Exploring Terrorism Prevention: An Organizational Perspective on Police Investigations

1 Introduction^[1]

Terrorism is fundamentally an organized field of modern societies with organizations on both sides.^[2] On the one hand, organizations are responsible for a substantial number of terrorist attacks while the field of terrorism prevention is dominated by formal and bureaucratic organizations, including the military, intelligence services, and the police (Silke 2019a). Despite their relevance, the intersection of terrorism and organizations is, in important regards, uncharted territory (see James 2011), with counterterrorism specifically “being […] nearly a terra incognita” (Brodeur 2010, 187).

A natural candidate for research on terrorism, organizational research views terrorism, with very few exceptions (Sutcliffe and Weick 2008), as an exogenous shock challenging corporate resilience (see Hepfer and Lawrence 2022). Terrorism research, on the other hand, focuses on terrorist organizations (Crenshaw 2014), studying their forms (Mayntz 2004), goal conflicts (Volders 2021), or mortality (Goldman and Bar 2020). This constitution of the research field leaves the organized actors who seek to prevent terrorism unexplored.

The present study addresses this research gap by analyzing the investigations conducted by the Berlin police into the subsequent perpetrator of a terrorist attack, Tunisian-born Anis Amri. On the evening of December 19, 2016, after having shot the driver, Amri drove a hijacked truck into the Christmas market next to the Kaiser Wilhelm Memorial Church on Breitscheidplatz in Berlin, killing 12 and injuring more than 170 people (Deutscher Bundestag 2021, 165). The attack exemplifies a specific form of terrorism that we will focus on here, namely, attacks carried out by lone actors, that is, by individual perpetrators unattached to any formal organizations and not acting on direct orders (Lindekilde, Malthaner, and O’Connor 2019, 23).

The case of the Berlin truck attack is intriguing from an organizational perspective because it involves an empirical puzzle. Shortly after Amri entered Germany, the police became aware of him because he had contacts with radical groups, openly stated his intention to carry out a terrorist attack and was involved in criminal activity. Consequently, a Berlin court ordered the police to investigate Amri up until September 2016, granting them invasive means for this purpose. However, the police prematurely phased out its investigations in August 2016 instead of investigating Amri right up until September (see Deutscher Bundestag 2021).

The present study seeks to explain why the Berlin police, despite being aware of Amri’s intentions, prematurely closed its investigations. For this purpose, we conceive of the police as an organization handling a specific caseload, which we refer to as case ecology, operating with limited resources and an artificial structure (Luhmann 1995; Simon 1981) that impacts the perception of their environment (Joseph and Gaba 2020). Further, we theorize police investigations as bounded rational and resource-intense routines.

The findings show that the Berlin police prematurely closed their investigations as the result of a dynamic created by the investigation’s resource intensity and the organizational case ecology. As the bounded rational investigations fail to produce conclusive evidence for any actual planning of an attack, the investigators face a mounting burden to justify further investigations due to a high caseload. Eventually, this dynamic incentivizes disambiguating Amri, who is perceived through the organizational structure as a borderline case between political motivated and general crime, as a criminal case. To this end, the investigators make use of a heuristic operationalizing the differentiation of the police and, thereby, compensating for the uncertainty about Amri’s motives. Building upon these results, we formulate four theoretical propositions for future research.

This article offers three contributions. First, we contribute to current research on terrorism prevention by providing an in-depth case study of police terrorism prevention investigations which addresses a vital research gap. Second, we contribute to the sociology of the police by developing a theoretical model accounting for investigative dynamics unfolding between case ecology, bounded rational investigative routines, and differentiation. Third, we contribute to research on lone actor counterterrorism by elucidating the organizational side of preventing lone actor terrorism.

In the first step, we reconstruct the state of research (Section 2) before expounding our theoretical perspective (Section 3). Subsequently, we present our methodical approach (Section 4) and our analysis (Section 5). We then put forward our explanatory model and infer propositions from it (Section 6), before discussing our results (Section 7) and drawing a conclusion (Section 8).

2 Organizational Approaches to Terrorism

Terrorism is a marginal topic in organization studies, although research on (counter-)terrorism—mirroring the border research landscape (Silke 2019b)—gained prominence after 9/11. In the main, organizational research addresses terrorism in terms of organizational resilience, defined as “the ability of an organization to anticipate, respond to, recover from, and learn from adversity” (Hepfer and Lawrence 2022, 8). Following early research (Coutu 2002), Quinn and Worline (2008) prominently demonstrate the relevance of narratives for enabling and organizing resilience using the example of the passengers of Flight 93. Moving from operational to strategic resilience, Gittell et al. (2006) analyze readaptation of airlines after 9/11. In a similar vein, Sullivan-Taylor and Wilson (2009) show how perception of terrorist threats differ across the travel and leisure industry, leading to different modes of adoption. These and comparable works (Hepfer and Lawrence 2022) converge in viewing terrorism as an exogenous shock from the point of view of corporations.

Closely related to the resilience perspective are sensemaking studies. The study conducted by Kent (2019) examined the connection between individuals’ responses to terrorism and their workplace, and how various narratives either provide significance to their work or deprive it of meaning. Sutcliffe and Weick (2008) deviate from this corporate focus by examining the inquiry by the Federal Bureau of Investigation after the 2003 Madrid train attacks. They focus on why the investigators wrongfully arrested a lawyer from Oregon. The authors demonstrate that the investigators failed to adequately make sense of the existing information due to several factors, including stress and pressure to succeed. This study resembles the classic one by Roberta Wohlstetter researching why the US military failed to heed the warning of a pending Japanese attack on Pearl Harbor (1962). More recently, Cornelissen, Mantere, and Vaara (2014) also focus on the police in their account of a failed operation of the British police that led to the death of an innocent person, showing how stress and routines impaired sensemaking and reinforced premises for taking the wrong course of action. In an insightful study not specifically concerned with terrorism, Schakel, van Fenema, and Faraj (2016) analyze police investigations in response to the sudden killing of a suspect. Following the literature on fast-response organizations (Faraj and Xiao 2006), the authors demonstrate how different coordination challenges, including communication technology and team composition, impaired switching between different routines.

While organization studies, with few exceptions, focus on corporations, terrorism research with its strong emphasis on organizations (Crenshaw 2014; Torres-Soriano 2021, 1363–64) mostly concentrates on terrorist organizations. Following Simmel’s work on secret societies (1906), one research path addresses the goal conflicts of terrorist organizations rooted in the requirement to both ensure operational safety and efficiency (Kilberg 2019; Volders 2021). Another approach analyzes the organizational forms of terrorist organizations (Mayntz 2004) and how their structures impact their lethality (Asal and Rethemeyer 2008), for instance, regarding the organizational embeddedness of suicide bombers (Warner, Chapin, and Sorenson 2021). The theoretical link of these studies to organization theory is, with a few outliers (Mayntz 2004; Volders 2021), relatively weak despite some common areas of interest such as clandestine organizations (Grey 2014; Schoeneborn and Scherer 2012).

Despite the prominence of organizations in terrorism research, the literature on preventing terrorism is dominated by policy analyses (see Silke 2019b), concentrating on the effectiveness of specific policy measures (Crenshaw 2014, 559) to prevent the survival of terrorist organizations (Goldman and Bar 2020), such as targeted killings (Price 2012). As the latter implies, these studies focus on a military approach to terrorism (Boyle 2019). Police approaches to terrorism (Clutterbuck 2019), on the other hand, are often considered to suffer from a lack of data, leading to a situation whereby “very little is known about the nature and effectiveness of police counterterrorism responses and strategies” (Lum et al. 2011, 103).

One of the few organization-sensitive approaches to counterterrorism is a study by Bye et al. (2019) who analyze the Norwegian police response to the 2011 terror attacks in Oslo, arguing that a failure to recentralize was pivotal for the failed police response (Bye et al. 2019, 69). More representative of the literature on police and terrorism, Hewitt (2014) evaluates the effectiveness of various police tactics. He argues that “undercover agents and informants” are success factors (2014, 66) enabling the police to prevent acts of terrorism. Along the same lines, Bayley and Weisburd (2011) underscore the significance of the public for terrorism prevention, concluding that general duties police officers may harness a community policing approach for a more active role in terrorism prevention (Bayley and Weisburd 2011, 95–96; Randol 2012). However, the authors also point out the risk of the police losing community trust when engaging in this type of “high policing” (Brodeur 2010).

The literature review reveals that organizational research on terrorism primarily focuses on corporate resilience with only the study by Weick and Sutcliffe examining police investigations but without specifically addressing organizational dynamics. The dearth of studies of terrorism prevention is mirrored by the policy focus of terrorism research. The focal study addresses this research gap by analyzing the terrorism prevention investigations in the run-up to the Berlin Christmas market attack. In the next step, we elaborate on our theoretical perspective.

3 An Organizational Perspective on the Police

Police organizations are highly differentiated orders (Brodeur 2010; Jobard and de Maillard 2016), mostly combining spatial and functional differentiation principles. Spatially, the police are differentiated according to geographical responsibilities. In Germany, this means that besides a federal police agency operating at national level, each state has its own police (Frevel and Groß 2016).

The functional differentiation of the police, with some exceptions regarding cross-sectional tasks such as observations, follows a system of categorizing crime. In this categorical system, criminal acts considered to be terrorism are subsumed under the category of politically motivated crime which is distinguished from other superordinate categories such as general, corporate, and organized crime. Within the category of politically motivated crimes, the German police further distinguishes left-wing, right-wing, and religiously motivated crime. Structurally, these distinctions translate into specialized divisions for each of these categories under the umbrella of the department for politically motivated crimes.

Organizational structures affect how organizations perceive their environment (Joseph and Gaba 2020; Simon 1949). In the case of the police, the system of crime categories and the organizational differentiation resulting from this structure how the organization perceives its environment by demarcating jurisdictions, thereby channeling attention to areas of formal responsibility (see Monjardet 1996). For police investigations, this means that the way a criminal act is categorized is a decisive factor for which department is responsible for the case. If evidence is unearthed that a criminal act is wrongly categorized, for instance, because a background in organized crime is assumed when the act was motivated by an extremist right-wing ideology, case responsibility is transferred to a different department and the corresponding division. This migration of responsibility to specialized investigative departments underscores the bureaucratic nature of the police (Jobard and de Maillard 2016; Monjardet 1996).

The categorical structure of the police is an artificial structure (Simon 1981) within a complex (Luhmann 1995) and highly ambiguous environment (March and Olsen 1976). Consequently, the structure of the police presents a reduction in complexity compared to its environment (Luhmann 1995). The structure does not depict the organization’s environment phenomenologically accurately but serves to organize agency. Therefore, the underlying category system frequently creates borderline cases since it maps clearly delineated organizational jurisdictions onto criminal acts with properties fitting multiple categories. These borderline cases include, for instance, groups categorized as terrorist structures engaging in organized crime (Jamieson 2005) or organized crime actors using terrorist techniques (Puttonen and Romiti 2022).

Having elaborated the organizational structure, we then theorize the investigations themselves. By investigations, we refer to “proactive and suspect-centered” investigations (Brodeur 2010, 200) aimed at preventing future crimes. Investigations of this type are typical of terrorism prevention and in marked contrast to reactive investigations taking place after the commission of a crime. A hallmark of these proactive investigations is that they face fundamental uncertainty regarding the intentions and future actions of an individual suspect. To absorb this uncertainty, the police engage an array of surveillance techniques to determine whether a suspicion is warranted. Only when this is the case can the police take further steps. Consequently, the goal of investigations is not to prevent an attack per se, but, rather, to determine whether a suspicion is warranted.

We consider investigations as organizational routines which we understand to be a “repetitive, recognizable pattern of interdependent actions, involving multiple actors” (Feldman and Pentland 2003, 96). A routine understanding of investigations is helpful because it directs our attention to the concatenation and coordination (Schakel, van Fenema, and Faraj 2016) of patterned actions (Feldman et al. 2021) typical of investigations and interfaced by files due to the bureaucratic nature of the police (Kremser, Pentland, and Brunswicker 2019). This routine understanding emphasizes that police investigations are organizational in character and presuppose the existence of organizations.

Investigative routines are resource intensive and require various organizational assets, including investigators, observation teams, cars, officers evaluating audio and/or video files, or translators, to name just a few. As police organizations possess only limited resources, investigations are consequently impacted by the organizational case ecology which we define as the overall case load a police organization, or a specific unit, has to investigate. This case ecology restricts how many resources a police organization can dedicate to individual investigation routines (see Klinger 1997). Hence, it impacts both the depth and thoroughness of investigations and may eventually lead to the relegation of a case. The only investigations protected from these dynamics are those that are able to substantiate a suspicion and, by doing so, both legitimate and necessitate further resource investments, for example, by finding concrete evidence for the planning of an attack.

A final important characteristic of investigation routines is their bounded rationality (Simon 1979) resulting from investigations usually yielding only incomplete information about the entity under investigation. Making up for incomplete information, investigators, much like beat officers (Newburn 2022, 441), resort to compensatory heuristics, that is, frugal decision rules (see Gigerenzer, Reb, and Luan 2022) to deal with uncertainty. The focal case showcases that these heuristics may operationalize the reductive category system undergirding the organizational structure and are thus a testament to organizational self-reference (Luhmann 1995). Before we illustrate this empirically, we will first present our research design, data, and data analysis.

4 Methodology

Owing to the lack of relevant previous research, we designed our study as a qualitative case study (Yin 2018). Duration and complexity of our subject matter also necessitated such a research design as case studies are particularly well suited to creating an in-depth understanding of complex events (Flyvbjerg 2006). Posing the question why the Berlin police closed its investigations into Amri prematurely (cf. Yin 2018, 27), we delimit our case in three regards: Factually to police investigations, socially to the Berlin police, and temporally to the run-up to the attack (Luhmann 1995).

The investigations conducted by the Berlin police present a “revelatory case” (Yin 2018, 50) for several reasons. First, the case and its subsequent parliamentary examination, which we will address below, present us with a rare opportunity to examine police attempts to prevent terrorism. Second, the case is characterized by an empirical puzzle instructive for theory building, as the Berlin police had information that Amri was planning an attack and still closed its investigations prematurely. Third, the Berlin truck attack is typical of the recent wave of IS-inspired lone actor attacks in Europe and thus promises to provide theoretical clues that can be tested on a wider range of cases.

4.2 Data Analysis

Data analysis comprised a four-step process based upon the Gioia methodology (2021) because of this methodology’s suitability for analyzing revelatory cases (Langley and Abdallah 2011, 109).

Our analysis began with reading through our notes and discussing preliminary ideas. At this stage, we open coded our data to identify first-order categories, arriving at roughly 50 categories for which we could claim empirical saturation (Glaser and Strauss 2006). We worked independently of each other in this step and used contradictions to refine our codes. Additionally, we wrote a case history at this stage to bring our data into chronological order to aid our procedural understanding of the case.

In the next phase of the research process, we grouped our first-order categories into first-order concepts by identifying overarching themes in the material. We identified, inter alia, “politically motivated crime”, “general crime”, “drugs”, ”LKA 54”, and “dangerous persons” (‘Gefährder’) as relevant first-order concepts. To ensure intercoder reliability, we determined coding rules by creating anchor examples. This helped us prevent assigning data to multiple concepts, for instance, by distinguishing between consumption and trafficking for the concepts of “drugs” and “general crime”.

In the next step, we drew on our theoretical perspective to create second-order themes based on our first-order concepts (Strauss and Corbin 1998). To identify analytical themes in our material, we alternated between data and theory. We aggregated the categories “general crime”, “politically motivated crime”, and “drug-related crime” into the theme “organizational structure”, the categories “observation times”, “translations and translators”, and “intercepted conversations” into the theme “bounded rationality”, the categories “dangerous persons”, “IS threat”, and “refugee immigration” into “case ecology”, and “investigation units”, “observation teams and software for intercepting communication”, and “procedures for coordinating police actor” into “investigative routines”.

Since the objective of our study is to explain the outcome of a process, we deviated from the Gioia methodology in the last stage of our research. Instead of distilling our second-order themes further, we traced the dynamic unfolding between them over the course of the investigation. To trace this dynamic, we related our identified themes to each other and thereby distilled two aggregate dimensions. We found that the themes “investigative routine” and “case ecology” were connected through a process of an increasing need for justification, while the themes “bounded rationality”, “case ecology”, and “organizational structure” were linked by a process of heuristic disambiguation. Following this step, we wrote our explanatory model. Figure 1 below shows our data structure:

Figure 1:

Data structure.

To add validity to our conclusions, each researcher developed an explanation individually for our research question. We used differences between our models to refine our explanatory model until it came to the point where it accommodated both perspectives. Although we could not contrast our model with alternative explanations due to a lack of research on the subject to date, we compared it to prevalent understandings of terrorism prevention and results from neighboring disciplines (see the discussion section). Finally, we sought feedback from high-ranking and long-serving police officers whom we had previously encountered during other research projects to review and critically evaluate our results (Yin 2018). This provided further clarification for our explanatory model.

5 Results

In this section, we present the results of our analysis. We integrate both empirical reconstruction and theoretical reflection in this presentation.

6 Organizational Dynamics of Terrorism Prevention

Terrorism prevention is a fundamentally organized phenomenon in modern societies; however, organizational analysis of the subject is rare. The investigations leading up to the Berlin Christmas market attack provide fertile ground for such an analytical endeavor. In what follows, we present our explanatory model.

The Berlin police investigated Amri amidst a high caseload caused by the coinciding of the refugee movement in 2014 with IS threatening terror attacks in Europe. As Amri was considered a potential terrorist, LKA 54 had invasive investigative means at its disposal, rendering the investigation resource intensive. The resource intensity of the investigation, coupled with the high number of cases, set in motion a dynamic in which the advancing investigations increased the need to justify their continuation unless evidence for Amri’s intensions was found. This dynamic was rooted in the organization itself and effectively functioned as a stopping rule because it created incentives to end the investigations and thereby to free up resources.

Despite their resource intensity, the investigative routines only generated selective information about Amri’s behavior due to their bounded rationality. Consequently, they did not absorb the uncertainty about his goals. Amri’s drug-related crimes added to the resulting uncertainty, as the investigators perceived them through the lens of the organizational differentiation between general and politically motivated crime. Thus, Amri became a borderline case to whom both categories might possibly apply. In the face of the inconclusive yet resource-heavy investigations, the investigators’ tolerance for Amri’s ambiguity decreased, while their willingness to disambiguate the case increased. This dynamic culminated in the investigators harnessing a heuristic operationalizing the organizational structure to neutralize their uncertainty about how to evaluate the case. This compensatory heuristic (Gigerenzer, Reb, and Luan 2022) assumed that planning a religiously motivated attack and drug-related criminal activities preclude each other. Its use was the result of increasing pressure to justify further resource investments the investigators were unable to offset with evidence of the planning of an attack. Hence, the heuristic disambiguation of Amri was not motivated by phenomenological considerations but was an expression of organizational self-reference (Luhmann 1995).

Case study results are generalizable to other cases if they can theorize their results to transferable propositions (Yin 2018). Our results allow us to formulate three such propositions.

Our first and most general proposition is that investigative routines to prevent terrorism generate a unique organizational dynamic, producing increasing burdens of justification due to their resource intensity. This dynamic is only stopped when concrete evidence for the planning of an attack is found, incentivizing closing the investigations when such evidence is lacking.

Our second proposition takes inspiration from Herbert Simon’s scissor analogy (1990) which posits that behavior “is shaped by a scissors whose two blades are the structure of task environments and the computational capabilities of the actor” (Simon 1990, 7). For our case, Simon’s scissor analogy is a reminder that to explain organizational actions, we have to account for both system and task environment. We take up this advice by questioning whether the organizational dynamic observed in our case is specific to a certain task environment, lone actors, or also applies to terrorist groups and organizations. We argue that this dynamic is particularly prevalent in the case of lone actors. While terrorist groups and organizations must make trade-offs between secrecy and operational security (Volders 2021), lone actors generate less opportunities for the police to find evidence corroborating concrete planning as they usually prepare their attacks in more seclusion (Lindekilde, Malthaner, and O’Connor 2019). As we argue below, the tendency of lone actors to leak their plans exacerbates the problem and creates another challenge. Furthermore, as police perception is structured by organizational differentiation and lone actors tend to engage in nonpolitical crimes (Kenyon, Baker-Beall, and Binder 2021), we assume that police typically perceive them as borderline cases. With this in mind, we hypothesize that under conditions of resource scarcity and lack of evidence, this further incentivizes stopping investigations.

Our third proposition derives from the observation that lone actors, like Amri, often show a time lag between announcing and committing an attack, while, unlike Amri, most individuals proclaiming plans for a terrorist attack never follow through. This leads us to suggest that police organizations face an exploration dilemma (March 1991) when investigating potential lone actors. By exploration dilemma, we refer to the dilemma in exploring new ideas that “what is good in the long run is not always good in the short run” (March 1991, 73). For that reason, organizations are structurally inclined to discard promising ideas too early. Similarly, as investigations into both individuals actually committing attacks and those just proclaiming intentions to do so will often initially produce negative feedback, police organizations are vulnerable to the identified dynamic incentivizing closing investigations too early. We further suggest that the longer the period between the announcement of an attack and its perpetration, the more probable it becomes that organizational self-reference (Luhmann 1995) in the gestalt of case-ecology driven resource pressure encourages stopping investigations in favor of other cases.

7 Discussion

This article aims to analyze organizational dynamics in terrorism prevention and presents the inner workings of police organizations as a crucial analytical level for understanding terrorism prevention. The results of our study enable us to make several contributions to the existing literature.

Our first contribution is to the sociology of the police. Heeding the call for more organizational analyses of terrorism (James 2011), we add to this literature by presenting an in-depth study of terrorism prevention investigations. By examining investigations from the perspective of organizational sociology, we provide a new angle to a literature mainly concerned with how stable factors such as the characteristics of a crime impact its clearance (Brodeur 2010) by demonstrating how organizational dynamics bear upon investigations.

Our second contribution is to have outlined a theoretical model accounting for the dynamics of police investigations, emphasizing interactions between case ecology, organizational structure, and bounded rational investigative routines as relevant factors. Thereby, we underscore the formal organization as a crucial level (see Du Gay 2020) for research on terrorism prevention. This line of reasoning challenges the common understanding that terrorism prevention primarily depends on legal restrictions and budgetary decisions. Regarding the former, we have shown that the investigations did not suffer from restrictions as the police had comprehensive legal means at their disposal. Regarding the latter, we argue that while more resources probably would have slowed down the process leading to closing the investigations, the general dynamic would have occurred anyway as police organizations are always systems with bounded resources. Further, as our analysis indicates, fully comprehensive investigations require resources to a degree unrealistic to ever be accorded to the police in democratic societies.

Our third contribution pertains to research on lone actors. The literature shows that lone actors care only a little for their operational safety, are known to divulge their intentions “months or even years ahead of the attack” (Schuurman et al. 2019, 772), remain in contact with radical milieus (Hewitt 2014; Schuurman et al. 2019), and often engage in criminal activity (Kenyon, Baker-Beall, and Binder 2021, 7). Reasonably, all of these factors are theorized to make them vulnerable to police detection and thus to prevention efforts (Kenyon, Baker-Beall, and Binder 2021, 20). Our findings add a vital organizational perspective to this theorizing by showing that even if these factors are present, which was the case for Amri, organizationally, lone actors may still present an ill-structured problem (Simon 1973) at the margins of reliability (Perrow 1984) because of the organizational dynamics identified above.

Some authors argue that the recent development of elaborate threat assessment tools has the potential to prevent lone actor attacks (Kenyon, Baker-Beall, and Binder 2021). Our perspective adds to this discussion as it allows us point out that the “large numbers of false positives” (Clemmow et al. 2022, 573) these tools produce, translate into a higher caseload, risking abetting the dynamic observed in the investigations against Amri. More pointedly, with regard to our case, detecting Amri’s intentions was not the issue for the police but, rather, it was deciding how to weigh his announcements against similar cases with no concrete evidence, an increasing need for justifications, and bounded resources. To put it succinctly, threat assessment is organizationally embedded and thus requires attention to be paid to organizations.

8 Conclusions

It is a cliché that not all terrorist attacks can be prevented. Yet, rarely do studies elaborate on the reasons why attacks are not prevented. The present study addressed this gap.

Our analysis yielded three theoretical propositions. We theorized that the organizational dynamics this case study has revealed also characterize other investigations. Further, we suggested that the dynamics prevalent in our case are particular to lone actors and proposed that investigations into lone actors are characterized by an exploration dilemma. Future research should test these arguments with other cases to broaden the empirical basis of organizational perspectives of terrorism prevention.

We remind readers that our study is not without limitations. Its main limitation is that we analyzed our case through the filter of data collected by an inquiry commission. While we are confident that our reasoning is thorough as it is based on robust and empirically saturated categories, we cannot preclude the possibility that the data at our disposal do not contain some relevant aspects due to classification or political bias. Nor can we exclude the possibility that the inquiry commission ignored data relevant for organizational research but unknown to us. On balance, despite our efforts to validate our data via multiple sources and field informants, we must acknowledge that we lacked control of the data collection process.

In conclusion, this study explained the dynamics underlying the premature closing of investigations into an individual threatening to perpetrate a terror attack. We reveal how investigative routines generate a self-referential temporal horizon of increasing urgency to either find corroborating evidence or free resources while we also indicated that this self-referential temporal horizon is decoupled from the attacker’s contingent timeline, which is most likely influenced by environmental opportunities (Marchment and Gill 2019). We hope our organizational perspective on terrorism prevention inspires further studies on the subject in the future.