Wikisource

Intelligence and Security Committee Report: Extreme Right-Wing Terrorism/The Online Space

< Intelligence and Security Committee Report: Extreme Right-Wing Terrorism
←
The International Dimension
Intelligence and Security Committee Report: Extreme Right-Wing Terrorism (2022)
the Intelligence and Security Committee of Parliament
Targets
→
4595121Intelligence and Security Committee Report: Extreme Right-Wing Terrorism2022the Intelligence and Security Committee of Parliament

​THE ONLINE SPACE

133. Historically, a journey into Right-Wing Extremism entailed real-world contact with organised groups and individuals in person, often through street demonstrations or music festivals. The combined deterrent of a police presence and travel logistics, together with a reticence to be seen publicly associating with controversial groups, discouraged many would-be members.

134. The internet has removed these barriers. Individuals can be anonymous and conduct online research from the privacy of their own homes, while organised groups can disseminate propaganda and recruit new members online. This recruitment can start with an invitation to a closed chat room in an online gaming community, or with a link to a closed forum. This global accessibility means a growing number of people now have access to, and are exploring, ERWT content online.

135. Nick Lowles, Chief Executive of Hope Not Hate, said that the online space is "much harder to track. Groups start up and close quite quickly",[1] and the Director General of MI5 acknowledges the particular challenges of Extreme Right-Wing Terrorism (ERWT) online:

*** the ERWT online environment, whose distinctive sub-cultures, complex ideologies and propensity for violent but empty rhetoric make it hard to distinguish which individuals actually pose a genuine terrorist threat and which do not.[2]

136. ERWT material online appears to be more difficult to tackle than Islamist terrorism propaganda, perhaps because of the wider lack of understanding of the ERWT threat, and concerns regarding freedom of speech (particularly in the US where material held on US-owned platforms can go unchallenged owing to the US Constitution's First Amendment).[3] The Joint Terrorism Analysis Centre (JTAC) also noted in 2019 that some of the secure messaging apps (SMAS) ***.[4]

Categories of ERWT content online

137. The Home Office's Extremism Analysis Unit (EAU) and the Research and Information Communications Unit (RICU; part of Homeland Security Group) have built a categorisation framework[5] which divides the Extreme Right-Wing (XRW) material that can be found online into seven categories as follows.

Performative propaganda

138. This comprises videos, images and streams of terrorist attacks and attackers, which may be produced and uploaded by parties—including the attacker as well as bystanders—and ​are often re-uploaded repeatedly after an incident's conclusion. Videos of ERWT attacks are primarily recorded by the perpetrator. This is a relatively new trend in ERWT, beginning when Brenton Tarrant live-streamed the Christchurch attack on Facebook. Videos produced by perpetrators are in many cases removed by communication service providers (CSPs), either via their own proactive detection technology, or following referrals from law enforcement. The EAU-RICU report advised that when videos are produced by bystanders, there are complications as to whether the footage can be taken down from social media platforms in the same way.

139. While videos of ERWT attacks are less accessible on mainstream platforms, they can be found on:

  • Chatrooms and imageboards: Marginal social media sites popular with ERWT and XRW audiences are often poorly moderated and enable users to freely share this content. For example, in November 2020 the video of Brenton Tarrant's attack in Christchurch could still be found online.[6]
  • Alternative search engines: Using search engines that are not as regulated as Google makes it more likely that a user will find this content.
  • Archives: Archive platforms often still carry videos of attacks: for example, ***. Users of popular ERWT sites will actively encourage each other to archive content, particularly if they consider that there is a possibility that it may be removed from the sites on the grounds that it contains terrorist material.

Attack 'manifestos'

140. Attack 'manifestos' have an important function for the ERWT community—their authorship by previous attackers showcases ideology and they are seen as inspirational for individuals who may be planning to launch their own attacks. The EAU-RICU report noted that these are not usually subject to concerted efforts at removal. In March 2021, for example, it was still possible to access Anders Breivik's 'manifesto' online.

Group-aligned ERWT propaganda

141. Group-aligned ERWT propaganda is easily accessible through standard search engines (e.g. Google), as well as through other platforms such as Telegram. The UK-based video-hosting site BitChute hosts a number of pieces of video propaganda aligned with proscribed ERWT groups (such as National Action). Whilst this propaganda is not available to view from a UK IP address, any individual subscribing to a Virtual Private Network (VPN) provider can access these videos quite easily.

​Memes with ERWT connotations

142. These are memes[7] which are doctored or appropriated images used to portray a terrorist narrative—by definition these will be widely shared and evolve in nature as users update and make edits. They serve a variety of functions, including:

  • Increasing influence: Being a 'meme-lord', someone reputed for producing popular memes, is a mark of prestige.
  • Group identification: Memes provide in-group identification and can be used to simulate a chain of responses among online communities on social media.
  • Signposting: Memes can encourage signposting to other content by hosting a hashtag or link in the corner of the image.

Discourse that incites, promotes or glorifies terrorism

143. Discourse that incites, promotes or glorifies ERWT can be found on openly accessible online forums—threads focusing on Brenton Tarrant (often referring to him as a 'Saint') are posted regularly on 4chan and other spaces frequented by ERWT audiences.

Video content used to popularise Right-Wing Extremist narratives by influencers

144. This includes videologs, interviews, documentaries or professional videos that mainstream extremist narratives:

  • Videologs: Hand-held videologs cultivate an image of authenticity and an illusion of proximity between influencers and their audiences.
  • Professional videos.
  • Documentaries: Many videos are produced using common documentary features such as interviews, data visualisation of statistics and narration over stock video footage.

Online ideological literature

145. Individuals view, suggest and exchange ideological literature online:

  • 'Cultural Nationalists' promote a somewhat generic ideology, which promotes a narrative of British culture being under attack from a range of foreign influences and trends, notably Islam, immigration, globalism and multiculturalism. They are also critical of what they view as domestic cultural and political elites.
  • 'White Nationalists' and 'White Supremacists' have a more actively conspiratorial view than 'Cultural Nationalists' and believe the so called 'indigenous' white race is being destroyed by a global conspiracy. The glorification of Nazi Germany and ​ the denial of Nazi war crimes form an important part of ideology and culture (for example, revisionist accounts of the Second World War, such as David Irving's Hitler's War).

146. The Home Office acknowledges, however, that whilst they are developing their understanding of the material online they do not at present have a granular understanding of the volume of this material or indeed which categories are the most widely accessed:

I have to be frank, I am not confident that even a year from now we will be able to because the material moves quite quickly, the platforms on which people operate move quite quickly, and so our ability to keep track of this is quite difficult.[8]

The XRW space was described as particularly challenging because:

So much of this material is rather more subtle, dog-whistle material, use of sarcasm, use of images which are not immediately obvious to individuals who are not within this milieu . . . this is a much more sophisticated set of propaganda than we have experienced in the past. That is not to say that ISIL and AQ propaganda is not highly sophisticated; it is, but it is much more conventional than the material that sits here.[9]

Platforms hosting ERWT material

147. JTAC assesses that these categories of material can be found on a variety of platforms and at different levels of encryption.[10] These five types of platforms are addressed below, but the headlines are:

  • XRW terrorists and extremists use an array of SMAS (i.e. encrypted apps) to communicate with like-minded individuals. It is highly likely that their reliance on SMAs will increase.
  • Some SMAS ***.[11]
  • Propaganda and rhetoric posted on both mainstream and ERWT-specific social networking sites/fora could inspire a Self-Initiated Terrorist to commit a terrorist attack.
  • Some ERWT-focused sites provide safe havens for violent, extremist rhetoric, which can further radicalise individuals and present networking opportunities for Extreme Right-Wing Terrorists.
  • With a large proportion of UK ERWT members being young and computer literate, it is highly likely that a growing number of the community have at least rudimentary knowledge of the benefits of VPNs and there is an awareness in some ERWT circles of the potential use of the 'dark web'.
    ​
  • There is limited use of ***.

Mainstream social media sites

148. XRW terrorists and extremists use an array of social media sites, many of which are considered 'mainstream', such as Facebook, Twitter and Instagram. For example:

  • National Action issued a series of tweets in 2016 applauding the murder of Jo Cox MP.
  • Stephen Yaxley-Lennon (also known as Tommy Robinson—co-founder and former leader of the English Defence League)[12]—developed a substantial following on Facebook prior to his lifetime ban in February 2019.

149. Extreme Right-Wing Terrorists use *** mainstream social networking sites to communicate, although there is evidence that they self-censor ***. The fact that they continue to use mainstream media applications, despite the restrictive measures introduced by such applications to withdraw content against guidelines, suggests that they view the benefits of reaching a wider audience as outweighing the risk of their accounts being suspended and the possibility of increased scrutiny by the authorities. The Home Office pointed to the commercial benefits of the mainstream applications as a particular draw for Extreme Right-Wing Terrorists:

If you are trying to monetise your activity, you cannot really do that on the little platforms because there are not enough people out there. You can do it on the bigger ones, so one of the conversations we are having a lot with the CSPs at the moment is, is this really what you want to see being used on your platforms for commercial gains by third parties, and I am quite hopeful of that over the next year.[13]

The Government's dialogue with the CSPs, and the measures it is taking with regard to tackling extremist and terrorist content online, can be found later in this Report.

'Fringe' social networking sites

150. There are a range of fringe social networking sites and online fora which are used primarily by Extreme Right-Wing Terrorists. These include: Gab, 8kun (formerly known as 8chan) and 4chan—all sites which offer something of a 'safe haven' for individuals and offer greater anonymity for users.

151. Brenton Tarrant, the Christchurch attacker, was a user of 8chan. The site was shut down in August 2019 by the service provider Cloudflare in the wake of the El Paso shooting. However, on 8 August 2019, The Guardian reported that this action had simply shifted users to other platforms:

​

Former members of 8chan have scattered across the internet after the far-right site was shut down over the weekend, finding new homes in other right wing sites, on encrypted messaging services, and on major social media platforms . . . Among the sites 8chan users appear to be relocating to is Gab, the forum frequented by the alleged shooter in the November 2018 Pittsburgh synagogue attack. In a statement released on Wednesday, Gab said it was adding more than 1,000 users a day as 'big tech bans people'.[14]

152. The EAU notes that the culture of 4chan is not welcoming to people claiming to be involved in organised groups, viewing them as either:

government-led hoaxes designed to entrap people, or ineffective clusters of people playing games rather than taking action . . . in contrast, 4chan and 8chan praise lone actor attackers such as Brenton Tarrant, perceived to be focused on causing chaos rather than associated with a specific group with an overt ideology.[15]

Online fora and dedicated extremist websites

153. There are a number of dedicated extremist websites and online haunts, frequented by the most extreme elements of the Far Right, such as Stormfront and Fascist Forge. JTAC advises that these sites, along with the fringe social networking sites above, are key influencers, ***.

Secure messaging applications

154. Secure messaging applications (SMAs) are messaging applications which use encryption to keep messages secure. For example:

  • Telegram, which includes features such as self-deleting messages (***). JTAC assesses that ***.[16]
  • Tutanota, which offers end-to-end encryption of emails (***).

155. They are used by ERWT groups and individuals to plan meetings, exchange media and propaganda and communicate with other like-minded individuals. This is all achieved in a space with more robust communications security than through social media sites. JTAC assesses that it is this enhanced security which is so ***. As ERWT groups in the UK, such as National Action and Sonnenkrieg Division (both now proscribed organisations), expand their links with ERWT individuals and groups based in ***, it is likely that their reliance on SMAS will increase. However, JTAC acknowledges that:

***.[17]

​Gaming platforms

156. Homeland Security Group noted: "There is no question there is an over-representation of young people interested in Right Wing Extremism in the gaming space".[18] Specific features of some gaming-related platforms facilitate online radicalisation by creating an environment in which radicalisation can occur. Gaming platforms are an alternative to the more traditional commercial messaging applications for terrorists to communicate online, and have been used to:

  • recruit new followers;
  • disseminate propaganda; and
  • as a means of communication.

157. Many games have a built-in chat functionality, and there are also a number of third-party applications designed primarily for the gaming community with similar features to traditional SMAs these include Steam, Twitch and Discord.

158. Discord is a freeware VOIP (Voice over IP) application and digital distribution platform, designed initially for the gaming community—accessed via a web browser or mobile app, it can be used to build private, invite-only groups. JTAC advises that:

It is plausible that some RW terrorists began using Discord due to a background in online gaming. This is reflected in the common parlance of RW terrorists, where phrases such as 'NPC' (Non-Player Character) are used to refer to an individual who does not partake in enough RW terrorist activity. John Earnest, the San Diego shooter, made reference to getting a "high score" (by context, causing many deaths) in the letter he released prior to carrying out his attack. ***.[19]

159. *** there are three factors which might lead to more widespread use of gaming platforms:

  • ***;
  • ***; and
  • ***.[20]

160. Overall, the sheer volume of Right-Wing Extremist content in the online space and the lack of accountability of these organisations is a formidable challenge. The Commission for Countering Extremism (CCE) observes that, whilst action is being taken by larger organisations such as Facebook, other smaller platforms such as BitChute continue to host and promote extremist content:

Some of the Far Right extremist content and support for terrorist causes found on BitChute include videos showing and/or advocating violence towards ethnic minorities, and racist rhetoric towards black and other ​non-white communities. Videos have also included support for proscribed group National Action, celebration of British terrorist David Copeland and support for Australian terrorist Brenton Tarrant. BitChute have not faced any penalties for their content, despite the platform containing significant hateful and violent extremist content. While BitChute is known as a smaller platform, it tweeted of having 20 million unique visitors in April 2020 alone.[21]

Progressing through the ecosystem

161. In terms of the different platforms, there is a clear 'progression'. As the internet has grown, its use by the XRW has increased significantly. Extremists can now connect to potential new recruits via mainstream platforms such as Facebook, YouTube, Twitter and Reddit, before then encouraging them to move to using low- or zero-moderation fringe platforms such as 4chan, 8kun (formerly known as 8chan) and Gab where they will be exposed to more extreme content.[22] From there, they may also use encrypted apps (referred to by the Agencies as SMAs)[23] such as Telegram and Discord to coordinate and plan.[24] Once potential targets are channelled into small online 'echo chambers' on niche or private platforms, isolated from opposing viewpoints, it becomes much easier for recruiters to present them with violent material without fear of being banned by mainstream platforms or facing social censure.

162. However, not everyone will be guided through the online extremist ecosystem by an individual recruiter. Some will 'self-radicalise', gradually—or sometimes quickly—making their way through these stages to more extreme material as they seek out figures and ideologies that confirm their pre-existing biases.


​163. As well as providing an ecosystem that facilitates radicalisation, the online space can result in individuals, such as Anders Breivik and Brenton Tarrant, assuming 'cult-like' status:

  • In July 2011, Anders Breivik carried out a mass shooting against the Workers Youth League (AUF), killing 69 people, and detonated an Improvised Explosive Device (IED) in central Oslo. He was convicted in 2012 of mass murder, causing a fatal explosion and terrorism.
  • On 15 March 2019, Australian national Brenton Tarrant conducted a terrorist attack in Christchurch, New Zealand, killing 51 and injuring 49. Tarrant live-streamed the attack on Facebook and posted links to his 'manifesto' on 8chan, an XRW-dominated site. In the first 24 hours after the attack, it is known that there were at least 1.5 million attempts to upload the video. Tarrant was inspired by ERWT international narratives, marking his weapons with the names of attackers and attacks from around the world and including references to the Finsbury Park attack in his manifesto. Although he took inspiration from multiple sources, it is highly likely that he is not a member of any ERWT group.[25]

164. In the intervening years since the attacks, Tarrant and Breivik have assumed 'cult-like' status, with aspiring Extreme Right-Wing Terrorists seeking to replicate elements of the attacks. JTAC advises that it is likely that if a UK-based individual active in the XRW online space planned to conduct an attack that received similar admiration to Tarrant's, they would aspire to conduct a high-impact attack with a high number of fatalities, or 'kill count'.[26]

Disrupting online activity: Feuerkrieg Division

165. The Feuerkrieg Division (FKD) was a predominantly online group made of international members who have coalesced in the online space.[27] ***, and the group was proscribed by the Home Secretary on 17 July 2020.

​

Feuerkrieg Division (FKD)

  • Whilst FKD was primarily an online group, ***.
  • For example, a child subject to reporting restrictions and Paul Dunleavy, both FKD members who aspired to obtain firearms to conduct activity in support of their ERWT ideology, were both arrested under the Terrorism Act (TACT) 2000 in 2019. The child subject to reporting restrictions was sentenced in February 2021 to a two-year youth rehabilitation order after pleading guilty to ten counts of collecting information likely to be useful to those involved in acts of terrorism (S.58 TACT 2000) and one count of disseminating terrorist publications (S.2 TACT 2006). Paul Dunleavy was sentenced in November 2020 to five and a half years' imprisonment for the preparation of terrorist acts (S.5 TACT 2006),[28] and two years' imprisonment (to run concurrently) for nine counts of collecting information likely to be useful to those involved in acts of terrorism (S.58 TACT 2000).
  • Another notable disruption is that of Luke Hunter, an FKD affiliate who created videos and propaganda for the group. Hunter had a huge online footprint in the Right-Wing Extremist space, administering his own website, hosting podcasts, creating propaganda and running a popular Telegram channel—all of which espoused extreme and violent views, frequently inciting ERWT-inspired attacks against perceived enemies. Luke Hunter was sentenced in December 2020 to four years and two months' imprisonment after pleading guilty to four counts of encouragement of terrorism (S.1 TACT 2006), three counts of disseminating terrorist publications (S.2 TACT 2006), and a single count of collecting information likely to be useful to those involved in acts of terrorism (S.58 TACT 2000).

166. JTAC assesses that external pressures (from law enforcement in the form of arrests for terrorism offences as well as the proscription of organisations such as FKD) has resulted in individuals active in the online space becoming increasingly cautious about joining established terrorist groups.[29] It is also possible that reports of government online targeting of organisations has had an inhibiting effect—there have, for example, been media reports that RICU has infiltrated the Order of Nine Angles (ONA/O9A) movement: "Whitehall sources said the RICU operation was set to build a case for banning ONA, which is considered to be the most extreme Far-Right Network in the world."[30]

K. Nevertheless, it is clear that the Extreme Right-Wing Terrorism online environment poses a new challenge for the Intelligence Community, and there is still a long way to go when it comes to tackling what is largely an ungoverned space. The Head of Counter Terrorism Policing told the Committee that "the single biggest thing that keeps me awake at night is the proliferation of online and its ability to radicalise and incite people".[31] The Director General of MI5 pointed to the particular challenge of determining Extreme Right-Wing activity online which could translate into 'real-world' terrorist activity:

​

the activity itself is often just online espousal of violent views without any real world accompanying activity and so often we are monitoring something which is just online and nothing else, potentially for years on end, but it doesn't take much for an individual or a small group of individuals to change their direction and do something violent in the real world.[32]

The measures being taken by the Intelligence Community and CTP to counter ERWT activity in the online space are covered later in this Report.

  1. ↑ Oral evidence - Nick Lowles, Hope Not Hate, 16 December 2020.
  2. ↑ Written evidence - MI5, 30 September 2020.
  3. ↑ The Constitution of the United States of America is the supreme law of the United States. The First Amendment provides that Congress makes no law respecting an establishment of religion or prohibiting its free exercise. It protects freedom of speech, the press, assembly, and the right to petition the government for a redress of grievance.
  4. ↑ JTAC paper, 4 July 2019.
  5. ↑ 'Framework for Understanding Right-Wing Terrorist and Extremist Activity Online', EAU and RICU, 18 November 2020.
  6. ↑ The video of Tarrant's attack could be found on ***, a message boarding site on the dark web.
  7. ↑ A meme is a virally transmitted image embellished with text, generally sharing pointed commentary on cultural symbols, social ideas or events.
  8. ↑ Oral evidence - Home Office, 28 April 2021.
  9. ↑ Oral evidence - Home Office, 28 April 2021.
  10. ↑ JTAC paper, 4 July 2019.
  11. ↑ A Subject of Interest (SOI) is someone (or something) who is, or has been, investigated because they are suspected of being a threat to national security.
  12. ↑ The English Defence League (EDL) is a Far-Right Islamophobic organisation in the UK. According to its mission statement: "The English Defence League has arisen from the English working class to act, lead and inspire it in the struggle against global Islamification" (www.englishdefenceleague.org.uk).
  13. ↑ Oral evidence - Home Office, 28 April 2021.
  14. ↑ '8chan: Ex-users of far-right site flock to new homes across the internet', The Guardian, 9 August 2019.
  15. ↑ RICU, 'Atomwaffen Division and the evolution of the international White Supremacist movement', September 2020.
  16. ↑ JTAC paper, 4 July 2019.
  17. ↑ JTAC paper, 4 July 2019.
  18. ↑ Oral evidence - Home Office, 28 April 2021.
  19. ↑ JTAC paper, 8 January 2020.
  20. ↑ ***.
  21. ↑ Written evidence - CCE, 17 December 2020.
  22. ↑ Mainstream social media platforms such as Twitter have terms of use which prohibit certain kinds of offensive content and hate speech, and they look to remove posts which violate these terms of use. However, there are a number of newer 'fringe' social media sites which market themselves as 'free speech' platforms, and therefore do not police the content posted there, even when it is explicitly extreme or violent.
  23. ↑ For example, secure messaging apps (SMAs) such as Telegram encrypt users' data on mobile telephones by default, in a way that even the companies themselves cannot decrypt. This essentially places the data on those telephones beyond the reach of any law enforcement agencies, even where they have obtained a lawful court order for access.
  24. ↑ Munich Security Report 2020.
  25. ↑ JTAC paper, 6 September 2019.
  26. ↑ JTAC paper, 21 October 2020.
  27. ↑ ISC Right-Wing Terrorism Inquiry Background Evidence - The Threat' - Written evidence, CTP and MI5, 31 January 2020.
  28. ↑ Section 5 of the 2006 Terrorism Act provides that an offence is committed if: a) a person intends to commit acts of terrorism, or b) a person intends to assist another to commit such acts; and c) a person engages in any conduct in preparation for giving effect to his intention. Acts of terrorism are defined as being anything constituting an action taken for the purposes of terrorism.
  29. ↑ JTAC paper, 19 November 2020.
  30. ↑ 'Government propaganda unit is given secret mission to infiltrate neo-Nazis linked to murders and terror plots around the world', Mail on Sunday, 3 January 2021.
  31. ↑ Oral evidence - CTP, 28 April 2021.
  32. ↑ Oral evidence - MI5, 28 April 2021.
Retrieved from "https://en.wikisource.org/w/index.php?title=Intelligence_and_Security_Committee_Report:_Extreme_Right-Wing_Terrorism/The_Online_Space&oldid=14436797"