Why It Matters: Intelligence gathering on the Deep and Dark Web provides authorities with data and insights to better identify extremist activity happening within communities. While it is not always possible to differentiate real threats from noise, technology providers like Media Sonar are working hard to make that possible. The path forward requires private sector technology companies to work alongside law enforcement to hope to stop the scourge of meaningless violence.
The Christchurch mosque shootings that occurred on March 15, 2019, claimed the lives of 50 people between the ages of 2 and 70. The lone gunman initially approached the Al Noor mosque. The first victim, standing at the door of the mosque, greeted the gunman with the words “Hello Brother” prior to being shot to death. The second attack took place a little later, five kilometers away, at the Linwood Mosque.
The outcome of the Christchurch shooting is ultimately revealed in the loss of life and its impact on the community, but this was not the shooter’s only goal. We can confidently surmise, based on the shooter’s online activity through recent months and immediately prior to the attack, that physical violence was ancillary to supporting and disseminating right-wing extremist ideas and opinions.
In short, the Christchurch shooter wanted to serve as inspiration. He wanted to be glorified, just as others have been by those who would emulate them. As law enforcement agencies worldwide struggle to cope with the increase in extremist sentiment, leveraging artificial intelligence technology to gather data from across the Deep and Dark Web can help. Ultimately, while investigators cannot anticipate and mitigate terrorist threats with absolute certainty, we can start to identify trends and potential threat actors. In time, by collaborating with technology companies to steer and drive more effective and innovative systems, law enforcement agencies will be better equipped in stopping extremist activities before they occur.
As news reports unfolded about the attack, many around the world were left wondering, as is often the case, if the Christchurch attack could have been avoided. Bob Parker, a former Christchurch mayor, immediately questioned why security agencies were not aware of the threat posed by the shooter.
“I think there are questions to be asked about why this wasn’t picked up by authorities. There does seem to be a significant amount of information that was put online sometime before this attack took place, and it does not seem to have rung alarm bells in the right places,” Parker told reporters.
According to Professor Greg Barton, chair of global Islamic politics at the Alfred Deakin Institute for Globalisation & Citizenship, there are too many people posting right-wing content to raise any alarms. Quite simply, real threats are lost in the noise.
Professor Barton is not wrong. The evidence that now seems so obvious is only so because the event has highlighted them. If the shooting had not come to pass, his photos and comments would have likely been lost in the noise as they should be, forgotten, like the millions of other extremist posts made online each day. His posts, like all the other content that does not culminate in an attack, would have been shown to be unfounded empty threats.
Shitposting and the spread of extremism online
Shortly before the mosque attack on Friday, March 15, the gunman posted to messageboard 8chan with the comment: “Well lads, it’s time to stop shitposting and time to make a real-life effort post.” The shooter shared what is being called his manifesto, “The Great Replacement,” a rambling 74 pages of poorly written confused ideas and beliefs, also on 8chan.
On the Bellingcat blog, Robert Evans provides a great description of “shitposting” in the context of this attack: “Shitposting is the act of throwing out huge amounts of content, most of it ironic, low-quality trolling, for the purpose of provoking an emotional reaction in less Internet-savvy viewers. The ultimate goal is to derail any productive discussion and distract readers. “The Great Replacement” is a clear and brutally obvious example of this technique.”
Leading up to the attack, the Christchurch gunman was active online. He scaled up his activity to prepare for the attack and to ensure his message was out there in case he was caught or killed. He shared multiple photos of weapons on March 12. In white writing, the shooter glorified the names of right-wing extremists, attacks, and events.
In a further post on the same day, the shooter shared a YouTube video entitled “Russian Angels of Death” that showed a Russian-made armed helicopter engaged in a ground offensive. In his post, he included the caption: “Coming soon to an immigrant suburb near you.”
After the event, the “manifesto” and online posts spread quickly through mainstream media, as well as by citizens on forums and social media. As people around the world struggled to understand what motivated the attack, it became obvious to some that the posts and manifesto could not be taken at face value. His message was inconsistent and confusing. In many cases, the shooter refers to unrelated persons and events hoping to drive the virality of his posts, for example by mentioning the popular YouTube personality PewPewDie. From the manifesto and dedications that blanket his firearms, the details of his message do not matter, at least in so much as their true meaning is concerned. The Christchurch shooter was less concerned with providing a clear narrative around his actions, but rather to draw others into the same murky quagmire where he himself was radicalized.
Separating Truth From Theater
The contents of Christchurch shooter’s manifesto, short of having a coherent message, includes what he wants us to know. When Ted Kaczynski launched his terrorist campaign, his manifesto portrays him as a man concerned with the problems of industrial society rather than as the disturbed individual that he was. Manifestos are not meant to be factual. It’s essentially amateur propaganda intended for mass consumption. What we are talking about here is the “theater of terrorism.” Any individual can now set the stage on social media. They can rally on the Deep and Dark Web where would-be extremists exist online in relative freedom from the watchful eyes of anyone who might disagree with them or report their activity.
According to a recent report from the Anti-Defamation League (ADL), domestic “extremists” killed 50 people in the United States last year – an overwhelming majority of which were perpetrated by “right-wing extremists”. The Christchurch shooter’s goal was not simply to kill, he also wanted to create more terrorists to drive up the death toll among those they’ve deemed offensive. The Christchurch shooter serves as a prime example of today’s increasingly galvanized extremists, active online yet virtually indistinguishable from the countless others who post similar content but who commit no acts of violence. Where is the path forward?
As the death toll rises, as concerns about safety remain top of mind for ordinary citizens, innovation within the private technology sector can help better support intelligence-led security strategies. Media Sonar uses artificial intelligence to augment existing investigative efforts to identify and curb extremist activity within communities by providing greater visibility into the Deep and Dark Web. Sadly, there is no magical or high-tech solution that can differentiate between extremists capable and likely to commit an act of violence from apparent extremists engaged in shitposting online. Nonetheless, technology is bringing us closer to that goal every day.
It’s time to update your digital investigation toolkit to account for the Deep and Dark Web.
Download our white paper “Untangling The Web: Where To Get Started With Online Investigation“ to learn how the Internet is used to create, as well as mitigate, public and private risk.