The following is derived from “The Logic of Rampage Terrorism,” recently published in Studies in Conflict and Terrorism. The authors would like to thank Daniel Lebowitz, Jacob Ware, attendees of the 2023 U.S. Military Academy at West Point Security Seminar, and reviewers from Studies in Conflict and Terrorism for their feedback.
Around 7:58 p.m. on March 22, 2024, four gunmen entered the Crocus City Hall in Krasnogorsk, Moscow Oblast, Russia, and started shooting. For about 20 minutes, the attackers moved through the entertainment complex, killing civilians gathered to hear Soviet-era rock group “Picnic.” Russian authorities claimed 143 people died and that 11 people were arrested, including the four gunmen. The Islamic State Khorasan claimed responsibility for the attack, which American intelligence confirmed.
This attack bears hallmarks of a distinct subset of terrorist threats: rampage terrorism. Rampage terrorism involves assaults wherein assailants are physically present, harm targets of opportunity, and continue until they are subdued, killed, give up, or otherwise choose to end the aggression. Rampage terrorism includes methods such as mass shootings, vehicle rammings, and stabbings. Such attacks, low in operational costs, pose significant challenges due to their spontaneous nature and minimal logistical requirements. In addition to the Crocus City Hall incident, notable examples of rampage terrorism include the 2016 tragedy at the Pulse Nightclub in Orlando, where 49 lives were lost in a mass shooting, and the dual assaults in Norway in 2011, where a car bomb in Oslo was followed by a mass shooting at a youth camp, culminating in 67 deaths.
The Logic of Rampage Terrorism
Rampage terrorism allows terrorists to conduct attacks without investing significant resources, with instruments readily available to them—such as firearms, knives, vehicles, and the like. Rampage attacks do not necessarily require either sophisticated organizational structures with well-defined roles that law enforcement can penetrate and disrupt, or sophisticated technologies and technical know-how. Often, minimal preparation is necessary. For example, Mohamed Lahouaiej-Bouhlel, the perpetrator of the July 14, 2016, vehicle attack in Nice, France, appears to have become radicalized and planned his attack only a few weeks prior. The attack killed 86 people and injured 450.
Rampage attacks let terrorists combat their ideological enemies directly. Rampage terrorists might see themselves as warriors fighting a righteous war. Numerous terrorist, insurgent, and general historical conflict narratives promote the idea of the warrior fighting for a noble cause. In Dominic Behan’s famous Irish rebel song written for his father Stephen, a former member of the Irish Republican Army, Behan writes, “Come out ye’ black and tans! Come out and fight me like a man!”—the “black and tans” referring to the notorious British soldiers recruited to the Royal Irish Constabulary to fight in the war of Irish independence. Rampage terrorists may see themselves as carrying on this tradition, fighting their adversaries “like a man,” instead of hiding behind bombs or other remote weapons. Further, the ubiquity of cell phones, social media, and 24/7 news coverage means the rampage may be captured and disseminated across the globe in real time. The attacker can inspire others through the real or perceived heroism of risking one’s life for the cause.
Tactically, terrorists who fight their adversaries head-on can be flexible and adapt to defensive measures. In July 2016, Michael Xavier Johnson attacked police officers at El Centro College in Dallas, Texas, possibly based on support for black nationalism and anger over police shootings. Johnson consciously moved between shooting positions to convince police officers there were multiple shooters. At one point, he broke a glass door in a failed attempt to enter the college building—instead, he took a different entrance, resulting in a multi-hour standoff with police, until a robot-mounted explosive killed him.
The flip side of tactical flexibility is uncertainty and risk, which can mean an attack may end prematurely. In May 1984, Corporal Denis Lortie stormed the Quebec Parliament, intending to kill members of the National Assembly but instead shooting several staff members. However, the parliament’s Sergeant-at-Arms, Rene Jalbert, talked him down, and Lortie surrendered to the police. At times, terrorists engaging in rampage attacks have received special training to reduce the risk of premature disruption. Islamic State recruits were given the option of becoming regular fighters, suicide bombers, or “Inghimasi.” The Inghimasi received special training as commando forces to stay alive as long as possible and maintain momentum during an attack. Even if the attack does not end prematurely, the inevitability of the attackers, victims, and bystanders capturing portions of the attack on cellphones and posting to social media increases the likelihood of terrorists being identified and caught. Russian claims to have caught the four suspects of the Crocus City Hall attack, three of whom reportedly confessed, are plausible. However, the evidence of torture and claims of Ukrainian involvement cast some doubt on those confessions.
Terrorist organizations may face challenges in sustaining rampage attacks due to the high risk of capture or death, necessitating a renewable pool of operatives for continued operations. The arrest of Anders Breivik, responsible for the 2011 attacks in Norway, effectively neutralized his “group.” While his actions might motivate future assailants, Breivik’s influence over their strategy, operations, or tactics ceased with his capture. Conversely, terrorist groups with substantial manpower and logistical support, such as Hamas, demonstrate the capability to execute multiple, extensive rampage attacks. The October 7, 2023 coordinated assault on Israel involved a widespread campaign against civilians, highlighting Hamas’s ability to absorb significant operational losses due to its large number of fighters.
Countering the Rampage
Since September 11, 2001, law enforcement and counter-terrorism officials have rightly placed significant emphasis on characterizing and disrupting terrorist plots and organizations, including support networks providing financing, recruits, and propaganda. However, the unique characteristics of rampage terrorism make the phenomenon difficult to prevent. A terrorist needs no support structure to simply grab a knife off the kitchen table and set out to inflict violence. At the same time, law enforcement and security agencies would have minimal opportunity to identify, intercept, and disrupt the attack. Instead, law enforcement should focus on countering influencers and building civil defense and resilience.
Law enforcement officials and civil society can and should target individuals, media outlets, and social forces that encourage or enable rampage terrorism. For example, the Yemeni branch of al-Qaeda encouraged readers to carry out vehicle ramming attacks in the 2010 issue of Inspire magazine. Rampage attacks are sustained only as long as the terrorist keeps fighting, so law enforcement officials should work to improve response times through community engagement, better analysis of rampage targets, greater law enforcement presence, and improved physical defense. In the aftermath of attacks, community leaders, law enforcement, and policymakers should aim to support social resilience and a return to normalcy in order to limit the strategic benefits to terrorists. There is not much glory in dying for a cause if society ignores it.
Terrorists have adopted rampage terrorism as a tactic for centuries. Practitioners and scholars need to better understand how and why the phenomenon occurs and how best to counter it.
Zachary Kallenborn is the Lead Researcher at Looking Glass USA, a counter-drone consultancy and investment firm. He is also affiliated with the Center for Strategic and International Studies (CSIS), the Schar School of Policy and Government, the National Institute for Deterrence Studies, and the National Consortium for the Study of Terrorism and Responses to Terrorism (START).
Gary A. Ackerman is an Associate Professor and Associate Dean for Research in the College of Emergency Preparedness, Homeland Security and Cybersecurity at the University at Albany (SUNY), where his research focuses on assessing emerging threats and understanding how terrorists and other adversaries make tactical, operational, and strategic decisions, particularly regarding innovating in their use of weapons and tactics.
Herbert Tinsley is a Ph.D. student at the School of Government and Public Policy at the University of Arizona. He is pursuing research on professionalization and innovation in non-state militant groups, with particular interest in those phenomena’s effects on organizational dynamics and uses of terrorism.
Main Image: Crocus City Hall, Moscow (Photo by Artyom Svetlov via Wikimedia)
The views expressed are those of the author(s) and do not reflect the official position of the Irregular Warfare Initiative, Princeton University’s Empirical Studies of Conflict Project, the Modern War Institute at West Point, or the United States Government.
If you value reading the Irregular Warfare Initiative, please consider supporting our work. And for the best gear, check out the IWI store for mugs, coasters, apparel, and other items.
Leave a Reply