By Aleksandar Srbinovski | Trpe Stojanovski

Ever since Russia’s full-scale invasion of Ukraine, there has been concern that the conflict may act as a source of illegal arms flows into Europe, following the pattern of the Balkan conflicts in the 1990s. To be sure, the risk is significant. The conflict in Ukraine is the most protracted mechanized war in Europe since the Second World War, and materiel of all descriptions has flooded into the battlefield. There are now millions of unregistered weapons circulating in civilian Ukraine, many of which are trophy weapons collected from the battlefield, and the situation is similar in Russia, which has seen a spike in gun-related violence in regions adjoining the occupied territories.1 The prospect of these weapons falling into the hands of organized criminals in Europe and beyond is a major risk to countries’ internal security. But with this heightened attention there is a danger of tunnel vision. The conflict in Ukraine is only one risk among many. The illicit firearms market in Europe is diverse, with multiple sources, paths to market and types of weaponry for sale; from Soviet-era stockpiles to cutting-edge 3D-printed guns. This report maps out the illicit firearms dynamics in three countries to the south-east of Europe – gateways for illicit weapons into the EU and elsewhere but which have distinct ecosystems in their own right – Türkiye, Greece and Bulgaria. For organized crime, these three countries serve multiple purposes: transit routes, consumer markets and points of origin for a variety of illicit flows along the so-called ‘Balkan route’. In recent decades, the flow of illicit drugs (particularly heroin) and migrants through these countries has dominated global headlines, especially in light of the conflicts in Afghanistan, Syria and Iraq. But the movement of illegal firearms – and their threat to Europe – has been little discussed in comparison. The one exception is the issue of gas guns originating from Türkiye, which have grown in popularity among criminals in Europe because they are cheap and low risk to transport as legal unconverted weapons.2 Close to the point of sale they can be converted into lethal firearms. But as this report makes clear, converted gas and blank guns are just one issue among many in the region, each with their own criminal dynamics. This report considers the illicit arms markets of each country and how they are interconnected. This analysis is intended to complement two previous reports, ‘Smoke on the horizon’, which described trends in arms trafficking in Ukraine and assessed the marketplace for illicit weapons in Europe, and ‘Tomorrow’s fire’, which mapped how arms trafficking in Europe may develop depending on the outcome of the Ukraine conflict.3 Taken together, these three reports provide a holistic view of how the European illicit firearms market interacts with its south-eastern flank, and how it may evolve in the future. This report highlights how complex the illicit arms markets are in Bulgaria, Greece and Türkiye, and the cultural, criminal and political factors that must be taken into consideration in assessing the risk. It also spotlights the responses that these countries have formulated, including through international forums and joint operations. Finally, the report offers a series of recommendations that aim to integrate analysis of the region into the broader picture of European threats.

Geneva: Rhw Global Initiative Against Transnational Organized Crime (GI-TOC) 2025. 49p.

By NADINE SALMAN , SARAH MARSDEN , JAMES LEWIS

This report synthesises and critically analyses the existing research that has considered whether and how political contention and protest relate to radicalisation and terrorism. It draws on social movement theory perspectives to provide insights into what informs group and mass radicalisation and what constrains them, and what impact state responses have. AIMS This review seeks to address the following primary research questions: 1. What factors, features, or events are linked to violence, radicalisation, and terrorism in social movements? 2. What factors, features, or events constrain the potential for violence, radicalisation, and terrorism in social movements? 3. What are the mechanisms that help explain what facilitates or constrains opportunities for violence in social movements? 4. How do different state and policing responses affect the potential for violence and extremism in social movements? METHODOLOGY This research adopts a rapid evidence assessment (REA) approach, synthesising knowledge on specific topics in line with the research questions from KEY FINDINGS This REA identifies several potential drivers for violent and extremist escalation within social movements, as well as potential factors for de-escalation. The literature reviewed highlights the complex and interacting nature of movement characteristics, mobilisation contexts, and the influence of external actors, namely countermovements and state responses. Key findings identified in this review are summarised in a table for each major section, loosely based on the EMMIE framework for evidence relating to crime prevention interventions (Johnson et al., 2015). The EMMIE framework summarises the overall effect, direction, and strength of the evidence;1 the mechanisms or mediators it activates; relevant moderators or contexts, including unintended effects; implementation considerations; and economic costs/benefits (Johnson et al., 2015). Since the findings of this review are not solely concerned with interventions, the latter two considerations are not summarised here. These tables therefore highlight the factors identified, their overall effects on violence and/or extremism, any identified mechanisms and/or moderators, and the strength of the evidence from the literature base. Movements are informed by their socio-historical contexts and internal dynamics, the factors set out in the tables therefore represent general trends in the research rather than firm indicators of movement behaviour. The effects identified below should not, therefore, be interpreted as suggesting a direct causal relationship between a given factor and the likelihood of violence/ extremism, but instead as evidence of how these factors have impacted the dynamics within certain contexts and mobilisations. MOVEMENT CHARACTERISTICS Different movement characteristics, including factors relating to movement structure, resources, and composition, as well as ideological factors, may contribute to an increased potential for engaging in or rejecting violence. Understanding the characteristics of a given movement is therefore an important first step when understanding how and why violence is produced.

Department of Psychology, Lancaster University, Lancaster, LA1 4YF, UK.The Centre for Research and Evidence on Security Threats (CREST), 2025. 44p.

By Aileen van Leeuwen and Amy-Jane Gielen

Executive Summary The Dutch National Training Institute against Radicalisation (Rijksopleidingsinstituut tegengaan Radicalisering, ROR) offers a broad range of training programmes on radicalisation and extremism for first- and second-line professionals from various sectors who may encounter these phenomena in their work. The one-day introductory training is the most frequently delivered course, with over one hundred sessions held in 2023. To assess the introductory training’s longer-term impact (six months after completion), the ROR commissioned an independent impact evaluation by the International Centre for CounterTerrorism (ICCT). The evaluation targeted all participants – first- and second-line professionals from various fields – who attended ROR’s introductory training between 14 November and 21 December 2023. The final report was delivered in August 2024. The design of the impact evaluation was based on the Kirkpatrick evaluation model, which provides a framework for measuring training outcomes. Additionally, a results monitoring framework was created to provide an overview of the intended outcomes, relevant indicators for tracking change over time, the methods used to collect data for each indicator, and the frequency of data collection. The evaluation employed a mixed methods approach, combining qualitative as well as quantitative indicators and research methods. The evaluation included three measurement points: a baseline prior to the training, a post-training measurement immediately after, and a follow-up conducted six months later. Three rounds of surveys were administered (N=235, N=221, N=88), followed by interviews with former participants six months after the training (N=8). In addition, two training sessions were observed, a focus group was held with stakeholders from the ROR and the National Coordinator for Security and Counterterrorism (NCTV), and a document analysis was carried out by the research team. Based on this data, the evaluation was able to answer the three key research questions guiding the study. 1. What is the expected and actual impact of the ROR introductory training on participants’ foundational knowledge, perceived ability to respond to signs of radicalisation and extremism, and intention to embed knowledge within their own organisations in the longer term (6 months)? Overall, the impact evaluation shows highly positive results, indicating that expectations and learning objectives were largely met for the majority of participants. At the end of the training, 90 percent of participants reported that the course met or exceeded their expectations. Only a small minority found the training either too basic – due to extensive prior knowledge – or difficult to follow because they struggled to connect it to their daily work. Foundational knowledge Both the ROR and the participants expected the training to strengthen participants’ foundational knowledge of radicalisation and extremism. The results strongly support this. • Firstly, the findings confirm that the training reached the right target audience – namely, professionals who are not yet experts on radicalisation and extremism and have had limited prior exposure to these topics. • Secondly, the content of the training was well-aligned with participants’ knowledge levels: those with limited prior understanding found it accessible, while those with more background also gained new insights. Participants reported a better grasp of the complexity of the topic, more practical tools, and a more nuanced understanding of radicalisation. • Thirdly, a statistically significant increase in knowledge was observed among participants, which was sustained after six months. The comparative analysis revealed that participants from the security domain with a secondary vocational education background (the Dutch so-called MBO-level) had the lowest baseline knowledge and experienced the most difficulty engaging with the content. This underscores the need for tailored approaches by trainers to better match participants’ prior knowledge and learning needs. While this customisation improves accessibility, it may lead to slight variations in training delivery and, ultimately, in participants’ knowledge outcomes.

The Hague: The International Centre for Counter-Terrorism (ICCT) , 2025. 9p.

By Méryl Demuynck

The intentional spread of false or misleading information to inflict harm, commonly referred to as disinformation, raises unprecedented challenges in today’s digital age. This phenomenon becomes even more concerning when strategically leveraged by violent extremist actors to disseminate hateful narratives, incite violence, and recruit followers. While both disinformation and violent extremism are widely recognised as critical global threats, their intersections have however received limited scholarly and political attention. Drawing on findings from a multiyear EU-funded project, this policy brief seeks to address this gap and raise awareness on the complex dynamics and potential harms associated with disinformation propagated by extremist actors. Building on a cross-country mapping, with a particular focus on Boko Haram factions in Nigeria, it outlines the enabling conditions, defining features, and potential harmful impacts of such disinformation. The brief concludes by offering evidence-based recommendations to enhance the capacity of policy-makers and practitioners to assess, prevent, and mitigate its adverse effects.

The Hague: The International Centre for Counter-Terrorism (ICCT) , 2025. 27p.

By J.M. Berger

This report compares two large random samples of Twitter accounts that tweet in English: one taken just before Elon Musk acquired Twitter in October 2022, and one taken three months later, in January 2023. It also examines several related datasets collected during the period following the acquisition, a period in which, the study found, new accounts were created at a record-breaking pace. Some extremist and conspiracy networks created accounts faster than the baseline rate, probably because changes to Twitter’s trust and safety policies had been announced. In the context of these policy announcements, the study examines some reinstated accounts, with mixed results. Despite the loosening of several content policies, accounts that automated the sending of tweets (‘bots’) saw activity drop sharply during the period of the study, with many bot accounts being suspended or deactivated, while others voluntarily curtailed their activity in light of the API changes announced. Deactivated accounts were dominated by sex- related content and apparent financial spam or scams, often coupled with automated tweeting.

Oxford. UK: VOX-Pol Institute, 2024. 80p.

Editors: Hans-Jakob Schindler, Senior Director, Counter Extremism Project Marcin Zaborowsk

Central Europe represents a fertile ground for extreme right-wing ideologies (XRW), some of which are openly preaching intolerance and even violence. Similar to the western part of Eurppe. Central Europe has been affected by global dynamics related to the expansion of populism and XRW to a considerable extend. There are, however, also some specific conditions in the formerly communist Central Europe that are setting the region aside from other parts of Europe. These conditions are historical, economic, and ethnic in nature. With most of the region subjected to foreign communist domination during the second half of the 20th century, nationalism, sometimes in extreme forms, remains a strong under-current within the nations of Central Europe. With interwar Czechoslovakia (1918- 1938) being historical exception, Central Europe had practically no tradition of democracy prior to 1989. Also, whilst most of Western Europe went through the period of cultural changes in the 1960s, the Communist states of Central Europe were stuck on the wrong side of the iron curtain and isolated until 1989. Finally, although Central European nations are often historically heterogeneous, there is little experience of recent migrations into the region, especially from the outside of Europe. Whilst democratic transitions in the formerly communist Central Europe were achieved relatively smoothly, these processes were considerably helped by the international context and the conditionality of NATO and EU enlargements. For much of the current post-Cold War history Central Europeans were guided through the process of post-communist transitions by externally imposed criteria and requirements. The process was entirely voluntary as Central Europeans were keen to join the EU and NATO, hence, ready to meet the conditions set out by these institutions. Most importantly, this conditionality were also supporting stability and predictability of the domestic transitions in Central European states. However, this inevitably led to some shallowness of the process with the candidate states hurriedly setting up institutions and mechanisms that would satisfy NATO and EU. Today, with these countries being members of the EU and NATO, the stabilizing role that the conditions during the accession processes played is no longer available while democratic norms and institutions remain very fragile. The combination of all these factors means that XRW ideologies have find sizable constituencies in Central Europe. The salience of the phenomenon is compounded by the relative inexperience and sometimes the lack of legal instruments to address this issue in the states of Central Europe. In this report we chose to focus on four middle and smaller size Central European nations: Bulgaria, Czech Republic, Hungary, and Slovakia. Three of the four were formerly parts of the Austro-Hungarian empire whilst Bulgaria spent half of the previous millennium under Ottoman domination. All the four were members of the Soviet block until 1989 (Czech Republic and Slovakia as a one state) and today all are members of the EU and NATO. Although XRW movements remain outside mainstream politics in all four countries, all have powerful populist movements which tend to operate in symbiosis with the respective XRW movements.

Bratislava Slovakia : GLOBSEC, 2023. 64p.

By Stephen Reimer

Extremism and terrorism motivated by far-right ideologies has captured the attention of policymakers and much of the public as an urgent threat to peace, security and democracy across much of the Western world. This has not escaped the notice of practitioners of counterterrorism financing (CTF), many of whom see the far right as a natural extension of the global terrorist-financing threat. Although there is enthusiasm for immediately and directly applying CTF tools and responses to far-right fundraising and related financial activities, the ability of the CTF regime to suitably respond to this threat has been largely assumed. Through an analysis of the operational and organisational financing behaviours of the contemporary far right, this paper finds this financing threat to be largely incompatible with the CTF regime and identifies several shortcomings in the regime as it stands. The vast majority of far-right violence emits meagre financial signals before an attack is carried out, which is incongruous with a CTF regime that depends on financial institutions to spot overt red flags in transaction data. Further, the CTF regime’s reliance on terrorism designations and resultant sanctions to financially isolate groups is at odds with the far right, whose organisational structures are unprecedentedly fluid and adaptable to such restrictive measures. In the absence of clearer direction from states, the private sector (especially operators of online platforms) has responded to pressure to independently ‘cut off’ perceived far-right ideologues and agents from accessing their services. Although laudable in their intention, such responses have precipitated several adverse consequences, including the spoiling of opportunities to collect financial intelligence on individuals and networks that could feed into more effective disruption efforts. In recalibrating the CTF regime to make it more suitable for the far-right threat of today, this paper makes the following recommendations: • To increase the likelihood of pre-attack financial signals being identified by financial institutions and used for preventative purposes, states should broaden public–private collaboration in the form of multiagency ‘fusion cells’ involving social services, health, education, security intelligence services and financial institutions for real-time intelligence sharing on persons of interest • To maximise the near-term effectiveness of far-right terrorism designations for disrupting finance, states should provide their private sector (particularly financial institutions) with detailed lists (including names and identifying information) of real or legal persons linked to designated far-right groups to aid implementation. • In recalibrating their national CTF regimes to meet the threat posed by the far right, states should reclaim authority and safeguard freedom of expression by denying private sector actors a free pass to make decisions, largely on the basis of reputation, about what constitutes violent extremism, as opposed to merely distasteful ideology. • In building CTF regimes fit to combat far-right financing, states should include oversight mechanisms to forestall the abuse of anti-financial crime measures for authoritarian ends. Responding to far-right mobilisation using financial tools could also set dangerous precedents for authoritarian onlookers if not done transparently

London: Royal United Services Institute (RUSI) (2023), 20p.

By Hans-Jakob Schindler

.The report outlines the current mechanisms set up in Germany to mitigate the risks emanating from the financing of terrorism, violent extremism, and non-violent extremism. These present three basic challenges for investigators: a restrictive legal basis and significant administrative limits on the ability of the security authorities to collect and analyze information concerning the financial operations of extremist entities; gaps in financial transparency and a wide distribution of relevant data; administrative and investigative silos as well as competing investigative priorities. The example of the Muslim Brotherhood-linked entities in Germany demonstrates that these challenges result in a lack of available information concerning the underlying financial structures of extremist entities. The report concludes with a range of policy recommendations to adjust the current legal and administrative mechanisms, increase financial transparency concerning associations and non-profit entities and establish more cooperation and coordination mechanisms.

berlin: Institute for Strategic, Political, Security and Economic Consultancy (ISPSW) 2023. 15p.

By Alexander Ritzmann

Key Findings  Research conducted by CEP Germany in September 2022 shows that a large portion of the “who’s who” of the (violence-oriented) German extreme-right are still present and active on Facebook, Instagram and YouTube. They use those platforms to promote their merchandise stores, martial arts associations, music labels, bands, and prepper organizations to fund their extremist activities, reach new customers, and recruit new members. These key actors are the foundation of the (transnational) violence-oriented right-wing extremist (VRWE) milieus in Germany.  The terms of service of Facebook, Instagram and YouTube state that they will “not allow” white supremacy actors to use and benefit from their platforms.  This research builds on a CEP policy report from November 2021, which documented that many of the key right-wing extremist actors in Germany are active on major social media platforms. These key actors are pursuing a strategy of “extreme normalization,” where they no longer carry out explicitly illegal activities on mainstream social media to avoid being permanently blocked from the platforms.  CEP provided their research findings to Facebook and YouTube directly 13 months ago. The same global social media companies publicly commit to work against hate speech, extremism and terrorism e.g. at the EU Internet Forum, the Christchurch Call To Action, and the United We Stand Summit.  Why is this a serious problem? The described key right-wing extremist actors do not only promote dangerous conspiracy narratives like the “Great Replacement” or “White Genocide”, which postulates that a Jewish-led elite seeks to destroy the “white race” by means of mass migration of “non-whites”, feminism and LGTBQI+ rights. They also build the “Erlebniswelten” (spaces for collective experiences) like music concerts and festivals or mixed martial arts tournaments to further expand the reach of extreme-right milieus in Germany, which can lead to increasing political violence and stochastic terrorism. .

New York, Berlin, London: Counter Terrorism Project, 2022. 6p.

By William Allchorn, Nigel Bromage, Bethan Johnson, Alexander Ritzmann, and Hans-Jakob Schindler

This study outlines and analyzes the financial strategies and activities of key right-wing extremist (RWE) organizations and actors in the United Kingdom (UK) and in Germany. The research focused on legal as well as (potentially) illegal financial activities and on key actors (individuals/ groups) with systemic relevance to the UK’s and Germany’s RWE milieus who have been active for a significant amount of time and have a significant track record of (being suspected or convicted) of relevant crimes as well as individuals who are likely to operate across national borders. 2. As identified in a 2020 CEP report1 on the transnational connectivity of key RWE actors in six countries, right-wing extremists apply various strategies for generating income streams. These can be classified as: 1) self-financing/ donations/crowdfunding/membership fees/ cryptocurrencies, 2) concerts and music festivals, 3) commercial activities like merchandise stores/web-shops, 4) combat sports events, 5) purchase of real estate for investment purposes and to establish “safe spaces,” and 6) organized/ financially motivated crimes, including money laundering. 3. Some of these financial strategies do generate significant amounts of income, as shown in another CEP report on RWE financing patterns and networks in 2021.2 A significant portion of the generated funds are in cash. In this context, illegal activities such as tax evasion or money laundering could present a weakness in these financial activities that offer potential opportunities for disruption by law enforcement and tax authorities if investigative priorities are set appropriately. 4. The objective of this study is to inform policymakers and practitioners working on the prevention and countering of right-wing extremism/ terrorism as well as financial crime with the goal of enhancing the understanding of the RWE financial strategies and to encourage further cooperation between relevant government agencies and civil society organizations.

New York, Berlin, London: Counter Terrorism Project: 2023. 31p.

By Hans-Jakob Schindler, Alexander Ritzmann and Marco Macori

In an in-depth study in 2020, the Counter Extremism Project (CEP), commissioned by the Federal Foreign Office of Germany, analysed the transnational connectivity of the violent rightwing extremist (vXRW) and terrorist movement in five European countries and the US.1 It argued that in particular since 2014 a new leaderless apocalyptic transnational vXRW and terrorist movement emerged, which is responsible for a growing amount of violence in all countries at the centre of the study. The study also outlined that all governments had developed a variety of countermeasures, ranging from prevention and countering violent extremist (P/CVE) approaches, approaches with a focus on executive and intelligence-led measures to mixed strategies which integrated P/CVE with an increase in executive capacities as well as legal and administrative changes. However, the study argued that due to the growing transnational connectivity of right-wing extremist and terrorist networks, both offline in physical networking hubs as well as online through specific online ecosystems, transnational measures and mechanisms would be an effective, complementary tool to national strategies and tactics. From the analysis of the study, five main issue areas emerge, in which further transnational cooperation and coordination could be achieved to mitigate the threat emanating from this movement: (1) The further development of a common understanding and legal concepts, better capturing the terrorist nature of this developing threat. (2) Development of a deeper and more nuanced understanding of the various online ecosystems that underpin and connect the networks within this transnational movement and the deployment of already existing capacities, which are currently geared to counter Islamist terrorism online. (Topic of this briefing paper) (3) More in-depth analytics concerning the financial activities and transnational commercial connections of the vXRW and terrorist movement to allow for the potential adjustment of existing global counter terrorism financing mechanisms. (4) Greater awareness and the development of appropriate countermeasures focusing on the training activities within the vXRW movement, in particular paramilitary training. (5) The further development of P/CVE approaches and concepts on a local, national and transnational level, based on lessons learned. Throughout 2021, CEP, in cooperation with the Federal Foreign Office of Germany, will address these issues in a series of virtual events, bringing together relevant national and multilateral policy stakeholders. These events will be accompanied by a series of short reports, outlining the main operational and policy issues. Building on the discussions with relevant stakeholders, these papers will contain a range of concrete policy recommendations.

CEP Policy Brief

New York, Berlin, London: Counter Terrorism Project: 2021. 16p.

By Alexander Ritzmann, Dr Hans-Jakob Schindler, Dr Thorsten Hindrichs, Maximilian Kreter

The financial structures of violent right-wing extremist organisations and actors in Germany are broad and multifaceted. Currently, there is a lack of up-to-date and in-depth analyses of the various financial strategies employed by these groups and individuals as well as their different sources of income. It seems like the “follow the money” approach, which has been successfully deployed against organised crime and in the prevention and fight against Islamist extremism and terrorism, has not been adopted with regard to violent right-wing extremism. A part of the violent right-wing extremist milieu, in particular those actors that are closely integrated into wider transnational networks, seem to have professionalised their financial strategies. Interestingly, a superficial analysis of publicly available data concerning the business models and legal formats chosen by violent right-wing extremist entrepreneurs may give the impression that a discernible strategy is absent. However, it is important to note that large segments of the violent right-wing extremist milieu, especially those that are transnationally linked, are highly networked with discernible structures connecting the various nodes. Deploying the “Administrative Approach”, developed by the European Union to fight organised crime, could be an effective tool in the fight against right-wing extremist organised crime. This methodology targets the interface between illegal and supposedly legal activities and income of criminal actors and networks. For example, local authorities could carry out coordinated tax audits as well as controls concerning the adherence with building codes and fire protection regulations targeting companies and businesses of right-wing extremist entrepreneurs that are directly linked to convicted felons who are part of the same ideological network. The study identified 38 relevant business entities in Germany that are involved in the production and dissemination of violent right-wing extremist music. Interestingly, although the overall music market in Germany is characterised by high levels of competition, this subsegment does not seem to display economic or ideological conflicts and functions in a cooperative manner, with various stakeholders linked to each other. Right-wing rock concerts are both lifestyle events as well as marketplaces and function as central networking hubs of the overall movement. Therefore, a clear distinction between the social networks of the right-wing rock music scene and those of the violent right-wing extremist scene can only be made in a very abstract sense. Due to the intricate and opaque business relationships on both the national and transnational levels of the (legal) German right-wing rock music market, it is of utmost importance to further investigate the key stakeholders within this milieu. These actors should be conceptualised not as individual economic entities or individual perpetrators but as representatives of the right-wing terrorist networks that operate in the background. Extremist right-wing rock music can be a profitable business in Germany due to the increasing professionalisation of production, dissemination and event management. These financial structures will continue to thrive so long as they are led by professional entrepreneurs who are not effectively confronted by government authorities.

New York, Berlin, London: 2021. 41p.

By Alexander Ritzmann

This paper aims at informing governments on a federal, state and local level that want to investigate the financial strategies and networks of extremist key actors in a targeted and comprehensive manner. The main objective of implementing a "Follow The Money" strategy in this context is to investigate if illegal activities, such as tax evasion or money laundering are being conducted.

New York, Berlin, London : Counter-Extremism Project, 2024. 7p.

By Wesam Charkawi , Kevin Dunn ,  Ana-Maria Bliuc

Since the September 11 attacks, prevention and countering violent extremism (P/CVE) programs have rapidly increased worldwide, garnering significant interest among researchers. This paper is a systematic review focusing on the evaluations of primary, secondary and tertiary prevention programs from 2001 until 2020. The review identified 74 program evaluations that included satisfactory measures and metrics. Only 32% of the studies deemed the intervention successful, 55% described limited success, and 8% deemed the program had failed. Many of the programs evaluated failed to reach their objectives; some generated negative outcomes such as community disdain and an increase in the likelihood of alienation and stigma. Success was largely a self-assessed measure by the facilitators or stakeholders of the programs or the evaluators of the study. Success indicators can be operationalized as the degree of enhanced sense of belonging (connectedness to the community, social connection), trust and willingness to engage in programs, development of critical thinking skills (integrative complexity theory), and a strong sense of worth (quest for significance). Without a generally accepted set of metrics and no cohesive framework for conducting evaluations, this review offers an important addition to the field on the evidence suitable for program evaluations. An important aim of this systematic review was to identify what makes an effective and successful countering violent extremism program. The key findings indicate that enhancing belonging, identity, trust and community engagement, acknowledging perceptions of injustice, religious mentoring, and the promotion of critical thinking/self-reflection are associated with successful programs. The findings press upon policymakers, funders, and researchers the need to consider and support high-quality evaluations of programs.

International Journal of Law, Crime and Justice, 2024., 19p.

By By Stephane J. Baele,* Lewys Brace, and Elahe Naserian 

Scholars and practitioners investigating extremist and violent political actors’ online communications face increasingly large information environments containing ever-growing amounts of data to find, collect, organise, and analyse. In this context, this article encourages terrorism and extremism analysts to use computational visual methods, mirroring for images what is now routinely done for text. Specifically, we chart how computer vision methods can be successfully applied to strengthen the study of extremist and violent political actors’ online ecosystems. Deploying two such methods – unsupervised deep clustering and supervised object identification – on an illustrative case (an original corpus containing thousands of images collected from incel platforms) allows us to explain the logic of these tools, to identify their specific advantages (and limitations), and to subsequently propose a research workflow associating computational methods with the other visual analysis approaches traditionally leveraged  

Perspectives on Terrorism, Volume XIX, Issue 1 March 2025  

By Stephane J. Baele and & Lewys Brace

How to best chart and analyse extremist digital ecosystems? This paper proposes to complement standard mapping methods based on URL outlinks, which are typically deployed but present several critical flaws, with socio-semantic network analysis. Adapting bi-nodal socio-semantic network principles to the specificities of extremist and terrorist digital communications, we put forward a simple yet efficient method for generating informative networks based on ideological or thematic proximity rather than URL connections. We use three datasets of various sizes and nature (French far-right websites, British far-right websites, US far-right Telegram channels) to compare traditional URL-based vs. socio-semantic networks, demonstrating how the latter bypasses the flaws of the former and offers significant advantages in multi-methods research designs. This empirical validation of our methodological proposition unfolds several new observations concerning the contemporary Western far-right digital ecosystem, highlighting specificities and commonalities of its French, British, and American variants.

By Luke Baumgartner

On July 22, 2011, 32-year-old Anders Behring Breivik embarked on a threehour murder spree across Norway, killing seventy-seven in what would become the single largest loss of life in the country since the Second World War. Beginning that morning in central Oslo, Breivik’s terrorist attack claimed its first victims after detonating a van filled with nearly one ton of explosives outside of the Regjeringskvartalet complex, which housed the prime minister’s administrative offices. Disguised as a police officer, Breivik then boarded a ferry for the island of Utøya, where he proceeded to kill sixty-nine students attending a youth worker’s party summer camp in a mass shooting that lasted nearly ninety minutes. An hour before the bombing, Breivik emailed his manifesto, 2083: A European Declaration of Independence, to more than 1,000 contacts, asking for their assistance in disseminating his magnum opus, which, according to him, took more than three years to complete. The 1,500-page compendium contained a litany of grievances and rails against political correctness, feminists, and “multiculturalist/cultural Marxists,” ultimately accusing them of complicity in a grand conspiracy orchestrated by political elites of the European Union and Arab states to destroy Western civilization through the gradual replacement of white Christian Europeans by way of increased Muslim immigration—in other words, a Great Replacement. Breivik’s actions that day would inspire a cascade of copycat attacks in the United States, New Zealand, and Germany. As part of their attacks, each perpetrator wrote a manifesto to explain the rationale for their actions. In doing so, the manifestos can–and often do–serve multiple purposes: air the personal and societal grievances that led them to kill, provide a blueprint for future attackers, and perhaps, most importantly, gain the public notoriety and infamy they so desperately crave. At its core, terrorism is an act of violence that seeks validation through its very nature as a public spectacle, and thus, manifestos can provide answers to the ever-present question of why an event of this magnitude occurs. While these attacks are separated from one another in both time and space, the ideological glue binding them together is the belief in a racially and culturally homogenous dystopian future, one in which white people gradually cease to comprise demographic majorities in traditionally white dominions such as the United States and Europe. Or, in the most dire circumstances, cease to exist at all. These manifestos contain several common themes central to replacement theory–the conspiracy that motivated their attacks. This paper attempts to build on the current body of academic literature that focuses on the thematic elements of the manifestos and the historical and theoretical foundations upon which the attackers’ justifications for their actions lie. Beginning with a detailed history of replacement sentiment in the United States and Europe, this section seeks to provide the necessary background and context for where replacement theory comes from and how it has motivated actors across time and space. Within the context of the United States, replacement theory finds its ideological roots in late-19th and early-20th century race science, or eugenics, beginning with the works of sociologist Edward A. Ross and anthropologist Madison Grant, both of whom popularized the notion of “race suicide.” Subsequent generations of post-war white supremacists, such as David Duke and David Lane, transformed race suicide into the explicitly anti-semitic conspiracy theory of “white genocide,” laying the groundwork for contemporary militant far-right extremists to coalesce around the idea of replacement theory. Meanwhile, European manifestations of parallel racist conspiracies emerged during an intellectual movement of the 1960s in France known as the Nouvelle Droite, championed by the likes of Jean Raspail. Raspail’s work would influence leading public figures such as Italian author Oriana Fallaci and British Historian Bat Ye’or, who were instrumental in sparking Renaud Camus’ coining of the “Great Replacement.”

Washington, DC: Program on Extremism at George Washington University , 2025. 32p.

By Leland Lazarus and Alexander Gocso

This paper provides a comprehensive analysis of the Chinese individuals, gangs, and companies engaging in illicit activities in Latin America and the Caribbean. Our methodology was to research academic literature, news articles, press releases, official statements, and podcasts in Spanish, Portuguese, Mandarin and English, as well as conduct off-the-record interviews with U.S. and LAC intelligence and law enforcement officials to ascertain growing trends in Chinese criminal behavior in the region.

Miami: Florida International University, 2023. 33p.

By Phil Williams and Sandra Quincoses

The economic and political environments in Latin America have been advantageous for local, regional, and transnational threat networks. Specifically, technology, increased international trade and economic interdependence, heightened interest in natural resources for profit, synthetic drug production, economic disparities, corruption, impunity, and unstable political conditions have led to a complex web of opportunities that requires new, progressive ways to address criminal activities. The creativity of threat networks along with their entrepreneurial strategies have resulted in increasing power and influence. Despite efforts by the United States and some governments in Latin America to combat these networks, the everchanging global environment has worked in their favor. Indeed, some countries in Central and South America are in danger of transforming into what Jorge Chabat described as “criminally possessed states.” Furthermore, gangs in Central America, especially in Honduras where MS-13 has become more closely linked to drug trafficking, have reduced local extortion, become more aware of their nascent political power and have even engaged in rudimentary social welfare provision. Another major trend identified in this report is the strategic diversification of trafficking routes, activities, and markets. For instance, licitly established transpacific trade between East Asia and Latin America has been exploited by criminal groups involved in wildlife and drug trafficking. This, along with other activities such as illegal logging and mining, have undermined licit trade. Moreover, criminal groups have also conducted cyber-attacks against government agencies to obtain false documentation to illegally conduct logging activities in protected areas of Brazil’s Amazon rainforest. Such activities illustrate the growing relationship between technology, illicit behavior, and criminal groups’ diverse capabilities. An emerging nexus between state and non-state threat networks is also identified as a key trend in the region. Notable links between criminal groups and malign state actors such as Cuba, Venezuela, and Nicaragua are publicly known with indigenous and under-resourced communities violently confronting illicit organizations that sometimes have the tacit support of government authorities and agencies. Moreover, external state actors’ investments and economic interests in highly corrupt and unstable political environments pave the way for impunity, which enables threat networks to operate without inhibition. The most explicit example pertains to the Revolutionary Armed Forces of Colombia (Fuerzas Armadas Revolucionarias de Colombia—FARC)-linked mining operations in Venezuela. Undoubtedly, trends are becoming increasingly complex now that activities have reached a global scale. This is also evident in illicit financial flows into, through, and out of the region. In terms of money laundering, tried and tested methods still seem to be favored, although it is likely that new opportunities, such as those provided by digital currencies, will be increasingly exploited in the future. The paper concludes that, in spite of adverse trends, it is important to avoid worst-case analysis. It also suggests, however, that many of the problems in the region stem fundamentally from poor governance—and that taking steps to deal with this should be a priority.

Miami: Florida International University, Jack D. Gordon Institute for Public Policy, 2019. 45p.

By Lea Gerster, Francesca Arcostanzo, Nestor Prieto-Chavana, Dominik Hammer and Christian Schwieter

As part of its project on “Combating Radicalisation in Right-Wing Extremist Online Subcultures”, ISD is investigating smaller platforms to which the German-speaking far-right online scene is retreating. Their aim is to circumvent regulation and moderation on large platforms, for example as required by the German Network Enforcement Act (NetzDG, or 'Facebook Act'). Analyses contained in the report on “Telegram as a Buttress” have already made clear the importance of investigating PeerTube. While writing the previous report, the ISD research team came across multiple video platforms with almost identical layouts and functionalities. It was found that eight out of 19 video platforms identified were set up using the free software PeerTube. PeerTube is an example of a growing socio-technological movement that attempts to turn away from large, centralised platforms towards decentralised and mostly community-managed websites. Instead of a single platform with a monopoly on content, this movement is building a network based on servers that are maintained independently of one another. This is leading to a “hydra effect”: even if connected servers are cut off, the network itself survives, allowing for new servers to be added at will. While far-right extremists are not the ones driving this phenomenon, it does appear that they are exploiting these new-found possibilities. For example, various far-right figureheads have established platforms via PeerTube where users can in some cases create their own accounts. Some of these PeerTube platforms record millions of visits per month. But it is not just its reach but also its structure which makes PeerTube worth investigating. With PeerTube, individuals or organisations can create their own video platforms where they set the rules for content, moderation and user registration. This is essential for far-right and conspiracy groups and individuals who, according to previous ISD research, prefer audiovisual platforms to other types, such as micro-blogging services. PeerTube is a particularly valuable tool since it is more technologically demanding to host and access audiovisual materials than text files. In contrast to centralized platforms such as YouTube, PeerTube content is managed separately by so-called instances - this refers to the small-scale video platforms created with PeerTube software. Different instances can network with each other and form federations. This allows videos that have been uploaded on one instance to be played on another instance without having to change the website. PeerTube belongs to the so-called Fediverse, which will be discussed in more detail below. Another difference to centralized video platforms is that this software uses peer-to-peer technology (P2P), which presumably explains the name. The fact that instances are not managed by large companies, but by individuals or groups at their own expense and with the help of free software, also has implications for their regulation. Key Findings • There is no central moderating authority for managing content. PeerTube offers individuals or groups, whose content has been blocked on centrally managed video platforms for to violating the terms of service, an attractive way of continuing to share their content online. Where it is these groups or individuals who control moderation, content can only be removed from the network by switching off the server. • It is difficult to accurately map the size and connections of the Fediverse. The network is constantly in flux as the relationships between instances can change rapidly due to blocking and follow requests. Instances can also go offline from one day to the next. • The instances used by far-right and conspiracy actors make up only a small fraction of the Fediverse network. They primarily network among themselves. However, some of the instances that were investigated are connected to a wider Fediverse through their own highly networked servers. • The deletion of extremist YouTube channels is not necessarily reflected in the number of account registrations on the corresponding PeerTube instances. PeerTube is rather used as a back-up option for deplatforming. The frequently observed phenomenon that not all users migrate to the new platform can also be observed here. • Instances are often customised in different ways. For example, each instance varies in whether they permit third parties to register for accounts and upload videos. There is no clear correlation between the numbers of accounts, videos and views. However, the most watched videos on relevant instances were mostly created by prominent members of the milieu, which would appear to indicate that persons with a pre-established audience are particularly successful on PeerTube. • The instances selected for the five case studies hosted a lot of content that focused on the COVID-19 pandemic. Another frequent narrative was an alleged conspiracy perpetuated by elites who, according to conspiracy theorists, use events such as the pandemic or Putin's war against Ukraine to further their secret agenda. These findings suggest that PeerTube instances provide safe refuge for disinformation. • Because PeerTube is a piece of software that anyone can access and use in a variety of different ways, state regulation will do little to limit its use by farright extremists. While state agencies can enforce individual aspects of the NetzDG against PeerTube instances, many instances do not have the number of users required to impose reporting obligations or requirements to delete content. Moreover, most content is not hosted with the aim of generating profit, which limits the applicability of both the Facebook Act and the EU's Digital Services Act. • However, PeerTube's community moderation function does allow the community to moderate the use of PeerTube for promoting harmful content. One way of doing this is by isolating extremist instances. Efforts should be undertaken to work with the Fediverse community, i.e. with the server operators and their users, and to develop best practices for identifying and combating extremist activities. This could include further training on how to spot hate speech or setting up a body for reporting extremist instances.

London: Institute for Strategic Dialogue (2023). 44p.