This is a live copy of our work in progress on a new report. Once completed, the report will be available here to read online or download. We are pre-releasing the information here before the final report is ready to facilitate a rapid improvements to public safety by industry, government, and civil society stakeholders. Feedback and additional tips and information are welcome.

Last updated: 12pm May 23, 2022 (Melbourne, Australia). Status: Work in progress.

At 2:30 p.m. (Eastern Time, USA) on Saturday 14th of May 2022 (i.e. 4am AEST on May 15th) outside a Tops Friendly Market supermarket in Buffalo, New York, USA, a heavily armed 18 year old white man exited his vehicle wearing tactical gear including a helmet. He shot four people in the parking lot, killing three of them. He then proceeded into the supermarket where he was shot multiple times by a security guard (a retired police officer), the man’s tactical gear protecting him from the security officer’s shots. The man shot and killed the security officer and a number of people inside the store. On leaving, he encountered police. He prepared to kill himself and was talked down by police who then took him into custody. The attack has left 10 people dead and three wounded. The FBI are treating the attack as both a “hate crime” and as “racially motivated violent extremism”.

The man was live streaming the attack to the online gaming service Twitch, an Amazon service, and the same service used to livestream the Halle attack in Germany in 2019. The video and associated account were later removed. He also posted a manifesto online. It runs to 180 pages and borrows heavily from the manifesto of the Christchurch attack in New Zealand in 2019.

We have removed one copy of the livestream video (see the press release or read the full details below) and we are working on removing a second video that has remained up for over 72 hours. These videos incite further attacks. We are also analysing the manifesto, discord transcripts and other content and our analysis below is being regularly updated as we add new information.

Our work is supported by public donations, we are a small charity and every donation makes a big difference to us. We accept donations from around the world. Donations of $2 or more by Australian tax payers are tax deductible.

The Manifesto

The manifesto closely follows the style of the Christchurch attacker’s manifesto. It starts with an image (shown above) that uses the Black Sun (Schwarze Sonne) a form of Sonnenrad (sun wheel) used by the Nazis and by neo-Nazi groups in more recent times. It adds a call to action, “you wait for a signal while your people wait for you”. It promotes further attacks by others and seeks to help radicalise them. This reflects the attacker’s own path to violent extremism.

In case the use of Nazi symbols is not clear enough, the attacker says in his manifesto “I support neo-nazism but I am not a member of any neo-nazi groups, you decide what that makes me.” He also says that the Christchurch attacker is the person that radicalised him. He writes, “Brenton’s livestream started everything you see here. Brenton started my real research into the problems with immigration and foreigners in our White lands, without his livestream I would likely have no idea about the real problems the West is facing.” The style of the manifesto makes it clear it isn’t just the live stream he read in detail and absorbed, but the long manifesto that came with it.

The attacker notes how he adopted his views between the ages of 15 and 18 as he progressively moved further to the right, that is further down the path of radicalisation. He makes a play to anti-vaxxers and conspiracy theorists saying he is not a false flag or a government agent, but “Who knows maybe it’s the two shots of covid vaccine juice going
through my bloodstream that’s really making me do this.
” In his manifesto he claims he is at a community college studying engineering science, but the college has told the media he had dropped out and was no longer enrolled there.

The Great Replacement Conspiracy Theory

The main focus of the manifesto is the Great Replacement conspiracy theory. It repeats arguments found in the Christchurch manifesto, speaking about how white people are not having enough children, and therefore slowly being replaced through demographics. Where it takes a turn is the intense focus on immigration, claiming “We are experiencing an invasion on a level never seen before in history“. He argues both that governments and companies are inviting millions of people into the United States, and that these millions of immigrants are coming illegally. He explains the benefit to society of immigration, but then presents it as “an assault on the European people“. He refers to it as “white genocide“, a term at the core of the great replacement conspiracy.

He concludes that long before demographics become an issue, mass immigration will “disenfranchise” white people, “subvert” white nations, and “destroy” (white) communities, ethnic ties, cultures, and peoples. He therefore urges action to deport what he calls “invaders” and to “crush immigration“.

In his attack in Buffalo, 11 of those shot were black, and 2 were white. In the video he is seen apologising after pointing the gun at a white man, a cashier. After apologising he walks away leaving him unharmed.

4chan and /pol/ as the source of radicalisation

In the manifesto the attacker write that he joined 4chan out of boredom during COVID in May 2020. He started on other boards, but “eventually wound up on /pol/”. He described how the “infographics, shitposts, and memes” on /pol/ shared messages about the “White race” dying out, Blacks being disproportionately responsible for killing white people, white people are subsidising Black people through welfare, and that “the Jews and the elite were behind this”.

A word of correction on the misinformation spread by /pol/ which leads to radicalisation:

The “great replacement” is a racist and misogynistic conspiracy theory. Not only is the idea of some underlying plot nonsense, but the demographic data used is very uncertain. Even if white people did become a smaller share of US population, that is unlikely to have much impact. An op-ed in the New York Times explained this in far more detail after the Christchurch attack. That op-ed also explains why the term “great replacement” has been chosen, and its all to do with search engine algorithms and the lack of competition for those search terms. The author noted, “It has found its greatest purchase among a certain type of basement-dwelling incel edgelord, to whom it offers both an explanation for self-pitying personal circumstance and a set of convenient antagonists (roughly, the blame falls on race-betraying, sexually empowered women; immigrants; and the Jews said to control the whole system).” Following COVID and lockdowns, with more people spending more time online, this conspiracy theory has lightly spread much faster. This attack and the very rapid radicalization is an example of this.

The argument Black people are responsible for most deaths of white people is just wrong. FBI crime statistics show that the vast majority (over 82%) of homicides of white people are committed by white people. Yes, this data is a little old, but the latest data from the FBY doesn’t give the same useful intersection. The situation is, however, unlikely to have changed radically in recent years.

Regarding welfare, far more white people in America are on welfare recipients than Black people. This is primarily because they are a larger part of the population. The percent of Black people on welfare is higher, but has a lot to do with racism and unequal opportunity both now and in the past. Business Insider has a great article explaining “How decades of US welfare policies lifted up the white middle class and largely excluded Black Americans”. It also includes details on one of the main forms of US wefare, the “Supplemental Nutrition Assistance Program” or “SNAP”. The U.S. Department of Agriculture (USDA) released demographic data on those who receive this welfare. The data for 2018 said 35.7% of recipients were white, 25.1% were Black, 16.7% were Hispanic, 3% were Asian, and 1.5% were Native American. The remaining 17.4% are unknown and 0.8% listed their race as mixed. In short, the argument is based on a racist stereotype.

Finally, the idea Jews and elites are controlling all these things that aren’t even happening, that links back the Protocols of the Elders of Zion – a famous antisemitic conspiracy theory created in Tsarist Russia. The conspiracy is also the basis of a lot of the QAnon conspiracy. It is fake, has been exposed multiple times, yet remains in circulation.

Further analysis on the manifesto is currently in progress.

The livestream, the videos, and their distribution

The attack was live streamed via Twitch, the same video streaming services (usually used by gamers) which was used in the terrorist attack on the synagogue in Halle, Germany, on Yom Kippur (the holiest day in Judaism) in October 2019. In the manifesto, the young male attacker notes the use of Twitch in the Halle attack, saying this proved the suitability to him of using that platform. He also notes in the manifesto the ability to stream from Twitch to Discord to facilitate recording and dissemination of the video.

Twitch has stated to CNN that they took the video down within 2 minutes of the violence starting. We have seen the video which cuts out during the live stream, which appears to be a result of Twitch taking the feed offline. This is a great improvement in the response since the attack in Halle where the attacker finished the video, and it was then automatically uploaded and shared through the Twitch service. Unfortunately, through a sophisticated technical setup, discussed below, the attacker circumvented the response of the platform with an alternative path to ensure capture and distribution of his video.

From copies of the livestream we have examined we can see 22 people were watching the attack live through Twitch. As discussed below, this includes 21 people and a computer used by the attacker as part of the infrastructure to facilitate anonymous viewing and distribution of the video.

In discussion on 4chan’s /pol/ after the attack members of /pol/ stated about 20 people watched the livestream. At least five members of /pol/ who engaged in discussion after the attack were part of this audience. It was through the discussion that the manifesto was shared, followed by multiple copies of the video. Some copies were recovered from the cache of /pol/ users who has watched the attack via Twitch.

Some videos were a result of social pressure from the /pol/ community to those who had watched the livestream on Twitch. The anonymous users in /pol/ demanded the video be uploaded, advised whose who had watched the livestream about caching, and supplied technical advice and support to help recover copies of the video. As discussed below, the pressure to distribute this terrorist content, and the aid to facilitate it, came from /pol/ members from around the world. This included engagement (documented below) from the US, Australia, and Canada.

These efforts by the /pol/ community sought to circumvent the action taken by Twitch to terminate the live feed and prevent the video spreading. The attacker himself, however, was a step ahead. Through a sophisticated technical setup, he ensure he was rebroadcasting his livestream to a Discord server and others using that server were aware of the impending attack and were encouraged to record and distribute the video. While this reduced the quality of the footage, it ensured there were a group of people able to watch and record while being one step removed from Twitch. This ensured even Twitch would not have records of their IP address. In this way, the attacker made it more likely others, who had only the weakest links to him, would record and distribute the video based on a perception of it being a high impact and low risk activity.

How the video was initially captured and shared

Using his GoPro, the attacker was streaming video to the Twitch service. This allowed others to watch his livestream by visiting his account on Twitch. Our review of video evidence shows that at the time the feed was terminated by Twitch, there were 22 people watching. In reality it was 21 people, and the attackers own computer which was likely sitting at his home unattended.

His computer was showing the Twitch channel in full screen mode. A person watching the monitor would have seen a full screen view of the footage being recorded from the GoPro. While there was likely no one there to see it, he was also running the Discord instant messaging program. Discord allows a user to steam the view of one of their browser windows to a chat as a video. This can be used to, for example, share with others in the chat how you play a browser based game. Discord makes sharing this way easy. In this case, the attacker shared the browser window which was showing the feed from their Twitch. This set up a relay, rebroadcasting it to the Discord channel.

We know there were 21 people, plus this unattended computer, watching the attack on Twitch. We don’t know how many people were in the Discord watching the related stream. We do know at least two of them recorded the discord stream and the shared the video online spreading this extremist content. We know there were at least two of them as they used different screen capturing software; one left a watermark while the other did not.

When the stream on Twitch was cut, the full screen mode ended and the browser returned to showing the Twitch channel page. Because it was no longer in full screen mode, we can now see the bookmarks in the browser tab, as well as which other channels Twitch is recommending to this viewer. Comparing the two videos, the bookmarks match as do the recommended channels, showing this is actually the same browser being captured by two different people, and using two different video capture programs.

How do two people capture the same browser on two different computers? It’s because they are not capturing their own browser in the video. Rather, what we see being captured is the attackers browser, which continues to be stream to Discord. Now that there is no video stream, it just sits there showing the offline channel.

Think of it as a terrorist who is carrying out an attack, and live streaming it to a movie theatre. Everyone in the theatre sees the same thing, which is whatever the terrorist’s camera is pointing at. Now image two people use their phones to record the movie theatre screen. They each save what they recorded, and they share their video to different sites. The videos are identical, except the second person started filming the screen a couple of minutes earlier, so their video is longer but the final part of it is identical to the first video. It looks like both videos show the attackers feed, but in reality they are recording the movie theatre screen, and if the lights come up in the theatre, they will record that as well. That’s the equivalent of what happened at the end.

The first video capture with no watermark
The same frame as before, captured by a different person whose software added a watermark

By comparison, if people were capturing their own browser showing the Twitch channel, firstly each user would have a different set of bookmarks, open tabs, etc. Secondly, the recommended channels would be different. You can see an example of this below, which comes from a Canadian user who captured the video and posted an image of it to /pol/ to prove they has been in the Twitch channel and had captured it on video. While we have redacted the channel names, it is clear to see the number of views is the same for each recommended channel in the first two images, but very different in this third image. The tabs and books marks are also different.

The screen showing the Twitch channel as captured by a Canadian /pol/ user

This means the attacker was streaming their Twitch via discord as they said they would in their manifesto. It also follows that more than just the 22 viewers (21 people) on Twitch were watching, at least some viewers were clearly watching via Discord. These viewers would be entirely invisible to Twitch, they weren’t watching Twitch directly, but were watching a recording (live streamed) of someone else’s screen as they watched Twitch.

The result is multiple points from which the video could be spread, and those getting their content via the path of: GoPro -> Twitch -> Attackers Computer -> Discord, they would be anonymous. This means even if Twitch released IP details of the people who watched the stream (the 21 users) this would not provide any leads on the “first recorder”, “second recorder”, or additional people who may have captured the feed as a video and began its circulation on other platforms.

It is also possible the role of the First recorder and Second recorder in capturing the video was planned with the attacker in advance, making them accomplices. If so, the delay may have been a result of waiting until others were close to releasing copies of the video before sharing their own versions of it. That assistance to terrorism, and spread of terrorist materials, should result in charges if they can be found.

The spread of the video via Streamable and catbox.moe

One copy of the video we monitored was uploaded to the streaming service Streamable, a US company which was acquired by Hopin in March last year. The video went through the path: GoPro -> Twitch -> Attackers Computer -> Discord -> First Recorder captured it -> First Recorder Uploads it to Streamable.

We first found this video around 3:40pm Melbourne time on May 15th, that is 1:40am ET, about 13 hours after the attack. At the time this copy had already been seen 107,546 times. We reported it immediately, selecting terrorism as the reason for the report. We then checked back every hour recording the number of views to monitor its spread which rapidly accelerated, particularly as people on the East Coast of the US woke up.

After almost 13 hours, and working in collaboration with the American Jewish Congress, we were able to speak with Hopin’s General Manager, Armen Petrosian, who drew the attention of Streamable staff to the video. This resulting it being removed within 20 minutes.

First seen +1 hour +2 hours +3 hours +4 hours + 5 hours + 6 hours + 7 hours
107,546 175,374 204,748 274,759 335,565 401,270 503,441 666,957
Views of one copy of the attack video hosted at Streamable
+8 hours +9 hours +10 hours +11 hours +12 hours Final at almost 13 hours
978,245 1,434,135 2,229,770 2,838,505 3,130,179 3,244,599
Views of one copy of the attack video hosted at Streamable
Error message after the content is removed (almost 13 hours later)

Given the manifesto itself highlighted how the Christchurch video was a direct inspiration for this attack, and how this attack is itself designed to inspire further attacks, the continued spread of this video was deeply worrying.

The second video was a little longer and featured the attacker driving to the venue, then carrying out the attack. This video was uploaded to catbox.moe, which does not show how many people have viewed the video, but from complaints about load times on /pol/ clearly a lot of viewers saw it there. This service has no reporting mechanism other than a general contact email for the administrator and it seems to be run as a hobby. We sent an email to the administrator drawing attention to the video. The video remained online for at least three days longer than the first video. We last saw it online at 5am AEST on May 18th / 3pm ET May 17th. At 3am AEST on May 21 / 1pm ET May 20 we confirmed this second video had been removed.

Error message at the address of the second video after it was removed

Information on the attacker from the video

Give the attacker ended up accidentally streaming their browser, this exposed additional information about them. Firstly, we can see a bookmark the college they attended, PayPal and eBay.

The bookmarks from the person who uploaded at least two version of the video which is circulating

Further along, however, we can see a link to the Daily Stormer. We monitored the Daily Stormer when it first started in 2013. At that time it had a Facebook page. In an early post it explained what it was all about saying: “For those who already don’t know, ‘Daily Stormer’ is in english to what ‘Der Sturmer’ was in Germany during the Hitler’s time.” The text accompanied an image of the October 1936 front page of Der Stürmer, a German newspaper that was a key part of Nazi propaganda and the antisemitic hate whose acceptance in Nazi Germany facilitated the Holocaust. Following the deadly “Unite the Right” rally in Charlottesville in 2017 the Daily Stormer found itself repeatedly terminated by its hosting companies and bouncing between servers, banned by GoDaddy and then Google. It was the start of a reconsideration by tech companies of the idea of being “neutral” when it came to neo-Nazism and white supremacy. The Southern Poverty Law Center called it the number one hate site on the internet.

Another bookmark links to the DailyArchive a site (recently taken offline by GoDaddy) which focused on distributing Nazi material such as speeches by Nazi leaders. From the Google cache, here’s some of the content that was available there until recently:

The daily archive was also, until recently, operating a Twitter account which it used to promote its Nazi articles, as well as other neo-Nazi activities and messages.

Another link goes to an article at the National Vanguard, an American white nationalist, neo-Nazi organization based in Charlottesville. The article itself, “14 Reasons IQ Race Gap is Genetic”, was published in 2016 and is a promotion of Nazi like racial pseudo-science that argues Black people are inferior to white people. Given the choice of Black targets in this attack, the bookmarking of this article is particularly significant.

Other bookmarks relate to weapons and an armor purchasing guide. Again significant given the use of guns and body armor in this attack.

The /pol/ Community on 4Chan

In our report on the Halle Attack in 2019 we explained how the culture of /pol/ was deliberately altered by neo-Nazis from Stormfront who infiltrated it. In this attack have the attackers confession in the manifesto of being a neo-Nazi who was radicalised on /pol/.

The attacker

In addition to what we learn about the connection to /pol/ in the manifesto (discussed above), evidence emerged of a registered user on 4chan, posting in /pol/, with the same name as the Twitch account that was livestreaming the attack. The post is from an archive of content from 4 months before the attack and is both antisemitic and very in keeping with the culture on /pol/.

4Chan’s role in spreading the extremist content

The original poster (Jf2XMB9C)

One person from the /pol/ community on 4chan saw the attack live and 20 minutes later posted about it on /pol/. They claimed about 20 people were watching it live, and shared the Twitch account.

In a later post same user explained they didn’t record it because they weren’t set up for that, but they did share the link to as many discords as possible, which they estimated was about 3 before the stream died.

There was a clamour of /pol/ users asking for the video. One from Canada sought to provide technical assistance telling the original poster to hurry so they could see the video. Others joined in and the original poster told them to “tell me how to do this”.

An Australian user offers to help, asking for details of the original poster’s system and suggests a tool to use to recover the videos from the cache.

The original poster gives their system details.

The original user used the tool but didn’t find the right video.

A second users (g3WHSXwg)

Another 4chan /pol/ user stated that they were one of the 20 viewing it. They claimed to have watched the attacker drive around for about 5 minutes as he tried to psych himself up.

A third user (pRoO1onj)

A third /pol/ user also saw him driving around looking for somewhere to park, then stopping in front of the store before getting out and starting to shoot people. They speak of clicking off to reload the stream, and mention that “Somebody’s possibly recorded that.” A reference that may refer to themselves, if the reload was to enable recording.

A fourth user: Sharing the manifesto

The manifesto was also shared through 4chan, first via Google Drive. Google has disabled that link.

A fifth User

A user from Canada who had watched the stream live posted when they had the file and showed it playing.

They were told by a US user to post it to kiwifarms using a VPN (to hide their IP address) and a throwaway email address so as to avoid law enforcement.

He responded with another image from the video saying “dude I don’t even have a vpn right now”. The image they shared is extremely violent and showed one of the victims at the exact moment they were killed.

Despite this they were urged to post it and attacked for not having the right software.

In response to the barrage of abuse they posted a screen shot of a video playing in front of the comments attacking them.

After further demands to post the video, a link appeared. The link showed a video of the attacker driving around, then stopping and getting out of the car, raising the gun to kill the first victim. At that point it cuts to the 1987 music video for “Never Gonna Give You Up” by Rick Astley i.e. it devolved into a Rickroll. The thread dissolved into chaos at this point. The video was however uploaded to Kiwifarms.

The Discord Transcript

In the manifesto, readers are encouraged to also see the Discord transcript which is described as “much less formal” and containing personal and other information.

Analysis on the transcript is currently being carried out.

We thank the White Rose Society Australia (@WhiteRoseSocAU) for privately sharing a copy of the transcript with us.

Theoretical Frameworks

In online discussion some have expressed the view this should not be treated as a lone wolf attack, but either as part of a movement that include the GOP and Fox News, with politicians and media also being labelled as terrorists, or that it should be seen as part of Militant Accelerationism like Atomwaffen Division or the Boogaloo movement. We disagree.

Problems with the Broad Right Wing Movement theory

There is no doubt that politicians like Marjorie Taylor Greene and Matt Gaetz are seeking to pull the GOP to the far right. Greene’s engagement with Gab, which provides a platform for white supremacy and the far-right Christian Identity movement, as documented in detail in the reports of the American Jewish Congress, is deeply problematic.

The push by Gab’s founder to get supporters to withdraw from mainstream media, mainstream social media, mainstream banking, etc. and form an alternative society that focused on taking over communities at the local level and promoting white nationalism is indeed dangerous.

Attacks on immigrants, American Muslims, etc. by Fox News, Gab, some GOP politicians, President Trump, etc. is concerning. It is certainly raising interest and normalising more extreme views. These, however, are not the extremist views that lead to an attack like the one we saw in Buffalo. What they do is lower the barriers society puts in place between what is mainstream political debate, and the conspiracy theories of extremists. When members of Congress promote nonsense conspiracy theories like “Jewish Space Lasers” (as Marjorie Taylor Greene did) or QAnon (yes, Greene again) it makes some see these and other conspiracy theories they happen to find online as more “possible”.

Tucker Carlson’s efforts to raise anxiety with misinformation leaves people more open to the scapegoating of minorities. His promotion of the Great Replacement conspiracy theory on his show will have directly led to more people searching for information about it, or paying more attention to it when they come across it. Carlson may stop short of crossing the line, but the material he inspires others to find does not.

The campaign against facts, science, and the mainstream media undermine the public’s defences in the face of extremist propaganda. None of this, however, actually radicalises the individuals that carry out terrorist attacks. What it does is leave more people exposed to other channels of information which engage in radicalisation and incitement to violence.

The problem with the Militant Accelerationism theory

ARC has a good introduction to Militant Accelerationism. They note the lack of a consensus on definition and where it fits in the understanding of terrorism. Examples range from those with “explicit self-identification as accelerationist (e.g., Atomwaffen Division)” to those with “implicit adherence to the tactics and strategies without a strict identification as accelerationist (e.g., Boogaloo)”. They propose as a definition: “Militant accelerationism is a set of tactics and strategies designed to put pressure on and exacerbate latent social divisions, often through violence, thus hastening societal collapse.”

What we have seen in the series of attacks that include Buffalo are individuals who seek to change society, and to inspire others to take action to cause change, and who choose to use violence as the means of cause that change. This alone is simply terrorism – the combination of a political goal and the use of violence against civilians, and fear of future violence, as a means to achieve it.

The addition of “pressure on and exacerbate latent social divisions” in the context of these attacks would refer specifically to this particular movement’s the division between “white people” or “European people” and others in society. The narratives in the series of attacks Buffalo is part of are consistently focused on this. This is what makes this not just terrorism, but far-right terrorism.

Having said, this, we must point out that Militant Accelerationism does not have to focus on racial divisions. Our work on the Boogaloo movement showed there were clearly two completing movements operating at the same time. One was a far-right white supremacist movement, the other was very bit as militant and anti-government, but was explicitly anti-racist. The common thread was the desire to destroy and replace the system which those in the two movements felt was not working for them.

What separates Militant Accelerationism from other forms of terrorism, and Far-Right Militant Accelerationism from other Far-Right Terrorism, is the use of tactics in which groups of people cooperate as part of a movement rather than as part of a more rigid groups that acts under the direction of leaders and officers. There is no leadership, but there is a consensus and a set of tactics related to operational security and interactions with each other across the movement. There is communication and coordination. That’s what differentiates it from the “lone-wolf” concept (1970s) or the “leaderless resistance” concept (1990s).

This attack was more like the lone-wolf attack. The attacker had at most 22 people watching their stream. They were not a part of any group (this comes from the manifesto). They self radicalised through reading various materials online. They were inspired by the Christchurch attack to do something similar. It is in a sense a lone-wolf copy cat crime.

The theory of /pol/ as specific culture fostering extremism

Our approach suggests there is something more than just a lone-wolf copy cat crime. This is the 5th person we have have looked at who was radicalised to extremism through the culture on /pol/.

In our report on the topic after the Halle Attack, we explain the culture and history of 4Chan (references and images have been removed from the quotes below, but they are in the original and report is freely available):

4chan provided the foundation for a great deal of popular culture which spread across the Internet and occasionally offline, while at the same time maintaining a “culture of abuse”. Among the positive contributions of 4chan to popular culture are the modern concept of a meme, LOLCats, and the Anonymous movement. Negative contributions to online culture coming from 4chan include encouraging suicides, coordinating extreme harassment, and initially hosting the misogyny that led to Gamergate. 4chan has received sporadic bursts of high-profile media attention, usually for its negative impact.

4chan has always cultivated a “too toxic to endure” culture steeped in sarcasm and irony that users claim is intentionally designed to confuse and shock new visitors. This culture was deployed as a tool for excluding certain social groups from participation and establishing subcultural boundaries and signposting group identity. One of the boards within 4chan, however, took this to a new level. The /pol/ board was regularly presented as a “containment zone”, a place within the 4chan community to quarantine behavior that was too toxic even for the rest of 4chan.

5.3 /pol/ the “Politically Incorrect” Board and its Evolving Antisemitism

The “politically incorrect” forum known for short as /pol/ can be found on 4chan, 8chan, and a range of other boards. The promotion of Nazism, racism, and xenophobia in general are popular themes on the board, and traditionally would continue only until someone started to take it seriously, before the mob would then turn on them. In recent years, however, that has changed.

/pol/-users are responsible for a range of actions that gained widespread media attention. They turned Microsoft’s self-learning Twitter bot into a Hitler loving racist. They manipulated the media into believing there was a boycott of Star Wars on the grounds of the cast being too racially diverse and not ‘white enough’. They spent years trolling cartoonist Ben Garrison, turning his political cartoons into pro-Nazi and antisemitic propaganda, and were involved in the efforts to turn an antisemitic image into a part of everyday Internet culture. They are responsible for the spread of extremist slogans such as “Gas the kikes. Race war now” to a range of other platforms.

While it used to be hard to know what was serious and what was a result of /pol/lacks (users of /pol/) trolling each other, the extreme views which started as a parody became an earnest belief within the /pol/ community. This normalisation of neo-Nazism on /pol/ was in part the results of a campaign by neo-Nazis from Stormfront who sought to convert the /pol/acks to their ideology.

Andre Oboler, William Allington and Patrick Scolyer-Grey 2019, Hate and Violent Extremism From an Online Subculture: the Yom Kippur Terrorist Attack in Halle, Germany, Online Hate Prevention Institute, Melbourne. p. 71.

We explain the change in detail with documented evidence.

Antisemitism has always been present on 4chan and was a part of /pol/ since /pol/’s inception in 2011. After all, what could be more politically incorrect than claiming to support Nazism? This initial promotion of antisemitism was an attempt to cause shock and use the anonymity of the online forum to defy the norms of offline society. There was no particular malice towards Jews, instead the focus was on jokes and pranks expressed ironically to troll others.

Andre Oboler, William Allington and Patrick Scolyer-Grey 2019, Hate and Violent Extremism From an Online Subculture: the Yom Kippur Terrorist Attack in Halle, Germany, Online Hate Prevention Institute, Melbourne. p. 72.

However:

Over time /pol/ has been taken over by neo-Nazis and its culture has changed from one that was ironically racist, with antisemitism being a part of that, to one where violence against Jews is not just advocated, but live streamed for the /pol/ community’s entertainment.

Andre Oboler, William Allington and Patrick Scolyer-Grey 2019, Hate and Violent Extremism From an Online Subculture: the Yom Kippur Terrorist Attack in Halle, Germany, Online Hate Prevention Institute, Melbourne. p. 73.

There has been interest in /pol/ by neo-Nazis on Stormfront since at least July 2012. At that time the “almost completely unmoderated” nature of /pol/ was already noted as a plus for spreading neo-Nazi ideology. At this time there was push back on /pol/ to overt neo-Nazism.

Andre Oboler, William Allington and Patrick Scolyer-Grey 2019, Hate and Violent Extremism From an Online Subculture: the Yom Kippur Terrorist Attack in Halle, Germany, Online Hate Prevention Institute, Melbourne. p. 77.

The change overed 2012 and 2013:

By January 2014, however, a long time stormfront user described /pol/ users as “strongly pro-WN [White Nationalism], pro-NS [National Socialism] or pro-libertarian” adding that “the whole culture of the board is ragingly anti-jew”, and that “there’s a strong, almost overwhelming WN [White Nationalist] current on the /pol/ board”

Andre Oboler, William Allington and Patrick Scolyer-Grey 2019, Hate and Violent Extremism From an Online Subculture: the Yom Kippur Terrorist Attack in Halle, Germany, Online Hate Prevention Institute, Melbourne. p. 77-78.

It was 2019 when it moved from hate to violence:

In another thread calling for the neo-Nazi’s to be kicked off /pol/ in November 2018, the poster starts their message with a caricature of a post by a neo-Nazi. Another user picks up one line in the impersonation that says “hurr durr I’m going to go out and shoot a bunch of kikes and niggers” and dismisses it saying “name one time this has happened”. Since this post was made there have been 4 such incidents as documented in this report. 2019 has marked a significant shift in the nature of /pol/ and therefore in the way it needs to be treated.

Andre Oboler, William Allington and Patrick Scolyer-Grey 2019, Hate and Violent Extremism From an Online Subculture: the Yom Kippur Terrorist Attack in Halle, Germany, Online Hate Prevention Institute, Melbourne. p. 82.

The terrorist attacks are an outgrowth of 4chan’s culture subverted to neo-Nazi purposes. This has occurred through self radicalisation as /pol/ is used to direct its audience to extremist material and resources. It is poll that facilitated the sharing of terrorist material and praise for the attackers, as we saw in the previous attacks again in this one. This is not Militant Accelerationism, it is a culture all its own. Nor is it a response to the GOP, even its most extreme elements, they just serve to bring more people to /pol/. The problem is this online culture, its anonymity, and the way it allows the platform to be used to spread terrorist content and the hate that leads to it.

Related content

Buffalo get condolences from Israel, J-Wire, 16 May 2022 (News article with commentary from our CEO)

American Jewish Congress Press Release, 16 May 2022 (Notes partnership with OHPI on monitoring the video)

Online Hate Prevention Institute Press Release, 17 May, 2022 (A short media briefing from us)

Sarah Roach, “‘We’ll be here again’: How tech companies try and fail to prevent terrorism“, Protocol, 17 May 2022 (includes commentary from an interview with our CEO)

Dimitriy Shapiro, “Jewish groups react to mass shooting in Buffalo, lamenting dismal shared experience of late“, Jewish News Service, JNS, 17 May 2022 (Responses from the US Jewish community, includes mention of OHPI’s partnership with the American Jewish Congress in removing the first video)

Why we’ve provided this information

The Online Hate Prevention Institute is an Australian Charity that works to improve online safety. Our work is based on our deep interdisciplinary understanding of technology, law, public policy, hate speech, and extremism.

  • We document online hate and extremism, helping practitioners respond and researchers across multiple disciplines better understand the online space and the impact it has on society.
  • We work with the technology industry to remove hateful and extremist content. We make recommendation to industry to improve their tools, policies, processes, and training to ensure an safer internet for everyone.
  • We document a range of problems impacting individuals and specifically impacted communities, making an evidence-based public case for more to be done.
  • We work with governments, government agencies, and parliaments to help shape effective policy and laws to tackle online hate and extremism and keep the public safe online and offline.

This report, first published within 24 hours of the Buffalo attack and then continually updated, has been prepared as a rapid response to the unfolding situation. It is designed to deepen understanding and help those in industry and government respond in the aftermath of the attack, as well as providing more detailed analysis to help society better prevent or mitigate future harm.

Support for our work

The Online Hate Prevention Institute is a Registered Australian Charity and on the Australian Government’s Register of Harm Prevention Charities. Our work is funded through public donations. You can support our work using the buttons below for either a single donation, or a reoccurring monthly donation. Donations of $2 or more by Australian tax payers are tax deductible.