When most people think about the Decision Logic Behind Terrorist Attacks they think about ideology.
They think belief comes first—and that belief drives everything that follows.
And that’s partially true.
But ideology alone doesn’t create an attack.
What creates an attack… is a decision.
A person or a group decides:what to target,when to strike, where are the vulnerabilities,how to exploit security weaknesses,and when the chances of success trump the risks.
Today, we’re not going to focus on why terrorists believe what they believe.
We’re going to focus on the thinking behind successful attacks.
And to do that, we’re going to walk through three real-world attacks
The 2008 Mumbai attacks in India, carried out by Lashkar-e-Taiba
The 2013 Westgate Mall attack in Nairobi, Kenya, carried out by al-Shabaab
And the November 13, 2015 Paris attacks in France, carried out by ISIS
Three different regions. Three different groups.But the same underlying decision-making process.
Not just what happened—
but how decisions were made at each stage.
Because once you understand that decision logic,you start to see warning signs long before an attack ever happens.
Segment 1 — Target Selection: Impact Meets Feasibility
There’s a common belief that terrorists choose targets purely because they’re symbolic.
That’s not wrong—
but it’s incomplete.
Terrorists don’t choose targets just because they’re symbolic.
And they don’t ignore symbolism either.
What they actually do is weigh multiple factors at once
Psychological impact
Accessibility
Vulnerability
Ability to control the environment
Media attention
So the real question isn’t
“Is this target symbolic?”
It’s
“Will this target work—and will it create the effect we want?” ADD Ambo Stevens Example
Case Study 1 — Mumbai (2008)
On November 26, 2008, ten terrorists carried out a coordinated attack across Mumbai, India.
The attack lasted nearly 60 hours.
By the time it ended, 166 people were dead and more than 300 were injured.
The attackers were part of Lashkar-e-Taiba.
They struck multiple locations
The Taj Mahal Palace HotelThe Oberoi Trident HotelChhatrapati Shivaji TerminusAnd Nariman House
Each location served a different purpose.
The hotels allowed them to control space, take hostages, and extend the attack.
The train station created immediate mass casualties.
Nariman House added a religious and international dimension.
This wasn’t symbolic versus practical.
It was both—working together.
They conducted reconnaissance ahead of time.
They used GPS and satellite imagery.
They entered the city by sea.
And during the attack, they received real-time direction from handlers.
This was a planned operation designed for maximum effect.
Segment 2 — Testing the Plan
Before an attack happens, there’s already a model in place
“What has to go right for this to succeed?”
Reconnaissance is how they answer that.
Attackers will
Visit locations multiple times
Watch security behavior
Identify weak points
Time crowd patterns
This is not random.
It’s deliberate testing. And stay tuned as we are going to do a follow-on episode of the signs people miss prior to attacks where we get into this issue in more detail.
Even in non-coordinated events, Studies show roughly 25 to 35 percent of lone attackers conduct surveillance before acting.
Organized groups do it even more.
Because the pre-attack ground work reduced uncertainty.
Case Study 2 — Westgate Mall (2013)
On September 21, 2013, al-Shabaab terrorist entered the Westgate Mall in Nairobi, Kenya.
The attack lasted four days.
Sixty-seven people were killed. More than 170 were injured.
Westgate wasn’t globally symbolic.
But it was ideal operationally.
It had high foot traffic—around 25,000 people per day.
Multiple entrances.
And inconsistent security.
Investigations showed the attackers had visited the mall before.
They studied guard placement.
They identified gaps.
They understood peak hours.
And they exploited all of it.
This is the key takeaway
The target didn’t need to be symbolic.
The attack itself can create the symbolism.
Segment 3 — Tools and Tactics
Weapons are chosen the same way as targets.
Not randomly.Not emotionally.But based on what works.
Attackers are making practical decisions.
They’re asking
What can I realistically access?
What do I know how to use?
What fits this environment?
And what will create the outcome I want?
Because the weapon isn’t the point.
The outcome is.
Let’s break that down.
Accessibility matters.
If someone can’t get a firearm, they don’t stop.
They adapt.
A weapon that works in one setting doesn’t work in another.
In tight indoor spaces → firearms or knives
In open, crowded streets → vehicles
In controlled environments → explosives
Look at the 2016 Nice truck attack in Nice, France.
Nice attack clip: https://youtu.be/fDbpcd871J8?si=iuM_BAznjAShf-qx
A cargo truck was used to drive through a crowded Bastille Day celebration.
Why a truck?
Because the environment—a dense crowd with limited barriers—made it one of the most effective tools available.
The attacker didn’t need firearms, explosives, or other complex weapons.
The environment itself became the vulnerability.
Case Study 3 — Paris (2015)
Paris attack clip: https://youtu.be/qfFSKvS87_4?si=3yZSP5cPPAeeD3Tm
On November 13, 2015, coordinated terrorist attacks across Paris, France.
Nine attackers carried out assaults across the city.
By the end of the night, 130 people were dead and more than 350 were injured.
The attackers were linked to ISIS.
They targeted
The Bataclan TheatreThe Stade de FranceAnd multiple restaurants and cafés
This attack was coordinated across borders.
Operatives moved through Syria, Belgium, and France.
They used safe houses.
Encrypted communications.
And coordinated timing.
They used suicide vests to guarantee lethality.
And assault rifles to sustain the attack.
Multiple teams ensured chaos and a delayed response.
Every decision reinforced the next.
Segment 4 — The Pattern
Across all three attacks, the same pattern appears.
Not a single decision—but a chain
OutcomeTargetLocationReconnaissanceAdjustmentExecution
And at any point, the plan can change. Terrorists are much more flexible on the objective that we realize.
Because the goal isn’t the target.
The goal is the outcome.
Counterterrorism Reality
Most attacks don’t succeed.
Many are stopped during planning or surveillance.
And often, it comes down to observation.
People noticing
Unusual behaviorRepeated surveillanceStrange questionsTesting boundaries
In many cases, public tips play a role in stopping attacks.
That matters.
Because prevention often happens before the attack begins.
If there’s one thing to understand, it’s this
Terrorist attacks don’t start with a target.
They start with an outcome.
Everything else—
the location,the timing,the weapons,even the symbolism—
is chosen to make that outcome possible.
And once you understand that,
you stop seeing attacks as random—
and start seeing the decisions behind them.