Much hinges on the breadth of the definition of a NIAC. A narrow definition subjects state forces to the more rigorous demands of international human rights law (IHRL), which permits the use of deadly force only when an individual poses a concrete, imminent threat to the life of a law enforcement officer or other individuals.⁹ The European Court of Human Rights has defined such threats narrowly, second-guessing the use of lethal force by law enforcement even when the target was a pair of known terrorists whom authorities rightly believed had planted an explosive device that they planned to trigger in the near future.¹⁰ Under IHRL, terrorists have a greater opportunity to operate with impunity. Applying the law of armed conflict (LOAC), in contrast, diminishes the non-state actor’s room to maneuver. It allows states to target individuals whom it believes to be performing a continuous combat function (CCF).¹¹ Even narrow definitions of CCF recognize that an individual who performs this role may spend much time in pursuits other than presenting a concrete, imminent threat to the other side. A typical uniformed soldier, for example, may spend time marching, building an encampment, or even sleeping. The soldier can be targeted by an enemy state’s forces in any and all of these activities.¹² Just as a state can target an opposing state’s uniformed forces without a showing that an individual soldier faces a specific, imminent threat, LOAC would allow targeting of a member of an organized non-state actor whom the state reasonably believed to be engaged in CCF.

However, the greater latitude allowed states in targeting terrorists makes human rights advocates blanch at the prospect of higher civilian casualties.¹³ More latitude in targeting may increase the risk of mistakes, in which a state erroneously targets innocents or causes collateral damage among civilians.¹⁴ Advocates of greater state latitude will argue that states can and should build in systems that minimize mistakes, such as a lawyer’s review and approval of targeting decisions. However, state advocates would add, opponents of state latitude have a bad case of hindsight bias¹⁵ regarding state action. State critics regard all civilian casualties as avoidable, a position that the laws of war have never taken. However, proponents of state latitude would argue, critics fail to consider matters from an ex ante perspective, involving the incentives for violent non-state actors. When violent non-state actors believe they can operate with impunity, risks to civilians increase.¹⁶ Curbing violent non-state actors thus reduces net risks for civilians.

Moreover, state critics often fail to acknowledge that while a broader definition of OAG confers advantages on a state in the arena of targeting, with that advantage comes greater accountability for all parties to the NIAC.¹⁷ A state in a NIAC must observe the strictures of the Geneva Convention’s Common Article 3, such as humane treatment of captives.¹⁸ These provisions are generally considered jus cogens and therefore non-derogable.¹⁹ OAGs incur the same duties; one purpose of the requirement that a group have a minimum level of organization is that it would be unfair to require a disorganized group to observe IHL because it lacks the structure to do so. Individuals who target civilians can be made to answer for violations of municipal law, such as the prohibition on murder. In contrast, OAGs who target civilians may be prosecuted in international tribunals for crimes against humanity, instead of merely being answerable in the sometimes-dysfunctional justice systems of their countries of origin. The targeting advantages reaped by states are thus paid for by greater accountability elsewhere in the IHL framework.²⁰

At first blush, state critics may have an edge in the definitional debate regarding OAG. Some passages in case law have propounded a narrow definition of OAG that requires something approaching the attributes of state entities.²¹ In Prosecutor v. Limaj, the ICTY suggested that to meet its criteria, an OAG should have a headquarters, a unified command, and a military police unit that will arrest malefactors.²² Without these attributes, a group is considered not an OAG, but a criminal band or an assemblage of individuals engaged in civil unrest such as a riot.²³ Individuals in such groups cannot be targeted as readily as participants in an armed conflict, but instead are protected by IHRL.

Acts of terrorism sit uneasily within this paradigm. “[I]solated acts of terrorism” probably do not demonstrate the level of organization required for a NIAC.²⁴ Moreover, some commentators have noted that several major nations have addressed significant acts of terrorism through traditional law enforcement.²⁵

If a terrorist entity can elude definition as an OAG within one state, it can even more readily elude such definition in the regional or global context. The United States confronts extremist organizations not merely in one country, but in multiple regions, that feature ties of varying closeness to Al-Qaeda. Some have argued that Al-Qaeda’ relationship to such groups involves only “very loose ties” typical of a “confederation of like-minded fellow travelers, many of whom are fighting separate armed conflicts in different regions of the globe.”²⁶

Treaty law and the ICTY jurisprudence actually permit greater flexibility in the definition of OAGs. While AP II applies to some NIACs, other NIACs are governed by Common Article 3, which contains no requirement that a party control territory.²⁷ The International Committee of the Red Cross (ICRC), a group with special competence regarding LOAC, has also signaled that flexibility is important. In one study, the ICRC observed that to be considered an OAG, an entity should merely have a “minimum of organization.”²⁸ That terminology strongly suggests that a rigid, itemized checklist would be counterproductive.²⁹

Moreover, the ICTY jurisprudence is far more flexible than it may appear.³⁰ In Prosecutor v. Boskoski & Tarculovski,³¹ a case involving the targeting of civilians by a non-state group, the ICTY noted that terrorist acts could form a pattern that would constitute an armed conflict.³² Boskoski can be read as standing for either one or two eminently pragmatic propositions. First, OAG should not be assessed in a vacuum, but on a sliding scale that also includes the other Tadic criterion—intensity.³³ Second, the best proof of OAG is in the operational details of violence that members of the group have caused. A group’s sheer ability to mount sustained terrorist attacks is evidence of a “high level of planning and a coordinated command structure.”³⁴

The ICTY’s treatment of evidence also suggests substantial flexibility in the definition of OAG. In Limaj, for example, the ICTY found that the Kosovo Liberation Army (KLA) was organized even though evidence of discipline was “scant” by the court’s own admission.³⁵ Witnesses differed widely on when the military police cited by the tribunal had been established.³⁶ If the military police were a salient symbol of organizational discipline, this divergence in recollection seems odd. Moreover, as the ICTY acknowledged, there was no record of any imposition of discipline among KLA members.³⁷

The Limaj court sought to buttress this decidedly equivocal evidence of discipline with a proxy: other nations and entities dealt with the KLA in a way that suggested that they regarded the group as organized,³⁸ although evidence for this point was slim. For example, the ICTY acknowledged that representatives of other entities were “sometimes unclear about the KLA’s command structure.”³⁹ Indeed, one report described the KLA’s structure as “a mystery” and “more a matter of diffuse horizontal command.”⁴⁰ Limaj also noted that the General Staff of the KLA “did not have a consistent…location.”⁴¹ While the tribunal made much of the KLA’s governing regulations, it acknowledged that the authorship and date of the regulations were not apparent on the regulations’ face.⁴² Yet the ICTY brushed past these apparent failures of organization, explaining pragmatically that the KLA was “effectively an underground operation, operating in conditions of secrecy out of concern to preserve its leadership” and “under constant threat of military action” by Serbian forces.⁴³ Therefore, it was “no surprise that the organizational structure and the hierarchy of the KLA was confusing.”⁴⁴ More than any other factor, the court relied on the KLA’s knack for recruiting new followers.⁴⁵ Based on this one criterion and modest evidence of others, the court was satisfied that the KLA’s fluid and contingent structure did not undermine its classification as an OAG.

Precedent from elsewhere also argues against a narrow definition of organization. Consider Abella v. Argentina (Tablada Case),⁴⁶ involving an attack on an Argentinean army base by rebels, followed by alleged state mistreatment of the attackers that the plaintiffs characterized as a violation of Common Article 3. The Inter-American Commission on Human Rights (IAHCR) first ruled that AP II did not limit the situations in which armed conflict existed. The tribunal observed that armed conflicts “not of an international character” that trigger Common Article 3 need not be “large-scale and generalized hostilities or a situation comparable to a civil war in which dissident armed groups exercise control over parts of national territory.”⁴⁷ Suggesting the need for flexibility, the IAHCR noted that NIACs could also involve “confrontations between relatively organized armed forces.”⁴⁸ The tribunal’s use of the term, “relatively,” to modify the requirement of an OAG suggests that a narrow or rigid definition would be counterproductive. While the tribunal added that an armed conflict must be something more than “riots, mere acts of banditry or an unorganized and short-lived rebellion,”⁴⁹ its analysis indicated that requiring a significantly more elaborate showing would merely allow parties to escape accountability. Turning to the specific facts, the IAHCR found it sufficient that the rebels’ attack on the base was “carefully planned, coordinated and executed.”⁵⁰

Tribunals have also expansively defined a non-state actor’s capacity to comply with IHL. Terrorist groups generally do not comply with IHL; often their standard operating procedure involves fundamental violations such as the targeting of civilians. But tribunals have viewed terrorist groups as able to comply with IHL, even if those groups are disinclined to do so.⁵¹ A contrary view would create perverse incentives, allowing a group to free itself from the risk of targeting by increasing its violations of otherwise applicable norms.⁵²

Buttressing this flexible approach, the ICTY has also broadly interpreted the Tadic requirement that violence be “protracted.” Interpreting the term “protracted” narrowly would again create perverse incentives. Violent non-state actors could strike first and then claim that the conflict was not yet a protracted one, thereby precluding a state from utilizing the full range of responses permissible under LOAC. Instead, the state would be limited to the far narrower repertoire of force permissible under a law enforcement paradigm. To avoid creating this perverse incentive, the ICTY has viewed the term “protracted armed violence” in a pragmatic fashion, as referring generally to the intensity of the violence, not its timing per se.⁵³

Terrorist groups require organization because they wish to influence actors who are often organized. Terrorist groups play a multi-level game of the kind made famous by Robert Putnam, involving internal and external actors.⁵⁵ Internal actors include people within the organization and within the community that the group purports to represent—Al-Qaeda purports to represent a particular religious vision, while a group like Hamas purports to represent Palestinians and the Kurdistan Workers’ Party (PKK), Kurds. External actors include states where the terrorist group is principally located, other states where the group wishes to extend its influence, groups of states such as Western nations or states in the Middle East, international organizations, and other terrorist groups.⁵⁶

Terrorist groups use violence for both expressive and instrumental ends. Violence expresses their commitment to a distinctive vision that the mundane corruption of other parties obscures.⁵⁷ Certain kinds of violence, such as suicide attacks, express this commitment in an even clearer form—sending messages about the group’s commitment to its cause.⁵⁸ Instrumentally, violence serves as a spoiler, derailing negotiations between states and moderate members of their own community.⁵⁹ On occasion, terrorist groups find it expedient to mitigate violence, to avoid alienating key constituencies or to gain time to regroup from state pressure.⁶⁰ Managing violence to maximize both expressive and instrumental goals requires organization. Maintaining fidelity to these goals in the face of state pressure and internal disagreement requires a particular agility in organizational form.

Like any other entity, a terrorist group needs some form of discipline. Without discipline, agency costs proliferate, as undisciplined members pursue their own impulses or agendas to the detriment of the organization’s goals.⁶¹ However, discipline requires institutional memory, as leaders monitor, document, and assess the performance of subordinates. Documentation can be exploited by the group’s foes, providing information about operatives and planned attacks. Terrorist groups including Al-Qaeda grapple with the conflict between uniform messaging and secrecy.

Al-Qaeda has coped with this dilemma by cultivating a portfolio approach that maximizes versatility in structure and decision-making, as well as in operational plans.⁶² Wise investors use portfolio theory to diversify risk. The careful and prudent investor never entrusts all of her resources to one company or even one sector. Rather, the investor pursues some measure of risk diversification. If one investment fails to bring returns, others can pick up the slack.

Al-Qaeda employs a portfolio approach to operations. Officials have recognized that Al-Qaeda needs to be right only once to achieve its expressive and instrumental goals, while security officials must be right every time.⁶³ Running several plots simultaneously keeps state adversaries guessing, lodging the initiative with Al-Qaeda. Even if the vast majority of attacks are prevented, one catastrophic attack sends the message that Al-Qaeda is still on the map. That message encourages further attacks and distorts government policies. Al-Qaeda uses a similar approach to organizational form. It varies its structure, as the need requires, equipping its personnel to leverage “evolving relationships” rather than being wed to a particular organizational structure.⁶⁴ Sticking with one organizational form would also give an advantage to Al-Qaeda’s adversaries.⁶⁵ Al-Qaeda has adopted an approach to structure that minimizes this risk, mixing command decisions with subordinates’ operational initiative. While some have argued that most terrorist acts are the product of independent, grass-roots efforts,⁶⁶ that picture is decidedly incomplete. According to terrorism expert Bruce Hoffman, Al-Qaeda is a “remarkably agile and flexible organization that exercises both top-down and bottom-up planning and operational capabilities.”⁶⁷

Accounts of terrorist groups as creatures of chaos are inaccurate. It turns out that terrorist groups breed bureaucracy. Like lawful organizations, terrorist groups wrestle with the ubiquitous problem of agency costs. Al-Qaeda, like a state military unit, uses personnel drawn from a variety of backgrounds it expects to fulfill the group’s mission.⁶⁸ However, operatives may have agendas of their own. For example, they may have an interest in looting civilian property or skimming money from the group and enriching themselves.⁶⁹ Alternatively, terrorist operatives may engage in more violence than the group’s leaders find optimal, because the operatives have developed habits of violence while leaders sometimes believe that relative restraint enhances the organizational brand.⁷⁰ Bureaucratic rules and procedures can help the terrorist group address these problems.

Consider the case of Al-Qaeda in Iraq (AQI). AQI was a “cohesive organization with shared personnel across ‘official’ names, institutional memory, embedded management practices, and permanent salaried employees.”⁷¹ Both AQI and its successor organization, the Islamic State of Iraq (ISI) took steps to enforce discipline among members.⁷² For example, terrorist groups such as AQI keep copious records of the success and failure of operations, even though maintaining such records greatly enhances the risk that adversaries will obtain custody of this information and use it against these groups.⁷³ Groups such as AQI clearly believe that committing rules and communications to writing tightens the organization of the group, making defection or shirking more difficult. AQI required signed pledges by fighters who consented to conditions on various activities.⁷⁴ For example, AQI threatened to expel members who engaged in ordinary criminal conduct, such as looting, which would distract from the group’s ideological agenda.⁷⁵ ISI instituted controls that would bring a glow to the most austere of accountants, decreeing that, “[f]or every amount paid out of [organizational] funds, the recipient is required to provide two signatures…one for receiving the money and another one to show how the money was spent.”⁷⁶ Another ISI pronunciamento declared that, “[a]ll properties, small and large, will be inventoried.”⁷⁷ The ISI also required operatives to upload information on flash drive, to be “sent every week to the [group’s] administrator.”⁷⁸ The proliferation of flash drives and memory sticks obviously ratchets up the risk that some of the information contained in these devices will end up in the hands of the group’s adversaries.⁷⁹ However, ISI apparently determined that the benefits of such a structure to group discipline outweighed those risks.

ISI also kept careful track of all of its operatives, cataloguing incoming fighters, ongoing staff, and “exiting brothers.”⁸⁰ These internal records distinguished between the assignments of new staff, who might be suicide bombers or perform other roles.⁸¹ This record keeping, like the ban on looting, served strategic and ideological purposes. Operatives in Iraq were often foreign nationals who had entered Iraq because ISI’s practice of violence resonated with their preconceived beliefs or habits.⁸² Left to their own devices, these recruits might engage in violence “for its own sake.”⁸³ However, indiscriminate violence, like looting, could impair the group’s messaging. Record keeping also enhances the propaganda capabilities of terrorist groups. In most groups, claiming credit for an attack is as important as the attack itself.⁸⁴ Claiming credit announces to the world and to other terrorist groups that the organization has “arrived.” Claiming credit for violence also enhances the group’s commitment: a suicide attack, for example, signals the sincerity of the attacker’s beliefs and those of the organization.

One can also view a strategy relying on suicide attacks as a decision about the costs of internal monitoring. Suppose that a terrorist leader orders a conventional (non-suicide) attack. For whatever reason, the attack fizzles. The group’s leadership then has a difficult time in evaluating the causes for the attack’s failure in a “noisy” environment,⁸⁵ where many factors can impede optimal execution. An attacker who survives a suboptimal attack will likely have many excuses for why the operation failed to go as planned. The leader will need to weigh those excuses before deciding on the staffing for the next attack. A suicide attack dispenses with the excuse-sifting phase, and also gives the suicide operative no exit strategy apart from outright desertion. Since that path leads to disgrace,⁸⁶ a suicide attack is often a good way of ensuring discipline. However, making sure that the operative has sufficient ties to the organization and a “track record” of violence and ideological commitment requires some degree of organization.

Al-Qaeda displays this mix of organizational forms in its relationships with affiliated groups.⁸⁷ While Al-Qaeda’s core remains in Pakistan, its lack of geographic proximity to other groups is not necessarily a weakness. Network theory teaches us that physical proximity is less important when knowledge and values can be shared in other ways.⁸⁸

Links between Al-Qaeda and regional groups are synergistic along a number of axes. The Taliban/Al-Qaeda link has been durable and effective because it combined the embedded localism of the Afghan Taliban with the extreme Islamist network of schools and camps based in Pakistan.⁸⁹ In other situations, regional organizations seek out Al-Qaeda when state pressure has weakened the organization.⁹⁰ Allied with Al-Qaeda, groups can share information on effective strategies and learn from their mistakes.⁹¹ Al-Qaeda has historically welcomed such overtures, since they assist the global group in extending its brand.⁹² More sophisticated technology, including improvement in transportation and communications, has made it far easier to coordinate activities across regions.⁹³

Experts have identified a number of characteristics of the relationship between Al-Qaeda and its regional affiliates. According to Thomas Joscelyn, a Senior Fellow at the Foundation for Defense of Democracies, affiliates often swear a loyalty oath or bayat to Al-Qaeda’s leadership.⁹⁴ Affiliates swearing the bayat include Jabhat al Nusra in Syria, which is currently one of a number of groups seeking to topple the Assad regime.⁹⁵ Joscelyn, speaking to Congress in July, 2013, noted that Al-Qaeda and its affiliates “form an international terrorist network that is focused on both acquiring territory and executing terrorist attacks against the West.” According to Joscelyn, “Al-Qaeda’s general command guides the overall strategy pursued by the affiliates and even sometimes gets involved in specific tactical matters.”

Al-Qaeda often sends key operatives into the field to assist affiliates. For example, Al-Qaeda in the Arabian Peninsula (AQAP) is run by Nasir al Wuhayshi, who was Osama bin Laden’s aide-de-camp for several years before 9/11.⁹⁶ According to a Defense Department report, “Al-Qaeda in Libya: A Profile” published by LOC in August 2012, core Al-Qaeda sent senior operatives to Libya. There are also credible reports that key Al-Qaeda members have gone to Syria to aid extremist rebels’ efforts to topple the Assad regime.⁹⁷ Dr. Ayman al-Zawahiri, Al-Qaeda’s current leader, has ongoing contacts with extremists among the rebel forces.⁹⁸ Most recently, Zawahiri has sought to unify disparate extremist elements in Syria under the core Al-Qaeda banner,⁹⁹ although one such group, ISIS, has defied Zawahiri’s attempts.¹⁰⁰

Other examples of this sponsor-affiliate relationship abound. For example, AQAP, which operates primarily in Yemen, began as a result of “direct orders” from Osama bin Laden to Al-Qaeda members on the ground in that region.¹⁰¹ Today, AQAP is both more “professional” in its operations and more linked to the Al-Qaeda “core.”¹⁰² Indeed, the U.S. recently closed many embassies around the world because of credible reports that Dr. Zawahiri had sent a letter to AQAP leaders ordering attacks on US diplomatic facilities.¹⁰³

The Al-Qaeda sponsor-affiliate relationship is also alive and well in North and East Africa. In North Africa, Al-Qaeda of the Islamic Maghreb (AQIM) enjoys a partnership with Al-Qaeda.¹⁰⁴ Dr. Zawahiri announced a “blessed union” with AQIM, leading both groups to focus on attacking French interests.¹⁰⁵ In Somalia, the terrorist group Al-Shabaab publicly pledged its loyalty to Al-Qaeda.¹⁰⁶ Operatives trained in Afghanistan camps transferred to Somalia to provide training to Shabab members.¹⁰⁷ The two organizations now cooperate on a host of matters, from ideological instruction to advanced tactics.¹⁰⁸ Zarqawi’s AQI “willingly merged” with bin Laden’s group, although the latter had been weakened by the erosion of its base in Afghanistan after September 11.¹⁰⁹ Credible evidence indicates that members of Al-Qaeda in Iraq have been assigned to “establish cells in other countries.”¹¹⁰

Al-Qaeda provides training for operations elsewhere. For example, the perpetrators of the London subway suicide attacks obtained training from Al-Qaeda branches in Pakistan.¹¹¹ Indeed, Al-Qaeda provided training in Afghanistan, Pakistan, and Yemen to as many as 3,000 violent extremists from the United Kingdom, who subsequently returned there, “embedding themselves” in communities and developing plans for further attacks.¹¹² While discrimination and alienation from the mainstream in the United Kingdom and elsewhere may have facilitated additional recruitment, “much of the terrorist threat in the United Kingdom today stems from deliberate, long-standing subversion by Al-Qaeda.”¹¹³ Al-Qaeda–linked networks released videotaped martyr’s wills by the attackers.¹¹⁴ Other plots, such as the conspiracy to target trans-Atlantic passenger aircraft in 2006, also have ties to Al-Qaeda networks in Pakistan or Yemen.¹¹⁵ Groups such as Hezbollah have global networks that attract financing and recruit new members.¹¹⁶ Moreover, some terrorist groups have strong ties to transnational criminal enterprises that share the proceeds of drug trafficking, kidnapping, and prostitution.¹¹⁷

Groups partnering with Al-Qaeda buy into a distinctive operational focus. While many groups have local agendas, groups under the Al-Qaeda umbrella must agree to pursue attacks on Western interests.¹¹⁸ The attacks on Western interests are a signature element of Al-Qaeda; perpetuating these attacks allows groups under the Al-Qaeda umbrella to “stay on message.”¹¹⁹ Moreover, Al-Qaeda insists on specific approval for attacks outside a subsidiary’s regional base.¹²⁰ For example, when a Danish newspaper published caricatures of the Prophet Muhammad, Al-Qaeda asked its Iraqi branch to carry out attacks on Danish interests.¹²¹ United States officials believe that Hezbollah operatives played a significant role in the July 2012 attack in Bulgaria on a bus carrying Israeli tourists.¹²² In addition, Al-Qaeda requires certain operational modalities for attacks outside a branch’s region. Al-Qaeda pushes suicide attacks and patterned attacks on particular kinds of targets, such as public transportation, government structures, and infrastructure.¹²³ This layer of specific operational control demonstrates Al-Qaeda’s organizational contours and confirms its existence and functioning as a “united front.”¹²⁴ Al-Qaeda also has structural mechanisms that ensure communication and guidance. It uses information committees that are tied to senior leadership and operational planners.¹²⁵

A networked approach driven by an anti-Western strategic focus has many advantages for Al-Qaeda. Shared ideology lessens the likelihood of deterring the group through ordinary law enforcement or negotiation. Suicide bombers will not blink at the prospect of arrest and trial. Rather, involvement with the legal system confers another opportunity for the attackers to brand themselves as martyrs.¹²⁶ In addition, networks such as Al-Qaeda and its affiliates are far less amenable to negotiation than territory-based groups. Groups that control territory within a single state may on occasion be a party to successful negotiations, as the IRA demonstrated.¹²⁷ Such movements may gain a stake in negotiations, as they seek to ease state pressure on their territorial base.¹²⁸ In contrast, the disaggregation of territory and operations in transnational networks mean that those groups lack a “return address.” Since transnational groups can readily shift their operations,¹²⁹ state pressure is not an effective deterrent. The absence of an effective general deterrent only exacerbates the risk of armed conflict from transnational groups, and makes specific deterrence or incapacitation of the group’s operatives all the more imperative.¹³⁰