Online Extremist Communities and Mass Killings at Schools and Other Educational Institutions. Continued, Part 2.

 

As I mentioned in the first part of this article, the threat posed by online extremist communities is serious and real—there is no longer any doubt about that. I would like to add that in the last month alone, law enforcement agencies have suggested that these communities may have been involved in three more attacks:

June 22, 2026, Tacloban, Philippines;

July 6, 2026, Banting, Malaysia;

July 8, 2026, Schongau, Germany.

Politicians and officials have now acknowledged the very existence of this threat and are demanding that police forces take urgent countermeasures. However, there is no longer a quick and effective solution to this problem. Such an opportunity existed several years ago, when these groups began shifting their ideology, moving from extortion and fraud to organizing mass killings and riots. However, the threat was underestimated at the time, and now the opportunity has been missed.

Under the current circumstances, a completely different approach is needed—not an illusory plan designed for a quick «wow effect», but a strategy, a system designed not only to contain the threat in its current form but also to address the directions and forms of its possible development.

To build such a countermeasure system, I propose using the «Hostile Environment» model. What is this? Imagine crime not as a social phenomenon, but as a living organism. This organism actively grows, develops, and reproduces only if the environment is favorable. In such an environment, there are comfortable weather conditions, sufficient water and food, and no (or minimal) threats in the form of predators or natural disasters. In this case, the population of this species will grow and expand into more and more new territories.

The conclusion is simple: since crime is on the rise, it means the environment is favorable for it, and it is thriving. What should be done? We must develop a counterstrategy designed to make the environment for crime no longer comfortable, but rather hostile and aggressive—one in which the chances of survival are very slim.

 

Step 1: Gathering Information.

This is always the place to start; it is important to understand who you are dealing with, what their goals are, how they operate, and what capabilities they possess. Having as much reliable and objective information as possible about the adversary is half the battle. Their logic becomes clear and their actions become understandable, which means they become predictable—their next moves can be anticipated and thwarted.

The starting point is the testimony provided by surviving suspects in crimes committed in the interests of and at the behest of online extremist communities. They are direct participants who went through the entire chain of events, from recruitment to carrying out the final mission. They know a great deal; the question is, will they be willing to share this information? It is important to understand that, after consulting with their lawyers and parents, they will try to portray themselves as victims who acted unintentionally, under duress, or under threat of physical harm or the public disclosure of compromising material. Only 30–40% of the information in such accounts, which they provided during the investigation, will be reliable. All of them have been punished—some with actual prison terms, others, due to their age, with suspended sentences and restrictive measures. I believe it is acceptable, once the court decisions have taken effect, to offer them the opportunity to testify again, provided that the terms of their punishment are mitigated (within reasonable limits) and their anonymity is guaranteed. This would take place without procedural status, with the involvement of experts in psychology and forensic psychiatry.

The second, equally important area—which should proceed in parallel with the first—is the search for would-be perpetrators who did not carry out the crimes. Those who were also recruited and trained but did not go through with the crime, those who refused at the last moment, and those who were stopped during the preparation stage. This should be done anonymously, also without procedural status, with the involvement of specialists.

It is important to understand exactly how, where, and based on what criteria criminals find their victims—the principle behind selecting targets for potential recruitment. How did they come into contact with the handler of the extremist network? Did they seek out the meeting themselves, or did the recruiters approach them? Next, we need information on how potential victims are subjected to psychological manipulation. The details here are crucial; I am certain that recruiters do not immediately reveal to those they are recruiting their affiliation with extremist organizations and movements, nor do they disclose their objectives regarding these teenagers. This is the main question for the experts. I don’t think that on the other side, each teenager is assigned a professional psychologist or a recruiter with practical experience in foreign intelligence. They likely use people who have undergone some training, but only at the level of crash courses. They operate according to a specific template similar to aggressive online sales tactics; online scammers also use similar tactics.

Based on the limited information that has become publicly available, the recruitment system used by extremist communities closely resembles the one used by ISIS recruiters.

Hypothesis: Based on an analysis of the available information, they operate in a targeted and deliberate manner, using pre-compiled lists of potential victims—teenagers who are in a state of emotional and psychological vulnerability and are easily influenced and manipulated. They obtain these lists through legal and semi-legal means, ordering them through front companies from information and analytics agencies that collect data on target audiences for companies selling goods and services on social media. In this case, they may disguise their actual interest in the specified target audience as a search for potential customers for personal development courses, psychological services, dating sites, merchandise for informal communities, and so on. But in the near future (or perhaps even now), this will no longer be necessary, as specialized  AI-based search programs will be able to collect and perform the initial processing of such data.

The third area involves working with digital traces and analyzing the content of deleted groups, channels, websites, and other online communities. When courts or authorized regulatory bodies (which vary by country) block harmful communities, their content often simply disappears, resulting in the loss of valuable information for analysis. An operational protocol is needed for telecommunications operators and hosting providers, stipulating that, prior to blocking, all metadata (posts, comments, hashtags, timestamps, participants, etc.) must be preserved and transferred to a specialized law enforcement unit (more on this later) for subsequent analysis. This is like a «digital autopsy» for experts; it can yield a great deal of useful information, both for operational intelligence and as evidence in legal proceedings.

It is necessary to gather as much information as possible on the scenarios used by extremists, including details and a detailed algorithm of actions for locating, approaching, and manipulating victims. All of this should be provided to specialists—criminologists, psychologists, and psychiatrists—for analysis. Based on their conclusions, it will be possible to understand:

- the principles of locating and selecting victims;

- the sources of information used and the methods of gathering it;

- the scenarios and templates used in manipulating victims;

- methods of moral and psychological pressure;

- means of communication and other tools for controlling victims.

Expected outcome of this phase:

Using the collected data, it will be possible to develop a statistical model of a potential victim: age, gender, family characteristics (two-parent family or single-parent household, social status, income level, religious affiliation, parenting principles, and parental involvement in the child’s life, etc.), level of intellectual and physical development, attitudes toward school, politics, religion, sports, culture, hobbies, a moral and psychological profile, and other additional information.

The resulting model will make it possible to identify and provide a clear description of the most vulnerable groups of adolescents. This information must be forwarded to schools, colleges, other educational institutions, and places where large numbers of children gather. It is intended for practical use by teachers, psychologists, social workers, and staff of relevant police units.

Identifying a well-founded «risk group» of potential victims, placing them under observation, and notifying their parents (or guardians) of the potential threat is the first and most effective preventive measure, which will significantly reduce the effectiveness of extremist recruiters. It will serve as an effective deterrent and significantly slow the spread of the threat.

Key Features of Organizing This Phase:

To ensure the most effective and comprehensive collection of information, this process must be organized on an international scale.

An international information and analysis group is needed, comprising expert analysts and specialists from various countries—primarily those that have already suffered from the actions of criminals in online «death groups»*.

If each country collects information separately, without combining it with data from others, an effective statistical model will not be possible. All analysis will be based on very sparse and incomplete data. As a result, instead of an effective tool for deterring the threat, we will end up with a general template containing vague wording and generic phrases, which is of little practical use. To be frank, this is exactly what we have today. Let me remind you: we are dealing with an international threat that operates according to this pattern: the organizer is in one country, the recruiter in another, the handler in a third, and the final perpetrators in a fourth. Trying to counter them on an «every man for himself» basis won’t work—we’ll lose, yet again. The more information we can gather and process, the more accurate and detailed the experts’ conclusions will be.   Therefore, we must act together; only this will guarantee a positive outcome.

On a personal note: I want to appeal once again to my colleagues—it’s time to put an end to political squabbles and return to being professionals. When it comes to children’s safety, there is no room for disagreements over contrived issues. As you can see, criminals do not distinguish between «good» and «bad» children; they maim and kill everyone, regardless of citizenship, race, religion, or political affiliation.

In my next article, I will continue to share my proposals on countering the activities of «death groups»*. This will be Phase 2, which is dedicated to developing effective practical solutions whose implementation will make it more difficult to spread information and recruit new members, thereby reducing the influx of new operatives into extremist communities.

* This term was coined by journalists who have written about extremist and destructive online communities. I will use this term here and in the future to refer to communities on social media and messaging apps that promote violence and encourage teenagers to commit suicide, mass murder, and other serious crimes.

Author – Roman Grishin.

#schoolsafety #schoolsecurity #educationalsecurity #educationalsafety #violenceprevention #K-12 #massshooting #764 #reddolphin #bluewhale #schoolshooting #research #criminology #schoolcrime #educationalcrime #terrorism #schoolterrorism #educationalterrorism #massmurder #article #threat

Online Extremist Communities and Mass Killings at Schools and Other Educational Institutions. Continued, Part 1.

 

Note: it should be borne in mind that the author lives and works in Russia, so in this article, he considers the situation on the example of his country. Measures to ensure the safety of schools, other educational institutions and places with a mass stay of children that he proposes are developed by him for use in Russia, taking into account the existing law enforcement system and the situation there.

In 2024, while researching cases of mass school shootings, I first came across information indicating that several such crimes had been committed by teenagers who were carrying out a «final task» assigned by the administrators of a closed social media group. This information was indirectly corroborated by statements from the Children’s Rights Ombudsman, the Chair of the «Safe Internet League» - the largest quasi-governmental organization in the field of digital security—as well as a major public organization providing assistance to minors in crisis situations. It was then that the name of this community - «Red Dolphin» - was first mentioned.

The emergence of communities and movements with similar ideologies and tactics was predictable. First, around 2015, a community called «Blue Whale» emerged, which, operating through social media and messaging apps, incited teenagers to commit suicide. In their activities, they employed a step-by-step scheme to lead the victim toward a planned outcome through the sequential completion of individual tasks modeled after a game-like quest. Even within the community itself, completing these tasks was referred to as «The Game,» with the victim’s profile featuring the hashtag #TheGame and similar tags. Each new «player» was assigned a mentor who gave tasks, monitored their completion, and provided psychological support to the victim until the final task—suicide, most often a jump from a height. There is no exact information in open sources regarding the number of victims officially confirmed. The figures cited in journalistic investigations are contradictory; some sources mention dozens of victims, while others cite hundreds. Regarding the organizers, there is information about only one criminal case—involving the organizer of such a social media community—which was investigated, concluded, sent to court, and resulted in a guilty verdict in 2025.  I am unaware of the motives, but the tactics used by «Blue Whale» were based on an individualized approach aimed at causing the death of a single, isolated person through their own actions.

As for «The Red Dolphin,» things were different here; the tactic was similar—based on the victim, who was being manipulated, carrying out the handler’s instructions—but the tasks here were entirely different. The initial tasks involved minor offenses, such as leaving graffiti on walls and doors or placing a sticker on a car or public transportation. Subsequent tasks became more complex and were classified as criminal offenses, including shoplifting, property damage, assaulting peers or younger children, arson, animal cruelty, and so on. The teenagers were not only required to commit these acts but also to document them with photos and videos and send them to the handler. In effect, they were collecting and handing over incriminating evidence against themselves to the «Game’s» handler. If a teenager tried to refuse to proceed and complete the tasks, blackmail, threats of violence from other «players,» and other forms of psychological pressure would begin. The «handlers» goal was the same—to drive the teenager to suicide—but through a different, more dangerous method. The teenager was first required to commit a mass murder and then take their own life.

This represents a new form of mass murder in educational institutions, with the planning and execution remotely controlled by third parties. Similar crimes have occurred before, but they were primarily mass murders committed in public places or targeting specific individuals or organizations. Recruiters for the terrorist organization ISIS often used this tactic of lone-wolf attacks: they would first identify people interested in their ideology on social media and messaging apps, then remotely indoctrinate them, turning them into committed fanatics. After the subject underwent psychological conditioning, they would receive a command from their handler to take a weapon—or an object used as a weapon—and go out onto the streets to kill people. There have been quite a few such cases, but the use of teenagers to attack schools and other children’s institutions has been virtually nonexistent. There have been terrorist attacks on educational institutions, but they followed a different scenario, and in most cases, the perpetrators were people over the age of 18.

However, I would surmise that the use of teenagers in particular—as the segment of society most susceptible to indoctrination and, at the same time, sufficiently aggressive and reckless—has piqued the interest of terrorist organizations and other extremist groups and movements. Their groups and organizations can be used to instigate mass unrest, while lone actors can be used to carry out mass killings in educational institutions. I first expressed these assumptions in March 2023, when I commented on the situation involving the «Ryodan PMC,» and then in October 2024, I published two more articles (Part 1 and Part 2) on this topic with additional arguments regarding the extremist group «Red Dolphin.»

Even then, I expressed the view that these were not isolated incidents and that we were dealing with a new tactic involving mass killings and the infliction of serious harm on the health of children and adolescents in schools and other educational institutions. I also stated there that, given the development of social media, messaging apps, and other forms of communication, this threat would quickly reach the international level. It appears that this is exactly what has happened.

In early June 2026, my colleagues from the U.S. sent me a link to a document—an open letter from the Dallas, Texas, field office of the Federal Bureau of Investigation to parents, guardians, and teachers. I won’t quote it in full here (those interested can read it for themselves by following the link), but the letter addresses the growing security threat posed by a malicious online network known as «764.» Their members often befriend minors on popular online gaming platforms and social media, gain their trust by posing as friends, and then coerce them into harming themselves or others. They operate worldwide, driven by hatred, sexual gratification, or a desire to sow chaos. Regardless of their motivation, they share a common goal: children and other vulnerable individuals. They exploit the trust they initially gained to manipulate their victims and force them to harm themselves or others. The FBI is currently investigating more than 450 individuals linked to these cruel online networks. The report also provides recommendations on how to monitor teenagers’ behavior and identify direct and indirect signs that a child may have become a victim of such manipulators. It includes links to additional educational resources and contact information for reporting incidents. The bureau reaffirms its commitment to combating this dangerous phenomenon. 

In short, the extremist online community «764» and several other groups associated with it operate primarily within the United States, but have large cells in Greece, the United Kingdom, France, Romania, Brazil, Sweden, Canada, Australia, Spain, and Turkey. Their main activities include sexual blackmail, the distribution of child pornography, and the recruitment of children to commit crimes. The pattern is similar: recruitment, indoctrination, and the commission of crimes under the supervision of handlers—either at the initiative of teenagers who share extremist views or under coercion.

Among the high-profile crimes committed in recent years by supporters of «764,» the following can be cited:

January 2025, Borås, Sweden: A 14-year-old criminal armed with a knife brutally stabbed an elderly woman to death. The attacker recorded the attack on video and personally uploaded the clip online via an account directly linked to and verified by the «764» community in order to report to the moderators;

August 2024, Eskişehir, Turkey: An 18-year-old criminal armed with a knife attacked random passersby near a local mosque; five people were injured. Before the attack, the assailant published his manifesto, to which he attached extremist manuals and Nazi literature actively circulated by «764» supporters;

April 2022, Mediaș, Romania: A 17-year-old assailant armed with a knife attacked an elderly woman, injuring her, and livestreamed the crime online. During the investigation, it was established that the perpetrator carried out this attack as an «initiation rite» to join the «764» group.

Some journalists also attribute to «764» the mass murder in Southport, United Kingdom, in July 2024, when a 17-year-old assailant armed with a knife attacked a children’s dance studio, killing 3 people and injuring 10 others. Despite the suspect’s interest in extremist ideology, his connection to «764» or similar groups has not been definitively established or confirmed.

Among the attacks carried out by «764» adherents on educational institutions, a link has been confirmed to the attack on Antioch High School in Nashville, in the United States in January 2025, when a 17-year-old student opened fire with a semi-automatic pistol, killing one female student and injuring another.  The perpetrator took his own life at the scene. Immediately before the attack, the perpetrator posted an audio recording online in which he openly stated that he was carrying out this mass murder on behalf of a group affiliated with «764.»

On June 26, according to media reports, a 17-year-old teenager was detained in Russia for creating an online community to recruit other teenagers and organize extremist actions, crimes, and terrorist acts in Russia, the United States, Germany, and Italy. According to the detainee’s testimony, in January 2026, one of the group’s members carried out five arson attacks in Fort Worth, Texas, U.S. Later, in the same state of Texas, the terrorists managed to trigger the evacuation of at least 14 schools by making a false bomb threat. In February 2026, the criminals carried out two arson attacks and triggered one evacuation of educational institutions—this time in the state of California—and in March, they carried out arson attacks in Germany and Italy. The suspect also stated that within the community he had created, there was active propaganda promoting the «Columbine» movement—a group recognized as extremist in Russia and therefore banned—whose members carry out attacks on schools around the world.

According to his own account, the detainee trained the recruited teenagers in tactics for carrying out terrorist attacks and mass killings, provided them with tools of terror, instructions for making homemade explosive devices, and guidance on maintaining secrecy. In Russia, members of the community were planning a series of attacks on educational institutions in various cities.

This is just one person who managed several communities. As for how many such communities there are in total and what their audience reach is, we can only speculate—and, unfortunately, there is no cause for optimism in these speculations.

In short, the conclusions are as follows:

1. The network of extremist communities targeting children and adolescents is actively expanding;

2. Their ideology is becoming increasingly aggressive;

3. The geographic scope of their presence and activity is expanding;

4. The level of public danger posed by their actions is rising;

5. A structured system (training, supply, leadership) is emerging;

6. Educational institutions are their primary targets.

The situation is further complicated by the fact that criminals are actively exploiting the ideology of the «Columbine» movement (cult). These are not merely attacks on schools and other educational institutions; they involve the commission of mass murder as a form of suicide for the perpetrator or group of perpetrators. And such crimes are the most dangerous, because those who commit them have no moral barriers or other restraining factors; they do not consider the consequences of their actions. This is because they know in advance (or think they know) what will happen to them in the end.

The opportunity to gain control of the situation—when it could still have been stopped at a certain point—has already been missed. As is, unfortunately, very often the case, the threat was underestimated, and the necessary countermeasures were not taken at a time when it was still vulnerable. It is now too late—and, from a practical standpoint, pointless—to look for someone to blame. All efforts must be focused on a strategy to counter this threat. We must shift our focus from the question «Who is to blame?» to finding an answer to another, more important question: «What should be done?»

I will outline my proposals for countering this threat in the second part of the article, which I will publish shortly.

 Dear Colleagues,

I would very much welcome your input and suggestions on this topic. As you can see for yourselves, the threat is more than real; it is escalating, and doing so very rapidly. We are faced with a complex applied criminological challenge, but despite its complexity, it is solvable. I invite anyone interested in this area to share their suggestions for possible countermeasures.

The plan is as follows:

1. Containment

Effective measures capable of stopping or significantly slowing the spread of the threat. In our approach, we’ll start from an international perspective; containing the threat within a single country or even a single continent is no longer feasible. Therefore, we consider the following scenario: the organizer is in one country, the recruiter in another, the handler in a third, and the final perpetrators in a fourth.

2. Prevention

Here, the main task is to develop effective practical solutions whose implementation will hinder the spread of information and recruitment, thereby reducing the influx of new members into extremist communities.

3. Disrupting the Management and Coordination System

The objective is clear from the title: we need effective measures that, when implemented, will significantly complicate the work of handlers and organizers in coordinating and managing the activities of operatives, as well as in supplying, training, and monitoring them. I understand that there is little precise data available in open sources regarding the specifics of their organizational structure and operations, but there are general, fundamental principles upon which any modern international criminal organization is built. I do not believe they have invented anything fundamentally new, so we will work from the basic principles found in criminology textbooks.     

4. Prevention and Suppression of Perpetrators’ Actions

Effective practical solutions are needed that will enable the early detection of perpetrators’ preparations for committing crimes and other offenses. We must suppress criminal acts that have progressed to the stage of direct execution. Create conditions that make it difficult for perpetrators to prepare and carry out their criminal plans.

You can develop your proposals however you like—by individual topic or across all four at once, individually or collaboratively. You have complete creative freedom in terms of execution, with the standard restrictions: no politics, mysticism, or conspiracy theories.

You can ask questions here in the comments, via the Portal’s email: mail@orderandsafety.org , or by any other convenient means; all my contact information is available on my Portal page. Please also submit your finished articles there for consideration for publication.  

Author: Roman Grishin

Photo from the website: nevs.ru

#schoolsafety #schoolsecurity #educationalsecurity #educationalsafety #violenceprevention #K-12 #massshooting #764 #reddolphin #bluewhale #schoolshooting #research #criminology #schoolcrime #educationalcrime #terrorism #schoolterrorism #educationalterrorism #massmurder #article #threat

A new article titled “Ensuring Safety in Educational Institutions.”

 

 I worked on it for four long years, during which time I gathered materials and prepared and published two additional studies on a similar topic.

The work took so long because I was looking for more than just practical solutions to existing safety issues in schools and other educational institutions. The main objective was to build a system out of them—a unified mechanism where everything is interconnected, where there are no superfluous details, and  each element complements and reinforces the others, where technology enhances and expands human capabilities rather than replacing them. 

The primary condition for working on the system project presented in this article—designed to ensure comprehensive security for educational facilities against criminal, terrorist, and other threats—was that a school must remain a school, not turn into a prison or a military base. It was difficult, but I managed to find such solutions.

The article begins with an analysis of the current situation, the results of conducted research, and an assessment of existing and potential threats. Subsequently, based on effective global practices for preventing and countering such threats, as well as public demand, I outlined my practical solutions, each of which is aimed at addressing specific vulnerabilities in the existing system for organizing security and safety at educational institutions, as identified during the study of actual crimes.

The project includes: administrative and legal measures, proposals for changes and additions to the system of technical fortification and security of educational institutions, the organization of security, monitoring, and response to direct threats, the use of technical security and access control measures, as well as many other issues and areas. 

In conclusion, I presented the results of a hypothetical experiment on the application of all proposed solutions, using the example of a real attack on an educational facility.

I am fully aware that the framework I propose has not yet been tested in practice, and it is premature to speak of its effectiveness; many of the proposals outlined in it are controversial. However, I believe I have achieved the main goal: to create a format, a basic foundation that can be used as a starting point to work on, improve, make changes and additions to, enhance capabilities, and increase effectiveness. To strive for excellence and create a safe space for our children.

As always, I welcome your reviews, feedback, comments, and constructive criticism. 

Read more

#schoolsafety #schoolsecurity #educationalsecurity #educationalsafety #violenceprevention #K-12 #massshooting #schoolshooting #research #criminology #schoolcrime #educationalcrime #terrorism #schoolterrorism #educationalterrorism #massmurder #article #threat