Introduction

It is well established in the literature that crime is not evenly distributed in space (Cohen 1941; Quetelet 1984) or time (Falk 1952). Zipf’s (1965) principle of least effort suggests that criminals seek strategies that minimise effort and time spent when committing a crime. Further, Rengert and Wasilchick (1985) argued that criminals favour local areas over unknown territory, indicating that spatial exploration is uncommon. Studies on crime, including terrorism, have recently focused on identifying patterns of events in space and time at the micro-level. A few scholars (e.g. Johnson et al. 2007; Townsley et al. 2008; Johnson and Braithwaite 2009) have concentrated on the phenomenon called near-repeat victimisation using methods originally developed by Knox (1964) for the study of disease and contagion. Here, pairs of criminal events are analysed to see if they take place close enough in time and space to identify clustering, and thus establish an elevated risk of near-repeat victimisation. The results of these studies have implications for crime prevention strategies as identified crime patterns often have a predictive utility for the police and other law enforcement agencies (Johnson et al. 2007).

Patterns of clustering in time and space have predominantly focused on burglaries (e.g. Townsley et al. 2003; Johnson and Bowers 2004; Johnson et al. 2007; Chainey and Da Silva 2016). Significant patterns of spatiotemporal clustering, however, have also been identified in other types of criminal offences like arson (Grubb and Nobles 2016) and insurgent activity (Townsley et al. 2008; Johnson and Braithwaite 2009).

This paper aims to contribute to the limited literature that exists on the identification of microcycles in terrorist attacks, and particularly in attacks carried out by the Taliban in Afghanistan. So far, studies of microcycles on terrorist groups have only focused on countries in Europe (ETA in Spain; LaFree et al. 2012; Behlendorf et al. 2012) and Central America (FMLN in El Salvador; Behlendorf et al. 2012), making this the first study to investigate the presence of microcycles in attacks by the Taliban in Afghanistan.

Literature review

In the field of Crime Science, the Knox method has been utilised to identify risk contagion patterns of different crime types such as motor vehicle theft (Johnson et al. 2009; Lockwood 2012; Block and Fujita 2013; Piza and Carter 2017), shootings (Ratcliffe and Rengert 2008; Sturup et al. 2017), gun assaults (Wells et al. 2011), arson (Grubb and Nobles 2016), armed robbery (Haberman and Ratcliffe 2012) and maritime piracy (Marchione and Johnson 2013). Zhang et al. (2015) concluded that street robberies had a significant space-time clustering for up to ¼ of a mile and 6 days. Residential burglaries, however, had significant clustering for up to 1.55 miles and 90 days. Different types of crimes have a clustering signature of their own, which can help predict the location and timing of future events.

Microcycles as a term has been applied to various domains in research and has previously been described as “localised bursts of activity” (Behlendorf et al. 2012, p. 49). In this study a microcycle in terrorist activity is defined as localised bursts of terrorist attacks, more specifically:

A series of two or more related events at the local level where the distance in space and time between each event and the next event are within a critical distance for risk contagion and also isolated from other events or groups of events by a similar critical distance (Behlendorf et al. 2012, pp. 60–61).

We expected microcycles in terrorist attacks because ecological theories of crime tell us that crimes are more likely to occur in places within the collective awareness spaces of motivated offenders where the environment provides possible targets and an absence of capable guardianship (Brantingham and Brantingham 1981; Cohen and Felson 1979). These variables vary from location to location all throughout the day, which suggests that criminal offences are not randomly distributed either temporally or spatially (Brantingham and Brantingham 1982; Andresen and Jenion 2004). Analyses have shown that burglary and robberies are frequent near common roads (Johnson and Bowers 2010; Davies and Johnson 2015) and around facilities that share nodes of routine activity (Bowers 2014; Groff and Lockwood 2014).

Several scholars (Townsley et al. 2008; Johnson and Braithwaite 2009) have suggested that the spatiotemporal patterns found in urban crime can be expected in terrorism and insurgency due to the same resource constraints. By considering terrorism as a type of crime, the tools utilised for analysing crime patterns can be used to identify spatiotemporal patterns in terrorist incidents (Medina et al. 2011). Therefore, several terrorism studies have applied versions of the Knox (1964) method to test for clustering of terrorist attacks. Townsley et al. (2008) investigated spatiotemporal patterns of improvised explosive device (IED) attacks by insurgents in a three-month period in Iraq during the U.S. occupation. The results showed more clustering of IED attacks in time and space than what would be expected if attacks were randomly distributed.

Johnson and Braithwaite (2009) analysed IED and non-IED attacks by insurgents in Iraq during a 6-month period and found that both attack types clustered in time and space. In addition, the results from the study demonstrated evidence of “burstiness” (Behlendorf et al. 2012); attacks were more likely to happen in close vicinity to an initial attack in a short time-period afterwards.

Most of the studies based on the Knox approach mentioned above analyse to what extent pairs of events took place close to one another in time and space, also known as the near-repeat phenomenon. By doing this, only global patterns of event interdependence can be unveiled, disregarding the possibility that a series of events can take place as a burst of activity close in space and time. Research on microcycles has been proposed as a way of investigating whether there is an elevated risk for future attacks in close vicinity after an initial event, and if identified risks of future attacks vary across time, locations and between different strategies and targets (Behlendorf et al. 2012).

Research on violent microcycles in attacks by different terrorist groups has been meagre, but valuable. Using data from the Global Terrorism Database (GTD), Behlendorf et al. (2012) analysed patterns of terrorist attacks by the ETA in Spain and compared it to patterns from the FMLN in El Salvador. Both terrorist groups showed strong evidence for the presence of violent microcycles where 52% of all attacks by the ETA and 67% by the FMLN took place within 5 miles and 14 days of each other.

Braithwaite and Johnson (2015) identified clustering of insurgency violence through a fixed spatial structure model of Baghdad. An important finding in their study was that locations for insurgent activity were best explained through the notion of spatial heterogeneity. Therefore, some parts of Baghdad were found to continually be at a greater risk. Positive associations were also established between the risk of attacks and higher population levels, military garrisons and a greater density of roads. These findings support the risk heterogeneity hypothesis (Pease 1998), where the risk across potential targets could be explained through time-lasting differences that seem to account for spatiotemporal patterns of victimisation.

Another advantage of focusing on microcycles, rather than other traditional hotspot analyses like kernel density estimation (Chainey et al. 2008), is that both the temporal and spatial distributions are incorporated into the model.

Taliban violence in Afghanistan

An independent assessment, commissioned by the Pentagon on Afghan security in 2014, anticipated that as the international coalition forces withdrew from the country the Taliban insurgency would expand the amount of areas under their command and become a greater threat between 2015 and 2018 (Schroden et al. 2014). This paper focused on attacks carried out by the Taliban in 2016 to identify whether this expected increase in number and area of attacks occurred in violent microcycles. 2016 was also the most recent and complete yearly dataset available from the GTD at the time of the study. In addition, it was first in the June 2016 publication of the GTD that their dataset was geocoded to include latitude and longitude coordinates (where known) and information on the specificity of these coordinates, which was an essential factor for this study [National Consortium for the Study of Terrorism and Responses to Terrorism (START) 2017b].

Previous research on insurgent warfare in Afghanistan has demonstrated how timing and location of events can be forecast. Zammit-Mangion et al. (2012) used stochastic partial differential equations to predict violent events. These findings were based on a weekly count of attacks on regional and national levels in Afghanistan through data from the Afghan War Diary. Johnson et al. (2011) proposed a model for the waiting time distribution between attacks by insurgents in Afghanistan and Iraq. Both studies, however, did not analyse whether the attacks by the Taliban in Afghanistan took place as part of violent microcycles.

Subsequently, this paper investigated the following research question:

Does the occurrence of a terrorist attack by the Taliban in Afghanistan at one location and time increase the risk of attacks at nearby locations, as well as at the same location?

The current study builds on the notion that the act of terrorism is a calculated, rational behaviour (Pape 2003; Dugan et al. 2005; Clarke and Newman 2006). This form of rationality is constrained by resources (e.g. experience, time, money, people and knowledge) which are all calculated against each other to reduce both risks and efforts, and to increase rewards of specific offences (Cornish and Clarke 1986, 2003). Offenders are likely to return to recently targeted locations because the knowledge of the risks and rewards are not as uncertain as in unfamiliar areas. On the other hand, offenders will move on after a burst of offences in a target area to reduce the risk of detection (Johnson and Braithwaite 2016). As a result, terrorists are not able to attack freely, and targets are said to be chosen non-randomly (Clarke and Newman 2006). Rapid targeting of nearby or similar locations also help to draw awareness to strategies and intentions of insurgencies. This can facilitate recruitment from the population and get more media coverage for the group (Johnson and Braithwaite 2016; Hedges and Karasik 2010).

The Taliban too suffer resource constraints when trying to make decisions on future attacks and targets. In addition, they are continually trying to recruit individuals and gain support to achieve their goals (Rashid 2010). Based on this and the other evidence presented in the literature review, the following hypothesis was proposed:

H 1

Terrorist attacks by the Taliban in Afghanistan occur in microcycles.

Clarke and Newman (2006) argue that identifying tactics of a specific group is key to comprehend both strategic and operational conditions that form opportunities for terror events. In rational choice theory it has been shown that the decision-making process by terrorists consists of selecting an alternative from a set of alternatives. Presumably, they choose what they think is the best alternative from a set of choices. In other words, we can say that they order their preference for their alternatives and choose the one that is ranked the highest (Phillips 2016).

This picture of decision making is common across orthodox and behavioural economics. In expected utility theory, the decision maker considers outcomes, the utility of those outcomes and the probabilities that those outcomes will occur (Rabin 2013). In a behavioural model, such as prospect theory, the decision maker may consider his reference point, his mental accounts or what he expects to achieve, the chance of loss and how much those losses may affect him relative to gains of a similar magnitude (Thaler 2015).

Where the decision-making models differ from each other is not so much in their confidence that the decision maker will weigh things up correctly but in the things the decision maker considers when forming this preference ordering (George 1984). Therefore, it is a fairly safe assumption to make that we can detect discernible patterns in the actions of terrorists, and get an understanding of their decision-making process in selection of targets and other tactics.

An analysis on terrorist events from 1970 to 2012 by LaFree et al. (2014) found that bombings and armed assaults accounted for more than 84% of the total events. Further analysis by LaFree and Dugan (2016) on the twenty most lethal terrorist/insurgency groups from 2002 to 2013 found that organisations who consider themselves Islamic are significantly more likely to apply bombings (53.35% of total attacks) as a tactic to their non-Islamic counterparts (40.37% of total attacks). The same study also found that armed assaults accounted for 33.78% of total attacks by Islamic terror organisations. In accordance with these findings, an initial analysis of attack types in 2016 by the Taliban in Afghanistan showed that the two most utilised attack types were bombings/explosions and armed assaults. Overall, they accounted for 69.21% of all events with a known attack type by the Taliban in 2016.

One of the tactics the Taliban employ is mining, which is strategically placing IEDs in certain areas as they can cause a lot of damage, but are, at the same time, simple and inexpensive to produce. The Taliban prepared for the surge of coalition troops in 2010 by mining the Helmand province extensively, littering prominent travel routes with IEDs (Hedges and Karasik 2010). This tactic makes it more likely for attacks to be a part of microcycles, especially when taking into account the percentage of attacks identified as bombings by the Taliban. IEDs placed in the same area, around the same time, are more likely to become localised bursts of terrorist events.

After bombings and armed assaults, the two most utilised attack types by the Taliban in 2016 were kidnappings and assassinations, accounting for 23.96% of all events. The present study, however, argues that these kidnappings and assassinations are less likely to occur in microcycles due to their discriminate targeting. These types of attacks are known to target specific individuals (Rapoport 1971; Forest 2012; Mandala 2016), which often requires more planning and effort (Clarke and Newman 2006). In addition, the planning and execution of a kidnapping or assassination are more constrained by resources like time and knowledge, making it more complex than an armed assault or IED attack on indiscriminate targets (Sandler and Enders 2004; Clarke and Newman 2006). These two tactics also receive strong reactions from citizens (Mandala 2016) and authorities (Behlendorf et al. 2012). As a result, this study proposed the following hypothesis:

H 2

Compared to kidnappings and assassinations, bombings and armed assaults by the Taliban in Afghanistan are more likely to occur within microcycles.

The central targets of Taliban violence are the government, police and coalition forces (Hedges and Karasik 2010). However, subsequent to the surge of US troops that peaked at 100,000 in 2011, the Taliban increased their attacks on civilians. Attacks on civilians are at times used to attract coalition forces into areas where the Taliban can attack military forces with firearms or IEDs. This type of tactic has shown to often kill more civilians than coalition forces. In 2011, the Taliban insurgency accounted for 80% of civilian deaths in Afghanistan (Cassman 2016). Further, a United Nations report revealed that 2015 was the deadliest year for Afghan civilians since the invasion in 2001 (UN News, 2016). More importantly, private citizens and property have limited ability to retaliate against Taliban attacks and are therefore perceived as softer targets where both risks and efforts are reduced. In comparison, targeting government officials is a more discriminate attack where more resources need to be allocated with a greater risk attached to the process, reducing the likelihood of clustering within this target type. In addition, due to the coalition forces’ ability to reciprocate fire and the subsequent risk and efforts that follow an attack on the military or police, it is more likely that attacks on private citizens and property will occur within localised bursts of terrorist events (Behlendorf et al. 2012). Thus, the following hypothesis was proposed:

H 3

Compared to attacks on the military, the police and government, attacks on private citizens and property by the Taliban in Afghanistan are more likely to occur within microcycles.

Previous literature has concluded that some locations are more likely to be targeted by terrorist groups than others. More attractive targets are areas of political or symbolic value and highly concentrated populations (Clarke and Newman 2006; Savitch 2014). It is common for the Taliban to attack densely populated civilian areas, and it is known for targeting voters and polling offices around election times to create fear and oppose the ruling government (Hedges and Karasik 2010). These types of attacks in cities are likely to be part of clusters, thus having the potential to occur within microcycles. Clarke and Newman (2006) further argue that attractive targets are mostly within national or regional capitals where events are more likely to receive greater amount of media coverage. Based on this, the following hypothesis was proposed:

H 4

Compared to attacks on non-provincial and non-national capital cities, attacks on provincial and national capital cities by the Taliban in Afghanistan are more likely to occur within microcycles.

Another important tactic to analyse by terrorist organisations is whether their attacks generate fatalities. By analysing data from the GTD, LaFree et al. (2014) discovered that over half of all terrorist events since 1970 generated no fatalities. However, LaFree and Dugan (2016) identified the Taliban as the most lethal terrorist group between 2002 and 2013, causing 830 fatalities on average each year. Fatality as a strategy is an important element to consider in terrorism research, as fatal attacks tend to receive more government responses and attention from the public (Behlendorf et al. 2012). If fatal terrorist attacks by the Taliban are more likely to occur in microcycles, it suggests that government responses and reprisal from coalition forces after previous fatal attacks do not deter the organisation from committing consecutive fatal attacks nearby and close in time. This study therefore proposed the following hypothesis:

H 5

Compared to non-fatal attacks, fatal attacks by the Taliban in Afghanistan are more likely to occur within microcycles.

Method

Data

To analyse the proposed hypotheses, data were collected from the GTD for the period of January 1st to December 31st 2016 (National Consortium for the Study of Terrorism and Responses to Terrorism (START) 2017a). The GTD is a reliable database that makes it possible to produce valuable and empirically-based models (Zammit-Mangion et al. 2012). It recorded 1061 terrorist incidents committed by the Taliban in Afghanistan in 2016.

Behlendorf et al.’s (2012) study on violent microcycles geocoded all attacks to the longitude and latitude for the centroid of the city/town/village where the attack happened. As a result, attacks occurring in cities larger than 5 miles, such as Madrid, were at risk of being falsely identified as part of microcycles when the distances between attacks were in fact greater than the set parameters of 5 miles and 2 weeks. That made the study vulnerable to Type II errors.

The present analysis of spatial and temporal patterns by the Taliban in Afghanistan aimed to produce a more accurate representation of microcycles by only including attacks where the exact longitude and latitude coordinate for each incident was known. That reduced the dataset to 432 attacks. The temporal aspect of this analysis was just as important as the spatial aspect. Hence, all events with an unknown or approximate date for a terrorist attack were excluded, reducing the dataset to 376 attacks. Further, only attacks that met all the criteria set by the GTD for terrorism were incorporated, attacks where there was any doubt whether or not the event was a terrorist attack were removed. Following these inclusion criteria, 305 terrorist attacks carried out by the Taliban in Afghanistan in 2016 were included in the analysis. The GTD data are limited to media reports as its primary source which means that some incidents that takes place are not always reported to the exact time and place for the event, which may help explain the reduced sample size in this study.

All 305 attacks included in the study were geocoded fulfilling the minimum geocoding rate of 85% as suggested by Ratcliffe (2004). Figure 1 shows the dispersion of terrorist attacks in space by the Taliban included in this study. Of all the districts in Afghanistan by count, 74.37% did not experience any terrorist attacks by the Taliban in 2016, so no microcycles could be identified in those areas. This meant that all 305 attacks were spread around ¼ of the districts in Afghanistan, suggesting that the attacks were somewhat clustered.

Fig. 1
figure 1

Dispersion of terrorist attacks in space by the Taliban in Afghanistan 2016

Full size image

Figure 2 shows that terrorist attacks included in this study were spread quite evenly around the months of 2016, but still appeared to have taken place within small bursts of activity with periods of no attacks in between.

Fig. 2
figure 2

Dispersion of terrorist attack in time by the Taliban in Afghanistan 2016

Full size image

Analysis

To identify clustering and set the critical distances for inclusion in a microcycle, a Monte Carlo simulation-based Knox analysis was carried out with the Near Repeat Calculator (NRC) (Ratcliffe 2009a).

While using the NRC, every single event in a dataset is compared to all the other events, and the temporal and spatial distances between them are registered. The total number of pairs generated are n(n − 1)/2, where n is the total number of events analysed (Behlendorf et al. 2012). For this study, 46,360 events were compared and a contingency table (Knox table) with given temporal and spatial bandwidths was computed based on the pairings. The observed cell counts were compared with the expected counts in the contingency table to identify spatiotemporal clustering.

To see if the identified clusters were statistically significant, a Monte-Carlo simulation technique was incorporated into the NRC. This was included to overcome the violation of the assumption that observations are independent. Permutations of the observed data were utilised to generate expected distributions. Since a full permutation is practically impossible to calculate, even on reasonably sized datasets, a Monte-Carlo simulation was applied to select a random sample from all permutations. The null hypothesis of random clustering was rejected if more events in the original contingency table took place close in time and space than a pre-determined large percentage (95% or 99%) of randomly selected permutations (Johnson et al. 2007). For this study, the process of permutations was repeated 999 times which calculated statistical significance values down to p < 0.001 to produce more robust results. The probability that observed values happened on the basis of chance were calculated with the following formula:

$$p = \frac{n - rank + 1}{n + 1}$$

where n is the amount of simulations, and rank is the position of the observed value in a rank ordered array for that cell. Seen as the expected distributions were obtained through the original dataset, particular patterns like attack rates, temporal fluctuations and spatial concentrations were taken into account, meaning that any observed patterns could not be justified by general factors as area level attacks rates of terrorist events (Johnson et al. 2007).

The population shift bias is a major limitation with the Knox test (Kulldorff and Hjalmars 1999; Mack et al. 2012). The Knox test is biased if the population growth rate varies in geographical subareas at different times (Mantel 1967). However, the population shift bias is not typically a concern if the data in the analysis are equal to or less than a year, due to the population growth being relatively stable in that timeframe (Kulldorff 2006). This study analysed terrorist events in 2016 only, so the population shift bias should not be a major concern. Furthermore, the population growth rate in Afghanistan between 2009 and 2016 only ranged between 2.6% and 3.3%, exhibiting a rate of 2.7% in 2016 (The World Bank, 2017). Subsequently, the population shift bias was not a significant issue since Afghanistan had a reasonably stable population growth rate from 2010 to 2016.

Another criticism of the Knox test is that it is subjective. The choice of spatial and temporal bandwidths has been criticised as arbitrary due to the possibility of changing critical distances until a desired test statistic outcome has been identified, creating a biased procedure (Kulldorff and Hjalmars 1999; Fuchs and Deutz 2002; Grubesic and Mack 2008; Kalantari et al. 2016). To reduce systematic error, researchers select critical distances either empirically (Townsley et al. 2003; Johnson and Bowers 2004; Johnson et al. 2007; Ye et al. 2015) or by applying similar intervals used by other studies. In recognition of previous research, this study applied the same spatial and temporal bandwidths as Behlendorf et al. (2012) to test for spatiotemporal clustering.

To run the test, longitude and latitude coordinates from the GTD were converted into x and y coordinates. Manhattan distances were preferred to Euclidean distances to calculate spatial distances between events. The Manhattan distances calculated a travel pattern where one first travels horizontally (difference between two x coordinate points) and then vertically (difference between two y coordinate points) (Ratcliffe 2009b). In contrast, the Euclidean distance merely calculated the distance as a straight line between two points, making it a less accurate portrayal of urban travel patterns (Rossmo 2000; Chainey and Ratcliffe 2005).

In summary, a Monte-Carlo simulated based Knox analysis with a significance level of p < 0.001 and 999 permutations were conducted with the NRC to determine the critical distances for inclusion within a microcycle. In accordance with Behlendorf et al. (2012), spatial and temporal bandwidths for the NRC analysis were set to 5 miles and 7 days. The spatial distances between points were calculated using Manhattan distances.

The output of the NRC was a contingency table displaying Knox ratios for various spatiotemporal combinations created with the set bandwidths. The Knox ratios are interpreted in the same manner as odds ratios (Haberman and Ratcliffe 2012). A cell in the Knox table must display a Knox ratio of 1.20 or greater (i.e. at least 20% greater than what would be expected by chance) and a significance level of p < 0.05 to be identified as a spatiotemporal cluster (Ratcliffe 2009b) and thus, to be used as a critical threshold for inclusion in a microcycle. After critical distances in time and space for inclusion in a microcycle had been established empirically, the researchers went through all 305 events with the set parameters to identify each event as either part of microcycles or isolated events.

Further, as our aim was to examine whether specific attack locations, targets and tactics by the Taliban in Afghanistan were part of microcycles, a binary logistic regression was performed where our dependent variable is given the following binary classification:

$$Y = \left\{ \begin{array}{ll} {1, If\; event\; part\; of\; microcycle} \\ {0,\; Otherwise} \\ \end{array} \right.$$

Let \(P\left( {Y = 1 |X} \right) = p\left( X \right),\) where \(p\left( X \right) \in \left[ {0,1} \right].\) Meaning, the probability that a given event is part of a microcycle depends on a vector of variables \(X,\) and lies between 0 and 1. In this paper, we considered locations, targets, tactics and fatalities as part of our vector of 12 independent variables, \(X\), all of which are checked for multicollinearity. Using this, we fit a logistic regression:

$$\begin{aligned} Microcycle_{it} & = \beta_{1} NatCap_{it} + \beta_{2} ProvCap_{it} + \beta_{3} Gov_{it} + \beta_{4} Military_{it} + \beta_{5} Police_{it} + \beta_{6} Private_{it} + \beta_{7} Assassination_{it} \hfill \\ &\quad \beta_{8} Armed_{it} + \beta_{9} Bomb_{it} + \beta_{10} Hostage_{it} + \beta_{11} Fatal_{it} + \beta_{1} NonFatal_{it} + \varepsilon_{it} \hfill \\ \end{aligned}$$

where each variable measures the expected effect of said variable on the probability of the attack \(i\) at time \(t\) being part of a microcycle. The estimates of our coefficients \(\beta\) are outlined in Table 4. \(\varepsilon_{it}\) is an error term, which represents any variation in the probability of an attack being part of a microcycle that is not controlled for by our independent variables. Our categories are measured in daily frequencies \(t\) over one year (2016), and each independent variable has been defined in Table 1.

Table 1 A list of independent variable definitions retrieved from the Global Terrorism Database Codebook [National Consortium for the Study of Terrorism and Responses to Terrorism (START) 2017b], with the exception of the first two variables
Full size table

In addition, the sample size in this study was big enough, as recommended by Green (1991). With k being the number of predictors in the model, a minimum sample size of either \(\left( {104 + k} \right)\) or \(\left( {50 + 8k} \right)\) should be met, whichever is greater. Given that this study had 12 independent variables, the sample size should be over 146, which it was with 305 events analysed.

Results

The descriptive statistics of the dataset showed that there were on average 0.83 attacks per day with a standard deviation of 1.08 by the Taliban in Afghanistan in 2016. The highest number of attacks per day was eight and the lowest was zero. Further, the output of the Knox table from the NRC analysis (Table 2) showed a significant temporal and spatial pattern of terrorist events for up to 5 miles and up to 2 weeks at the local level. These parameters were chosen as the predominant threshold for inclusion within a microcycle in this study. However, since significant spatiotemporal patterns were identified at up to 5 miles and 1 week, and at the exact location and up to 1 week, microcycles were also constructed with these critical distances to check the robustness of the predominant thresholds of 14 days and 5 miles. Even though significant clustering was found for up to 20 miles and up to 1 week, it was not accepted as a critical distance within local levels by the NRC, and neither in this study.

Table 2 Knox ratios of observed to expected mean frequencies for terrorist attacks by the Taliban with temporal bandwidths of 1 week and spatial bandwidths of 5 miles
Full size table

Cells identifying spatiotemporal clustering of up to 5 miles and 14 days, and exact same location and 7 days had a significance level of p < 0.001. Even though the NRC output showed a spatiotemporal clustering up to 7 days and at the same location, suggesting that the Taliban is an insurgency that repeatedly attacks in the same location, this was not chosen as the predominant critical distance for inclusion within microcycles in this study. Analysing attacks from the exact same location carried the risk of making the conclusions of the study restrictive. This paper worked on a rational presumption that once the Taliban attacked one location, the surroundings were also possible targets. Therefore, the risk was not considered concentrated to only one particular location, but to the area around it. Subsequently, critical distances of 14 days and 5 miles were preferred as the predominant threshold in this study.

Table 3 displays a comparison of identified microcycles by the different critical distances in terms of frequency, length and density. Nearly 40% of terrorist attacks by the Taliban in Afghanistan in 2016 were identified as part of microcycles based on a critical distance of up to 5 miles and 14 days. There are solitary positive events that are not included in microcycles, however these results show that despite this a certain significant percentage of events were part of microcycles.

Table 3 Microcycle characteristics by critical distances
Full size table

Figure 3 presents the dispersion of the terrorist attacks in space recognised as part of microcycles. A large proportion of the attacks took place in the district of Kabul, more specifically within the city of Kabul, the national capital. Further, attacks within microcycles also appeared to occur in the middle region of the Helmand province, the south-east corner in the province of Kunduz and west in the province of Baghlan. Within each of the 40 different microcycles identified, the average length of each microcycle was 9.93 days, with nearly one attack (0.92) occurring each day on average. The longest microcycle identified lasted for 48 days, comprising of 10 terrorist attacks. A further examination regarding the length of the microcycles showed that 42.5% of the 40 microcycles identified lasted for more than 10 days, whereas 25% of the microcycles lasted 1 day only. The microcycles that lasted one day were often several coordinated attacks on neighbouring villages or in a specific city, frequently targeting police and police checkpoints.

Fig. 3
figure 3

Dispersion of terrorist attacks identified as part of microcycles in space by the Taliban in Afghanistan

Full size image

Based on these findings, Hypothesis 1 was accepted proposing that terrorist attacks by the Taliban in Afghanistan occur in microcycles.

Table 4 shows the outcome of the binary logistic regression testing the effect different locations, targets and tactics have on the likelihood that attacks are part of microcycles within 5 miles and 14 days. Results indicate that, in combination, the independent variables significantly impacted the likelihood of inclusion (or not) within a microcycle (X2(12) = 119.52, p < 0.001). The model correctly predicted 78.03% of the events and accounted for 29.17% of the variance in the dependent variable.

Table 4 Logistic regression predicting inclusion within a microcycle (5 miles/14 days)
Full size table

This study hypothesised that compared to assassinations and kidnappings, bombings and armed assaults were more likely to be part of microcycles. As expected, the results in Table 4 show support for assassinations and hostage takings as significantly less likely to be part of microcycles. However, it was also found that explosions and armed assault were significantly less likely to predict inclusion within a microcycle. A closer look at the variables showed a higher odds ratio for bombings and armed assaults compared to kidnapping and assassinations. Even though all attack type variables were found to be significantly less likely to be included within a microcycle, bombings and armed assaults were more likely to occur in microcycles compared to assassinations and kidnappings. Hypothesis 2 was therefore accepted.

This study also investigated the effect different targets have on inclusion within a microcycle or not. It was found that attacks on private citizens and property were more likely to occur within microcycles and was associated with a 51% increase in odds, whereas attacks on the government, the police and the military were found to be more likely to be isolated events. However, none of the targets analysed in the regression model were statistically significant, and thus the null hypothesis was accepted for Hypothesis 3.

Further, this paper hypothesised that attacks on national or regional capital cities were more likely to be part of microcycles than attacks on non-national or regional capital cities. The study found strong support for Hypothesis 4 to be accepted. Overall, 66.12% of all attacks within microcycles were on national or provincial capitals. Attacks on Kabul, the national capital, were significantly more likely to occur within microcycles. As the strongest predictor with a coefficient of 3.625, an attack on Kabul by the Taliban was associated with a 3.653% increased odds of occurring within a microcycle. Attacks on provincial capitals, Kabul excluded, were also significantly more likely to occur within microcycles. Attacks in provincial capitals like Khost, Lashkar Gah, Kandahar and Farah had more than nine times the odds of occurring within a microcycle by the Taliban than terrorist attacks on non-provincial capitals. Based on these results, Hypothesis 4 was accepted.

Lastly, non-fatal attacks as a tactic were significantly more likely to occur within a microcycle, associated with a 1.821% increased odds. Fatal attacks (perpetrators included) were also found to be more likely to be part of microcycles with a 648% increased odds, but a statistical significant result was not discovered. Therefore, the null hypothesis was accepted for Hypothesis 5 set out in this study.

Discussion

This study found that nearly 40% of all attacks by the Taliban in Afghanistan in 2016 occurred within microcycles. Microcycles were identified all the way down to critical distances of 7 days and exact same locations. Attacks took place at the same location less than 1/8 of the time, but there was a greater risk of subsequent attacks within a five-mile radius.

These findings seem to be in accordance with previous theory regarding the act of terrorism as a rational behaviour (Pape 2003; Dugan et al. 2005; Clarke and Newman 2006). Patterns identified by this paper suggest that the Taliban carry out attacks close in time to reduce the amount of resources, increase the level of rewards and draw attention to their strategies and goals, but move on after a burst of offences in one area to another, to reduce risk of detection.

Regarding the types of targets attacked by the Taliban, no significant results were identified. None of the targets analysed were found to be significantly more likely to occur within microcycles than on the basis of chance. These results may be explained due to data processing and coding of the independent variables, which might have affected the internal validity of the study. The trend in this study however, showed that attacks targeting private citizens and private property were more likely to occur in microcycles. Further studies on the Taliban and localised bursts of terrorist activity are needed to establish if some targets are statistically more likely to occur in microcycles or not. If none of the target types seem to be statistically significant, it will have implications for counter-terrorism strategies, making it harder for security forces to narrow down their focus of prevention strategies in the fight against the Taliban.

This study wanted to compare the identified spatiotemporal patterns of microcycles and its characteristics to previous findings on violent microcycles in terrorism. With the same critical distances of 5 miles and 14 days as this study, Behlendorf et al. (2012) identified that 52% of attacks by the ETA and 67% by the FMLN occurred in microcycles, whereas this study identified 40% of attacks by the Taliban occur in microcycles. Some of the variance between the two studies could be explained due to different processing of data. Behlendorf et al. (2012) geocoded all events to the centroid of the city/town/village, which could mean that more incidents were considered closely clustered enough for inclusion in a microcycle.

More importantly, attack patterns and strategies within microcycles seem to be quite similar for both the ETA, FMLN and Taliban. Attacks on national capitals were the strongest predictor for inclusion within microcycles for all three of these terrorist organisations. In addition, attacks on provincial/regional capitals and non-fatal attacks were found to be strong predictors in all studies. For all three groups bombings were found to be significantly more likely to occur in microcycles compared to other tactics. All these findings suggest a great similarity between the organisations, leading to the assumptions that terrorist groups (at least the ones researched so far) face similar constraints and strategic options to which they also respond in a similar manner.

Implications of violent microcycles

The presence of microcycles and clustering of terrorist events in time and space suggest that terrorist campaigns and their group-level strategies are multifaceted. Bursts of terrorist events are utilised as a strategy to boost messages and goals through fear and intimidation. In addition, specific locations and strategies at specific times seems to be utilised in different campaigns by terrorist organisations. A great deal of empirical research on terrorism does not focus on specific campaigns of attacks, rather, the intensity of attacks is measured on a monthly, quarterly or yearly basis to identify whether campaigns of terrorism have either increased or decreased (Bapat 2007; Siqueira and Sandler 2007). This study of microcycles is offered as an addition to the existing research carried out on terrorist campaigns, where events can be analysed at a more disaggregated level in time and space.

Nowadays, preventing threats before they happen is extremely important in counter-terrorism. In order to do so, governments need to understand how terrorist groups behave. That is difficult, considering terrorism is a complex phenomenon with supposedly high uncertainties in what the perpetrators do. This uncertain nature of terrorism is a main challenge in the design of counter-terrorism policy.

In general, the challenge in protecting society from terrorism is being able to correctly identify associated activity patterns with the given information such as incident type, attack type and weapon type (Tutun et al. 2017). This study is a step in that direction by analysing attacks by the Taliban in Afghanistan in 2016. It contributes by identifying useful patterns of attacks for counter-terrorism experts to analyse, to understand behaviours of terrorists and their future moves and finally to prevent potential terrorist attacks. The results would also enable policy makers to develop precise global and/or local counter-terrorism policies.

Limitations and future research

A limitation of this study is the generalisability and external validity of the results, both in relation to the other active years of the Taliban insurgency and other terrorist organisations. It is not certain whether the results identified in this study would be replicated in the other active years of the Taliban insurgency.

Less than a third of the 1061 events recorded by the GTD fit the inclusion criteria applied in this study. Although the cleansing of the dataset was justified, the analysis could have produced ambiguous results compared to if all incidents were included. This degree of missingness was addressed by looking into how many incidents happened within the set timeframe in two adjacent districts. Nawa-i-Barakzayi and Nad Ali are two adjacent districts located in the Helmand province where 18 attacks by the Taliban were registered in 2016 by the GTD. None of these attacks were analysed in the study as they did not meet the criteria for inclusion. By applying the threshold of 5 miles and 14 days to these attacks, 5 unique microcycles were identified, accounting for 64.7% of all attacks in these two districts by the Taliban in 2016.

Therefore, a point can be made that the missing data do not have a severe impact on the results found in this study, as the inclusion of the missing data would more likely increase the occurrence of identified microcycles and clustering, rather than decreasing them. Further research should attempt to geocode and identify the date and time of these excluded events in 2016 as accurately as possible for future research to produce a more rigorous result as this was outside the scope and time constraints of this study.

In methodological terms the most favourable option would have been to set the spatial and temporal bandwidths for the NRC empirically. Kalantari et al. (2016) proposed to set the bandwidths empirically through the Ripley’s k function, mean distance or natural breaks classification of nearest neighbour distance. However, any form of bias was avoided in the procedure for the present study by applying same spatial and temporal bandwidths as previous research on terrorist organisations to reduce systematic error. Further research should attempt to set temporal and spatial bandwidths for the NRC empirically for terrorist organisations.

Conclusion

The identification of microcycles in attacks by the Taliban provides insight into the risk of future events at local levels. Identified patterns can have an operational relevance and guide policy makers on how to allocate resources in the fight against terrorist groups and insurgencies.