The Tactics and Targets of Domestic Terrorists

CSIS Briefs

The Issue

With a rise in domestic terrorism, it is increasingly important to analyze trends in terrorist tactics and targets. According to CSIS data, firearms were the most common weapon used in fatal attacks over the past five years by far-right, far-left, and Salafi-jihadist terrorists. In addition, the most common targets were individuals based on their ethnicity, race, or religion (such as African Americans, Latinos, Jews, and Muslims) for right-wing extremists; and government, military, and police targets for left-wing extremists and Salafi-jihadists.

On May 29, Air Force Staff Sergeant Steven Carrillo, a supporter of the “boogaloo boys” who wanted to ignite a civil war, used a firearm to kill protective security officer Patrick Underwood and critically wound a second officer in Oakland, California.1 On May 24, FBI agents arrested Muhammed Momtaz Al-Azhari in Tampa, Florida, for purchasing multiple firearms to conduct mass-casualty attacks in the Tampa area, including at beaches. He was inspired by the Islamic State and al-Qaeda, and he remarked to a confidential human source from the FBI, “I want to die, you know, in a shootout with the kuffar [disbelievers] . . . I want to take at least 50 [lives].”2 On April 15, FBI agents arrested John Michael Rathbun in East Longmeadow, Massachusetts, after he allegedly placed an improvised explosive device outside the entrance of Ruth’s House, a predominantly Jewish assisted-living residence.3 In July 2019, Willem Van Spronsen, a self-proclaimed anarchist, attacked a U.S. Immigration and Customs Enforcement detention center with an AR-15 semi-automatic rifle and attempted to ignite a 500-gallon propane tank.4

These cases involved a wide range of weapons (such as firearms and homemade bombs) and targets (such as police officers, beaches, a religious-affiliated institution, and a U.S. government facility). While there has been concern about a rise in domestic terrorism in the United States, including before and after the November 2020 presidential election, there has been less public attention about domestic terrorist tactics and targets. Consequently, this analysis asks several questions. What are the major tactics and targets used by domestic terrorists, and how have they evolved over time? How do tactics and targets differ by far-right, far-left, and Salafi-jihadist extremists? What are the policy implications? To answer these questions, this analysis compiles and analyzes an original CSIS data set of terrorist attacks in the United States between January 1, 1994, and May 8, 2020. There is a link to the methodology at the end of this analysis.

The analysis leads to several conclusions. First, it will be virtually impossible to stop domestic terrorism through reactive, defensive measures alone. The most frequent weapons used by far-right, far-left, and Salafi-jihadist individuals in lethal attacks were firearms, which are widely available in the United States. In fact, FBI data indicate that in 2020 gun purchases were at their highest levels ever.5 Other types of weapons—such as vehicles, melee devices (including hammers and knives), and the components for homemade explosives—are also widely available. In addition, some of the primary targets include public locations, which are difficult to protect from attacks.

Second, successful prevention will require more proactive measures. One is sustained targeting of extremist ideologies that espouse violence on social media platforms. Another is improving local intelligence. Unlike with international terrorism on U.S. soil—which often requires top-down intelligence from the Central Intelligence Agency, National Security Agency, and foreign partners operating overseas—domestic terrorism is inherently bottom-up. State and local law enforcement agencies have a particularly important role to play in collecting intelligence “left of boom”—before an attack—not just the Joint Terrorism Task Forces and Fusion Centers. Yet many state and local law enforcement agencies do not have a single point of contact for counterterrorism intelligence, creating a potential blind spot as the threat from domestic terrorism rises.

The rest of this report is divided into four sections. The first examines targets and tactics of right-wing terrorist individuals and networks. The second section analyzes the targets and tactics of left-wing terrorists. The third assesses targets and tactics of those inspired by a Salafi-jihadist ideology. The fourth section outlines policy implications.


As used here, a tactic refers to the method of employing a weapon to achieve a terrorist objective, such as assassinations, armed assaults, bombings, and hijackings. In particular, we focus on the weapons used by domestic terrorists, such as firearms, explosives, melee devices, vehicles, and incendiary devices. A target includes the object of the attack, such as transportation locations, religious institutions, government personnel, or businesses.

This analysis defines terrorism as the deliberate use—or threat—of violence by non-state actors in order to achieve political goals and create a broad psychological impact.6 Violence and the threat of violence are important components of terrorism. Overall, this analysis divides terrorism into four broad categories: right-wing, left-wing, religious, and ethnonationalist.7 Terms like right-wing and left-wing terrorism do not—in any way—correspond to mainstream political parties in the United States, such as the Republican and Democratic parties, which eschew terrorism. Instead, terrorism is orchestrated by a small minority of extremists.

First, right-wing terrorism refers to the use or threat of violence by sub-national or non-state entities whose goals may include racial or ethnic supremacy; opposition to government authority; anger at women, including from the involuntary celibate (or “incel”) movement; and outrage against certain policies, such as abortion.8 Second, left-wing terrorism involves the use or threat of violence by sub-national or non-state entities that oppose capitalism, imperialism, and colonialism; advocate black nationalism; pursue environmental or animal rights issues; espouse pro-communist or pro-socialist beliefs; or support a decentralized social and political system such as anarchism.9 Third, religious terrorism includes violence in support of a faith-based belief system, such as Islam, Judaism, Christianity, and Hinduism. The primary threat from religious terrorists in the United States comes from Salafi-jihadists inspired by the Islamic State and al-Qaeda.10 Fourth, ethnonationalist terrorism refers to violence in support of ethnic or nationalist goals, which often include struggles of self-determination and separatism along ethnic or nationalist lines. Due to the relatively low levels of ethnonationalist terrorism in the United States, this brief does not address the targets and tactics of ethnonationalist terrorists.11

There are several other caveats regarding this analysis. To begin with, it does not focus on hate crimes. There is an overlap between terrorism and hate crimes since some hate crimes include the use or threat of violence.12 But hate crimes can also include non-violent incidents such as graffiti and verbal abuse. Hate crimes are obviously concerning and a threat to society, but this analysis concentrates only on terrorism and the use—or threat—of violence to achieve political objectives.

In addition, while there is often a desire among government officials and academics to focus on terrorist groups, the terrorism landscape in the United States is highly decentralized, including among right-wing and left-wing extremists. Many are formally or informally organized around the concept of “leaderless resistance,” which shuns a centralized, hierarchical organization in favor of decentralized networks or individual activity.13 The decentralized nature of terrorism in the United States is particularly noteworthy in regard to the use of violence, which our data suggests is often planned and orchestrated by a single individual or small network. Consequently, this analysis frequently refers to terrorist individuals and networks, rather than groups.

Right-wing Terrorism

Over the past five years, most right-wing attacks targeted individuals—generally because of their ethnic, racial, or religious background—or religious institutions. In addition, firearms were the most frequent weapons in lethal attacks.


There were 411 right-wing attacks in the data set between 1994 and 2020.14 The most frequent types of right-wing targets over this span included: abortion-related targets, such as women’s health clinics and medical staff (27 percent); private individuals and property, primarily selected due to race, ethnicity, or religion (25 percent); religious institutions, particularly synagogues, mosques, and churches (21 percent); and government, military, and police facilities and personnel (13 percent). But the targets of right-wing terrorist attacks have shifted over time.

Between 2015 and 2020, the largest percentage of targets (42 percent) were against private individuals—such as African Americans and Latinos—and locations associated with them. In August 2019, for example, Patrick Crusius perpetrated an attack against Latinos at a Walmart in El Paso, Texas. Crusius claimed he was acting in response to a “Hispanic invasion of Texas” and warned that white people were being replaced by foreigners.15 The second-highest percentage of targets (32 percent) were religious institutions. In April 2019, John T. Earnest entered the Chabad of Poway synagogue in Poway, California, with a Smith & Wesson Model M&P 15 Sport II semi-automatic rifle, killing one person and wounding three others.16 In October 2018, Robert Bowers entered the Tree of Life Synagogue in Pittsburgh, Pennsylvania, and opened fire during a service, killing 11 people and wounding 6 others, including 4 police officers.17 The third most common type of right-wing target between 2015 and 2020 included government, military, and police locations, which comprised 8 percent of right-wing attacks. In April 2020, Texas police arrested Aaron Swenson, a supporter of the boogaloo movement. He had stockpiled guns, planned to kill a police officer, and then posted his intentions on Facebook Live while driving a late model black Chevrolet truck searching for a police officer to ambush.18

This shift in targets may have been caused by an upsurge in white supremacist activity and a decline in anti-abortion extremism. During the 1990s, the highest percentage of right-wing attacks focused on abortion-related targets. But a decrease in these types of plots and attacks suggests that there are fewer individuals inspired by anti-abortion views. Instead, there has been a rise in white supremacist activity. The reasons are complex and could include: the effective use of the internet and social media by white supremacists to conduct important tasks, such as issuing propaganda, raising funds, and recruiting members; a growth in physical and virtual contacts between white supremacists across the globe; and exogenous factors, such as the election of Barack Obama as president, the subsequent election of Donald Trump as president, and rising concerns about immigration.19

Tactics and Weapons

Far-right tactics and weapons have evolved from 1994 to 2020. As shown in Figure 2, explosives and incendiaries were the primary weapons in 50 percent of all right-wing attacks from 1994 to 2020. We combined explosives (such as homemade bombs) and incendiaries (such as Molotov cocktails) into one category in our data set. Notable explosives and incendiaries included arson and fire-bombing attacks targeting abortion clinics, government facilities, and places of worship. Firearms were the primary weapon used in 27 percent of attacks, making them the second most frequent type of weapon. The data from 2015 to 2020, however, indicate a new trend. Though explosives and incendiaries were still most common, they were used in only 38 percent of attacks during this period. Meanwhile, the percentages of melee attacks and threats or hoaxes grew. Melee attacks generally involved knives or other sharp weapons, while threats or hoaxes primarily involved bomb threats or fake weapons.Firearm usage in fatal far-right attacks also increased from 1994 to 2020. As shown in Figure 3, firearms were the most frequently used weapon in 66 percent of right-wing attacks between 1994 and 2020.20 Between 2015 and 2020, however, right-wing perpetrators used firearms in 73 percent of fatal attacks. Melee weapons—primarily knives—were the main weapon in 20 percent of fatal right-wing attacks since 2015.

Left-wing Terrorism

Over the past five years, left-wing terrorists primarily targeted government, military, and police facilities or personnel, followed by businesses and infrastructure targets. As with right-wing extremists, firearms accounted for the majority of fatal left-wing attacks.


Based on the 219 left-wing attacks in the data set between 1994 and 2020, the most frequent types of left-wing targets included: businesses, particularly in industries involving animals or lumber (52 percent); government, military, and police facilities or personnel (17 percent); private individuals or property, particularly related to their involvement in environmental issues, animal rights, or right-wing politics (17 percent); and educational institutions, particularly those conducting research on animals (7 percent).

The focus of left-wing terrorist attacks has shifted from 1994 to the present. Between 1994 and 2004, most left-wing targets were businesses, particularly lumber companies and companies in the meat and fur industries. Between 2006 and 2009, there was a particularly heavy focus by extremist animal rights groups on universities and labs conducting research on animals. Over time, however, left-wing terrorists shifted to government, military, and police targets. This change appears to reflect an evolution in left-wing extremism in the United States from a focus on the environment and animal rights to anarchism and anti-fascism—with a particular emphasis on opposing the government and corporations. This shift also appears to be occurring in Europe. According to the European Union Agency for Law Enforcement Cooperation (Europol), numerous left-wing extremists are motivated by anarchist views, along with “anti-fascism, anti-racism, and perceived state repression.”21

Between 2015 and 2019, 36 percent of left-wing attacks targeted government, military, and police facilities or personnel.22 For example, in July 2019, Willem Van Spronsen attempted to bomb the U.S. Immigration and Customs Enforcement detention facility in Tacoma, Washington.23 Prior to the attack he sent several people a manifesto, which argued that detention camps “are an abomination,” complained that “in these days fascist hooligans [are] preying on vulnerable people on our streets,” and apologized that he would “miss the rest of the revolution.”24 Meanwhile, 22 percent of left-wing attacks since 2015 targeted businesses and 17 percent targeted transportation and infrastructure. The remainder targeted private individuals and property (14 percent), religious institutions (8 percent), or educational institutions (3 percent).

Tactics and Weapons

Explosives and incendiaries were by far the most common weapon used by left-wing terrorists. However, firearms have been increasingly common in left-wing attacks, and they account for the majority of fatal left-wing attacks. For example, in June 2017, James Hodgkinson opened fire on a congressional Republican baseball practice. Six people were injured, including House Majority Whip Steve Scalise and Representative Roger Williams, before police shot and killed Hodgkinson.25 As shown in Figure 5, 81 percent of all left-wing attacks between 1994 and 2019 involved explosives and incendiaries.26 For instance, in December 2018, Elizabeth Lecron purchased black powder and screws in an attempt to bomb a pipeline she believed was polluting a local river.27

The second most common weapons were melee weapons such as knives, hatchets, and hammers, which accounted for 7 percent of attacks. Examples included the destruction of property—such as construction equipment—by groups like the Animal Liberation Front and Earth Liberation Front. Firearms were the third most common weapon, used in 6 percent of attacks. However, firearms have been more common in recent years, and they were the primary weapon in 25 percent of left-wing attacks between 2015 and 2019.Although most left-wing attacks involved explosives and incendiaries, the 11 fatal left-wing attacks since 1994 were primarily conducted with firearms. Firearms were used in nine of these attacks (82 percent), compared to explosives and incendiaries, which were used in the other two (18 percent). Six fatal left-wing attacks have occurred since 2015, and all six used firearms. For example, Gavin Long open fired on police in July 2016, killing three and injuring three others. He saw the attack as a response to the unfair prosecution of African Americans by the justice system.28

Religious Terrorism

Salafi-jihadists inspired by al-Qaeda and the Islamic State accounted for most religious attacks in the data set. Over the past five years, Salafi-jihadists primarily attacked government, military, and police targets, though some of the most lethal targets included nightclubs and public locations like pedestrian paths. Much like right-wing and left-wing terrorists, Salafi-jihadists used firearms in most fatal attacks.


Between 1994 and 2020, the most frequent targets of Salafi-jihadists included: government, military, and police facilities and personnel (41 percent); private individuals or property (22 percent); businesses (12 percent); and transportation and infrastructure (12 percent). The proportion of religious terrorist targets remained fairly consistent between 1994 and 2020.29

Between 2015 and 2020, Salafi-jihadists targeted government, military, and police facilities and personnel (43 percent); private individuals and property (18 percent); businesses (14 percent); transportation and infrastructure (14 percent); educational institutions (7 percent); and religious institutions (4 percent). Unlike right-wing or left-wing terrorists, Salafi-jihadists indiscriminately targeted private individuals and businesses. These attackers frequently intended to send a broad message to American society. Some of the most lethal targets were public venues. For example, in October 2017, Sayfullo Saipov, who pledged allegiance to the Islamic State, indiscriminately killed 8 people and injured 11 more when he drove a rental truck on a bike path on the West Side Highway in Lower Manhattan, New York City.30 In June 2016, Omar Mateen, who pledged allegiance to Islamic State leader Abu Bakr al-Baghdadi, killed 49 people and wounded 53 others at a gay nightclub in Orlando, Florida.31

Tactics and Weapons

Unlike right-wing and left-wing terrorists, religious terrorists have not overwhelmingly used one type of weapon. Explosives, incendiaries, and firearms were most commonly used in religious terrorist attacks overall, though firearms and melee weapons (such as knives) were the most common over the last five years.

As shown in Figure 6, terrorists used explosives and incendiaries and firearms in 31 percent of the 49 religious attacks between 1994 and 2020.32 Melee weapons, particularly knives or other sharp objects, were the second most frequently used weapon, accounting for 20 percent of attacks overall. The remainder of attacks involved either vehicles (10 percent) or threats or hoaxes (8 percent).

Between 2015 and 2020, the proportion of melee attacks increased and matched firearms as the most commonly used weapon type at 32 percent. Salafi-jihadists used explosives and incendiaries in 18 percent and vehicles in 4 percent of attacks—both less frequently than average. The high percentage of attacks using firearms and melee weapons might be caused by the guidance provided by the Islamic State and al-Qaeda, which encouraged individuals to use simple and easily accessible weapons. The series “Just Terror Tactics,” which first appeared in Rumiyyah magazine, encouraged individuals to conduct low-budget attacks, such as knife attacks and hostage-taking.33 An article in al-Qaeda’s Inspire magazine titled “The Ultimate Mowing Machine” recommended: “A random hit at a crowded restaurant in Washington, D.C. at lunch hour for example might end up knocking out a few government employees.” It continued that an attack with firearms required little preparation and was the “fastest operation to perform.”34

Despite this diversity of weapon choice, firearms were most likely to result in fatalities. This is consistent with the data on right-wing and left-wing fatal attacks. Between 1994 and 2020, 62 percent of the 16 fatal religious attacks were conducted with firearms—the same as the percentage of the fatal attacks involving firearms between 2015 and 2020. For example, in December 2019, Second Lieutenant Mohammed Saeed Alshamrani, a Saudi air force cadet training with the U.S. military in Pensacola, Florida, killed three men and injured three others in a shooting attack. He was inspired by al-Qaeda’s ideology, communicated with leaders of al-Qaeda in the Arabian Peninsula until the attack, and joined the Saudi military in part to carry out a “special operation” for al-Qaeda.35 Other examples included Omar Mateen’s attack at Pulse nightclub in June 2016 and Rizwan Farook and Tashfeen Malik’s December 2015 attack in San Bernardino, California.

Policy Implications: Bottom-up Intelligence

Despite a 50 percent decline in terrorism across the globe between 2014 and 2019, the number of terrorist attacks in the United States has increased over the same period by 141 percent, according to CSIS data.36 This may explain why public opinion polls show that Americans continue to rank terrorism as a significant threat. According to one poll published in 2020, 73 percent of Americans considered terrorism a major threat, second only to the spread of infectious diseases such as Covid-19.37

Our data suggest that the threat of terrorism in the United States will likely increase over the next year based on several events, such as the November 2020 presidential election, the response to the Covid-19 crisis, and other polarizing events such as racially-motivated killings.38 These exogenous events can cause a “tip” or “cascade” that increases the possibility of terrorist violence.39 Events such as an election can increase political entrepreneurs’ desire to use inflammatory language and raise the perceived stakes of winning and losing to such a degree that it leads to what Nobel Prize-winning economist Thomas Schelling called “excessively polarized behavior” and motivates some individuals to use violence.40

Consequently, it is important to understand trends in domestic terrorist tactics and targets. Our data indicate that the most common weapons for fatal attacks over the past five years were firearms, which comprised 73 percent of fatal far-right attacks, 100 percent of fatal far-left attacks, and 62 percent of fatal Salafi-jihadist attacks. In addition, the primary targets for right-wing extremists included individuals based on ethnicity, race, or religion (such as African Americans, Latinos, Jews, and Muslims). For left-wing extremists and Salafi-jihadists, the primary targets were government, military, and police personnel and locations. In light of these findings, there are several policy implications.

First, based on the tactics of domestic terrorists, enacting stricter legislation to ban some types of guns (such as assault rifles) and further strengthening background checks could help prevent some would-be terrorists from getting access to weapons. Firearms are—by far—the most common weapon for fatal attacks by far-right, far-left, and Salafi-jihadist extremists. Based on data from the National Instant Criminal Background Check System (NICS), the number of firearm background checks for gun purchases has spiked to its highest level ever in 2020—reaching nearly 4 million in June 2020.41 The pervasiveness of guns—including automatic weapons—is particularly concerning in the United States’ ultra-polarized political climate. In addition to guns, other types of weapons—such as vehicles, melee devices, incendiary devices for arson attacks, and the components for homemade explosives—are also widely available.Second, based on the target selection of domestic terrorists, there are some steps that organizations can take to reduce the likelihood of an attack, mitigate the consequences if an attack occurs, or even deter an attack. For example, organizations can increase and improve their use of closed-circuit televisions (CCTVs); construct more effective barriers to prevent vehicular attacks; increase security personnel (including armed guards) and improve protective security measures and procedures (such as layered defenses) at businesses and other potential targets; conduct training and education for all employees to increase vigilance and improve their response to an attack; organize table-top and other exercises; and carry out routine risk assessments to identify security gaps and vulnerabilities. Yet it will be virtually impossible to prevent some of the most common types of attacks, which involve targeting individuals at public locations based on their ethnicity, race, or religion.

Third, law enforcement and intelligence agencies need to adapt to the bottom-up aspect of domestic terrorism. Countering international terrorism is often a top-down process. State and local law enforcement agencies often rely on at least some intelligence collected by the CIA, NSA, and U.S. partners, which is then passed down to local Joint Terrorism Task Forces (JTTFs) for threats in the U.S. homeland. But domestic terrorism is inherently bottom-up. Right-wing, left-wing, and religious extremists in the United States generally do not coordinate with others outside the country to plot and execute attacks. In fact, many attacks involve one or a small number of individuals that do little—if any—coordination with others inside or outside the United States.

Consequently, state and local law enforcement agencies have a particularly important role to play in identifying terrorism “left of boom.” Based on the example of some countries such as the United Kingdom, state and local police departments should have a single point of contact for terrorism intelligence wherever feasible. This person would serve as the main contact with local JTTFs and Fusion Centers and be in charge of outreach with the local community. With roughly 800,000 police officers in the United States, it is impossible to conduct counterterrorism effectively from the top-down for domestic terrorists.42 The need for a single point of contact is greatest at small- and medium-sized police departments since most metropolitan police forces already have robust intelligence capabilities.

Fourth, the U.S. government, its partners overseas, and the private sector need to continue to aggressively target individuals and groups that espouse violence on digital platforms. This is a war of ideas on virtual battlefields—just as much as on the streets of U.S. cities and towns. Most domestic extremists use the internet and social media platforms to release propaganda, coordinate training, raise funds, recruit members, and communicate with others. They have used various combinations of Facebook, Twitter, YouTube, Gab, Reddit, 4Chan, 8kun (formerly 8Chan), Endchan, Telegram, Vkontakte, MeWe, Discord, Wire, Twitch, and other online communication platforms. The establishment of the Global Internet Forum to Counter Terrorism (GIFCT) and the appointment of Nicholas Rasmussen, former head of the National Counterterrorism Center, as its first full-time executive director is a welcome step in countering terrorist exploitation of digital platforms.

The United States will never be able to stop every attack, but it can prevent most of them. The Provisional Irish Republican Army reminded British prime minister Margaret Thatcher in 1984 after failing to kill her at the Grand Brighton Hotel: “Remember, we only have to be lucky once. You have to be lucky always.”43 While some luck may be required to counter a wave of domestic terrorism, proactive steps—such as improving bottom-up intelligence collection in the United States and countering extremism on digital platforms—can help mitigate the threat.

Seth G. Jones is the Harold Brown Chair and director of the Transnational Threats Project at the Center for Strategic and International Studies (CSIS) in Washington, D.C. Catrina Doxsee is a program manager and research associate with the Transnational Threats Project at CSIS. Nicholas Harrington is a research associate for the Transnational Threats Project at CSIS.

The authors give special thanks to James Suber and Grace Hwang for their research assistance and helpful comments, including their involvement in building the terrorism data set.

For an overview of the methodology used in compiling the data set, please see here.

This brief is made possible by general support to CSIS. No direct sponsorship contributed to this brief.

CSIS Briefs are produced by the Center for Strategic and International Studies (CSIS), a private, tax-exempt institution focusing on international public policy issues. Its research is nonpartisan and nonproprietary. CSIS does not take specific policy positions. Accordingly, all views, positions, and conclusions expressed in this publication should be understood to be solely those of the author(s). © 2020 by the Center for Strategic and International Studies. All rights reserved.

Please consult the PDF for references.

Seth G. Jones
Senior Vice President; Harold Brown Chair; and Director, International Security Program
Catrina Doxsee
Associate Director and Associate Fellow, Transnational Threats Project

Nicholas Harrington