The Left-Wing Threat: What Data Shows, and What It Does Not

Drawing on 556 far-left cases in the Profiles of Individual Radicalization in the United States (PIRUS) Version 5 dataset, we examine the individual-level profile of left-wing radicalization in the United States and how it has shifted since 2015. The evidence supports neither a simple surge narrative nor a simple decline narrative. What emerges is a profile that is less lethal than the deadliest ideological streams, but more decentralized and more internet-involved than older left-wing patterns. More recent far-left cases outside the dataset point to a more aggressive posture among some actors, while still requiring careful case-by-case classification.  

What incident counts can and cannot tell us 

In September 2025, the Center for Strategic and International Studies (CSIS) reported that left-wing plots and attacks had outpaced the far right in the first half of the year. Within weeks, Just Security pushed back, pointing out the CSIS finding rested on five incidents over nearly seven months and cautioning against strong trend claims on that basis. Five incidents can still carry analytic weight. The matter is how much. What these few incidents cannot do, on their own, is support a broad trend claim without a longer evidentiary runway. 

Two incidents from 2025 give the abstract count debate some concrete weight. In December of that year, federal prosecutors alleged law enforcement disrupted a coordinated bombing plot by four members of the Turtle Island Liberation Front (TILF). The government described TILF as a far-left, anti-capitalist, anti-government, and pro-Palestinian group. TILF purportedly planned simultaneous pipe bomb attacks on at least five logistics center locations in the Los Angeles area at midnight on New Year’s Eve, as well as follow-on attacks targeting U.S. Immigration and Customs Enforcement (ICE) agents and vehicles. According to the complaint, the four defendants, arrested in the Mojave Desert while constructing test devices, had produced a detailed operational document titled “Operation Midnight Sun.” It was alleged that the group had already spent weeks acquiring materials when the Federal Bureau of Investigation intervened.  

On July 4 of the same year, a separate group attacked the Prairieland ICE Detention Center in Alvarado, Texas, using fireworks as cover before one individual opened fire on responding officers, wounding a local police officer in the neck. Nine defendants tied to what prosecutors called a North Texas Antifa cell were subsequently convicted in federal court of providing material support to terrorists, rioting, and attempted murder. Together, these cases show that some actors on the far-left have moved past rhetoric into planning and execution. More specifically, with serious lethal potential in one case and demonstrated execution in the other.  

Separately, in September 2025, President Trump signed an executive order purporting to designate Antifa as a domestic terrorist organization. The order also directed federal agencies to investigate and disrupt unlawful activity associated with Antifa. That executive action preceded a broader formal shift. In particular, the May 2026 U.S. Counterterrorism Strategy elevated violent left-wing extremism to a named counterterrorism priority alongside narcoterrorism and legacy Islamist threats. The proclamation and the strategy together define the institutional environment in which left-wing radicalization will be monitored going forward. 

The July and December 2025 incidents are part of a broader pattern of left-wing aligned political violence spanning several years. In September 2025, Joshua Jahn opened fire at the Dallas ICE field office, killing one detainee and injuring two others; an unspent casing near Jahn bore the inscription “ANTI ICE.” Jahn died of a self-inflicted gunshot wound. In July 2025, Ryan Mosqueda fired an assault rifle at the U.S. Border Patrol sector annex in McAllen, Texas, injuring a local officer before he was killed by law enforcement. Mosqueda’s motive remains analytically uncertain. His family attributed the incident to mental health problems. The family stated they had not heard him discuss immigration or Immigration and Customs Enforcement.  

In June 2025, Tyler Robinson shot and killed conservative activist Charlie Kirk at Utah Valley University. Government officials and later reporting described Robinson as left-leaning or possibly influenced by left-oriented views. Still, the motive remains under investigation. Some cartridge inscriptions also reflected meme and gaming culture. In January 2025, Ryan English was arrested approaching the U.S. Capitol with homemade firebombs. English admitted he was inspired by Luigi Mangione and sought to kill Treasury Secretary nominee Scott Bessent. Mangione, who criticized corporate power and killed UnitedHealthcare chief executive officer Brian Thompson in New York City in 2024, has been characterized by some analysts as far-left, although that classification remains analytically contested. 

In 2023, Manuel Paéz Terán was killed during a confrontation with Georgia State Troopers. Terán was associated with the Defend the Atlanta Forest campaign. Georgia prosecutors later linked the broader campaign to domestic terrorism and racketeering charges. In October 2025, Nicholas Roske was sentenced to 97 months, a little over eight years, for his June 2022 attempted murder of Supreme Court Justice Brett Kavanaugh. Roske explained he was motivated by the draft Dobbs decision and the Uvalde shooting. Ellen Reiche and Samantha Brooks were convicted of placing a shunt on a railroad signaling system in Bellingham, Washington, an act capable of causing train derailments in 2021. In July 2019, Wilhelm Van Spronsen of the Puget Sound John Brown Gun Club entered an ICE detention facility in Tacoma armed with a rifle, threw Molotov cocktails, and was killed by police. Lastly, in June 2017, James Hodgkinson shot at Republican members of Congress at a baseball practice in Virginia, injuring five before being killed by responding officers. Taken together, the record since 2017 reflects recurring episodes, allegations, and contested cases involving far-left political violence across multiple ideological strains, directed at a range of institutions and individuals. 

Against this backdrop, small base counts require caution because a single mobilizing episode can double a yearly total. In doing so, it can create the optical illusion of a structural shift. Bart Schuurman’s review of terrorism scholarship documented this tendency across the field. He found that the literature has long favored major events and jihadist violence, leaving other ideological streams comparatively underdeveloped. Left-wing violence has not been ignored entirely. The analytic apparatus built around this strain of extremism remains thinner. Thinner infrastructure means more room for misreading. 

Two critiques are helpful in understanding left-wing perpetrators. Schuurman’s finding is a coverage argument: left-wing violence received proportionally less systematic scholarly attention than jihadist terrorism across nine leading journals over a decade. Smith and Tan’s argument is methodological: even existing analysis has been shaped by classification frameworks built primarily around post-9/11 jihadist and far-right threat profiles. Those frameworks influence which incidents get coded as terrorism, which actors attract analytic attention, and what organizational features researchers seek. The two problems compound each other in practice.  

Fewer scholars studying left-wing violence means fewer sustained challenges to classification frameworks built primarily around jihadist and far-right profiles. Without those challenges, those paradigms remain in place and continue to shape which incidents get counted as terrorism and which actors attract formal analytic attention. Thinner coverage feeds framework rigidity; such inflexibility shapes what the limited coverage is able to see. This is precisely the kind of misreading that individual-level PIRUS data help correct. After all, PIRUS shifts the analytic focus from incident tallies to the profiles and pathways of the people behind them. 

This article takes up a narrower and more tractable question than whether the left-wing threat is dangerous in general. What the Profiles of Individual Radicalization in the United States, or PIRUS, can address is a prior question. What kinds of individuals, pathways, and relational contexts appear in the far-left subset, and how has that profile shifted before and after 2015? The distinction between incident-level and individual-level analysis matters practically. It changes what counts as evidence. Too, it modifies what kind of policy response is even in scope. 

Left-wing extremism in the United States encompasses several distinct ideological strains. Beutel and Johnson identify four main categories of violent far-left actors: Black nationalist extremism, anarchist extremism, anti-fascist extremism (including Antifa), and ecological extremism. Meanwhile, the George Washington University Program on Extremism identifies several left-wing militias of note, including the John Brown Gun Clubs/Redneck Revolt, the Socialist Rifle Association, and the Huey Newton Gun Club. The Counter Extremism Project (2022) catalogues eleven far-left groups currently or formerly active in the United States, including Antifa, the Earth Liberation Front, the Animal Liberation Front, and associated formations. Meanwhile, the Institute for Strategic Dialogue notes that there is no broadly agreed-upon definition of the far left. Scholarly coverage of these groups is also considerably less developed than research on far-right extremism in the United States. What most definitions in the left-wing paradigm share is a cluster of anti-capitalist, anti-imperialist, and radically egalitarian commitments, with disparate stances on the legitimacy of political violence. 

What PIRUS can, and cannot, show 

The PIRUS dataset, maintained by the National Consortium for the Study of Terrorism and Responses to Terrorism (START), codes individual-level information on people who have radicalized in the United States, including their ideology, organizational affiliations, and behavioral markers. The working PIRUS Version 5 spreadsheet used in this analysis contained 3,528 rows before exclusions. After removing one case without valid coding across the four mutually exclusive ideological flags, 3,527 cases remained for the cross-ideology comparison: Islamist, far right, far left, and single issue. The far-left subset accounts for 556 of those valid ideology-coded cases, or 15.8 percent. 

Again, PIRUS is not an event count. It does not report how many left-wing attacks occurred in a given year. Treating PIRUS as a substitute for incident databases such as CSIS or T2V is wrong. What PIRUS offers instead is a systematic look at the personal and relational characteristics of people who were radicalized, the groups they joined or drifted away from, their documented online activity, and the peer networks they moved through. Conflating the two kinds of analysis is one of the more consistent errors in public commentary on this topic. 

The coding decisions used here follow the National Institute of Justice (NIJ) final report on PIRUS. Before turning to the findings, one further methodological point bears stating. This analysis uses a split at 2015 to compare a more historical far-left profile with more recent ones. The cutpoint is pragmatic rather than causal. It is not a claim that something structurally decisive happened in 2015 specifically. 

What the structure shows, 2000–2022 

Table 1 sets out the cross-ideology comparison. The finding most worth stating at the outset, because it tends to get lost in commentary that emphasizes the existence of left-wing violence rather than its character, is that the far-left subset is not the most lethal profile in the dataset. On violence rates it sits well below both Islamist and far-right subsets. That asymmetry is not a reason to dismiss the issue. Rather, it is a reason to be precise about its nature during the period analyzed. 

Table 1. Cross-ideology comparison of selected PIRUS indicators. 

* Active recruitment and internet involvement percentages use valid-case denominators; internet involvement counts cases coded 1 or 2. 

Three other structural features emerge from Table 1 go beyond the lethality comparison. Clearly, the far-left subset is less violent than the Islamist and far-right subsets, consistent with the cross-dataset comparison by Jasko and colleagues. Beyond the lethality gap, two other differences stand out. The female participation rate in the far-left subset is 25.2 percent, or 140 of 556 coded far-left cases. The female presence in the far-left is nearly three times the far-right figure and more than three times the Islamist rate. Far-left internet involvement is 180 of 193 valid cases, or 93.3 percent, which is the highest proportion among the four groups under the coding rule used here. These are descriptive features of the coded population, not causal findings. The recruitment and internet measures should be read with their valid-case denominators in view. 

Two of these differences deserve a brief note. The lethality gap fits the strategic logic that has historically characterized far-left movements: property damage, disruption, and symbolic action rather than mass-casualty targeting. The elevated female participation rate is less settled analytically, but the most plausible explanation is organizational. Far-left networks recruit through activist channels that are less gender-exclusionary than jihadist cells or militia structures. Also, in some respects, jihadist and right-wing actors are less embracing of female members. Both points come from comparative research, not from anything the PIRUS data themselves can establish. 

The lethality point deserves more sustained attention than it typically receives. Public debate often slides from “left-wing violence is a real phenomenon” to “left-wing violence is a threat on par with the deadliest domestic streams.” The CSIS brief is careful on the point that left-wing attacks have been far less lethal than far-right and jihadist attacks over the past decade. The Anti-Defamation League’s (ADL) 2024 murder and extremism report found that all 13 confirmed extremist killings in 2024 were tied to right-wing actors, with no far-left cases in the count. One year of data does not establish a trend, but it anchors the lethality asymmetry in the most recent available tracking. Taken alongside the decade-long CSIS record, the case for taking the far-left profile seriously runs through detection and classification, not through body counts. 

The CSIS analysis puts specific numbers on that asymmetry. Over the past decade, right-wing extremists killed 112 people across 152 terrorist attacks in the United States, left-wing extremists killed 13 people across 35 attacks, and jihadist attacks killed 82. Still, the relatively low left-wing death toll should not be read as evidence of a categorical commitment to non-lethal action. As the New Lines Institute has observed, far-left actors have generally favored disruptive but non-fatal direct action. It has also noted that internal constraints against homicidal escalation may be eroding. This is driven partly by environmental factors and by the ideological rejection of formal organizational structures that might otherwise moderate tactical choices. The operational record gives reason for caution here. Firearms, improvised explosives, railroad sabotage, and arson carry mass-casualty potential has not yet been fully realized. The lower far-left death toll likely reflects incomplete execution and operational constraints as much as principled restraint. 

The year-by-year case count makes clear why event-based arguments about the far-left threat are structurally unstable. Within the 2015 to 2022 far-left subset, 2020 accounts for 100 of 234 cases, or 42.7 percent. Any trend analysis that takes 2020 as its endpoint will look alarming. Any analysis that treats it as an outlier will look dismissive. The series itself does not resolve that choice. It just shows that the choice is consequential. 

Removing 2020 from the post-2015 subset still leaves violence and lone-offender rates higher than in the pre-2015 group. The more defensible reading is that 2020 amplified something already moving in a more decentralized direction, rather than creating the pattern from scratch. If that framing holds, the relevant policy question shifts to not what caused the 2020 spike, but what was the underlying structure the spike rode on top of. 

Figure 2 keeps the comparison in perspective. The far-left subset does not lead on violence. Readers should see that clearly before moving further into the analysis. Where the subset does stand out is on female participation and, among validly coded cases, on internet involvement. Those differences remain descriptively notable, but the internet comparison rests on uneven valid-case denominators across groups and should be read with that limitation in view. Even so, the far-left subset looks structurally distinct from the other groups in PIRUS on dimensions that may matter for how radicalization is likely to proceed and, more critically, for how it may be missed by conventional detection approaches. 

Figure 3 is where the structural shift becomes concrete. The post-2015 far-left subset shows a marked increase in lone-offender coding, a sharp drop in active recruitment, and very high internet involvement among validly coded cases. The denominators are uneven across measures, especially for pre-2015 internet involvement, where only 41 far-left cases are validly coded. Taken together, those changes describe an organizational form that appears farther removed from the classic model of hierarchical group membership and formal recruitment pipelines. Chakraborty and Rizvi’s review underscores that scholars continue to debate how “online radicalization” should be defined and how much causal weight should be assigned to internet exposure alone. The Institute for Strategic Dialogue’s (ISD) 2024 US violence review also found that many violent incidents did not map neatly onto standard ideological categories. For instance, some of the deadliest cases emerged from nihilistic or hybrid online subcultures. Those observations do not prove the PIRUS mechanism proposed here. But, they do support caution against equating lone-offender coding with social isolation. 

What changes after 2015 

The numbers behind Figure 3 deserve closer attention. In the pre-2015 far-left subset, 31 of 322 cases, or 9.6 percent, are coded as lone offenders. By 2015 to 2022, that figure stands at 103 of 234, or 44.0 percent. Violence rates move from 115 of 322, or 35.7 percent, to 110 of 234, or 47.0 percent. Active recruitment falls from 36 of 125 valid cases, or 28.8 percent, to 4 of 125 valid cases, or 3.2 percent. Internet involvement rises from 29 of 41 valid cases, or 70.7 percent, to 151 of 152 valid cases, or 99.3 percent. These descriptive shifts point in the same direction. The internet measure in particular should be interpreted with caution because the valid-case denominator is small before 2015. 

These shifts are broadly consistent with scholarship suggesting that the internet has become increasingly prominent in radicalization pathways, even though online activity should not be treated as a self-sufficient explanation for violence. That more modest point fits the far-left PIRUS profile better than a pure lone-wolf account would. The pure lone-wolf framing requires evidence of complete social isolation, but the PIRUS data show only weaker formal organizational ties, not the absence of social connection altogether. Far-left actors in the post-2015 subset continue to emerge from shared activist milieus, share ideological commitments with loose peer networks, and engage in online spaces that are themselves forms of social embeddedness. Reducing that pattern to lone-wolf atomization overstates what the decentralization finding actually supports. The actors may be harder to track through traditional indicators of group membership and formal recruitment, but that does not by itself establish social isolation or total detachment from peers. 

What the post-2015 data describe, then, is diffusion rather than disappearance. Recruitment signals weaken. Online exposure is very high among valid cases. Yet, that measure rests on 152 valid post-2015 cases and only 41 valid pre-2015 cases. The organizational shell appears thinner, while some forms of social embeddedness may persist. For analysts accustomed to looking for group membership, leadership hierarchies, and formal recruitment pipelines, this profile may be harder to discover. That is a detection problem. The current data, however, do not justify stronger claims about peer-network stability unless the relevant denominators are reported. 

The directionality problem is real, and the current data cannot resolve it. Socially isolated individuals may seek online communities because offline networks are unavailable to them. That pathway would make high internet involvement a selection artifact, not a radicalization mechanism. Both pathways produce identical observational signatures in cross-sectional data. Operational conclusions about the causal role of internet exposure need to reflect that. 

What practitioners should take away? 

The analytic distinction between incident counts and individual profiles carries real operational weight. A small rise in incidents may or may not signal a broader shift in who is radicalizing and how. PIRUS speaks to the latter question. Commentary that collapses the two levels of analysis tends to either overread spikes or dismiss structural changes that do not yet show up in incident tallies. 

Far-left violence warrants serious analytic attention. The argument for this scrutiny does not require overstating the lethality record. PIRUS data and external incident research align on one important point. The far-left subset appears less lethal than the deadliest ideological streams. PIRUS also suggests a post-2015 profile that is more decentralized, less dependent on visible recruitment, and more internet-involved than the pre-2015 subset. However, those latter findings come from an individual-level dataset and should not be treated as direct incident-level equivalents. That distinction matters regardless of where the subset ranks on a lethality table. 

The August 2020 killing of Aaron Danielson by Michael Reinoehl in Portland, documented by VOA News and Oregon Public Broadcasting, is a confirmed case of fatal far-left political violence. The Center for Strategic and International Studies (CSIS) counts Reinoehl alongside Luigi Mangione’s December 2024 assassination of UnitedHealthcare CEO Brian Thompson as the two confirmed far-left fatalities since 2020. If the June 2025 killing of Charlie Kirk is formally attributed to left-wing motivation, it would constitute a third. None of these cases should disappear into aggregate patterns that suggest zero far-left lethality. More recently, the alleged TILF plot in December 2025 and the July 4, 2025 attack on the Prairieland ICE Detention Center in Alvarado, Texas suggest that some actors in this ideological stream are moving toward operations with greater lethal potential, even as aggregate lethality data remain well below the far-right and Islamist benchmarks. Both 2025 incidents involved coordination between multiple actors rather than lone-offender activity. This development is a notable exception to the post-2015 PIRUS trend and should be treated as case-level qualifications rather than replacements for the aggregate profile. 

Any operational response will also need to preserve the distinction between lawful protest and violent extremism. PIRUS is not designed to test whether protest participation creates a radicalization pipeline, so no such inference should be drawn from this dataset. What the data may suggest is that when violent actors emerge from broader activist milieus, the task of distinguishing who within that setting is moving toward violence becomes harder. The cost of misclassification falls disproportionately on people engaged in lawful political expression. This is precisely why analytic discipline about what the evidence warrants matters here. 

As referenced above, concern now has a concrete institutional dimension. A New York Times investigation published in April 2026 reported the Trump administration has directed more counterterrorism resources toward far-left groups, including by adding Antifa to the National Intelligence Priorities Framework. The same shift appears in the administration’s efforts to press European allies to designate far-left organizations as terrorist groups. The May 2026 U.S. Counterterrorism Strategy, released by the White House, formalized that posture. The strategy identifies “Violent Left-Wing Extremists, including Anarchists and Anti-Fascists” as one of three major current threat categories alongside narcoterrorists and legacy Islamist groups. Furthermore, the new strategy calls for mapping their domestic membership, identifying ties to international organizations such as Antifa, and using law enforcement tools to disrupt them operationally before attacks occur. The policy specifically references the killing of Charlie Kirk as an example of politically motivated violence by violent left-wing extremists. How that framework is applied, and whether it preserves the analytic distinction between lawful protest and violent extremism, will shape the field for the foreseeable future.  

Reciprocal radicalization deserves careful handling as well. The cumulative extremism literature and work by Lygren and Ravndal suggest that interactive escalation can occur across opposed milieus under specific conditions. That conditional finding is not the same as a deterministic one. The PIRUS data are descriptive. They support sharper classification. In fact, they do not support alarm-driven threat projections. 

The gender finding is the one most consistently overlooked in practitioner discussions. That omission matters. At 25.2 percent, or 140 of 556 coded far-left cases, the female share of the far-left subset is not a minor statistical artifact. Detection frameworks built primarily around male radicalization profiles may therefore miss a meaningful portion of this population. Koehler’s thematic analysis adds a further dimension by showing that women who engaged in left-wing terrorism articulated motivational themes that do not map neatly onto the better-studied right-wing or jihadist cases. That implication is best treated as an analytic inference rather than a settled operational conclusion. 

The literature on women in terrorism expanded after 9/11 and accelerated again when the Islamic State drew researchers to the question of female participation. Margolin and Cook catalogued 661 publications on the topic from 1970 to 2021, finding real growth but persistent gaps, including in the study of women in far-left movements.  

Koehler documented that gap in a thematic analysis of 13 autobiographies by German and American women active in left-wing terrorism, identifying four motivational themes: consequentialism, internationalism, perceived moral superiority of the cause, and reaction to prison conditions. His observation that women have historically held more prominent roles in far-left violence than in jihadist or far-right groups, yet attracted comparatively little scholarly attention, holds.  

The 2023 prosecution of the Engel-Guntermann network in Germany is a useful reference point. Lina Engel, a female university student, led a clandestine group that conducted planned, targeted assaults on right-wing extremists over two years and received the case’s harshest sentence. Women made up roughly 31.5% of the network’s known membership, were concentrated in its youngest age cohort, and age did not correlate with leadership position. 

Conclusion 

The debate over left-wing political violence in the United States tends to oscillate between two unsatisfying positions. The threat is either dismissed as marginal or inflated to a level the available evidence cannot support. Neither serves analytic purposes. The 556 far-left cases in the PIRUS V5 file do not justify a sweeping surge narrative. Neither do they justify dismissal. What they show is a population that is less lethal than the deadliest ideological streams, more decentralized than older organizational models, and, on valid cases, more internet-involved than the pre-2015 subset. 

The finding worth carrying forward is structural, not epidemiological. The far-left threat profile does not fit well with frameworks built around formal organizations, visible recruitment activity, and clear group boundaries. Analysts who recognize that mismatch will be better placed to interpret future case counts, whether those counts rise or fall, without importing assumptions that the data no longer support. 

The lone-actor and small-cell pattern is not unique to the far left. Gill, Horgan, and Deckert’s analysis points to a broader structural feature of post-9/11 domestic terrorism rather than an ideology-specific one. What distinguishes the far-left profile is the following combination: low lethality, high internet involvement among valid cases, and elevated female participation. Together, they produce a detection profile that does not fit frameworks built around more studied threat streams. That combination merits closer attention, particularly as recent fatal and serious cases complicate older assumptions about far-left tactical restraint.