The recent deadly mosque attack in the San Diego area served as one of many recent reminders that targeted violence rarely emerges without warning signs. Parents may notice behavior changes, peers may feel concerned, and, sometimes, law enforcement even tries to intervene with an individual or family before a tragedy happens. Yet communities frequently lack the resources to understand what they are seeing and appropriately respond before a crisis becomes operational.
As an extremism researcher, I spend much of my time helping law enforcement, tech companies, and prevention practitioners understand emerging extremist threats.
Much of my work focuses on decentralized communities that target minors through gaming and other youth-oriented platforms. Predators groom children into hating and harming themselves and into recording or streaming harmful acts. Those recordings can then be used to pressure them into escalating behavior, including school shootings. The FBI reports at least 450 open investigations into just one aspect of this ecosystem. Most disturbing of all, many of the groomers are children themselves.
Researchers like me become invested in each case we see because we know there are real children and families being permanently impacted by these manipulations. Some are permanently physically scarred with the names of NVE leaders or groups they’ve been coerced to carve into their skin. Some will have long-term trauma from the sexual abuse perpetrated within these networks. Almost all children in these spaces are psychologically harmed from repeated exposure to sexualized, violent, and gory material that is synonymous with these environments.
Last school year, the investment became deeply personal.
At the start of a holiday break, I received an email that appeared to come from an administrator at my child’s school. The account had been hacked and was being used to doxx a student, listing his home address, accusing him of involvement with 764, a notorious nihilistic violent extremist (NVE) network, and identifying several online aliases.
I already knew extremist activity was likely present at my family’s school. Our city of Nashville has experienced two school shootings that are frequently referenced in extremist communities, and I had spent more than a year urging school leaders to facilitate basic training on warning signs and intervention.
Still, my heart stopped when I read the email.
Although framed as an attempt to embarrass the student, the email looked more like an effort to push him toward violence. The timing was particularly concerning because the school break potentially gave him time to sit with shame and anger—emotions extremist cultures weaponize—and return ready to exact revenge.
I immediately warned local law enforcement that the student’s family could be targeted for swatting. People have died as a result of fake emergency calls, and that’s exactly what some extremists want.
Using the same strategies I routinely use for other, less personal threats, I then analyzed the accounts named in the email, and their content confirmed my fears. The accounts displayed classic NVE indicators, including an obsession with violence and repeated references—many of them subtle—to so-called “Saints,” the term many extremist communities use to glorify successful mass attackers.
Many of these indicators would have appeared meaningless to most parents and educators. Even after our previous discussions, school officials did not recognize that one anime-style profile image from the student’s accounts depicted a Columbine High School shooter.
That kind of detail matters.
Identifying NVE radicalization requires an understanding of online cultures, symbols, and narratives that evolve very quickly. It also requires an understanding of behavior patterns, both online and off, and it is very challenging for parents, school officials, or even many law enforcement agencies to stay apprised of relevant indicators given the full scope of their jobs.
Fortunately, Nashville law enforcement was exceptionally adept and responded quickly, intervening before a tragedy occurred. Their preparation reflected prior awareness of emerging threats, familiarity with evolving online indicators, and a willingness to act before violence became imminent.
But both this case and the San Diego attack reveal the fragility of our current response system and how thin the line between successful intervention and executed attack can be.
In San Diego, warning signs reportedly appeared long before violence became imminent. One perpetrator had reportedly been involuntarily hospitalized for mental health concerns. Court records indicate family members repeatedly tried to intervene by removing firearms, monitoring online activity, and placing him in therapy. Police had previously sought to remove guns from the home because of concerns about his admiration for Nazis and mass shooters.
The Nashville student showed a strikingly similar pattern: online fixation, concerned family members, and—until intervention occurred—access to firearms. In both cases, warning signs were clear, but this time, we likely avoided a tragedy because people were positioned to respond quickly.
Nationally, however, this is precisely where our current response framework continues to struggle.
Many prosecutors, including Nashville’s regional U.S. Attorney, are reluctant to pursue cases involving minors unless there is a clear operational plot. I understand that hesitation because punitive responses alone can harden rather than rehabilitate young offenders.
But when cases are not pursued, investigators lose opportunities to fully examine the networks that are aggressively grooming children to hate and hurt themselves and other people. They can easily miss other individuals in the same ecosystem who are plotting their own violent attacks.
Meanwhile, local agencies are increasingly expected to manage these threats with limited resources. The consequence is a gap in our response capacity. Communities can see pieces of the threat, but often lack the full picture needed to stop it.
By the time someone qualifies for intervention under the current approach, it is often too late for victims and too late for meaningful rehabilitation for the perpetrator.
The San Diego case illustrates that problem. At the point where law enforcement can definitively establish an imminent threat, families and police may have already spent months fruitlessly trying to find help through systems that are poorly equipped to respond.
There are encouraging signs. Senators recently advanced bipartisan legislation aimed at combating online exploitation and strengthening protections for children online. It is a useful first step. But legislation alone will not solve a problem schools, parents, mental health professionals and law enforcement confront every day
Our children’s safety cannot depend on a series of lucky breaks—the right people seeing an email or having relevant experience. Prevention must happen before a trigger is pulled by giving families, schools and communities the tools they need to recognize these threats and respond before violence occurs.
