AMMAN – Questions are mounting over the transformation of terrorist operations in Jordan, the Arab world and internationally, from attacks carried out by organised cells linked to extremist groups to those perpetrated by so-called “lone wolves.” These individuals pursue similar objectives but may operate with fewer resources and at almost no organisational cost, relying instead on self-directed ideological indoctrination influenced by extremist rhetoric on social media platforms.
Terrorist organisations have increasingly shifted their operational tactics from organised cells to lone actors after recognising that security agencies have become capable of dismantling these networks and arresting their members before most attacks can be carried out. Such operations are often disrupted through intelligence penetration, monitoring communications, training and financing activities, as well as close surveillance of individuals promoting extremist ideologies.
Lone actors, however, present a different security challenge because changes in an individual’s behaviour, growing inclination towards violence and ideological radicalisation can be difficult to detect and monitor.
While experts disagree over which poses the greater threat — organised terrorist cells or lone actors — many stress that identifying and tracking a lone attacker is more difficult than dismantling a network linked to an established organisation.
Al-Sharafat: No Absolute Answers
Retired Brigadier General Dr Saud Al-Sharafat, director of the Sharafat Centre for Globalisation and Terrorism Studies in Amman, said there is no definitive answer from a national security and counterterrorism perspective as to whether lone wolves are always more dangerous than terrorist cells, or vice versa.
He explained that the level of threat depends on the nature of the threat itself, the capabilities of those involved, their objectives, the potential scale of damage and the ability of security agencies to detect and prevent their plans.
“Before making a comparison, it is necessary to clarify that the term ‘lone wolf’ is used here as an academic concept commonly found in terrorism and security studies. It is not intended in any way to praise or glorify terrorists,” Al-Sharafat said.
“The term describes a pattern of terrorist behaviour and execution, rather than conferring any noble status on its perpetrator. Its use does not change the fact that terrorism is a brutal criminal act that violates human values.”
Al-Sharafat said an essential distinction must be made: a lone wolf represents a different kind of security challenge, while a terrorist cell constitutes an organisational and operational threat that may extend beyond a single attack.
He outlined the differences as follows:
First: Lone actors and the difficulty of early detection.
“The main danger posed by lone actors lies in the difficulty of detecting them in advance, particularly when individuals make decisions independently and have no organisational contacts or known connections that security agencies can monitor,” he said.
An individual may move from ideological influence to carrying out an attack without passing through clearly identifiable traditional organisational stages. As a result, the early-warning window available to security agencies may be extremely limited.
However, organisational independence does not necessarily mean ideological independence. An individual may be influenced by the propaganda or ideological guidance of a terrorist organisation without being a formal member.
Second: Organised terrorist cells and their operational capabilities.
The danger posed by terrorist cells lies in their potential ability to divide responsibilities, exchange expertise and resources, plan operations in multiple stages, and carry out simultaneous or successive attacks.
They may also maintain links with domestic or foreign networks.
At the same time, the discovery of one cell member may enable security agencies to identify the rest of the network and uncover its plans, making these organisational connections a potential weakness.
Third: Two dimensions of national security threats.
Al-Sharafat said a comprehensive national security assessment should distinguish between two levels of risk.
The first concerns the difficulty of detection and early warning. This is generally greater in the case of a lone actor who operates independently, because there are no direct organisational communications or links for security agencies to monitor. Nevertheless, this does not make detection impossible, as behavioural, digital and intelligence indicators may still reveal a potential threat.
The second concerns organisational capacity and continuity. This may be greater in the case of terrorist cells because they can repeat and expand operations and may have recruitment, financing, planning, logistical support and supply networks.
Al-Sharafat also pointed to international studies and findings from the annual Jordan Terrorism Index, published by the Sharafat Centre for Globalisation and Terrorism Studies in Amman.
He said these findings indicate that the relative isolation of lone actors makes their plans more difficult to detect and disrupt. Some organisations, particularly ISIS and far-right groups in the West, have sought to encourage individuals to carry out attacks that appear to be independent operations.
However, he highlighted an increasingly important analytical point: the distinction between lone wolves and organised terrorist cells is no longer as clear-cut as it once was.
A third pattern has emerged, involving individuals who carry out attacks alone but are influenced by the ideology, incitement or indirect guidance of a terrorist organisation, without necessarily holding formal membership or maintaining operational contact with it.
He cited the terrorist attack that targeted the late Corporal Jawad Al-Salaytah as an example of this pattern.
This, he said, makes the term “lone wolf” potentially misleading, particularly in media coverage, when the definition is based solely on the number of people involved in carrying out an attack.
Al-Sharafat concluded that the danger of a terrorist threat should not be measured simply by the number of perpetrators. Instead, assessments should consider how difficult the threat is to detect, the capabilities involved, the size of the network, the objectives and the potential impact on the stability of the state and its institutions.
A lone actor may be harder to detect, while an organised cell may pose a greater threat in terms of its ability to sustain and carry out multiple operations. Both require different but integrated intelligence, security and preventive approaches.
“The most important question for Jordanian security agencies should not be which is more dangerous, but how to detect a terrorist threat before it turns into an attack, whether it comes from a lone wolf, an isolated individual or an organised network,” he said.
The Dangers of Acting Alone
Security and strategic affairs expert retired Brigadier General Dr Omar Al-Raddad shares Al-Sharafat’s assessment.
He said that, from a security perspective, comparing terrorist cells linked to ISIS with lone actors who embrace its ideology — but may have no direct organisational connection to the group — suggests that lone actors present the greater challenge in terms of early detection.
The security agencies have less opportunity to monitor them than they do organised cells, which are generally easier to track.
Al-Raddad explained that intelligence principles and basic investigative and surveillance methods, including human and technical intelligence operations, are more effective when terrorist cells maintain communications with ISIS.
Such communications can potentially be intercepted, even when members use secret channels or concealed methods of communication.
By contrast, a lone actor may have no direct organisational relationship with ISIS, with the connection limited to adopting its extremist ideology and its particular interpretation of religious concepts, as well as sharing its targets — whether churches, security personnel, public institutions or government ministries.
He added that this ideological convergence creates a serious challenge.
From an academic and security perspective, a lone actor may have no direct organisational ties but can still decide to commit an attack when an opportunity arises, using a firearm or another means, including vehicle-ramming attacks.
Although general security monitoring and screening procedures may help identify potential attackers through behavioural indicators, detecting a lone actor before an attack remains difficult.
Such indicators may include the use of concealed communication methods and signs of radicalisation that could point to preparations for terrorist activity.
This makes the task more challenging than identifying organised cells, which are often easier for security agencies to reach.
New Concepts and Evolving Threats
Dr Marwan Sajadeh, a researcher and analyst specialising in terrorist organisations, said that sleeper cells and lone wolves have become widely recognised concepts in security and strategic studies, particularly since the international campaign against terrorism intensified following the September 11, 2001 attacks.
Their use has been closely associated with changes in the activities of armed jihadist organisations, particularly Al-Qaeda and ISIS, and the shift from attacks planned by centralised organisational structures towards operations carried out by individuals or small groups with varying degrees of independence.
Sajadeh said that despite fundamental differences between sleeper cells and lone actors in organisational structure, the nature of their affiliations and decision-making mechanisms, both can produce violence targeting individuals, communities and state institutions.
Such attacks may also generate security, psychological and political consequences that extend beyond their immediate casualties.
He stressed that distinguishing between the two concepts is not merely a matter of terminology. It is essential for understanding the nature of the threat, developing prevention and early-detection strategies, and determining the appropriate security and legal responses.
Sleeper Cells and Organisational Links
In security and media terminology, sleeper cells refer to groups of individuals connected to an extremist organisation or violent network who retain the ability to operate or communicate organisationally but do not engage in visible operational activity for a certain period.
This inactivity may be part of the network’s operating strategy or a response to surrounding security conditions.
Describing a cell as “dormant” does not necessarily mean its members are completely inactive. Rather, it generally indicates the absence of visible or publicly declared operational activity during a particular period.
Sleeper cells may become less active when preventive security measures are intensified. Such measures can significantly weaken them and restrict their ability to conduct recruitment, organisational activities and material operations.
In the cases of Al-Qaeda and ISIS, organisational relationships can take several forms, including direct membership, communication with leaders or intermediaries, receiving general or specific instructions, or maintaining links with local networks that share the organisation’s objectives.
The pledge of allegiance, known as bay’ah, occupies an important position in the ideological and organisational structures of some extremist groups, serving as an expression of loyalty and obedience to leadership.
However, a formal pledge is not a necessary condition for defining every terrorist cell, as organisational or operational links may exist without an officially declared allegiance.
Organisational commitment does not necessarily eliminate individual independence in every case, although some groups seek to impose strict obedience on their members and use distorted religious interpretations to justify orders and violent acts.
The danger posed by sleeper cells lies in their potential possession of established human and organisational connections and accumulated capabilities, which may allow them to move from inactivity to violent operations.
Their capacity varies according to the size of the cell, its level of organisation, available resources and the nature of its links with leadership or external networks.
Therefore, the threat posed by sleeper cells cannot be measured solely by the number of their members, but rather by their ability to turn organisational connections into coordinated violent activity.
Lone Wolves and Changing Patterns of Terrorism
The term “lone wolf” refers to an individual who plans or carries out a terrorist act with a relative degree of independence, without necessarily operating under the direct operational control of a terrorist organisation.
Such an individual may be influenced by the rhetoric, ideology or propaganda of an extremist group without being an official member or maintaining a direct pledge of allegiance or organisational commitment.
In some cases, an attacker publicly declares support for a particular organisation before, during or after an attack. The organisation may subsequently claim responsibility for the operation for propaganda purposes, even when there is no independent evidence establishing an organisational relationship or a direct role in planning and execution.
For this reason, it is important to distinguish between ideological influence, publicly declared support, communication with an organisation and direct operational guidance. These represent different levels of association and should not be treated as equivalent evidence of organisational membership.
It is also important to note that the concept of a lone wolf is not universally agreed upon in academic research.
Some attacks described in the media as individual operations may later be found through investigations to have involved social relationships, digital communications or other individuals who influenced the perpetrator, without necessarily amounting to direct organisational command.
Consequently, operational independence does not always mean complete social or ideological isolation.
This distinction has become increasingly important in today’s digital environment, where individuals can encounter extremist content through open or closed online platforms.
However, exposure to such material does not mean that everyone who encounters it will turn to violence. The transition from adopting extremist ideas to carrying out terrorist acts is not inevitable; it is influenced by a complex combination of individual, social, political and contextual factors.
Which Poses the Greater Threat?
Ultimately, there is no absolute answer as to which is more dangerous.
Sleeper cells may represent a greater threat in terms of organisational capacity and their ability to carry out coordinated attacks. Lone actors, meanwhile, may pose a greater challenge in terms of early detection, particularly when they lack visible organisational communications.
The assessment must therefore distinguish between the potential scale of damage, the likelihood of an attack occurring, and the difficulty of detecting and preventing it.
