Security Weekly: December 18, 2014

By Scott Stewart

Some media outlets are reporting that the Sydney hostage situation was the work of a lone madman rather than an act of terrorism, but an examination of the perpetrator's motives reveals that the case exhibits many of the elements associated with grassroots terrorism.

Shortly before 10 a.m. on Dec. 15, a lone gunman, later identified as Man Haron Monis, took 17 people hostage at the Lindt Chocolat Cafe in Sydney's central business district. As the ordeal dragged on, Monis reportedly told some of those in the cafe that they were going to die at dawn unless his demands were met. At approximately 2 a.m. on Dec. 16, one of the hostages attempted to take the shotgun away from a drowsy Monis, prompting some of the other hostages to flee as Monis opened fire. Hearing shots, the police entered the cafe and killed Monis, but two hostages were also killed in the exchange, including the man who attempted to take the gun. Several others, including a police officer, were wounded.

Monis — a self-ascribed cleric who called himself Sheikh Haron on his website, Twitter, Facebook and on other social media outlets — was born in Iran and had sought and received asylum in Australia. Subsequently, he garnered a fairly extensive criminal history, which included charges of accessory to the murder of his ex-wife and multiple charges of sexual assault. At the time of the hostage incident, Monis was out on bail and facing trial on these charges. He also had a previous conviction for sending insulting messages to the families of Australian soldiers killed in Iraq and Afghanistan and had carried out a number of high-profile protests. In one instance, Monis chained himself to a Sydney courthouse after being convicted in the letters case. He also claimed to have been tortured while in jail.

Though Monis was born in Iran and was originally a devotee of Shiite Islam, according to his website, he had converted to Sunni Islam and had recently become a follower of the Islamic State. Because of his criminal history, heavy social media activity and the protests he conducted, Monis was well known to police in New South Wales, to the Australian Federal Police and to the Australian Security Intelligence Organization.

Lone Nut?

Australian Prime Minister Tony Abbott told reporters at a Dec. 6 press conference it was obvious Monis "was a deeply disturbed individual." Similarly, members of the Muslim community and even Monis' own lawyer described him as mentally unstable. Some have interpreted this to mean that the attack was the work of a mentally disturbed individual and not an act of terrorism, but as seen in past cases, these classifications are not mutually exclusive. There are plenty of past cases of terrorism in which the perpetrator has been delusional or otherwise mentally unbalanced, something a brief perusal of Anders Behring Breivik's compendium or Ted Kaczynski's manifesto makes clear.

Intent is what separates cases of terrorism from the acts of other violent madmen. Terrorism is violence perpetrated for political purposes, and despite any personal, legal or mental problems Monis might have faced, he clearly intended this incident to be an act of terrorist theater.

Monis' political motives were clearly expressed by the headband he wore which read, "We are your soldiers oh Muhammad," and by the black flag bearing the Shahada that he forced one of the hostages to hold against the cafe window. Though the Shahada is used on a number of Muslim flags, including the national flag of Saudi Arabia, the black banner has come to represent the flag of war, and a number of jihadist groups have adopted various versions of it, including al Qaeda and the Islamic State. Monis also forced some of the hostages to stand in front of the flag to record messages he posted to YouTube, similar to the highly publicized videos the Islamic State has released featuring hostages in Syria. In these messages Monis reportedly demanded to speak with Prime Minister Abbott over live broadcast, he insisted that the media announce that the hostage scenario was an attack by the Islamic State, and he requested what he called an Islamic State flag, which presumably is the black banner used widely by the Islamic State that contains the Shahada plus a circle that is purported to represent the seal of the Prophet Mohammed.

Despite Monis' reported mental instability, the sequence of events in this incident clearly demonstrate that he was acting in a planned, logical manner designed to accomplish his goals — however delusional those goals may have been.

Intent Is Key, Not Ability

Some argue that because Monis was amateurish, acted alone and had no connections to terrorists outside of Australia, his acts were not acts of terrorism. But just because Monis was more of a bumbling Kramer than a deadly Carlos the Jackal does not mean he was not a grassroots terrorist operative. Indeed, as we've previously discussed, most grassroots operatives tend to be more like stray mutts than lone wolves.

In this case, a jihadist convert, who was very active on social media, pledged allegiance to the Islamic State and stated that he was acting on behalf of the Islamic State. He also conducted an attack against an extremely soft target, using a very simple attack with an easily acquired weapon. Firearms are fairly difficult to acquire in Australia, but it is far easier to obtain a shotgun than a fully automatic assault rifle or a large truck bomb. The Australian Federal Police will certainly trace Monis' shotgun to determine its origins. Most likely it was stolen or bought on the black market.

Finally, by choosing to take hostages rather than enter the cafe shooting, Monis was able to prolong the incident rather than be taken out quickly by police. As we've previously discussed, active shooter protocols were designed as a response to school shootings and other mass shooting incidents, but they also help police agencies mitigate terrorist incidents and keep them from becoming prolonged sieges, as was the 2009 Mumbai attack.

Some have suggested that Monis' modus operandi signified he was unwilling to die in the operation, but his choice of tactics may also have been an acknowledgement of active shooter protocols and an attempt to avoid them. By prolonging the event into an extended act of terrorist theater, he captured the world's attention for over 16 hours, reaching millions of vicarious victims through his antics. That Monis reportedly threatened to begin shooting his hostages at dawn and then went down shooting at police rather than surrendering supports the idea that he was intentionally exploiting police protocol.

Can't Track Them All

Finally, there are many who will criticize the Australian government for releasing Monis on bail awaiting trial and for not putting him on a terrorist watch list. However, such criticism illustrates one of the largest challenges that the leaderless resistance model of operations poses for law enforcement and intelligence agencies. Because there was no known contact between Monis and terrorist actors overseas, there was no intelligence to indicate he might be planning an attack in Australia.

As a lone actor, Monis did not have to coordinate his attack with other plotters. There was no conspiracy for Australian law enforcement to penetrate, and unless Monis did something to draw attention during the attack planning process, he was unlikely to be detected. There were points during the attack cycle when Monis was vulnerable to detection, such as when he conducted preoperational surveillance or when he obtained his shotgun. But he was not detected and was able to launch his attack.

Though Monis expressed his support for the Islamic State on social media, that is not illegal in Australia, and he was only one of many do so. Until he broke the law or made contact with known terrorist entities, the Australian authorities were not likely to focus specifically on him. Indeed, because he was well known to police and had conducted a number of non-violent publicity stunts, he may have been perceived as less of a threat. In his protests after the letters case, for example, he publicly stated that his pen was his gun and his words were his bullets.

As in the United States, the United Kingdom, Canada and elsewhere, there are simply too many jihadist cheerleaders in Australia — and government resources are too limited — to monitor the activities of each of them. Therefore, grassroots operatives will continue to pose a challenge, albeit a limited one, to countries in the West.

The Sydney Hostage Incident Was a Classic Case of Grassroots Terrorism is republished with permission of Stratfor.