Online Extremist Communities and Mass Killings at Schools and Other Educational Institutions. Part 3.

 

Continued: Previous posts: Part 1, Part 2.

The implementation of additional monitoring measures and both overt and covert interventions targeting adolescents in potential at-risk groups* within educational and childcare institutions. This should have a significant impact on the total number of potential victims of «Death Group» recruiters and, consequently, on the number of perpetrators of crimes committed at the direction of and in the interests of these groups. As a result: a reduction in the activity of such groups, a slowdown in the spread of the extremist ideas they promote, and, most importantly, a decrease in the number of serious and particularly serious crimes committed by their members in countries where this work is actually carried out.

If this approach is integrated into the work of psychologists and sociologists at educational and other children’s institutions on a permanent basis, Maintaining the work of an international monitoring and coordination group - which will track changes in the situation and adjust detection and countermeasures accordingly- will serve as an effective deterrent to the threat and, in the long term, help bring the situation under control.

As an effective complement to the aforementioned deterrence measures- one that reduces the number of potential victims for recruiters - I would suggest that the leadership of schools, other educational institutions, and places where large numbers of children and adolescents gather consider implementing an approach such as CPTED.

 CPTED: The concept of «Crime Prevention Through Environmental Design» (CPTED) is an approach aimed at reducing crime by altering the physical environment in which it occurs. The core of the concept is that a well-designed physical space can prevent crime, deter undesirable behavior, and strengthen community ties.

 The effectiveness of this method in reducing violence in educational institutions has been confirmed by many years of practical research conducted by Safe Havens International (SHI) - one of the world’s oldest and most experienced expert and analytical organizations specializing in improving safety in educational institutions.

For more details on CPTED implementation methods and the results achieved, see the articles by SHI Executive Director Michael Dorn, a recognized international expert in the field of school safety and security.

Although creating a more comfortable psychological and emotional environment does not solve all security problems and does not have a guaranteed effect on all at-risk adolescents, according to research findings, the use of such methods can reduce anxiety, stress, and aggression among some adolescents by 10–15 percent, thereby reducing the number of potential victims. And the fewer such emotionally and psychologically vulnerable adolescents there are, the more difficult it will be for recruiters from «death groups» to attract and control them.

It’s simple math. Today, «curators» from extremist communities recruit hundreds and thousands of teenagers through their online platforms, but at best, only dozens agree to participate in active operations, and only a handful commit particularly serious crimes. By reducing the initial number, we will reduce the rest as well. Even a 10–15% reduction would be a good result here.

The next aspect of the threat containment phase is blocking the online resources used by criminals. It is important to understand that this aspect is extremely complex, both technically and legally. Blocking must be precise and targeted, focusing on specific communities and individual accounts through which extremist material is disseminated and teenagers are recruited to engage in criminal and terrorist activities.

In this situation, criminals exploit several existing vulnerabilities. I have identified five main problems that we face:

1.    The difficulty of blocking individual accounts on social media and messaging apps.

Using technical and software-based blocking tools, it is practically impossible to restrict access to one (or more) individual accounts without the involvement of the social media or messaging app administration.

2. The complexity and length of the legal and administrative procedures required to obtain court orders to block such websites, as well as individual profiles and communities.

As a follow-up to point 1: The administrators of social media platforms and messaging apps generally recognize the threat, but—in accordance with their internal policies, as well as national and international legal instruments on freedom of speech and information - they require law enforcement agencies to provide evidence and, often, court orders to block accounts. Obtaining such a ruling is not easy, and often takes a long time—sometimes weeks or months - while law enforcement officials gather the evidence needed to present to the court.

3. Jurisdiction.

As I mentioned in Parts 1 and 2, this threat is international in nature. In recent years, extremists have most often used a scheme in which the recruiter is located in one country and his victims in another. In doing so, the perpetrator often chooses countries that have diplomatic disputes and where cooperation between law enforcement agencies is virtually nonexistent. Court rulings in one country carry no weight in another.

4. Procedural Differences.

Different countries have different criminal laws, and different types of crimes have different qualifying characteristics, types (categories), nature, and severity. What is considered a particularly serious crime in one country may be regarded as an administrative offense in another. Under the law of one country, certain types of items, methods of recording, and procedures for seizing information are considered evidence in court, while in another they are not.

5. Differences in procedural documentation.

Different countries have different types, forms, and methods for preparing procedural documents, as well as different methods for recording and documenting evidence, questioning suspects and witnesses, and obtaining and admitting evidence into the case file. Evidence gathered in one country will not be accepted by a court in another country simply because it was not properly documented, due to differing procedural approaches to documenting facts of procedural significance.

All of this complicates the work of law enforcement officers and makes it easier for criminals and criminal organizations to operate. On the other hand, however, it is also unacceptable to simplify the procedure for blocking accounts by reducing the number and quality of the legal grounds for doing so. This would provide grounds both for unfounded and unsubstantiated restrictions on the dissemination of information based solely on suspicion, and for deliberate abuse of power. This cannot be allowed; the rule of law is a fundamental principle and must be strictly observed.

But how, then, can we ensure both prompt action and strict adherence to the rule of law? Is such a compromise even possible? Yes, it is possible, but it will require fundamental changes to the current approach.

Currently, sending an international request (even between countries that have agreements in place) takes weeks or months; during that time, hundreds, if not thousands, of teenagers could be drawn into criminal networks, and dozens of serious crimes could be committed. We need a system for rapid procedural response at the international level. This system would allow law enforcement officers from any participating country to promptly obtain an enforceable procedural document, on the basis of which social media and messaging app administrators would block groups and users.

To implement this proposal in practice, several conditions must be met:

1. Establish an international judicial body with a highly specialized mandate, handling only one category of cases**. It need not necessarily be established specifically as a court; in the initial stage, it could be an international organization with judicial functions that operates in a judicial format but is not a court in the legal sense.

2. Develop a uniform international format for presenting charges and evidence for consideration by this judicial body. This document must contain clear definitions of:

- who has the right to file a case with this judicial body;

- what charges may be filed and on what grounds;

- what type of petition must be submitted and how it must be drafted;

- what evidence must be submitted, in what form, and how it must be obtained;

- within what timeframe the request must be reviewed;

- what decisions the judicial body may render.

3. Encourage - on the basis of international treaties - not all, but at least the largest international corporations that own the most widely used social media platforms, messaging apps, and other information resources exploited for criminal purposes to cooperate with this organization. The essence of this cooperation lies in the adoption and enforcement of decisions issued by this judicial body to block (or impose other restrictive measures on) the activities of accounts, users, or communities for which there are sufficient grounds to suspect involvement in extremist, terrorist, or other activities related to the commission of, or the involvement of other persons (primarily minors) in, particularly serious crimes directed against the person, life, or health of individuals.

The international judicial body referred to in paragraph 1 need not necessarily be established as a separate entity under international law; given its limited functions and legal authority, it may well be established as a structural unit of one of the existing international organizations with special legal status - such as the United Nations, for example. Funding will be provided by the participating countries under a separate international treaty. Each participating country will have the right to bring cases before this judicial body within the scope of its jurisdiction and will undertake to pay membership dues for its maintenance and to enforce its decisions within its territory. For example, by equating a decision of this international judicial body - insofar as it pertains to restrictions on the dissemination of information - with a decision of a court within that state’s judicial system in terms of procedural status.

The judicial body itself will not be overly large in terms of organizational structure or staffing. The review of requests and the rendering of decisions will be a collegial process; in my opinion, the panel should consist of three judges who receive, review, consider, and render a decision on each submitted request within 60 hours. In certain emergency situations, this should be done within 12 hours. The credibility of the charges and the persuasiveness of the evidence will be assessed in light of generally accepted norms of national and international law. Accordingly, the judges must possess relevant knowledge of international law and sufficient practical experience in its application.

On average, each panel will be able to review up to 4 requests per week. Under current circumstances, the average caseload will be approximately 100 requests per month. I would like to remind you that this body will consider only a small fraction of crimes in the field of information security. These are direct, explicit threats of an extremist, terrorist, or other nature related to the commission of - or the involvement of others (primarily minors) in - particularly serious crimes directed against the person, life, or health of individuals. There are not many such crimes at present, but they fall into the category of the most socially dangerous, which is why they require the swiftest possible enforcement measures.

Based on preliminary figures, the total authorized staff of such a judicial body - including not only judges but also administrative and technical personnel - will number approximately 200 employees. For an international organization, this is not a large number; with at least 30 participating countries, funding would not be costly.

The main challenge will be convincing large international corporations - which own the most major social media platforms, messaging apps, and other information resources, most of which are used for criminal purposes - of the need for cooperation. Only then will it be possible to realize the key advantage of such a system: speed of response.

Promptly blocking communication channels and the dissemination of extremist material will significantly curtail the capabilities of destructive communities and, most importantly, hinder - and in some cases even dismantle - the system used to manage and coordinate illegal activities. This is particularly relevant now, as teenagers are increasingly being actively recruited to organize mass riots. I wrote about this as far back as 2023, when mass brawls and pogroms carried out by groups of teenagers from the «PMC Ryodan» subculture were reported in Russia and several neighboring countries. At the time, I suggested that these events were not random and that what we were witnessing were not spontaneous incidents, but rather planned and orchestrated processes. We can see a similar situation today in the U.S., where a wave of such crimes is underway, and they have even been given their own name: «Teen Takeover». Similar mass attacks, albeit on a smaller scale, have also been reported in Europe.

As an analysis of the incidents revealed, calls to commit illegal acts, information about meeting places, and the identification of targets, times, and locations of the attacks were carried out through social media communities, chat rooms, and messaging apps.

In conclusion to Part 3, I would like to remind you that the threat posed by «death groups» and other destructive online communities has long since become an international one. Advances in information technology and new forms and methods of communication have erased the boundaries between countries and continents. Unfortunately, criminals and extremists are actively exploiting this, and their communities have quickly become transnational. Under such conditions, a decentralized security system - where everyone is on their own - has become ineffective. We can only counter these threats by working together, consolidating our efforts on an international level, and taking a proactive, preemptive, and anticipatory approach. In this case, we have every chance of winning this battle for a safe future for our children.

In the next article, I will continue to share my proposals on countering the activities of «death groups». This will mark the conclusion of Phase 2, which is dedicated to developing effective practical solutions - the implementation of which will hinder the spread of information and recruitment, thereby reducing the influx of new recruits into extremist communities - and the transition to Phase 3, which focuses on specific tactical countermeasures.

* the psychotype of the members of this group, as well as the methods for identifying and influencing it, will be developed jointly by behavioral analysis specialists, based on the processing of personal data collected during the international group’s work. Further details are provided in Part 2.

** at the initial stage. However, given the growth and evolution of transnational threats in the field of information technology, the establishment of such a judicial body holds significant promise for future development, with its jurisdiction expanding to cover other categories of crimes.

Author: Roman Grishin

#schoolsafety #schoolsecurity #educationalsecurity #educationalsafety #violenceprevention #K-12 #764 #reddolphin #bluewhale #schoolshooting #research #criminology #deathgroups #extremism #terrorism #UN #CPTED #SHI #threat #TeenTakeover

Issues Regarding the Adaptation of the Project for the United States and Countries with an Autonomous (Independent) Education System

 

This article serves as a supplement to the previously published project on the main website - a comprehensive security system for schools and other educational institutions designed to protect against criminal, terrorist, and other threats. It was prompted by a critical review of the project that I received; its authors represent one of the most serious and authoritative international organizations in the field of educational facility security.

I will reiterate that I view criticism - especially constructive criticism - in a completely normal and respectful manner; it allows me to identify and address vulnerabilities and errors that are clearly visible from an outside perspective. I view all critical comments and well-reasoned recommendations - especially those from recognized experts and practitioners - as a form of self-education and always take them into account in my work. I have outlined my main arguments regarding the comments mentioned in the review in a separate article.

After receiving the main review, I received another letter from the same author, which no longer contained criticism but rather a recommendation to take into account, when developing the project, the specific features of how educational institutions are organized and operate in different countries - primarily in the United States. I will quote from the letter:

In the United States and many other countries, such as the United Kingdom and India, the government has very limited control over independent schools, and they operate as separate entities. In the United States, only one state has a public school system. That is precisely why the remaining 49 states have between 30 and 250 separate public school systems, which, although regulated by federal and regional governments, are administered by local authorities and enjoy significant autonomy. And this is not unique to the U.S., so keep in mind that there are significant differences between countries.

This letter served as an additional incentive for me: if even leading experts cannot see a way beyond the existing system, then this system has truly become a “comfort zone.” But a comfort zone is a place where growth stops. Meanwhile, threats are growing. And we are falling behind.

I am very familiar with the situation described by the expert; I have pointed out that I drew on the American experience as the basis for the units for the prevention and suppression of direct (explicit) threats outlined in the draft. Specifically, the experience of establishing and operating police services such as the New York City Police Department’s School Safety Division (SSD NYPD) and the Los Angeles School Police Department (LASPD). I studied their activities, legal status, and effectiveness in considerable detail, comparing them with other cities and states where similar police services exist or do not exist. At the same time, I studied, using open sources, the principles governing the organization and operations of educational institutions and childcare facilities in various states - including kindergartens, schools, colleges, and universities. I also examined the regulatory legal acts governing their status, the procedures for interacting with local and federal authorities, the police, and the community, as well as how security issues are addressed.

In short, based on an analysis of the information, it can be concluded that the school safety system in the United States does not have a single federal (state) standard and is managed at the state and local school district levels. Most schools employ the most basic measures: access control, video surveillance, the presence of police officers, school security personnel, or private security guards, and regular emergency drills. Within the administrative structures of local governments, school districts, and certain large schools, there are specialized staff positions (coordinators, directors, deputies, specialists, etc.) that are entirely focused on security issues. In some states, state law provides for the possibility of teachers carrying firearms and using them to stop an attack in cases of direct threats to themselves and students. The Department of Education and law enforcement leadership periodically send guidance materials on safety issues to schools, but all these documents are largely advisory in nature. Within the administrative structure - both at the state level and at the level of individual school districts - in addition to officials from the departments of education, there are various commissions, committees attached to school boards, and task forces responsible for overseeing security matters.

A system like this took shape as early as the second half of the last century, when the main security threats to students and school staff were teenagers who poured glue on the chairs of teachers they disliked, smoked in the schoolyard, broke light bulbs in the restroom, stole pastries from the cafeteria, or scrawled graffiti on the principal’s office door. Nowadays, the nature and severity of these threats have significantly increased and changed. Today, no one is surprised by serious and particularly serious crimes committed in schools - including those involving bladed weapons or firearms, sexual harassment, rape, theft, robbery, and extortion—or serving as a breeding ground for arms and drug dealers, organized crime gangs, and extremist groups. Yes, this situation does not exist in every school, but unfortunately, it is present in many, and the proportion of such schools (colleges, universities, etc.) is growing year by year.

Yes, it’s unpleasant to admit, but it’s a fact - in the 21st century, educational institutions have become high-risk environments.

The existing security system for educational institutions simply wasn’t designed to handle a situation like this. Yes, there have been many attempts to expand and modernize it, but the potential for modernization is limited, and it has now been exhausted. In its current state, the system is incapable of countering modern and emerging threats; it has become obsolete. This is not a criticism of its creators; it is a normal, natural process for any component of the state and municipal governance system. Over time, and under the influence of changes in the country’s social and political life, the system reaches the end of its useful life and becomes unsuitable for further use.

A system that is not updated to address new threats ceases to provide protection. It becomes a mere prop. We put locks on cardboard doors and then are surprised when they are broken into. This is exactly what we are witnessing right now.

In my project, I propose a new approach to ensuring the security of educational institutions. This framework has been developed with consideration for both existing and potential threats of all types—from criminal to natural and man-made. It is a new and unconventional approach based on the principle of centralization, in which schools and other educational institutions are not autonomous entities but rather components of a unified, managed system. However, I want to emphasize that this applies only to security matters; it will not affect other areas of operation in any way.

The first step in the project is administrative reform (Section III: Proposed Solution; Subsection 1: Administrative and Legal Measures; Paragraph 1.2), the essence of which is to completely relieve the administration of an educational institution of responsibility for organizing, ensuring, and maintaining public order and safety on its premises. This involves not only removing responsibility but also prohibiting interference in the process of organizing and implementing public order and safety. Only this will allow for the creation of a solid foundation upon which a transparent and effective system can be built in the future, where responsibilities are clearly delineated. Educational institutions will be able to focus on their primary mission - the education and upbringing of the younger generation.

This is a necessary condition; without it, there is no point in even beginning any reforms - they will yield no results. A major problem for public safety - and a significant boon to crime - is the competition among educational institutions to maintain their reputations and achieve positive statistical results. This compels their leadership to use any means necessary to conceal committed offenses from official record-keeping and full investigation until these incidents begin to lead to serious consequences and it becomes impossible to conceal them any longer. It is not uncommon for staff members to use their official positions to interfere with the work of security services, demanding that rules be disregarded for the sake of the educational process or other institutional priorities. The current (autonomous) security system allows them to do so, and criminals actively exploit this vulnerability. The result is obvious.

The only effective way to change the situation is to strip the administrations of educational institutions and education officials of any influence over safety issues. Safety matters should be handled exclusively by specialized professionals who possess the necessary expertise and resources. But most importantly, their top priority will be the lives and health of students and staff at the educational institution, rather than its reputation or statistical reporting.

A detailed model for creating a security system based on the principles of centralization and a clear chain of command—specifying the interdependencies and the impact of various elements on specific processes and the resolution of specific tasks—is outlined in the draft.

The issue of funding also depends on the willingness and approach to addressing it. When transitioning from a decentralized to a centralized security system, financial flows are also centralized; in other words, instead of 10 recipients, there will be one. Own funds (including those freed up by reducing the institution’s own contribution), municipal, regional, and federal subsidies, grants, donations, targeted funding, and co-financing under various programs. All funds are received by the “Specialized Police Service” (Section III: Proposed Solution; Subsection: 3. Prevention and Suppression of Direct Threats to Security). It also assumes full responsibility for all tasks related to the protection and security of educational institutions; details on how this will be implemented can be found in the draft (Section: III. Proposed Solution; Subsection: 3. Prevention and Suppression of Direct Threats to Safety). Funds are reallocated from some sources to others. This is not an increase in spending; it is a redistribution of existing funds to improve their effectiveness. Yes, expenses will rise initially—investments in infrastructure, technical equipment, and organizational costs will be needed—but eventually, costs will drop to current levels, and the budget will become more transparent and predictable. The question is, are we willing to spend these funds on an effective system rather than on a false sense of security? If we want results, we’ll have to invest in them - that’s a fundamental principle. In this case, the end justifies the means, because the goal is people’s lives and health - first and foremost, children, who, due to their age and limited life experience, cannot yet protect themselves, so we adults are responsible for their safety.

The project is fully suitable for implementation in the United States and other countries with a developed system of local self-government and an autonomous (independent) system of education. This is provided that local authorities deem it necessary to adopt it. A number of U.S. government officials, governors, senators, members of Congress, and public figures have spoken out about the need for concrete and effective measures to increase safety in educational institutions. Furthermore, based on an analysis of media publications, social media, and other online platforms for communication, discussion, and expressing one’s views, there is a growing public demand for such measures in the U.S., which means that similar initiatives will receive support.

I would add that implementing this project in the United States may even be easier than in any other country, as it already has a solid legal foundation for doing so. There is a well-established and developed system of local self-government, where local authorities can make organizational decisions without lengthy coordination with the federal government, as well as a local police force, which serves as the foundation for prevention and rapid response.

The main critical argument raised by my opponents is that the system I propose has not been tested in real-world conditions, and therefore its practical effectiveness has not been proven. I agree; this is indeed the case, which is why I myself state that it cannot be implemented immediately and across the board. First, an experiment is needed - a practical test of its effectiveness under real-world conditions - over the course of several years in a single state or even a single city.  Real-world testing will inevitably reveal certain shortcomings and oversights; this is the correct scientific approach and a normal working process for anything new. In just a few years, taking into account the corrections made to errors and shortcomings identified during the experiment, as well as the additions and improvements made, this will be a completely different model. The effectiveness and functionality of each of its elements will have been tested and proven in practice through repeated trials and verifications under various conditions and scenarios. A template whose effectiveness has been proven in practice can be used worldwide, with minor adjustments for local characteristics, but its fundamental foundation will remain the same - one that, drawing on international experience, will only become better and more reliable year after year.

The main outcome is that schools will once again become places where parents can send their children without fear - places that embody reliability, confidence, and safety. Places where children gain knowledge and life experience, make friends, and experience positive emotions. A place where administrative and teaching staff focus exclusively on their core mission - educating and nurturing the younger generation—while safety is the responsibility of professionals. I have dedicated my life to this cause and am confident that this is an achievable goal.

Knowing how pragmatic Americans are - and for me, this is an exceptionally positive quality - I invite you to take a look and assess the prospects and opportunities that creating such an international model for school safety systems opens up.

I first voiced this idea nearly 20 years ago, and over the years, my conviction has only grown stronger: that Safety will be the most valuable resource in the 21st century.

Author: Roman Grishin

#review #expert #USA #US #schoolsafety #educationalsafety #safety #security #K12 #opinion #position #comment #response #project #system #criticism #proposal #evaluation #threat #terrorism #crime

Online Extremist Communities and Mass Killings at Schools and Other Educational Institutions. Continued, Part 2.

 

As I mentioned in the first part of this article, the threat posed by online extremist communities is serious and real—there is no longer any doubt about that. I would like to add that in the last month alone, law enforcement agencies have suggested that these communities may have been involved in three more attacks:

June 22, 2026, Tacloban, Philippines;

July 6, 2026, Banting, Malaysia;

July 8, 2026, Schongau, Germany.

Politicians and officials have now acknowledged the very existence of this threat and are demanding that police forces take urgent countermeasures. However, there is no longer a quick and effective solution to this problem. Such an opportunity existed several years ago, when these groups began shifting their ideology, moving from extortion and fraud to organizing mass killings and riots. However, the threat was underestimated at the time, and now the opportunity has been missed.

Under the current circumstances, a completely different approach is needed—not an illusory plan designed for a quick «wow effect», but a strategy, a system designed not only to contain the threat in its current form but also to address the directions and forms of its possible development.

To build such a countermeasure system, I propose using the «Hostile Environment» model. What is this? Imagine crime not as a social phenomenon, but as a living organism. This organism actively grows, develops, and reproduces only if the environment is favorable. In such an environment, there are comfortable weather conditions, sufficient water and food, and no (or minimal) threats in the form of predators or natural disasters. In this case, the population of this species will grow and expand into more and more new territories.

The conclusion is simple: since crime is on the rise, it means the environment is favorable for it, and it is thriving. What should be done? We must develop a counterstrategy designed to make the environment for crime no longer comfortable, but rather hostile and aggressive—one in which the chances of survival are very slim.

 

Step 1: Gathering Information.

This is always the place to start; it is important to understand who you are dealing with, what their goals are, how they operate, and what capabilities they possess. Having as much reliable and objective information as possible about the adversary is half the battle. Their logic becomes clear and their actions become understandable, which means they become predictable—their next moves can be anticipated and thwarted.

The starting point is the testimony provided by surviving suspects in crimes committed in the interests of and at the behest of online extremist communities. They are direct participants who went through the entire chain of events, from recruitment to carrying out the final mission. They know a great deal; the question is, will they be willing to share this information? It is important to understand that, after consulting with their lawyers and parents, they will try to portray themselves as victims who acted unintentionally, under duress, or under threat of physical harm or the public disclosure of compromising material. Only 30–40% of the information in such accounts, which they provided during the investigation, will be reliable. All of them have been punished—some with actual prison terms, others, due to their age, with suspended sentences and restrictive measures. I believe it is acceptable, once the court decisions have taken effect, to offer them the opportunity to testify again, provided that the terms of their punishment are mitigated (within reasonable limits) and their anonymity is guaranteed. This would take place without procedural status, with the involvement of experts in psychology and forensic psychiatry.

The second, equally important area—which should proceed in parallel with the first—is the search for would-be perpetrators who did not carry out the crimes. Those who were also recruited and trained but did not go through with the crime, those who refused at the last moment, and those who were stopped during the preparation stage. This should be done anonymously, also without procedural status, with the involvement of specialists.

It is important to understand exactly how, where, and based on what criteria criminals find their victims—the principle behind selecting targets for potential recruitment. How did they come into contact with the handler of the extremist network? Did they seek out the meeting themselves, or did the recruiters approach them? Next, we need information on how potential victims are subjected to psychological manipulation. The details here are crucial; I am certain that recruiters do not immediately reveal to those they are recruiting their affiliation with extremist organizations and movements, nor do they disclose their objectives regarding these teenagers. This is the main question for the experts. I don’t think that on the other side, each teenager is assigned a professional psychologist or a recruiter with practical experience in foreign intelligence. They likely use people who have undergone some training, but only at the level of crash courses. They operate according to a specific template similar to aggressive online sales tactics; online scammers also use similar tactics.

Based on the limited information that has become publicly available, the recruitment system used by extremist communities closely resembles the one used by ISIS recruiters.

Hypothesis: Based on an analysis of the available information, they operate in a targeted and deliberate manner, using pre-compiled lists of potential victims—teenagers who are in a state of emotional and psychological vulnerability and are easily influenced and manipulated. They obtain these lists through legal and semi-legal means, ordering them through front companies from information and analytics agencies that collect data on target audiences for companies selling goods and services on social media. In this case, they may disguise their actual interest in the specified target audience as a search for potential customers for personal development courses, psychological services, dating sites, merchandise for informal communities, and so on. But in the near future (or perhaps even now), this will no longer be necessary, as specialized  AI-based search programs will be able to collect and perform the initial processing of such data.

The third area involves working with digital traces and analyzing the content of deleted groups, channels, websites, and other online communities. When courts or authorized regulatory bodies (which vary by country) block harmful communities, their content often simply disappears, resulting in the loss of valuable information for analysis. An operational protocol is needed for telecommunications operators and hosting providers, stipulating that, prior to blocking, all metadata (posts, comments, hashtags, timestamps, participants, etc.) must be preserved and transferred to a specialized law enforcement unit (more on this later) for subsequent analysis. This is like a «digital autopsy» for experts; it can yield a great deal of useful information, both for operational intelligence and as evidence in legal proceedings.

It is necessary to gather as much information as possible on the scenarios used by extremists, including details and a detailed algorithm of actions for locating, approaching, and manipulating victims. All of this should be provided to specialists—criminologists, psychologists, and psychiatrists—for analysis. Based on their conclusions, it will be possible to understand:

- the principles of locating and selecting victims;

- the sources of information used and the methods of gathering it;

- the scenarios and templates used in manipulating victims;

- methods of moral and psychological pressure;

- means of communication and other tools for controlling victims.

Expected outcome of this phase:

Using the collected data, it will be possible to develop a statistical model of a potential victim: age, gender, family characteristics (two-parent family or single-parent household, social status, income level, religious affiliation, parenting principles, and parental involvement in the child’s life, etc.), level of intellectual and physical development, attitudes toward school, politics, religion, sports, culture, hobbies, a moral and psychological profile, and other additional information.

The resulting model will make it possible to identify and provide a clear description of the most vulnerable groups of adolescents. This information must be forwarded to schools, colleges, other educational institutions, and places where large numbers of children gather. It is intended for practical use by teachers, psychologists, social workers, and staff of relevant police units.

Identifying a well-founded «risk group» of potential victims, placing them under observation, and notifying their parents (or guardians) of the potential threat is the first and most effective preventive measure, which will significantly reduce the effectiveness of extremist recruiters. It will serve as an effective deterrent and significantly slow the spread of the threat.

Key Features of Organizing This Phase:

To ensure the most effective and comprehensive collection of information, this process must be organized on an international scale.

An international information and analysis group is needed, comprising expert analysts and specialists from various countries—primarily those that have already suffered from the actions of criminals in online «death groups»*.

If each country collects information separately, without combining it with data from others, an effective statistical model will not be possible. All analysis will be based on very sparse and incomplete data. As a result, instead of an effective tool for deterring the threat, we will end up with a general template containing vague wording and generic phrases, which is of little practical use. To be frank, this is exactly what we have today. Let me remind you: we are dealing with an international threat that operates according to this pattern: the organizer is in one country, the recruiter in another, the handler in a third, and the final perpetrators in a fourth. Trying to counter them on an «every man for himself» basis won’t work—we’ll lose, yet again. The more information we can gather and process, the more accurate and detailed the experts’ conclusions will be.   Therefore, we must act together; only this will guarantee a positive outcome.

On a personal note: I want to appeal once again to my colleagues—it’s time to put an end to political squabbles and return to being professionals. When it comes to children’s safety, there is no room for disagreements over contrived issues. As you can see, criminals do not distinguish between «good» and «bad» children; they maim and kill everyone, regardless of citizenship, race, religion, or political affiliation.

In my next article, I will continue to share my proposals on countering the activities of «death groups»*. This will be Phase 2, which is dedicated to developing effective practical solutions whose implementation will make it more difficult to spread information and recruit new members, thereby reducing the influx of new operatives into extremist communities.

* This term was coined by journalists who have written about extremist and destructive online communities. I will use this term here and in the future to refer to communities on social media and messaging apps that promote violence and encourage teenagers to commit suicide, mass murder, and other serious crimes.

Author – Roman Grishin.

#schoolsafety #schoolsecurity #educationalsecurity #educationalsafety #violenceprevention #K-12 #massshooting #764 #reddolphin #bluewhale #schoolshooting #research #criminology #schoolcrime #educationalcrime #terrorism #schoolterrorism #educationalterrorism #massmurder #article #threat

Safety in Schools and Other Educational Institutions: An Overview of the Current Global Situation, First Half of 2026.

 
The first half of 2026 has come to a close, so it’s time to take stock and draw some preliminary conclusions. The first conclusion is that my forecast, made based on the results of 2025 and published in an article, did not come true. At that time, I predicted that in 2026 there would be a 25–30% decrease in the number of crimes committed, based on key indicators. I reached this conclusion by comparing the sharp spike in crime rates in 2025 with a similar spike in 2014, after which the figures for the following several years were even slightly below average. Based on this comparison, I concluded that in 2014 and 2025, there was a sort of «release of accumulated excess pressure», followed by several years of relative «calm» and then another rise to a new record high. The forecast did not materialize.

The situation in the first half of 2026 became much more complicated, with growth across virtually all indicators.

 

Statistics for the first 6 months, a brief overview:

In total, 72 serious and particularly serious crimes were committed in schools and other educational institutions, which is 35.8% more than during the same period last year (hereinafter referred to as «s.p.l.y.») - 53.

There were 43 crimes involving mass murder and acts of terrorism; during the same period last year, there were 22 such crimes, representing an increase of nearly double, or 95.4%. Below are the specific figures for this category of crimes.

The proportion of crimes committed with firearms decreased slightly to 41.8% (s.p.l.y. - 45.5%), however, the proportion of crimes committed using chemical poisons rose significantly to 11.6% (s.p.l.y. - 4.5%), incendiary devices and mixtures to 9.3% (s.p.l.y. - 4.5%), and explosive devices 4.6% (s.p.l.y. - 0%). The proportion of attacks committed by groups rose slightly to 9.3% (s.p.l.y. - 9.1%), as did that of terrorist attacks 2.3%( s.p.l.y. - 0%).

The percentage of crimes in which vehicles were used as weapons decreased significantly to 0% (s.p.l.y. - 9.1%), and the percentage of crimes in which the perpetrators managed to flee the scene was halved to 18.6% (s.p.l.y. - 36.3%).

Total number of victims (under Section 2, «Crimes with characteristics of mass murders and terrorist acts2): 218 (s.p.l.y. - 143), of whom:

- 46 were killed (s.p.l.y. - 39);

- 172 were injured (s.p.l.y. - 104).

Despite the increase in these figures, the public danger coefficient for attacks in the first half of 2026 decreased to 3.06; in the same period of 2025, it was 4.1.

 

Geography of Crime:

There have been sharp, negative changes in two countries: Turkey and the Philippines.

In Turkey, the situation deteriorated sharply in the spring. The first attack took place on March 2 at a school in Istanbul; a month and a half later, two attacks occurred one day apart: on April 14 in Siverek and the following day in Kahramanmaraş, resulting in 38 victims—10 dead and 28 wounded. In terms of scale, these crimes exceeded the figures for the previous 25 years. Prior to this, mass killings at educational institutions in Turkey had occurred twice: 

- November 22, 2005, in Nusaybin: an attack on a school, 5 victims (1 killed, 4 injured);

- April 5, 2018, in Ankara: an attack on a university, 7 victims (4 killed, 3 injured).

 

In the Philippines, events in June sent shockwaves through the country, with three consecutive attacks occurring within one week:

- June 16, 2026, General Trias, Philippines;

- June 19, 2026, Cavite, Philippines (stabbing, 1 injured, male, 18 years old, student);

- June 22, 2026, Tacloban, Philippines;

Two of the incidents showed signs of mass killings. There were 16 victims, including 3 fatalities and 13 injured.

Prior to this, over the past 25 years, there had been only one similar incident in the Philippines, on October 22, 2010, in Zamboanga; however, that was a single external attack on an elementary school carried out by a perpetrator over 50 years old. In 2026, the picture is completely different: one attack was carried out by a group, two were internal (carried out by students at these schools), and one was of a mixed nature; the oldest of the attackers was 18 years old.

It is still difficult to say exactly what caused such drastic changes in the situation, specifically in these two countries, where, until 2026, such crimes were the exception rather than the rule. There are several theories, but none of them is backed by direct evidence; for now, everything remains at the level of speculation, and more definitive conclusions can be drawn at the end of the year.

As for positive developments, the situation in China shows a positive trend. I’m not sure exactly what this is due to, but for the first half of 2026, there is not a single mention of China in open sources in the context of serious and particularly serious crimes committed in educational institutions. This is unusual, as China typically ranks among the top three countries in terms of the number of such attacks. By comparison, last year saw four crimes in China that met the criteria for mass murders and terrorist acts, two of which occurred in the first half of the year.

Otherwise, no other significant changes were recorded on the world map during the first half of 2026. However, the overall trend is that the list of countries where such crimes are committed is growing every year. As of today, based on statistics for the past six months, the geographic distribution of attacks on educational facilities is as follows: the United States, Russia, Turkey, the Philippines, Brazil, Mexico, Chile, Argentina, South Africa, Indonesia, Kazakhstan, Azerbaijan, the United Kingdom, Canada, Thailand, India, the Netherlands, Finland, Uganda, and Lithuania.

I won’t make any predictions for the end of the year, but so far everything indicates that the all-time high set in 2025 will most likely be surpassed this year.

Over the next one and a half to two months, we can expect a lull, as most educational institutions around the world close for summer break. It’s still hard to say what will happen in the fall, when the school year begins. There is a high probability that an already difficult situation could become even more complicated due to the growing activity of online extremist communities and movements, which have shifted to more aggressive tactics and ideologies and have begun actively promoting ideas of misanthropy - but that is a topic for a separate discussion. 

Author – Roman Grishin.

#2026 #statistics #overview #schoolsafety #schoolsecurity #educationalsecurity #educationalsafety #violenceprevention #massshooting #schoolshooting #research #criminology #schoolcrime #educationalcrime #terrorism #schoolterrorism #educationalterrorism #massmurder #k-12 #threat

Online Extremist Communities and Mass Killings at Schools and Other Educational Institutions. Continued, Part 1.

 

Note: it should be borne in mind that the author lives and works in Russia, so in this article, he considers the situation on the example of his country. Measures to ensure the safety of schools, other educational institutions and places with a mass stay of children that he proposes are developed by him for use in Russia, taking into account the existing law enforcement system and the situation there.

In 2024, while researching cases of mass school shootings, I first came across information indicating that several such crimes had been committed by teenagers who were carrying out a «final task» assigned by the administrators of a closed social media group. This information was indirectly corroborated by statements from the Children’s Rights Ombudsman, the Chair of the «Safe Internet League» - the largest quasi-governmental organization in the field of digital security—as well as a major public organization providing assistance to minors in crisis situations. It was then that the name of this community - «Red Dolphin» - was first mentioned.

The emergence of communities and movements with similar ideologies and tactics was predictable. First, around 2015, a community called «Blue Whale» emerged, which, operating through social media and messaging apps, incited teenagers to commit suicide. In their activities, they employed a step-by-step scheme to lead the victim toward a planned outcome through the sequential completion of individual tasks modeled after a game-like quest. Even within the community itself, completing these tasks was referred to as «The Game,» with the victim’s profile featuring the hashtag #TheGame and similar tags. Each new «player» was assigned a mentor who gave tasks, monitored their completion, and provided psychological support to the victim until the final task—suicide, most often a jump from a height. There is no exact information in open sources regarding the number of victims officially confirmed. The figures cited in journalistic investigations are contradictory; some sources mention dozens of victims, while others cite hundreds. Regarding the organizers, there is information about only one criminal case—involving the organizer of such a social media community—which was investigated, concluded, sent to court, and resulted in a guilty verdict in 2025.  I am unaware of the motives, but the tactics used by «Blue Whale» were based on an individualized approach aimed at causing the death of a single, isolated person through their own actions.

As for «The Red Dolphin,» things were different here; the tactic was similar—based on the victim, who was being manipulated, carrying out the handler’s instructions—but the tasks here were entirely different. The initial tasks involved minor offenses, such as leaving graffiti on walls and doors or placing a sticker on a car or public transportation. Subsequent tasks became more complex and were classified as criminal offenses, including shoplifting, property damage, assaulting peers or younger children, arson, animal cruelty, and so on. The teenagers were not only required to commit these acts but also to document them with photos and videos and send them to the handler. In effect, they were collecting and handing over incriminating evidence against themselves to the «Game’s» handler. If a teenager tried to refuse to proceed and complete the tasks, blackmail, threats of violence from other «players,» and other forms of psychological pressure would begin. The «handlers» goal was the same—to drive the teenager to suicide—but through a different, more dangerous method. The teenager was first required to commit a mass murder and then take their own life.

This represents a new form of mass murder in educational institutions, with the planning and execution remotely controlled by third parties. Similar crimes have occurred before, but they were primarily mass murders committed in public places or targeting specific individuals or organizations. Recruiters for the terrorist organization ISIS often used this tactic of lone-wolf attacks: they would first identify people interested in their ideology on social media and messaging apps, then remotely indoctrinate them, turning them into committed fanatics. After the subject underwent psychological conditioning, they would receive a command from their handler to take a weapon—or an object used as a weapon—and go out onto the streets to kill people. There have been quite a few such cases, but the use of teenagers to attack schools and other children’s institutions has been virtually nonexistent. There have been terrorist attacks on educational institutions, but they followed a different scenario, and in most cases, the perpetrators were people over the age of 18.

However, I would surmise that the use of teenagers in particular—as the segment of society most susceptible to indoctrination and, at the same time, sufficiently aggressive and reckless—has piqued the interest of terrorist organizations and other extremist groups and movements. Their groups and organizations can be used to instigate mass unrest, while lone actors can be used to carry out mass killings in educational institutions. I first expressed these assumptions in March 2023, when I commented on the situation involving the «Ryodan PMC,» and then in October 2024, I published two more articles (Part 1 and Part 2) on this topic with additional arguments regarding the extremist group «Red Dolphin.»

Even then, I expressed the view that these were not isolated incidents and that we were dealing with a new tactic involving mass killings and the infliction of serious harm on the health of children and adolescents in schools and other educational institutions. I also stated there that, given the development of social media, messaging apps, and other forms of communication, this threat would quickly reach the international level. It appears that this is exactly what has happened.

In early June 2026, my colleagues from the U.S. sent me a link to a document—an open letter from the Dallas, Texas, field office of the Federal Bureau of Investigation to parents, guardians, and teachers. I won’t quote it in full here (those interested can read it for themselves by following the link), but the letter addresses the growing security threat posed by a malicious online network known as «764.» Their members often befriend minors on popular online gaming platforms and social media, gain their trust by posing as friends, and then coerce them into harming themselves or others. They operate worldwide, driven by hatred, sexual gratification, or a desire to sow chaos. Regardless of their motivation, they share a common goal: children and other vulnerable individuals. They exploit the trust they initially gained to manipulate their victims and force them to harm themselves or others. The FBI is currently investigating more than 450 individuals linked to these cruel online networks. The report also provides recommendations on how to monitor teenagers’ behavior and identify direct and indirect signs that a child may have become a victim of such manipulators. It includes links to additional educational resources and contact information for reporting incidents. The bureau reaffirms its commitment to combating this dangerous phenomenon. 

In short, the extremist online community «764» and several other groups associated with it operate primarily within the United States, but have large cells in Greece, the United Kingdom, France, Romania, Brazil, Sweden, Canada, Australia, Spain, and Turkey. Their main activities include sexual blackmail, the distribution of child pornography, and the recruitment of children to commit crimes. The pattern is similar: recruitment, indoctrination, and the commission of crimes under the supervision of handlers—either at the initiative of teenagers who share extremist views or under coercion.

Among the high-profile crimes committed in recent years by supporters of «764,» the following can be cited:

January 2025, Borås, Sweden: A 14-year-old criminal armed with a knife brutally stabbed an elderly woman to death. The attacker recorded the attack on video and personally uploaded the clip online via an account directly linked to and verified by the «764» community in order to report to the moderators;

August 2024, Eskişehir, Turkey: An 18-year-old criminal armed with a knife attacked random passersby near a local mosque; five people were injured. Before the attack, the assailant published his manifesto, to which he attached extremist manuals and Nazi literature actively circulated by «764» supporters;

April 2022, Mediaș, Romania: A 17-year-old assailant armed with a knife attacked an elderly woman, injuring her, and livestreamed the crime online. During the investigation, it was established that the perpetrator carried out this attack as an «initiation rite» to join the «764» group.

Some journalists also attribute to «764» the mass murder in Southport, United Kingdom, in July 2024, when a 17-year-old assailant armed with a knife attacked a children’s dance studio, killing 3 people and injuring 10 others. Despite the suspect’s interest in extremist ideology, his connection to «764» or similar groups has not been definitively established or confirmed.

Among the attacks carried out by «764» adherents on educational institutions, a link has been confirmed to the attack on Antioch High School in Nashville, in the United States in January 2025, when a 17-year-old student opened fire with a semi-automatic pistol, killing one female student and injuring another.  The perpetrator took his own life at the scene. Immediately before the attack, the perpetrator posted an audio recording online in which he openly stated that he was carrying out this mass murder on behalf of a group affiliated with «764.»

On June 26, according to media reports, a 17-year-old teenager was detained in Russia for creating an online community to recruit other teenagers and organize extremist actions, crimes, and terrorist acts in Russia, the United States, Germany, and Italy. According to the detainee’s testimony, in January 2026, one of the group’s members carried out five arson attacks in Fort Worth, Texas, U.S. Later, in the same state of Texas, the terrorists managed to trigger the evacuation of at least 14 schools by making a false bomb threat. In February 2026, the criminals carried out two arson attacks and triggered one evacuation of educational institutions—this time in the state of California—and in March, they carried out arson attacks in Germany and Italy. The suspect also stated that within the community he had created, there was active propaganda promoting the «Columbine» movement—a group recognized as extremist in Russia and therefore banned—whose members carry out attacks on schools around the world.

According to his own account, the detainee trained the recruited teenagers in tactics for carrying out terrorist attacks and mass killings, provided them with tools of terror, instructions for making homemade explosive devices, and guidance on maintaining secrecy. In Russia, members of the community were planning a series of attacks on educational institutions in various cities.

This is just one person who managed several communities. As for how many such communities there are in total and what their audience reach is, we can only speculate—and, unfortunately, there is no cause for optimism in these speculations.

In short, the conclusions are as follows:

1. The network of extremist communities targeting children and adolescents is actively expanding;

2. Their ideology is becoming increasingly aggressive;

3. The geographic scope of their presence and activity is expanding;

4. The level of public danger posed by their actions is rising;

5. A structured system (training, supply, leadership) is emerging;

6. Educational institutions are their primary targets.

The situation is further complicated by the fact that criminals are actively exploiting the ideology of the «Columbine» movement (cult). These are not merely attacks on schools and other educational institutions; they involve the commission of mass murder as a form of suicide for the perpetrator or group of perpetrators. And such crimes are the most dangerous, because those who commit them have no moral barriers or other restraining factors; they do not consider the consequences of their actions. This is because they know in advance (or think they know) what will happen to them in the end.

The opportunity to gain control of the situation—when it could still have been stopped at a certain point—has already been missed. As is, unfortunately, very often the case, the threat was underestimated, and the necessary countermeasures were not taken at a time when it was still vulnerable. It is now too late—and, from a practical standpoint, pointless—to look for someone to blame. All efforts must be focused on a strategy to counter this threat. We must shift our focus from the question «Who is to blame?» to finding an answer to another, more important question: «What should be done?»

I will outline my proposals for countering this threat in the second part of the article, which I will publish shortly.

 Dear Colleagues,

I would very much welcome your input and suggestions on this topic. As you can see for yourselves, the threat is more than real; it is escalating, and doing so very rapidly. We are faced with a complex applied criminological challenge, but despite its complexity, it is solvable. I invite anyone interested in this area to share their suggestions for possible countermeasures.

The plan is as follows:

1. Containment

Effective measures capable of stopping or significantly slowing the spread of the threat. In our approach, we’ll start from an international perspective; containing the threat within a single country or even a single continent is no longer feasible. Therefore, we consider the following scenario: the organizer is in one country, the recruiter in another, the handler in a third, and the final perpetrators in a fourth.

2. Prevention

Here, the main task is to develop effective practical solutions whose implementation will hinder the spread of information and recruitment, thereby reducing the influx of new members into extremist communities.

3. Disrupting the Management and Coordination System

The objective is clear from the title: we need effective measures that, when implemented, will significantly complicate the work of handlers and organizers in coordinating and managing the activities of operatives, as well as in supplying, training, and monitoring them. I understand that there is little precise data available in open sources regarding the specifics of their organizational structure and operations, but there are general, fundamental principles upon which any modern international criminal organization is built. I do not believe they have invented anything fundamentally new, so we will work from the basic principles found in criminology textbooks.     

4. Prevention and Suppression of Perpetrators’ Actions

Effective practical solutions are needed that will enable the early detection of perpetrators’ preparations for committing crimes and other offenses. We must suppress criminal acts that have progressed to the stage of direct execution. Create conditions that make it difficult for perpetrators to prepare and carry out their criminal plans.

You can develop your proposals however you like—by individual topic or across all four at once, individually or collaboratively. You have complete creative freedom in terms of execution, with the standard restrictions: no politics, mysticism, or conspiracy theories.

You can ask questions here in the comments, via the Portal’s email: mail@orderandsafety.org , or by any other convenient means; all my contact information is available on my Portal page. Please also submit your finished articles there for consideration for publication.  

Author: Roman Grishin

Photo from the website: nevs.ru

#schoolsafety #schoolsecurity #educationalsecurity #educationalsafety #violenceprevention #K-12 #massshooting #764 #reddolphin #bluewhale #schoolshooting #research #criminology #schoolcrime #educationalcrime #terrorism #schoolterrorism #educationalterrorism #massmurder #article #threat