Previous
posts: part
1, part
2, part
3.
In the fall of 2026, as the school year began, the situation took a sharp turn for the worse. First, the geographic focus shifted dramatically—from Southeast Asia to West Asia and Eastern Europe. The main attacks targeted Turkey and Poland.
I cannot say for certain why these two countries in
particular were targeted; there is too little information available for
analysis. We need the results of the police investigation, especially the
interrogations of suspects and the findings of forensic analyses—but this
information is classified.
In any case, there is unlikely to be a single cause
here; it is always a combination of several factors, which we will be able to
identify once more information becomes available. But there is one factor I can
confidently identify right now: ease of execution. If we examine the chronology
of events across all the incidents this fall in Turkey and Poland, the same
recurring pattern emerges everywhere: the way the perpetrators gained access to
the crime scenes—through unrestricted entry. They entered the educational
institution unimpeded, brought in weapons, committed the crime, and in several
cases even managed to escape before the police arrived.
No further comment is needed here: schools and other
educational institutions have been and remain easy targets for criminals and
terrorists. Those who plan attacks, recruit and train perpetrators, and
organize and oversee these processes in their final stages are well aware of
this and skillfully exploit it. This is the first vulnerability that extremists
actively exploit, and their hand, according to statements made in the media by
official law enforcement representatives, has been evident in nearly all
attacks.
The second vulnerability is the authorities’ response
to such attacks - its formulaic and predictable nature. At first, law
enforcement agencies simply deny the very existence of the threat; then they
claim that it exists but is insignificant, and that all available facts are
exaggerations and sensationalism. Naturally, no effective countermeasures are
implemented; all intervention is limited to a few measures that are largely ineffective
and, for the most part, merely symbolic.
The third vulnerability is the (again, predictable)
approach taken by authorities when a situation spirals out of control—one that
prioritizes short-term populism over systemic effectiveness. Prominent examples
this year include Russia, the Philippines, Turkey, and Poland. The scenario is
always the same and can be summed up by a well-known aphorism: «Using a cannon
to shoot sparrows» - loud, dramatic, but ineffective. To elaborate, law
enforcement agencies begin detaining anyone who has even an indirect connection
to extremist online communities—whether they’ve subscribed to their groups,
liked posts, written comments, or shared content; or posted extremist material
or links to such content on their own pages. Groups, channels, and individual
accounts are blocked; in cases where social media and messaging platform
operators refuse to cooperate, the entire platform is blocked. Those detained
are questioned, and interviews are conducted with their parents (most often
teenagers), teachers, and school psychologists. Depending on the degree of
involvement, they are placed on police watch lists at their place of residence,
and monitoring groups are established in schools for students prone to violence
or its justification. Comprehensive investigations are conducted into the work
of security personnel, psychologists, and educators in educational
institutions. I should note, however, that these investigations are very often
deliberately biased, with the primary goal of the investigators not being to
understand the situation, but to identify as many violations as possible and
assign blame.
None of this has any real impact on security in the
long term; it is merely necessary for reporting purposes and to create the
appearance of action.
Here is a recent and quite telling example from
Turkey. In late September of this year, following a series of attacks on
schools, the Republic’s Ministry of the Interior conducted a large-scale
operation to combat provocative online posts and reported
on the results. A total of 3,810 people were detained for posting offensive
and provocative messages; 304 were arrested and taken into custody; and 1,163
were placed under police supervision. Access was blocked to 817 websites
associated with 359 different digital games promoting obscenity. In addition,
1,532 websites advertising these games were blocked. A total of 448 channels on
messaging apps and social media were also blocked. The total number of
addresses for which decisions were made to block access and remove content
amounted to 12,141. The figures are certainly impressive. However, a little
over a week later, there was another attack on the school, and another one a
week after that.
As I’ve already mentioned in previous parts, criminals
have now changed their tactics; the primary method of interaction is direct
communication between the recruiter (handler) and the prospective perpetrator.
They do not use mass mailings or engage in active propaganda in social media or
messaging app communities with thousands of members. They take an
individualized approach to each victim, and the selection of potential recruits
is by no means random. Criminals target a specific audience of teenagers whose
personality traits meet their requirements, with the aim of psychologically
manipulating them for future use as perpetrators of mass murders and other
serious crimes.
Currently, with the advancement of technology -
particularly AI-based technology - the search for potential victims based on
specific criteria has become significantly easier for criminals. When search
algorithms are properly configured to target markers of a specific psychotype,
an AI-based system processes vast amounts of data from teenagers’ profiles on
social media and gaming platforms and analyzes their activity. In addition, in
the first part of this series of articles, I speculated on other sources from
which they might obtain information about potential recruitment targets.
After collecting and processing the data, the
criminals move on to personally assessing each of the candidates they have
selected. I want to emphasize that all of this is done directly, through
personal contact - not in a day, not in two days, and not in a week. They
engage the teenager in conversation, asking questions - at first general and
harmless ones - and gradually build a relationship of trust. During these
conversations, «test questions» are asked and «indicator» topics are discussed;
based on the answers and reactions, the recruiters draw conclusions about the
child’s suitability for carrying out their criminal plans and the advisability
of continuing to work with them. At the same time, the recruiters’ own accounts
on social media, messaging apps, and gaming platforms contain no prohibited or
suspicious material. Therefore, all these mass police raids on the Internet
pose no threat to them. A huge amount of time, human resources, and material
resources is spent on such «special operations», yet the result is nothing more
than a nice photo op for the media. I cannot say for certain - this is merely
my assumption - but the incident in Turkey could very well have been a public
slap in the face to the authorities, in response to their report.
There is no doubt that we must combat the spread of
calls for violence and discrimination, as well as other harmful content, but
this must be done not just once every few years as part of another special
operation - as is currently the case - but on an ongoing basis. Communities and
channels that spread extremist ideology on social media and messaging apps must
be blocked right from the start, before they gain significant influence. We
must not limit ourselves to simply blocking them, but must also identify,
locate, and hold their administrators and authors accountable. Only then can we
ensure that the information space remains consistently and adequately free of
such content. The most important task of prevention will be accomplished.
Often this year, in comments on news stories about yet
another tragedy, I’ve heard people say that the situation is spiraling out of
control. Yes, that is true, and there is nothing unusual or unexpected about
it, because the situation is developing unopposed, in a favorable and
comfortable environment. Without a radical change in strategy, it will not be
possible to turn the situation around.
In previous articles, I have put forward my proposals
regarding measures for information gathering, prevention, and containment of
this threat, as well as interagency and international cooperation. However,
defensive measures alone are not enough; they can only slow the spread of the
threat and reduce its intensity, but active measures are needed to effectively
counter it. To do this, we must focus our efforts on identifying and bringing
to justice the middle - yet most crucial—link in this criminal chain: the
recruiters and so-called «handlers». It is precisely their elimination that can
bring down the entire system of management and operations of extremist
communities that recruit teenagers to commit mass murders and other
particularly serious crimes.
Why is this link the most important and, at the same
time, the most vulnerable? To begin with, we need to understand exactly who
these individuals are (I cannot bring myself to call them «people»). They are
those who deliberately persuade teenagers to commit suicide and carry out mass
killings of their classmates or other children, while fully understanding exactly
what they are doing and the consequences their actions will bring. For this
individual, this is not an isolated incident but an ongoing process; in fact,
for them, it’s a job - once they’re done with one victim, they move on to the
next.
I am not an expert in psychology or psychiatry (though
I am somewhat familiar with the basics, through self-study), but even I
understand that a mentally healthy person - and even someone with certain
abnormalities and a propensity for criminal activity - is not capable of such a
thing. According to the experts I’ve consulted, these are people with specific
mental disorders; however, they aren’t entirely antisocial and often have
above-average intelligence. They know how to communicate with teenagers, spark
their interest, gain their trust, persuasively present their case, subjugate
the child’s personality, and maintain control over them until they achieve
their goal. At the same time, they must do this remotely, remaining in the
shadows, without face-to-face meetings or revealing their true identity. They
must also possess certain skills in psychology and behavioral analysis, as well
as skills in searching for, gathering, and analyzing information, and in
secrecy and information security.
Most importantly, according to experts, there are not
many people who combine these psychological traits, personal qualities, and
professional skills. Therefore, it will be very difficult to find a fully
adequate replacement for such an individual. This is their main vulnerability:
the presence of a component that is difficult to replace makes any mechanism
problematic. The use of simpler and cheaper alternatives reduces the
mechanism’s performance and reliability, often requires more frequent
replacement of components and consumables, shortens its service life, and
ultimately causes it to fail completely.
It is precisely this process that must be set in
motion, by focusing all law enforcement efforts on identifying and bringing to
justice the recruiters and handlers of extremist communities. Yes, this is no
easy task, but it is entirely feasible, provided that the proposals I have put
forward in previous installments of this series of articles are implemented. In
short, an international working group composed of experts in criminology,
intelligence, information security, psychology, behavioral analysis, and
related fields would be able, within a relatively short timeframe, to gather
and process the necessary volume of information on both potential victims and
recruiters. It could determine their psychological profiles, strengths and
weaknesses, thought processes, and patterns of behavior - and, most
importantly, understand exactly how they find one another.
Armed with such information, legal and technical
resources, as well as international cooperation, law enforcement agencies will
have little difficulty planning, coordinating, and carrying out a full range of
operational and investigative measures aimed at identifying these individuals,
gathering evidence of their guilt, and subsequently arresting them. I will not
discuss the specific types and forms of such measures, since this article is
publicly available, and I have no intention of giving criminals any tips. I am
confident that professionals with experience in the police and other law enforcement
agencies understand exactly what I am talking about.
This stage of countering the threat posed by online
extremist communities is one of those rare cases where we can rely on sheer
numbers. As I mentioned earlier, these individuals share a certain psychotype -
a set of personality traits and skills - that makes them suited for such
activities. Most importantly, there aren’t that many people with this
particular set of personality traits, especially among those who are at large.
Therefore, the more handlers and recruiters are identified and isolated, the
weaker the network will become. With each new arrest, it will become
increasingly difficult to find replacements for such individuals. More and more
time will be spent selecting replacements, less and less time will be available
for training them, and the quality of the recruits will continue to decline.
This means that their effectiveness and efficiency will decrease with each
attempt, and they will make more and more mistakes.
The result will be obvious: the number of mass
killings committed by teenagers in schools and other educational institutions
will begin to decline significantly. At the same time, the level of radicalism
and aggression among young people will also decrease significantly.
In conclusion to Part 4, I would like to reiterate
that the threat posed by «Death groups» and other destructive online
communities has long since become an international one. Advances in information
technology and new forms and methods of communication have erased the
boundaries between countries and continents. Unfortunately, criminals and
extremists are actively exploiting this, and their communities have rapidly
become transnational. Under such circumstances, a decentralized security system
- where everyone is on their own - has become ineffective. We can only counter
these threats by working together, consolidating our efforts on an
international level, and taking a proactive, preemptive, and anticipatory
approach. If we do so, we have every chance of winning this battle for a safe
future for our children.
Author: Roman Grishin
#schoolsafety #schoolsecurity #educationalsecurity #educationalsafety #violenceprevention #Turkey #Poland #schoolshooting #research #criminology #deathgroups #extremism #terrorism #threat #K-12 #764 #reddolphin #bluewhale
No comments:
Post a Comment