Questions to Ask After a Terrorist Attack

Commentary by Daniel Byman

Published December 16, 2025

Terrorist attacks and plots have dominated headlines in the last week. In Sydney, Australia, two gunmen killed 15 people at a Hanukkah celebration at Bondi Beach on December 14. The same day, a gunman-currently on the loose-killed two students at Brown University in Rhode Island. A day later, the FBI announced the arrest of what it claimed were four pro-Palestine, left-wing terrorists who planned to bomb multiple targets in California on New Year's Eve. Less noticed, on Saturday, a gunman shot over 20 bullets into a Hanukkah-decorated home in Redlands, California, and shouted "fuck Jews."

The immediate aftermath of one such attack, let alone such a large number over one weekend, is marked by shock, grief, anger, and profound uncertainty. In those first hours and days, there is little that can or should be done to blunt the emotional impact of violence deliberately designed to horrify. Yet the confusion that follows often compounds the harm. Misinformation is common, particularly on social media. Rumor spreads faster than verified information; speculation outpaces evidence; and early media narratives-however tentative-can influence perceptions of the event and terrorism in general, even if mainstream sources debunk the false information.

Initial reporting after major attacks has repeatedly, though usually unintentionally, repeated conspiracies, overstated organizational involvement, or misunderstood attackers' motives. Long after the September 11 attacks, for example, claims about al Qaeda financing itself through African blood diamonds or planning waves of imminent follow-on attacks persisted in public discourse, despite authoritative investigations that discredited them. The 2016 attack on the Pulse nightclub, where Omar Mateen, an Islamic State supporter, killed 49, is the deadliest attack on the LGBTQ+ community in the United States, and it was widely believed that he deliberately targeted this community. Mateen, however, originally targeted another nightclub not associated with the LGBTQ+ community, but security concerns probably led him to reconsider. Such persistent narratives matter because they influence how Americans understand the threat, whom they fear, and which policies they support.

Similarly, investigative leads that seem promising often prove to be false trails. After the Brown University shooting, authorities detained a "person of interest" who was initially thought to be complicit but later released him due to a lack of incriminating evidence. Such mistakes are common in high-profile investigations (and, indeed, the relatively quick release of the subject is a sign the system is protecting the innocent as well as trying to find the guilty), but they can further the confusion generated after a terrorist attack.

If societies cannot eliminate the chaos that follows terrorist violence, they can at least impose some analytical discipline on it. As I originally wrote in a 2017 Lawfare piece, asking the right questions-early and repeatedly-can help policymakers, journalists, and the public distinguish signal from noise, avoid costly overreaction, and better prepare for future threats. Since then, I've added new questions to my original list and modified how I think about some of the possible answers. The questions and issues I present below are not ideological, but rather ways to gauge the danger and the best responses.

A first and overriding question after any attack is whether additional violence is imminent. Security officials must determine whether the perpetrators are dead or at large, whether accomplices remain active, and whether the attack was part of a coordinated campaign rather than an isolated act. History offers sobering examples of both possibilities. Some attackers die at the scene; others evade capture, as occurred after the Boston Marathon bombing. In still other cases, organizations deliberately stage multicell operations across different locations, as happened in 2015 in Paris, when Islamic State terrorists targeted a soccer stadium, concert hall, and bars and restaurants. Faced with incomplete information about the risk of future violence, authorities often err on the side of caution, shutting down cities, grounding flights, or deploying extraordinary security measures. While these responses are disruptive, the political and moral cost of underreacting to a real follow-on threat is far higher.

Another question concerns whether the violence is a hate crime or terrorism. The FBI defines a hate crime as "a criminal offense against a person or property motivated in whole or in part by an offender's bias against race, religion, disability, sexual orientation, ethnicity, gender, or gender identity," though the FBI also notes that "hate itself is not a crime." Terrorism, in contrast, has a political and psychological element-the goal is to change government policy or otherwise advance a broader agenda and to influence a wide set of people. Often, observers are quick to use the terrorism label when the goal, while hateful, was narrower and does not fit the definition. Misclassifying terrorist attacks as just another form of violence, however, risks understating their strategic intent and societal impact and thus may lead to under-resourcing the danger.

A related question concerns organizational involvement. Terrorist violence is frequently mislabeled as either the work of isolated "lone wolves" or the product of tightly directed, sophisticated organizations, when in fact most plots and attacks exist along a continuum between these two extremes. Public pledges of allegiance-especially those made online after an attack-are a particularly imprecise indicator. Anyone can declare loyalty to a terrorist organization without ever having met a recruiter, received training, or taken orders. The San Bernardino husband and wife who killed 14 people in 2015 supposedly pledged loyalty to the Islamic State on Facebook after the attack, a pledge the media quickly trumpeted and led to pressure on social media companies. In reality, the attackers did not make such a post. They did declare their allegiance, but they did so only in private communication and, according to the FBI, did not have direct links to the group. Amplifying the confusion, the Islamic State seized the propaganda coup offered to it, claiming the attackers as "soldiers of Caliphate."

Conversely, some attackers with minimal public signaling have maintained sustained contact with foreign handlers. The 2015 Paris attackers, for example, traveled from the caliphate in Syria to conduct their attacks and were otherwise under the direction of Islamic State leaders. Stronger evidence of organizational direction includes pre-attack martyrdom videos, encrypted communications, or logistical support, all of which suggest prior contact and some degree of control.

At times, there is a middle ground. Attackers may not be directed by the Islamic State or other group leaders, but senior jihadists might encourage attacks in email or chats, provide resources for obtaining weapons, or otherwise go beyond issuing propaganda. Al Qaeda leader Anwar al-Awlaki, for example, both issued propaganda and often engaged directly with would-be jihadists or helped facilitate their travel to jihadist hotspots like Yemen.

Understanding where an attacker falls on this operational spectrum matters enormously. At one end are individuals whose ideological affinities are real but whose operational ties are weak or nonexistent. At the other end are operatives embedded in networks that provide training, guidance, financing, and target selection. Many recent attacks occupy the murky middle ground, where online interaction and remote encouragement blur the line between autonomy and direction. Treating all these cases as identical leads to distorted threat assessments and misallocated resources. If a broader network is involved, that network must be uprooted for the danger to become manageable, and this may require operations overseas. On the other hand, if the danger is primarily from radicalized individuals, counter-radicalization programs and more engaged law enforcement may be the most important counterterrorism measures.

Even when an attack itself is executed by only one or two individuals, it is rarely socially isolated, and it is important to ask if a broader network was implicated. Attackers often emerge from broader ideological ecosystems-informal communities, online forums, prison networks, or political subcultures-that normalize or encourage violence. Timothy McVeigh's path to the Oklahoma City bombing, for example, was shaped by years of immersion in anti-government extremist circles rather than by a single organization issuing orders. Disrupting these permissive environments is often more important for long-term counterterrorism than dismantling any single cell.

Another critical question is whether foreign actors are involved and, if so, how. Foreign links trigger different legal authorities, investigative tools, and bureaucratic responses. The policy implications of a locally radicalized individual differ sharply from those of a plot facilitated by overseas operatives. If a group is foreign-based, military strikes might be considered against hostile or weak states, while intelligence cooperation might increase with some potential partners.

If there is a foreign link, the next question is whether a hostile foreign government played a role, and if so, what kind? Some actively sponsor terrorist groups, as Iran has done with Hezbollah since its inception in the 1980s. Others tolerate fundraising, travel, or propaganda activity that enables violence elsewhere. Russia has become more active, working with an array of criminal and right-wing individuals to sow chaos in Europe. Even allied governments can, through neglect or political calculation, create permissive conditions that extremist organizations exploit.

Communities that surround a terrorist can play an indispensable role in preventing attacks and apprehending a terrorist, should prevention fail, but they can also be part of the problem-where they stand is important to determine. In the United States, sustained collaboration between Muslim communities and law enforcement has contributed significantly to counterterrorism success. Where communities are alienated, distrustful, or stigmatized, as is true with many Muslim communities in Europe, cooperation erodes-and security suffers. This lesson applies equally to other forms of extremism. Communities that refuse to confront violence committed in the name of their political causes inadvertently create space for radicalization.

Additional questions arise if the attack might involve left- or right-wing terrorism. There is no large U.S. Muslim organization calling for the imposition of Islamic law or promoting other jihadist ideas. In contrast, right- and left-wing extremism often overlaps with legitimate political debates over guns, abortion, federal authority, or immigration. Violent actors exploit grievances that millions of peaceful citizens share in nonviolent form. Racism and antisemitism, while diminished from past levels, remain problems. This proximity to politics complicates prevention and accountability. Particular care is necessary when evaluating politically sensitive issues, such as immigration. Trump administration officials, for example, seized on an inaccurate news report that Shamsud-Din Jabbar, who conducted the January 1, 2025, vehicle ramming attack in New Orleans, had entered the United States illegally. Similarly, many on the left are lionizing Luigi Mangione, who is accused of killing healthcare CEO Brian Thompson in 2024, embracing the anticorporate political agenda and ignoring the violence. While communities should reject violence unequivocally, they often hesitate to police their own ideological fringes, especially when sympathy for the underlying cause blurs moral boundaries.

Understanding an attack also requires situating it within broader trends, and these are often confusing and involve many ambiguities. Terrorism is designed to feel existential, but perception often diverges sharply from reality. Although the Bondi Beach massacre in Australia shows the limits of gun control laws, the rarity of mass casualty events in that country also shows their success. In the United States, deaths from jihadist-linked terrorism since September 11 have been far lower than many feared in the immediate aftermath of those attacks. Although attacks like that in New Orleans show the continued danger of jihadist violence, it is important to recognize that jihadist violence has fallen significantly in the last 10 years. These patterns reflect not inevitability, but sustained intelligence, law enforcement, and preventive efforts. Without long-term context, each new attack risks being misinterpreted as evidence of inexorable escalation rather than as part of a fluctuating but often contained threat environment.

Inevitably, attention then turns to government performance-and here there can be many questions. Terrorism is difficult to prevent completely, and counterterrorism success often means fewer attacks rather than no attacks at all-a difficult standard to accept when people are grieving after a bloody strike. Failures occur, but they are often systemic rather than personal. Fragmented intelligence structures, poor information sharing, legal constraints, and resource imbalances frequently matter more than individual negligence. The temptation to scapegoat after tragedy is understandable, but serious reform requires diagnosing institutional weaknesses rather than assigning blame reflexively. It is vital to ensure that there are review mechanisms, transparency requirements, and other ways to ensure that government structures are adjusting to the threat of terrorism.

Even when errors come to light, reform is not automatically warranted. Every new authority or security measure carries costs: Tighter borders impede commerce; expanded surveillance raises civil-liberties concerns; and broader information sharing risks misuse or overload. Democracies must resist the illusion that perfect security is achievable. Demanding absolute prevention risks undermining resilience-the very quality that allows societies to absorb shocks without surrendering core values.

Political leadership is therefore central. After terrorist violence, leaders are expected to reassure the public, affirm democratic values, and reinforce trust in institutions. When leaders instead inflame divisions, legitimize extremist rhetoric, or undermine confidence in law enforcement, they inadvertently advance terrorists' goals. Although there should always be room for legitimate and peaceful politics, a line should be drawn when it comes to justifying violence. Rhetoric that excuses or minimizes extremist movements, even indirectly, can embolden perpetrators and weaken community cooperation at precisely the moment it is most needed.

Ultimately, the most important questions after a terrorist attack are not only operational but civic. How societies interpret violence shapes how they respond to it. Misinformation, fear-driven overreaction, and politicization can inflict damage long after physical wounds have healed. A failure of government to address community fears and concerns can undermine trust in institutions and social cohesion-a goal of many terrorists. Conversely, disciplined analysis, institutional accountability, political leadership, and societal resilience can deny terrorists their broader objectives.

No single framework can anticipate every attack or eliminate uncertainty. Each incident brings unique facts, actors, and consequences. But by consistently asking hard, informed questions-about organization, networks, state involvement, community dynamics, trends, governance, and proportional response-we can impose order on chaos.

Daniel Byman is the director of the Warfare, Irregular Threats, and Terrorism Program at the Center for Strategic and International Studies in Washington, D.C.

Programs & Projects

Brief by Daniel Byman and Riley McCabe - September 25, 2025

Podcast Episode by Riley McCabe - June 17, 2025