Online Extremist Communities and Mass Killings at Schools and Other Educational Institutions. Part 3.

 

Continued: Previous posts: Part 1, Part 2.

The implementation of additional monitoring measures and both overt and covert interventions targeting adolescents in potential at-risk groups* within educational and childcare institutions. This should have a significant impact on the total number of potential victims of «Death Group» recruiters and, consequently, on the number of perpetrators of crimes committed at the direction of and in the interests of these groups. As a result: a reduction in the activity of such groups, a slowdown in the spread of the extremist ideas they promote, and, most importantly, a decrease in the number of serious and particularly serious crimes committed by their members in countries where this work is actually carried out.

If this approach is integrated into the work of psychologists and sociologists at educational and other children’s institutions on a permanent basis, Maintaining the work of an international monitoring and coordination group - which will track changes in the situation and adjust detection and countermeasures accordingly- will serve as an effective deterrent to the threat and, in the long term, help bring the situation under control.

As an effective complement to the aforementioned deterrence measures- one that reduces the number of potential victims for recruiters - I would suggest that the leadership of schools, other educational institutions, and places where large numbers of children and adolescents gather consider implementing an approach such as CPTED.

 CPTED: The concept of «Crime Prevention Through Environmental Design» (CPTED) is an approach aimed at reducing crime by altering the physical environment in which it occurs. The core of the concept is that a well-designed physical space can prevent crime, deter undesirable behavior, and strengthen community ties.

 The effectiveness of this method in reducing violence in educational institutions has been confirmed by many years of practical research conducted by Safe Havens International (SHI) - one of the world’s oldest and most experienced expert and analytical organizations specializing in improving safety in educational institutions.

For more details on CPTED implementation methods and the results achieved, see the articles by SHI Executive Director Michael Dorn, a recognized international expert in the field of school safety and security.

Although creating a more comfortable psychological and emotional environment does not solve all security problems and does not have a guaranteed effect on all at-risk adolescents, according to research findings, the use of such methods can reduce anxiety, stress, and aggression among some adolescents by 10–15 percent, thereby reducing the number of potential victims. And the fewer such emotionally and psychologically vulnerable adolescents there are, the more difficult it will be for recruiters from «death groups» to attract and control them.

It’s simple math. Today, «curators» from extremist communities recruit hundreds and thousands of teenagers through their online platforms, but at best, only dozens agree to participate in active operations, and only a handful commit particularly serious crimes. By reducing the initial number, we will reduce the rest as well. Even a 10–15% reduction would be a good result here.

The next aspect of the threat containment phase is blocking the online resources used by criminals. It is important to understand that this aspect is extremely complex, both technically and legally. Blocking must be precise and targeted, focusing on specific communities and individual accounts through which extremist material is disseminated and teenagers are recruited to engage in criminal and terrorist activities.

In this situation, criminals exploit several existing vulnerabilities. I have identified five main problems that we face:

1.    The difficulty of blocking individual accounts on social media and messaging apps.

Using technical and software-based blocking tools, it is practically impossible to restrict access to one (or more) individual accounts without the involvement of the social media or messaging app administration.

2. The complexity and length of the legal and administrative procedures required to obtain court orders to block such websites, as well as individual profiles and communities.

As a follow-up to point 1: The administrators of social media platforms and messaging apps generally recognize the threat, but—in accordance with their internal policies, as well as national and international legal instruments on freedom of speech and information - they require law enforcement agencies to provide evidence and, often, court orders to block accounts. Obtaining such a ruling is not easy, and often takes a long time—sometimes weeks or months - while law enforcement officials gather the evidence needed to present to the court.

3. Jurisdiction.

As I mentioned in Parts 1 and 2, this threat is international in nature. In recent years, extremists have most often used a scheme in which the recruiter is located in one country and his victims in another. In doing so, the perpetrator often chooses countries that have diplomatic disputes and where cooperation between law enforcement agencies is virtually nonexistent. Court rulings in one country carry no weight in another.

4. Procedural Differences.

Different countries have different criminal laws, and different types of crimes have different qualifying characteristics, types (categories), nature, and severity. What is considered a particularly serious crime in one country may be regarded as an administrative offense in another. Under the law of one country, certain types of items, methods of recording, and procedures for seizing information are considered evidence in court, while in another they are not.

5. Differences in procedural documentation.

Different countries have different types, forms, and methods for preparing procedural documents, as well as different methods for recording and documenting evidence, questioning suspects and witnesses, and obtaining and admitting evidence into the case file. Evidence gathered in one country will not be accepted by a court in another country simply because it was not properly documented, due to differing procedural approaches to documenting facts of procedural significance.

All of this complicates the work of law enforcement officers and makes it easier for criminals and criminal organizations to operate. On the other hand, however, it is also unacceptable to simplify the procedure for blocking accounts by reducing the number and quality of the legal grounds for doing so. This would provide grounds both for unfounded and unsubstantiated restrictions on the dissemination of information based solely on suspicion, and for deliberate abuse of power. This cannot be allowed; the rule of law is a fundamental principle and must be strictly observed.

But how, then, can we ensure both prompt action and strict adherence to the rule of law? Is such a compromise even possible? Yes, it is possible, but it will require fundamental changes to the current approach.

Currently, sending an international request (even between countries that have agreements in place) takes weeks or months; during that time, hundreds, if not thousands, of teenagers could be drawn into criminal networks, and dozens of serious crimes could be committed. We need a system for rapid procedural response at the international level. This system would allow law enforcement officers from any participating country to promptly obtain an enforceable procedural document, on the basis of which social media and messaging app administrators would block groups and users.

To implement this proposal in practice, several conditions must be met:

1. Establish an international judicial body with a highly specialized mandate, handling only one category of cases**. It need not necessarily be established specifically as a court; in the initial stage, it could be an international organization with judicial functions that operates in a judicial format but is not a court in the legal sense.

2. Develop a uniform international format for presenting charges and evidence for consideration by this judicial body. This document must contain clear definitions of:

- who has the right to file a case with this judicial body;

- what charges may be filed and on what grounds;

- what type of petition must be submitted and how it must be drafted;

- what evidence must be submitted, in what form, and how it must be obtained;

- within what timeframe the request must be reviewed;

- what decisions the judicial body may render.

3. Encourage - on the basis of international treaties - not all, but at least the largest international corporations that own the most widely used social media platforms, messaging apps, and other information resources exploited for criminal purposes to cooperate with this organization. The essence of this cooperation lies in the adoption and enforcement of decisions issued by this judicial body to block (or impose other restrictive measures on) the activities of accounts, users, or communities for which there are sufficient grounds to suspect involvement in extremist, terrorist, or other activities related to the commission of, or the involvement of other persons (primarily minors) in, particularly serious crimes directed against the person, life, or health of individuals.

The international judicial body referred to in paragraph 1 need not necessarily be established as a separate entity under international law; given its limited functions and legal authority, it may well be established as a structural unit of one of the existing international organizations with special legal status - such as the United Nations, for example. Funding will be provided by the participating countries under a separate international treaty. Each participating country will have the right to bring cases before this judicial body within the scope of its jurisdiction and will undertake to pay membership dues for its maintenance and to enforce its decisions within its territory. For example, by equating a decision of this international judicial body - insofar as it pertains to restrictions on the dissemination of information - with a decision of a court within that state’s judicial system in terms of procedural status.

The judicial body itself will not be overly large in terms of organizational structure or staffing. The review of requests and the rendering of decisions will be a collegial process; in my opinion, the panel should consist of three judges who receive, review, consider, and render a decision on each submitted request within 60 hours. In certain emergency situations, this should be done within 12 hours. The credibility of the charges and the persuasiveness of the evidence will be assessed in light of generally accepted norms of national and international law. Accordingly, the judges must possess relevant knowledge of international law and sufficient practical experience in its application.

On average, each panel will be able to review up to 4 requests per week. Under current circumstances, the average caseload will be approximately 100 requests per month. I would like to remind you that this body will consider only a small fraction of crimes in the field of information security. These are direct, explicit threats of an extremist, terrorist, or other nature related to the commission of - or the involvement of others (primarily minors) in - particularly serious crimes directed against the person, life, or health of individuals. There are not many such crimes at present, but they fall into the category of the most socially dangerous, which is why they require the swiftest possible enforcement measures.

Based on preliminary figures, the total authorized staff of such a judicial body - including not only judges but also administrative and technical personnel - will number approximately 200 employees. For an international organization, this is not a large number; with at least 30 participating countries, funding would not be costly.

The main challenge will be convincing large international corporations - which own the most major social media platforms, messaging apps, and other information resources, most of which are used for criminal purposes - of the need for cooperation. Only then will it be possible to realize the key advantage of such a system: speed of response.

Promptly blocking communication channels and the dissemination of extremist material will significantly curtail the capabilities of destructive communities and, most importantly, hinder - and in some cases even dismantle - the system used to manage and coordinate illegal activities. This is particularly relevant now, as teenagers are increasingly being actively recruited to organize mass riots. I wrote about this as far back as 2023, when mass brawls and pogroms carried out by groups of teenagers from the «PMC Ryodan» subculture were reported in Russia and several neighboring countries. At the time, I suggested that these events were not random and that what we were witnessing were not spontaneous incidents, but rather planned and orchestrated processes. We can see a similar situation today in the U.S., where a wave of such crimes is underway, and they have even been given their own name: «Teen Takeover». Similar mass attacks, albeit on a smaller scale, have also been reported in Europe.

As an analysis of the incidents revealed, calls to commit illegal acts, information about meeting places, and the identification of targets, times, and locations of the attacks were carried out through social media communities, chat rooms, and messaging apps.

In conclusion to Part 3, I would like to remind you that the threat posed by «death groups» and other destructive online communities has long since become an international one. Advances in information technology and new forms and methods of communication have erased the boundaries between countries and continents. Unfortunately, criminals and extremists are actively exploiting this, and their communities have quickly become transnational. Under such conditions, a decentralized security system - where everyone is on their own - has become ineffective. We can only counter these threats by working together, consolidating our efforts on an international level, and taking a proactive, preemptive, and anticipatory approach. In this case, we have every chance of winning this battle for a safe future for our children.

In the next article, I will continue to share my proposals on countering the activities of «death groups». This will mark the conclusion of Phase 2, which is dedicated to developing effective practical solutions - the implementation of which will hinder the spread of information and recruitment, thereby reducing the influx of new recruits into extremist communities - and the transition to Phase 3, which focuses on specific tactical countermeasures.

* the psychotype of the members of this group, as well as the methods for identifying and influencing it, will be developed jointly by behavioral analysis specialists, based on the processing of personal data collected during the international group’s work. Further details are provided in Part 2.

** at the initial stage. However, given the growth and evolution of transnational threats in the field of information technology, the establishment of such a judicial body holds significant promise for future development, with its jurisdiction expanding to cover other categories of crimes.

Author: Roman Grishin

#schoolsafety #schoolsecurity #educationalsecurity #educationalsafety #violenceprevention #K-12 #764 #reddolphin #bluewhale #schoolshooting #research #criminology #deathgroups #extremism #terrorism #UN #CPTED #SHI #threat #TeenTakeover

Online Extremist Communities and Mass Killings at Schools and Other Educational Institutions. Continued, Part 2.

 

As I mentioned in the first part of this article, the threat posed by online extremist communities is serious and real—there is no longer any doubt about that. I would like to add that in the last month alone, law enforcement agencies have suggested that these communities may have been involved in three more attacks:

June 22, 2026, Tacloban, Philippines;

July 6, 2026, Banting, Malaysia;

July 8, 2026, Schongau, Germany.

Politicians and officials have now acknowledged the very existence of this threat and are demanding that police forces take urgent countermeasures. However, there is no longer a quick and effective solution to this problem. Such an opportunity existed several years ago, when these groups began shifting their ideology, moving from extortion and fraud to organizing mass killings and riots. However, the threat was underestimated at the time, and now the opportunity has been missed.

Under the current circumstances, a completely different approach is needed—not an illusory plan designed for a quick «wow effect», but a strategy, a system designed not only to contain the threat in its current form but also to address the directions and forms of its possible development.

To build such a countermeasure system, I propose using the «Hostile Environment» model. What is this? Imagine crime not as a social phenomenon, but as a living organism. This organism actively grows, develops, and reproduces only if the environment is favorable. In such an environment, there are comfortable weather conditions, sufficient water and food, and no (or minimal) threats in the form of predators or natural disasters. In this case, the population of this species will grow and expand into more and more new territories.

The conclusion is simple: since crime is on the rise, it means the environment is favorable for it, and it is thriving. What should be done? We must develop a counterstrategy designed to make the environment for crime no longer comfortable, but rather hostile and aggressive—one in which the chances of survival are very slim.

 

Step 1: Gathering Information.

This is always the place to start; it is important to understand who you are dealing with, what their goals are, how they operate, and what capabilities they possess. Having as much reliable and objective information as possible about the adversary is half the battle. Their logic becomes clear and their actions become understandable, which means they become predictable—their next moves can be anticipated and thwarted.

The starting point is the testimony provided by surviving suspects in crimes committed in the interests of and at the behest of online extremist communities. They are direct participants who went through the entire chain of events, from recruitment to carrying out the final mission. They know a great deal; the question is, will they be willing to share this information? It is important to understand that, after consulting with their lawyers and parents, they will try to portray themselves as victims who acted unintentionally, under duress, or under threat of physical harm or the public disclosure of compromising material. Only 30–40% of the information in such accounts, which they provided during the investigation, will be reliable. All of them have been punished—some with actual prison terms, others, due to their age, with suspended sentences and restrictive measures. I believe it is acceptable, once the court decisions have taken effect, to offer them the opportunity to testify again, provided that the terms of their punishment are mitigated (within reasonable limits) and their anonymity is guaranteed. This would take place without procedural status, with the involvement of experts in psychology and forensic psychiatry.

The second, equally important area—which should proceed in parallel with the first—is the search for would-be perpetrators who did not carry out the crimes. Those who were also recruited and trained but did not go through with the crime, those who refused at the last moment, and those who were stopped during the preparation stage. This should be done anonymously, also without procedural status, with the involvement of specialists.

It is important to understand exactly how, where, and based on what criteria criminals find their victims—the principle behind selecting targets for potential recruitment. How did they come into contact with the handler of the extremist network? Did they seek out the meeting themselves, or did the recruiters approach them? Next, we need information on how potential victims are subjected to psychological manipulation. The details here are crucial; I am certain that recruiters do not immediately reveal to those they are recruiting their affiliation with extremist organizations and movements, nor do they disclose their objectives regarding these teenagers. This is the main question for the experts. I don’t think that on the other side, each teenager is assigned a professional psychologist or a recruiter with practical experience in foreign intelligence. They likely use people who have undergone some training, but only at the level of crash courses. They operate according to a specific template similar to aggressive online sales tactics; online scammers also use similar tactics.

Based on the limited information that has become publicly available, the recruitment system used by extremist communities closely resembles the one used by ISIS recruiters.

Hypothesis: Based on an analysis of the available information, they operate in a targeted and deliberate manner, using pre-compiled lists of potential victims—teenagers who are in a state of emotional and psychological vulnerability and are easily influenced and manipulated. They obtain these lists through legal and semi-legal means, ordering them through front companies from information and analytics agencies that collect data on target audiences for companies selling goods and services on social media. In this case, they may disguise their actual interest in the specified target audience as a search for potential customers for personal development courses, psychological services, dating sites, merchandise for informal communities, and so on. But in the near future (or perhaps even now), this will no longer be necessary, as specialized  AI-based search programs will be able to collect and perform the initial processing of such data.

The third area involves working with digital traces and analyzing the content of deleted groups, channels, websites, and other online communities. When courts or authorized regulatory bodies (which vary by country) block harmful communities, their content often simply disappears, resulting in the loss of valuable information for analysis. An operational protocol is needed for telecommunications operators and hosting providers, stipulating that, prior to blocking, all metadata (posts, comments, hashtags, timestamps, participants, etc.) must be preserved and transferred to a specialized law enforcement unit (more on this later) for subsequent analysis. This is like a «digital autopsy» for experts; it can yield a great deal of useful information, both for operational intelligence and as evidence in legal proceedings.

It is necessary to gather as much information as possible on the scenarios used by extremists, including details and a detailed algorithm of actions for locating, approaching, and manipulating victims. All of this should be provided to specialists—criminologists, psychologists, and psychiatrists—for analysis. Based on their conclusions, it will be possible to understand:

- the principles of locating and selecting victims;

- the sources of information used and the methods of gathering it;

- the scenarios and templates used in manipulating victims;

- methods of moral and psychological pressure;

- means of communication and other tools for controlling victims.

Expected outcome of this phase:

Using the collected data, it will be possible to develop a statistical model of a potential victim: age, gender, family characteristics (two-parent family or single-parent household, social status, income level, religious affiliation, parenting principles, and parental involvement in the child’s life, etc.), level of intellectual and physical development, attitudes toward school, politics, religion, sports, culture, hobbies, a moral and psychological profile, and other additional information.

The resulting model will make it possible to identify and provide a clear description of the most vulnerable groups of adolescents. This information must be forwarded to schools, colleges, other educational institutions, and places where large numbers of children gather. It is intended for practical use by teachers, psychologists, social workers, and staff of relevant police units.

Identifying a well-founded «risk group» of potential victims, placing them under observation, and notifying their parents (or guardians) of the potential threat is the first and most effective preventive measure, which will significantly reduce the effectiveness of extremist recruiters. It will serve as an effective deterrent and significantly slow the spread of the threat.

Key Features of Organizing This Phase:

To ensure the most effective and comprehensive collection of information, this process must be organized on an international scale.

An international information and analysis group is needed, comprising expert analysts and specialists from various countries—primarily those that have already suffered from the actions of criminals in online «death groups»*.

If each country collects information separately, without combining it with data from others, an effective statistical model will not be possible. All analysis will be based on very sparse and incomplete data. As a result, instead of an effective tool for deterring the threat, we will end up with a general template containing vague wording and generic phrases, which is of little practical use. To be frank, this is exactly what we have today. Let me remind you: we are dealing with an international threat that operates according to this pattern: the organizer is in one country, the recruiter in another, the handler in a third, and the final perpetrators in a fourth. Trying to counter them on an «every man for himself» basis won’t work—we’ll lose, yet again. The more information we can gather and process, the more accurate and detailed the experts’ conclusions will be.   Therefore, we must act together; only this will guarantee a positive outcome.

On a personal note: I want to appeal once again to my colleagues—it’s time to put an end to political squabbles and return to being professionals. When it comes to children’s safety, there is no room for disagreements over contrived issues. As you can see, criminals do not distinguish between «good» and «bad» children; they maim and kill everyone, regardless of citizenship, race, religion, or political affiliation.

In my next article, I will continue to share my proposals on countering the activities of «death groups»*. This will be Phase 2, which is dedicated to developing effective practical solutions whose implementation will make it more difficult to spread information and recruit new members, thereby reducing the influx of new operatives into extremist communities.

* This term was coined by journalists who have written about extremist and destructive online communities. I will use this term here and in the future to refer to communities on social media and messaging apps that promote violence and encourage teenagers to commit suicide, mass murder, and other serious crimes.

Author – Roman Grishin.

#schoolsafety #schoolsecurity #educationalsecurity #educationalsafety #violenceprevention #K-12 #massshooting #764 #reddolphin #bluewhale #schoolshooting #research #criminology #schoolcrime #educationalcrime #terrorism #schoolterrorism #educationalterrorism #massmurder #article #threat