---
author:
- Aaron Clauset
- Kristian Skrede Gleditsch
title: The developmental dynamics of terrorist organizations
---

[**Traditional studies of terrorist group behavior [@terrorism:definition] focus on questions of political motivation, strategic choices, organizational structure, and material support [@cordes:etal:1985; @hoffman:1998; @enders:sandler:2002; @pape:2003; @sageman:2004; @li:2005], but say little about the basic laws that govern how the frequency and severity (number of deaths) [@clauset:young:gleditsch:2007] of their attacks change over time. Here we study 3,143 fatal attacks carried out worldwide from 1968–2008 by 381 terrorist groups [@mipt:2008], and show that the frequency of a group’s attacks accelerates along a universal trajectory, in which the time between attacks decreases according to a power law in the group’s total experience; in contrast, attack severity is independent of organizational experience and organizational size. We show that the acceleration can be explained by organizational growth, and suggest that terrorist organizations may be best understood as firms whose primary product is political violence. These results are independent of many commonly studied social and political factors, suggesting a fundamental law for the dynamics of terrorism and a new approach to understanding political conflicts.** ]{}

High-quality empirical data on terrorist groups, such as their recruitment, fundraising, decision making, and organizational structure, are scarce, and the available sources are not typically amenable to scientific analysis [@jackson:etal:2005]. However, good-quality data on the frequency and severity of their attacks do exist, and their systematic analysis can shed new light on which facets of terrorist group behavior are predictable and which are inherently contingent. Each record in our worldwide database of 3,143 fatal attacks [@mipt:2008] includes its calendar date $t$, its severity $x$, and the name of the associated organization, if known (see Supplementary Information).

For each group, we quantify the changes in the frequency and severity of a group’s attacks over its lifetime using a *development curve*. This curve maps a group’s behavior onto a common quantitative scale and facilitates the direct comparison of different groups at similar points in their life histories. To construct this, we plot the behavioral variable, such as the time (days) between consecutive attacks [$\Delta t$]{} or the severity of an attack $x$, as a function of the group’s maturity or experience $k$, indexed here by the cumulative number of fatal attacks (Fig. \[fig:individual:devcurves\]). Combining the developmental curves of many groups produces an aggregate picture of their behavioral dynamics, and allows us to extract the typical developmental trajectory of a terrorist group.

Constructing a combined development curve for the 381 organizations in our database, we find that the time between consecutive attacks [$\Delta t$]{} changes in a highly regular way (Fig. \[fig:development\]a), while the severity of these attacks $x$ is independent of organizational experience (Fig. \[fig:development\]c).

![image](devcurves_4groups_freq_sev.eps)

Empirically, the time between attacks decreases quickly as a group gains experience. For example, the mean delay between the first and second fatal attacks is almost six months, $\langle{\ensuremath{\Delta t}}\rangle=168.6\pm0.6$ days, while after 13 attacks, the mean delay is only $\langle{\ensuremath{\Delta t}}\rangle=27\pm1$ days. More generally, the envelope or distribution of delays $p({\ensuremath{\Delta t}},k)$ can be characterized as a truncated log-normal distribution with constant variance $\sigma^{2}$ and a characteristic delay between attacks $\mu$ that decreases systematically with experience $k$. Mathematically: $$\begin{aligned}
p(\log{\ensuremath{\Delta t}},\log k) & \propto {\rm exp}\!\left[\frac{-(\log \Delta t+\beta \log k-\mu)^{2}}{2\sigma^{2} }\right]  \enspace ,
\label{eq:model}\end{aligned}$$ where $\beta$ controls the trajectory of the distribution toward the natural cutoff at ${\ensuremath{\Delta t}}=1$ day. For small $k$, i.e., during a group’s early development, this model predicts a mean delay between attacks that decays like a power law ${\ensuremath{\Delta t}}\approx\mu\,\!k^{-\beta}$; however, as $k$ increases, this trend is attenuated as the mean delay asymptotes to ${\ensuremath{\Delta t}}=1$ (see Supplementary Information). Under this model, $\beta=1$ would indicate a simple linear feedback between a group’s attack rate and its experience. However, we find $\hat{\beta}=1.10\pm0.02$, indicating a faster-than-linear feedback between the accumulation of experience and the rate of future attacks.

This model successfully predicts that the distributions of normalized delays ${\ensuremath{\Delta t}}\,k^{\hat{\beta}}$ will collapse onto a single log-normal distribution with parameters $\hat{\mu}$ and $\hat{\sigma}$ (Fig. \[fig:development\]b). However, individual attacks cannot be considered fully independent ($p=0.00\pm0.03$; see Supplementary Information), indicating that significant temporal or inter-group correlations may exist in the timing of a group’s future attacks [@clauset:etal:2009:b] (Fig. \[fig:individual:devcurves\]).

In contrast, the severity of an attack $x$ is independent of group experience $k$ (Fig. \[fig:development\]c; $r=-0.024$, t-test, $p=0.17$), as illustrated by the collapse of the severity distributions $p(x\,|\,k)$ onto a single invariant heavy-tailed distribution [@clauset:young:gleditsch:2007; @clauset:etal:2009] (Fig. \[fig:development\]d; see Supplementary Information). For example, the mean severity of a group’s first attack $\langle x\rangle=6.7\pm0.9$ is only slightly larger than the mean severity of all attacks by very experienced groups ($k>100$) $\langle x\rangle=5.1\pm0.6$. Thus, contrary to common assumptions, young and old groups are equally likely to produce extremely severe events. Older groups, however, remain significantly more lethal overall [@asal:rethemeyer:2008] because they attack much more frequently than small groups, not because their individual attacks are more deadly.

Here, we consider four explanations for the acceleration in the frequency of attacks: (i) organizational learning [@jackson:etal:2005], (ii) organizational growth, (iii) sampling artifacts, and (iv) averaging artifacts [@gallistel:etal:2004]. Organizational learning—commonly studied in manufacturing [@dutton:thomas:1984; @argote:1993] and called “learning by doing”—implies that terrorist groups are born clumsy and increase their attack rate primarily because their existing members learn to be more efficient, e.g., better planning, coördination, and execution. In contrast, organizational growth implies that groups are born small and increase their attack rate primarily by recruiting new, replaceable, relatively independent members, e.g., adding new terrorist cells. Straightforward tests of the data can eliminate both artifactual explanations (see Supplementary Information), indicating that the acceleration is real, even at the level of an individual group (Fig. \[fig:individual:devcurves\]).

The relative importance of organizational learning and organizational growth cannot be estimated using frequency and severity data alone. Untangling their effects requires data both on event planning and execution, and on a group’s size and recruitment at various points in its life history. To our knowledge, systematic data on event planning and execution do not exist. The best available data on group sizes, taken from an expert survey [@asal:rethemeyer:2008], are coarse (roughly order of magnitude) estimates of the maximum size achieved by each of the 381 groups over the 1998–2005 period; of these 161 conducted at least one fatal attack, and 80 conducted at least two.

![image](delays_trend_final.eps) ![image](delays_collapse_final.eps)\
![image](sev_trend_final_c.eps) ![image](sev_collapse_final_d.eps)

The growth hypothesis predicts that a group’s maximum size will be inversely related to the minimum delay between its attacks over the 1998–2005 period. An analysis of variance indicates that the average minimum delays in the four size categories are significantly different (Fig. \[fig:group:sizes\]a; $n$-way ANOVA, $F=9.98$, $p<0.000013$), and further that larger organizational size is a highly significant predictor of increased attack frequency ($r=-0.49$, t-test, $p<10^{-5}$). In contrast, size, like experience (Fig. \[fig:development\]c), is not a significant predictor of attack severity (Fig. \[fig:group:sizes\]b; see Supplementary Information).

Although operational, organizational, and political circumstances vary widely across terrorist groups, the systematic nature of our results suggests several general conclusions. The strong dependence of attack frequency on experience (Fig. \[fig:development\]a) suggests that the timing of events is governed primarily by organizationally internal factors, like growth and learning, related to group development, e.g., recruitment, personnel turnover, and internal coördination. Our analysis of group sizes lends significant support to the growth hypothesis, but without additional data, we cannot eliminate the possibility that these groups are also learning. Even so, our results implicate these internal factors as leverage points for decreasing the incidence rate of future attacks. In contrast, internal factors seem to play a marginal role in the severity of any particular attack (Figs. \[fig:development\]c and \[fig:group:sizes\]b), implying that the lethality of larger and more mature groups [@asal:rethemeyer:2008] is explained by their more frequent activity rather than more deadly activity. Further, we note that curtailing the frequency of a group’s attacks, perhaps by limiting growth, would reduce the [*cumulative risk*]{} of very severe attacks.

Learning and growth may also constrain other behaviors, such as fundraising, resource availability, political motivation [@sageman:2004; @krueger:2007], strategic choices in timing [@kydd:walter:2002] and targets [@enders:sandler:2002], and the use of tactics like suicide bombs [@pape:2003]. However, most groups never achieve a high level of experience ($k>100$), and it is unclear to what degree this leaky pipeline is caused by group death, e.g., from counter-terrorism activities or internal conflicts [@cronin:2006; @jones:libicki:2008], versus shifts away from violence. Similarly, it is unclear whether or how these dynamics change when a group does become highly experienced. Once a group is large enough to execute almost daily attacks, it may be more like a social institution, and thus face different constraints and incentives than smaller, still developing groups. It is also unclear what mechanism explains the power-law distribution in the severity of terrorist attacks [@clauset:young:gleditsch:2007; @clauset:etal:2009], and its independence of organizational experience and size. Two possibilities are (i) the advantages and disadvantages of youth (small size and the element of surprise vs. poor resources and clumsy attacks) balance those of maturity (more resources and better planning vs. risk aversion and hostile attention from governments), yielding apparent independence; and (ii) severity is inherently random, governed by contingent details associated with the particular attack, the particular group, etc.

  --------------------------------------------- -----------------------------------------------
   ![image](groupsize_minfreq_1998-2005_a.eps)   ![image](groupsize_mediansev_1998-2005_b.eps)
  --------------------------------------------- -----------------------------------------------

The development curves shown here are similar in form to production curves found in manufacturing [@dutton:thomas:1984], in which per-item production costs tends to decrease like a power law in the cumulative number of items produced. In this light, terrorist groups may best be understood as firms whose principal product is political violence, and whose production rates depend largely on organizational growth and the availability of low-skill labor. Thus, studies of event-driven, non-terrorist organizations, e.g., some non-profits, political activism groups, and commercial firms, could shed additional light on the dynamics of terrorist groups. A better understanding of how these groups are like, and unlike, non-terrorist human social groups may indicate which counter-terrorism policies, e.g., limiting growth by stifling recruitment or by forcing organizational turnover, are likely to be effective.

Finally, we note that our results are independent of many commonly studied factors, including geographic location, time period, ideological motivations (religious, separatist, reactionary, etc.), and political context. Some aspects of terrorism are thus not nearly as contingent as is widely assumed, and quantifying dynamical patterns in political conflict can serve the broader goal of understanding what regularities exist, why they exist, and what they imply for long-term social and political stability.

[**Acknowledgments**]{} The authors thanks L.-E. Cederman, K. Drakos, B. Karrer, J. McNerney, J. H. Miller, M. E. J. Newman, A. Ruggeri, D. Sornette, C. R. Shalizi, and M. Young for helpful conversations. This work was supported in part by the Santa Fe Institute, the Economic and Social Research Council (RES-062-23-0259), and the Research Council of Norway (180441/V10).\

[10]{} url \#1[`#1`]{}urlprefix\[2\][\#2]{} \[2\]\[\][[\#2](#2)]{}

*et al.* ** (, , ).

** (, , ).

& In (ed.) ** (, , ).

. ** ****, ().

** (, , ).

** ****, ().

, & . ** ****, ().

. (). .

*et al.* **, vol.  (, , ).

, , & (). .

, & (). .

& . ** ****, ().

, & . ** ****, ().

& . ** ****, ().

. ** ****, ().

** (, , ).

& . ** ****, ().

. ** ****, ().

& ** (, , ).

Appendix \[sec:terrorism:data\]: Terrorism data

-   \[sec:data:events\]: Events

-   \[sec:data:organizations\]: Organizations

-   \[sec:unattributed\]: Attributed vs. unattributed events

-   \[sec:domestic:transnational\]: Domestic vs. transnational events

Appendix \[sec:dev:curve:model\]: Attack frequency development curve model\
Appendix \[sec:tests:of:delay:curve\]: Tests of the attack frequency development curve

-   \[sec:average:sampling\]: Averaging and sampling artifacts

-   \[sec:p:value\]: Calculation of statistical significance; $p$-value

Appendix \[sec:severity:by:experience\]: Analysis of attack severity development curve\
Appendix \[sec:group:sizes\]: Additional analyses of group size

Terrorism Data {#sec:terrorism:data}
==============

Events {#sec:data:events}
------

Many organizations track terrorist events worldwide, but few provide their data in a form amenable to scientiÞc analysis. The most popular source of information on terrorist events in the political science literature is the ITERATE data set [@s:mickolus:etal:2004], which focuses exclusively on transnational terrorist events, i.e., events involving actors from at least two countries. For the analysis of terrorist groups, however, domestic events, i.e., events involving actors from only one country, are equally relevant. Thus, we use the data contained in the National Memorial Institute for the Prevention of Terrorism [@s:mipt:2008] database, which largely overlaps with the ITERATE data but also includes fully domestic terrorist events since at least 1998.

The MIPT database combines the RAND Terrorism Chronology 1968-1997, the RAND-MIPT Terrorism Incident database (1998-2008), the Terrorism Indictment database (University of Arkansas and University of Oklahoma), and DFI International’s research on terrorist organizations. Since we last collected event data [@s:mipt:2008], MIPT mandate was changed by the U.S. Department of Homeland Security such that maintaining and making publicly available this data was no longer a priority. Our understanding is that the MIPT data will eventually be merged with the Global Terrorism Database (GTD) managed by the START program, a U.S. Department of Homeland Security Center of Excellence, at the University of Maryland, College Park.

Records in the MIPT database are derived by a team of specialized scholars from original sources, largely reports in newspapers worldwide, accessible via the LexusNexis service and other means. This human element presents the possibility that some records, particularly those corresponding to non-lethal events, could be missing or corrupted by poor reporting [@s:danzger:1975]. In order to mitigate the effect of such biases, we focus our analysis on the portion of the database that is most trustworthy [@s:clauset:young:gleditsch:2007], namely those events that resulted in at least one fatality, since these events are typically reported more reliably in the media [@s:snyder:kelly:1977].

The MIPT database contains 35,688 recorded terrorist attacks worldwide from January 1968 to January 2008; these events occurred in almost 6,000 cities in over 180 nations. 13,274 (37.2%) of the events resulted in at least one fatality while 10,085 (28.3%) were attributed to one of 910 organizations. The intersection of these criteria, i.e., events that were both fatal and attributed, includes 3,143 events attributed to 381 organizations. (106 such events were attributed to more than one organization; in our analysis, we give all groups credit for such an event.) This set of organizations includes most common ideological motivations, such as national-separatist, reactionary, religious, and revolutionary ideologies [@s:miller:2007], and spans a wide variety of political contexts.

In some cases, groups carried out multiple attacks on the same day. For our analysis of the delay between consecutive attacks, these few cases present a difficulty by inducing a delay variable of ${\ensuremath{\Delta t}}=0$. For simplicity, we combine such concurrent attacks into a single record with a severity equal to the sum of the fatalities of its component attacks.

Organizations {#sec:data:organizations}
-------------

There are very few sources of systematic data on terrorist organizations worldwide. The START program at the University of Maryland currently hosts some data under their “Terrorist Organization Profiles” (TOPs) program; this data was originally developed by Detica, Inc., a British defense contractor, and was accessible from the MIPT from c.1998 to March 2008. Estimates of group sizes in this database are relatively few, and the methodology used to derive them opaque.

![The severity distributions for attributed and unattributed events, along with maximum likelihood power-law models for their tails. See Table \[table:unattributed\] for details. []{data-label="fig:unattributed"}](severity_attribution.eps)

                   $n$     $\langle x \rangle$   $\sigma$   $x_{\max}$   $\hat{x}_{\min}$   $\hat{\alpha}$        $p$
  -------------- -------- --------------------- ---------- ------------ ------------------ ---------------- ---------------
  Attributed      3,143            6.6             52.1        2749          $10\pm3$       $2.24\pm0.12$    $0.78\pm0.03$
  Unattributed    10,131           3.5             10.5        500           $14\pm3$       $2.55\pm0.12$    $0.19\pm0.03$
  All events      13,274           4.2             51.3        2749          $10\pm3$       $2.39\pm0.09$    $0.39\pm0.03$

Jones and Libicki, working at the RAND Corporation, compiled a database of information on 649 terrorist groups. This database includes estimates of the group’s peak size over its entire lifetime [@s:jones:libicki:2008]. Unfortunately, the breadth of time over which the size estimate holds makes it difficult to tightly relate size with behavior.

Finally, Asal and Rethemeyer extracted data from the MIPT list of organizations and augmented it with data drawn from public sources and estimates from a panel of experts at the Monterey Institute of International Studies (MIIS) [@s:asal:rethemeyer:2008]. This data provides coarse (roughly order of magnitude) estimates of maximum size over the 1998–2005 period. Given the care taken in constructing the Asal and Rethemeyer data, it appears to be the most accurate data on terrorist group sizes currently available. Of the groups they consider, 161 conducted at least one fatal attack over the 1998–2005 period, and 80 conducted at least two. For our analyses of group size (Appendix \[sec:group:sizes\]), we consider the former set for questions of event severity, and the latter set for questions of event frequency.

Attributed vs. unattributed events {#sec:unattributed}
----------------------------------

Because a large fraction of the MIPT events are not attributed to any particular terrorist organization, an important question is whether the unattributed events differ from the attributed events in important ways. For example, are attributed events systematically more severe than unattributed events? This might be the case if there were a systematic bias or incentive for attacking organizations to be associated with their more severe events, perhaps to gain greater media attention. We can test for such a bias by separately considering the severity distributions for attributed and unattributed events in the MIPT database. Fig. \[fig:unattributed\] shows these distributions, along with their corresponding power-law fits; Table \[table:unattributed\] summarizes these data and models.

The results show that the attributed- and unattributed-event severity distributions are extremely similar. Their averages and standard deviations differ primarily because these are high-variance distributions, and the presence of a few very large attributed events drives outsized differences in these summary statistics. There are slight differences in the bodies (small $x$, see Fig. \[fig:unattributed\]), and the upper tails are almost identical [@s:clauset:etal:2009]: both are plausibly distributed according to power laws and span largely indistinguishable ranges of severity, but have slightly different scaling exponents (Table \[table:unattributed\]). Although we find some evidence for a very weak relationship between severity and attribution, our results imply that the severity of attributed and unattributed events do not differ in qualitatively important ways.

![The attack frequency development curves for groups whose first attack was [**a**]{}, in 1968–1997 or [**b**]{}, in 1998–2008, illustrating that the development curve progression for attack frequency is not merely a transnational or domestic phenomenon, and is robust to the change in the definition of the MIPT database in 1998. The expected mean delay shown here is taken from the main text, and thus serves as a reference point. []{data-label="fig:1998"}](frequency_devcurve_1968-1997_a.eps "fig:") ![The attack frequency development curves for groups whose first attack was [**a**]{}, in 1968–1997 or [**b**]{}, in 1998–2008, illustrating that the development curve progression for attack frequency is not merely a transnational or domestic phenomenon, and is robust to the change in the definition of the MIPT database in 1998. The expected mean delay shown here is taken from the main text, and thus serves as a reference point. []{data-label="fig:1998"}](frequency_devcurve_1998-2008_b.eps "fig:")

There is no clear theoretical reason to expect that the delay between events ${\ensuremath{\Delta t}}$ should be systematically related to attribution. However, because the development curve analysis described in Appendix \[sec:dev:curve:model\] omits all of the events carried out by a group but which are not attributed to it, the empirical delay between consecutive attacks is at best an upper-bound on the true delay. (Unfortunately, it is unknown how the observed delay between attributed events relates to the true delay between consecutive events.) This implies that our estimate of the acceleration of attack rates (characterized by $\beta$) may overestimate its true value. The systematic patterns shown in Fig. \[fig:development:freq\] and Fig. \[fig:development:sev\] suggest that, unless they are highly pathologically distributed as a function of $k$, incorporating correctly labeled unattributed events is unlikely to fundamentally change our results.

Domestic vs. transnational events {#sec:domestic:transnational}
---------------------------------

The MIPT data has an important bias, due to its particular maintenance history. From 1968–1997, the database was maintained by the RAND Corporation as part of its project on transnational terrorism. As a result, almost no domestic terrorist attacks are included before 1998, after which the scope of the database was significantly expanded (in part due to the Oklahoma City bombing in 1995) to include purely domestic events worldwide. Thus, an important check on the generality of our results is to ask whether the attack frequency development curves depend on mixing data across the critical 1998 date. To test for this sensitivity, we construct combined development curves from events by groups whose first attack was before 1 January 1998 (mainly transnational groups), and separately from events by groups whose first attack was on or after 1 January 1998 (transnational and domestic groups). Groups in the MIPT database are not coded as being transnational or domestic, and adding such data is a highly non-trivial task for a database of this size.

Figure \[fig:1998\] shows that the development curve phenomenon is robust to this division of data. That being said, one difference is worth noting. The development curve for the 1968–1997 data shows a much slower overall rate of acceleration than does the 1998–2008 curve. The origin of this difference may be related to the rise of religiously motivated terrorism in the 1990s and beyond; however, sorting out its cause is beyond the scope of both this test and this study. For our purposes, it suffices to demonstrate that the development curve’s overall form is robust to the MIPT’s coverage bias.

![[**a**]{}, The mean delay $\langle\log{\ensuremath{\Delta t}}\rangle$ between attacks by a terrorist group, with $25^{\rm th}$ and $75^{\rm th}$ percentile isoclines, as a function of group experience $k$. The solid line shows the expected mean delay, from the model described in the text. [**b**]{}, The distributions of normalized delays $p({\ensuremath{\Delta t}}\,k^{\hat{\beta}})$, showing the predicted data collapse onto an underlying log-normal distribution.[]{data-label="fig:development:freq"}](delays_trend_final.eps "fig:") ![[**a**]{}, The mean delay $\langle\log{\ensuremath{\Delta t}}\rangle$ between attacks by a terrorist group, with $25^{\rm th}$ and $75^{\rm th}$ percentile isoclines, as a function of group experience $k$. The solid line shows the expected mean delay, from the model described in the text. [**b**]{}, The distributions of normalized delays $p({\ensuremath{\Delta t}}\,k^{\hat{\beta}})$, showing the predicted data collapse onto an underlying log-normal distribution.[]{data-label="fig:development:freq"}](delays_collapse_final.eps "fig:")

Attack frequency development curve model {#sec:dev:curve:model}
========================================

This model comes from the observation that the distributions of delays $p({\ensuremath{\Delta t}},k)$ for different values of $k$ collapse onto a single universal curve (Fig. \[fig:development:freq\]b) of the form $$\begin{aligned}
p(\log{\ensuremath{\Delta t}},\log k) & = C\,{\rm exp}\!\left[\frac{-(\log {\ensuremath{\Delta t}}+\beta\log k-\mu)^{2}}{2\sigma^{2} }\right]  \label{eq:model2}
 \\
C & = \frac{\sqrt{2/\pi}}{ \sigma \left(1 - {\rm Erf}\!\left[\frac{\beta \log k-\mu}{\sigma\sqrt{2}}\right]\right)} \enspace , \nonumber\end{aligned}$$

![image](devcurves_8groups_frequency.eps)

where ${\rm Erf}$ is the error function and $C$ is the normalization constant. In words, the logarithm of the delay is normally distributed $\mathcal{N}(\mu,\sigma)$ (or equivalently, the delay is log-normally distributed), but has a natural lower cutoff at ${\ensuremath{\Delta t}}=1$ day (which comes from the resolution of the recorded data) and a $\mu$ parameter that decreases systematically as $k$ increases. The parameter $\mu$ denotes the characteristic delay between attacks, and in particular the delay between the first and second attacks, while $\sigma^{2}$ denotes the variance in the expected delay. Due to the breadth of the log-normal distribution, a non-trivial value of $\sigma$ implies a wide degree of variability in the waiting time, even given the characteristic delay $\mu$. By integrating, we can derive the expected mean delay from Eq. , which has the form $$\begin{aligned}
{\rm E}[\log{\ensuremath{\Delta t}}] = \mu - \beta \log k + \left(\frac{ {\rm exp}\!\left[ \frac{-(\beta \log k - \mu)^{2}}{2\sigma^{2}}  \right] \sqrt{2/\pi}   }{\sigma^{-1}\left(1-{\rm Erf}\!\left[ \frac{\beta \log k - \mu}{\sigma\sqrt{2}} \right]\right)} \right)\enspace .
\label{eq:expected:delay}\end{aligned}$$ For small values of $k$, the expected delay is dominated by the first two terms, and thus decays according to a power-law ${\ensuremath{\Delta t}}\approx \mu k^{-\beta}$, where $\mu$ represents the initial rate of attack for a group. At larger values of $k$, the expected delay is dominated by the third term in Eq. , which makes the expected delay to approach ${\ensuremath{\Delta t}}=1$ more slowly than a power law.

The model’s parameters $\mu$, $\sigma$ and $\beta$ can be estimated directly from the data using standard numerical procedures (the simplex or Nelder-Mead method [@s:nelder:mead:1965], in this case) to maximize the likelihood of the data. Standard error estimates for the parameters can then be numerically estimated using the method of Fisher information to approximate the width of the log-likelihood function in the vicinity of the maximum [@s:barndoff-nielsen:cox:1995]. Applying these methods to our data yields $\hat{\mu}=5.67\pm0.05$, $\hat{\sigma}=2.12\pm0.02$, and $\hat{\beta}=1.10\pm0.02$. The estimated value of $\beta$ has particular significance: $\beta=1$ indicates a simple linear feedback between the gain in experience and the change in attack rate, with deviations above and below indicating super- and sub-linear feedback. The estimated $\hat{\beta}>1$, thus indicates super-linear feedback, which implies an explosive acceleration in the attack rate in finite time. However, this explosive growth is strongly attenuated by the third term in Eq. , which prevents the actual attack rate from reaching extremely high levels.

Although desirable, estimates of individual group trajectories are difficult to obtain using this procedure, due to a severe $O(k_{*}^{-1/4})$ finite-size bias in the estimation of $\mu$ (where $k_{*}$ denotes the total number of attacks by the group), and slightly less severe biases in estimating $\sigma$ and $\beta$. On the other hand, combining data from many groups yields a less severe $O(n^{-1/2})$ bias in each parameter (where $n$ is the total number of delays combined). For the combined development curve, we have $n\approx2500$, and the finite-size bias is negligible (less than 0.1 for each parameter).

Finally, we point out that very few groups (e.g., Hamas, Fatah, LTTE, FARC, etc.) manage to become highly experienced ($k\gtrsim100$). The sparsity of the data for large $k$ means that the fit in this region is primarily controlled by the delays at much smaller values of $k$, where the vast majority of data lay (Fig. \[fig:development:freq\]a). This explains the slight misfit to the delays for highly experienced groups, relative to the empirical observations, and highlights the fact that the behavior of inexperienced groups is predictive of the behavior of more mature groups.

Tests of Attack Delay Development Curve {#sec:tests:of:delay:curve}
=======================================

Averaging and sampling artifacts {#sec:average:sampling}
--------------------------------

As described in the main text, there are several possible explanations for the observed universal development curve for the frequency of terrorist attacks by a group. These are (i) organizational learning [@s:argote:etal:1995], (ii) organizational growth, (iii) sampling artifacts, and (iv) averaging artifacts [@s:gallistel:etal:2004]. Here we show that the sampling and averaging explanations can be eliminated using the available empirical data.

In the sampling scenario, groups are born with some unique, but fixed, attack rate $\mu_{i}$. As each group progresses through its lifetime, groups with slower attack rates (larger $\mu_{i}$) die out first. This implies that the maximum experience $k_{*}$ achieved by a group should be inversely proportional to its attack rate $\mu_{i}$. The net result of sampling groups in this way is to leave progressively fewer groups with large $\mu_{i}$ values at larger experiences $k$, which gives the illusion of a smooth trend toward faster attack rates.

In the averaging scenario, groups can exhibit one of two attack frequencies: daily attacks (fast attackers) or attacks at some rate $\mu$ (slow attackers). Initially, all groups are slow attackers; however, at a group-specific experience threshold $k_{\circ,i}$, they switch behaviors and become fast attackers. The individual development curve for such a group would be a step function. By combining many such step functions, each with a different step location $k_{\circ,i}$, i.e., by averaging across the different thresholds, the combined development curve show a smooth trend toward faster attack rates even though no individual group behaves that way. (As an aside: this averaging across thresholds model has been used to explain the apparently progressive learning curves for certain behaviors in animals [@s:gallistel:etal:2004] and is thought to underly some evolved regulatory behaviors among eusocial insects [@s:jones:etal:2004].)

It is instructive to again use the factory analogy. In the case of selection artifacts, different factories have different intrinsic production rates, but slower factories go out of business sooner, leaving a progressively larger fraction of fast factories at later times. Thus, although no factory exhibits a progressive trend toward faster production, as time passes, a larger fraction of the slow factories have died off, and the average rate of the remaining factories progressively increases. In the case of averaging artifacts, all factories begin with slow production rate, but at a randomly chosen time in the future, each switches from slow to fast production (due to a sudden insight or a sudden windfall profit). Thus, although no individual factory exhibits a progressive trend toward faster production, as time passes, a larger fraction of factories have switched to the faster rate, and the average rate of all factories progressively increases.

Both the sampling and averaging explanations can be tested using the available event frequency data. The sampling explanation predicts an inverse relationship between a group’s characteristic attack rate $\mu_{i}$ and its maturity $k_{*,i}$ (total number of attacks), i.e., groups with larger $\mu_{i}$ (slower attack rate) die out more quickly and thus should exhibit a smaller number of total events. Unfortunately, the finite-size bias mentioned in Appendix \[sec:dev:curve:model\] prevents us from testing this prediction directly, by first estimating each group’s $\mu_{i}$ via maximum likelihood and then testing if $\mu_{i}$ varies inversely with $k_{*,i}$. Instead, we must use a more indirect test. Here, we use the first delay variable for a group ${\ensuremath{\Delta t}}^{(1)}_{i}$ as a proxy for the group’s attack rate $\mu_{i}$. Regressing each group’s initial delay against its total experience yields no significant relationship ($r=-0.057$, t-test, $p=0.46$), and similarly for the logarithm of delay and experience ($r=-0.114$, t-test, $p=0.14$). (Notably, the empirical $k_{*,i}$ underestimates the total number of attacks by a group for all groups still active today; however, this particular kind of bias is unlikely to transform an inverse relationship between ${\ensuremath{\Delta t}}^{(1)}_{i}$ and $k_{*,i}$ into the null relationship we observe here.)

A strong test of the sampling explanation, which also tests the averaging hypothesis, is to plot the individual attack frequency development curves for the groups with the most fatal attacks. Fig. \[fig:averaging:test\] shows these curves for the eight most experienced groups in our database. Notably, none of these curves exhibits the predicted switching behavior (from low to high frequency) predicted by the averaging hypothesis, and very few (Islamic State of Iraq, and possibly al Qaeda in Iraq) exhibit extremely short initial delays; instead, each generally exhibits a progressive increase in attack rate, and similar results hold for less experienced groups.

Thus, although the combined development curve may not represent precisely the development of any individual organization—and indeed, we see that individual groups do indeed deviate from the population trend (Fig. \[fig:averaging:test\])—its general shape is an accurate description of the tendencies of each group.

![The numerically estimated distribution of $p$-values (4000 reps.) for data drawn iid from the generative model described in Eq. , using the procedure described in Appendix \[sec:p:value\], shown as [**a**]{}, the histogram with standard error estimates and [**b**]{}, the cumulative distribution function. The dashed line shows the null-model of a uniform distribution, and the estimated distribution’s uniformity indicates that the Monte Carlo estimation of the $p$-value is unbiased. []{data-label="fig:pvalue:test"}](pvalue_unbiased.eps "fig:") ![The numerically estimated distribution of $p$-values (4000 reps.) for data drawn iid from the generative model described in Eq. , using the procedure described in Appendix \[sec:p:value\], shown as [**a**]{}, the histogram with standard error estimates and [**b**]{}, the cumulative distribution function. The dashed line shows the null-model of a uniform distribution, and the estimated distribution’s uniformity indicates that the Monte Carlo estimation of the $p$-value is unbiased. []{data-label="fig:pvalue:test"}](pvalue_unbiased_cdf.eps "fig:")

![image](devcurves_8groups_severity_b.eps)

Calculation of statistical significance; $p$-value {#sec:p:value}
--------------------------------------------------

We numerically estimate the statistical significance of the model given in Eq.  using a semiparametric Monte Carlo procedure. Under this procedure, we use the empirical experience data $\{k_{i}\}$, but generate new delay variables $\{{\ensuremath{\Delta t}}_{i}\}$ by drawing them iid from the estimated model, conditioned on their corresponding $k_{i}$ value (see Appendix \[sec:dev:curve:model\]). As the test statistic, we use the Kolmogorov-Smirnov distance [@s:press:etal:1992] between the empirical data and the truncated log-normal distribution, averaged over experience variables: $$\begin{aligned}
\label{eq:test:statistic}
D^{*} & = \frac{1}{k_{\max}} \,\sum_{k=1}^{k_{\max}} \,\max_{i} \left| S_{k}(i) - P_{k}(i) \right| \enspace ,\end{aligned}$$ where $S_{k}(i)$ is the empirical distribution function for experience $k$ and $P_{k}(i)$ is the corresponding theoretical cumulative distribution function. We average the KS distances, rather than, say, take their maximum, because the number of delays $n_{k}$ observed at each value of $k$ is roughly inversely proportional to $k$, and when $n_{k}$ is small, the KS distance will be large, regardless of how well (or poorly) the model fits the data. The average KS distance avoids this problem.

To calculate the $p$-value, we use the following procedure:

1.  estimate $\mu$, $\sigma$ and $\beta$ for the empirical $\{{\ensuremath{\Delta t}}_{i}\}$ data using maximum likelihood \[list:1\];

2.  compute the empirical value of the test statistic $D^{*}$ (Eq. ), relative to this model ;

3.  for $j=1\dots N$ repetitions (for $N\gg1$), do the following:

    1.  for each event delay $k_{i}$, draw a new delay variable ${\ensuremath{\Delta t}}_{i}$ independently from $p({\ensuremath{\Delta t}}\,|\,k_{i})$ (the model estimated in step \[list:1\]) \[list:2\];

    2.  estimate model parameters $\mu_{j}$, $\sigma_{j}$, and $\beta_{j}$ from the data generated in step \[list:2\] \[list:3\];

    3.  compute the test statistic $D^{*}_{j}$ for this same data (from step \[list:2\] relative to its own estimated model, with parameters $\mu_{j}$, $\sigma_{j}$, and $\beta_{j}$, from step \[list:3\]) ;

4.  the $p$-value is defined as the fraction of the test statistics $D^{*}_{j}$ that are at least as large as the empirical test statistic, i.e., $D^{*}_{j} \geq D^{*}$.

To check that this choice of test statistic yields an unbiased $p$-value, we conducted a numerical experiment to measure the distribution of $p$-values for data truly drawn iid from the model. To be unbiased, i.e., to have the correct interpretation as a probability that the data were in fact drawn from the null model, this distribution should be uniform on the unit interval. Fig. \[fig:pvalue:test\] shows the results of this test, confirming that the test statistic $D^{*}$ is unbiased.

When applied to the empirical delays, we estimate $p=0.00\pm0.03$, indicating that the null model can be rejected. Because the normalized delay distributions $p(k^{\hat{\beta}}\,{\ensuremath{\Delta t}})$ collapse onto the underlying log-normal distribution, however, this rejection implicates the assumption of independence as being invalid, as opposed to the general form of the model, i.e., there are significant correlations in the timing of attacks.

Analysis of attack severity development curve {#sec:severity:by:experience}
=============================================

Fig. \[fig:8groups:severity\] shows the individual attack severity development curves for the same eight groups as in Fig. \[fig:averaging:test\], along with the population-level trend described below. Most notably, these individual development curves largely reflect the combined development curve result that experience and severity are independent, even at the level of individual groups.

Fig. \[fig:development:sev\]a repeats the attack severity developmental curve from the main text. The slope of a simple trend line (regressing $\log k$ against $\log x$) is not distinguishable from zero ($r=-0.0238$, t-test, $p=0.17$), and the solid line shows the zero-slope null hypothesis. Further, if we consider the distribution of severities at a particular value of $k$, we see that they do not seem to depend on $k$ (Fig. \[fig:development:sev\]b), and that they resemble power-laws distributions [@s:clauset:young:gleditsch:2007]. Taking this similarity at face value, we can test whether the severity distribution $p(x\,|\,k)$ depends strongly on the group’s experience $k$. Fig. \[fig:sev:statistics\] (upper) shows the results of fitting each of the distributions $p(x\,|\,k)$ for the first 40 values of $k$ with a power-law distribution with $x_{\min}=1$ [@s:clauset:etal:2009].

![[**a**]{}, The mean severity $\langle\log x\rangle$ of fatal attacks by a terrorist group, with $25^{\rm th}$ and $75^{\rm th}$ percentile isoclines, as a function of group experience $k$. The solid line (with slope zero) shows the expected mean delay, from a simple regression model. [**b**]{}, The distributions of event severities $\Pr(X\geq x)$, showing the data collapse onto an underlying heavy-tailed distribution.[]{data-label="fig:development:sev"}](sev_trend_final_a.eps "fig:") ![[**a**]{}, The mean severity $\langle\log x\rangle$ of fatal attacks by a terrorist group, with $25^{\rm th}$ and $75^{\rm th}$ percentile isoclines, as a function of group experience $k$. The solid line (with slope zero) shows the expected mean delay, from a simple regression model. [**b**]{}, The distributions of event severities $\Pr(X\geq x)$, showing the data collapse onto an underlying heavy-tailed distribution.[]{data-label="fig:development:sev"}](sev_collapse_final_b.eps "fig:")

The estimated power-law exponents are very stable: the correlation between $\hat{\alpha}_{k}$ and $k$ is negligible ($r=0.0274$, t-test, $p=0.87$), and the average estimated value $\langle \hat{\alpha}_{k} \rangle = 1.74$ is indistinguishable from the estimated value for all the data together (i.e., ignoring $k$), $\hat{\alpha}_{\rm all} = 1.74\pm0.01$. Thus, the distribution of attack severities appears to be independent of organizational experience, i.e., the probability that an attack will cause $x$ fatalities does not depend on the number of attacks $k$ a group has done in the past.

![Power-law analysis of event severities, for $k\leq40$: (upper) the maximum likelihood exponent $\hat{\alpha}$ for a power-law distribution with $x_{\min}=1$, and (lower), the corresponding $p$-value of the fit. The slope of the trend line in the upper panel is not statistically different from zero. []{data-label="fig:sev:statistics"}](sev_analysis.eps)

This result has several implications for understanding the origin of the power-law form of the severities distribution for terrorist attacks worldwide [@s:clauset:young:gleditsch:2007; @s:clauset:etal:2009]. In so far as terrorist attacks are characteristic of the more general category of asymmetric or guerrilla warfare, a model proposed by Johnson et al. suggests that the severity power law comes from self-organized critical behavior in the internal dynamics of terrorist organizations [@s:johnson:etal:2005; @s:johnson:etal:2006]. Their model assumes that all groups are composed of a number of cells, and that these cells merge (pairwise) or fall apart (into individuals) according to a Markov process. Under these dynamics, the steady-state distribution of cell sizes can be shown to follow a power law under relatively general conditions [@s:ruszczycki:etal:2008; @s:clauset:wiegel:2009], and by assuming that cells attack independently, at roughly equal rates, and induce fatalities in proportion to their size, this model yields a power-law distribution in the severity of attacks.

The independence of event severity $x$ and organizational experience $k$, however, suggests that this explanation requires additional assumptions to explain terrorist attack severities. For instance, we might assume that groups are born with a power-law distribution of cell sizes, as the model otherwise predicts an initial transient period of non-power-law behavior while the cells self-organize away from their initial state toward their steady state. This transient period should appear in our data as non-power-law behavior in the severity of events at small $k$, with the distribution at $k=1$ reflecting the distribution of initial cell sizes.

However, Figs. \[fig:development:sev\]a,b and \[fig:sev:statistics\] show that even for $k=1$, we see power-law-like behavior. This suggests that (i) terrorist groups are not internally self-organized critical, (ii) groups converge to their steady-state distribution of cell sizes before making any attacks, or (iii) other assumptions (e.g., about the behavior of cells) conspire in a complicated way to nevertheless produce a power-law distributions for small $k$. Common sense and historical evidence suggest that the second possibility is probably not the case: most terrorist groups start out small and do not wait very long before beginning their attacks [@s:hoffman:1998; @s:sageman:2004].

An important caveat to our stability analysis is that more of the 40 distributions tested above have $p<0.1$ than we would expect from an iid situation (37% vs. 10%; Fig. \[fig:development:sev\]a, lower). This implies that there is more structure (or more variance) in the severity data than the simple iid power-law hypothesis would lead us to expect. That is, there are likely significant correlations in the severity of subsequent attacks by the same group. One place this structure could be hiding is in the extreme right tail.

![image](groupsize_meanfreq_1998-2005_a.eps) ![image](groupsize_medianfreq_1998-2005_b.eps) ![image](groupsize_minfreq_1998-2005_c.eps)

Additional analyses of group size {#sec:group:sizes}
=================================

On the question of how the frequency of attack varies with organizational size, in the main text, we argue that the minimum delay $\min{\ensuremath{\Delta t}}$ is the appropriate dependent variable to consider because the size estimate corresponds to the maximum size over the 1998–2005 period. For completeness, we additionally considered whether the mean and median delays vary with group size, and found similar results (Fig. \[fig:groups:freq\]). In all cases, the categorical means were significantly different ($n$-way ANOVA, $F=3.78$ and $p=0.0139$ for mean delay; $F=7.44$ and $p=0.0002$ for median delay), and the trends point in the same direction as for the minimum delay. That is, in all cases, larger organizational size is indicative of greater attack frequency.

Similarly, we considered how the mean, median and maximum severity of attacks varies with organizational size. Here, the mean and median severities are not related to organizational size ($n$-way ANOVA, $F=1.14$ and $p=0.3352$ for mean severity; $F=0.59$ and $p=0.6219$ for median severity). Only in the case of maximum severity do we find a significant relationship ($n$-way ANOVA, $F=4.53$ and $p=0.0045$); however, such a relationship is expected, given that larger groups attack much more frequently. That is, consider a situation in which the severity $x$ of an attack is an iid random variable drawn from some distribution $P$. It is well known from extreme value theory that the expected maximum observed severity will increase monotonically with the number of draws from $P$ [@s:dehann:ferreria:2006]. Thus, because larger groups attack more often, i.e., they have many more chances to produce a severe attack, a positive relationship between the maximum severity and group size is expected.

![image](groupsize_meansev_1998-2005_a.eps) ![image](groupsize_mediansev_1998-2005_b.eps) ![image](groupsize_maxsev_1998-2005_c.eps)

[10]{} url \#1[`#1`]{}urlprefix\[2\][\#2]{} \[2\]\[\][[\#2](#2)]{}

, , & (). .

. (). .

. ** ****, ().

, & . ** ****, ().

& . ** ****, ().

. ** ****, ().

& ** (, , ).

& . ** ****, ().

, & (). .

& . ** ().

& ** (, , ).

, , & . ** ****, ().

, & . ** ****, ().

, , & . ** ****, ().

, , & ** (, , ).

*et al.* (). .

*et al.* (). .

, , & (). .

& (). .

** (, , ).

** (, , ).

& ** (, , ).
