Counterterrorism is designed to detect movement. Travel, procurement, encrypted communications, surveillance, weapons, and training: those indicators separate noise from mobilization, and they matter. But they tend to appear after a more basic decision has already been made. Before an attacker moves, someone has decided which person, building, congregation, or piece of infrastructure will be held answerable for a grievance it does not control. That decision, and the explanation that justifies it, is itself an indicator, and U.S. homeland security planners should learn to read it as such.
Begin with what these cases are not about. They are not simply examples of attackers striking symbolic or soft targets, a pattern documented for decades. The point is narrower and has an operational edge. In each of the recent cases below, the target bears no responsibility for the grievance it is punished for: a Brooklyn synagogue does not set Israeli policy, an El Paso Walmart does not run immigration, and a Baltimore substation does not cause civilizational collapse. What links the target to the grievance is an explanation the attacker produces — and, increasingly, publishes. That explanation is the targeting decision. It takes collectible form, in a complaint, a claim of responsibility, a manifesto, a target list, or a recorded message. In at least one case, it traveled intact between movements that otherwise have nothing in common. And it is the one part of the attack cycle that the current system is least equipped to treat as intelligence rather than as speech.
The clearest current example was unsealed in the Southern District of New York on May 15, 2026. Federal prosecutors allege that Mohammad Baqer Saad Dawood al-Saadi, a senior Kata’ib Hizballah figure tied to Iran’s Islamic Revolutionary Guard Corps, directed and urged attacks on U.S. and Israeli interests, and that he and his associates planned, coordinated, and claimed responsibility for at least 18 terrorist attacks in Europe and two additional attacks in Canada under the name Harakat Ashab al-Yamin al-Islamiya, or HAYI, a front prosecutors describe as a component of Kata’ib Hizballah. Prosecutors also allege that al-Saadi attempted to coordinate attacks inside the United States, including in New York.
What al-Saadi allegedly ran was, in his own account to the FBI, “media and psychological warfare.” According to the indictment, he joined attacks by video call as they were carried out, filmed them, and produced HAYI’s branded claim videos. After an arson against a synagogue in Skopje, North Macedonia, on April 12, 2026, he posted footage of the burning building marked with a red target symbol and the group’s logo. The explanation was not added after the fact. It was manufactured alongside the attack and disseminated as its point.
That production has a purpose: it widens the target set. According to the complaint, al-Saadi urged supporters to kill those who support America and Israel, civilians included, and to strike American or Zionist targets in any country. Once the justification is “supports Israel” rather than “is Israel,” the target no longer has to be a soldier, an embassy, or a state facility. A civilian institution can be drawn in the moment it is described as American, Israeli, Zionist, or supportive of them.
The European campaign shows the move at scale. Per the complaint, the attacks ran from a synagogue bombing in Liège, Belgium, on March 9, 2026, through an arson at a Rotterdam synagogue, an explosion outside a Jewish school in Amsterdam, and a bombing of the Bank of New York Mellon building in Amsterdam, to the April 29 stabbing of two Jewish men — one a dual U.S.–British citizen — in London. A Jewish charity in London was allegedly tied to the founder’s prior Israeli army affiliation. A London synagogue was allegedly described as a center of Zionist influence in the British capital.
None of those targets sets Israeli policy or directs a military campaign. The framing is what made each one usable.
The U.S. allegations are more direct. According to the complaint, al-Saadi sent an undercover officer — posing as a Mexican cartel contact — the location of a prominent New York synagogue and directed that it be attacked. He also sent information stating that the congregation supports Israel’s right to exist. He allegedly agreed to a $10,000 fee, paid roughly $3,000 of it in cryptocurrency, demanded that the attack be filmed, and pressed for it to happen at once. The demand to film it is the tell: the recording was the deliverable, because the explanation it would carry was the objective. The same day, he allegedly sent locations for Jewish centers in Los Angeles and Scottsdale, along with documents describing them as supporters of Zionism outside Israel and as centers of solidarity with Israel and Zionist objectives.
The same structure appears where the grievance has nothing to do with Iran. The alleged plot against UFC Freedom 250, the fight card held on the White House South Lawn on June 14, 2026, was not a proxy operation and not a plot against Jewish institutions, and it should not be reduced to Israel. According to the Justice Department, the alleged conspirators discussed driving attendees from the event with explosive-laden drones and then firing on “high-value targets” as they fled, and discussed assassinating senators, representatives, and prominent business executives. Some legislators, the department says, were targeted on the group’s belief that they had taken money from pro-Israel lobbies. Power grids, too, were raised as potential targets.
This case carries the argument furthest, because the rationale was not even the group’s own. The plotters’ stated grievances ran to government corruption, the Epstein files, and an accelerationist wish to tear the country down. Accelerationism does not generate an AIPAC target list. They took one, assembling images of lawmakers from a left-leaning anti-AIPAC tracking website and folding them into a right-wing plot. The explanation traveled between movements that agree on nothing else. That portability is the reason it should be read as a transferable indicator rather than the property of any one ideology.
The assignment can also be doctrinal. In April 2026, the Justice Department announced that Muhammad Shahzeb Khan, a Pakistani national who had been living in Canada, pleaded guilty to attempting to enter the United States to carry out a mass shooting at a prominent Jewish center in Brooklyn in support of ISIS. He timed the planned attack to the anniversary of October 7, told undercover officers that New York was “perfect” because of its large Jewish population, and discussed Chabad locations before settling on the Brooklyn center. He selected the center for what it represented to him.
Target substitution is not confined to Jewish institutions, Israel, or foreign-policy grievances. The same structure appears when the grievance is race, immigration, or the collapse of the system itself.
On August 3, 2019, Patrick Crusius opened fire at a Walmart in El Paso, killing 23 people and wounding 22. In his 2023 federal guilty plea, he admitted that he killed and wounded people because of the actual and perceived Hispanic national origin of those he expected to find there, and that he chose El Paso, a border city, to deter Mexican and other Hispanic immigrants from coming to the United States. The target was a Walmart; the attached grievance was immigration-related.
Buffalo was more explicit. On May 14, 2022, Payton Gendron killed 10 people and wounded three at a Tops supermarket. Federal prosecutors alleged that his planning materials set out a plan to kill Black people at the store and tied the attack to “Great Replacement” ideology, and that he selected the ZIP code for its Black population before selecting the Tops store because he expected to find a large number of Black shoppers there. He chose the store because it was where the grievance could be carried out.
The Baltimore power grid case applied the same logic from people to infrastructure. In February 2025, a federal jury convicted Brandon Russell, a founder of the neo-Nazi group Atomwaffen Division, of conspiring to damage an energy facility. Prosecutors said the plot targeted transformers inside electrical substations in support of accelerationist ideology, and that a small number of strikes could cause a “cascading failure.” Here, the target was infrastructure rather than a population, valued for the cascading failure it could set off.
The structure repeats across very different target types. A synagogue is tied to Israel. A Jewish center is tied to Zionism abroad. A lawmaker is tied to lobbying money. A Walmart is tied to immigration. A supermarket is tied to replacement. A substation is tied to collapse. These cases share no ideology — Iran-directed proxy command, accelerationist anti-government conspiracy, ISIS inspiration, white-nationalist mass shooting, neo-Nazi infrastructure sabotage — and they should not be collapsed into one another. What recurs is the explanation: in each record, the target arrives with a justification that makes it stand for something else, and in several of these cases, that justification was written down or filmed before anyone moved.
Anger, ideology, surveillance, procurement, travel, and planning still matter. But by the time those indicators appear, the explanation has often already done its work, fixing responsibility on a person, an institution, a community, or a symbolic site. The operationally relevant moment comes earlier, when the rationale is produced.
Three implications follow for homeland security planning. First, the explanation should be tracked as a leading indicator rather than reconstructed after an attack. The forms it takes — claims of responsibility, target lists, manifestos, the justifying language inside encrypted threads — are frequently public or semi-public before any procurement or travel begins. The Department of Homeland Security, the FBI’s Joint Terrorism Task Forces, and state and local fusion centers already collect this material. What they lack is a consistent discipline for reading it as targeting intelligence rather than as rhetoric. What matters about a grievance is whether it has begun to name substitute targets.
Second, the indicator is cross-ideological, and detection should be built that way. The same move organizes an Iran-directed plot against a New York synagogue, an accelerationist plot against lawmakers, and a white-nationalist attack on a supermarket — and, in the UFC case, a single target list crossed from one camp to another. Frameworks organized strictly by ideological category will keep missing it, because the shared signature is structural, not doctrinal. Detection developed around the production and circulation of targeting rationales will travel further than detection built around any one movement’s beliefs.
Third, the line that matters is the one between criticism and targeting. Naming an institution as political opposition is protected speech and ordinary politics. The shift that is operationally relevant is the point at which an institution stops being argued against and starts being mapped — when a synagogue, a charity, a store, or a substation is converted from an object of grievance into a stand-in for the enemy. That conversion is where speech ends, and targeting begins, and it is the threshold planners should be resourced to watch.
A war does not stay overseas when actors attach responsibility to people and institutions thousands of miles from the front. A conspiracy theory does not stay online when a store, a city, an official, or a power grid is made to stand for the enemy. Whether the frameworks built to detect mobilization are adapted to detect the production of targeting rationales will determine how much of this is seen, while it is still only an explanation.
Analysts are trained to watch the move from talk to action. The earlier move, the manufacture of a reason that turns an uninvolved target into the enemy, deserves the same attention, because by the time the familiar indicators appear, the choice of where to strike has usually already been made.
