What does terrorism monitoring miss before an attack? What happens before violence that conventional terrorism monitoring may not capture?
The most visible symptom of a terrorist monitoring is following a terrorist event. When violence has happened, it is reported, the perpetrators identified and analysts start asking what and why. In many cases, however, the information which explains an attack is much subtler, and occurs much earlier.
Moroccan police in July 2026 said they have arrested ten people linked to Islamic State in the Sahel Province (ISSP) which is reportedly planning attacks in Morocco. Items found included weapons, instructions for making bombs, chemicals, digital material and equipment for an attack, authorities said. The authorities also said that the plans of the cell were at a high level.
The case is notable for several reasons: First, an attack was prevented, and second, this case provides a good example of the process that can unfold before an attack occurs. It is possible that all these activities – from the recruitment phase to the online communication, access to materials, contact with extremist networks and travels between conflict areas – might become parameters. These may not be one security event but when taken in total, they can create a picture of the changing threat landscape.
The reason it is important to ask “what happened?” in any act of terror makes it all the more important to ask this question. It should also reflect on its own question – what is happening around it?
This is not the case in North Africa. The U.N. evaluation concluded that the militant threat in North Africa is still in some respects “somewhat limited” because of the measures taken to counter the group, but added that “radicalisation on the Internet, particularly targeting minors” is also a worry. During the same period, Moroccan authorities have disrupted four plots and the majority of arrests for the period were made in Morocco due to exposure to online content by terrorists and the desire to travel to regions of conflict, in particular the Sahel-Saharan region, the same assessment showed.
The developments illustrate that it is necessary to value individual events in a regional framework.
The link between North Africa and Sahel is particularly significant. In recent years, armed groups in the Sahel have developed new tactics, expanded their geographic footprint, and adopted new technologies. In 2026, the number of incidents in Africa attributed to the IS has increased to 86 per cent of recorded incidents globally, from 79 per cent the previous year, while incidents in the Middle East, Europe and Asia accounted for the remaining incidents.The group’s activity in the Islamic State had risen to 86 percent of its activity across the world from 79 percent recorded in 2025, and the rest had been in the Middle East, Europe and Asia. It also observed that JNIM is now employing armed drones much more frequently than before, rising from less than 10 strikes in 2024 to approximately 80 strikes in 2025.
These should not be seen as a direct threat to North Africa from all the developments in the Sahel. They do, however, highlight the fact that regional monitoring is not always achievable according to national lines.
For analysts focused on North Africa, it may also be important to watch a situation in neighboring Mali, Niger, or Burkina Faso, where some militant groups, recruitment networks, propaganda, financing and movement can cross the border. Meanwhile, the presence of a regional connection doesn’t necessarily imply that an attack is imminent. Here, it’s important to carefully analyze.
The meaning of the smaller indicators can be hard to understand without interpreting them in relation to the larger ones. An arrest can be a positive result in a security response, not a result of an escalation of threat. A propaganda message can effect thousands of people, and not have any effect at all on recruitment. There can be multiple causes of a suspected movement across a border. If you take everything that is happening as some sort of warning, then you can come to certain incorrect conclusions.
It is important to note that the usefulness of monitoring is not to foretell all attacks. The patterns and changes that needs should be explored for are noticed.
Language also matters. The primary security information in the region of the Middle East and North Africa could appear in Arabic or French language publications, official announcements or local media. The information from these sources can include information not immediately available in International English-language media on arrests, court proceedings, local population reactions, and security operations. The analysts can gain a clearer picture by analysing these sources, as well as international reporting.
This is also applicable to security cooperation. INTERPOL declared, in September 2026, Operation Phoenix, which focused on Algeria, Jordan, Morocco, Palestine and Tunisia in the field of border security. More than 700,000 checks were made against INTERPOL databases to yield 48 arrests – eight of which were for individuals subject to INTERPOL Red Notices – in the operation. On the other hand, during the operation, travel documents, mobile phones, cash and other illegal items were seized.
Again, it wasn’t a single terrorist attack. It was a police sting. But, it offers information on the reaction of states to cross-border threats and the areas where authorities see gaps.
That’s where ongoing monitoring can come in handy. The arrest of one may not provide you with much information. In the long term, changes in use of online, new recruitment methods, increased border crossings, and altered tactics of militants can be detected and have more significance in a rolling series of arrests.
The actual issue for the analysts is which signals do they follow and which do they dismiss, to prevent them from following too many prediction signals. This involves checking sources, checking local and international reporting, knowing the regional context, and distinguishing between confirmed information and assessment.
The major attacks will be given the greatest attention as they have the most immediate human and political repercussions. But 1D thinking of such events results in a lack of understanding. The things that can contribute to an attack can have occurred by the time you are having the attack.
Often the most helpful question is not “What happened today?” but rather “What happened in the last several weeks or months?”.