An academic paper by two Dutch CT SME 'Indicators of terrorist intent and capability: Tools for threat assessment' available now for free. Published in Asymmetric Conflict, a journal unknown to me:http://www.tandfonline.com/doi/full/...6.2015.1040426

The Abstract:
Behaviors or expressions can (inadvertently) communicate the intention or capability to commit a terrorist attack. Such pre-attack “indicators” can be used to improve police services’ ability to detect and interdict terrorist plots before they materialize. This article explores the concept of terrorism indicators by applying it to seven case studies of home-grown jihadist groups and individuals that occurred in three Western countries between 2004 and 2007. Two main findings are presented: a framework that conceptualizes the pre-attack process as consisting of seven distinct phases and, divided over these phases, a multitude of possible indicators of terrorist intent or capability. The run-up to a terrorist attack is found to be multipronged and chaotic rather than a neat linear progression through distinct preparatory stages. This may be characteristic of the loosely organized and relatively amateur nature of the home-grown jihadist groups and individuals studied.