← Portfolio

Briefing paperMay 2026Academic exercise

The Evolution of Terrorism

Homegrown extremism, digital radicalization, and the future European threat landscape.

Aviv Hagar · M.A. International Security, IBEI

Written to the format of a European law-enforcement strategic briefing for a graduate counterterrorism course. This is an academic exercise and not a document of Europol or any other agency.

Executive summary

Terrorism in Europe is evolving faster than the continent's counterterrorism architecture is adapting. The EU is not institutionally absent: Europol, the 2017 Counter-Terrorism Directive, and the Digital Services Act reflect important institutional adaptation. Yet these instruments remain unevenly integrated against a threat environment defined by homegrown extremism, digital acceleration, lone-actor mobilization, and fragmented intelligence coordination (Europol, 2025; Directive (EU) 2017/541).

This briefing argues that the centre of gravity of extremism is progressively shifting toward Europe itself, driven by three structural forces: a liberal democratic architecture that creates a permissive environment for digital radicalization; the failure to develop non-kinetic capacity to interrupt radicalization before it becomes operational; and the fragmentation of intelligence sharing between member states, which produces a tiered architecture that systematically weakens the EU as a unified counterterrorism actor.

Europol's TE-SAT 2025 reports 449 terrorism-related arrests across 20 member states in 2024, including 289 for jihadist terrorism, 47 for right-wing terrorism, and 28 for left-wing and anarchist terrorism, confirming that Europe faces a diversified and increasingly internal threat environment (Europol, 2025). The historical record of the IRA, the LTTE, and Islamic State points to a consistent conclusion: kinetic suppression absent political and social investment relocates extremism rather than terminates it.

1. Introduction: the shifting centre of gravity

For much of the post-9/11 period, European counterterrorism was organized around a spatial logic in which threats originate in ungoverned spaces in the MENA region and travel westward through foreign fighter returnees, directed attack planning, or inspired lone actors. That logic was accurate but insufficient. The threat has since moved inward.

Europol's TE-SAT 2025 data shows that a growing proportion of counterterrorism arrests involve individuals born or raised in Europe, with radicalization trajectories beginning in European cities, online platforms, and prison systems (Europol, 2025). IS-Khorasan's recent European plotting relies on EU-based recruiters rather than foreign direction, far-right extremism is produced entirely by European political and social conditions, and Europol's reporting highlights growing concern over the involvement of minors, encrypted communications, immersive digital spaces, and AI-enabled propaganda as primary drivers of radicalization and mobilization (Europol, 2025).

2. The meaning of terrorism: a concept in continuous revision

The concept of terrorism has never resolved its central ambiguity: whether it describes an act, an actor, or a political relationship between the two. As Schmid observed, that ambiguity carries direct operational consequences. If one state operates with a broad definition and another with a narrow one, a coordinated common policy becomes structurally impossible (Schmid, 1992).

Through the 1970s and 1980s, EU member states operated from fundamentally incompatible legal thresholds. The TREVI group's definition, modelled on the broad British formulation, defined terrorism as the use or threatened use of violence to effect political aims, a formulation so expansive it encompassed conventional warfare and nuclear deterrence (Schmid, 1992). Germany's definition focused on terrorism as an enduring struggle for political goals achieved through criminal means (Schmid, 1992). France's 1986 Law on Action Against Terrorism defined terrorism as existing criminal acts committed with specific intent to disturb public order through intimidation, making it a category of aggravated ordinary crime rather than an independent legal concept (Chatham House, 2005). Member states regularly refused extradition requests on the grounds that the act in question failed to meet their own domestic definition, and the European Convention to Combat Terrorism (1977) responded by avoiding definition altogether.

The September 11 attacks finally produced what decades of cooperation had failed to achieve. The 2002 Framework Decision on Combating Terrorism established the first legally binding common definition applicable across all EU member states, combining an objective dimension of nine categories of serious criminal conduct with a subjective dimension requiring the specific intent to intimidate a population, compel a government, or destabilize fundamental state structures (Council Framework Decision 2002/475/JHA; Kaunert, MacKenzie and Leonard, 2022). The achievement carried limitations forward: the 2002 definition was oriented toward organized cell-based external threats, and while the 2017 Counter-Terrorism Directive significantly expanded the framework to incorporate foreign terrorist fighters, public provocation, recruitment, training, and associated preparatory offences, far-right terrorism and lone-actor radicalization through algorithm-mediated ecosystems remain definitionally underspecified in EU law (Directive (EU) 2017/541).

3. Is terrorism an existential threat? Reframing the question for Europe

In the strict sense of the physical destruction of state sovereignty, terrorism falls short of an existential threat to European democracies. The academic consensus supports this framing: terrorism is most accurately characterized as a compound strategic challenge (Mueller, 2006; Cronin, 2009). The principal categories of terrorism directly threatening Europe are jihadist terrorism, with IS-K demonstrating sustained capacity to recruit and inspire attacks within EU diaspora communities; far-right and white nationalist terrorism, the fastest-growing vector by arrest volume; and lone-actor violence spanning all ideological spectrums, driven increasingly by algorithm-mediated online ecosystems (Europol, 2025).

The EU Counter-Terrorism Strategy, structured around the four pillars of Prevent, Protect, Pursue, and Respond, provides the foundational strategic architecture (European Council, 2005). Prevent addresses the conditions that drive radicalization; Protect hardens targets and reduces vulnerabilities; Pursue dismantles terrorist networks through investigation and prosecution; and Respond builds capacity to manage the consequences of an attack. Together these pillars represent a comprehensive framework, yet their uneven implementation and orientation toward organized external threats leave the far-right, lone-actor, and digitally accelerated vectors that now dominate the threat landscape inadequately addressed.

Terrorism nonetheless poses a compound existential threat to the values on which European democracy depends. Every expression of extremism erodes the conditions of liberal democratic coexistence: the shared civic trust and the willingness to resolve political conflict through institutional rather than violent means that pluralist societies require. In a multipolar society, each attack targets the social contract itself, deepening communal tensions and generating the polarization that extremist recruiters across all ideological spectrums deliberately cultivate.

This produces a structural paradox at the heart of European counterterrorism. The EU is constitutionally committed to maintaining a legal and rights-based framework in its counterterrorism response, yet that same framework creates operational constraints that extremist movements, which operate entirely outside its logic, actively exploit. European states are engaged in an asymmetric contest: defending a system of rules against actors for whom those rules impose no equivalent obligation. The dual obligation this creates, countering radicalization with sufficient force while preserving the civil liberties and minority community trust that define democratic governance, cannot be resolved in favour of either security or liberty without reproducing the very failure it seeks to prevent. Managing that asymmetry honestly is the defining governance challenge of European counterterrorism.

4. Tactical evolution: from hierarchies to lone actors

David Rapoport's four-wave framework establishes that terrorism evolves in generational cycles driven by common political energy, each producing diaspora networks that sustain campaigns when domestic pressure degrades home-based structures (Rapoport, 2012). Two features carry direct implications for the current European threat.

The first is consistent organizational adaptation under pressure. When British intelligence penetrated the IRA's hierarchical structure in the 1970s, the organization restructured into cellular formations and sustained its campaign through Irish-American diaspora support, ultimately requiring a political settlement rather than military defeat (Taylor, 1997; Rapoport, 2012). The LTTE demonstrated the upper boundary of non-state institutional development, pioneering the suicide vest and operating a dedicated intelligence wing at state-service sophistication levels; their defeat required total military encirclement that European democratic governments could sustain under no circumstances (Duyvesteyn, 2004). Islamic State followed the same adaptive logic at greater scale: when the caliphate collapsed, IS dispersed into franchises, online networks, and diaspora communities, with IS-K continuing European attack planning without territorial infrastructure (Europol, 2025).

The second and more consequential feature is the progressive disaggregation of the threat toward individual actors. The endpoint of this evolutionary trajectory is the lone wolf: an individual radicalized outside formal organizational structures, operating without interceptable network communications, capable of executing attacks with minimal preparation (Europol, 2025). Europol's TE-SAT 2025 documents lone actor attacks across jihadist, far-right, and left-wing vectors simultaneously, with radicalization driven by online ecosystems rather than group recruitment (Europol, 2025). This multi-directional convergence on individual violence is the defining tactical evolution of the current period, and one the counterterrorism architecture built to target hierarchical organizations is structurally ill-equipped to address.

5. The digital threat environment: Europe's structural vulnerability

Far-right terrorism is the fastest-growing vector by arrest volume, with Europol recording consistent annual increases since 2019 (Europol, 2025). The reciprocal radicalization dynamic connects it analytically to jihadist terrorism: jihadist attacks accelerate far-right mobilization and far-right violence provides jihadist recruitment material, producing a self-reinforcing cycle requiring a multi-vector response European counterterrorism doctrine has yet to develop (RAN, 2021). Radicalization remains a multi-factor process shaped by offline grievance structures, social networks, prison ecosystems, identity crises, and local political conditions interacting with online exposure (Europol, 2025).

Europe's liberal democratic architecture, specifically its freedom of expression protections, data protection standards, and operational space for encrypted platforms, produces a structurally permissive environment for extremist dissemination and recruitment. The vulnerability lies in the interaction between platform design and behavioural exposure: recommender systems iteratively push users toward more extreme content; frictionless cross-platform migration allows extremist milieus to survive moderation; encrypted messaging closes the transition from visibility to operational privacy; and digital communities provide belonging and ideological reinforcement at a speed national monitoring frameworks consistently struggle to capture.

Research from the Combating Terrorism Center at West Point documents a recurring radicalization pattern among European lone attackers following October 7, 2023: digitally native individuals progressing from low-threshold Salafi content to execution footage through TikTok recommendation systems, a process the study terms the Virtual Caliphate Complex (CTC West Point, 2025). Six European case studies from 2023 to 2025, including attacks in Vienna, Solingen, and Zurich, followed this pattern, with radicalization timelines measured in months rather than years (CTC West Point, 2025).

The Digital Services Act represents the most significant legislative response. Its relevance to counterterrorism lies in its requirements around systemic risk assessment, recommender-system transparency, mitigation measures, protections for minors, and scrutiny of design choices that amplify harmful content. Its consistent enforcement across member states, combined with more serious policy engagement with encrypted environments, constitutes the most consequential lever currently available for disrupting radicalization at scale (Directive (EU) 2022/2065).

6. Historical lessons for current EU threats

Two lessons from the historical record remain structurally unabsorbed by European counterterrorism. Kinetic pressure produces relocation rather than dissolution: the IRA sustained its campaign for decades after penetration, requiring a political settlement addressing the underlying grievances kinetic operations left untouched (Taylor, 1997), and Islamic State continued European attack planning through IS-K after territorial defeat (Europol, 2025). Absent political and social investment in the conditions sustaining recruitment, disruption degrades capability temporarily while the threat reconstitutes in more diffuse form.

The domestic politics of member states represent a structural risk to the coherence of European counterterrorism intelligence. Governments facing electoral pressure around immigration frame threat assessments of diaspora communities accordingly; those with significant far-right constituencies operate under different institutional incentives around far-right monitoring; and those with strong MENA bilateral relationships produce assessments calibrated to protect those partnerships. As Jervis (2010) identifies through the producer-client dynamic, agencies produce analysis consistent with the political environment in which they operate, producing a collective output systematically skewed toward threats that carry the lowest domestic political costs (Kaunert, MacKenzie and Leonard, 2022).

7. Intelligence sharing and cross-border collaboration

Kaunert and Leonard (2013) identified member states' structural preference for coordination over genuine integration as a defining feature of EU counterterrorism development. A decade later, Kaunert, MacKenzie and Leonard (2022) confirmed that preference remained intact, with member states retaining what the same analysis identifies as a deeply ingrained dislike of sharing counterterrorism intelligence. The EU Counter-Terrorism Coordinator has no independent budget, no legislative powers, and no authority to compel member states. The most sensitive intelligence flows through the Counter Terrorism Group, established informally in 2016 outside EU structures entirely (Kaunert, MacKenzie and Leonard, 2022).

Three overlapping weaknesses result. First, bilateral intelligence relationships, whether with MENA partner services, EU member states, or the United States, deliver more operationally valuable intelligence than anything Europol's pooled architecture offers, incentivizing member states to protect those channels and contribute residual intelligence to European mechanisms. Each bilateral pairing produces a rational outcome for the states involved and a collectively irrational outcome for the EU as a whole, as the best intelligence circulates through preferred national channels while Europol operates on the residual. As Jervis (2010) identifies, this creates the producer-client distortion at an interstate level: states optimize for their most valuable bilateral relationships rather than for the collective European picture.

Second, even entirely European threats generate indicators across separate national systems with no systematic mechanism to connect them, a synthetic failure the pre-Paris 2015 attack pattern illustrated directly. Brexit compounded this further by removing from EU coordination structures a member state whose domestic counterterrorism experience, signals intelligence capacity, and depth on jihadist networks operating across European cities represented capabilities without equivalent replacement within the remaining twenty-seven.

Third, the bilateral counterterrorism infrastructure was built for externally projected threats, while far-right radicalization, online pipelines, and prison recruitment are domestic law enforcement problems in an entirely different institutional lane, explaining why 47 far-right arrests in 2024 occur across member states sharing no unified analytical framework for this vector (Europol, 2025). Compounding this further, significant asymmetry in member state intelligence capacity means that many smaller member states operate with considerably more limited institutional infrastructure than France, Germany, or the Netherlands, producing structural blind spots in the collective intelligence picture that persist regardless of sharing willingness or architectural reform.

Reforms proposed

1. A joint analytical cell with direct SIENA access and a mandate to synthesize cross-border indicators across all threat vectors in real time, addressing the synthetic failure post-attack investigations have consistently identified, with targeted capacity-building investment in lower-capacity member states to close the asymmetry that currently undermines the collective intelligence picture.
2. A formal EU-UK counterterrorism intelligence accord, distinct from the Trade and Cooperation Agreement, restoring the signals and network intelligence capacity that Brexit removed from EU coordination structures.
3. Collectively resourced prevention infrastructure, including deradicalization programmes, prison intervention and community engagement, treated as a strategic function rather than an auxiliary one, since kinetic disruption alone reconstitutes threats in more diffuse form.
4. A minimum standards framework for structured counterterrorism intelligence exchange with MENA partners and Israel, scoped to digital radicalization networks and diaspora monitoring, with human rights conditionality embedded in its legal architecture. Hedayah already convenes EU and MENA practitioners, providing an institutional model for this kind of bounded exchange (Hedayah and SETA, 2017), and the EU-Israel security relationship, despite political controversy, provides a strategically significant channel on Hamas-affiliated networks and Iran-linked cells operating across the MENA-European interface that structured formalization would make more consistent and accountable.

8. Conclusion

Europe confronts a convergence of three structural weaknesses: a digital architecture accelerating radicalization faster than legislative frameworks can interrupt it, an intelligence architecture delivering domestically shaped assessments to a collective system with limited corrective capacity, and a counterterrorism doctrine oriented toward an older external threat landscape. Each weakness compounds the others, and together they describe an institutional lag that the threat is actively exploiting.

European states are engaged in an asymmetric contest, defending a system of rules against actors for whom those rules impose no equivalent obligation. That asymmetry cannot be eliminated. It can only be managed, and managing it requires an institutional architecture equal to a threat that is now domestic in origin, digital in acceleration, and diffuse in form. Europe's democratic architecture is simultaneously its greatest strength and its most exploitable vulnerability. Acknowledging that paradox honestly is the precondition for addressing it.