Closing the Stable Door: Why Europe Must Rethink Violent Unrest

You cannot stop a stampede by closing the stable door after the horses have bolted.

It is an old expression, but one that captures a very modern national security challenge.

When violence erupts in the streets, the response is immediate and visible. Police are deployed, emergency measures are considered, political leaders issue statements, and public attention turns to restoring order.

These responses may be necessary. But they also raise a question that deserves far more attention: What happened before the violence began?

What warning signs were visible? What tensions were building? How did narratives spread, gain momentum, and influence behavior? And most importantly, was there an opportunity to intervene before the situation reached the point of confrontation?

Recent episodes of unrest across parts of Europe bring these questions into focus. They also point to a broader challenge that extends well beyond Europe: the gap between our ability to respond to violent incidents and our ability to understand and address the processes that lead to them.

The challenge begins long before the first confrontation

Violent unrest rarely emerges in a vacuum.

Behind major escalations, there is often a combination of genuine grievances, economic pressures, social tensions, political frustration, competing narratives, and a growing sense of distrust.

These conditions do not automatically lead to violence. In democratic societies, public anger, protest, and disagreement are legitimate forms of political expression. They are not, in themselves, security threats.

But within these environments, other dynamics can emerge.

False information may spread rapidly. Provocative narratives can intensify existing tensions. Individuals or networks may deliberately encourage confrontation. Online communities can amplify messages, reinforce grievances, and accelerate mobilization.

Sometimes these developments are spontaneous. Sometimes they involve coordinated efforts. Often, the reality is more complicated than either explanation alone.

The task of intelligence is not to treat public dissatisfaction as a threat. It is to distinguish legitimate civic activity from credible indicators that a situation may develop into violence.

That distinction requires judgment, context, and an understanding of the environment in which events unfold.

Between the screen and the street

One of the most important national security questions today is what happens between the digital environment and the physical world.

How does an online narrative move from a discussion to a call for action?

Who is spreading it? Through which channels? To which audiences?

What causes a message to gain traction? What role do influential individuals, organized networks, or rapidly developing events play in shaping public behavior?

And at what point does legitimate mobilization begin to show credible signs of possible violent escalation?

The relationship between online activity and real-world events is neither simple nor automatic.

A viral post does not necessarily lead to violence. A large online following does not automatically translate into people taking action. And not every aggressive statement represents a credible threat.

This is precisely why effective analysis requires more than monitoring social media or identifying trending hashtags.

It requires the ability to understand narratives, their context, the actors involved, patterns of amplification, and their relationship to developments on the ground.

Digital information must be examined alongside other sources of intelligence, local knowledge, emerging events, and changes in behavior.

The objective is not to predict every protest or every confrontation. That would be unrealistic.

The objective is to recognize meaningful changes in risk early enough to support better decisions.

From collecting intelligence to creating operational capability

After nearly two decades of building and leading intelligence and operational teams, I have learned that collecting information is rarely the most difficult part of the mission.

The real challenge is understanding what the information means, determining what matters, and translating that understanding into timely, coordinated action.

Organizations can collect enormous amounts of data and still fail to recognize an emerging threat.

They can produce sophisticated intelligence assessments without ensuring that the people responsible for decisions receive clear, actionable conclusions.

They can identify warning signs without having an established process for deciding what should happen next.

And they can invest heavily in technology without building the organizational capability required to use it effectively.

This is not simply a technology problem.

It is a problem of integration, leadership, responsibility, and execution.

Intelligence must connect to decisions. Decisions must connect to operational capabilities. And operational capabilities must be able to act within clear legal, institutional, and ethical boundaries.

Without these connections, early warning risks becoming little more than an accurate description of a crisis that was already unfolding.

The missing capability is not another dashboard

Much of the discussion around emerging threats focuses on technology: artificial intelligence, automated monitoring, data analytics, and increasingly sophisticated tools for identifying patterns.

These technologies can provide substantial value.

But technology is only one part of the solution.

What is often missing is a permanent, multidisciplinary capability that brings together intelligence professionals, digital analysts, behavioral and social expertise, decision-makers, communication specialists, and operational authorities.

Not a temporary task force assembled after a crisis.

Not another report distributed across multiple organizations.

And not a collection of disconnected tools.

Rather, a standing system designed to understand the environment, identify credible warning signs, support decisions, coordinate lawful preventive action, and continuously evaluate results.

Such a capability should be built around five essential functions.

1. Understand the environment

Effective prevention begins with understanding the underlying conditions.

What grievances are shaping public sentiment? Which narratives are gaining influence? What events may intensify existing tensions? Who are the relevant actors, and what roles do they play?

This requires more than technical analysis.

It requires human expertise, local context, cultural understanding, and the ability to distinguish genuine public concerns from attempts to exploit them.

2. Recognize escalation early

Early warning should focus on meaningful changes in risk rather than the volume of online activity alone.

Relevant indicators may include explicit threats, credible calls for violence, preparations for confrontation, or significant changes in behavior.

No single indicator should automatically trigger a security response.

The value lies in combining multiple sources, assessing their reliability, understanding uncertainty, and identifying when developments justify closer attention or preventive measures.

3. Connect the digital and physical environments

The online and offline worlds cannot be analyzed in isolation.

A narrative may gain momentum online while events on the ground develop in a different direction. Conversely, a local incident can rapidly reshape digital conversations and intensify tensions far beyond its immediate location.

An effective system must connect these developments without assuming that online attention necessarily predicts physical action.

This connection is central to understanding how risks evolve and where intervention may be useful.

4. Turn warning into lawful preventive action

Intelligence has limited value if it does not influence what happens next.

Depending on the circumstances, preventive measures may include better coordination between responsible authorities, protection of vulnerable locations, engagement with relevant community representatives, or timely public communication that addresses false claims and reduces uncertainty.

Credible communication is particularly important.

When misinformation spreads, silence can leave a vacuum. But an effective response must be factual, transparent, and trusted by the people it seeks to reach.

The goal should never be to suppress legitimate criticism, peaceful protest, or political disagreement.

It should be to address credible threats, counter incitement to violence, and reduce the risk of harm while respecting democratic rights.

5. Measure, learn, and adapt

Prevention is difficult to measure.

When violence does not occur, it can be tempting to claim that an intervention succeeded. But the absence of an incident does not prove that a particular action prevented it.

That is why a serious national capability must include continuous evaluation.

Were warning signs identified in time? Were assessments accurate? Did information reach the right decision-makers? Were actions proportionate and effective? What unintended consequences emerged?

Just as importantly, did the system protect legitimate public expression while addressing genuine security risks?

These questions are essential to improving performance, maintaining public trust, and avoiding the false confidence that can come from technology alone.

A different measure of national preparedness

Governments understandably devote considerable attention to their ability to respond to emergencies.

Response time, operational readiness, coordination between agencies, and the ability to restore public safety are all important measures.

But they are not sufficient.

A mature national security system must also ask what it could have understood earlier and what opportunities existed to reduce the risk before an incident occurred.

That requires moving from an incident-centered mindset to a capability-centered approach.

It means treating intelligence, technology, communication, decision-making, and operational execution as parts of one connected system rather than separate activities.

It also requires recognizing that prevention is not about eliminating uncertainty or promising that every act of violence can be predicted.

No intelligence system can do that.

The objective is more practical, and ultimately more valuable: improving the ability to recognize credible risks, make informed decisions, and act responsibly while there is still time to make a difference.

Before the horses bolt

When violence breaks out, governments are judged by how quickly they respond, how effectively they protect the public, and how soon they restore calm.

They should be.

But we should also ask a harder question:

Could the warning signs have been recognized earlier? Could the relevant organizations have connected the dots? And could timely, lawful action have reduced the likelihood of violence?

These are the questions that should shape the next generation of national security capabilities.

Because intelligence alone does not prevent violence. Neither does technology.

Prevention depends on the ability to connect information, judgment, decisions, and action before a developing threat becomes a crisis.

The goal is not to become better at closing the stable door after the horses have bolted.

It is to recognize the danger, act while there is still time, and prevent the stampede.