Security Weekly: Norway: Lessons from a Successful Lone Wolf Attacker, July 28, 2011

By Scott Stewart

On the afternoon of July 22, a powerful explosion ripped through the streets of Oslo, Norway, as a large improvised explosive device (IED) in a rented van detonated between the government building housing the prime minister’s office and Norway’s Oil and Energy Department building. According to the diary of Anders Breivik, the man arrested in the case who has confessed to fabricating and placing the device, the van had been filled with 950 kilograms (about 2,100 pounds) of homemade ammonium nitrate-based explosives.

After lighting the fuse on his IED, Breivik left the scene in a rented car and traveled to the island of Utoya, located about 32 kilometers (20 miles) outside of Oslo. The island was the site of a youth campout organized by Norway’s ruling Labor Party. Before taking a boat to the island, Breivik donned body armor and tactical gear bearing police insignia (intended to afford him the element of tactical surprise). Once on the island he opened fire on the attendees at the youth camp with his firearms, a semiautomatic 5.56 mm Ruger Mini-14 rifle and a 9 mm Glock pistol. Due to the location of the camp on a remote island, Breivik had time to kill 68 people and wound another 60 before police responded to the scene.

(click here to enlarge image)
Shortly before the attack, Breivik posted a manifesto on the Internet that includes his lengthy operational diary. He wrote the diary in English under the Anglicized pen name Andrew Berwick, though a careful reading shows he also posted his true identity in the document. The document also shows that he was a lone wolf attacker who conducted his assault specifically against the Labor Party’s current and future leadership. Breivik targeted the Labor Party because of his belief that the party is Marxist-oriented and is responsible for encouraging multiculturalism, Muslim immigration into Norway and, acting with other similar European governments, the coming destruction of European culture. Although the Labor Party members are members of his own race, he considers them traitors and holds them in more contempt than he does Muslims. In fact, in the manifesto, Breivik urged others not to target Muslims because it would elicit sympathy for them.

Breivik put most of his time and effort into the creation of the vehicle-borne IED (VBIED) that he used to attack his primary target, the current government, which is housed in the government building. It appears that he believed the device would be sufficient to destroy that building. It was indeed a powerful device, but the explosion killed only eight people. This was because the device did not bring down the building as Breivik had planned and many of the government employees who normally work in the area were on summer break. In the end, the government building was damaged but not destroyed in the attack, and no senior government officials were killed. Most of the deaths occurred at the youth camp, which Breivik described as his secondary target.

While Breivik’s manifesto indicated he planned and executed the attack as a lone wolf, it also suggests that he is part of a larger organization that he calls the “Pauperes Commilitones Christi Templique Solomonici (PCCTS, also known as the Knights Templar), which seeks to encourage other lone wolves (whom Brevik refers to as “Justiciar Knights”) and small cells in other parts of Europe to carry out a plan to “save” Europe and European culture from destruction.

Because of the possibility that there are other self-appointed Justiciar Knights in Norway or in other parts of Europe and that Breivik’s actions, ideology and manifesto could spawn copycats, we thought it useful to examine the Justiciar Knights concept as Breivik explains it to see how it fits into lone wolf theory and how similar actors might be detected in the future.

An Opening Salvo?

From reading his manifesto, it is clear that Breivik, much like Oklahoma City bomber Timothy McVeigh, believes that his attack is the opening salvo in a wider campaign, in this case to liberate Europeans from what Breivik views as malevolent, Marxist-oriented governments. These beliefs are what drove Breivik to attack the Norwegian Labor Party. As noted above, it is also clear that Breivik planned and executed his attack alone.

However, he also discusses how he was radicalized and influenced by a Serbian living in Liberia whom he visited there. And Breivik claims to have attended a meeting in London in 2002 to “re-found the Knights Templar.” This organization, PCCTS, which was founded in 2002, is not related to the much older official and public chivalric order also known as the Knights Templar. According to Breivik, the PCCTS was formed with the stated purpose of fighting back against “European Jihad” and to defend the “free indigenous peoples of Europe.” To achieve this goal, the PCCTS would implement a three-phase plan designed to seize political and military power in Europe. In his manifesto Breivik outlines the plan as follows:

Phase 1 (1999-2030): Cell-based shock attacks, sabotage attacks, etc.
Phase 2 (2030-2070): Same as above but bigger cells/networks, armed militias.
Phase 3 (2070-2100): Pan-European coup d’etats, deportation of Muslims and execution of traitors.
As outlined in Breivik’s manifesto, the 2002 meeting was attended by seven other individuals, two from England and one each from France, Germany, the Netherlands, Greece and Russia. He also asserts that the organization has members from Serbia (his contact living in Liberia), Sweden, Belgium and the United States who were unable to attend the meeting. Brevik states that all the members of the PCCTS were given code names for security, that his code name was “Sigurd,” and that he was mentored by a member with the code name “Richard the Lionhearted” (presumably a Briton). Breivik claims that after meeting these individuals via the Internet he was carefully vetted before being allowed to join the group.

The diary section of Breivik’s manifesto reveals that during the planning process for the attack Breivik traveled to Prague to obtain firearms and grenades from Balkan organized-crime groups there (he had hoped to obtain a fully automatic AK-47). Breivik was not able to procure weapons in Prague and instead was forced to use weapons he was able to obtain in Norway by legal means. It is interesting that he did not contact the Serbian member of the PCCTS for assistance in making contact with Balkan arms dealers. Breivik’s lawyer told the media July 26 that although Breivik acted alone in conducting his attack, he had been in contact with two terror cells in Norway and other cells abroad. Certainly, Norway and its partners in EUROPOL and the United States will try to identify these other individuals, if they do in fact exist.

In phase one of the PCCTS plan, shock attacks were to be carried out by individuals operating as lone wolves or small cells of Breivik’s so-called Justiciar Knights, who are self-appointed guardians who decide to follow the PCCTS code outlined in Breivik’s manifesto and who are granted the authority to act as “a judge, jury and executioner until the free, indigenous peoples of Europe are no longer threatened by cultural genocide, subject to cultural Marxist/Islamic tyranny or territorial or existential threats through Islamic demographic warfare.”

Breivik’s manifesto notes that he does not know how many Justiciar Knights there are in Western Europe but estimates their number to be from 15 to 80. It is unclear if this is a delusion on his part and there are no other Justiciar Knights or if Breivik has some factual basis for his belief that there are more individuals like him planning attacks.

While some observers have noted that the idea of Justiciar Knights operating as lone wolves and in small cells is similar to the calls in recent years for grassroots jihadists to adopt lone wolf tactics, it is important to understand that leaderless resistance has been a central theme of white supremacist groups in the United States since the early 1990s. While Breivik did not express any anti-Semitism in his manifesto (something he has been heavily criticized for on U.S. anti-Semitic websites), clearly the anti-immigration and anti-Marxist ideology of the PCCTS has been influenced more by white hate groups than by al Qaeda.

Moreover, the concept of a self-identified Justiciar Knight is quite similar to the idea of a “Phineas Priest” in the leaderless resistance model propagated by some white supremacists in the United States who adhere to “Christian Identity” ideology. In this model, Phineas Priests see themselves as lone wolf militants chosen by God and set apart to be his “agents of vengeance” upon the earth. Phineas Priests also believe that their attacks will serve to ignite a wider “racial holy war” that will ultimately lead to the salvation of the white race.

Leaderless resistance has also been advocated by militant anarchists as well as animal rights and environmentalist activists who belong to such groups as the Animal Liberation Front and the Earth Liberation Front. So it is not correct to think of leaderless resistance merely as a jihadist construct — it has long been used by a variety of militant actors.

Lone Wolf Challenges

One of the great strengths of our enemies, the Western European cultural Marxist/multiculturalist regimes is their vast resources and their advanced investigation/forensic capabilities. There are thousands of video cameras all over European major cities and you will always risk leaving behind dna, finger prints, witnesses or other evidence that will eventually lead to your arrest. They are overwhelmingly superior in almost every aspect. But every 7 headed monster has an Achilles heel. This Achilles heel is their vulnerability against single/duo martyr cells. — Anders Breivik

As STRATFOR has long discussed, the lone wolf operational model presents a number of challenges for law enforcement, intelligence and security officers. The primary challenge is that, by definition, lone wolves are solitary actors, and it can be very difficult to determine their intentions before they act because they do not work with anyone else. When militants are operating in a cell consisting of more than one person, there is a larger chance that one of them will get cold feet and reveal the plot to authorities, that law enforcement and intelligence personnel will intercept a communication between conspirators, or that the authorities will be able to insert an informant into the group.

This ability to fly solo and under the radar of law enforcement has meant that some lone wolf militants such as Joseph Paul Franklin, Theodore Kaczynski and Eric Rudolph were able to operate for years before being identified and captured. Indeed, from Breivik’s diary, we know he took several years to plan and execute his attack without detection.

As the Breivik case illustrates, lone wolves also pose problems because they can come from a variety of backgrounds with a wide range of motivations. While some lone wolves are politically motivated, others are religiously motivated and some are mentally unstable.

In addition to the wide spectrum of ideologies and motivations among lone wolves, there is also the issue of geographic dispersal. As we’ve seen from past cases, their plots and attacks have occurred in many different locations and are not confined just to Manhattan, London or Washington. Lone wolf attacks can occur anywhere.

Furthermore, it is extremely difficult to differentiate between those extremists who intend to commit attacks and those who simply preach hate or hold radical beliefs (things that are not in themselves illegal in many countries). Therefore, to single out likely lone wolves before they strike, authorities must spend a great deal of time and resources looking at individuals who might be moving from radical beliefs to radical actions. This is a daunting task given the large universe of potential suspects.

Vulnerabilities

In spite of the challenges presented by lone wolf operatives, they are vulnerable to detection at several different stages of their attack cycle. One of these vulnerabilities comes during the planning stage when weapons are acquired. From reading Breivik’s diary, it is clear that he felt exposed as he tried to purchase the chemicals he needed to build his IED. Because of this vulnerability, Breivik created an extensive cover story that included renting a farm in order to explain his purchase of a large quantity of ammonium nitrate fertilizer. The farm also provided a private, spacious place for him to construct his IED.

Breivik also exposed himself to potential detection when he traveled to Prague to attempt to purchase weapons. One of the criminals he contacted could have turned him in to authorities. (In June 2011 we saw a jihadist cell in Seattle detected and arrested while attempting to buy guns from a criminal acquaintance. Another small cell was arrested in New York in May 2011, also while attempting to obtain weapons.) Even if Breivik had succeeded in purchasing weapons in Prague, he would still have been vulnerable as he smuggled the weapons back into Norway in his car (though it is important to remember that EU countries have open borders so security checks would not have been too stringent).

Breivik also exposed himself to detection as he conducted surveillance on his targets. Interestingly, in his diary, Breivik goes into excruciating detail discussing how he manufactured his device based on information he was able to obtain from the Internet, but he mentions very little about how he selected specific targets or how he conducted surveillance on them. He mentions only that he visited the sites and programmed the locations into his GPS. He also discusses using a video camera to record his attack but does not mention if he used still or video cameras in his target surveillance. How Breivik specifically chose his targets and how he conducted surveillance on them will be important for the Norwegian authorities to examine.

Finally, Breivik mentions several times in his diary that the steps he was taking would be far more difficult if he were a foreign-born Muslim instead of a Caucasian Norwegian. This underscores a problem we have discussed with profiling suspects based on their ethnicity or nationality. In an environment where potential threats are hard to identify, it is doubly important to profile individuals based on their behavior rather than their ethnicity or nationality — what we refer to as focusing on the “how” rather than the “who.”

Not All Lone Wolves are Equal

Finally, in the Breivik case we need to recognize that Norwegian authorities were dealing with a very capable lone wolf operator. While lone wolf theory has been propagated for many years now, there have been relatively few successful lone wolf attacks. This is because it takes a special individual to be a successful lone wolf assailant. Unlike many lone wolves, Breivik demonstrated that he possessed the intelligence and discipline to plan and carry out an attack that spanned several years of preparation. For example, he joined a pistol club in 2005 just in case he ever needed to buy a gun through legal means in Norway, and was able to rely on that alternate plan when his efforts to purchase firearms in Prague failed. Breivik was also driven, detail-oriented and meticulous in his planning. His diary documents that he was also extremely patient and careful during the dangerous trial-and-error process of manufacturing explosives.

It is rare to find a lone wolf militant who possesses all those traits, and Breivik stands in stark contrast to other European grassroots operatives like Nick Reilly or Bilal Abdullah and Kafeel Ahmed, who made amateurish attempts at attacks. Breivik appears to have been a hard worker who claims to have amassed some 500,000 euros by working a variety of jobs and selling a communications company. After some unsuccessful speculation on the stock market he still had enough money and credit to rent the farm and the vehicles he used in the attack and to buy the required bomb components, weapons and body armor. In his diary he says that he began his two tasks — writing the manifesto and conducting the attack — with a war chest of 250,000 euros and several credit cards.

Breivik also is somewhat unique in that he did not attempt to escape after his attacks or become a martyr by his own hand or that of the authorities. Instead, as outlined in his manifesto, he sought to be tried so that he could turn his trial into a grandstand for promoting his ideology beyond what he did with his manifesto and video. He was willing to risk a long prison sentence in order to communicate his principles to the public. This means that the authorities have to be concerned not only about other existing Justiciar Knights but also anyone who may be influenced by Breivik’s message and follow his example.

There is also the possibility that individuals who do not adhere to Breivik’s ideology will seek to exploit the loopholes and security lapses highlighted by this incident to conduct their own attacks. Breivik’s diary provides a detailed step-by-step guide to manufacturing a successful VBIED, and the authorities will be scrutinizing it carefully to address the vulnerabilities Breivik exposed before those instructions can be used again.


Norway: Lessons from a Successful Lone Wolf Attacker is republished with permission of STRATFOR.