Trump’s “I Guess” Signals the Terror Factory Is Back

Trump’s “I guess” answer on Iran retaliation risk is already activating the security machine that manufactures the plots it claims to stop.

Trump Normalizes Fear of Domestic Attack

In the first week of the escalating conflict with Iran, Donald Trump was asked whether Americans should worry about retaliatory attacks at home. His answer was blunt: “I guess.” The remark was not delivered as warning or strategy. It sounded casual. But statements like that normalize the expectation that violence might soon reach domestic soil. Once that expectation enters public discourse, the familiar machinery of national security politics begins to move. Media outlets run stories about sleeper cells and lone-actor threats. Intelligence agencies warn of potential retaliation. Politicians discuss expanded surveillance powers and stronger domestic counterterrorism tools.

This pattern has repeated so often over the past two decades that it has become a governing reflex. War abroad produces fear at home. Fear produces political support for stronger security powers. And those powers lead to a steady stream of terrorism arrests that appear to confirm the severity of the threat. This cycle is the central subject of Trevor Aaronson’s Terror Factory investigation. The investigation argues that much of the post-9/11 counterterrorism apparatus does not simply uncover plots. In many cases, it creates them. The pattern was already visible before the current conflict: charges against a Pakistani national alleged to have Iranian ties in a Trump assassination plot arrived during a prior escalation cycle, fitting the same template of timely arrests tracking geopolitical tension.

FBI Built 15,000-Informant Network in Muslim Communities

After September 11, the FBI shifted from reactive law enforcement to preemptive counterterrorism. Instead of waiting for attacks to occur, investigators began searching for individuals who might be willing to commit them. By the early 2010s, the bureau had developed a network of fifteen thousand confidential informants, the largest in its history. Many operated inside Muslim communities across the United States. Mosques, student groups, and social networks were routinely monitored through individuals working with federal investigators.

The informants themselves often had powerful incentives to cooperate. Some were paid substantial sums. Others faced criminal charges and agreed to assist in exchange for reduced sentences. Some were immigrants concerned about their legal status. Because their compensation or legal benefits depended on producing useful information, the system created an incentive structure that encouraged informants to generate cases rather than observe potential threats. In many cases, informants did far more than report suspicious behavior. They played central roles in constructing the plots that eventually led to arrests.

Sting Operations Follow a Predictable Script

A pattern appears repeatedly in domestic terrorism prosecutions. First, investigators identify a target, often someone who has expressed anger toward U.S. foreign policy or sympathy for extremist groups online. In many cases, the person is socially isolated, financially desperate, or psychologically unstable. Second, an informant or undercover agent approaches the individual, posing as a representative of a terrorist organization. Third, the undercover operative introduces the idea of a specific attack. The suspect may initially express general hostility toward the United States or its policies, but the operational plan emerges during conversations with the informant.

Fourth, investigators provide the tools needed to carry out the plot. These can include weapons, explosives, transportation, or money. Finally, the suspect is arrested at the moment he attempts to execute the attack, using weapons or explosives that are secretly controlled by law enforcement. The arrest is then announced as a successfully foiled terrorist plot. This pattern appears in dozens of cases prosecuted after 9/11. The result is a steady flow of dramatic arrests that appear to demonstrate the constant presence of domestic terror threats. Yet in many of these cases, the suspects lacked the means or capability to conduct an attack on their own.

Newburgh Four: FBI Supplied the Entire Plot

One of the most controversial examples is the Newburgh Four case from 2009. Four men from Newburgh, New York were arrested for plotting to bomb synagogues in the Bronx and shoot down military aircraft. The operation had been largely orchestrated by FBI informant Shahed Hussain. Hussain approached the men, proposed the bombing plan, and offered them large sums of money to participate. The explosives and missiles used in the plot were fake devices provided by federal agents. The informant even drove the suspects to the target locations.

When the men attempted to detonate the inert explosives, they were arrested. During sentencing, the presiding judge acknowledged the unusual nature of the case, noting that the government had supplied the plot, the weapons, and the opportunity. Another widely discussed example occurred in Portland, Oregon in 2010. A Somali-American teenager named Mohamed Osman Mohamud attempted to detonate a bomb at a Christmas tree lighting ceremony. Undercover FBI agents had contacted Mohamud after he expressed extremist views online, posed as members of al-Qaeda, and worked with him to plan the attack. The bomb was an inert device provided by investigators.

Canada’s Mr. Big Tactic Uses the Same Logic

Canada has long employed a controversial policing method known as the Mr. Big technique. In a typical operation, undercover officers befriend a suspect and gradually recruit him into a fake criminal organization. The suspect participates in staged criminal activities designed to build trust. Eventually, he is introduced to the fictional crime boss known as Mr. Big. The boss explains that membership requires full honesty about past crimes. If the suspect confesses, the statement is secretly recorded and later used in court.

The technique creates enormous psychological pressure on suspects, particularly those who are lonely or financially desperate. Some cases have resulted in false confessions. Although the Mr. Big tactic is usually used in murder investigations rather than terrorism cases, the underlying logic resembles the FBI sting operations. In both approaches, investigators construct a controlled environment designed to elicit criminal behavior. Canadian terrorism investigations have also relied on extensive undercover work. The Toronto 18 case in 2006 involved a group accused of plotting attacks against government targets. Informants played key roles in monitoring the group, and police replaced the explosives the suspects attempted to purchase with harmless materials.

BC Court: RCMP Sting Was a Travesty of Justice

The most controversial Canadian terrorism case occurred in British Columbia in 2013. Two suspects, John Nuttall and Amanda Korody, were accused of plotting to detonate pressure-cooker bombs outside the provincial legislature during Canada Day celebrations. Undercover officers posing as terrorists supplied the materials used to construct the bombs and helped guide the plot. In July 2016, Justice Catherine Bruce ruled that the RCMP had entrapped the suspects. The B.C. Court of Appeal upheld the stay in December 2018, with judges describing the operation as “a travesty of justice.” The ruling remains one of the strongest judicial rebukes of a terrorism sting in Canada.

Known Wolf Problem Exposes Surveillance State Limits

Despite the scale of modern surveillance and undercover operations, real attacks still occur. Two incidents in Canada in October 2014 highlight the contradictions of the modern security system. On October 20, Martin Couture-Rouleau drove a vehicle into Canadian soldiers in Saint-Jean-sur-Richelieu, Quebec. One soldier was killed. Two days later, Michael Zehaf-Bibeau shot and killed a soldier standing guard at the National War Memorial in Ottawa before entering Parliament Hill, where he was shot by security personnel. Both attackers were already known to Canadian security agencies.

Couture-Rouleau had attracted attention because authorities believed he might attempt to travel abroad to join extremist groups. His passport had been revoked. Zehaf-Bibeau had also been flagged by authorities and had experienced delays in obtaining travel documents while background checks were conducted. Questions about how Zehaf-Bibeau moved undetected in the lead-up to the attack remain unresolved. If security services had extensive surveillance capabilities and large watchlists of potential extremists, how had CSIS missed both men despite active monitoring? Whether the Parliament Hill attack represented an intelligence failure or something more systemic was a question the security establishment never fully answered. The incidents became examples of what analysts call the known wolf problem: attackers who appear on intelligence radar but still manage to act.

Attack-to-Legislation Cycle Expands Security Powers

The political consequences of those attacks were swift. Within months, the Canadian government introduced sweeping national-security legislation known as Bill C-51. The law expanded intelligence sharing between government agencies, broadened the definition of activities that could threaten national security, and granted the Canadian Security Intelligence Service new powers to disrupt suspected threats. Critics argued that the legislation dramatically expanded surveillance and intelligence powers while weakening civil-liberties protections. Supporters argued that stronger tools were necessary to prevent future attacks.

The debate followed a familiar pattern seen in many countries. An attack occurs. Fear spreads through the public and political system. Governments introduce new security powers. Those powers are justified as necessary responses to the threat that has just been demonstrated. The same diaspora networks and community ties that intelligence agencies already surveill as potential threats — as documented in Weaponized Diaspora — become grounds for expanded monitoring during each new conflict. Today, with tensions escalating between the United States and Iran, the early stages of that same pattern are beginning to appear again.

The Security Machine Is Already Moving

The War on Terror did not end when the wars in Iraq and Afghanistan wound down. It created a permanent domestic security infrastructure. That infrastructure includes surveillance networks, informant systems, specialized counterterrorism units, and legal frameworks designed to support preemptive investigations. Once such a system exists, periods of geopolitical tension naturally activate it. Foreign conflict generates fear of retaliation. Fear legitimizes expanded security measures. Those measures produce investigations and arrests that appear to confirm the severity of the threat.

The result is a self-reinforcing cycle in which the machinery of counterterrorism continuously justifies its own expansion. The Terror Factory investigation argues that the modern counterterrorism system does not simply respond to danger. It also shapes how danger is perceived, investigated, and sometimes produced. When war abroad raises fears of retaliation at home, the system is ready to react. Informant networks expand their reach. Undercover operations search for potential suspects. Arrests are announced as evidence that attacks were successfully prevented. The known wolf problem persists in parallel: the 2025 Vancouver attacker was also reported to have been known to police before the attack occurred, extending a pattern that decades of expanded security infrastructure has not broken. Meanwhile, the CIA’s intervention in the 9/11 plea deal illustrates how deeply the security apparatus resists any accounting for what it actually knew and when. As tensions rise once again, the question is not whether that machinery still exists. It does. The question is whether the public recognizes the system when it begins to move again.

Sources