form cells with likeminded HVEs. In regard to DVEs, they are more inclined to be lone actors, who likely interact with other likeminded DVEs through online platforms. In some instances, DVEs will be members of groups. The greatest threats from HVEs and DVEs are from those acting as lone offenders because it is less likely they are known to law enforcement (LE).

In What Capacity?

Capacity should be assessed in two dimensions. First, what is the capacity of the FTO, HVE or DVE to succeed? Second,
how would an FTO, HVE or DVE interact with the public? This question is particularly relevant for financial institutions (FIs) that could facilitate the flow of funds for any of these groups. With regard to FTOs, do they have the financial and operational ability to sustain their organization and carry out attacks? Having a broad funding base, membership and training facilities enhances their capacity. With regard to HVEs, they usually radicalize at home, lack military training and do not have the opportunity to travel to an FTO training camp. Such individuals will probably lack the capacity to carry out large-scale attacks. This is where many HVEs get detected. In their desire to commit more grandiose acts, they communicate online with likeminded HVEs to carry out these plans. Invariably, these perceived brothers or allies are undercover FBI personnel.

Unfortunately, it does not take much capacity to use knives, handguns and motor vehicles to carry out more small-scale successful HVE attacks, which are encouraged by FTOs. With regard to DVEs, they will more likely be lone offenders with some level of firearm proficiency or familiarity. They will also be more inclined to follow the manifestos of likeminded DVEs who carried out successful shooting attacks at soft targets like religious venues, schools, shopping malls and other less secure venues.

How Are Funds Raised, Moved, Stored and Spent?

In order to succeed, terrorists require funds. Whether it is $1 or $1 million, terrorists have to be able to raise, move, store and spend money.

For FTOs, the process will likely be more complex, involving a greater flow of funds in terms of volume and velocity. FTOs require extensive funding to sustain their operations. In considering an FTO a corporation and assessing it from a
business model perspective, income (the source of funds) must equal or exceed expenditures to sustain the FTO’s operations. Sources of funds flowing to FTOs include proceeds from a wide range of criminal activity including but not
limited to legitimate commercial enterprises; private donations; and abuse or misuse of nonprofit organizations and state sponsors.

For FTOs, raising, moving, storing and spending funds involves three funding streams. The first funding stream is money that flows into the organization. The funding in this first stream will range from a few dollars to millions of dollars
and will require considerable bandwidth. The second funding stream is from the organization to operations. The funding in
this second stream will range from a thousand to many thousands of dollars. The third funding stream is from the operational component of the organization, generally through facilitators, to operatives to pay for activities and operations. The funding in the third stream will range from hundreds to thousands of dollars. The complexity of organizational funding flows will ultimately involve a traceable stream and require the use of formal and informal financial mechanisms. Therefore, there will be a trail that creates financial intelligence.

Most HVE and DVE activities require minimal funding. HVEs inspired by FTOs are most likely self-funded. HVEs enabled
by FTOs could receive FTO guidance or funding but are also most likely selffunded. Finally, HVEs directed by FTOs are
more likely to receive funding from the FTO but they could also be self-funded. DVEs, under most circumstances, will be
self-funded. Sources of funding for self-funded HVEs and DVEs include employment compensation, government entitlement money, and money from family or proceeds from criminal activity. Most HVEs and DVEs will have bank accounts. Transactional activity will be normal or routine and not raise suspicion until they commit a terrorist act or are arrested after having been identified by LE before committing a terrorist act. Although there will be financial intelligence, it will probably be more fragmented and more difficult to identify.

Conclusion

FIs serve as the key repository for financial intelligence and LE is one of the primary consumers of financial intelligence. The bridge for FIs and LE to share financial intelligence effectively is through meaningful and sustainable public-private sector partnerships. Whether at a national or local grassroots level, partnerships that facilitate the exchange of information lead to more robust financial intelligence. In actuality, there are numerous examples of substantive public-private partnerships, in many countries, that enhance financial intelligence. Fighting money laundering
and terrorist financing is an inherently reactive process. The more that can be done to develop proactive initiatives and
“urgently” reactive responses to address terrorism, the better professionals can defend their national security. Financial
intelligence is pivotal to this process.

As daunting a task it is to identify terrorist financing, it is possible to do so. Finance is one of the biggest vulnerabilities confronting terrorists. FTOs, members of FTOs, HVEs or DVEs, all require funding and share some degree of financial vulnerability. Financial intelligence is the key weapon to exploit the financial vulnerability of terrorists and the best sources for financial intelligence are FIs. Developing proactive and reactive methodologies to identify and exploit financial intelligence is a powerful tool in the fight against terrorism. In order to leverage such information, AML/CTF professionals must understand the threat environment, who is behind the threat, in what capacity, and how funds are raised, moved, stored and spent. When LE and FIs establish public-private partnerships to exchange information in a sustainable and timely manner, the potential for identifying more robust and meaningful financial intelligence is enhanced thereby increasing the probability as well as improving the possibility of identifying and disrupting terrorist financing.

Dennis M. Lormel, CAMS, internationally recognized CTF expert, president & CEO, DML Associates LLC, Lansdowne, VA, USA, dlormel@dmlassocllc.com