By  Nora Beauvais

This is the OECD’s fourth benchmarking report examining the policies and procedures related to terrorist and violent extremist content (TVEC) online, with a focus on transparency reporting, of the world’s top 50 most popular online content-sharing services (the “popular services”). Like the third edition, this report also covers the 50 online content-sharing services that terrorist and violent extremist groups and their supporters exploit or rely upon the most (the “intensive services”). The first three reports provided a benchmark against which this fourth report assesses relevant developments. Terrorist and violent extremist actors continually adapt their methods to technological developments. As governments and online platforms increasingly take measures to curb the dissemination of TVEC, terrorists and violent extremists make adjustments to avoid content moderation. On mainstream online platforms, for example, they have been developing tactics to evade automated detection tools. Meanwhile, sustained efforts by large platforms to combat TVEC have also caused a “displacement effect” whereby terrorists and violent extremists turn to alternatives (e.g. cloud platform websites, decentralised web technology, niche alt-platforms, and terrorist-operated websites). Transparency reporting on TVEC online is crucial to assess the evolution and magnitude of the threat, evaluate the effectiveness and efficiency of online platforms’ policies and actions to tackle this problem, as well as their impact on human rights, and build an evidence base to support policymaking and regulatory frameworks. The key findings of this report are: 1. The popular and intensive services are more diverse, both ideologically and geographically. The TVEC landscape is multi-faceted, encompassing a wide range of ideologies, from terrorist groups to violent extremist political movements and lone actors, and it is spreading across different types of contentsharing services and geographical regions. For the first time in this report series, the popular services’ list includes a gaming service. This is noteworthy because gaming services are increasingly used by terrorist and violent extremist actors. In addition, three Indian platforms have joined this ranking. As for the intensive services’ list, it features a self-proclaimed anarchist website for the first time and covers a wider spectrum of geographic regions and languages.2. Overlap between the popular and intensive services remains low, highlighting the need to look at the TVEC landscape more comprehensively. Only ten services appear on both the popular and intensive lists, compared to 11 in the third benchmarking report. However, many policy discussions and responses still tend to focus on the largest platforms. Paired with the finding that the intensive services tend to be less transparent than the popular services (see below), the takeaway is that neglecting smaller but intensive services risks under-scrutinising or even turning a blind eye to a core part of the problem.3. The evidence shows mixed results regarding the clarity of the popular services popular services’ definitions of TVEC, while most of the intensive services’ still do not define or even expressly prohibit TVEC. On the one hand, the definitions related to TVEC in the popular services’ policies and procedures are, overall, clearer than in the previous report. Services are using more comprehensive descriptions of TVEC and related concepts, but new gaps among the services’ approaches have emerged, with a proportion of them still using vague terminology (18%) or having become less precise. On the other hand, 60% of the intensive services still do not define or explicitly prohibit TVEC, or they simply have not established any governing documents. 4. Transparency reporting on TVEC reveals new gaps among popular services and remains rare among intensive services. Seventeen of the popular services now issue transparency reports with specific information on TVEC, as compared to just five in the first edition, 11 in the second, and 15 in the third of this series. This represents the slowest year-to-year growth rate to date. For the first time in the series, one of the services (present on both the popular and the intensive services lists) that previously issued transparency reports with TVECspecific information ceased this practice. In addition, three of the four newest Services to issue transparency reports on TVEC provide very limited information, both quantitatively and qualitatively. Furthermore, there is still significant heterogeneity among the popular services’ reporting approaches, which continues to make data aggregation and cross-platform comparisons difficult, if not impossible. Among the intensive services, only six issue transparency reports on their policies and actions concerning TVEC, against 8 previously, and the vast majority (5 of 6) also appear in the popular services list. The scarcity in transparency reporting on TVEC among the intensive services may be explained by the fact that many of them are operated by terrorist and violent extremist groups and supporters, or by free speech “absolutists” who deliberately let TVEC flourish on their platforms. 5. Content moderation approaches continue to pose risks for privacy, freedom of expression and due process. Continuing a trend that began during the COVID-19 pandemic, popular services rely more heavily on automated tools to detect and remove TVEC, which has generally increased the removal of lawful content and unjustified censorship. Furthermore, half of the intensive services remain opaque regarding their approaches to content moderation; and most of them either have no notifications and appeal mechanisms in place, or do not provide any information in this regard. This raises questions regarding their efforts to ensure the respect of privacy, freedom of expression and due process.6. New online safety laws and regulations are creating an increasingly fragmented transparency reporting landscape. As new online safety laws and regulations come into force, content-sharing services are facing new obligations to issue transparency reports in multiple jurisdictions, and they face different reporting requirements in each of them. To conclude, this report highlights the need for more precision in the Services’ governing documents; more consistency in the metrics and methodologies used to prepare transparency reports; more transparency in their content moderation approaches; and more efforts to ensure due process and to safeguard human rights and fundamental freedoms.

By Bàrbara Molas

The word “doxing” (sometimes “doxxing”) is made up of the words “dropping dox” whereby dox, an abbreviation of the word “document”, refers to personal information (Strandell, 2024). Doxing, or revealing personal information in the online public space with the general intent of causing harm, is increasingly being used in modern armed conflicts. For example, Ukraine’s military has released private information of over 100,000 Russian soldiers, including alleged war criminals and FSB officials, in multiple doxing campaigns (Jensen and Watts, 2022). On the other hand, hackers from Russian hacker group RaHDit have published data on more than 3,000 Ukrainian Armed Forces mercenaries (Rossa Primavera, 27 July 2024), in addition to leaking information on 7,700 Azov soldiers (Al Mayadeen, 28 August 2024). Another group of Russian hackers, EvilWeb, leaked data from Ukraine’s Security Service (SBU), including IP addresses, emails, and encryption keys of SBU employees (URA, 29 September 2024). Finally, members of the Russian hacker project “NemeZida” revealed the identities of 800 Ukrainian Armed Forces soldiers who participated in the attack on the Kursk region, including representatives of the 82nd Airborne Assault Brigade, the 61st Mechanized Brigade of the Ukrainian Armed Forces, as well as about 200 foreign mercenaries from Israel, Armenia, Georgia, Kazakhstan, and Syria (URA, 29 September 2024). In a non-conflict environment, doxing may serve the purpose of extorting, silencing, controlling, or serving the public interest (Snyder 2017, p. 438; Anderson 2021, pp. 208-9; Li 2023, p. 368). In short, the role of doxing in today’s strategies to gain or retain power over enemy actors or rival factions is prominent and more relevant than ever before. This raises questions over the nature and legitimacy of doxing, including what (and who) exactly is that doxing involves, what makes a particular case of doxing ethically acceptable, or whether the practice should be seen as a crime or as a means for anti-repression activism.In order to shed light upon such questions, this literature review provides findings on academic discussions around doxing, from its conceptual or theoretical understanding to its real-life forms and implications. It does so by assessing a total of 17 peer-reviewed research papers published in the time span of 10 years (2014-2024). The contributions include approaches to the subject by scholars from the Social Sciences, the Data Sciences, and Public Health, located across North America, Europe, and Asia. Selecting the material involved open-source methodology (OSINT), with keywords including both scholarly and culturally sensitive vocabulary, especially in relation to state surveillance and the misuse of data sharing. For example, “dox” AND “antidox”, “doxing” AND “legal”, “doxing” AND “vigilantism”, or “doxing” OR “doxed” AND “security” as well as “doxing” AND “malicious” retrieved relevant sources. Due to part of the academic discussion on doxing being morality-based, namely whether it is “good” or “bad”, which is an inherently subjective assessment, research contributions were not disregarded based on their moral assessment, thereby allowing for this review to be nuanced and whole-encompassing. As a way to complement scholarly contributions with some preliminary data on the subject of doxing, the discussion following the literature summary includes data from semi-structured interviews with individuals who have been, or are, victims of doxing. In particular, such conversations took place with combatants, humanitarian workers, and journalists active in conflict zones, specifically in Ukraine. The incorporation of real and direct testimonies to doxing allows for a more nuanced grasp of the nature and impact of the practice, and helps fill out some gaps found in the literature, namely state-sponsored and/or state-supported doxing in the context of war. Indeed, among the existing literature, the only scholars that address the subject of doxing and conflict are Jensen and Watts from Brigham Young University and the United States Military Academy, respectively. While their work illustrates the use of doxing on enemy soldiers, it does  so focusing solely on Ukraine’s current tactics against Russian soldiers. This analysis contributes to such work by adding evidence on pro-Russia combatants’ doxing tactics against pro-Ukraine individuals in the area and abroad. This literature review contains a summary of findings, which includes a chronological content analysis of the scholarly contributions to the subject together with data from the above-mentioned interviews. Such an analysis is followed by a brief discussion, designed to stress points of agreement and disagreement between the authors, namely around conceptual approaches to doxing, its ethical use, and its legality. It ends with a conclusion section synthesising the results of the literature review and highlighting where our project, “Anti-Dox: Identifying, Evaluating, and Countering Disinformation in Times of War”, hopes to contribute to current debates on the subject. Ultimately, this analysis aims to situate the project into an evidence-based conversation in which doxing is considered a form of harmful information spread, characterised by actors employing manipulation tactics to advance political, military, or commercial goals.

By Mia Doolan,  Katie Cox,  Kiran M. Sarma

This is the protocol for a Campbell Systematic Review. This review will address two aims: (1) A qualitative synthesis ofliterature on the composition of online far right propaganda, and (2) A quantitative synthesis of literature examining the impactof exposure to online far‐right propaganda on audiences. These syntheses will be guided by the following specific objectives: (i)What is the content (i.e. themes) of online far‐right propaganda, and how does this differ across ideological subgroups? (ii) What is the structure of online far‐right propaganda, and how does this differ across ideological subgroups? (iii) What is the context ofthese messages (i.e., where, when and by whom were they posted?) (iv) What impact does exposure to online far‐rightpropaganda have on audiences with reference to the radicalisation of opinion and/or action.

Campbell Systematic Reviews Volume 21, Issue 4 Dec 2025

By Bibi van Ginkel, Tanya Mehra, Merlina Herbach, Julian Lanchès, and Yael Boerma

This study examines a pressing and highly topical challenge: how to assess online content that may undermine democracy, threaten national security and public safety, or infringe upon the rights of others—while safeguarding freedom of expression. The central question it explores, the specific challenges identified, and the recommendations it puts forward should not be viewed in a vacuum. Rather, they are situated within a broader and increasingly complex societal and political context. A range of systemic developments shapes the environment in which this work takes place: the rise of online radicalisation, particularly among children and young adults; the expanding influence of large technology platforms and the tensions this creates with rule-of-law-based democratic societies leading to a global trend toward both techno-libertarianism and techno-authoritarianism; and the evolving role of governments as they seek to reconcile the imperatives of security, safety, and national interest with those of privacy, human rights, and minority protection. These challenges are compounded by the unprecedented speed and scale of online information dissemination, growing concerns about disinformation and foreign influence, and the urgent need to strengthen societal resilience and media literacy. While this study does not address each of these systemic issues in depth, they form the essential backdrop against which its findings and proposals should be understood.

The Hague: The International Centre for Counter-Terrorism (ICCT), 2025. 208p.

By Rohan Gunaratna

SYNOPSIS
In 2026, intensified geopolitical competition and rivalries will influence and shape the global threat environment. In parallel, non-state armed groups driven by religious, ethnic, and hard-line ideologies will threaten both governments and social harmony in various countries around the world.

S. Rajaratnam School of International Studies, NTU Singapore. 2025.

By Dmytro Bukhanevych, Rayan Succar, Maurizio Porfiri

Social media platforms have become a key tool for politicians to signal their policy positions and communicate about issues that are salient to them and their constituency. One such issue is gun violence. Grounded in framing and issue-attention cycle theories, this paper analyzes the response of members of the United States (US) Congress to mass shootings on social media. We analyzed 785,881 gun-related tweets from members of the 117th US Congress on X (formerly Twitter) between January 2021 and January 2023. We used logistic regression to model the main effects, implemented the PCMCI+ algorithm for causal discovery, and applied latent Dirichlet allocation topic modeling to evaluate the substantive differences between gun-related tweets from the two parties. Higher fatality counts were positively correlated with the probability of gun-related tweets by Congress members (OR=1.13, 95% CI=[1.12, 1.15], p < 0.001). A causal link was detected between mass shootings and subsequent legislators’ activity on X (ρ=0.122, p=0.001). Democrats were more likely to tweet about guns following mass shootings than Republicans (OR=3.60, 95% CI=[3.03, 4.28], p < 0.001), with qualitative differences in tweet substance between parties (community, families, victims, and mass shootings themselves are recurrent topics for Democrats, while Second Amendment rights and crime are frequent for Republicans). The paper suggests that while mass shootings elevate the level of discussion on guns in Congress, they trigger different reactions depending on party affiliation. Congress members tend to focus on topics aligned with party issues, likely reducing the opportunity for policy-making alignmen

PLOS Global Public Health, Dec. 2025.

By Joshua Hochman

 In New York State Rifle & Pistol Association v. Bruen, the Supreme Court reaffirmed that laws prohibiting the carrying of firearms in sensitive places were presumptively constitutional. Since Bruen, several states and the District of Columbia have defended their sensitive-place laws by analogizing to historical statutes regulating firearms in other places, like schools and government buildings. Many judges, scholars, and litigants appear to have assumed that only statutescan count as evidence of the nation’s historical tradition of firearm regulation. This Note is the first expansive account since Bruen to challenge this assumption. It argues that courts should consider sources of analogical precedent outside of statutory lawmaking when applying the Court’s Second Amendment jurisprudence. Taking public transportation as a case study, the Note surveys rules and regulations promulgated by railroad corporations in the nineteenth century and argues that these sources reveal a historical tradition of regulating firearm carriage on public transportation. Bruen permits courts to engage in more nuanced analogical reasoning when dealing with unprecedented concerns or dramatic changes. One such change is the shift in state capacity that has placed sites that were privately or quasi-publicly operated before the twentieth century under public control in the twenty-first century. As in the case of schools, which the Court has already deemed sensitive, a substantial portion of the nation’s transportation infrastructure in the nineteenth century was not entirely publicly owned and operated. For this reason, courts should consider evidence of historical firearm regulations enacted not just by legislatures but by quasi-public or private corporations. This case study instructs that courts and litigants can best honor Bruen’s history-based test by considering all of the nation’s history of firearm regulation.

Yale Law Review,  133:1676 2024

By Shani Buggs, Sheyla Delgado, Jocelyn Fontaine, Stephanie Hawkins, Talib Hudson, Tanya Sharpe

This report makes the case for the importance of more equitable and community-engaged research to address gun violence and the need to invest in and grow the field of Black, Brown, and historically underrepresented scholars committed to centering equity in the research process.

By The Justice Collaboratory, Yale Law School

The primary goal of this project was to explore how gun violence prevention work impacts individuals considered at high risk of being directly impacted by gun violence. The current study aimed to elevate the voices of gun violence prevention program participants and impacted communities who can best attest to the influence and power of the message and services received. Gun Violence Prevention Models and Projects The Group Violence Intervention (GVI) model used in this work is a focused-deterrence strategy that targets groups of people at high risk of gun violence. GVI is facilitated by law enforcement agencies that identify individuals who are associated with or members of groups responsible for shootings. These individuals receive an anti-violence message from law enforcement agencies partnered with community representatives and social services providers. In New Haven, CT, Project Safe Neighborhoods (2002) and Project Longevity (2012) are current initiatives modeled after the GVI strategy. Cure Violence is a public health approach to address violence as a disease to be treated by violence interrupters in the community that mediate conflicts. One prominent community-based organization that modeled the Cure Violence Approach in New Haven, CT is Connecticut Violence Intervention Program (CTVIP). The Community Perspective Numerous evaluations across the nation highlight the success of the GVI and Cure Violence programs. However, many of these policy evaluations do not include the perspectives of the people closest to the problem and they also fall short of addressing the complexities and concurrent, environmental factors underlying participation within GVI initiatives. To this end, the current study explored how individuals at high risk of gun violence benefit from gun violence prevention services whether simultaneously participating in a GVI strategy or not. The current study emphasized why the field of gun violence prevention policy needs studies that are designed to elucidate the critical components of such programs from the community perspective, with results that show that the theory of change accurately represents the impact mechanisms at work on the ground. This project, therefore, proposed an exploratory, qualitative study of initiatives to address gun violence in New Haven, CT. The goal was to explore how gun violence prevention work impacts individuals considered at high risk of being perpetrators or victims of gun violence. 

New Haven, CT: Justice Collaboratory, Yale Law School, 2025. 49p.

By Sofia Molina, Andrei Serbin Pont

The enduring proliferation of illicit Small Arms and Light Weapons (SALW) remains a critical factor in the security and stability challenges facing Latin America. These armaments fuel organized crime, exacerbate violence, and empower non-state armed actors, thereby undermining governance and public safety. The foundational analysis presented by Andrei Serbin Pont and Alex Miller in the "Small Arms and Light Weapons Black Markets in Latin America" story map established a comprehensive framework for understanding these dynamics (Serbin Pont & Miller, 2022). This report builds upon that essential work, leveraging a new database of open-source seizure incidents to provide a current and granular update on the state of the illicit arms market.

The data analyzed, derived from police operations and journalistic reports compiled in the SALW dashboard from Brazil, Argentina, Panama, and Guatemala, reveals a market that is not only robust but also increasingly sophisticated and adaptive. A rigorous examination of the new dataset uncovers two significant phenomena that represent an evolution in the illicit arms trade. First, there is a proliferation of fake Colt markings on assault rifles. Second, the presence of other specific markings such as the "Punisher" skull, on seized firearms introduces another layer of analysis, indicating that weapons are not merely tools of violence but are also powerful symbols of criminal identity and ideology.

Miami: Florida International University, 2025. 9p.

By Leslie M. Barnard , Wei Perng ,, Ashley Brooks-Russell,, Talia L. Spark,

Background: Firearms are the most common and lethal method of suicide. Previous studies showed that households with firearms have a higher risk of suicide. It is unclear whether this is due to higher underlying risk of suicide among groups who have firearms or those who store their firearms securely. Methods: This cross-sectional analysis used Colorado Behavioral Risk Factor Surveillance System data from the period 2020–2022, which is weighted to represent the Colorado population. We used survey-weighted Poisson regression to calculate adjusted prevalence ratios (aPR) for associations of selected suicide risk factors (depressive disorder, excessive alcohol use, poor mental health, poor physical health) with firearm presence and storage practices. Results: One-third (36.5%; 95% CI: 35.8–37.7) of respondents said that they kept at least one firearm in/around their home; of those, 15.0% (95% CI 13.8–16.2) said at least one firearm was loaded and unlocked. Overall, 13.7% (95% CI 13.0–14.4) of adult Colorado residents reported poor mental health, 9.5% (95% CI 8.9–10.0) reported poor physical health, 20.4% (95% CI 19.6–21.2) reported a depressive disorder, and 30.5% (95% CI 29.4–31.7) reported excessive alcohol use. Only excessive alcohol use was more common among those keeping a firearm in/around the home compared to those not doing so (aPR 1.09 [95% CI 1.01–1.17]), and none were associated with unsecure firearm storage. Conclusions: These findings suggest that the association between household firearms and suicide is not explained by an increase in suicidality among those with firearms but rather may be explained by the presence or unsecure storage of a firearm.

2025, Academia Mental Health and Well-Being Volume 2; Issue 4

By The Council of Europe

Although the misuse of new technologies by terrorist actors has been a major concern for some time, the capabilities offered by (and the availability of) a range of new and emerging technologies – including gaming platforms, unmanned aerial systems (UAS), artificial intelligence (AI) and 3D-printed weapons – have heightened these fears even further. An analysis of how and why terrorists adopt new technologies suggests that it remains highly context specific, with the extent and speed of innovation affected by internal factors (for example strategic, structural and individual factors) and external factors, particularly relationships, resources and the effects of counter-terrorism. In combination, these factors can encourage or inhibit the adoption of new technologies by terrorist actors, resulting in significant variations in the adoption and use of key technologies of concern. Terrorist actors in or affecting Europe have adopted (or are beginning to adopt) many of these technologies. Social media platforms, small or micro platforms, terrorist-hosted websites and gaming or gaming-adjacent platforms are all playing critical roles in the radicalisation and recruitment process. Emerging technologies used in this process include the decentralised web, the dark web and, most recently, generative AI. Although many terrorist attacks in Europe use a low-tech modus operandi, technology plays a key role in their preparation, planning and subsequent promotion. Propaganda and instructional material – typically stored and shared online – play a prominent role in shaping attack targets and methodology. For example, the emergence of 3D-printed weapon usage by terrorist actors in Europe has been fuelled by instructional materials developed by an active online subculture. Other far-right online subcultures have also encouraged the live-streaming of attacks and sharing of manifestos online. Terrorist actors in Europe use a range of licit and illicit activities to fund their attacks and radicalisation and recruitment activities, some of which (but not all) require the use of new technologies. These include mobile payment systems, online exchanges and wallets, crowdfunding, peer-to-peer online funds transfers and the solicitation of donations on social media platforms. Simultaneously, terrorist actors outside Europe, notably ISIL (Islamic State of Iraq and the Levant)/Daesh, are increasingly encouraging donations via virtual assets, driving a rise in the presence of virtual assets in European terrorist financing arrests and prosecutions. Interviews with national, regional and international experts identified lessons learned and good practices when responding to terrorist misuse of new technologies. These include reducing the lag between terrorist exploitation of new technologies and counter-terrorism responses to it (through horizon scanning exercises and greater information sharing), the criticality of multistakeholder approaches, the importance of identifying and managing human rights-related risks, and the benefits of greater strategic clarity, which can lead to a focus on desired outcomes, rather than the steps required to reach them

By Renushka Madarie, Marleen Weulen Kranenbarg&Christianne de Poot

Previous quantitative studies applying Routine Activity Theory (RAT) to cybercrime victimization produced mixed results. Through semi-structured interviews with cybersecurity experts, the current study aims to qualitatively reevaluate the applicability of RAT to cyber-dependent crime, specifically data theft from organizations. An in-depth assessment of environmental factors appearing to affect data thieves’ actions resulted in concrete operationalizations of theoretical concepts. Importantly, we highlight the distinction between target selection and strategic choices made during the attack. Furthermore, RAT appeared to be as relevant, if not more, for explaining offender actions during an attack as for the initial convergence of offenders and digital targets.

DEVIANT BEHAVIOR 2025

By Stibbe, D., Ruiter, S., Steenbeek, W., & Moneva, A.

This online field experiment tested how risk and reward cues in (fake) account credential ads on a hacker forum influence target selection for account hijacking. High-risk posts, warning of account monitoring, received fewer views, while high-reward posts, promising benefits, attracted more. An unexpected law enforcement operation targeting an illicit marketplace created a natural experiment, triggering increased removals of high-risk posts by forum administrators, which slowed over time. These findings suggest hacker forum users respond rationally to risk and reward cues in target selection, and forum administrators adapt their moderation efforts in response to external threats to reduce perceived risk.

DEVIANT BEHAVIOR 2025, VOL. 46, NO. 9, 1172–1193

By Daniella J. Ferrante & Thomas J. Holt

There is little research considering the ways that local events in physical space trigger responses from ideological groups in online spaces. This study attempted to address this gap in the literature through the analysis of information from the Extremist Cybercrime Database (ECCD), a unique open-source repository of cyberattacks performed against U.S. targets from 1998to 2020. This qualitative study focused on the language used during cyber-attacks against police agencies by the hacker collective Anonymous.Evidence suggested that the attackers’ language reflected values observed in the hacker subculture to justify their attacks and incorporated negative language regarding law enforcement. This was particularly evident in cases of police excessive use of force against minority groups and emphasized theneed for public protest and social change.
DEVIANT BEHAVIOR 2025, VOL. 46, NO. 9, 1125–1

 By Marco Romagna & Rutger Erik Leukfeldt  

  Hacktivism represents the promotion in the cyber landscape of ideologically motivated agendas using hacking techniques. Despite research on the topic has provided some clues on how hacktivist networks develop, the processes behind their evolution remain mostly unknown. This gap in the literature prompted us to research the role of online/offline social relationships and of the offender convergence settings in the creation, recruitment process and development of hacktivist networks. This study is based on 30 interviews with hacktivists, and it uses the social opportunity structures framework to analyze the development of 21 hacktivist networks. The results show that said networks can be divided in sub-categories based on the type of connections used to create them. Online social relationships and online convergence settings (particularly social media platforms and IRC channels) seem to play a key role in the development of hacktivist networks, while offline contacts are limited. For the recruitment process, hacktivists use comparable strategies to any organization, but three different categories were identified when discussing

VICTIMS & OFFENDERS Published online: 01 Jul 2024

By Marco Romagna & Rutger E. Leukfeldt

Hacktivism is a rising phenomenon in the cyber landscape combining elements of the hacking subculture with ideologically motivated agendas inspired both by traditional activism and by new elements of the digital culture. Despite several studies on the topic, it is still not completely clear what motivates an individual to engage in this type of collective action and if the reasons can be compared to what is already known for more traditional forms of social protests. Taking a socio-psychological approach, this study uses the social identity model of collective action (SIMCA) as a theoretical lens to analyze hacktivists’ motives and engagement process. The analysis is based on 28 semi-structured interviews, and it considers the four main elements of the model, naming: morality, social identity, perceived injustice and perceived efficacy. The violation of moral values seems to be the main trigger to participate in the action, while social identity plays an important role both as the second step in the engagement process and as a bridge with the other elements of the model. The results seem to be in line with what is already known for other forms of social protests, although some elements of the model provide new means of interpretation.

JOURNAL OF CRIME AND JUSTICE 2024, VOL. 47, NO. 4, 511–529

By Marco Romagna & Eric Rutger Leukfeldt

The organizational aspects of hacktivist networks are seldom studied, with research mainly focused on exploratory and descriptive case studies. To narrow the gap, we have used the sociological model for the social organization of deviants developed by Best and Luckenbill (1994). Said model illustrates how hacktivist networks are organized and contributes to a clear-cut categorization useful when dealing with hacktivism. Our study uses a rich dataset obtained from 32 semi-structured qualitative interviews conducted within 23 different networks. By expanding on past research on cybercriminal and hacktivist networks, the results show that hacktivists operate at varying levels of sophistication, favoring small, well-organized teams where roles and tasks are clearly divided. While there are differences among networks, our analysis reveals the importance of individual actions within larger operations: being affiliated with like-minded people, the existence of internal rules, and the importance of hacking skills to determine, if not hierarchies, then who is the most influential. Most of the networks analyzed were classified as “peers” or “teams,” although the landscape shows considerable heterogeneity. Compared to other cybercriminal networks, hacktivists seem to have lower level of sophistication, while embracing the hacking subculture that places importance on the role of the individual within the network.
DEVIANT BEHAVIOR 2025, VOL. 46, NO. 9, 1104–1124

By   Eugenio Benincasa

Recent revelations of Chinese government-backed hacking show a recurring pattern: prominent hackers behind groups such as APT17, APT27, APT41, Flax Typhoon, and Red Hotel—monikers given by cybersecurity researchers for groups with similar tactics—trace their roots to a broader community of early elite hackers, known as “red hackers” or “Honkers” (红客, Hong Ke). Active in online forums during the mid-1990s and 2000s, these hackers operated independently but often aligned with state interests, targeting foreign entities perceived as hostile to China, including the US, Taiwan, and Japan. The author’s analysis builds upon prior research into China’s red hacker groups.

Center for Security Studies (CSS), ETH Zürich . 2025. 74p.

Aims

This review seeks to synthesise existing research on transnational mechanisms and processes to provide insights into the factors that shape protest-extremism dynamics to address the following primary research questions::

1. What increases the vulnerability of protest mobilisations to transnational actors (states, violent movements, individuals) promoting violence across borders?

2. What factors constrain the potential for violence, radicalisation, and terrorism in transnational social movements/ mobilisations?

3. Under what conditions do alliances between social movements and international actors lead to an increased potential for violence? What characteristics of both types of actors contribute to this dynamic?

4. What are the mechanisms of influence between transnational and local protest mobilisations?

Methodology 

This research uses a rapid evidence assessment (REA) approach, synthesising knowledge on specific topics in line with the research questions from published journal articles, book chapters, reports, and dissertations, including both academic and “grey” literature (e.g., government and think tank reports).

The REA adopted a streamlined methodology using keyword searches of major social science databases, after which identified documents were screened for inclusion based on pre-determined eligibility criteria.

Key findings 

The literature on both transnational protests and transnational interactions with local movements or protests does not significantly differ from the core findings of the previous two Rapid Evidence Assessments in this series which focused on social movement insights into violent protests (Salman, Marsden, Lewis, 2025) and interdisciplinary research into individual-level processes that shape radicalisation and violence related to protests (Peterscheck, Marsden & Salman, 2025). Earlier findings that remain highly relevant to transnational processes include:

• Movement schism and fragmentation may increase potential for violence.

• Exposure to misinformation influences protest dynamics in ways which can increase the danger of violent escalation.

• The potential for counter-messaging to be counter-productive by producing unintended effects like reinforcing commitment to pre-existing positions, enhancing grievances like perceived discrimination, and reinforcing identities.

• Digital platforms play a role in forging collective identities, including or especially transnational ones.

• Fringe political movements are associated with increased acceptance of political violence.

• Identity fusion, especially in relation to perceived threats against a group, increases the salience of group identity and individual commitment to actions in support or defence of the group, even at cost to the individual.

• Perceptions of existential threats, discrimination, collective angst, and shared grievances can intensify group identity.

The social movement literature has developed a significant body of work on transnational movements. The key insights from the social movement and interdisciplinary literature on violence and protests also help to interpret cross-border influences. Transnational perspectives primarily add another layer of interaction, mutual influence, and opportunities for resource sharing and mobilisation. However, the mediating factors that influence contemporary social movement mobilisations, including new technology and the role of social media and their influence on violence have received less attention. This is particularly the case when violence is informed by local events and dynamics, but is influenced by transnational actors and processes. This suggests a broader gap to be filled by future research on the questions outlined in this report. 

London: CREST, The Centre for Research and Evidence on Security Threats , 2025. 48p.