Terrorist Attacks Escalate in Frequency and Fatalities Preceding Highly Lethal Attacks

Highly lethal terrorist attacks, which we define as those killing 21 or more people, account for 50% of the total number of people killed in all terrorist attacks combined, yet comprise only 3.5% of terrorist attacks. Given the disproportionate influence of these incidents, uncovering systematic patterns in attacks that precede and anticipate these highly lethal attacks may be of value for understanding attacks that exact a heavy toll on life. Here we examined whether the activity of terrorist groups escalates–both in the number of people killed per attack and in the frequency of attacks–leading up to highly lethal attacks. Analyses of terrorist attacks drawn from a state-of-the-art international terrorism database (The Global Terrorism Database) showed evidence for both types of escalation leading up to highly lethal attacks, though complexities to the patterns emerged as well. These patterns of escalation do not emerge among terrorist groups that never commit a highly lethal attack.


Introduction
Using a large state-of-the-art international terrorism database, this research examined whether terrorist incidents that kill a particularly large number of people are preceded by escalation in either the number of people killed per attack or the frequency of attacks. Attacks that result in a large loss of life are especially important to understand. The vast majority of attacks kill one person or no one at all. Yet a small number of more deadly attacks kill many more times the mean number of fatalities per attack (a distribution that can be described with a power law [1]). Further, examining the distribution of fatalities per attack in a comprehensive international terrorism database-the Global Terrorism Database [2]-the number of fatalities in the most deadly 1% of attacks (69,156 fatalities) accounts for 32% of the total number of fatalities recorded in the database (219,078). Thus, a small number of particularly deadly attacks accounts for a disproportionate number of the total fatalities resulting from terrorist attacks.
Considering this distribution, an efficient approach to researching the cost to human life that terrorism exacts may be to treat big attacks-''big'' with respect to the number of resulting fatalities-as qualitatively different and to gather information about when these particular attacks tend to occur. Different criteria for the size or importance of a terrorist attack may be considered (e.g., media coverage, financial costs). But certainly a good argument can be made-especially from the perspective of those killed by an attackthat an attack's most important characteristic is the number of resulting deaths. Here we take this perspective and use the term ''big attack'' to describe an attack that kills large numbers of people. Recent research [3][4] has begun to examine the timing of big attacks by assessing whether, over the course of a terrorist group's lifespan, the fatalities that result from attacks tend to increase or decrease with each subsequent attack. This work suggests that the number of fatalities per attack does not systematically vary with the number of previous attacks by a group. In other words, the likelihood of a big attack cannot be predicted simply by the number of previous attacks committed by a group.
Given this extant research [3][4], which implies big attacks are somewhat randomly scattered across a group's lifespan, we developed a different analytic strategy for examining their timing. Though big attacks may occur in a relatively random fashion, it may be that small-scale attacks that precede these big attacks occur more systematically. To examine this, we did not examine big attacks themselves, but tested for patterns of escalation in the subset of small-scale attacks that a group commits prior to and leading up to big attacks. In other words, we conducted a series of analyses to describe the attack-trajectories that precede big attacks. Perhaps signals indicative of an escalating trajectory emerge in this series of smaller attacks that precede big attacks.
There are a number of reasons to suspect escalation prior to a big attack. Various lines of psychological research suggest that violence, and perhaps killing in particular, can escalate under certain conditions [5][6][7][8][9]. Killing may trigger justification processes, desensitize people, or produce material and/or psychological rewards that increase the likelihood of further killing. It may also be that with experience, group members become more adept at carrying out severe and deadly attacks. A growing ability to carry out deadly attacks may increase the likelihood that the subsequent attack will be even more lethal.
If escalation occurs, it may occur with the number of fatalities per attack and/or may emerge with the frequency of attacks.
Further, escalation may occur in a linear or curvilinear fashion (i.e., the slope of escalation may increase as groups approach a big attack). Given these basic possibilities, in progressions of smallscale attacks that lead up to big attacks we tested for the presence of linear and curvilinear escalation in the number of fatalities per attack and the frequency of attacks in a series of Multilevel Random Coefficient Models and Beta Distribution Models.

Database
We tested for these escalation patterns using the Global Terrorism Database (GTD [2]) produced by the National Consortium for the Study of Terrorism and Responses to Terrorism (accessed on June 13, 2013). The GTD includes broad categories of data for terrorist incidents from 1970 through 2011 (but excluding 1993). The GTD has been developed by merging large existing databases with additional data collection and corroboration directed by the National Consortium for the Study of Terrorism. The data have been gathered from credible U.S. and international online and print news sources. The criteria used for whether to include an event in the database are relatively inclusive. It must be an ''intentional act of violence or threat of violence by a non-state actor (i.e., sub-national or non-national).'' In addition, it must meet two of the following three criteria: (1) The act was aimed at attaining a political, economic, religious, or social goal; (2) the act included evidence of an intention to coerce, intimidate, or convey a message to a larger audience (or audiences) other than the immediate victims; (3) the act was outside the context of legitimate warfare activities (e.g., the act deliberately targeted civilians or non-combatants). Further information about the GTD's development and contents can be found at http:// www.start.umd.edu/gtd/downloads/Codebook.pdf.

Data Preparation: Linear and Quadratic Modeling
For our analyses we required that the group responsible for the attack be known. Thus, we omitted attacks for which the group name was listed as ''unknown'' in the database. In addition, we omitted incidents that the database coded with obvious catch-all labels that do not represent actual organizations (e.g., group labels of ''Other,'' ''Extremists,'' ''Terrorists,'' and ''Guerillas''). For analysis, we also required that the date be known (year, month, and day) and that the number of victim fatalities be known. The database does not report how many victims were killed in each attack but it does report the total number of fatalities per attack, and the number of terrorist members killed in the attack. Thus we computed the number of victim fatalities by subtracting the number of terrorist members killed from the total number of fatalities in each attack.
We examined escalation in the progression of small-scale attacks leading up to big attacks. These within-group progressions frequently consist of multiple attacks on the same day. However, the database does not provide information about the chronology of attacks within days. Given the absence of information about within-day timing of attacks, we merged attacks that each group committed on the same day. For example, if a group committed four attacks on one day that killed 1, 0, 3, and 7 people, we recoded these four events as a single event that killed 11 people. In sum, we recoded and now refer to multiple attacks committed by the same group on one day as one attack. A drawback of this approach is that our measure of fatalities per attack can be influenced by the frequency of attacks on the same day. Keeping this in mind-that the distinction between frequency of attacks and fatalities per attack is not necessarily clear cut-we nevertheless felt that without within-day temporal resolution, merging same-day attacks was the most sensible way to deal with these data. Merging same-day attacks (for which the database can provide the date, group, and victims killed) left 37,092 attacks for analyses.
Next, to examine escalation along the progression of small-scale attacks leading up to big attacks, we operationally defined a ''big attack.'' To do so, we rank ordered the 37,092 attacks in our new dataset by their number of fatalities and then plotted this sequence of attacks against the cumulative percentage of all fatalities in the dataset. In other words, the most deadly attack (2,977 victim fatalities) accounts for 2.0% of the total fatalities from attacks combined in our refined dataset (148,569), the top two most deadly attacks (4,157) account for 2.8% of all fatalities combined, and so on. Figure 1 shows this relationship (along with a standard empirical cumulative distribution function).
We defined a ''big attack'' by determining the threshold above which attacks cumulatively account for 50% of all fatalities. As can be seen in Figure 1, attacks that kill 21 or more people account for 50% of the total number of fatalities. These attacks comprise just 3.5% of the 37,092 attacks. Thus, this fits our conceptualization of big attacks: a small group of attacks that accounts for a disproportionate number of deaths. The average number of fatalities resulting from a big attack is 52.40 people (SD = 94.80, range = 21-2,977). We later examine alternative thresholds as well.
After defining a big attack, we selected only incidents committed by groups that are included in an official group list on the GTD website (http://www.start.umd.edu/gtd/search/BrowseBy. aspx?category = perpetrator, accessed June 13, 2013). Then, within each terrorist group we found all sets of three or more small-scale incidents (killing fewer than 21 people) that occurred in succession in between big attacks. We term each of these sets of consecutive small-scale incidents a ''lead-up progression.'' (Given that the GTD had no information for 1993, we did not allow leadup progressions to span 1993.) As an example, imagine that a hypothetical terrorist group commits 17 attacks: first they commit five small attacks, then a big attack, then ten small attacks, then a big attack, then twelve small attacks, and then a big attack. This group would include two lead-up progressions, the first consisting of ten attacks and the second consisting of twelve attacks. Of the 2,849 groups in our dataset, 68 groups contained at least one leadup progression. The remainder contained no lead-up progressions either because the group did not commit a big attack or because a series of three or more consecutive small attacks did not fall between big attacks committed by the group. These 68 groups were as follows: Abu Nidal Organization (ANO), Abu Sayyaf  Figure 2.
Within each lead-up progression, we rank ordered each incident in ascending temporal order, starting with 0 (i.e., 0 = the first incident in the progression, 1 = the second incident, 2 = the third incident, etc.). However, because lead-up progressions varied substantially in the number of incidents they contained, we scaled the rank-ordered incidents within each lead-up so that 0 always represented the first attack in the lead-up and 1 always represented the last attack in the lead-up (i.e., the attack just prior to big attack). This was accomplished by dividing the rank-ordered number by the total number of incidents in that lead-up progression. This scaling allowed us to equate the first and final attacks in all lead-up progression regardless of how many attacks they contained. For example, the scaling equates incident 30 in a 30-incident lead-up progression with incident 5 in a 5-incident lead-up progression (they are both coded as ''1''). Our models therefore rescale time of events leading up to large attacks and only preserve their relative ordering by a uniform position of the unit interval. Thus, we were able to examine escalation in fatalities and For example, attacks killing 49 or more people account for 30% of fatalities from all terrorist attacks combined. Attacks killing 21 or more people account for 50% of all fatalities. We also plot the empirical cumulative distribution function. This shows, for example, that nearly 50% of all terrorist attacks results in zero fatalities, and approximately 67% result in 0 or 1 fatalities. Only 3.5% of attacks results in 21 or more fatalities (i.e., 96.5% of attacks result in fewer than 21 fatalities). doi:10.1371/journal.pone.0093732.g001 Escalation Precedes Highly Lethal Terror Attacks PLOS ONE | www.plosone.org attack-frequency from groups' first to final attack in lead-up progressions, no matter the number of attacks in each progression. We accomplished this by examining the relationships between these scaled ranking and fatalities and between the scaled ranking and time between attacks. Further, we examined curvilinear (quadratic) escalation by squaring the scaled rankings before examining the relationships with fatalities and with time between attacks.

Escalation: Fatalities per Attack
Basic analysis. First we tested for linear and curvilinear escalation in the number of fatalities per attack over the course of lead-up progressions (i.e., a series of three or more consecutive small-scale attacks that fall between big attacks). We constructed a Multilevel Random Coefficient Model (MRCM) with data from terrorist attacks (Level 1, n = 10,285) nested within lead-up progressions (Level 2, n = 549), nested within terrorist groups (Level 3, n = 68). This modeled each set of attacks in the lead-up to a big attack as its own distinct sequence, controlling for attacks made by the same group. We modeled all effects as random, which allowed parameters to vary across Levels 2 and 3 (i.e., across leadup progressions and terrorist groups). Including these random effects allows for modeling the slopes and intercepts while recognizing that they may differ across different lead-up progressions and groups. These differences are weighted by their reliability when estimating the average effect (for an in-depth explication of MRCM, see Raudenbush and Bryk's Hierarchical linear models [10]).
Our MRCM was specified as follows: Victims Killed~b 00 zb 10 scaled progression ð Þ zb 20 scaled progression 2 À Á zr 0 zr 1 zr 2 zu 0 zu 1 zu 2 ze: In Equation 1, the number of victims killed was modeled as a function of an intercept (b 00 ) which represented the mean number killed during the first incident in a scaled progression (i.e., scaled from 0 to 1), a slope representing the linear scaled progression in victims killed (b 10 ), and a slope representing the quadratic change in victims killed over the scaled lead-up progression (b 20 ). The terms r 0 , r 1 , and r 2 represent the intercept, linear, and quadratic slopes at Level 2. The terms u 0 , u 1 , and u 2 represent the intercept, linear, and quadratic slope at Level 3. Linear and quadratic progressions were uncentered.
The linear slope over the course of the scaled progression was significant and negative in direction (b 10 = 21.37, SE = 0.60, t = 22.28, p = .03; we used p = .05 as our threshold for statistical significance in these MRCM analyses). This indicates that, adjusting for the quadratic progression of change, there was a linear decrease in the number of people killed in each sequential attack in the lead-up to big attacks. However, the linear slope should not be interpreted in isolation from the quadratic effect. The quadratic slope indicated significant positively accelerating growth in the numbers killed in sequential attacks preceding big attacks (b 20 = 1.34, SE = 0.61, t = 2.19, p = .02). We graphed the raw data in a box plot in Figure 3. Then we graphed the equation comprised of the linear and quadratic functions in Panel A of Figure 4. The dotted lines represent 95% pointwise confidence bands. Our model indicates that the number of victims killed follows a pattern in which there is a slight initial sequential decrease in the number killed. The predicted number of people killed then begins to increase with each small-scale attack prior to a big attack. This function is specified in Equation 2.
The random effects for the linear and quadratic slopes at Level 2 were both significant, indicating that while these slopes provided the best fitting average trajectory, there was also variation in the progression of people killed in attacks across different lead-up progressions (x 2 (481) = 717.04, p,.001; and x 2 (481) = 709.15, p, .001, respectively). The random effects for the linear and quadratic slopes at Level 3 were not significant (x 2 (67) = 68.74, p = .42; and x 2 (67) = 63.16, p..50, respectively). This suggests that there were no reliable differences in the linear and quadratic rate of progression for different groups when also accounting for variation attributable to differences across lead-up progressions. However, had we been able to access data from a larger number of terrorist groups, we may well have been able to detect more subtle differences in progression rates between groups. Further, these Level 3 effects were obtained while statistically accounting for significant differences between progressions. We also constructed the MRCM again with a threshold of 21 but excluded outliers-those events with fatalities that exceeded the mean by three or more standard deviations (i.e., greater than 16 fatalities). This model included examined 10,030 terrorist attacks (Level 1) nested within 549 lead-up progressions (Level 2), nested within 68 terrorist groups (Level 3). Essentially mirroring the results when the outliers were included, the linear slope for scaled progression was significant and negative in direction (b 10 = 21.22, SE = 0.43, t = 22.83, p,.01) while the quadratic slope indicated significant positively accelerating growth in the numbers killed in sequential attacks preceding a big attack (b 20 = 1.27, SE = 0.43, t = 2.95, p,.01).
Escalation analysis using alternative definitions of a big attack. The threshold for a big attack was set at 21 fatalities because at this threshold big attacks account for 50% of all fatalities. However, we repeated the above MRCM analysis four more times but adopting different thresholds that account for 30%, 40%, 60%, and 70% of all fatalities. The thresholds that corresponded to these percentages were 9, 14, 31, and 49 fatalities. Panel B of Figure 4 plots the functions for these alternative leadups derived using these thresholds. As can be seen, similar patterns emerge in lead-ups to big attacks whether big attacks are defined more conservatively or more liberally.
The Escalation analysis using non-scaled lead-up progression. Thus far we have examined escalation over the course of scaled lead-up progressions (progressions placed uniformly on a scale from 0 to 1). This allowed us to examine escalation from a group's first attack to final attack in a lead-up progression, no matter the number of attacks in the progression. The approach we have adopted and the results from these analyses do not indicate the actual number of incidents over which escalation tends to occur. As a consequence, we analyzed the relationship between fatalities and the non-scaled group of incidents leading up to big attacks. To do this we rank-ordered attacks in lead-up progressions in reverse chronological order. We labeled the final attack in a progression (just prior to a big attack) as 0, the attack just prior to this attack as 1, the attack just prior to that attack as 2, etc. Further, we only included attacks from the lead-up progressions if they were within 20 attacks of the big attack.
The MRCM consisted of data from 6,193 terrorist attacks (Level 1) nested within 549 lead-up progressions (Level 2), nested within 68 terrorist groups (Level 3). The linear slope was significant and negative in direction (b 10 = 20.14, SE = 0.04, t = 23.15, p,.01). The quadratic slope was significant and positive (b 20 = 0.01, SE = 0.002, t = 2.66, p = 0.01). As can be seen in Panel C of Figure 4, this model indicated that fatalities tended to begin escalating only once groups were within approximately 11 incidents of a big attack. The random effects for the linear and quadratic slopes at Level 2 were both significant (x 2 (481) = 601.00, p,.001; and x 2 (481) = 597.07, p,.001, respectively); the random effects for the linear and quadratic slopes at Level 3 were not significant (x 2 (67) = 71.09, p = .34; and x 2 (67) = 77.91, p = .17, respectively).
Terrorist groups that do not commit a big attack. The above analyses depict the progression of fatalities leading up to big attacks. However, many groups never commit a big attack and thus their entire series of attacks does not lead up to a big attack. We tested for linear and curvilinear escalation in fatalities among these groups to ascertain whether the pattern that emerges above for progressions leading up to a big attack holds among progressions that do not lead up to a big attack. To do so we scaled the entire series of incidents of each group that never committed a big attack from 0 (their first incident) to 1 (their final incident reported in the database). Only groups with three or more attacks were included in the analysis. Then we constructed a twolevel random coefficient model with terrorist attacks (Level 1, n = 6,904) nested within terrorist groups (Level 2, n = 291). The model did not hold. The linear and quadratic progressions were both non-significant (b 10 = 0.017, SE = 0.37, t = 0.05, p = .960; and b 20 = 20.002, SE = 0.39, t = 20.01, p = .995, respectively). Thus we observed no escalation among groups that do not commit a big attack. In Panel D of Figure 4 we graphed this function and for comparison again graphed the function resulting from progressions that lead up to big attacks from Panel A of Figure 4.

Escalation: Frequency of Attacks
Basic analysis. In addition to examining escalation in fatalities over the course of scaled lead-up progressions, we examined linear and curvilinear escalation in the frequency of attacks over the course of lead-up progressions. We constructed a 3-level MRCM just as before except used the log transformed number of days until the next attack as the dependent measure (we used log 10 ). The linear slope for scaled lead-up progression was significant and negative in direction (b 10 = 20.23, SE = 0.08, t = 22.77, p,.01). This indicates that there was a linear decrease in the log number of days between each sequential attack in the leadup to a big attack. The quadratic slope indicated positively accelerating growth in the log number of days between attacks in sequential attacks preceding a big attack (b 20 = 0.19, SE = 0.09, t = 2.20, p = .03). We graphed the raw data using a box plot in Figure 5 and then graphed the equation comprised of the linear and quadratic functions together in Panel A of Figure 6. As can be seen, there is a sequential decrease in the days until the next attack over the first half of the number of events in the average lead-up progression, but an increase in days until the next attack over the second half of the events in the average lead-up progression. This function is specified in Equation 3:   Figure 6, is roughly consistent with the overall results presented up to this point. It suggests that the number of days between attacks increases among the last attacks in a lead-up progression. Terrorist groups that do not commit a big attack. As with number of fatalities, we tested for linear and curvilinear escalation in frequency of attacks among groups that never commit a big attack. We constructed a two-level random coefficient model with 6,904 terrorist attacks (Level 1) nested within 291 terrorist groups (Level 2). The linear progression emerged as significant (b 10 = 20.86, SE = 0.17, t = 24.95, p,.001) as did the quadratic progression (b 20 = 1.01, SE = 0.17, t = 5.88, p, .001). We plot this function in Panel D of Figure 6 next to the function for escalation in frequency leading up to big attacks for comparison. Attacks that do not lead up to a big attack show initial decrease in the number of days between attacks followed by particularly severe increase in the number of days between attacks, as compared to the number of days between attacks observed among attacks that are leading up to a big attack. When comparing these two types of groups, however, we should keep in mind that the graphed progression of groups that never commit a big attack spans the entire life cycle of these groups. Thus this increase in number of days between attacks toward the end of the progression may represent a disbanding or disintegration of the group and the dynamics of these groups during periods in which they are more fully functioning may look different.

Data Preparation: Beta Distribution Models
To supplement the above analyses, we conducted a second set of analyses using a similar overall approach but with a different modeling tool: a beta distribution. Using a beta distribution we were able to model when in time attacks tend to occur over the course of a progression, relative to the overall duration of the progression. In contrast, the above MRCM analyses could not consider the time of an attack within the progression beyond where it fell in the rank-ordering of attacks. A beta distribution also allowed us to estimate both a de-escalatory parameter immediately following big attacks as well as an escalatory parameter leading up to big attacks. We examined these parameters among small-scale sequences of attacks that occur between big attacks. In addition, after conducting a global analysis across groups, we examined beta distributions separately for each group involved in the global analysis in order to provide a rough indication of each group's de-escalatory and escalatory components.
To conduct these analyses, we selected all sequences of three or more small-scale attacks (i.e., attacks with 20 or fewer fatalities) that fell between two big attacks (of 21 or more fatalities). Also, given that we were examining individual group patterns in addition to global/average patterns, we analyzed groups with only a reasonably large number of attacks with which to estimate beta distribution parameters. Specifically, we selected only groups with at least 30 small attacks that fell between big attacks (this might consist of more than one progression). Lead-up progressions consisted of an average of 20.6 attacks (SD = 28.2; range = 3-303).
As in the above set of MCRM models, we scaled the incidents that make up each progression-we put each progression on the same scale from 0 to 1-in order to pool the data from each progression. We then used a beta distribution to model the density of attacks and fatalities per attack over the course of these progressions. However, we were able to preserve more informa- tion about the timing of attacks than in the above MRCM analyses in which we simply rank-ordered the attacks. Instead of rankordering, we scaled the timing of attack according to their position in their progressions relative to the overall length of their progression. Specifically, for each attack we divided the number of days since the most recent big attack by the entire length of the progression (the number of days between the two big attacks flanking the progression). Using a beta distribution we were then able to examine de-escalation and escalation in (1) the frequency of attacks by examining the density of attacks at different points over inter-big-attack progressions and in (2) fatalities by examining the density of fatalities at these different points.

Escalation: Frequency of Attacks and Fatalities per Attack
Basic analyses. First we tested for de-escalation in attackfrequency following big attacks and escalation of attack-frequency approaching big attacks. We estimated a Beta Distribution Model with 10,261 attacks, 474 inter-big-attack sequences, and 42 different groups. This analysis modeled all attacks in between big attacks according to the probability density function given by the beta distribution. The probability density function for the beta distribution (up to the normalizing constant) is as follows: x a-1 (1x) b-1 . This analysis produces maximum likelihood estimates of the alpha and beta parameters. An alpha parameter estimate below 1 along with a 99% confidence interval that does not include 1 suggests initial de-escalation following a big attack (and an alpha parameter above 1 suggests initial escalation). A beta parameter estimate below 1 along with a 99% confidence interval that does not include 1 suggests escalation towards the end of a progression just prior to a big attack (a beta parameter above 1 suggests deescalation approaching a big attack).
The results for data pooled across all groups showed estimates of alpha = .949, 99% CI [.916, .983], and beta = .910, 99% CI [.878, .943]. The upper boundary of the alpha CI is less than 1, which suggests a de-escalation of attack-frequency immediately following  (9,14,21,31, and 49 or more fatalities). The x-axis value of 0 represents the first incident; 1 represents the incident just prior to a big attack.
[C] Days until next attack by non-scaled lead-up progression. The x-axis value of 19 represents 20 attacks prior to the next big attack; 0 represents the incident just prior to the next big attack. The dotted lines give the 95% pointwise confidence bands.
[D] Days until next attack by scaled progression of attacks among groups that never commit a big attack (in grey). The x-axis value of 0 represents a group's first incident; 1 represents a group's final incident. For comparison, we also plot (in black) the days until the next attack in lead-up progressions shown in Panel A. The dotted lines give the 95% pointwise confidence bands. doi:10.1371/journal.pone.0093732.g006 a big attack. The upper boundary of the beta CI is also less than 1, which suggests an escalation in attack-frequency as groups approach a big attack. In other words, we rejected the null hypothesis that alpha $1 and beta $1 at the 1% significance level. This pattern is depicted in Panel A of Figure 6. We also present group-specific estimates of the alpha and beta parameters in   Beta distribution parameters for inter-big-attack sequences by individual terrorist group. Groups are rank-ordered according to their beta coefficient that represents the escalation in frequency of attacks prior to a big attack (defined as attacks resulting in 21 or more fatalities). The beta for fatalities represents the escalation in fatalities per attack prior to a big attack. The alphas represent de-escalation in frequency and fatalities following a big attack. doi:10.1371/journal.pone.0093732.t001 Table 1. These 42 groups are ranked by their beta (i.e., escalatory) parameter.
Next we utilized the beta distribution model to examine fatalities per attack following big attacks and as groups approach big attacks. We accomplished this by modelling an event for each fatality at approximately the time point that the attack occurred (up to the day). Thus as with the above analysis, for an attack with 0 fatalities we modeled 1 event, but for an attack with 1 fatality we modeled 2 events, for an attack with 2 fatalities we modeled 3 events, and so on. At most, one event can occur at any one point on the unit interval under the continuous Beta Distribution. Due to our coarse time measurement scale we can only observe these events up to units of days (our results are robust to uniformly distributing multiple events on the same day to a 24-hour window and subsequently rescaling to the unit interval).
The results showed alpha = .926, 99% CI [.910, .943], and beta = .906, 99% CI [.890, .922]. The upper boundaries of the alpha and beta CIs are less than 1 (rejecting the null hypothesis that alpha $1 and beta $1 at the 1% significance level). This suggests a de-escalation of fatalities-per-attack immediately following a big attack and escalation of fatalities-per-attack as groups approach a big attack. This pattern is depicted in Figure 7, Panel B. Estimates of alpha and beta parameters for each group are presented in Table 1.
We also examined our statistical power for this fatalities analysis and for the frequency analysis by simulating the 10,261 data points repeatedly 10,000 times from the maximum likelihood estimates of alpha and beta parameters. We then used this simulated data to attempt a rejection of the null hypothesis that alpha and beta are , = 1.0 (the null states that the density distribution is not Ushaped). At the 1% significance level the tests are high in power: 92.66% and 99.96% for the beta distribution analyses of frequency and fatalities, respectively.
Terrorist groups that do not commit a big attack. As with our original set of MRCM analyses, we examined the Beta Distribution Model among groups that never commit a big attack and thus whose progressions of attacks do not lead up to a big attack. This model contained 6,160 attacks and 64 different groups. First we examined the frequency of attacks. The results showed alpha = .931, 99% CI [.892, .972], and beta = 1.240, 99% CI [1.194, 1.289]. The upper boundary of the alpha CI is less than 1, which suggests a de-escalation of attacks immediately following the first attack. The lower boundary of the beta CI is greater than 1, which suggests a further de-escalation of attacks as groups approach their last attack. The escalatory component present in progressions leading up to big attacks is thus absent in these groups who are not leading up to a big attack. This pattern is depicted in Figure 7, Panel C.
Next we examined the number of fatalities per attack with the Beta Distribution Model among the groups that never commit a big attack. The results showed alpha = .897, 99% CI [.868, .927], and beta = 1.183, 99% CI [1.151, 1.215]. The upper boundary of the alpha CI is less than 1, which suggests a de-escalation of fatalities-per-attack immediately following their first attack. The lower boundary of the beta CI is greater than 1, which suggests a further de-escalation of fatalities-per-attack as groups approach their last attack. Thus the escalatory component present in progressions leading up to big attacks is absent in these groups who are not leading up to a big attack. This pattern is depicted in Figure 7, Panel D.
Escalation analysis using alternative definitions of a big attack. As with the MRCM analyses, we examined the Beta Distribution Model again using the alternative thresholds of 49, 31, 14, and 9. First we examined frequency of attacks using these alternative thresholds. The patterns for each threshold can be seen in Panel A of Figure 8. As the threshold increases, the models show stronger escalatory patterns in frequency of attacks leading up to big attacks (and weaker patterns of de-escalation in frequency of attacks following big attacks). Specifically, using a threshold of 49

Discussion
In the series of incidents between big attacks (big attacks were defined as attacks with 21 or more victims killed), the lethality of a group's attacks tended to first decrease following a big attack and then increase prior to a big attack. Specifically, beta distribution analyses showed that attacks that occur closer in time to the flanking big attacks tend to kill more people than attacks that occur near the midpoint between big attacks. In addition, we analyzed fatalities using MRCM, which focused only the sequence of attacks without considering the actual time points at which they occur during the progression. These analyses showed that incidents early and late in the sequence of attacks between big attacks tend to inflict the highest number of fatalities, relative to the middle of these sequences. These patterns appeared more pronounced with higher thresholds for big attacks (e.g., leading up to attacks that result in 49 or more fatalities). However, these patterns did not hold among groups that never committed a big attack (i.e., in the series of attacks that do not lead up to a big attack).
We also examined the patterns of attack-frequency between big attacks. The beta distribution analyses suggested that attacks tend to occur more frequently just after and just before big attacks (as reflected by a higher density at these time points) relative to the midpoint between big attacks. Moreover, the observed U-shape of the density estimates suggested an even higher density of attacks just prior to a big attack than just after a big attack. In contrast, the beta distribution analyses of groups that never commit a big attack looked quite different. They showed more of a steady trend towards de-escalation throughout their entire progression of attacks.
We analyzed frequency with MRCM as well, which again focused only the sequence of attacks without considering the actual time points at which they occur during the progression. These analyses suggested that with each consecutive attack, the number of days between attacks grows shorter in the middle of the sequence but then grows longer as groups approach the end of the sequence. Thus, though the beta distribution showed that the attacks in a progression are most frequent towards the end-close in time to an upcoming big attack-the final attacks in this sequence tend to have more days between them than attacks in the middle of the sequence. The pattern among groups who never committed a big attack looked different. These groups took longer overall between attacks. Further, toward the end of their lifespan they showed a more pronounced increase in the number of days between attacks than we observed in progressions leading up to big attacks.
As mentioned, the escalation patterns we have observed may have a number of explanations. It may be that killing triggers justification processes, desensitizes people, or produces material and/or psychological rewards that increase the likelihood of further killing [5][6][7][8][9]. Or perhaps with each attack, group members gain experience and thus increase the group's ability to carry out big attacks.
In addition to escalation prior to big attacks, the data provide evidence for de-escalation after big attacks. As with escalation, there are various possible explanations for this pattern. For one, it may be that after big attacks, pressure, surveillance, or conflict from opponents (e.g., State opponents) may limit the resources terrorist groups have with which to operate. Second, these pressures may fragment groups, diminishing their ability to organize and carry out more deadly attacks [11]. Work in conjunction with those in various disciplines (e.g., political science, sociology, psychology, economics, physics) may help tease apart these explanations for escalation and de-escalation as well as contribute to the development of others.
Yet another path for future work is suggested by the evidence here that escalation before big attacks and de-escalation after big attacks occurred using varying definitions of big attacks. Because we varied the definition of big attacks, big attacks according to one threshold became small attacks using a higher threshold to define big attacks. For example, many big attacks defined with the threshold of 21 fatalities are included as small attacks in analyses defining big attacks with thresholds of 31 and 49. That similar patterns show up at many of these different thresholds for big attacks hints at a self-similar structure in these lead-up progressions [12]. Within large patterns of escalation and de-escalation we observed smaller patterns of de-escalation and escalation. Moreover, given that the data suggest smaller de-escalation and escalation cycles may be nested within larger cycles, it may be worth considering the possibility that escalation and de-escalation forces exert themselves simultaneously, though to different degrees.

Conclusion
This work adds to a growing body of research modeling the timing of terrorist events [3][4]11,[13][14][15]. Prior work suggests that big attacks occur in a relatively random fashion over the course of a group's lifespan [3][4]. The present results, considered in conjunction with this previous work, suggest that though the occurrence of big attacks appears scattered somewhat randomly over the course of a group's lifespan, the set of small-scale attacks that precede these big attacks has a more systematic pattern. It is important to note, however, that terrorist attack data are messy and the effects we find are modest in size. Thus, though the GTD is well-organized and relatively comprehensive, efforts should be made to examine these patterns using other sources of terrorism data, such as the RAND Database of Worldwide Terrorism Incidents (http://www.rand.org/nsrd/projects/terrorismincidents.html).
Despite the modest size of the effects and the noise inherent in analyses of real-world data such as these, we believe these analyses have value given the importance of the topic and may provide leverage for deeper exploration. For example, future research may examine factors that moderate whether escalation precedes big attacks. Future research may also build on the present descriptive analyses with models suited for prediction or forecasting. In addition, future research might take a different approach to modeling the timing of attacks. For example, though we scaled lead-up progressions from 0 to 1, one might also approach these data by examining fatalities (or frequency of attacks) by week or by month. Finally, it may be worth applying the present escalation model to the examination of killing in other contexts such as in war, genocide, and gang violence.