Identifying Violent Organizers in Real-Time with Dark Web Data

Posted on June 15, 2020 by Liran Sorani

read the article

The murder of 46-year old George Floyd by a white police officer on March 25 sparked a wave of political violence across the United States that has not been seen since the 1960s. Riots and vandalism that seem opportunistic in nature have spontaneously erupted from Los Angeles to New York and Chicago alongside peaceful protests in solidarity with George Floyd and the African-American community. 

What distinguished these riots was how people came, sometimes from distant cities and states to loot and damage property.

Could dark web monitoring by law enforcement agencies (LEAs) have detected these violent protesters ahead of time and prevented the extensive damage and looting done to businesses? Could it have helped LEA to more accurately target violent rioters and maintain law and order? 

Who is Antifa and how LEAs Can Detect Them

Many of the riots have since been linked to a group called Antifa, a term that is a combination of the word “anti-fascist.” The FBI Joint Terrorism Task Force has started to investigate the activity of peaceful protests that have become violent, like those in Denver. Experts warn that the group is not an organization with a defined leadership or headquarters, but rather an ideology. A small but significant number of Antifa members do believe that resorting to violent measures is sometimes necessary.

But LEA has cautioned that extremists and opportunists can be from either end of the political spectrum – or even connected to drug cartels.

What most agree on is the method these individuals employ for organizing: anonymous chat applications. These include various anonymous messaging chat communications, such as Telegram. 

Here is a conversation mentioning the riots and the specific channel on Telegram – @BLMprotests. 

 

And here is a chat from that  Telegram channel found in Webhose’s Cyber API labeled Strike Force #BLM.” The chat announced a riot in Minneapolis in the early morning of May 26, the day after the murder, and seen a total of 2.7K times. 

Some posts even state specifically that the demonstration will take place in Minneapolis at the intersection where the murder took place:   

Here is another message in June 2nd referring to an anonymous poster in Washington DC: 

By continuously monitoring dark web activity in addition to activity in messaging applications, LEA could have been better prepared for these riots. 

Extremist and Racist Posts Increase in Times of Unrest

It’s not just posts from people looking to start riots that we see on the dark web during these times of civil unrest. Right-wing extremists take advantage of these times to post extremist language more frequently. Webhose’s dark web data has seen a significant increase in the number of posts with extremist and racist language in the days after Floyd’s murder, rising by 80% the day after Floyd’s death, spiking at 458% on June 1st and by 1020% on June 2 before trending downwards again (but still higher than the May 24th number). These spikes may be correlated with Floyd’s death being officially ruled a homicide and President Trump’s threat to bring in the national guard to help bring the violent protests under control.

Want to learn more about how to monitor dark web data with Webhose’s Cyber API? Schedule a call with our data experts today!