Studying Police Files with Grounded Theory Methods to Understand Jihadist Networks

This article focuses on a challenge in the current terrorism literature, namely the methodological justi ﬁ cation concerning the collection and analysis of empirical data. Lack of detailed methodological accounts of the collection and analysis of the data makes it dif ﬁ cult to evaluate presented ﬁ ndings, especially if these data are con ﬁ dential or focused on speci ﬁ c aspects of the phenomenon. This article offers an extensive overview of the methodological procedures conducted in a large empirical research project on jihadist networks based on con ﬁ dential police ﬁ les (2000 – 2013), interviews, and trial observations. The article illustrates how grounded theory – based methods can be used to collect and analyze such data and to develop and test new theories in this research ﬁ eld. We found that “ ideological information sharing ” was not an independent category. When we compared it with several other preliminary categories, like “ establishing brotherhood ” and “ boasting, ” we found that together these categories actually embodied a larger concept or category, which we called “ encouraging involvement. ” This category stands for a process that supports a new recruit to remain associated with a jihadist movement, and the preliminary categories became sub-categories or properties of “ encouraging involvement. ” One should notice that each higher coding level becomes a more abstract term that covers a broader mechanism or process in comparison to the lower level codes and incidents . 59

The stream of academic publications on terrorism and radicalization has rapidly grown over the last two decades and several scholars have provided thorough reviews of the adopted approaches and applied methods over the years. 1 Some academics argue that the field of terrorism studies has developed positively, 2 whereas others sound a note of warning about the status quo of terrorism studies. 3 The following section reviews the main arguments of both strands and builds on this by introducing an important challenge in this field, namely the methodological justification. Although not at the center of the preceding discussions, clarity on methodological choices concerning the collection and analysis of empirical data definitely deserves more attention in terrorism research. In this article we highlight the necessity of this information and encourage researchers to incorporate sufficient information about the data collection and the methods applied when presenting their research findings. In a large study on the development of the jihadist movement, we used classified police files from the period 2000 to 2013, and additional interviews and trial observations as data sources. We will show how we used grounded theory methods to systematically collect and analyze these complex data, and how this combination of data and methods led to new insights in this research field.
these studies. To illustrate, several academic studies that (claim to) use extensive empirical data did not include separate methodology sections in their papers, or omitted an account of the empirical strategy that was used to conduct the research. 23 If the methodology section is present, it sometimes only gives an account of the source of the data. An explanation on the data collection, the inclusion criteria used to select relevant data, and the number of documents or data sources analyzed is not always present. 24 More importantly, procedural and analytical steps underlying research findings and conclusions are not always accounted for. 25 Coding efforts are, for instance, often unspecified, in spite of their essential role in qualitative analysis. Apart from the presence or absence of a methodological section, it is also important to be clear about the foundation of a particular finding when reporting results. Too often it is unclear whether a finding or conclusion is supported by multiple sources and whether the data contain sufficient evidence to draw such conclusions. For example, some scholars repeatedly refer to an "interview with confidential source" without numbering these interviews. 26 As a result, the reader does not know whether information comes from the same source, or from multiple respondents.
Insufficient clarity about the methods and analytical tools has important implications. When it remains unclear how scholars analytically arrive at their conclusions, it is difficult to assess the scope, reliability, and validity of these conclusions. Foremost, it may impede the development of high-quality terrorism research. Because the devil is in the detail, the reader may be unable to evaluate a study on its genuine merits and may raise the question whether scholars have indeed analyzed their data with rigor. In other words, the findings could come across as selective and subjective. It can also lead to insufficient practical utilization of higher quality research if policymakers have little confidence in the results. In the same vein, less well-designed research can be over-evaluated, which can lead to supposedly evidence-based countermeasures that do not fit the addressed phenomenon well in reality. Although we acknowledge that methodological justification has increased significantly over the years, it is still not a given fact. We believe that reporting on the actual methods used, needs to become common practice to get terrorism research in position to shape the debate, both in academia and in society.

Grounded Theory
To illustrate how this could be done, even with confidential data, we offer a transparent overview on how we conducted our research in a large research project on jihadist networks in the Netherlands (2000)(2001)(2002)(2003)(2004)(2005)(2006)(2007)(2008)(2009)(2010)(2011)(2012)(2013). We will elaborate on specific analytical steps, derived from Grounded Theory (GT) methods, which were taken to study classified police files. In general, GT methodology offers suitable analytical tools to conduct systematic analysis of complex qualitative data, and has been successfully applied by several scholars in the field of terrorism studies. 27 GT methodology aims to generate a theory that is built on theoretical concepts or categories that emerge from the data and is particularly suitable for explorative research.
A key strength of GT methods is, in the words of Bryant and Charmaz, 28 that it offers a "foundation for rendering the processes and procedures of qualitative investigation visible, comprehensible, and replicable." At the core of this foundation are two basic principles, which are constant comparative analysis and theoretical sampling. 29 The former involves the continuous comparison between data and emerging concepts during each stage of the research. The latter refers to the process where preliminary findings from initial data gathering uncover tentative concepts, which in turn direct the collection of new independent data. This additional data is then used to validate or falsify the initial concepts that emerged from the original dataset. This article aims to offer clear analytical insights by reporting extensively about the procedures that need to be conducted to adhere to these two basic principles. These procedures are sampling, coding, categorizing, memo writing, and theorizing, which need to be conducted simultaneously and continuously throughout the research. 30 Thoroughly carrying out these procedures will aid the systematic data analysis, which is considered a primary and essential feature of GT methodology. 31 Theoretical statements that are generated without regard for systematic data collection and analysis are considered "immaculate conjectures." 32 Indisputably, transparent and systematic analyses are not exclusively assigned to GT methods, and we neither claim that GT methods are more transparent than other qualitative methods, nor that they are better analytical tools. Yet, we favored GT methods in this research project because the underlying methodological or epistemological foundation best matched the research goals of this project. In this research project we were not so much interested in the why of jihadist behavior, but more in the how. We aimed to understand how jihadist networks operate and how this changed over time. Moreover, we sought new insights and the development of new explanatory models. To reach this explorative goal, we prefer an approach that allows gathering data with an open mind than being bound by predetermined theories. This is the cornerstone of GT. To illustrate, Glaser and Strauss 33 introduced GT as a response to the dominant positivist epistemology of their time. They questioned the deductive approach that solely focused on the verification of prior assumptions and hypotheses derived from existing theories. 34 Instead, Glaser and Strauss supported an inductive approach that aims to generate a theory built on theoretical concepts or categories that emerge from the data. This approach ignores prior assumptions and neglects the use of hypotheses. The reason for this, they stated, is that researchers should be able to generate theories on their own, instead of becoming "proletariat testers" of the "theoretical capitalists." 35 Since this matches our research interest, we favored GT methods over deductive alternatives.
There is not just one absolute GT though. Diverging perspectives on the analytical procedures, for instance, ended the collaboration between Glaser and Strauss. 36 Furthermore, new versions of GT were developed and a distinction was made between Glaser and Strauss's objectivist and Charmaz's constructivist GT methodology. This resulted in different perspectives on the ideal GT end-product. Nonetheless, the different schools all share a similar methodological process and all conduct similar analytical procedures to generate their theories. 37 We are primarily focused on the use and usefulness of these common procedures in terrorism research. Hence, we do not strictly follow one of the three approaches, although the methods applied in the research project are nonetheless more in line with Charmaz's constructivist approach. The reason for this is that, unlike the objectivists, we acknowledge that our findings are not necessarily objective facts, but are interpretations of documents and reflections from the respondents. Moreover, based on these interpretations and reflections, we have developed particular ideas and conceptualizations that could not have emerged from the data without our interference. Unlike the objectivists' opinion, we can therefore not be seen as completely neutral observers who inductively discovered particular concepts directly from the data. 38 Also, unlike the objectivist GT, we are not aiming to develop formal theories. Rather, we seek new insights that might explain or illuminate the situation studied, but these insights do not necessarily have to be developed into general theories that clarify other situations. In the same context, we also do not aim to develop a core category that summarizes all observations into a single explanation because we acknowledge that there is probably more than one. Hence, we focus on more categories or mechanisms in the various studies of this research project, which is more in line with Charmaz's constructivist approach.

Data Collection
Since we aimed to answer broad and explorative research questions about how jihadist networks operate in the Netherlands and how their modus operandi developed over time, we needed rich data sources that could offer insight into such processes.

Police Files
To see how jihadist networks operate, the ideal method would probably be a form of participant observation. However, because jihadist networks are covert and clandestine, it is highly questionable whether the network participants would cooperate. 39 Moreover, safety would be an issue and many ethical issues would arise. We therefore directed our focus towards a qualitative document analysis of Dutch police files and court files. Such files yield highly valuable but foremost rich information that could fulfill our broad research needs. As other terrorism scholars have indicated as well, 40 the thickness of information in police files and court documents is unprecedented. The police files contain the original wiretaps of both telephone and Internet communication, recordings of in-house communication, transcripts of suspect interrogations, witness statements, observation reports, forensic reports, reports of house searches, expert-witness reports, but also (when archived correctly) the complete and verbatim court transcripts and lawyers' pleas. The police files contain extensive information on the operational aspects of clandestine networks, because the police can unobtrusively follow and observe the participants of these networks without their knowledge, which bypasses the need for cooperation. 41 Furthermore, since the files we studied covered a longer time-frame, we were able to look for possible developments. Nonetheless, since the use of these types of data also comes with limitations (see "Limitations" below); we do not claim that such files are better than other kinds of (open) sources. It rather matches our research interests. The raw observation material in the files, for instance, enabled us to monitor how people behave and communicate with each other. 42 This is an empirical advantage that is hard to attain on the basis of media reports or even direct interviews. Moreover, police files yield more complete information than the excerpts from court transcripts that are often found in the media or online. The information in these police files concerns the underlying data on which criminal investigations and court cases are built. To conclude, police files render useful primary data according to GT, since they are suitable to portray empirical events. 43 In total we had access to 28 voluminous police investigations that focused on jihadi terrorism between 2000 and 2013, which led to 19 official criminal cases that were sent to the Dutch Public Prosecution Service (as several police investigations were merged into one criminal case). In these 19 criminal cases we identified 14 jihadist networks, which means that-contrary to the police-we merged criminal cases if they focused on the same network. 44 In addition, we conducted the collection of data from these police files in accordance with the basic principles of GT methodology, because we collected the data during different periods. The first tier of data, which yielded 12 police investigations (or 7 criminal cases), was collected between May 2006 and May 2008. 45 Based on preliminary findings from the first tier, a second tier of data was gathered between July 2012 and December 2013, which initially resulted in 10 police investigations. However, due to the eruption of the Arab Spring, the emergence of particular categories, and the uncertainties of a criminal case, we decided to add six additional police investigations at a later stage. As a result, we analyzed a total of 16 police investigations (or 12 criminal cases). At the same time, this dispersed data collection allowed us to adopt a longitudinal perspective. The first tier of data covered the period 2000-2005, while the second tier of data eventually covered the period 2005-2013. Table 1 shows how the various criminal cases are spread over the different years. Based on these data we were able to analyze how the modus operandi of jihadist networks developed over time. The selected police investigations focused on several hundred individuals, which we reduced to a total of 209 subjects. We did not copy police categorizations, but determined our own inclusion criteria. 46 The 209 subjects included are not necessarily terrorist perpetrators or suspects. The basic inclusion criteria were that: (1) an individual expressed extremist Salafi-jihadist sympathies or explicitly facilitated such a sympathizer; (2) we were able to gather information on the subject beyond his/her personal details, and (3) the subject lived or regularly resided in the Netherlands or played an indispensable role in a network operating in the Netherlands.
In order to gain access to the police files, formal permission from the Board of Procurators-General was requested for both tiers of data. At the same time, an advisory board was assembled, entailing representatives from the Dutch National Police, the Dutch National Coordinator for Security and Counterterrorism, the Dutch Intelligence Agency, and the Dutch Public Prosecution Service. The representatives were all terrorism experts within their organizations. In addition, biannual meetings were organized with the experts to reflect on our research progress during both data collection periods and to verify whether we complied with rules of data anonymity. Nonetheless, they respected our academic integrity and did not interfere with the reporting of our research findings. Initially they informed us about the availability and variety of police investigations relating to jihadist networks and they enabled us to physically access the police files. The police investigations from the first tier constitute an initial sample of which the inclusion criteria were the richness of the data and representativeness for different moments in time. The police investigations of the second tier were purposefully selected based on similar criteria and based on the categories rising from the first tier. We will illustrate this in the Data Analysis section. GT methods allow purposeful sampling, because they maximize variation of meaning. 47 After consultations with the advisory board, we started the data collection at various locations of both the National Police and the Public Prosecution Service. Our working space was either a separate room near the executives or we were allowed to settle among them, depending on the person in charge. We used a personal and secured laptop to safely record the data. This data collection was a very labor-intensive task due to the volume of the police files, which entailed thousands of pages per police investigation. 48 Eventually, it took several years to complete the data collection. In order to structure and guide this endeavor, a digital documentation sheet was used. The documentation sheet was merely to aid the researcher and to secure information from the police files into a format that could be used for future analyses. This sheet contained a variety of themes, such as the investigation timeline, subjects' personal traits, division of roles, network characteristics, radicalization and recruitment processes, network activities, subject's environment, transnational connections, financial aspects, convictions, religious behavior, and ideology. Each theme had several open questions that enabled the researcher to zoom in on certain aspects of the police files. Consequently, we inserted summaries of relevant information from the police files into the digital documentation sheet or we copied multiple excerpts from wiretap or interrogation transcripts. The documentation sheet was not a static research tool. We adjusted the sheet when it appeared to omit important themes or questions that emerged from the data. During the first tier of data collection we noticed the occurrence of subjects' flexible ideological behavior. 49 This was not yet a central theme in the initial documentation sheet, which we therefore inserted later on. On the other hand, possible activities such as suicide bombings were removed from the documentation sheet when it appeared that these activities did not occur in the Netherlands. As a result, through evaluation and constant comparison of data, we were able to continuously modify the documentation sheet. This approach is in accordance with more advanced versions of GT methodology, which acknowledges that a researcher has acquired certain ideas and perspectives about the world through education and prior reading. As a result, a researcher develops so-called sensitizing concepts, which are interpretive devices that function as a starting point to look at the data and to prepare interviews. 50 The themes in the documentation sheet are such tools or devices, which we derived from studying prior terrorism and organized crime 51 research. The themes were used to develop further understanding of the phenomenon and not to limit it. Furthermore, the themes were broken down in very general research questions, which were used to keep a focus at particular items that might be interesting. Hence, these themes and questions were not formulated to test hypotheses, but merely to guide our study of jihadist networks. When new questions arose, they were added to the documentation sheet.

Semi-Structured Interviews
The rich data derived from the police files did not always provide enough context and required additional clarification. Also, due to our interpretation of the files, tentative categories emerged from the police files that needed validation or falsification. Therefore, we conducted additional semi-structured interviews with both the police investigators and the public prosecutors involved in drafting the criminal cases in order to enhance a comprehensive understanding of the studied jihadist networks. We aimed at interviewing one police investigator and one public prosecutor per criminal case, although the numbers varied between cases. In total we interviewed 22 respondents, which we have outlined per criminal case in Table 1. Some respondents were interviewed multiple times, whereas some interviews were held with more than one respondent. All interviews were conducted by means of a semi-structured questionnaire, with themes similar to the documentation sheet. The questionnaire was adjusted per interview to cover a particular criminal case. The interviews yielded useful information and the respondents provided valuable contextual information.
The interview procedures slightly differed per tier of data collection. During the first tier, the interviews were conducted at the start of the police file data collection. Besides the themes, the respondents were also asked whether all relevant data was included in the police files and if they recognized the tentative categories that we derived from other police investigations. This way we verified whether the selected police files indeed covered a particular jihadist network and whether the tentative categories had actual ground. Also, we sometimes contacted the respondents again by telephone after we finished the data collection in order to clarify issues that remained ambiguous. We dispersed the timing of the interviews during the second tier. The first interview was conducted soon after we started our collection of data from the police files, while the (optional) second interview was conducted at the end of the data collection. This dispersion gave us more room to familiarize with the investigation before the first interview, and discuss and clarify issues in depth during the second interview. It also enabled us to adjust the questionnaire in relation to the police investigation studied and the categories that emerged from it, adhering to the GT principles.
Despite this thorough and varied data collection, we noticed that not all emerging questions could be answered with data from police investigations. For instance, within the first tier of data we found that irregular immigrants were disproportionally present within jihadist networks. 52 Unfortunately, we could not directly derive from the police investigations what made the jihadist networks so attractive to irregular immigrants. Therefore, we conducted 23 additional semi-structured interviews with Imams (n D 10) and staff members (n D 13) from Dutch Asylum Centers (AC) and Detention Centers (DC). In this way, we tried to draw a picture of the lives of irregular immigrants and asylum seekers prior to their jihadist involvement. The interviews with staff members were conducted by means of a semi-structured questionnaire, which focused on items such as general information on AC/ DC, background of asylum seekers/irregular immigrants, socioeconomic factors, living conditions, and religious behavior. Because the decision to conduct interviews was based on the initial findings from the police files, and because we constantly compared each interview with additional interviews and with the data from the police files, the additional data collection was in line with the principles of GT methodology.
Our primary data obviously relied heavily on the investigative authorities. Despite several features, such as our access to raw data, the inclusion of reports from examining judges, and the inclusion of lawyers' pleas, we admit that our data can be perceived as overly dependent on officials interested in prosecution. Therefore, we interviewed several criminal defense lawyers who could shed a different light on the court cases. 53 As contact details of the lawyers were not always available, and because several lawyers did not cooperate or respond to our request, we were able to interview 6 criminal defense lawyers about the cases in which they were involved. Although this is a small number, together they represented a fair portion of our criminal cases. 54 Several of them had been working in this area of expertise for more than a decade and they had represented multiple cases and defendants over the years. As a result, most lawyers were able to provide valuable insights over a longer period, if not the entire period. These interviews were also conducted by means of a semi-structured questionnaire, which was slightly adjusted per interview to cover the relevant criminal cases. We provided the respondent with our findings and interpretations of the central themes (i.e., emerging categories) discussed above. Thus we were able to validate our interpretation of the data from the police files and it provided the lawyers the opportunity to refine our conclusions. Besides the fact that this procedure adheres to the GT principles, this was also necessary to ensure lawyer-client confidentiality. By laying bare the details of a case, we did not put lawyers in a position in which they would disclose confidential information.
Finally, the interview settings and logistics were all similar, regardless of the type of respondent. The interviews were conducted at the personal offices of the respondents, or private areas were arranged in case the respondents did not have a personal office. In this way, all interviews could proceed without interruptions from external factors. In addition, we guaranteed all the respondents that they-and the people they spoke about-were anonymized in our publications. With this promise we had permission to tape record all interviews (except for the interview with the Imams), which we then transcribed verbatim. The interviews lasted about 75 minutes on average, but varied between 45 and 100 minutes overall. The 10 Imams were interviewed in the setting of a focus group. Although we wished to interview them one-by-one, for logistical reasons permission was only granted for a focus group interview. During this focus group session, we discussed the main findings from the interviews with the staff members and verified whether the Imams noticed similar situations. This appeared to be a good starting point for the Imams to speak from their own experiences. This interview was not tape recorded, but immediately transcribed by a research assistant.

Trial Observations
A final data source we deployed was the regular attendance of the criminal court hearings, which enabled us to see the suspects in person and gain a more vivid impression of their situation. Furthermore, because the suspects were questioned at trial, they might disclose new information, which could be added to the data. Also, when suspects were not temporarily detained and allowed to await trial in freedom, they were present in the public areas of the courthouse prior to and after the hearings and during the breaks. This enabled us to briefly speak with suspects, although none of them agreed to participate in a formal interview. On the other hand, it did bring us into contact with several criminal defense lawyers, which led to the aforementioned interviews. Overall, each of the criminal cases had several court hearings, spread over several months. The court hearings contained several kinds of hearings such as pre-trial reviews, court examinations, verdicts and sentencing sessions. Unfortunately, we were not able to attend all court sessions, because many criminal cases were already closed at the time we started the research or were never brought to a Dutch court. We were able to attend more than 10 court hearings of only 4 different criminal cases. We did, however, obtain most of the verbatim court transcripts from the court sessions we did not attend. Hence, we were aware of many additional statements from the suspects. To conclude, attending those hearings opened doors for further data sampling (i.e., interviews with lawyers), and enabled us to compare our preliminary findings with additional information that was disclosed during a court session, again adhering to GT principles.

Data Analysis
The triangulation of these different data sources led to significant new insights in jihadist networks. To discover and develop these insights, we analyzed the data simultaneously with the collection of data, leading to the identification of emerging categories. The emergence of preliminary categories initiated separate sub-studies within the greater research project on jihadist networks and at the same time directed further data collection on jihadist networks. In order to transparently illustrate how coding data led to the emergence of categories in more detail, we focus on one particular sub-study. In that particular project we studied socalled jihadist involvement mechanisms that enhance, discourage, and sustain possible affiliation with a jihadist network. In the following section we will on the one hand give an analytical overview of the data coding process at a more general level. On the other hand, we will provide analytical transparency on a more concrete level by illustrating how such coding led to the emergence of categories in the study on jihadist involvement mechanisms. When we refer to that study, we change to italicized sections. It must be stressed that we only show brief results, derived from a more extensive publication on this issue. Furthermore, we divided the analyzing process into two procedures, namely (1) coding and categorizing and (2) identifying relationships between the categories.

Coding and Categorizing
One of the crucial procedures in GT methodology is coding, which Charmaz defines as "naming segments of data with a label that simultaneously categorizes, summarizes, and accounts for each piece of data." 55 Codes offer a handle to interpret the data and to develop ideas about the data. In other words, a code is the link between the data and the final publication of findings. To arrive at this stage, the codes must first develop into categories and concepts, which can be viewed as higher level codes that have grown in complexity. Categories or concepts incorporate multiple codes and these codes eventually become the properties of categories. The aim of collecting and analyzing data is to achieve theoretical saturation, which means that no more properties of the defined categories will emerge when new data are added. Although there are different interpretations about what constitutes a code or a category, 56 the codes and the categories are the core of the analysis. Initial and focused coding needs to be conducted to develop codes into an analytical framework.
We started using initial coding by zooming in on the documentation sheet with an open mind while asking the open question: "what do these data say?" To record what is happening in the data, we used a software program for qualitative data analysis, MAXQDA, to label segments of data (the information summaries and excerpts) by means of line-by-line and incident-by-incident coding. The former was predominantly used to code every sentence from the transcribed interviews and the excerpts in the documentation sheets. Incident-byincident coding, however, was more suitable for the summaries from the police investigations, because summaries need to be interpreted as a whole (i.e., an incident), rather than by each individual sentence. Hence, line-by-line coding would not be very convenient in that context, because the summaries were often already expressed in our own words. Labeling segments forced us to narrow our focus to the information, which enabled us to distinguish and encapsulate pieces of relevant information into initial codes.
Several incidents in the police files highlighted how subjects communicated via multiple ways and shared all sorts of knowledge along the way. For instance, the interrogations contained confessions about how and what kind of material several subjects forwarded to others, while the wiretap transcripts illustrated discussions between subjects about this matter. These incidents were coded lineby-line with initial codes such as debating, attending educational gatherings, exchanging USBsticks (with radical sermons and films), lending (religious) books, sending suras, and distributing factsheets emerged. These codes explicitly captured what was going on in the police files and remained very close to the data. 57 To remain open to other analytical possibilities we adopted an additional approach called focused coding, which employs more directed, selective codes than initial codes. To develop such focused codes, the initial codes were used to scrutinize newly acquired data. By actively comparing the initial codes with the additional incidents, analytical thinking is encouraged, which helps to determine whether initial codes are adequate or need adjustment. Codes that are initially developed to capture a single incident influence the focus on the data such that similar data can be noticed and compared, leading to clarification of the data. Through constant comparing of data with data, data with codes, and codes with codes, focused codes can be refined. This refining could imply that codes expand, and develop into a category. As mentioned, categories are higher level codes and the focused codes are potential categories.
When we compared the initial codes that were derived from prior studied investigations with the data from newly acquired investigations and the interviews conducted, we observed similar incidents in the police files where subjects confessed, discussed, and held meetings to exchange knowledge. As a result, the foregoing initial codes such as lending (religious) books, or attending educational gatherings, for instance, were confirmed, sharpened, extended, and sometimes merged into focused codes, because they were indeed capable of summarizing additional incidents and situations. Moreover, through constant comparison we found that some of these focused codes together embodied a larger process, which was the distribution of ideological information. We therefore merged several focused codes in one and raised it to the level of a preliminary category, which we called "ideological information sharing." The foregoing focused codes became the properties of this category. However, due to our longitudinal perspective, we also found that "ideological information sharing" developed over time. Some properties were particularly present in earlier police investigations, but not so much later on. For instance, the exchange of ideological information moved from a physical to a virtual environment over time, causing properties such as "exchanging USB-sticks" to be replaced by "sending ideological email attachments" in later investigations. 58 However, categories are also provisional and one must therefore examine the adequacy of a category through theoretical sampling and constant comparison. This is done in a similar fashion as with the initial codes. This way, robust categories that capture larger mechanisms and processes can be developed. Furthermore, when the emerging categories are constantly compared, a set of initial categories often functions as properties or sub-categories of a higher level concept or category.
We found that "ideological information sharing" was not an independent category. When we compared it with several other preliminary categories, like "establishing brotherhood" and "boasting," we found that together these categories actually embodied a larger concept or category, which we called "encouraging involvement." This category stands for a process that supports a new recruit to remain associated with a jihadist movement, and the preliminary categories became sub-categories or properties of "encouraging involvement." One should notice that each higher coding level becomes a more abstract term that covers a broader mechanism or process in comparison to the lower level codes and incidents. 59 It is important to stress that the individual sub-categories or properties of "encouraging involvement" were supported by multiple segments of empirical data from a variety of investigations. This means that we did not focus only on seemingly interesting outliers, but kept studying whether our initial ideas were supported by more data. As a result, we could draw conclusions about this category that are grounded in the data.

Identifying Relationships between Categories
The development from initial codes to robust categories does not happen automatically, but requires the researcher's active analytical approach. The true analytical process is conducted by means of memo writing, which is the intermediate stop between collecting data and writing drafts of papers. 60 Memos are written brainstorms or narratives about the data, which start developing as soon as the initial analysis of the data begins. Memos conceptualize personal ideas of researchers about what they came across. 61 It is through memo writing that data are actually compared with data, codes, and categories; and vice versa. In this respect, memo writing is an analytical tool used to arrive at the conclusion that a provisional code or category is valid or that additional data are needed. By writing memos the categories and their properties are defined, specified, and elaborated.
Through memo writing, the relationships between categories are further defined, which is the basis for a paper. Through sorting memos and visualizing relationships between categories, the analysis can be raised to a higher level, because the categories are integrated into elucidatory social processes. These overall processes are grounded in the data, but may also have a more general applicability. The following example illustrates the outcome of such an analytical process.
By means of memo writing we analyzed the category "encouraging involvement" further. By jotting down everything that came to mind about the category, we concluded that "encouraging involvement" was dependent on another category that we later redefined as "discouraging involvement." That category contained properties such as "police arrests," "hostile environment," "boasting," "conflicts," "pressure," and "intimidation," which were factors that could have a discouraging effect on people to associate further with jihadist networks. This relationship was partly revealed because these categories share amongst other things a similar (sub) property, called "boasting." On the one hand, boasting was used by subjects to convince new recruits of the higher goal of the movement and to convert inconvenient arguments of likeminded subjects into better ones. Boasting was also used to overcome negative experiences and condemnations inflicted by society. Hence, boasting was an encouraging mechanism regarding jihadist involvement. On the other hand, however, we found that boasting was a tool during heavy debates and disputes, which could fuel conflicts and even repudiation of fellow members. In that regard, boasting carried too far became a discouraging mechanism. By understanding this process of bravado and conflict, used to rebel against the out-group, but also to dominate the in-group, boasting became an interesting link between two important categories, and sharpened our understanding of the complex jihadist involvement process.
The example above illustrates how continued coding, comparison, and memo writing opened our eyes to interesting processes that we could not have been aware of prior to this study.

Summary of Findings
Now that we have shown how the data were coded and how codes developed into categories, we want to illustrate how these analyses led to new findings and insights by summarizing some findings of three sub-studies that resulted from this research project.
The first example comes from the aforementioned study on involvement mechanisms. In the first tier of data collection and analysis we initially coded several incidents where older jihad veterans influenced younger subjects to internalize the ideology and become radically involved. As a result, we first categorized these incidents as a top-down recruitment process. Since we only found this process in the oldest criminal investigations, we requested and analyzed later criminal investigations that explicitly prosecuted people for terrorist recruitment in order to validate this process (i.e., theoretical sampling). We found that as of 2004, the senior jihad veterans were replaced by young radicals. Instead of direct recruitment, most jihadists now became involved through a process of self-radicalization and reciprocal peer influence in which some kind of power display and the aforementioned boasting played an important role. When we compared these two distinct categories of involvement more closely, we noticed important parallels between them. Regardless of one's position or duration of involvement, we found that jihadists had to deal with all sorts of encouraging as well as discouraging factors that affected their jihadist involvement. Moreover, we found that the factors were in constant interaction with each other, leading to a transformation process in which encouraging mechanisms changed into discouraging mechanisms and vice versa. The aforementioned boasting and conflict mechanism was a good example of this. On a more abstract level we therefore theorized that jihadist involvement covers more than an initial entrance, and should rather be seen as an unstable process that does not end with an alleged group membership. 62 A second sub-study relates to the earlier mentioned disproportionate presence of irregular immigrants in the data. Trying to understand what it is that attracts irregular immigrants to jihadist networks, we analyzed their profiles further. When comparing the code immigration status with the focused codes network activity and ideological involvement, we found that criminal conduct (as a core network activity) was often displayed by irregular immigrants, who at the same time were less ideologically involved. To explain this relation, we conducted the aforementioned interviews with imams and staff members from Asylum Centers and Detention Centers (i.e., theoretical sampling) and found that almost all irregular immigrants inhabiting these facilities suffered from mental issues due to the relative deprivation caused by their immigration status. When comparing these data with the foregoing codes or preliminary categories, we found that the type of criminal activities conducted by these irregular immigrants, such as shoplifting and passport forgery, could actually satisfy their own needs. As a result, a theoretical concept emerged from these preliminary categories, explaining that some members may not only be attracted to the jihadist movement through ideological considerations, but also for pragmatic reasons. 63 The third example is a study into the pre-departure stages of foreign fighters. When scrutinizing the network activities we found that becoming a foreign fighter was a primary objective. We wanted to understand how jihadists established this and through constant comparison of data from the first data tier we established five provisional categories; each representing a different preparation stage. To validate whether these categories could be found over time, we explicitly requested the Advisory Board for more recent criminal investigations that primarily focused on foreign fighting (i.e., theoretical sampling). Through this additional collection of data we were able to distinguish different episodes and compare these with regards to the pre-established categories or preparation stages. We found that these provisional categories were valid in each episode, but the properties of the categories differed between them. The more data we gathered, the more properties we could add or redefine, thus identifying a difference in preparation over time. For instance, while the property organized crime facilitated the operational stage in the first episode, common crime became a prominent property in later episodes. However, through constant comparison we also found particular parallels between the episodes, namely the fact that preparation was mainly driven by situational factors. As a result, we developed a theoretical concept that clarified how changing opportunity structures influence the preparation of jihadi foreign fighters, thus explaining the differences in properties between episodes. 64

Benefits of Combining Police Data and Applying GT Methods
Although we only gave a brief summary of some research findings, the findings illustrate how the combination of police data and GT methods has methodologically contributed to the field of terrorism studies.

Benefits of Police Data
The added value of using police files, interviews, and trial observations as primary data can be found in its scope and nature. First, it offers an extreme amount of information, as we have shown in the data collection part. The eyes of the police can reach much further into the lives and operations of alleged terrorists and criminals than many other sources would have been able to. The wiretap transcripts, for instance, are unparalleled and provided incredible amounts of information that could be analyzed for academic purposes, provided that they were sufficiently anonymized. Second, police data enabled us to scrutinize covert activities that would not have been easily accessible via other sources. For instance, the police files provided extensive information on crime, which was useful to understand how foreign fighters financially covered their expenses. Also, through scrutinizing criminal conduct we were able to link irregular immigrants to jihadist networks, a finding that is likely to have remained hidden when using other data sources. In addition, the aforementioned wiretap transcripts offered an insight into secretive jihadist-to-jihadist communication that would have been difficult to monitor via other means. It was especially useful with regards to the discovery of boasting and other forms of power display between the subjects. Surely, open social media accounts can be monitored nowadays, which could draw the attention to forms of display of power between the subjects, but this has only recently become a possibility. Due to our longitudinal perspective, we were also able to study private communication through in-house communication and telephone lines in much older police files during a time when communication between jihadists did not occur openly online.

Benefits of GT Methods
The added value of applying GT methods in our research can first of all be found in the focused data collection. Due to constant comparison we were much more aware of the kind of data we needed to sharpen and enhance our understanding of a particular phenomenon. Via theoretical sampling we conducted additional interviews in the irregular immigrant study and we requested from the Advisory Board additional investigations with regards to both the foreign fighting study and the study on involvement mechanisms. As a result, we were able to validate or falsify preliminary categories such as the pre-departure stages in the foreign fighting study and the top-down recruitment category in the involvement paper. Due to our explicit awareness of what type of information we wanted to test, we were also able to identify developments over time in those studies. A second benefit is that GT methods allow us much more room to develop new insights on a higher abstraction level. Such insights would have been less likely to emerge if we had used a deductive approach from the start. With deductive methods the study area is delimited by a hypothesis, which guides conscious choices concerning the data collection as well as the variables and concepts that are tested. With such approach it would have been less likely that we would have acquired the aforementioned theoretical insights.

Limitations of the Data
The illustrated method is labor intensive and time consuming, which could be a practical limitation. Furthermore, the most prominent limitation of studying police files is the selection of information. The police do not cover all jihadist activities and not everything that is relevant to understand the jihadist networks is encapsulated in a police investigation. As a result, our 28 police investigations are a selection of a selection and can therefore not be seen as representative. The same applies to the chosen time-frame. Although we covered a relatively long period from 2000 to 2013, we did not analyze all jihadi activity during that period. Also, even if the police cover the majority of jihadi activity and although we had formal permission to access and analyze police files, we were still dependent on the cooperation of the police and the public prosecutor. We were unable to verify whether we were indeed provided with all the available documented information. Additionally, the interviews suffered from a selection bias. As Table 1 shows, the number of interviews is not proportionate to the number of cases we studied. Unfortunately we were not able to interview all the people we aimed at. We did not structurally interview two respondents per criminal case and we also did not interview all lawyers involved. Although this limitation was beyond our control, it may have affected our perspective on the phenomenon.
The data might also be partially biased due to the context in which a (terrorism) police file is constructed. Terrorism cases are often believed to be formed and influenced under political pressure, 65 leading to misplaced labeling of groups and individuals as terrorists. This did not necessarily affect our research though, because we did not copy the labels from the police files. Rather, we used the information provided by the police and classified each individual or group under our own terms (see data collection). We therefore refer to people as subjects, rather than terrorists, and we even disclaimed several alleged terrorism cases that to our standards had little to do with terrorism or jihadist networks. In general, the construction of a police file can also be influenced by investigation policies. The initial goal of the police files is to convince the judge and is therefore not supposed to be used as scientific data. Suspect interrogations are controlled and orchestrated by the police, which, according to Althoff, 66 results in "forced" communication by the suspects. Whereas some subjects revealed everything they knew in order to be cooperative, others may have twisted reality or disclosed as little as possible to avoid conviction. This implies a biased perspective and therefore police data must be handled with much caution. However, the recorded confidential communication between subjects cannot be regarded as "forced communication," because in most cases the subjects were unaware of the fact that they were being monitored. However, there always remains a possibility that the final reports were filtered in order to persuade the judge. Althoff reminds us that "court files are a construction of social reality in the context of criminal law," as the offender perspective and circumstances are primarily formulated through the lens of the authorities. 67 Despite this accurate notion, we were to a great extent able to check the data ourselves, because we had access to the original transcripts. We therefore scrutinized this material intensively, and, as a result, relied on our own qualifications. In addition, we triangulated the information with other sources that offered a dissenting opinion, which enabled us to nuance our perspective. For instance, interviewing lawyers and studying their pleas clearly provided us with an alternative or altered perspective on the case. The same applies to the trial observations and scrutinizing court transcripts. In court, the various sources of information were assessed by a judge in the presence of all relevant actors. If there was a case of distorted information, this would have been the moment where opponents could protest. Furthermore, we also studied the examining judges' reports. In the Netherlands such judges already play an active role during the investigation. They examine the pre-trial decisions made by the public prosecutor in order to protect the suspect and to ensure a fair process.
Finally, an important point for discussion concerns the replicability of the research; one of the pillars of academic research and the main reason for a comprehensive methodological justification. Although the use of classified police files seems an odd choice in this regard, it may actually be a very suitable data source for a replication study. Although police files are not openly accessible, every researcher can request a formal admission. Other researchers are free to follow the same route as we did and apply for exactly the same police files. Furthermore, such police files are relatively static data sources because all the information included is archived. This means that once a researcher has been granted permission to access the files, he or she will find the exact same data as we did and will be able to replicate our study. It must be stressed that the Dutch government is relatively liberal in comparison to other countries when it comes to studying classified information by academics, 68 and this approach may therefore not be easily conducted elsewhere.

Limitations of Grounded Theory Methods
Studies using Grounded Theory methods have encountered serious critique in the past. 69 Probably the most problematic issue is the conceptualization of GT methods. Many researchers claim to be using GT methodology or GT principles, but seem to confuse GT with regular qualitative analysis. 70 For instance, coding data is not enough to be regarded as a GT method. 71 As a result, the label of GT bears a semblance of methodological rigor, but quite often detailed information on applied procedures is missing, which makes it difficult to determine whether or not GT principles are applied. Therefore, we tried to be as explicit as possible in this article to outline the different methodological steps. There is also an ongoing discussion about what the end product of a GT study should look like. 72 Since we do not adhere to, for instance, the Glaserian approach that only approves formal theory building, our study may not be characterized as a traditional GT study. However, other prominent scholars such as Corbin and Strauss 73 acknowledge that formal theory building should no longer be the only end goal, and support the wider application of this methodology for different purposes.
On a more practical level, a debatable practice in our research is the revision of the documentation sheet while gathering data from the police files. Although this is entirely in line with GT rules because it enhances theoretical sampling and constant comparison, it may increase the selection bias as well. Since we were not always able to re-analyze the already analyzed police files with the revised documentation sheet, this may have led to some under or overrepresentation of results. Nonetheless, we tried to incorporate new issues in former cases with the data still available to us. Another way to scrutinize new issues was the use of an additional data source, such as interviews with key respondents.
Another critical issue in GT methodology is saturation. Theoretical saturation implies that new information or incidents become interchangeable with earlier gathered data, which means that there is no more room for further exploration of the defined categories. 74 However, we are unable to make a claim of saturation yet, because it is difficult to determine whether we have reached this point. Our data collection was limited by time, money, and regulations and we cannot judge whether new aspects of the phenomenon would emerge if the data collection would be continued, neither can we predict how the phenomenon will develop over time. We did reach saturation on the studied cases, but cannot predict the added value of expanding the data collection with new cases. Nonetheless, we could always continue our research in the future. Additional research would furthermore be necessary to validate or falsify our findings on a wider scale. Since our research has been limited to cases from the Netherlands, our findings and the concepts developed are merely applicable to those networks under scrutiny. Although we studied a significant number of cases and subjects, the current findings and concepts have no general explanatory power until additional research is conducted.

Conclusion
In this article we drew scholarly attention to a recurring shortcoming in current terrorism research, which is the lack of methodological justification. By offering an overview of the methodological procedures conducted in a large empirical research project on jihadist networks, based on confidential police files, interviews, and trial observations, we illustrated how analytical transparency can be achieved and how GT-based methods can be used to collect and analyze such data and to develop and test new theories in this research field.
Despite considerable drawbacks of both GT-based methods and police data, we illustrate how this combination of data and methods led to new insights on jihadist networks. The combination of data and methods led to theories and conclusions that would have been difficult to achieve by other means. We do not claim that the use of GT methods and police files are flawless methods, and it is not our intention to claim that this combination of data and methods is better than other methodologies. We do, however, show that the combination of police data and GT methods offers a suitable and complementary approach to the current field of terrorism studies. In order for this research field to progress, researchers should be encouraged to seek new types of data or analytical tools to complement conventional methodologies. At the same time scholars should be transparent about the way they arrive at their conclusions. In a field that yearns for systematic analysis and rigor, openness about how this is established is more than a worthy pursuit.
Notes 44. As far as possible, we categorized a cluster of subjects as one network when the subjects interacted with each other (although with different intensity) and conducted several activities in order to establish the same goal. This goal refers to a concrete intent of violence and not merely the overarching ambition of Salafi-jihadists. The pursuit of that ambition nevertheless needs to be a central point of discussion within the network in order to be labeled as a jihadist network. For analytical reasons we refer to networks, although even with these criteria it remains arguable whether one is dealing with entirely independent groups or with a large network that contains several semi-independent sub-groups. 45. See Christianne J. De Poot and Anne Sonneschein, Jihadi Terrorism in the Netherlands: A Description Based on Closed Criminal Investigations (The Hague: WODC, 2011). 46. When the police have reason to believe that certain individuals have the intention to act unlawfully in accordance with an Islamic fundamentalist doctrine, the police often start a criminal investigation under the categorization of terrorism. This consequently implies that the monitored subjects become labelled as suspects of terrorism who have mobilized in terrorist groups. The inclination of terrorism is a heavy burden, whereas many subjects within the analysed movements appear to show different degrees of involvement, which does not always warrant the label of terrorist.