Several incidents of mass violence in 2019 were preceded by manifestoes posted to deep Web social media sites by their perpetrators. These sites, most notably 4chan and 8chan, are buried in the deep Web, away from the neutralizing effects of broad public discourse. Many of the posts to these sites reference earlier extremist incidents, and indeed the incidents themselves mimic aspects of previous attacks. Building on previous research, this paper examines these deep Web social media sites. Through an analysis of traffic and posts, we confirm that these sites often act as a self-reinforcing community of users encouraging each other to violence, and we map a statistically significant rise in ”post volume” on these sites immediately following terrorist attacks.Contents
Background
Deep Web traffic analysis
The effects of 4chan posts on terrorist attacks
When do the spikes in posts occur?
Discussion
Further research
Conclusion
In 2019, several prolific mass shootings led to a growing public debate about the role social media plays in encouraging violent behaviour in those with extremist leanings, particularly white males targeting certain religious and ethnic groups in pursuit of what is commonly understood as a white nationalist agenda.
Notable examples include:
the Al-Noor Islamic Centre attack in the outskirts of Oslo, Norway on 11 August 2019. Before the attack, the perpetrator wrote in the online forum EndChan [1] of his admiration for an earlier attack (Christchurch) (Thalen, 2019). [2]
the Christchurch attack itself saw its perpetrator post his manifesto on 8chan’s “politically incorrect” message board (/pol)/ [3]
the el Paso Walmart shooter and California synagogue attackers likewise posted their manifestos on 8chan’s /pol board. [4]
Our principal goal was to uncover whether there are links between traffic on extremist deep Web sites [5] and the real-life terrorist violence they espouse. To do so, we constructed a dataset from two sources: (1) daily post volume on one of the deep Web’s most popular extremist social media sites, 4chan’s /pol/ board, during 2018, [6] (2) and 169 terrorist [attacks listed on the Global Terrorism Database (GTD) for 2018. [7] We organized the GTD data around three key characteristics: whether the attack was conducted by a lone actor or a group, whether the attack was claimed, and the nature of the attack. We further isolated motivation via the perpetrators target selection choices, with the variables being: anti-Semitic, anti-migrant, anti-Islam, incel-extremist/misogyny, anarchist, mass violence, religious extremists, anti-LGBTQ, and fascist/white supremacists/alt-right motivations.
Table 1: Descriptive statistics of terrorist attacks and 4chan post volume. Level Obs. Mean S.D. Min Max Terrorist attacks Anti-Semitic Multi-Week 12 0.23076923 0.58125573 0 3 Anti-migrant Multi-Week 42 0.80769231 0.9031586 0 4 Anti-Islam Multi-Week 33 0.63461538 0.9081027 0 4 Incel/misogyny Multi-Week 5 0.09615385 0.2976783 0 1 Anarchist Multi-Week 40 0.76923077 0.94174191 0 5 Mass violence Multi-Week 1 0.01923077 0.13867505 0 1 Religious extremists Multi-Week 21 0.40384615 0.13867505 0 1 anti-LGBTQ Multi-Week 1 0.01923077 0.13867505 0 1 Fascists/White supremacists/alt-right Multi-Week 44 0.94615385 2.83109218 0 18 Lone actor Multi-Week 86 1.65384615 2.655992978 0 18 Claimed Multi-Week 40 0.76923077 0.8544092 0 3 Post-volume /pol/ Multi-Week 43171906 830228.962 73283.3428 657824 995912 /a/ Multi-Week 16287854 313227.962 35373.7166 247580 426022
Next, using data from a 4chan statistics aggregator, 4stats.io, we recorded posts per day on the extremist board 4chan’s /pol/ board. (We also gathered posts per day on the anime discussion board (/a/) for use as a control variable.) While the smallest historical post/per unit available from 4stats.io is per day, posts per minute data is available on a rolling three-day period, and we therefore used data from 15 November 2019 for /pol/ and 26 November 2019.
Table 2: Creating an estimate for hourly traffic on /pol/ and /a/. Average day on /pol/ Average day on /a/ Time Post per minute Posts per hour % per hour Time Post per minute Posts per hour % per hour 12:00:00 AM 92.33 5540 5.28% 12:00:00 AM 27.55 1653 4.66% 01:00:00 AM 91.06 5464 5.20% 01:00:00 AM 27.7 1622 4.68% 02:00:00 AM 88.38 5303 5.05% 02:00:00 AM 27.07 1624 4.58% 03:00:00 AM 83.99 5039 4.80% 03:00:00 AM 27.07 1624 4.58% 04:00:00 AM 77.82 4669 4.45% 04:00:00 AM 25.58 1535 4.33% 05:00:00 AM 70.39 4223 4.02% 05:00:00 AM 23.53 1412 3.98% 06:00:00 AM 62.55 3753 3.57% 06:00:00 AM 21.37 1282 3.61% 07:00:00 AM 55.29 3317 3.16% 07:00:00 AM 19.31 1159 3.27% 08:00:00 AM 49.46 2968 2.83% 08:00:00 AM 17.34 1040 2.93% 09:00:00 AM 45.35 2721 2.59% 09:00:00 AM 15.76 946 2.66% 10:00:00 AM 43.19 2591 2.47% 10:00:00 AM 15.38 923 2.60% 11:00:00 AM 43.52 2611 2.49% 11:00:00 AM 15.63 938 2.64% 12:00:00 PM 46.77 2806 2.67% 12:00:00 PM 16.29 977 2.75% 01:00:00 PM 52.57 3154 3.00% 01:00:00 PM 17.56 1054 2.97% 02:00:00 PM 59.89 3593 3.42% 02:00:00 PM 20.78 1247 3.51% 03:00:00 PM 67.64 4058 3.86% 03:00:00 PM 25 1500 4.23% 04:00:00 PM 74.99 4499 4.28% 04:00:00 PM 29.84 1790 5.05% 05:00:00 PM 81.46 4888 4.65% 05:00:00 PM 34.59 2075 5.85% 06:00:00 PM 86.7 5202 4.95% 06:00:00 PM 33.38 2003 5.64% 07:00:00 PM 90.63 5438 5.18% 07:00:00 PM 31.9 1914 5.39% 08:00:00 PM 95.31 5719 5.45% 08:00:00 PM 30.76 1846 5.20% 09:00:00 PM 94.8 5688 5.42% 09:00:00 PM 30.09 1805 5.09% 10:00:00 PM 95.33 5720 5.45% 10:00:00 PM 29.51 1771 4.99% 11:00:00 PM 95.46 5728 5.45% 11:00:00 PM 28.39 1703 4.80% Totals 105006 100% 35482.8 100%
The effects of 4chan posts on terrorist attacks
To investigate the link between 4chan posts and terrorist attacks, we estimate the fixed effects panel regression using an ordinary least squares (OLS) approach. [8] Due to the fact that 4chan posts are anonymous, we are not able to estimate the number of users creating posts. Some boards on 4chan display a flag based on the IP address of the user. However, it is common practice for users to use a VPN or similar anonymizers. (Hine, et al., 2017). [9] Due to the limitations of assessing the location and number of users, we thus rely exclusively on the volume of posts to estimate impact. Our first regression follows the following model:
/pol/ posts = α + β Terrorist Attacks + ε (1)
In this model we compare the volume of posts with the number of terrorist incidents that occurred in each week of 2018 from our right-wing terrorist dataset.
Note: This figure plots the number of weekly posts on 4chan’s /pol/ board against our dataset of right-wing terrorist incidents.
Table 3: /pol/ posts and terrorist attacks.
Note: This table presents the estimated coefficients from a regression of right-wing terrorist attacks on posts on 4chan’s /pol/ board as in Equation (1). The dependent variable is terrorist attacks. Standard errors in parentheses. ***, **, and * indicates statistical significance at the 0.01, 0.05, and 0.1 levels, respectively./pol/ posts
(1)Terrorist attacks 7370.9**
(70731.29)Observations 52 Adjusted R-squared 0.068
We find that there is a positive and significant correlation between terrorist attacks and the volume of daily posts on 4chan. In order to test whether this effect is unique to 4chan’s /pol/ board, we compare the same dataset of terrorist attacks to data from the same period of time on 4chan’s /a/ board. /a/ is an anime discussion board on 4chan that does not contain comparable amounts of right-wing extremist content as /pol/ Our second regression uses the following model:
/a/ posts = α + β Terrorist Attacks + ε (2)
We find that there is no correlation between posts on the anime board and terrorist attacks, suggesting that the effect is unique to posts on /pol/.
Table 4: /a/ posts and terrorist attacks.
Note: This table presents the estimated coefficients from a regression of right-wing terrorist attacks on posts on 4chan’s /a/ board as in Equation (2). The dependent variable is terrorist attacks. Standard errors in parentheses. ***, **, and * indicates statistical significance at the 0.01, 0.05, and 0.1 levels, respectively./a/ posts
(1)Terrorist attacks 987.546111
(1703.1251)Observations 52 Adjusted R-squared -0.013187
We then ran two regressions to determine whether this impact on /pol/ is more significant among attacks perpetrated by lone actors or groups, or attacks that are publicly claimed, under the models:
/pol/ posts = α + β Claimed Terrorist Attacks + ε (3)
Table 5: /pol/ posts and claimed terrorist attacks.
Note: This table presents the estimated coefficients from a regression of right-wing terrorist attacks on posts on 4chan’s /pol/ board as in Equation (3). The dependent variable is terrorist attacks. Standard errors in parentheses. ***, **, and * indicates statistical significance at the 0.01, 0.05, and 0.1 levels, respectively./pol/ posts
(1)Claimed attacks 17221.0124
(11882.81)Observations 52 Adjusted R-squared -0.021118647
/pol/ posts = α + β Lone Actor Attacks + ε (4)
Table 6: /pol/ posts and lone actor violence.
Note: This table presents the estimated coefficients from a regression of lone actor right-wing terrorist attacks on posts on 4chan’s /pol/ board as in Equation (4). The dependent variable is terrorist attacks. Standard errors in parentheses. ***, **, and * indicates statistical significance at the 0.01, 0.05, and 0.1 levels, respectively./pol/ posts
(1)Lone actor attacks 5895.232628
(3811.95)Observations 52 Adjusted R-squared 0.026563473
Investigating the effect of terrorist attacks on their target selection and perpetrator type using the model:
/pol/ posts = α + β1anti-Semitic + β2anti-migrant + β3anti-Islam + β4incel-extremist/misogyny + β5anarchist + β6mass violence + β7religious extremists + β8anti-LGBTQ + β9fascist/white supremacists/alt-right + ε (5)
Table 7: /pol/ posts and terrorist attacks by perpetrator type.
Note: This table presents the estimated coefficients from a regression of right-wing terrorist attacks by perpetrator on posts on 4chan’s /pol/ board as in Equation (5). The dependent variable is terrorist attacks. Standard errors in parentheses. ***, **, and * indicates statistical significance at the 0.01, 0.05, and 0.1 levels, respectively./pol/ posts Anti-Semitic -14589.291
(27434.80)Anti-migrant 16933.3509
(22857.38)Anti-Islam -4455.0628
(25122.03)Incel-extremist/misogyny 35203.0356
(41699.36)Anarchist 16472.4205
(11804.68)Mass violence 67903.4002
(83209.39)Religious extremists 4230.33166
(17052.51)Anti-LGBTQ -7828.2827
(80008.88)Fascist/white supremacists/alt-right 7846.5486
(5526.25)Observations 52 Adjusted R-squared -0.013187
Breaking down terrorist attacks by their target selection and perpetrator type is similarly uncorrelated. This suggests that no particular sort of terror attack creates traffic on /pol/, but that all terror attacks of an extreme right-wing variety provoke discussion on the site.
When do the spikes in posts occur?
The above models use weekly data which obfuscates exactly when spikes in posts occur. Using a weekly model such as the above regressions obscures when the spikes in posts are occurring. The smallest unit of data available from 4stats.io is posts per day. However, posts per minute are displayed for a three-day period. Using this data for an exemplary day, outlined in Table 2, we isolate the effect that a terrorist attack has on post volume, we chose to apply our hourly model to five days before and after the Christchurch attack. The first emergency call went out at 1:43pm local time (0043GMT) on 15 March 2019. Observing hourly data leading up to and following the attack for the /pol/ and /a/ boards, A significant spike in traffic can be observed almost immediately following the first emergency call on /pol/. A comparable effect cannot be observed on /a/. A reading of 4plebs.org, an archive of 4chan posts, revealed that the overwhelming majority of posts were discussing the Christchurch shooting.
The spike in traffic seen on 14 March 2019 appears to stem from U.S. Democratic presidential candidate Andrew Yang qualifying for the upcoming Democratic presidential debate on 11 March 2019 (Thebault, 2019). Andrew Yang has a large, grassroots following due to his support for policies that are popular amongst Internet users. These policies include universal basic income (UBI). Yang has accumulated a cult following amongst the alt-right (sometimes known as the YangGang) following an appearance on Joe Rogan’s podcast, and amplification on Twitter by alt-right figures such as Faith Goldy, Richard Spencer, and Nick Fuentes (Braslow, 2019).
Hine, et al. (2017) show that posts on /pol/ often contain links to other sites, sometimes to initiate discussion, but also serve as a call to action (Hine, et al., 2017). These calls of actions serve to coordinate action, including skewing public opinion polls, but also to initiate raids against other services (Hine, et al., 2017).
While a distributed denial of service (DDoS) [10] attack aims to disrupt a site from a network perspective, a raid aims to disrupt content on a third-party service. Hine, et al. (2017) find that almost all comments on a YouTube video containing hate speech occur during the lifetime of a post on /pol/ calling for action.
Further, research from the University of Alabama at Birmingham shows that content from 4chan feeds radical viewpoints into the broader internet ecosystem. Smaller, fringe communities serve as an incubation chamber for information. Researchers found that threads on 4chan have an influence on posts on Reddit and Twitter (Zannettou, et al., 2017).
It is typically believed that extremist views have an influence on traffic within more mainstream sites on the Internet, which affects content on alternative social media such as 4chan and 8chan, finally leading to certain radicalized individuals committing real-world violence. This paper has shown that the relationship is actually flipped. Incidents of violence occurring in the real-world influence content on /pol/, which in turn orchestrates raids on mainstream social media such as YouTube, and influences content on Reddit and Twitter.
The interaction between deep web social media and the mainstream media may be partly contributing to the rise in lone actor violence. Hamm and Spaaj (2015) identify that within the cycle of radicalization, lone actors are enabled indirectly by people who provide inspiration for conducting terrorist activities. Indirect enabling consists of an individual who encourages terrorism through providing examples (Hamm and Spaaj, 2015). One of the most-cited enablers is Alex Jones of Infowars. It is notable that Zanettou, et al. (2017) show that 4chan traffic feeds into alternative news sites such as Infowars.
Recall that in our first regression, the Adjusted R-squared value was 0.068. This indicates that while there is statistical significance, only 6.8 percent of post volume on /pol/ can be explained by terrorist attacks. A low R-squared value is to be expected, as a great number of topics and current events are discussed on the forum. However, terrorist incidents only encapsulate the ‘worst of the worst’ of real-world activity enabled by online content. This paper focused exclusively on the University of Maryland’s Global Terrorism Database (GTD) due to the richness of the data it provides. There is no parallel database that examines hate crimes to the same degree as the GTD.
Future studies should examine the effect that hate crime has on post traffic or vice versa. Similarly, this paper only examined the relationship between attacks and post volume, disaggregating to the target selection and motivation of the perpetrator. Using data from the GTD, future studies should consider the socio-economic factors of the perpetrators themselves, or of the location where an attack occurs.
This paper has examined the link between post volume on 4chan’s /pol/ board and right-wing extremist terrorism. It has shown that there is a positive and significant correlation between post volume on /pol/ and a dataset of 169 extreme right-wing attacks taken from the GTD in 2018. By investigating this link with a 4chan board that does not contain extreme right-wing content, the anime discussion board /a/, we find that there is no correlation.
By breaking down our dataset by the perpetrator identity and target selection, lone actor and group, and claimed and unclaimed, we find a similar lack of significance. This suggests that right-wing violence affects post volume on 4chan regardless of the target selection, if the attack is claimed, or if it is perpetrated by a lone actor or a group.
By building a generalized model of traffic on 4chan, we are able to estimate the post volume on 4chan on an hourly basis. Using this model, we show that traffic on 4chan increases in the wake of a terrorist attack. Given that research shows that 4chan has an effect on content throughout the online ecosystem, this trend suggests that right-wing extremist violence effects content not only on 4chan but has influences content throughout the broader Internet.
About the authors
Simon Malevich is a security consultant at Control Risks in London, and Master’s of Global Affairs candidate at the Munk School of Global Affairs and Public Policy at the University of Toronto. He has experience countering extremist messaging in the Royal Navy, and past roles in the Canadian Armed Forces and the Global Coalition Against Daesh within the U.K.’s Foreign and Commonwealth Office.
E-mail: simon [dot] malevich [at] controlrisks [dot] comTom Robertson is the managing partner of 3i Partners, a Toronto-based risk consultancy firm. He also holds ownership interests in several technology companies, including Xpresschek Inc., and Identity First Corp. Earlier in his career, Tom spent a decade in the financial services sector where he developed an appreciation for the intersection of state security and the private sector. Tom has an undergraduate degree from the Royal Military College of Canada, completed graduate studies at Carleton University, and holds several industry certifications.
E-mail: tom [dot] robertson [at] 3ipartners [dot] ca
Notes
1. EndChan was a forum with very similar format and content as 8chan.
2. Before the attack, the perpetrator wrote in an online forum that the perpetrator of the Christchurch attack was a ‘saint’ and, ‘It’s been fun. Valhalla awaits’ (BBC News, 2019).
3. Shooters in El Paso, California (Arango, et al., 2019) and New Zealand (Evans, 2019) posted their manifestos on 8chan’s ‘politically incorrect’ board (/pol/).
4. While 8chan was the most popular site for manifestoes to be posted in 2019, we selected 4chan data since Cloudfare removed its DDoS protection on 4 August 2019. Additionally, 8chan does not have a perfect archive. A large portion of content posted to 8chan was child pornography and was thus removed. Utilizing the Internet Archive WayBack machine would not provide an accurate picture of post volume on 8chan. We thus chose to use data from 4chan’s /pol/ board, because a bellingcat survey of 75 self-identified fascists found that 10 credited 4chan as having ‘red-pilled’ them, and 4chan is the second most credited Web site in red-pilling stories (Evans, 2018).
5. This paper utilizes data from a 4chan statistics aggregator, 4stats.io, in order to gather data on the posts per day on 4chan’s /pol/ board, and anime discussion board (/a/) as a control variable.
6. An analysis conducted by VICE News of over one million posts on 4chan in July 2019 found that the site’s ‘politically incorrect’ board (/pol/) has seen a 40 percent increase in slurs against racial, ethnic, religious, and sexual minorities since 2015, and neo-Nazi propaganda has seen an increase on the site (Arthur, 2019). One of every 15 comments on 4chan contain hate speech. Comments on the site that include both hateful content and violent threats have increased by 25 percent since 2015 (Arthur, 2019).
7. The Global Terrorism Database (GTD) is perhaps the most comprehensive database of its kind, cataloguing 190,000 terrorist attacks from 1970 to 2018. The database itemises and catalogues terrorist attacks based on the time and place of the attack, weapons used, the targets, and — when known — the perpetrator (National Consortium for the Study of Terrorism and Responses to Terrorism, University of Maryland, n.d.).
8. The least squares criterion is a formula used to measure the accuracy of a straight line in depicting the data that was used to generate it. That is, the formula determines the line of best fit. This mathematical formula is used to predict the behavior of the dependent variables. The approach is also called the least squares regression line.
9. This practice is known as ‘meme-flagging’ — in order to make posts appear that they originate from a country that the community views as being humorous.
10. A distributed denial of service attack (DDoS) occurs when a server is overwhelmed with more traffic than it can handle. This traffic can render a Web site of service inoperable (Weisman, n.d.).
References
T. Arango, N. Bogel-Burroughs, and K. Benner, 2019. “Minutes before El Paso killing, hate-filled manifesto appears online,” New York Times (3 August), at https://www.nytimes.com/2019/08/03/us/patrick-crusius-el-paso-shooter-manifesto.html, accessed 17 December 2019.
R. Arthur, 2019. “We analyzed more than 1 million comments on 4chan. Hate speech there has spiked by 40% since 2015,” Vice (10 July), at https://www.vice.com/en_us/article/d3nbzy/we-analyzed-more-than-1-million-comments-on-4chan-hate-speech-there-has-spiked-by-40-since-2015, accessed 17 December 2019.
BBC News 2019. “Norway mosque shooting probed as terror act” (11 August), at https://www.bbc.com/news/world-europe-49311482, accessed 17 December 2019.
S. Braslow, 2019. “Alt-right fanboys are crushing on this Democratic presidential candidate,” Los Angeles Magazine (15 March), at https://www.lamag.com/citythinkblog/andrew-yang/, accessed 17 December 2019.
R. Evans, 2019. “Shitposting, inspirational terrorism, and the Christchurch mosque massacre,” Bellingcat (15 March), at https://www.bellingcat.com/news/rest-of-world/2019/03/15/shitposting-inspirational-terrorism-and-the-christchurch-mosque-massacre/, accessed 17 December 2019.
R. Evans, 2018. “From memes to infowars: How 75 fascist activists were ‘red-pilled’,” Bellingcat (11 October), at https://www.bellingcat.com/news/americas/2018/10/11/memes-infowars-75-fascist-activists-red-pilled/, accessed 28 December 2019.
M. Hamm and R. Spaaj, 2015. “Lone wolf terrorism in America: Using knowledge of radicalization pathways to forge prevention strategies,” U.S. Department of Justice, at https://www.ncjrs.gov/pdffiles1/nij/grants/248691.pdf, accessed 28 December 2019.
G.E. Hine, J. Onaolapo, E. De Cristofaro, N. Kourtellis, I. Leontiadis, R. Samaras, G. Stringhini, and J. Blackburn, 2017. “Kek, cucks, and God Emperor Trump: A measurement study of 4chan’s politically incorrect forum and its effects on the Web,” Proceedings of the Eleventh International AAAI Conference on Web and Social Media, at https://aaai.org/ocs/index.php/ICWSM/ICWSM17/paper/view/15670/14790, accessed 28 December 2019.
National Consortium for the Study of Terrorism and Responses to Terrorism, University of Maryland, n.d. “Global Terrorism Database (GTD),” at https://www.start.umd.edu/data-tools/global-terrorism-database-gtd, accessed 17 December 2019.
M. Thalen, 2019. “No, the Norway mosque shooter did not post to 8chan before attack,” Daily Dot (11 August), at https://www.dailydot.com/layer8/norway-mosque-shooter-8chan/, accessed 28 December 2019.
R. Thebault, 2019. “Andrew Yang is running for president. Haven’t heard of him? You will soon,” Washington Post (14 March), at https://www.washingtonpost.com/politics/2019/03/14/andrew-yang-is-running-president-havent-heard-him-you-will-soon/, accessed 17 December 2019.
S. Weisman, n.d. “What is a distributed denial of service attack (DDoS) and what can you do about them?” Norton, at https://us.norton.com/internetsecurity-emerging-threats-what-is-a-ddos-attack-30sectech-by-norton.html, accessed 17 December 2019.
S. Zannettou, T. Caulfield, E. De Cristofaro, N. Kourtelris, I. Leontiadis, M. Sirivianos, G. Stringhini, and J. Blackburn, 2017. “The Web centipede: Understanding how Web communities influence each other through the lens of mainstream and alternative news sources,” IMC ’17: Proceedings of the 2017 Internet Measurement Conference, pp. 405–417.
doi: https://doi.org/10.1145/3131365.3131390, accessed 28 December 2019.
Editorial history
Received 28 December 2019; accepted 25 February 2020.
Copyright © 2020, Simon Malevich and Tom Robertson. All Rights Reserved.
Violence begetting violence: An examination of extremist content on deep Web social networks
by Simon Malevich and Tom Robertson.
First Monday, Volume 25, Number 3 - 2 March 2020
https://firstmonday.org/ojs/index.php/fm/article/download/10421/9403
doi: http://dx.doi.org/10.5210/fm.v25i3.10421
