Terror in Vienna: a risk assessment perspective – by Jörg Peschak

On the night before the second lockdown on November 2nd, 2020 at 8 pm, Austria’s capital was hit by a terrorist attack. On the macrolevel, it is the latest of a series of events that began in France with the republication of the caricatures of Charly Hebdo followed by the beheading of a teacher for showing the caricatures and an attack on people at the cathedral in Nice. Now the scene moved to Vienna. But why Austria? Could it have been prevented?

Austria as a target came rather surprising as there was no imminent threat by terrorist organizations or military involvement of Austrian forces in any conflict. It seems that political assessment cannot provide satisfactory answers. Therefore, a shift from the macrolevel to the microlevel might bring new insights. In order to get a view “behind the scenes”, after the “Timeline” which serves as a short recap, a threat assessment with the assessment tool used in the Austrian prison and probation context is provided. The Violent Extremist Risk Assessment Version 2 Revised (VERA-2R) is the most common tool for forensic and intelligence professionals for all kinds of violent extremists.[1] Specifically for lone actors as it might be the case in Vienna, Reid Meloy et al. developed the Terrorist Radicalization Assessment Protocol (TRAP-18)[2] which can be used in combination with VERA-2R[3]. These procedures are based on the structured professional judgment approach (SPJ) which helps the analyst to identify relevant risk factors as well as protective factors and provides a methodology to understand the extremist and conceptualize scenarios in order to reach an assessment of the individual at hand.


16/10/2020: Decapitation of Samuel Paty in France

28/10/2020: Stabbing attack in Nice/France

29/10/2020: 50 Turkish teenagers shout slogans and riot in a catholic church in Vienna’s 10th district. The police assumed a connection to the caricatures of Charly Hebdo.[4]


At 20:00 – four hours before the second lockdown in Austria – the 20 years old Kujtim F. started his attack in front of the main synagogue in the city center of Vienna. Equipped with a long firearm (Kalashnikov), a pistol, a machete and a fake explosive belt he moved on to further five locations in the surroundings where he shot and stabbed people. So far four died and 23 were injured, among them several are in a critical condition, also one police officer.

At 20:09 the police arrived and managed to shoot Kujtim F. but the search for accomplices continued all night long. People who happened to be in nearby bars or restaurants and those who were able to escape the attack were hiding until around 2 am when it was declared safe to leave.

According to the police, Kujtim F. was a lone actor but some aspects remain unclear. During the night there were reports of gunfire and several individuals were arrested. So far there have been 14 arrests in Austria and further two in Winterthur/Switzerland[5]. The “Islamic State” claimed responsibility for the attack, calling Kujtim “Abu Dagnah Al-Albany”.[6]

Risk/threat assessment

The following paragraphs seek to depict a tentative assessment with the publicly available information. The state-of-the-art method in assessing extremists is the structured professional judgment approach. In short it works the following way: the assessor first identifies which risk factors are present and relevant. Relevant factors are those that are causally or functionally related to the individual’s behavior.[7] They may be personal, situational or societal factors. Second, judging these factors the assessors construct a theory of how the individual “functions”. Third, the assessor creates several scenarios (realistic case, worst case, change in the nature of violence) and applies this theory in order to discuss the possible outcomes.

The case of Kujtim F.

Kujtim F. was of Albanian origin and held both the Austrian and Northern Macedonian citizenship. He was born in Austria in 2000 and grew up there. His family seemed inconspicuous and not radicalized according to neighbors.

He started to become more interested in Islam during adolescence and, by the end of 2016, he started to visit a radical mosque. Besides, he reportedly showed an increasing alienation from his social context at home and at school while at the same time he became more involved in radical networks. Under these circumstances he presumably grew the desire to leave Austria. Later on, he said that he had wanted a better life, his own flat and income in the “Islamic State”.

However, he failed twice to reach Syria.[8] For August 2018 he had booked a flight to Kabul but did not have a visa for Afghanistan and two weeks later he made it only to a safehouse of IS in a Turkish border town close to Syria. Before he was able to cross the border, the Turkish police had arrested him in September 2018. After four months in prison he was deported back to Austria in January 2019.[9] In April 2019 he was convicted to 22 months of imprisonment but already in December 2019 he was released on parole for a supervision period of three years (see for explanation[10]).

After release, Kujtim F. went on living with his family in social housing of the municipality of Vienna.

In July 2020 he drove to Bratislava with the car of the mother of a known Islamist and tried to buy ammunition for a Kalashnikov.[11] Although the Slovak authority NAKA reported this to the Austrian police, no measures were taken and neither was this information forwarded to the judge, the prosecution or the probation office.[12] In the end, he managed to obtain weapons and ammunition which he stored in his room.

On November 3rd, the Austrian police was supposed to carry out a raid in the radical scene but the plan was allegedly leaked to the Islamists.[13] Just before the raid, on November 2nd, 2020 Kujtim F. posted a photo on Instagram with the weapons he was about to use and wrote part of a pledge of allegiance to the “Islamic State”.[14] Then he executed his plan in the evening.


Based on the publicly available information, an assessment performed before the attack would have looked as follows. As with most extremists, judging the biography VERA-2R yields high scores on the items “Commitment to ideology that justifies the use of violence”, “Rejection of democratic society and values”, “Lack of empathy and understanding for those outside one’s own group”, “Personal contact with violent extremists” or “Susceptibility to influence, control, indoctrination” – just to mention the most striking ones. But additionally, he scored high on the item “Expressed willingness and/or preparation to die for a cause or belief”. Thinking back of his initial terrorist crime, an individual who was ready to fight and even to die had only two options: going to Syria or carrying out an attack. As in his case he saw the “Islamic State” as a utopic promised land, a “pre-stage” to paradise, he tried to get there. When he was stopped, he got frustrated[15], angry[16] and with only one option left: carrying out an attack.

On the other hand, judging his release conditions, one can identify two protective factors: item  “Participant in programs against violence” because he was under supervision by a probation officer and received a faith-based intervention by the organization Derad which indeed seems more effective among young violent extremists than among older and religiously more educated subjects[17]; and the item “Support from family members, other important persons for non-violence” as his family was known not to be radicalized.

As his Austrian citizenship was not revoked and as it was anyway more realistic that he would remain in Austria, scenarios in Vienna needed to be considered. An attack scenario could have come to mind as only last December another jihadist in Austria who had also tried twice to reach Syria unsuccessfully, had planned to attack a Christmas market in Vienna. Fortunately, a prison cell mate reported the plan.[18]

Other potential scenarios could have included a change in the nature of violence meaning for example that he would engage in recruiting or – a positive scenario – in which he would become deradicalized in a joint effort of the probation service, Derad and his family. The recruiting scenario would have seemed less likely due to his young age, missing theological background and missing status due to the failure to reach Syria himself. Furthermore, he seemed rather like a follower. As the positive scenario included supervision, interventions and family support, Kujtim F. was released.

However, when in July Slovak authorities reported to the Austrian police that Kujtim F. tried to purchase ammunition in Slovakia, it was clear that he was preparing an attack and the execution was potentially imminent.[19] At this point immediate action was necessary. Unfortunately, the intelligence service neither processed nor forwarded the information to the judge, the prosecution or the probation office. On the day of the attack, Kujtim F. implicitly announced the attack on Instagram[20], a frequent warning behavior.[21]


There are many jihadists with a similar risk profile as many individuals were stopped before reaching Syria. This special group requires more attention. Furthermore, one must not forget about those who returned from the “Islamic State” and have gained experience there. Many radicalized individuals are still embedded in local and international networks and so was the attacker. It was his network which supported him in acquiring the weapons. So far, 16 individuals have been arrested.

The case of Kujtim F. clearly points out the potentials and weaknesses of the current risk management procedures. Risk management consists of (1) acquiring sources to get relevant information, (2) the flow of information, (3) risk assessment and (4) action.

The Austrian authorities have sources to get relevant information. The Slovak Republic reported the attempted purchase of ammunition. And the attempted terrorist attack of last December was prevented due to Austria’s system of prison intelligence and dynamic security, meaning the establishment of an atmosphere in prison that stimulates the exchange of information from prisoners to officers.[22]

On the other side, the flow of information across the different authorities or agencies needs to be improved in Austria. Italy, Germany and Belgium for instance use fusion centers where information from different sources is gathered and assessed.[23] This model implies the participation of various experts which is important especially in risk assessments conducted in prison and probation settings where the assessor is in regular close contact with the individual. Such contact might lead to biases or enable an individual to manipulate the assessor.

In order to conduct state-of-the-art risk assessment, the Austrian Ministry of Justice is implementing VERA-2R with internal and external experts. It can be concluded that if the flow of information had worked, the attack could have been predicted and prevented.

In this regard, it is worth mentioning that the head of Vienna intelligence, following the great disappointment rising in the public opinion, is currently suspended from office and a commission will be set up to investigate the events.

[1] Pressman, Duits, Rinne & Flockton (2018). Violent Extremism Risk Assessment Version 2 Revised. Utrecht: NIFP.

[2] Meloy, J. R., Roshdi, K., Glaz-Ocik, J., & Hoffmann, J. (2015). Investigating the individual terrorist in Europe. Journal of Threat Assessment and Management, 2(3-4), 140-152.

[3] Logvinov, Michail (2019). Risikobeurteilung extremistischer Radikalisierung und Gewalt, SIAK-Journal − Zeitschrift für Polizeiwissenschaft und polizeiliche Praxis (3), 51-64, http://dx.doi.org/10.7396/2019_3_E.

[4] https://wien.orf.at/stories/3073824/

[5] https://www.nzz.ch/zuerich/terror-in-wien-zuercher-sondereinheit-verhaftet-zwei-maenner-ld.1585097?reduced=true

[6] https://www.france24.com/en/europe/20201103-islamic-state-group-claims-responsibility-for-vienna-terrorist-attack-without-providing-evidence

[7] Hart, S. D., & Logan, C. (2011). Formulation of violence risk using evidence-based assessments: The structured professional judgment approach. In P. Sturmey & M. McMurran (Eds.) Forensic case formulation, 83-106. Chichester, UK: Wiley-Blackwell.

[8] https://www.nau.ch/news/europa/attentater-von-wien-20-galt-als-lieber-bub-und-war-fussballer-65814363

[9] https://kurier.at/chronik/wien/nach-terroranschlag-werden-radikale-moscheen-geschlossen/401089305

[10] He was released seemingly early because the pre-trial detention was recognized as part of the prison sentence and because the judge can only place a convict under supervision if he is released early. This way, a three-year period of probation can be imposed on the individual. A reason that influenced the duration of the sentence and the treatment is the assumption that a failed attempt is less serious than an executed crime. However, from a risk assessment point of view, it can even be the opposite.

[11] https://kurier.at/chronik/oesterreich/anschlag-in-wien-14-verdaechtige-in-u-haft-mehrere-terrorverdaechtige-dabei/401087409

[12] https://www.vienna.at/anschlag-in-wien-opfer-koennen-wohl-republik-klagen/6799208

[13] https://www.diepresse.com/5892657/mit-attentat-einer-razzia-zuvorgekommen

[14] https://www.blick.ch/news/ausland/verdaechtiger-kuendigte-tat-auf-instagram-an-ist-dieser-dschidhadist-einer-der-attentaeter-von-wien-id16175820.html

[15] TRAP-18 Distal characteristic 3 “Failure to Affiliate with an Extremist Group”, frustration-aggression hypothesis

[16] VERA-2R item “Expressed emotion in response to perceived injustice”.

[17] Hofinger, V., & Schmidinger, T. (2017). Deradikalisierung im Gefängnis. Endbericht Zur Begleitforschung, Retrieved November 7 th, 2020 from https://www.irks.at/publikationen/studien/2017/deradikalisierung-im-gef%C3%A4ngnis.html.

[18] https://www.derstandard.at/story/2000112348502/terror-anschlaege-in-wien-geplant-drei-tschetschenen-in-haft

[19] Smith, B. L., Roberts, P., & Damphousse, K. R. (2016). The Terrorists’ Planning Cycle: Patterns of Pre‐incident Behavior. The Handbook of the Criminology of Terrorism, 62-76.

[20] https://www.kleinezeitung.at/oesterreich/5891547/Tat-auf-Instagram-angekuendigt_USSeite-zitiert-Aussage-eines

[21] Meloy, J. R., & Gill, P. (2016). The lone-actor terrorist and the TRAP-18. Journal of Threat Assessment and Management, 3(1), 37-52.

[22] UNODC (2015). Handbook on Dynamic Security and Prison Intelligence. Criminal Justice Handbook Series. New York: United Nations.

[23] van der Veer, R.,Bos, W., & van der Heide, L. (2019). Fusion Centres in Six European Countries: Emergence, Roles and Challenges, Retrieved November 8th, 2020 from https://icct.nl/app/uploads/2019/02/ICCT-VanderVeer-Bos-VanderHeide-Fusion-Centres-in-Six-European-Countries.pdf.