Norway's Police Navigate Social-Media-Tied Terror

   The Norwegian police were the first authorities across Europe to have to handle a massive terrorist attack in times where social media had become an established means of communication for broad parts.
   2011
   Oslo/Utoya, Norway
   Deutsche Hochschule der Polizei (DHPol)
   Crowdsourcing, Social Media
   County
   During
   Real-world
   Terror
   On July 22, 2011, a far-right nationalist attacker launched two terrorist attacks, one in Oslo and another one on the Norwegian island of Utøya. At first, the extremist detonated a bomb in Oslo's government district, killing eight people. This first attack served as a distraction. Later that afternoon, he went to the island of Utøya, 40 km away from Oslo, which he was able to reach at 5.17pm disguised as a policeman. Here, a vacation camp of the youth organization of the Social Democratic Labor Party was held. The perpetrator opened fire and shot 69 people. After about an hour on the island, the perpetrator called the emergency services and surrendered. The call was cut off, so he tried again 30 minutes later. At 6.34pm the police were able to arrest the terrorist.

Reactions on Social Media Though relatively new at that time, social media played a massive role during the unfolding events. Some of the people trapped on the island used Twitter and Facebook to communicate with each other and the outside world on what was happening on Utøya. Thus, news about the shooting actually first broke on Twitter. And the micro-blogging platform remained one of the most important sources of information for the public, for journalists (who could not access the location personally like they could after the bombing in Oslo), and – as interviews with survivors revealed – for the youths on Utøya themselves. As a result, the attacks led to a 200-percent increase in Twitter activity in Norway on 22 July 2011. The 10 most used hashtags during 22 and 23 July were all related to the attacks (e.g., #prayfornorway, #Utøya, #Oslo, #osloexpl).

   https://www.tagesschau.de/ausland/norwegenchronologie100.html, https://www.spd.de/aktuelles/detail/news/gedenken-an-utoya/21/07/2016/, https://www.22julisenteret.no/en/tidslinje, https://en.wikipedia.org/wiki/2011 Norway attacks, Crisis Communication: "Crisis Communication" has not been listed as valid URI scheme., [[Additional links::Attacks in public places]]
   

1. prayfornorway

,

1. Utøya

,

1. Oslo

,

1. osloexpl

   Collecting and Analysing Information from SMCS, Ensuring Credible Information, Making Information Accessible, Mobilising Citizens
   
   With this use case, we do not just want to replicate the harsh criticism the Norwegian authorities had to face after the incident and point out everything they could have done better. In fact, more than a decade after the attacks and with social media having become established tools for police crisis management, a lot of the mistakes are obvious as such (might even sound hilarious to the present-day reader) and would not be repeated in this way. Interviews with Norwegian authorities as well as the way they handled the 2022 shooting in a nightclub in Oslo indeed prove how much they have learnt from those experiences and how much recognition they are now giving to social media in their emergency communication. 

This use case shall rather illustrate on a more abstract level what can go wrong if organizations in charge of crisis management do not meet vulnerable groups where they are at. In an unanticipated, potentially life-threatening event, people tend to use the communication channels they are most familiar with. Thus, if a similar attack happened today, adolescents might for instance first turn to Instagram or TikTok instead of Twitter or Facebook - channels that today a lot of DMOs are absent from and do not invest into understanding their dynamics.

   Children, Adolescents, people affiliated with a certain political view
   The hashtags mentioned above were used to structure the communication accompanying the chaotic events and tried to make sense of them – yet this happened relatively late: it took the Twitter-sphere more than 30 minutes after the bomb blast before the hashtag #osloexpl was established that made it possible to monitor Twitter in a systematic way for updates. What was even more severe, was that none of the organizations in charge for the crisis management took the lead (or even part) in this structuring process. Of the 8, 290 Norwegian Twitter accounts posting on the incident during the critical hours between 15.25 and 21.00 on 22 July, only nine came from public bodies (releasing a total of 22 tweets with the account of Oslo Airport being the most active with eight tweets). In fact, several emergency organizations and authorities were not even on social media back then - the Directorate for Civil Protection, the fire departments, the operating police departments, and the Norwegian Security Police (PST) belonged to the absentees.

Instead, the Norwegian Twitter-community was dominated by young girls at the time which e.g., let to the bizarre fact that the incident was used to seek attention from international pop stars, Justin Bieber’s Twitter account was by far the most mentioned during and after the attacks (tweets containing #prayfornorway and referring to @justinbieber made up the most frequent hashtag/@mentions combination). The poor crisis communication by the police as well as their general crisis management attracted massive criticism and were analyzed in detail on various occasions in the aftermath of the attacks. Some of their most crucial mistakes research and official reports agree upon are:

1) There was a general lack of coordination between the central police department in Oslo and the police district responsible for Utoya and virtual any communication foundations to mediate between them: there was virtually an absence of any communication infrastructure in the crucial area, plans for strategic communication were poorly updated, is was not ensured that all districts had communication staff and regularly practiced crisis handling, 2) They were inadequately equipped to communicate relevant information in a timely manner, particularly through their neglect of social media. Due to the delay in identifying the perpetrator, the public discourse, particularly on Twitter, was for instance vulnerable to rumors: speculations about a possible al-Qaida involvement in the attacks were circulated in the early stages where information was lacking, which in turn gave rise to hostile tweets against Muslims or immigrants in general.

3) They were also inadequately equipped to respond to relevant information in a timely manner: survivors reported that they tried to contact the police or get people on the mainland to do it for them. One of them e.g., chose to post an alert on Twitter to make the public aware of the extent of the attack after he had called the police who did not seem to grasp the seriousness of the situation.

4) The mobilization among citizens – in terms of their actions to save people from the attack and expressions of public opinion on social media – were not always in line with law enforcement. Not having anticipated this role of the public, made the management of the crisis more complex for the rescue teams and authorities because they all of a sudden had to respond to those dynamics.

In 2012, the Commission on 22 July even came to the devastating conclusion that if the police had acted earlier, they would have had the possibility to stop the perpetrator before he reached Utøya, and that several of the killed campers could still be alive.

Concrete suggestions for improvements from survivors

On the positive side, the first-hand accounts from survivors repeatedly pointed out a very important aspect in which a terrorist attack differs from other kinds of disasters and that is thus often neglected in recommendations for effective crisis management - though it tremendously affects social media communication: in a terrorist attack there is a perpetrator, someone who intentionally wants to harm others and therefore might strategically use social media as well.

Survivors for instance expressed that they were reluctant to post relevant information such as their location publicly on social media because they feared the attacker might be monitoring social media for such information, too. They also stressed the aspect of credibility in this context. They pointed out that on the internet anyone can say anything and pretend to be anyone. A perpetrator who entered the island disguised as a police officer could well do the same on the internet and intentionally launch false information, just as someone unaffiliated could, who might think this is funny. So, when someone said that the police were on the island and everyone was safe now, the victims did not dare to trust that information (and looking at the timestamp of that post, they were right not to do so).

Yet, the survivors also derived relatively concrete recommendations for improvements for future crisis management via social media from their experiences:

1) Authorities should offer functionalities for none-public two-way communication with affected people. This does not only help to protect their physical safety but also their anonymity since most victims likely do not want to be publicly known (stigmatized) as such.

2) It should be possible for affected citizens to send pictures and videos to the police (e.g., to show the perpetrator’s face). Yet, since the victims are aware of the problem of fake photos and videos, such an upload-functionally should ideally have integrated verification tools.

3) Such verification tools should also be made accessible for the public, so that future victims are also better equipped to validate social media information during an attack. Yet, such a tool should not be designed for the use in emergencies only because then too little people would be familiar with it to actually use it in such an unlikely event.

4) Authorities involved in crisis response should have a joint social media emergency account which is well known to the public (similar to the emergency numbers 911 for the US or 112 across the EU).

   Social Media, particularly Twitter, were important media to acquire situational awareness during an unforeseen event with mass casualties, least some of the victims, the public, and potentially also the police, other emergency institutions, governmental bodies and public offices thus systematically started to monitor them during the attacks on 22 July 2011.
   
   Less than 1 day
   Facebook, Twitter
   Police Norway
   

View all Use Cases

Created: 29 March 2023
Last edited: 29 November 2023

The Norwegian police were the first authorities across Europe to have to handle a massive terrorist attack in times where social media had become an established means of communication for broad parts.

Hazard:

Terror

Year:

2011

Location:

Oslo/Utoya, Norway

Scale:

County

Involved Organisations:

Police Norway

Publishing Organisation

Deutsche Hochschule der Polizei (DHPol)

Category

Real-world

Theme

Crowdsourcing, Social Media

Thematic

• Collecting and Analysing Information from SMCS
• Ensuring Credible Information
• Making Information Accessible
• Mobilising Citizens

Disaster Management Phase

During

Description

On July 22, 2011, a far-right nationalist attacker launched two terrorist attacks, one in Oslo and another one on the Norwegian island of Utøya. At first, the extremist detonated a bomb in Oslo's government district, killing eight people. This first attack served as a distraction. Later that afternoon, he went to the island of Utøya, 40 km away from Oslo, which he was able to reach at 5.17pm disguised as a policeman. Here, a vacation camp of the youth organization of the Social Democratic Labor Party was held. The perpetrator opened fire and shot 69 people. After about an hour on the island, the perpetrator called the emergency services and surrendered. The call was cut off, so he tried again 30 minutes later. At 6.34pm the police were able to arrest the terrorist.

Reactions on Social Media

Though relatively new at that time, social media played a massive role during the unfolding events. Some of the people trapped on the island used Twitter and Facebook to communicate with each other and the outside world on what was happening on Utøya. Thus, news about the shooting actually first broke on Twitter. And the micro-blogging platform remained one of the most important sources of information for the public, for journalists (who could not access the location personally like they could after the bombing in Oslo), and – as interviews with survivors revealed – for the youths on Utøya themselves. As a result, the attacks led to a 200-percent increase in Twitter activity in Norway on 22 July 2011. The 10 most used hashtags during 22 and 23 July were all related to the attacks (e.g., #prayfornorway, #Utøya, #Oslo, #osloexpl).

What was the overall goal of the Use Case?

With this use case, we do not just want to replicate the harsh criticism the Norwegian authorities had to face after the incident and point out everything they could have done better. In fact, more than a decade after the attacks and with social media having become established tools for police crisis management, a lot of the mistakes are obvious as such (might even sound hilarious to the present-day reader) and would not be repeated in this way. Interviews with Norwegian authorities as well as the way they handled the 2022 shooting in a nightclub in Oslo indeed prove how much they have learnt from those experiences and how much recognition they are now giving to social media in their emergency communication.

This use case shall rather illustrate on a more abstract level what can go wrong if organizations in charge of crisis management do not meet vulnerable groups where they are at. In an unanticipated, potentially life-threatening event, people tend to use the communication channels they are most familiar with. Thus, if a similar attack happened today, adolescents might for instance first turn to Instagram or TikTok instead of Twitter or Facebook - channels that today a lot of DMOs are absent from and do not invest into understanding their dynamics.

What worked well and could be recommended to others?

Social Media, particularly Twitter, were important media to acquire situational awareness during an unforeseen event with mass casualties, least some of the victims, the public, and potentially also the police, other emergency institutions, governmental bodies and public offices thus systematically started to monitor them during the attacks on 22 July 2011.

What limitations were identified?

The hashtags mentioned above were used to structure the communication accompanying the chaotic events and tried to make sense of them – yet this happened relatively late: it took the Twitter-sphere more than 30 minutes after the bomb blast before the hashtag #osloexpl was established that made it possible to monitor Twitter in a systematic way for updates. What was even more severe, was that none of the organizations in charge for the crisis management took the lead (or even part) in this structuring process. Of the 8,290 Norwegian Twitter accounts posting on the incident during the critical hours between 15.25 and 21.00 on 22 July, only nine came from public bodies (releasing a total of 22 tweets with the account of Oslo Airport being the most active with eight tweets). In fact, several emergency organizations and authorities were not even on social media back then - the Directorate for Civil Protection, the fire departments, the operating police departments, and the Norwegian Security Police (PST) belonged to the absentees.

Instead, the Norwegian Twitter-community was dominated by young girls at the time which e.g., let to the bizarre fact that the incident was used to seek attention from international pop stars, Justin Bieber’s Twitter account was by far the most mentioned during and after the attacks (tweets containing #prayfornorway and referring to @justinbieber made up the most frequent hashtag/@mentions combination). The poor crisis communication by the police as well as their general crisis management attracted massive criticism and were analyzed in detail on various occasions in the aftermath of the attacks. Some of their most crucial mistakes research and official reports agree upon are:

1) There was a general lack of coordination between the central police department in Oslo and the police district responsible for Utoya and virtual any communication foundations to mediate between them: there was virtually an absence of any communication infrastructure in the crucial area, plans for strategic communication were poorly updated, is was not ensured that all districts had communication staff and regularly practiced crisis handling,

2) They were inadequately equipped to communicate relevant information in a timely manner, particularly through their neglect of social media. Due to the delay in identifying the perpetrator, the public discourse, particularly on Twitter, was for instance vulnerable to rumors: speculations about a possible al-Qaida involvement in the attacks were circulated in the early stages where information was lacking, which in turn gave rise to hostile tweets against Muslims or immigrants in general.

3) They were also inadequately equipped to respond to relevant information in a timely manner: survivors reported that they tried to contact the police or get people on the mainland to do it for them. One of them e.g., chose to post an alert on Twitter to make the public aware of the extent of the attack after he had called the police who did not seem to grasp the seriousness of the situation.

4) The mobilization among citizens – in terms of their actions to save people from the attack and expressions of public opinion on social media – were not always in line with law enforcement. Not having anticipated this role of the public, made the management of the crisis more complex for the rescue teams and authorities because they all of a sudden had to respond to those dynamics.

In 2012, the Commission on 22 July even came to the devastating conclusion that if the police had acted earlier, they would have had the possibility to stop the perpetrator before he reached Utøya, and that several of the killed campers could still be alive.

Concrete suggestions for improvements from survivors

On the positive side, the first-hand accounts from survivors repeatedly pointed out a very important aspect in which a terrorist attack differs from other kinds of disasters and that is thus often neglected in recommendations for effective crisis management - though it tremendously affects social media communication: in a terrorist attack there is a perpetrator, someone who intentionally wants to harm others and therefore might strategically use social media as well.

Survivors for instance expressed that they were reluctant to post relevant information such as their location publicly on social media because they feared the attacker might be monitoring social media for such information, too. They also stressed the aspect of credibility in this context. They pointed out that on the internet anyone can say anything and pretend to be anyone. A perpetrator who entered the island disguised as a police officer could well do the same on the internet and intentionally launch false information, just as someone unaffiliated could, who might think this is funny. So, when someone said that the police were on the island and everyone was safe now, the victims did not dare to trust that information (and looking at the timestamp of that post, they were right not to do so).

Yet, the survivors also derived relatively concrete recommendations for improvements for future crisis management via social media from their experiences:

1) Authorities should offer functionalities for none-public two-way communication with affected people. This does not only help to protect their physical safety but also their anonymity since most victims likely do not want to be publicly known (stigmatized) as such.

2) It should be possible for affected citizens to send pictures and videos to the police (e.g., to show the perpetrator’s face). Yet, since the victims are aware of the problem of fake photos and videos, such an upload-functionally should ideally have integrated verification tools.

3) Such verification tools should also be made accessible for the public, so that future victims are also better equipped to validate social media information during an attack. Yet, such a tool should not be designed for the use in emergencies only because then too little people would be familiar with it to actually use it in such an unlikely event.

4) Authorities involved in crisis response should have a joint social media emergency account which is well known to the public (similar to the emergency numbers 911 for the US or 112 across the EU).

Which social media platforms were used?

• Facebook
• Twitter

Which hashtags or keywords were used?

#prayfornorway, #Utøya, #Oslo, #osloexpl

Additional Links

• https://www.tagesschau.de/ausland/norwegenchronologie100.html
• https://www.spd.de/aktuelles/detail/news/gedenken-an-utoya/21/07/2016/
• https://www.22julisenteret.no/en/tidslinje
• https://en.wikipedia.org/wiki/2011_Norway_attacks
• Crisis Communication:
• Attacks in public places