Definitions: What is terrorism? (Updated 3/2/18)
The Active Intelligence Database team has elected to utilize the operating definition of the Global Terrorism Database, a database maintained by the National Consortium for the Study of Terrorism and Responses to Terrorism at the University of Maryland, which is as follows:
“The GTD defines a terrorist attack as the threatened or actual use of illegal force and violence by a non-state actor to attain a political, economic, religious, or social goal through fear, coercion, or intimidation. In practice this means in order to consider an incident for inclusion in the GTD, all three of the following attributes must be present:
-The incident must be intentional – the result of a conscious calculation on the part of a perpetrator. -The incident must entail some level of violence or immediate threat of violence -including property violence, as well as violence against people. -The perpetrators of the incidents must be sub-national actors. The database does not include acts of state terrorism.
In addition, at least two of the following three criteria must be present for an incident to be included in the GTD:
Criterion 1: The act must be aimed at attaining a political, economic, religious, or social goal. In terms of economic goals, the exclusive pursuit of profit does not satisfy this criterion. It must involve the pursuit of more profound, systemic economic change.
Criterion 2: There must be evidence of an intention to coerce, intimidate, or convey some other message to a larger audience (or audiences) than the immediate victims. It is the act taken as a totality that is considered, irrespective if every individual involved in carrying out the act was aware of this intention. As long as any of the planners or decision-makers behind the attack intended to coerce, intimidate or publicize, the intentionality criterion is met.
The definition in it’s whole, as well as the rest of the details on the GTD methodology, can be found in the Global Terrorism Database Codebook.
The R2P AID team feels the need to include further clarifications for the purposes of the AID specifically:
We code only acts of violence, and not threats of violence, as terrorist attacks. Ultimately, we believe that terrorism’s violation of the state monopoly on the use of force is most characterized by violence itself. Moreover, the proliferation of online cyberthreats and intimidation makes this measurement difficult to operationalize, which makes geographically and chronologically categorizing this data disjoint from the measure of violence.
While our definition does not include attacks done in support of broad goals like profit or territorial gains, small scale operations with these objectives in support of broader goals meeting the definition of terrorism may be included. For example, an anti-system terrorist group looting a village to continue its campaign would be included as an attack.
Our definition does not include violence as the result of military operations perpetrated against such groups, only those instigated by the groups themselves. Because circumstances, timing, and location are chosen by security forces rather than the group, the target logic would be misconstrued in the data entry. Moreover, understanding group strength and goals can only be interpreted by their actions of their own accord.
While the GTD Codebook notes that civilian targeting is the most typical violation of international humanitarian law, the R2P AID team would note that this includes not only civilian targeting, but further violations of Geneva Convention rules and other humanitarian law, which may include actions such as mutilation, torture, the taking of hostages, a lack of uniformed combatants, and the coercion of individuals into acting as combatants.
Terrorism ultimately concerns actions and not groups. Thus, certain groups can perpetrate actions that both fulfill as well as do not fulfill the definition of terrorism. This means that actions including policing of governed territory or efforts to gain control of cities or regions may not be included for some groups, but other attacks by those same groups may be included.
Data Input methodology (Updated 3/1/18)
The Code of an attack is an organizational tool for R2P. The code consists of the date of the attack preceded by a number (XX) assigned according to when the researchers received reports of the attack (in form XX.DD.MM.YYYY). The assigned number XX is not reflective of when in said day that the attack occurred.
The Date of an attack is the day when the attack began. It is stored in form of DD.MM.YYYY.
The City of an attack is the town or city in which an attack occurs. In some large cities or municipalities, this may be coded as the specific village or neighborhood if it raises the specificity of the input. Blank City inputs reflect either that the city of an attack is unknown or that the attack occurred too far from an appropriate population center to warrant the assignment of the attack to the city, for example on major roads or in extreme rural areas.
The District of an attack reflects the sub-province or sub-state level in which an attack occurred. A blank District input is used in countries where this level of organization is not used. Even in cases where countries use alternative terms for these secondary sub-national government regions, the second level of organization is coded in the District input.
The Province of an attack reflects the governate, province, state, or governing region in which an attack occurred. Even in cases where countries use alternative terms for these primary sub-national government regions, the first level of organization is coded in the Province input.
The Country of an attack reflects the country in which an attack occurs.
The Killed input reflects the number of individuals killed in the attack. Individuals who are injured by the attack and later succumb to their wounds are coded in the Killed input. Reports that note purely numbers of injured are assumed to have produced no deaths and the Killed input is coded as “0”. Because of the rapid and conflicting nature of news updates, the reported numbers of Killed may vary in individual news reports. In the spirit of maintaining a flow of information, the R2P team performs their best judgement in deciding which number to report, including timeliness and source credibility. Higher level analyses by government institutions or more meticulous research groups should be consulted before reporting these statistics as a final authority.
The Injured input reflects the number of individuals killed in the attack. Individuals who are injured by the attack and later succumb to their wounds are coded in the Killed input. A blank Injured input reflects uncertainty over the presence of injured people from the attack, especially when reports do not report on injury numbers. A “0” in the Injured input reflects one of two possibilities: either the report explicitly notes that there were no injuries, or the nature of the attack suggests that injuries were not a possibility, such as in an assassination. Because of the rapid and conflicting nature of news updates, the reported numbers of Injured may vary in individual news reports. In the spirit of maintaining a flow of information, the R2P team performs their best judgement in deciding which number to report, including timeliness and source credibility. Higher level analyses by government institutions or more meticulous research groups should be consulted before reporting these statistics as a final authority.
The Total Casualties input is a formula input that aggregates the Killed and Injured inputs in order to convey the total amount of people harmed in the attack. Blank inputs in either the Killed or Injured inputs are added as 0, which may undercount the total magnitude of the attack.
The Group input reflects the identity of the group considered to be involved in the attack, as reflected in the respective Attribution level. The identity of these groups are a result of the relevant news reports on the speculations and reports of governments and news agencies. Acts perpetrated by splinter or offshoot groups are coded as separate groups.
The presence of multiple groups in the Group input reflects one of three possibilities. In the event that the Attribution Level input reads “Disputed”, each group listed in the Group input have claimed responsibility for the attack. In the event that the Attribution Level reads “Suspected”, authorities or news agencies believe that the one or more of the groups were involved, but have not formally accused either group of perpetrating the attack. In the event that the Attribution Level input reads “Claimed”, each group responsible have claimed the attack as a joint effort.
The Attribution Level input reflects the confidence of attribution of the attack to the group listed in the Group input. In the event that the Attribution Level reads “Claimed”, the group listed in the Group input has publicly taken responsibility for the attack. In the event that the Attribution Level input reads “Disputed”, each group listed in the Group input have claimed responsibility for the attack. In the event that the the Attribution Level reads “Suspected”, governments or news agencies have reasons, based in either intelligence or experience, to believe that the group listed in the Group input perpetrated the attack. In the event that the Attribution Level reads “N/A”, there is no particular group currently suspected or claimed to have perpetrated the attack.
A note regarding attack claims. Often, many journalists or commentators note that attack claims do not seem credible. Because we as researchers do not believe we should code our biases of which evidence does and does not constitute a credible attack claim, we code an attack as “Claimed” as long as the claim goes through. Individuals are free to interpret these claims as they wish, but we will provide the information as such rather than insert our beliefs into our data.
The Weapon input reflects the weapon or weapons used in the attack. All firearms are coded as “Firearm” regardless of caliber or firing mechanism due to uncertainty and lack of detail often presented in large scale terror attacks. Any explosive that involves the death of the individual attacker in order to detonate is coded as “Suicide bomb”, regardless of the nature or size of the device itself. Any explosive with features created by individuals rather than mass manufacture is coded as “IED”, for Improvised Explosive Device. Any explosive considered manufactured and handheld/thrown is coded as “Grenade”. A self-propelled, manufactured explosive launcher, regardless of payload, is coded as “Rocket”. Any bladed weapon used to kill a victim is coded as “Knife”. Any explosive launched in an angular trajectory using gravity as a method of force is coded as “Mortar”. Any manufactured explosive triggered by physical contact is coded as “Landmine”. The combination of multiple weapons in the Weapon input means that each of those weapons was used at some point in the attack. However, the combination of multiple weapons in the Weapon input, as well as the “Unknown” input, indicate that the Weapon input is tentative and may be subject to change given future updates or information. The presence of only the “Unknown” input suggests that reports did not specify any type of weapon in the attack at all. Updates to this methodology may be added as terrorist tactics change or news reports release updated details.
A note regarding car bombs. Because some car bombs involve the suicide of the attacker while others do not, this requires an extra methodological step. A combination of a Weapon input of “Suicide bomb” and the Tag input of “Car bomb” indicates that a suicide bomber used explosives loaded in a vehicle for the attack. Meanwhile, a combination of a Weapon input of “IED” and a Tag input of “Car bomb” indicates that the attacker used a remotely detonated bomb placed inside a car, without killing themselves. A report discussing a car bomb is coded as an IED attack until a report notes that the attacker killed themselves. Single suicide car bombs are assumed to have a single attacker until a report explicates otherwise.
The Target Type input reflects the nature of the intended target of the attack, in a series of cascading tiers of classification. Targets may have multiple classifications along multiple tiers. Updates to this methodology may be added as terrorist tactics change or news reports release updated details.
T1 – Civilian: Targets relating to individuals unaffiliated with the political or security apparatuses of their respective countries.
T2 – Leader: Targets including any individual with a leadership role in a civilian group or organization. This can include business or social leaders who are considered informal leaders of their communities.
T2 – Official: Targets including individuals who work in civilian organizations or groups, but do not hold a leadership role. An example would be an aid worker.
T2 – Institution: Targets including buildings or locations central to the operation of a civilian institution or organization, such as aid groups or community meetings.
T2 – Religious: Targets which have significance or importance to a regional religious group, including places of worship or holy sites. This input, in combination with the “Official” or “Leader” inputs, reflects the targeting of an individual or group of individuals with that level of participation in a religious organization.
T2 – Infrastructure: Targets in which the goal of the attack involves a permanent site of high economic value for local civilian populations. This can include locations such as banks, schools, or other points of economic importance.
T2 – Displaced: Targets in which the attack harmed individuals displaced from their homes due to violence, including civilians in the act of fleeing violence. In the event that the Target Type input includes both “Displaced” and “Area” inputs, this reflects the targeting of a location meant to provide residence, support, or assistance to displaced populations.
T(2-3) – Area: Targets in which attackers assault a wide area of a settlement or village. This can also include open markets or gatherings.
T(2-3) – Vehicle: Targets in which the victims were in a stationary or moving vehicle at the time of the attack.
T(2-3) – Misc: Targets in which the nature of the target does not fit cleanly into any previous sub-classification.
T2 – Area: Targets in which attackers assault a wide area of a settlement or village. This can also include open markets or gatherings.
T3 – Vehicle: Targets in which the victims were in a stationary or moving vehicle at the time of the attack.
T3 – Displaced: Targets in which the attack harmed individuals displaced from their homes due to violence, including civilians in the act of fleeing violence. In the event that the Target Type input includes both “Displaced” and “Area” inputs, this reflects the targeting of a location meant to provide residence, support, or assistance to displaced populations.
T4 – Misc: Targets in which the nature of the target does not fit cleanly into any previous sub-classification.
T1 – Political: Targets relating to the governing body of a country or area.
T2 – Leader: Targets including any individual with a leadership role in a political organization, including both government agencies or political groups.
T2 – Institution: Targets including buildings, facilities, or meetings of political organizations or institutions.
T2 – Official: Targets including individuals who work in political organizations or government, but do not hold a leadership role. An example would be a tax collector.
T3 – Vehicle: Targets in which the victims were in a stationary or moving vehicle at the time of the attack.
T4 – Misc: Targets in which the nature of the target does not fit cleanly into any previous sub-classification.
T1 – Security: Targets relating to the internal or external security apparatus of the country in which the attack occurs.
T2 – Police: Targets relating to the police force of the country in which the attack occurs.
T2 – Military: Targets relating to the military or external security forces of the country in which the attack occurs.
T3 – Leader: Targets including any individual with a leadership role in a security organization or agency.
T3 – Base: Targets that include an attack against a security installation used to conduct operations for the respective security organization. This can include checkpoints as well as police stations.
T3 – External: Targets in which security personnel are away from base but still operational as security personnel. An example would be a unit on patrol.
T3 – Offsite: Targets in which the victims were not responsible for security operations or sited at a base at the time of the attack. Examples included security personnel at home with their families or eating a meal off base.
T3 – Vehicle: Targets in which the victims were in a stationary or moving vehicle at the time of the attack
T4 – Misc: Targets in which the nature of the target does not fit cleanly into any previous sub-classification. When used as a T2 input, this often means that the target is part of a non-state controlled security apparatus. An example would be an attack against a non-state armed actor in control of a certain area.
A note on IED and Landmine attacks. First, it is often difficult to distinguish between IED and Landmine attacks as a result of their similar attack pattern and difficulty in quickly identifying remains. Even if an explosive is motion triggered, if police and news reports mark an explosive as an IED, the R2P defers to referring to the explosive as an IED. Secondly, while IEDs and Landmines do not hold clear targets, the best way to reasonably evaluate their impact as well as compensate for the acceptance of terrorist groups of the possibility of civilian casualties is to record their target as the ultimate victim of an attack using a Landmine or IED. While this is at best an imperfect method of understanding IED and Landmine attacks, and while it undermines the ability of readers to comprehend terrorist targeting logic based on the results of the attack, the R2P team sees this as the best method.
Tags are specific notes given on certain tactics or characteristics of an attack. An attack may contain any number of tags. The R2P team researches and documents tagged characteristics to the best of their ability given the details they receive in a timely manner. Higher level analyses by government institutions or more meticulous research groups should be consulted before reporting these statistics as a final authority. Updates to this methodology may be added as terrorist tactics change or news reports release updated details.
Car – The attackers utilized a four wheeled motor vehicle in the course of the attack. This does not include use as transportation to or from an attack. This also does not include car bombs, which have their own Tag input.
Car bomb – The attackers utilized an explosive rigged to a car, detonating it with intent to kill or damage people or places nearby. This can include both suicide car bombs as well as remotely detonated ones, depending on the respective “Weapon” input. This does not include devices rigged to cars for the purpose of killing the passenger, which would be coded as “Landmine” or “IED” depending on the individual case.
Disguise – The attackers utilize deceptive clothing in order to assist them in their attack. This can include the disguise of attackers, weapons, or vehicles.
Hostages – The attackers took victims hostage for a protracted period of time during the attack to achieve a tactical goal or obtain leverage.
Kidnap – The attackers captured victims and fled the attack with the victims in order to achieve a tactical goal or obtain leverage.
Loot – The attackers attempted to obtain nonhuman resources during the course of the attack, including supplies, weapons, or vehicles.
Motorcycle – The attackers used a motorcycle in the course of the attack. This does not include use as transportation to or from an attack.
Mutilation – The attackers committed acts of violence against the victim in large excess of that needed to kill them. Examples of this include decapitation, immolation, or the continuation of violence onto a victim after the victim has died.
Roadside – The attack occurred on or near a road. This includes when victims or attackers are not within vehicles.
Standoff – The attackers engaged in a protracted fight against security forces in which they did not immediately flee but attempted to achieve a tactical goal in the face of a stalemate.
Personal Explosive Device – The attacker utilized an explosive device attached to their body in a way that the detonation of the device kills them in the process. This is coded with the “Suicide bomb” Weapon input.
Targeted – The attackers sought a specific person or persons for their functional importance in a community or organization. This necessitates the attackers targeting a specific person rather than a specific type of person, i.e. a specific police officer rather than police officers in general. This does not include attacks against specific religious or ethnic groups, but rather attacks on individuals for their specific function in a certain setting, including government officials or community leaders.
Number of Attackers
Number of Attackers indicates the quantity of attackers that commit the attack itself. This does not include getaway drivers or other forms of transportation to or from the attack, but does include those who assist the attackers during the course of the attack in nonviolent ways or attempt and fail to harm others, such as suicide bombers who kill themselves only. Single suicide car bombs are assumed to have a single attacker until a report indicates otherwise.
Double verification indicates that two independent news sources have reported that the attack has occurred. Pure reprints of articles into other publications do not count towards this tally. This is meant to indicate a higher level of certainty that the attack has occurred in the manner described.
Source Archives are a connective organization tool by the R2P team in entering data into the AID.
Confirmation Sources are the publications that corroborate the existence and details of the attacks. We encourage all to engage and read with these sources, as they provide the front line of communication in the anti-extremism community, and the continued support of free speech and journalism abroad is an important prerequisite to the fight against extremism.
Confirmation Archives are stored versions of the articles and reports used to compile and enter the data on that particular attack. We provide each of them to the readers of AID not only as a means to enhance transparency, but also to grant credit to the original writers and agencies who reported the information as well as to further public education and discourse on terrorism and extremism.