What the Ontology Shows: A Statistic Sees 22 Target Types. A Hierarchy Suggests Two Kinds of War., 1970-2020

A statistic sees 22 target types. A hierarchy suggests two kinds of war.

Two thirds of the shifts a changepoint detector finds in fifty years of terrorism data are gaps in the reporting. Thirty survive. Some of those groups changed what they attack; others changed only how. That split is real but fragile: it depends on how you decide which targets belong together.

We built a formal ontology over fifty years of coded terrorism incidents to find out whether a group’s change in tactics is detectable in the public record before anyone announces it. It is, and the model reported 97 such moments. Sixty-seven were false. The database is assembled from press reports, so when coverage of a group thins out, or stops recording what weapon was used, or shifts from one country to another, the numbers move even though nothing about the group has changed, and a detector reads that as a change in tactics. These false signals cluster at the top of any ranking by size, so the most dramatic-looking findings are reliably the emptiest. Filter them and 30 remain, which hold up where we checked them against the historical record: a Spanish group pivoting to extorting businessmen, a Colombian one escalating attacks on oil pipelines for leverage before peace talks. That is the finding this piece defends. Section 6 asks a further question, whether those 30 divide into groups that changed what they attack versus only how, and reports both a suggestive answer and the reasons we do not think it is yet load-bearing.

Thirty breaks, twenty-three groups, fifty years.

Each point below is a group-year where the model detected a structural shift in operational signature that rests on real data: at least ten recorded incidents in both the year of the break and the year before it. Note the vertical range. Nothing survives above 0.78, and the largest, most active organizations cluster low, between 0.06 and 0.24. Before filtering, this chart ran all the way to 1.0, and those maximum-magnitude points were the emptiest.

Sixty-seven false positives, and why each one fooled the model.

Each of these is a known property of press-derived event data, described in GTD’s own documentation. What follows is what happens when a detector is run without accounting for them. Each has a mechanism, each is testable, and each will recur in any event dataset assembled from press reporting.

Each of these produces a large, confident, entirely false result. All three are invisible if you look only at the magnitude score, and all three are obvious the moment you look at the underlying counts.

ELN, 2014: escalation as leverage.

Colombia’s ELN shows a detected break in 2014 (magnitude 0.43). Its signature tactic, explosives against utilities, barely moves (21% to 23%), but the composition around it shifts toward police and military targets, and recorded incidents rise from 34 to 184 across the surrounding three-year windows.

The context is documented. Colombia’s Ministry of Defense recorded 259 pipeline attacks in 2013, close to 20% above the previous year, and from 2014 pipeline attacks began to be accompanied by sniper attacks on workers. Through this period the ELN was manoeuvring for its own negotiations while the FARC’s Havana talks approached a conclusion, and analysts describe the group using attacks on oil infrastructure and kidnappings to strengthen its hand at the table. The break is real, and it is a negotiating posture rather than a change of doctrine.

Signatures are reasoner-verified, not self-asserted.

The pipeline never writes “this is a signature.” It writes the raw facts, weapon and target, and an independent reasoner decides whether those facts satisfy a formal definition. Below is one real record from the two graph files the pipeline produces, before and after that reasoning step. The only line that differs is the one HermiT added.

gtdo:sig_Tupac_Amaru_Revolutionary
_Movement__MRTA_0
    a owl:NamedIndividual ;
    gtdo:frequency 167 ;
    gtdo:involvesWeapon
        gtdo:weapon_Explosives ;
    gtdo:targets
        gtdo:target_Business .

gtdo:sig_Tupac_Amaru_Revolutionary
_Movement__MRTA_0
    a gtdo:OperationalSignature,
        owl:NamedIndividual ;
    gtdo:frequency 167 ;
    gtdo:involvesWeapon
        gtdo:weapon_Explosives ;
    gtdo:targets
        gtdo:target_Business .

OperationalSignature (defined class)

Not a primitive type we assert. An OWL equivalentClass restriction: any individual satisfying both involvesWeapon some WeaponType and targets some TargetType is classified into it by the reasoner.

SignatureEpoch

A time-bounded interval during which a group’s distribution was stable, reified with validFrom / validUntil so breaks are queryable graph objects rather than rows in a table.

SPARQL cross-group convergence

A query joining PerpetratorGroup → exhibitsSignature → involvesWeapon/targets surfaces tactic pairs shared by groups with no other apparent connection in the data.

The limits of this, stated plainly.

• We did not perform causal inference. The model locates the year a distribution changed shape. Why it changed, whether strategy, leadership, resources, or pressure, is established case by case from sources outside the data.
• Two of thirty surviving breaks have been researched in depth. Both hold up. The other 28 are unverified. We are not claiming they are all real, only that they are not disqualified by the failure modes we can test for.
• The 10-incident floor is a judgement, not a derived constant. It is defensible and we show our reasoning, but a floor of 5 or 20 would produce a different count. The finding that most unfiltered breaks come from the reporting is robust to that choice; the exact number 30 is not.
• The headline count depends on parameters we chose. The number of surviving breaks ranges from 10 to 69 across defensible settings of the two main knobs: the per-year incident floor (5, 10, 20) and PELT’s penalty (1.0, 1.5, 2.0). Our reported 30 is the middle cell of that grid, not a fact about the world. The direction of the main finding is stable, most unfiltered breaks are reporting artifacts at every setting, but the specific count is not.
  floor  pen=1.0  pen=1.5  pen=2.0
     5      69       40       21
    10      43      30       17
    20      20       15       10
• The posture classification in §6 is exploratory. It fails three of four robustness checks we ran on it, and we report those failures there rather than in a footnote. It is included because the approach is worth pursuing with better validation, not because the 13/17 split is a result we would defend.
• Absence of an explanation is not evidence of a discovery. If a break has no obvious documented cause, the likeliest reason is that we did not find the source, not that none exists. GTD is built from press reporting, so a shift large enough to detect is usually a shift someone wrote about at the time.
• Every earlier version of this analysis was wrong. Before the sample-size floor, this piece led with a case, MRTA in 1996, that rested on one incident in the break year and five the year after. It did not survive filtering. That case is now excluded, and we mention it here because the failure is the point.

All 232 profiled groups, live.

Everything above is an argument built from this dataset. Below is the dataset: every group meeting the 50-incident threshold, its tactic co-occurrence network, and its break timeline where one survived the filter. Most groups will show no breaks, which is the corrected result.

An instrument, and its calibration.

A coded incident database read as a spreadsheet tells you what happened. Read as a formal knowledge graph with a reasoner over it, it tells you when a group’s behaviour changed shape. The harder and more useful result is knowing when it is lying to you: two thirds of the changes this method appears to find are properties of how the data was collected, not of the world it describes.

That distinction transfers. Any corpus assembled from reporting, whether conflict events, sanctions actions, court filings, or procurement records, carries the same three failure modes, and the same filters apply. The value here is not a finding about terrorism. It is a tested instrument and a known error profile, ready to be pointed at a corpus where the underlying events were never covered by anyone.