SCIENTIFIC STUDIES
Going dark: the inverse relationship between online and on the ground pre-offense behaviors in targeted attackers
Julia Kupper & Reid Meloy — Global Network on Extremism & Technology (2023)
This pilot study investigates the correlation of online and on-the-ground behaviors of three lone-actor terrorists prior to their intended and planned attacks on soft targets in North America and Europe: the Pittsburgh synagogue shooter, the Buffalo supermarket shooter and the Bratislava bar shooter. The activities were examined with the definition of the proximal warning indicator energy burst from the Terrorist Radicalization Assessment Protocol (TRAP-18), originally defined as an acceleration in frequency or variety of preparatory behaviors related to the target. An extensive quantitative and qualitative assessment of primary and secondary sources was conducted. Preliminary findings from this small sample suggest an inverse relationship between online and offline behaviors across all three perpetrators. The average length of time between the decision to attack and the actual attack was five months, with an elevation of digital activities in the three months leading up to the incident, along with some indications of offline planning. In the week prior to the event, social media activity decreased – with two subjects going completely dark on the day before the respective acts of violence – while terrestrial preparations increased. On the actual day of the incident, all assailants accelerated their tactical on-the-ground actions and resurfaced inthe online sphere to publish their final messages in the minutes or hours prior to the attack. Operational implications of this negative correlation are suggested for intelligence analysts, counterterrorism investigators and threat assessors, and policy recommendations are proposed for technology companies and policymakers.
The Hanau terror attack: unraveling the dynamics of mental disorder and extremist beliefs
Julia Kupper, Patricia Cotti & Reid Meloy — Journal of Threat Assessment and Management (2023)
This case study is a detailed assessment of the paranoid schizophrenia and right-wing extremist beliefs of Tobias Rathjen, who amalgamated three low-base rate events: mass homicide, matricide, and suicide. The offender killed nine individuals during a terrorist attack in Hanau, Germany, on February 19, 2020, before murdering his mother and taking his own life. A comprehensive qualitative analysis of primary and secondary sources was conducted, with raw materials consisting of three written documents and three recorded videos, all authored and disseminated by the perpetrator prior to his attack. Open-source data were predominantly composed of the postmortem forensic psychiatric evaluation of the assailant, as well as minor interpellations between the German government and parliamentary groups, and to a lesser extent printed and online articles. We structured the analysis with the Terrorist Radicalization Assessment Protocol (TRAP-18) and found that Rathjen was positive for 94% of the TRAP-18 indicators. The motivations for his acts of violence were multifaceted, but his major psychiatric illness, paranoid schizophrenia with chronic delusions, was central in his progression to become a lone-actor terrorist. In addition to this internally formed psychotic-driven ideology, the perpetrator was influenced and inspired by external (i.e., online and offline) xenophobic and conspiratorial elements that gradually provided a secondary framework for his violent attack. The complex interplay of his delusions, obsessions, and extreme overvalued beliefs—which drove his fixation—reveal the difficulty of clinically understanding such a case, and also the necessity of doing so, to attempt to risk mitigate these types of subjects by threat assessment teams.
Terrorgram's first saint: analyzing accelerationist terrorism in Bratislava
Julia Kupper, Kacper Rekawek & Matthew Kriner — Accelerationism Research Consortium (2023)
On October 12, 2022, 19-year-old Juraj Krajčík perpetrated a terrorist attack that killed two people and injured one outside a LGBTQ+ bar in the center of Bratislava, Slovakia. The authors used a multi-disciplinary approach to assess the empirical evidence of the case by combining the authors’ unique skill sets in terrorism, international security, threat assessment, and forensic linguistics.The report provides a forensic analysis of the attack and its aftermath; the attacker’s life before the event; and the attacker’s targeted violence manifesto, suicide note, tweets, and 4chan comments and, in turn, provides groundbreaking evidence in support of the hypothesis that the shooter did not write his manifesto alone. The research culminates in an assessment of the role of militant accelerationist milieus (e.g., Terrorgram) that were central to the attacker’s radicalization and subsequent mobilization, which will be useful to law enforcement, researchers, tech platforms, and policymakers.
The contagion and copycat effect in transnational far-right terrorism: an analysis of language evidence
Julia Kupper, Tanya Karoli Christensen, Dakota Wing, Marlon Hurt, Matthew Schumacher & Reid Meloy — Perspectives on Terrorism (2022)
This article corroborates the continued threat of extreme right terrorism by exemplifying textually intercon- nected links across linguistic evidence composed prior to or during attacks in the United States, New Zealand, Germany, Norway and Sweden. A qualitative content analysis of targeted violence manifestos and live-streams, attack announcements on online platforms, and writings on equipment (e.g., firearms) used during the inci- dents reveals an emerging illicit genre set that is increasingly consolidated in form and function. The messages accentuate an intricate far-right online ecosystem that empowers copycats and escorts them on their pathway to violence. A definition for targeted violence live-streams is proposed and operational applications are discussed.
Words of suicide: identifying suicidal risk in written communications
Amendra Shrestha, Nazar Akrami, Lisa Kaati, Julia Kupper & Matt Schumacher — IEEE Xplore (2021)
Suicide is a global health problem with more than 700,000 individuals dying by self-destruction each year, yet it is classified as a low base rate behavior that is difficult to prognosticate. Aiming to advance suicide prediction and prevention, we examined the potential use of machine learning and text analyses models to predict suicide risk based on written communications. Specifically, we used a dataset consisting of more than 27,000 general writings unrelated to suicide, 193 genuine suicide notes from individuals who committed suicide, and an additional 89 suicide posts shared on sub-Reddits for an in-the-wild test to examine the prediction accuracy of two machine learning models (SVM & RoBERTa) and a linguistic marker model. Our tests showed that the machine learning models performed better than the linguistic marker model when examined on the test data. However, the linguistic marker model achieved higher results in the wild, correctly classifying 88% of written communications as a "high risk of suicide" versus 56% and 70% of the machine learning models. The best in-the-wild performing model was adopted in an online suicide risk assessment tool called Edwin to honor Edwin Shneidman for his numerous contributions to the field of suicidology. Finally, discrepancies between training and real-world data, vocabulary variation across domains, and the limited number of benchmarks constitute limitations that need to be addressed in future research.
TRAP-18 indicators validated through the forensic linguistic analysis of targeted violence manifestos
Julia Kupper & Reid Meloy — Journal of Threat Assessment and Management (2021)
This study is a qualitative and quantitative analysis of written and spoken manifestos authored by lone offenders that planned to or committed a targeted attack (n = 30). The acts of violence were primarily motivated by an ideology or a personal grievance, and occurred between 1974–2021. The main objective of this retrospective study was to examine if a behavior-based threat assessment instrument, the Terrorist Radicalization Assessment Protocol (TRAP-18), could be applied to a thin slice of data using only language evidence compiled by the perpetrator before the event occurred. Findings indicate that 17 out of 18 TRAP-18 indicators (94%) were able to be coded in the manifestos. Proximal warning behaviors ranged from 2 to 7, with an average of 4.5. The average number of distal characteristics was 3.8 across the sample. The most frequent proximal warning behaviors were leakage, identification, fixation, and last resort. The most frequent distal characteristics were changes in thinking and emotion, framed by an ideology, and personal grievance and moral outrage. Further analyses of the manifestos comparing written versus spoken communications, ideologically based versus grievance-fueled attacks, and seven categories of primary motivations, supported the generalizability of the TRAP-18 when applied to only language data. A definition for targeted violence manifestos is proposed and examined within a genre framework. Application to threat assessment and management is discussed
[Coming soon] An interdisciplinary analysis of the Halle terrorism case
Julia Kupper, Marie Bojsen-Møller, Tanya Karoli Christensen, Dakota Wing, Marcus Papadopulos & Sharon Smith — Cambridge University Press
[Coming soon] An accelerating state of mind: digital evidence and the question of sanity at the time of the crime
Reid Meloy, Julia Kupper & Matt Kriner — Behavioral Sciences & the Law
ARTICLES
Special report: analysis of Ryan Palmeter’s targeted violence manifesto
Julia Kupper — Accelerationism Research Consortium (2024)
[available upon request for law enforcement and intelligence agencies; not for public distribution]
Practical forensic and tactical linguistics in investigations
Julia Kupper — ASIS International Security Management (2024)
Although acts of targeted violence are difficult to predict, largely due to their low base rates (i.e., they are statistically rare events), it has become apparent that subjects who embark on a pathway to violence consistently exhibit warning behaviors that alert threat assessors to engage in the management of an emerging threat. To intervene before an act of violence occurs, linguistic threat analyses can be applied to written and spoken communications, for instance leakage in the form of terrorist, school, or criminal threats—such as terrorism manifestos, stalking letters, intimidating online postings, and homicide or suicide threats.
The Reichsbürger coup: how the German COVID-19 denier scene and anti-lockdown movement became a breeding ground for terrorism
Julia Kupper & Miro Dittrich — Global Network on Extremism and Technology (2023)
This Insight provides an overview of the ideology behind the German Reichsbürger movement, its recent cross-pollination with international QAnon narratives, and how this amalgamation resulted in the planned German coup by a group called the ‘Patriotische Union’ (the ‘Patriotic Union’). Furthermore, we emphasize the conspiratorial belief systems of several arrested members and discuss why secure communications platforms, such as Telegram, are perpetually exploited to spread extremist content and coordinate acts of violence.
Linguistics and threat assessment: how the analysis of language can assist in preventing workplace and campus violence
Julia Kupper & Stephen White — Work Trauma Services Inc. (2023)
Threat assessors seek to identify an edge, especially in high-concern cases; tactical and forensic linguistics can complement more traditional investigations, enhancing our ability to interpret written or spoken data. As language is a central component of human behavior, the analysis of linguistic evidence “left of bang” can assist multi-disciplinary threat mitigation teams in evaluating the level of an emerging or active threat. Writers and speakers often make decisions subconsciously about the kind of language they use, and our knowing eyes may tell us more than the author might realize.
The venomous rhetorical web of far-right terrorists
Julia Kupper — Global Network on Extremism and Technology (2022)
Between 2011 and 2022, ten lone-actor terrorists motivated by race and/or ethnicity attempted or carried out multi-casualty incidents across North America, Europe and Oceania. The assailants self-radicalized in cyberspace and were influenced by an intricate far-right ecosystem of digital platforms and narratives, including the Great Replacement conspiracy theory and accelerationist beliefs. This was reflected in the operational approaches of their offenses when they converted their virtual frustration into violent, real-world action.
Preventing attacks using targeted violence manifestos
Julia Kupper — FBI Law Enforcement Bulletin (2022)
This article argues that written and spoken communications authored and leaked by lone perpetrators who actively plan and prepare acts of targeted violence can be utilized to prevent destructive attacks. Targeted violence refers to intended attacks by an offender who preselects one or more targets, such as people at a specific location in a public setting (e.g., school, workplace, concert).
[Coming soon] Terrorgram’s propaganda — an overview of publications designed to incite accelerationist terrorism attacks
Julia Kupper & Miro Dittrich — Accelerationism Research Consortium
[Coming soon] How language analysis can enhance threat assessment
Julia Kupper — The Maze: Fixated Risk Management Bulletin
INFOGRAPHICS
Snapshot: threatening communication (2021)
This infographic provides a visual snapshot of a linguistic threat analysis of an open-source manifesto, including an application of the Terrorist Radicalization Assessment Protocol (TRAP-18).
Linguistic comparison: manifestos of extremists (2020)
This infographic highlights shared themes of five right-wing manifestos written by violent extremists. Thematic similarities and differences are presented in a tabular view. All findings are derived from the content of the manifestos.
Linguistic comparison: suicide notes vs. manifestos (2019)
This infographic discusses linguistic similarities and differences of suicide notes and manifestos. It highlights common and contrasting themes, as well as distinctive features in production and distribution, illustrated by real-life examples.
PRESS & OTHER APPEARANCES
The Conversation: Christchurch attacks 5 years on: terrorist’s online history gives clues to preventing future atrocities (article, March 2024)
The Guardian: ‘You will not replace us’: a deadly attack on a Slovakian gay bar – and its link to a fast-spreading racist ideology (news article, January 2024)
U.S. Department of Defense, the Defense Personnel and Security Research Center, The Threat Lab: BLUF Targeted Violence (newsletter, June 2023)
MHS, Public Safety: The Hanau Terror Attack (newsletter, June 2023)
Association of Threat Assessment Professionals, D.C. Mid-Atlantic Chapter: Contagion and Copycat Effects in Terrorism (newsletter, April 2023)
Association of European Threat Assessment Professionals: Linguistics (newsletter, Spring 2023)
VICE: Nazi Shooting on LGBTQ Bar May Not Have Been a ‘Lone Wolf’ Attack After All (news article, March 2023)
Association of European Threat Assessment Professionals: Follow-up on the TRAP-18 (newsletter, Autumn 2021)