Since the advent of the internet in the 1980–1990s, cyberspace has become an important venue for radicalization and cross-fertilization of ideological content (Schwarz, Reference Schwarz2020; Simi & Windisch, Reference Simi and Windisch2020).Footnote ¹ Violent extremists leverage the global interconnectivity of the virtual sphere to establish and maintain relationships with like-minded individuals and organizations, and facilitate expansions by spreading propaganda to attract and recruit new members (Dittrich et al., Reference Dittrich, Rathje, Manemann and Müller2022; Scrivens et al., Reference Scrivens, Wojciechowski, Freilich, Chermak and Frank2021). Today’s online platforms provide diverse (sub)cultures with extensive opportunities for interaction, enabling the global exchange of content without delay or oversight. Proponents of extreme movements have emerged on all mainstream social media channels to disseminate radical content, including Facebook, Instagram, Twitter (now X), TikTok and YouTube, but also on fringe forums, for instance anonymous imageboard forums such as “the chans” (e.g., 4chan or 8chan). Particularly the far-rightFootnote ² – right-wing populists, national conservatives and violent revolutionists – has created a parallel universe of alternative platforms where extreme worldviews appear to be reiterated with discourse that evades content moderation, avoids fact checking and disregards opposing opinions (Fuchs & Middelhoff, Reference Fuchs and Middelhoff2020). Examples of such platforms include Parler (emulating Facebook), Gab (emulating Twitter – now X), Bitchute (emulating YouTube), Metapedia (emulating Wikipedia) and Voat (emulating Reddit).

The Swedish Defence Research Agency (European Commission, Reference Commission, Kaati, Cohen and Pelzer2021) found that the violent right uses specific jargon to strengthen their members’ sense of belonging and to enforce their ideological messaging by utilizing toxic language, dehumanization terminology and conspiracy theories in digital environments. Furthermore, the Institute of Strategic Dialogue (Bedingfield, Reference Bedingfield2021) observed that major game streaming and messaging platforms, such as Steam, Discord and Twitch, host publicly accessible chat servers, channels and groups that are composed of large networks of radical far-right collectives and extremist activities. In a study across twelve chan sites, the Centre for Research and Evidence on Security Threats (Keen, Crawford & Suarez-Tangil, Reference Keen, Crawford and Suarez-Tangil2020) found that several imageboards fostered an extremist mindset and promoted violence on the basis of deploying irony and humor in memes and other visual narratives. In addition, the forums promoted an “in-group” status while concurrently targeting “out-groups,” an important framework for understanding the us versus them mentality (Tajfel & Turner, Reference Tajfel and Turner1979). This identity theory illustrates how individuals and movements categorize themselves and others into competing social groups, with the in-group sharing a national, racial or religious identity (Berger, Reference Berger2018). Out-groups of the far-right include, for instance, the Jewish, Muslim and LGBTQIA+ communities; immigrants; black and brown people; left-wing politicians and supporters; the media; and women (Schwarz, Reference Schwarz2020). While the far-right may not be a uniform group (Booth, Reference Booth2023), we believe referring to in- and out-groups is a useful concept in the context of online radicalization and how individuals express (dis)alignments with certain people, groups and ideologies.

The technological changes that have enabled a global network of connectivity have also accelerated the radicalization process for a new generation of lone-actor terrorists born into the digital era (Crawford & Keen, Reference Crawford and Keen2020; Thorleifsson & Düker Reference Thorleifsson and Düker2021). By engaging in online interactions with other extremists in detached webs, subjects appear to feel a sense of unity and commitment to a certain cause (Simi & Windisch, Reference Simi and Windisch2020). This has triggered a number of targeted violence attacks that – despite the digital community – are prepared and carried out autonomously. The focal point of this Element, Stephan Balliet, was part of this far-right ecosystem of interchangeable digital platforms where he partly self-radicalized, for instance, on the darknet and clearnet platforms Kohlchan, Nanochan, 8chan, vch.moe and Julay.World (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022; Pook, Stanjek & Wigard, Reference Pook, Stanjek and Wigard2021). The main research question of this Element is not whether Balliet fits into any specific group, but rather how he constructs an identity as part of something – a collection of transnational online extremists with overlapping ideals and connections. By understanding how Balliet aligns with this network, we can gain insights into his ideological frameworks and motives, which ultimately resulted in a violent act of terrorism. This is important as these digital environments where successful lone-actor terrorists with a high kill count are glorified (Macklin, Reference Macklin, Dafinger and Florin2022) partly inspired Balliet to escape his mundane reality and design a mass casualty incident.

1.1 The Terrorism Attack

On October 9, 2019, at 11:54 am, Stephan Balliet is seated in a rental vehicle in a parking lot near a synagogue in the East German town of Halle, Saxony-Anhalt. Intent on conducting a mass shooting at a Jewish place of worship on Yom Kippur – the holiest day in the Jewish calendar – he publishes a link to his targeted violence manifesto (henceforth, TVM) and live-stream on the imageboard Meguca at 11:57 am. After initial technical difficulties when configuring his broadcast to the online gaming platform Twitch, he turns the camera of his phone to his face and announces the following scripted message in English:

1. (1) Hi my name is Anon,Footnote ⁴ and I think the holocaust never happened. [unintelligible] Feminism is the cause of the decline of birthrates in the West, which acts as a scapegoat for mass immigration. And the root of all these problems is the Jew. Would you like to be friends?

Subsequently, the twenty-seven-year-old German navigates to the synagogue on Humboldtstraße, dressed in a military-style outfit and equipped with a head-mounted phone camera on his ballistic helmet to live-stream his premeditated attack. Antisemitic music is blasting from an MP3 player and loudspeakers attached to the back of a tactical vest (Pook et al., Reference Pook, Stanjek and Wigard2021). Balliet arrives at the target site at 12:01 pm and attempts to break into the building – which holds fifty-one worshippers at the time – with homemade explosives, 3D-printed guns and ammunition while broadcasting his attack online to an international audience. Unable to breach the secured doors at the main and side entrances, the perpetrator shoots and fatally wounds a passerby, a forty-year-old female whose only transgression appears to be her vocal complaints about the deafening sounds of the offender’s explosives. Visibly agitated, Balliet accidently shoots his car’s front tire. When he tries to fire at a second person who has stopped to aid his first victim, Balliet’s self-made weapon jams multiple times. Then, the attacker impulsively departs and drives less than 0.3 miles (500 meters), choosing a nearby Turkish restaurant on Ludwig-Wucherer-Straße as a spontaneous second target, and fires shots at several individuals, killing a twenty-year-old male.

The first patrol car arrives at the kebab shop at 12:15 pm – approximately twenty minutes into the incident – and the perpetrator engages in a firefight with several law enforcement officers. Balliet sustains a minor neck injury, drives off, hitting and injuring a Somalian victim walking on the sidewalk, reportedly on purpose. The offender then escapes to the small village of Wiedersdorf, Saxony-Anhalt, nine miles (sixteen kilometers) east of Halle where he attempts to carjack a vehicle at 1:00 pm (Mitteldeutscher Rundfunk, Reference Rundfunk2019). The car owners, a married couple, refuse to relinquish their vehicle and Balliet shoots and seriously injures them before proceeding to steal a cab to drive towards Munich. Along the way, he discards his phone used to live-stream the attack (Pook et al., Reference Pook, Stanjek and Wigard2021). Twenty-five miles (forty kilometers) into his escape, the attacker hits a truck on the freeway and law enforcement apprehends him without further resistance at 1:38 pm (Koehler, Reference Koehler2019). Responding officers discover an escape bag in the vehicle, containing several hygiene and clothing items, as well as food for approximately two days. Balliet explained during his trial that his original plan entailed an escape to the Harz Mountains, a highland area northwest of Halle (Pook et al., Reference Pook, Stanjek and Wigard2021).

Extensive criminal investigations revealed that Balliet carried out the act of terror alone. Over 320 witness interrogations confirmed that there were no indications of contact with groups or individuals that could have assisted the offender with planning and preparing for the targeted attack (Pook et al., Reference Pook, Stanjek and Wigard2021). In December 2020, the perpetrator was charged with two counts of murder, seven counts of attempted murder and incitement of the masses, and was sentenced to life imprisonment with subsequent preventative detention (Bundesamt für Verfassungsschutz, 2022).

1.2 The Language Evidence

Minutes before driving to the target location, Balliet announced his intentions in a short message titled Last Post on the imageboard Meguca with the help of a wireless internet stick and laptop (Pook et al., Reference Pook, Stanjek and Wigard2021). The anime discussion forum was reportedly loosely connected to 4chan and shut down three days after the Halle incident, which resulted in a loss of all forum data (Pook et al., Reference Pook, Stanjek and Wigard2021; Thorleifsson & Düker, Reference Thorleifsson and Düker2021). During the court proceedings, Balliet stated that it was a coincidence that he leaked his materials to this specific website, which seems questionable as the perpetrator planned every other aspect of his targeted act meticulously (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022). We believe Balliet chose this particular imageboard because of his interest in anime and gaming (see Sections 3.2 and 4.3) and because 8chan had been taken down after three preceding lone-actor terrorists announced their acts of violence on this platform in March, April and August 2019 (see Sections 7.1 and 8.4).

In the online attack announcement on Meguca, Balliet linked to a folder that contained his TVM, which was authored in English and dissected into three separate files:

• A one-page READ THIS FIRST file, which contained a link to the Twitch live-stream and a short message. According to investigations, this document was created on October 1 and edited until four days prior to the incident, October 5, 2019 (Pook et al., Reference Pook, Stanjek and Wigard2021).

• An eleven-page short pre-action report, comprising photographs and descriptions of his self-manufactured equipment (guns, bullets, grenades), as well as an operational plan and gaming-style objective and achievement sections. The original file name was dokumentation.pdf, which translates to “documentation.” During the Halle trial, it was stated that Balliet began working on this document on March 26, 2019, eleven days after the New Zealand mosque shooting (March 15, 2019). He continuously added to and edited the file until August 17, 2019, and then picked it up again on September 21, 2019, less than two weeks prior to the attack (Pook et al., Reference Pook, Stanjek and Wigard2021).

• A four-page spiritual guide, consisting of encouraging statements for others to commit similar attacks and an image of an anime cat-girl. The file name was a Japanese translation of the word “Manifesto.” Balliet worked on this document from September 21, 2019, until three days before the attack, October 6, 2019 (Pook et al., Reference Pook, Stanjek and Wigard2021).

According to investigation files from Balliet’s interrogation conducted by Germany’s Federal Criminal Police on November 22, 2019, the assailant claimed to have uploaded all of these communications for entertainment purposes (Bundeskriminalamt, Reference Bundeskriminalamt2019).

We also obtained an unreleased self-interview titled Your F&A Guide but saved as Manifest0.pdf on Balliet’s hard drive, which he did not distribute publicly with his other materials. F&A is a German abbreviation for “Frage & Antwort,” the English equivalent to Q&A (“question & answer”). The offender stated that he decided against publishing the file “because it sounded too much like a justification. And only those who do wrong have to justify themselves. And there is nothing wrong with taking action against someone that wants you dead” (Bundeskriminalamt, Reference Bundeskriminalamt2019, p. 2). When asked why the document was authored in English during one of his first police interviews, Balliet responded that he intended to reach a wide audience with it (Pook et al., Reference Pook, Stanjek and Wigard2021). Furthermore, the perpetrator explained that he created his short pre-action report as a follow-up document to the unreleased self-interview, which was meant to be a joke (Bundeskriminalamt, Reference Bundeskriminalamt2019).

The thirty-six-minute recorded live-stream was aired on Twitch, a video-game broadcasting and viewing platform, with Balliet switching between English and German throughout the video that was filmed from a first-person shooter perspective. During his trial, the offender declared that he registered the account spilljuice on Twitch a few months before the attack for the sole purpose of streaming his event live (Pook et al., Reference Pook, Stanjek and Wigard2021). The phrase spill juice is a euphemism for bleeding as a result of a gunshot or stab wound. Balliet opted to use Twitch because Facebook had improved its algorithms to detect and eliminate streams of violent acts quicker after previous terrorism attacks were broadcast on there in 2019. Twitch informed investigators that the original live-stream had a total of three viewers based in the United States and Switzerland, who watched the broadcast for ten, fifteen and thirty minutes each (Pook et al., Reference Pook, Stanjek and Wigard2021). By the time the platform identified and deleted Balliet’s broadcast, the video had been watched by approximately 2,200 people (Koehler, Reference Koehler2019). Similarly to previous targeted violence live-streams, the recording spread like wildfire online (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022).

As a number of scholars have called for multidisciplinary research into threatening language that combines theoretical perspectives from linguistics, rhetoric, psychology and law (Bojsen-Møller, Reference Bojsen-Møller2021; Gales, Reference Gales2010 and Reference Gales, Evans, Jeffries and O’Driscoll2019), we fuse several qualitative methodologies for forensic text analysis and behavioral threat assessment in a novel approach to present a holistic review of the Halle terrorism case. Part one of our interdisciplinary analysis provides a deep dive into Stephan Balliet’s targeted violence communications by applying different forensic text assessments to his language evidence, such as genre, text linguistic and appraisal analyses. Part two focuses on the perpetrator’s pre-attack behaviors to conduct a retrospective threat assessment and organizational review for security agencies, and incorporates an uptake analysis to highlight the contagion and copycat effect of Balliet’s communications and attack.

2.1 Holistic Review

The objective of this Element is to provide a comprehensive analysis of the language evidence associated with the Halle terrorism attack by conducting a scientific and systematic post-hoc examination of select genre, linguistic and behavioral features.Footnote ⁵ This multi-method approach highlights the need for interdisciplinary threat assessment teams composed of investigators, psychologists and linguists to tackle various types of evidence and to approach terrorism cases through different lenses. While intelligence analysts can collect and analyze raw data from the digital sphere to identify a potential subject of concern, detectives can conduct search and seizure procedures and interviews to obtain relevant corroborations. This information can then be analyzed by mental health specialists regarding warning behaviors, while linguists can conduct an analysis of written and spoken evidence. Such cross-disciplinary investigations will deepen the understanding of subjects’ motivations, ideologies and networks, and thus enhance the ability to determine the level of risk of an impending attack. As TVMs are often disseminated minutes or hours prior to an attack and provide limited time for intervention, our interdisciplinary analysis demonstrates the importance of looking at language corroborations in their wider context as part of an aggregate social act of terrorism. Furthermore, the scientific interest in describing, analyzing and explaining language data in the form of a case study carries great value that can provide a prism through which we can evaluate other cases. Insights gained from retrospective assessments, such as the examination of how warning indicators may have manifested themselves in pre-attack behaviors, contribute to the larger goal of preventing future acts of targeted violence. In concert, the findings assist in enriching our understanding of threat assessment protocols and in devising proactive measures against domestic and foreign threats.

Our analysis first renders a broad overview of the genre of TVMs and of the specific constellation of the TVM that Balliet produced prior to his attack. We then consecutively zoom in on how the language of the TVM relates to the textual and situational context, and on how the language reveals Balliet’s stances towards his weapons, his objectives and himself. We then broaden the perspective again to analyze the psychological and behavioral traits that may have caused the attack, and to give an assessment of whether the act of violence could have been prevented through intelligence and investigative measures. Finally, we expand the focus even further to the ramifications in terms of uptakes by other far-right extremists and copycats in different online and offline settings.

This qualitative, multifaceted approach allows us to conduct a critical, in-depth and thorough examination of the perpetrator’s communications and actions, and thus provides a comprehensive and nuanced review of the Halle case. All methodologies will be elaborated upon in their respective sections, but here we provide a summary of all manual types of analyses that complement each other to enhance our understanding of the event:

• The genre analysis assesses the communicative functions, structure and genre labels of each written communication in the TVM and shows how the perpetrator’s self-professed purpose overlaps with and differs from the generic functions of TVMs.

• The text linguistic analysis examines the interplay between grammatical, lexical and pragmatic features to reveal the perpetrator’s narrative, networks and discursively expressed need for significance.

• The stance analysis identifies the assailant’s stances through appraisal analysis to provide insights into his motives and ideologies, including his evaluations of the intended targets, his manufactured weapons, his plan and how he presents himself as ideologically (dis)aligned with the audience(s) of his TVM.

• The retrospective threat assessment conducts a behavioral analysis of the perpetrator’s background, red flags, triggering events and pathway to violence behaviors to accentuate warning indicators that might be utilized to thwart future acts of violence.

• The organizational review assesses challenges faced by security authorities when dealing with lone-actor terrorists, including an examination of Balliet’s behaviors in the run-up to the crime, to discuss whether information for preventive police measures was available to security authorities.

• The uptake analysis examines how the offender’s TVM, live-stream and Q&A are a response to – an uptake on – other targeted violence attacks and communications, and how Balliet’s actions and words have been taken up by subsequent terrorists and a variety of online communities through different intertextual connections.

2.2 Data Selection and Aggregation

The authors of this Element opted to study Stephan Balliet for several reasons. First, there appears to be a lack of research focusing exclusively on the Halle incident with the exception of a commentary published two months after the attack occurred (Koehler, Reference Koehler2019) and Balliet’s TVM and live-stream having been assessed in previous studies (Allchorn, Dafnos & Gentile, Reference Allchorn, Dafnos and Gentile2022; Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022). Second, far-right terrorism is contemporarily the greatest threat for lone-actor attacks in North America and Europe (Bundesamt für Verfassungsschutz, 2022; Wray, Reference Wray2021). Third, publicly available data on Balliet was sufficient to apply a multi-method approach to his linguistic corroborations and pre-attack behaviors. The written and spoken evidence compiled by Balliet (i.e., the multi-document TVM, imageboard post and recording of the live-stream) was originally reviewed and analyzed in the days following the attack in the form of an operational analysis when the first author was embedded within a law enforcement agency. All data are also available in the public domain and were subsequently securely stored in an online file system accessible to all authors of this Element. The unpublished file Your F&A Guide was later obtained from a private source and only reviewed by the first author to maintain confidentiality. The court trial transcripts were acquired from democ. Zentrum Demokratischer Widerspruch e.V., an association of scientists, journalists and media professionals who jointly observe, document and analyze antidemocratic movements.Footnote ⁶ They transcribed the Halle court proceedings and published their reproduction in Pook et al. (Reference Pook, Stanjek and Wigard2021).

3.1 The Genre of Targeted Violence Manifestos

Kupper and Meloy (Reference Kupper and Meloy2021, p. 6) define the genre of targeted violence manifestos (TVM) as:

Kupper et al. (Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022) clarify that TVMs also have the communicative function of inspiring people with like-minded beliefs to commit similar attacks (known as the “contagion and copycat effect,” see Section 8.1). In accordance with this, Bakhtin explains that every genre utterance presupposes an inherent addressivity (Bakhtin, Reference Bakhtin, Emerson, Holquist and McGee1986), that is, an utterance will always have a concept of a sender and an addressee (or audience). Together with communicative functions, the types of senders and addressees are constitutive features of the genre of an utterance.

The typical traits (i.e., communicative functions and addressivity) of a TVM are thus:

• to announce and justify a future act of intended violence committed by the author of the communication prior to their attack;

• to specify a target or target group for the attack;

• to express grievances, homicidal plans and/or extremist beliefs;

• to inspire other violent extremists and possible future attackers;

• to signal in-group membership to a far-right ecosystem.

Similarly to the genre of threatening communications, TVMs are an illicit genre (Bojsen-Møller et al., Reference Bojsen-Møller, Auken, Devitt and Christensen2020; Kupper & Meloy, Reference Kupper and Meloy2021), which are genres that are proscribed by general society. The audiences of illicit genres are typically divided into two distinct groups: supporters and opponents, meaning that illicit genres often have both a desired and an unwanted audience. The desired audience will typically be like-minded in-group members that share the norms of or sympathize with the sender (see Prologue and Sections 4.3, 5.5, 6.3, 7.3 and 8.4). The unwanted audience of illicit genres, the out-group members, will often express condemnation or seek to enforce societal or legal norms upon the sender.

3.2 Communicative Functions, Embedded Genres and Genre Labels

Genres are often embedded within other genres, where each embedded genre (Auken, Reference Auken2021) serves a constituent communicative function that contributes to the total communicative function, for example, a greeting or a thank you can be embedded within a letter and an indictment can be embedded within a record of judgment (Bojsen-Møller, Reference Bojsen-Møller2022).Footnote ⁸

In this case, Balliet made a pre-attack announcement on Meguca.org, linking to a folder and to the Twitch live-stream. The folder contained three PDF files with the file names READ THIS FIRST, dokumentation.pdf andマニフェスト (Japanese for “Manifesto”). Each of the three documents and their different sections can be considered genres (i.e., typified, communicative social actions) in their own right that are embedded in the overall genre of the TVM. Each embedded genre (each document and each document section in Figure 1) thus serves different, constituent communicative functions, which in combination shape the total communicative functions of the TVM. The genre embeddings reflect the structure of the TVM, as shown in Figure 1.

Figure 1 Embedded genres within Balliet’s TVM.

Balliet uses the names of each PDF file and the headings and subheadings within the files (in short, all titles in italics in Figure 1) to describe and categorize the documents and their distinctive subsections. Titles of texts designate the subject matter of the text, and they function as thresholds (Genette, Reference Genette1997) to the text itself that help guide the reader’s interpretation. Titles are identifying devices for the reader, and since they often serve to name the text type itself, they have genre-indicating properties (Genette, Reference Genette1997). Within RGS, such titles – that is, names used to categorize texts – are therefore called genre labels (Nyboe, Reference Nyboe2016). Since the genre labels (i.e., the italicized file names, headings and subheadings in Figure 1) that Balliet has chosen for some of the embedded genres in his TVM have a direct bearing on the perceived communicative functions of the texts, the following analysis will consider these genre labels.

3.3 Conclusion

In this section, we have demonstrated how an RGS approach can outline the communicative functions as well as the self-professed communicative purposes of a specific TVM. We have also identified how these communicative functions and purposes diverge from and converge with the typical traits of the genre of TVMs. We have thereby sought to gain a deeper understanding of the complex motivations behind TVMs and targeted violence attacks.

Throughout the TVM, Balliet uses genre labels to guide his readers and introduce the content of the documents. The various genre labels reflect the primary communicative functions of his TVM, which are: (1) to showcase his self-made weapons and to document the attack, and (2) to address the far-right community and encourage future violent attackers.

Balliet’s documents are an enactment of the genre of TVMs, as they constitute an announcement of his later targeted violence attack against a specific target, that is, the Jewish synagogue and thereby the Jewish community. However, the perpetrator’s self-professed communicative purposes deviate from the typical function of a TVM by prioritizing the presentation of his improvised weapons over relaying extremist ideologies or justifying the violent attack.

In the next two sections, we zoom in on the language of the Halle TVM to provide more texture and detail to the analysis. In Section 4, we show how a text linguistic analysis can uncover not only the underlying ideological narrative for the attack but also the perpetrator’s complex online networks and his need for significance.

4.1 The Role of Context

This section offers a text linguistic analysis of the Halle TVM, adducing three sources of information to deepen our insight into this text and its role in the attack: (1) the communicative functions outlined in the previous section, (2) the linguistically signaled connections within the text, and (3) the lexical and social meanings that allow for a reconstruction of the situational context.Footnote ¹¹ When analyzing nonfictional texts, situational context is integral to the interpretation of utterance meaning. In criminal cases, however, contextual information may be quite limited, reducing the interpretive potential of pragmatic analyses, such as the analysis of indirect speech acts (Searle, Reference Searle1979) and implicatures (Grice, Reference Grice, Cole and Morgan1975). Even absent such contextual information, the surrounding text forms a textual context for words and utterances, and, here, text linguistic analyses can provide a richer and more detailed understanding of both explicit and implicit meanings.

Text linguistics refers to the study of linguistic structure and meaning in longer stretches of written or spoken language, that is, “texts” (De Beaugrande & Dressler, Reference De Beaugrande and Dressler1981; Halliday & Webster, Reference Halliday and Webster2014), and the approach resembles at least some versions of discourse analysis (Shuy, Reference Shuy, Tannen, Hamilton and Schiffrin2015; Vagle & Wikberg, Reference Vagle and Wikberg2001; van Dijk, Reference Van Dijk1977). Text linguistic analysis places a particular focus on cohesive devices, such as pronouns and connectors (i.e., conjunctions and linking adverbs, also called (con)junctives; De Beaugrande & Dressler, Reference De Beaugrande and Dressler1981; Halliday & Hasan Reference Halliday and Hasan2014 [1976]). In addition, it typically includes a pragmatic element in seeking to resolve semantic ambiguities and presuppositions (Levinson, Reference Levinson1983), and analyzing speech acts and implicatures. All levels of language contribute to a text’s textuality (De Beaugrande & Dressler, Reference De Beaugrande and Dressler1981), and while a text linguistic analysis can proceed chronologically – from beginning to end – such a procedure quickly becomes unmanageable for longer texts. We find that a better approach is to structure the analysis around topics of relevance to the genre at hand or to the text’s unique features. Here, we draw inspiration from the notion of a quest for significance, which has been proposed as the underlying motivation for different types of violent extremists (Kruglanski et al., Reference Kruglanski, Jasko, Webber, Chernikova and Molinario2018) and use its component elements to structure our analysis.

4.2 The Narrative

As detailed in Section 3.1, TVMs have several communicative functions, amongst them the justification of violence, the targeting of particular victims and the expression of grievances and extremist beliefs. Throughout his multi-document TVM, Balliet demonstrates his adherence to the far-right conspiracy theory termed the Great Replacement or White Genocide, according to which white people are being supplanted from their home countries by an obscure Jewish cabal that controls Western governments (Bracke & Hernández Aguilar, Reference Bracke, Hernández Aguilar, Bracke, Manuel and Aguilar2023; see Sections 5.2, 6.3, 7.2 and 8.4). As Bartlett and Miller (Reference Bartlett and Miller2010, p. 31) note, “the greater the conspiracy, the greater the act required” to awaken people to its existence. Thus, believers in population replacement theories consider lethal violence justified, both to counter the effects of the conspiracy and to recruit new members (see Section 8.4).

Balliet’s list of Objectives in the short pre-action report (see Section 3.2) contains two items that reference such far-right conspiracy theories, see (7)–(8), repeated from (3):

1. (7) Increase the moral of other suppressed Whites by spreading the combat footage.

1. (8) Kill as many anti-Whites as possible, jews preferred.

The noun phrase other suppressed Whites in (7) triggers two presuppositions (Levinson, Reference Levinson1983), namely that (some) white people are being repressed by society and that Balliet is part of that group. According to the objective in (8), the remedy to this maltreatment is to murder those who are opposed to white people (the selection of the prefix anti- instead of non- signals that Balliet refers to a stance, not a skin color). Further, there is social meaning in the reversal of conventional practices of capitalization in anti-Whites and jews (Sebba, Reference Sebba, Jaffe, Androutsopoulos, Sebba and Johnson2012). The juxtaposition of the two group names shows the deviation from orthographical norms to be deliberate and thereby performative of an underlying ideology (Bucholtz & Hall, Reference Bucholtz, Hall and Duranti2005). Capitalizing White performs a sociocultural elevation of white people over all other groups; in other words, Balliet’s nonstandard spelling can be considered a typographical instance of white supremacy and hate speech (ECRI, 2016).

Linguistically, it is worth noting the use of imperatives throughout the Objectives list. Imperative clauses belong to the class of speech acts called directives, that is, speech acts that request or instruct the addressee to perform a certain action (Searle, Reference Searle and Hutchby2008 [1965]). Written in a TVM, the person expected to perform these actions is Balliet himself, and in this sense, the objectives have the indirect speech act force of commissives (committing the sender to these actions). Being formed without a grammatical subject, imperatives omit explicit reference to an agent, which allows them to be easily lifted out of their original context and inserted into new ones (Briggs & Bauman, Reference Bauman and Briggs1990). Phrasing the objectives as imperative clauses thus facilitates the dissemination of far-right messages in wider forums.

The subsequent section of the short pre-action report, called the Plan, contains several other explicit and implicit references to the conspiratorial narrative (Baele, Reference Baele2019) to which Balliet subscribes. From the very beginning, the target is designated as a Jewish place of worship; see (9):

1. (9) First there is the local synagogue. Damn, that’s not a soft target.

The wording of the first sentence in (9) has text linguistic significance, since the initial adverbial First is a connector signifying that at least one other element should be listed. In this text, however, it is never followed up with a continuation. This incomplete list structure indicates an unfinished train of thought, which may furthermore reveal that Balliet considered alternative targets. By analyzing his use of connectors further down on the same page, we can reconstruct his thinking and how it relates to the narrative: In a paragraph near the end of the Plan, Balliet explains his reasoning in selecting this target over other, perhaps more opportune, targets; see (10):

1. (10) I originally planned to storm a mosque or an antifa “culture” center, which are way less defended, but even killing 100 golems won’t make a difference, when on a single day more than that are shipped to Europe.

The temporal connector originally implies that Balliet’s plans have changed. At first, he had two possible targets, the Muslim community and members of Antifa, presented as equally desirable through the coordinating connector or. This reflects far-right thinking in that Muslims are considered “non-white” (and thereby part of the population replacement conspiracy) and Antifa are characterized as traitors (Baele, Reference Baele2019; Finley & Esposito, Reference Finley and Esposito2020). Following up on the implication of changed plans, the next main clause is introduced by the disjunctive connector but, which here indicates that there is a disconnect between the original plan and the desired outcome. Further, Balliet deploys a term from Jewish folklore, the golem, a concept that has been adopted in popular culture to refer to a humanoid entity controlled by a master (Golem, 2023). Given the narrative, the master lurking in the background is the aforementioned Jewish cabal. This interpretation is supported by the presuppositions triggered by the phrase shipped to, which relies on assumptions that the people in question originate outside of their planned destination (here Europe) and that someone else controls their transport as if they were cargo freight (a metaphor that contributes to the far-right dehumanization of immigrants).

The subsequent sentence to (10) affirms this analysis; see (11) and its continuation quoted in (5):

1. (11) The only way to win is to cut of the head of ZOG […]

The acronym ZOG stands for the “Zionist Occupation Government,” a cardinal antagonist of far-right conspiracy theories and typically integrated into the population replacement narrative (Bartlett & Miller, Reference Bartlett and Miller2010; Bergmann, Reference Bergmann and Bergmann2018). The noun phrase The only way presupposes that some might believe there are other options and simultaneously denies this possibility, representing a kind of fatalistic thinking characteristic of the far-right.

4.3 The Networks

Since one of the communicative functions of a TVM is to incite followers to conduct further attacks, we would expect Balliet’s network to consist of other far-right extremists. However, the text linguistic analysis reveals that this is not the full picture. From the lexicon used in the documents, we can see that he also belongs to at least two other communities, namely constructors of homemade weapons and an amalgamation of “extremely online” internet users (in practice, information-sharing activists, gamers, anime fans and memers; see Section 3.2).

Based on the desire to perform violent attacks, it is not surprising that a far-right extremist such as Balliet is interested in weapons. However, in the Weapons section of the short pre-action report, he directly addresses a specific audience, namely those with limited access to commercial weapons; see (12):

1. (12) After all some of you fellows don’t have the luxury of industrial-made equipment.

The expression some of you fellows implies that he is not himself part of this group, and we do see in the Weapons section that he owns a few professional firearms. Nonetheless, the majority of his weapons are homemade. In offering detailed instructions on how to construct homemade firearms and explosives, Balliet simultaneously aligns himself with the far-right agenda of committing mass-shooting attacks and with a group of potential perpetrators who live in regions with strict gun regulations.

In a separate document of the TVM, the READ THIS FIRST file, we see a reflection of the transnational networks when Balliet first references US currency (50$) – and note how he employs the European convention of placing the currency marker after the amount – and then uses metric measurements (5g) in the same sentence; see (13):

1. (13) All you need is a weekend worth of time and 50$ for the materials. Cartridges can be made from paper, primers can be made from match heads, 5g black powder is an efficient main charge.

The second-person pronoun you can be either read generically or as a deictic reference to his intended audience, that is, those who wish to construct their own weapons (see Section 3.2).

As mentioned, Balliet’s TVM also shows his connections with other communities or networks, especially ones in the online sphere (see Sections 3.2 and 7.3). Throughout the documents, Balliet uses jargon that evidences his deep engagement with both fringe and mainstream internet culture such as file-sharing activists (Bauer et al., Reference Bauer, Grunwald and Sicker2009), videogaming (Squire, Reference Squire, Coiro, Knobel, Lankshear and Leu2014), meme culture (Kostadinovska-Stojchevska & Shalevska, Reference Kostadinovska-Stojchevska and Shalevska2018) and anime fandom (Ray et al., Reference Ray, Plante, Reysen, Roberts and Gerbasi2017). We begin by listing some examples of this in-group lexicon, organized by the domains they refer to (all can be looked up online, e.g., on the website Know Your Meme: https://knowyourmeme.com/memes/).

• File-sharing activism

  1. ○ seeding: digital file sharing through decentralized, peer-to-peer computer networks (pre-attack announcement)

  2. ○ magnet link: hyperlink for downloading data in peer-to-peer networks (pre-attack announcement)

• Gaming

  1. ○ 8ch /v/: a sub-board on 8chan on videogaming (READ THIS FIRST)

  2. ○ vch.moe: a now defunct videogaming imageboard (READ THIS FIRST)

  3. ○ Achievements: meta-goals in video games (short pre-action report)

  4. ○ Techno-Barbarian: a class of warriors from the table-top and video game Warhammer (“Manifesto”)

• Internet and meme culture

  1. ○ shitpost: deliberately provocative and derailing comments online (short pre-action report)

  2. ○ jej: a (perhaps once typo-induced) version of LOL, “laughing out loud” (short pre-action report)

  3. ○ Tldr: abbreviation of “too long; didn’t read,” used to headline a short summary (short pre-action report)

  4. ○ Headlines of several of the Achievements (short pre-action report), for example,

     1. ◾ Think of the children: meme from the animated sit-com The Simpsons

     2. ◾ Why not both?: meme from an old taco commercial

     3. ◾ The fire rises: quote from the Batman movie The Dark Knight Rises

     4. ◾ If I only had one bullet … partial quote from Romanian antisemitic Cornelia Codreanu’s book For my Legionaries

     5. ◾ This is my BOOM-STICK: quote from the fantasy comedy Army of Darkness, part of The Evil Dead series.

     6. ◾ The Eternal Anglo: anti-British meme coined after the antisemitic expression “The Eternal Jew”

• Anime

  1. ○ weeb: a person who likes anime and Japanese culture (short pre-action report)

  2. ○ waifu: Japanese transliteration of English wife, an attractive fictional female (short pre-action report; “Manifesto”)

  3. ○ cat-girl: an anime/manga hybrid of a cat and a woman (“Manifesto”)

These phrases not only demonstrate Balliet’s proficiency in internet vernacular but also place him in a complex network of partially overlapping communities, whose combination serves to circumscribe the perpetrator’s online world. Most of these communities are not extremists, but the far-right has been shown to infiltrate some of the online networks to recruit new members, in particular through the use of humor (see Prologue and Sections 3.2 and 5.6).

To illustrate the way Balliet combines lexicon from all these spheres, we zoom in on two excerpts from the short pre-action report. First, one of the Achievements, see (14):

1. (14) Blue-screened

   Kill a ZOG-bot.

Blue-screened signifies the blue-colored screen shown after a system crash on the Windows operating system. In this context, it is extended metaphorically to cover the death of a victim, here referenced as a ZOG-bot. In computer terminology, a bot is a software application built to communicate with users, but since Balliet is planning a live event, it is likely meant as a derogatory term for someone who mindlessly follows their master’s directions (see the term golem). In using the compound ZOG-bot, Balliet thus signals to both his far-right network and a collective of computer savvy internet citizens. Secondly, the final paragraph of the Plan forms a short summary of Balliet’s plan of action; see (15):

1. (15) Tldr:

   Choose the best way for entry spontaneous. Go in and kill everything.Improvise, if when something goes wrong. Drive away. Kill some more.Repeat until all jews are dead or you prove the existence of Waifus in Valhalla, whatever comes first. Jej.

This excerpt evidences Balliet’s embedding in internet culture through his use of the abbreviations Tldr and jej (see the list of in-group jargon terms), strikethrough (if when) as a humorous indication of self-correcting (see also Section 5.1), and the cross-cultural terms Waifus and Valhalla. This latter combination identifies Balliet as belonging not just to the wider network of anime fans but to a narrower group who are also white supremacists. Valhalla is a term from Norse mythology designating the glorified hall of warriors in Asgard, the realm of the gods. A subset of contemporary followers of Norse mythology (Ásatrú) is “overtly white supremacist, claiming that Ásatrú is the true religion of the superior ‘Aryan race’” (Weber, Reference Weber2018). As summarized by Koehler (Reference Koehler2019, p. 15) in an early study of the Halle attack, “[t]he mixture of Japanese anime culture with Norse mythology is striking and is reminiscent of jihadi promises of 72 virgins awaiting the martyr in paradise.”

However, other parts of the short pre-action report indicate that Balliet did not seek to achieve martyrdom in the form of death (although he may have sought “sainthood” for his actions, see Sections 6.3, 7.2 and 8.4); see (16) and (17):

1. (16) Bonus: Don’t die

1. (17) there’s quite the possibility that I fail to get in and instead spill my spaghetti all over the street [ … ] I would rather prefer to not do that.

Both of these excerpts suggest that this offender may have sought the death of his victims, but not of himself. This leads us to the “need for significance” and how Balliet tailored this to his personal goals.

4.4 The Need

As mentioned in Section 3.2, Balliet’s TVM distinguishes itself from other far-right TVMs in prioritizing weapons testing over targeting certain victim groups and inspiring other attackers. This appears not only in the Objectives list in the short pre-action report but also in the body of the Weapons section; see (18):

1. (18) the whole deal is to show the viability of improvised guns.

The fixed expression the whole deal in (18) means “the point of it all” and we can infer that Balliet is referring to the point of the planned attack. Paradoxically, merely raising the question of the weapons’ viability invites the implicature that they may not in fact function as well as desired (Grice, Reference Grice, Cole and Morgan1975). At the same time, the technical vocabulary used in the Weapons section demonstrates an intense personal interest in mastering the construction of homemade weapons. This reveals that Balliet seeks to gain significance by overcoming one of the obstacles for escalating mass casualty attacks transnationally, namely the restricted access to firearms and ammunition. By providing future attackers with a blueprint to construct their own weapons, it matters less to Balliet whether his own attack is successful and more that his knowledge about weapons assembly is disseminated (see also Sections 3.2, 5.1, 6.3 and 7.3).

Similarly, some of the gaming-style Achievements indicate a resignation to possible defeat, which to some extent contrasts with the notions of heroic martyrdom (Valhalla) and therefore with the violent extremist quest for significance (Kruglanski et al., Reference Kruglanski, Jasko, Webber, Chernikova and Molinario2018; but see Sections 6.3, 7.2 and 8.4 on how he may still have sought “sainthood”). While most of the achievements contain violent verbs (primarily kill) and can be considered pledges-to-harm (Hurt, Reference Hurt2020), the list is bookended by two achievements that simultaneously reflect a determination to execute the plan and a concern for the consequences. The first achievement iconically refers to the first step of Balliet’s plan; see (19):

1. (19) No way back.

   Upload this PDF.

The expression No way back is used in a figurative sense to indicate that a course of action has proceeded too far to be aborted and typically implies a risk of regret. In distinction to most of the other achievements, which are all generic and could take anyone as the agent of the designated action, the imperative phrase in (19) contains a deictic reference to the TVM itself: this PDF must refer to Balliet’s own TVM and it thus directly implicates himself. Uploading, and thereby broadcasting, the TVM counts as the first step in a performative speech act for Balliet, since he in effect declares “I hereby commit myself to this pledge-to-harm” (Hurt, Reference Hurt2020). Making the documents available online puts him in touch with recipients who would have otherwise been oblivious to his plans. It is only in establishing (the preconditions for) this contact that the speech act begins to have social consequences; if there were no recipients to acknowledge the commissive speech act, it would not function as a performative. But as soon as the performative act is accomplished, Balliet is enmeshed in a powerful interactional bond that forces him to continue with his plan, however vaguely defined it is (notably, Germany is one of the jurisdictions in which the act of uploading a TVM is a criminal offense in itself, since it shows intent to carry out a violent attack). It is therefore no trivial matter that Balliet begins by broadcasting his intentions; on the contrary, this communicative act demonstrates his need for significance.

The final achievement focuses more directly on the risk of harm to himself; see (20):

1. (20) I liked that hand …

   Accidentally frag yourself

   with the improvised explosives.

This achievement is unique in this list by containing deictically referring personal pronouns, conventionally pointing to the author (the first-person pronoun I) and the reader (the reflexive second-person pronoun yourself). Both will pragmatically refer to the person who takes up the challenge (in the first run: Balliet), who then can project themselves simultaneously into the semantic roles of agent (I) and patient (yourself) of this action. The simple past liked invites the implicature that the object in question (the hand) is no longer in the person’s possession and that this state of affairs is regrettable. Taken together with the imperative clause and the adverbial Accidentally, this achievement thus places the responsibility for losing a hand on the offender himself. The shift between first- and second-person pronouns is indicative of a split perspective on the action from the inside and the outside, as well as from the immediate and the later future (from where one can look back upon the unfortunate consequences of prior actions). While this last of the achievements does align with the commitment of the rest, it also reveals a lack of confidence in his abilities to successfully carry through the attack, and thus contributes to the self-degrading intonation of the entire TVM. At the same time, the TVM has a humorous tone, which seems intended to offset the overall despondency (also see Section 3.2). This shows that Balliet’s need for significance lies just as much in gaining acknowledgement from his network(s) as in fighting against the purported “population replacement.”

4.5 Conclusion

In this section, we have shown how a text linguistic analysis can explicate the underlying meanings in the language of a TVM to reveal the offender’s narrative, networks and need for significance. The analysis of Balliet’s narrative showed that it aligns with white supremacist population replacement conspiracy theories. The analysis of his networks found that his language displays a strong affiliation with the “extremely online” internet culture, and in particular with the gaming, anime and illicit file-sharing communities. While the gamification of offline behavior does not indicate radicalization, it is an established fact that the extreme right uses gaming forums online to identify possible new recruits (see Prologue and Fizek & Dippel, Reference Fizek, Dippel, Groen, Kiel, Tillmann and Weßel2020). Finally, in the analysis of Balliet’s need for significance, we argue that he tailors his quest to his individual interests and objectives by leveraging his expertise in weapons construction and internet vernacular to gain acknowledgement from his peers. For one, his action objectives appear strategic rather than tactical in the sense that a successful deployment of his homemade firearms and explosives would pave the way for other extremists to construct their own weapons and thereby circumvent the difficulties in obtaining professional guns. Secondly, the effort put into crafting amusing and memetic expressions throughout the TVM shows how important the tone of Balliet’s communications were to his attempt to position himself relative to his networks.

The following section delves deeper into Balliet’s affiliation with the far-right and how it manifests through interpersonal stances in his short pre-action report.

5.1 Evaluations of Weapons and Equipment

In the Weapons and Equipment sections, various weapons are labeled and described with embedded evaluations of their effectiveness and reliability (see Sections 3.2 and 4.4), which are attitudinal stances of appreciation. Appreciation relates to “meanings construing our evaluations of ‘things’, especially things we make” (Martin & White, Reference Martin and White2005, p. 56). While the majority of these tokens are negative, especially as they relate to the weapons’ impact (e.g., basic), quality (e.g., heavy) and balance (e.g., low reliability), there are also positive tokens relating to the evaluation of the weapons’ complexity (e.g., easy to use) and valuation (e.g., effective). Balliet’s predominantly negative evaluations of the weapons display his awareness of their limitations, anticipating potential problems and things that can go wrong. As such, the weapon evaluations contribute to affective stances of (dis)satisfaction.

Balliet’s descriptions of weapons highlight his awareness of this tension between the desired functionality (positive valuation) and lack of efficacy (negative balance). This is perhaps most clear where Balliet uses a typographical strikethrough where the crossing out of words is a way of reflecting the dynamic editing of otherwise static text as in (21):

1. (21) Backup gun if when the Luty shits itself.

This functions to express Balliet’s negative assessment of the weapons as not a possibility, but a certainty, and indexes his own reflections on the efficiency of the weapon. Such epistemic stances are expressed through heteroglossic utterances in which other voices/viewpoints are referenced. The use of the strikethrough displays an awareness of an alternative (the possibility of a weapon malfunctioning) but ultimately contracts to close off the reality of this possibility. Contractive utterances feature prominently in the Weapons section. Although this anticipation for failure would provide a justification for any problems during his attack, the positioning of the weapons as expected to fail sets up a particularly auspicious perception of the weapons should they not fail. That is, the weapons would be seen as beating the odds, and therefore viable. Such stances highlight a main motivating factor for Balliet’s attack; despite the sense of anxiety surrounding the weapons’ viability, Balliet’s objective to use and test them prevails.

The descriptions of the weapons contain highly specific details, including quantified components and measurements as in (22). Such detailed descriptions amplify Balliet’s displayed investment in the discourse, thereby strengthening his commitment to the proffered content:

1. (22) 1x 15 round magazine in the gun, 2x 20 round mags on the right shoulderand 15x 15 round mags in pouches on the chest-rig.

   Loaded with 124 grain soft lead bullets and 7 grain chlorate powder (65/35potassium chlorate/sugar)

While these may be considered monoglossic bare assertions, Gales (Reference Gales, Coulthard, May and Sousa-Silva2021, p. 683) notes that “assertions […] may, on the surface, appear to be monoglossic but still create tension, due to the backdrop of social context or disalignment with the audience” (also see Gales, Reference Gales2011 and White, Reference White2015). Indeed, when contextualized as a TVM and viewed in relation to how other far-right extremists have entextualized language and replicated actions of other far-right perpetrators (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022; see Section 8.4), these statements serve as references and instructions for others to copy or modify. In this sense, Balliet’s statements can be taken up by such anticipated audience(s). Likewise, other audiences that may be disaligned with Balliet (e.g., law enforcement and members of targeted social groups) may be ideologically opposed to his assertations, and these audiences can reflect on these utterances in assessing Balliet’s actions. Thus, for the purposes of this study, considering the forensic context, such surface-level monoglossic utterances are better understood as heteroglossic pronouncements.

The short pre-action report also presents images, which, like the detailed descriptions of weapons, enhance the authorial investment. These images demonstrate a realization of the weapons, such that the weapons are presented as physical objects rather than conceptual, idealized items. The incorporation of these semiotic modes (Keane, Reference Keane2003) in this text makes the weapons “real” by their photographed existence, provoking attitude and texturing evaluative stances (Martin, Reference Martin and Foley2004).

In the Achievements section, as the achievement list unfolds, the targets shift from specified groups of people as in (14) to an unspecified someone. This shift corresponds with a shift in focus towards the type of weapons used, as in (23), and a shift in stances, from evaluations of others (judgment, discussed in Section 5.2) to evaluations of weapons (appreciation):

1. (23) Kill someone with the Smith-Carbine.

As Haberl (Reference Haberl, Eze, Speakman and Onwubiko2020, p. 126) notes, the presence, utilization and glorification of certain weapons can relate to identity building efforts with links to ideology, such that references (and uses) of “the weapon itself can indeed become part of a group’s narrative and identity.” Thus, Balliet’s stances towards these weapons function not only as meaning-creations of the weapons themselves but also as a symbolic tool of ideological alignment with the far-right (see also Luckham, Reference Luckham1984; see Sections 4.2, 6.3 and 7.3).

5.2 Evaluations of Targets

In the Plan section, Balliet provides evaluations of social groups and the physical spaces associated with (and likely to be occupied by) these groups. While we recognize the social significance and consecrated relationship between these spaces and the social groups, we find that Balliet expresses different stances towards them, warranting an analysis that reflects this distinction.

5.3 Evaluations of Plans

Much of Balliet’s discussion of the plan is expressed with irrealis markers, realized as desideratives (e.g., Balliet hopes the grenades detonate). Irrealis markers of (positive) inclination provide insights into Balliet’s desires (understood here as relating to his motivations). Gales (Reference Gales, Coulthard, May and Sousa-Silva2021, p. 680) notes that “[c]odings of irrealis generally relate to surges of behavior and dispositions of desire and fear.” As Martin and White (Reference Martin and White2005) note, irrealis affect (inclination) can be used to look at authorial intention rather than reaction. While expressions of intent do not necessarily equate to psychological intention, we suggest that linguistic manifestations in the context of TVMs, which as discussed previously serve to communicate justifications for violent acts, contain linguistic cues as to the violent intent.

The Plan section contains a number of positive inclination tokens paired with negative tokens of appreciation. This creates a type of push-and-pull dynamic where various behaviors, events and outcomes that Balliet needs, prefers and will try to do are juxtaposed with an awareness of things that could go wrong. This awareness (and expectation) of possible failure is evidenced through multiple tokens of negative appreciation of the plan, (e.g., the plan not being foolproof, and sound[ing] bad). The co-occurrence of irrealis markers (positive inclination) and negative tokens of appreciation relating to the plan contribute to a sense of affective insecurity (see Gales (Reference Gales, Coulthard, May and Sousa-Silva2021) on implicitly invoked evaluations).

Evaluations of the plan are mainly presented through dialogically expansive clauses. This is done through a series of conditional clauses (e.g., If …), disjunctive coordinated clauses (e.g., or, alternatively), probability modals (e.g., could) and hedges and mental-verb projections (e.g., I think, I believe). The high frequency of expansive clauses relating to Balliet’s evaluation of the plan demonstrates low commitment to the specificity of these plans (which does not, however, indicate a low commitment to act on these plans, as evidenced through Balliet’s actions). Such expansive clauses also contribute to a sense of insecurity.

Negative evaluations of the plan display alignment with the far-right in that his assumed failures are not just a problem for him but for the progress of the far-right in achieving their goals, discussed next.

5.4 Evaluations of Goals

As previously noted, the short pre-action report presents a list of goals in the Objectives section and a gaming-type list of achievements in the Achievements section (see Sections 3.2 and 4.4). These future-oriented objectives and achievements are here referred to collectively as goals in that they present Balliet’s expressed intent or purpose. As such, the goals are tokens of desire (positive inclination) towards which Balliet expresses positive evaluations of dis/satisfaction (relating to the pursuit of goals, see Martin & White, Reference Martin and White2005).

Through his stances towards the desired activities, Balliet positions himself as an active participant in accomplishing the goals; he projects pleasure in the desired outcomes of the Objectives: proving (the viability of improvised weapons), increasing (the morale of others), killing (specific people) and not dying. But, as discussed previously, he also demonstrates frustration through dissatisfaction with the weapons, and the things that could go wrong in his plan. These varied stances highlight projected struggles of achieving these goals, which ultimately position them as tokens of positive valuation in that they are worthwhile. Not only do the objectives reflect ideological alignments in what Balliet wants to achieve, but the discursive positioning of them as valuable amongst evaluations of dissatisfaction reflects a strong ideological commitment to these objectives.

The achievements and objectives reveal sometimes competing discourses between his ideologically motivated targets and his ideologically motivated display of weapons. In the Objectives section, these are clearly listed as separate goals. But in the Achievements section, there is a non-delineated shift in what is being appraised as an achievement. In the achievements with specified targets (see (24)), Balliet is positioned as responsible for the success or failure, questioning his capability (negative capacity). However, in the latter achievements that specify the weapons (see (23)), it is the weapons’ effectiveness that determines the success of the achievements. These achievements reflect a relationship between intention and action, in which Balliet has personal agency over only some of the goals.

5.5 Evaluations of the Far-Right Community

The preceding analysis has demonstrated how Balliet discursively positions himself as part of the far-right through stances towards weapons and equipment, targets, plans and goals. This alignment is facilitated by a shared set of values, presented as “common sense.” Those that share Balliet’s expressed ideological perspectives are constructed as the intended reader.

Here, we turn to stances that Balliet takes towards this ideal addressee. Overall, there are few tokens of attitude towards his audience, with the exception of the attitudinally inscribed epithet suppressed (negative capacity) in (7), which presents a value position of how he views other whites. Moreover, in noting that moral[e] needs to be increased, this inscribes an evaluation of negative tenacity in that the morale of this group is low. These judgments of social esteem present an affective stance of displeasure in how Balliet evaluates this group, framing it as a problem to be solved and effectively providing a justification (and motivation) for his planned violent acts. Notably, such explicit justification is limited to this one statement, suggesting that Balliet assumes ideological alignment with the intended audience in that the justification/motivation is otherwise taken for granted.

As mentioned previously, Balliet’s alignment with the far-right is also evidenced through framing himself as part of the in-group of suppressed Whites. Moreover, he expresses alignment through pronominal uses of we in (26) and direct references to readers as you in (25), (27) and (28):

1. (26) After all, if every White Man kills just one, we win.

1. (27) You know what a knife looks like?

1. (28) use 55 g and 10 g and additional 5 ml water if yours is dry and pure.

In (26), the collective group of every White Man serves as the antecedent of we, positioning Balliet as a member of this group. The positive valuation token (win) reflects an ideologically driven collective goal, presenting Balliet as one person amongst others working together. In (25), (27) and (28), Balliet addresses an assumed idealized audience (you), taking for granted who his readers are. For example, he assumes that the reader knows the answer to his rhetorical question in (27), is similarly preparing weapons (and following his instructions) in (28) and may question his target decisions in (25). His propositions are presented as unproblematic and justified by shared ideological frameworks.

5.6 Evaluations of Stephan Balliet

While the preceding analysis highlights insights into Balliet’s presentation of himself (e.g., his feelings, emotions and levels of commitment), the analysis in this section focuses on broader patterns in how Balliet evaluates himself.

One such pattern is the recurring invoked connotations of insecurity. Negative evaluations (appreciation) of weapons, the goals and the plan, together with desires of weapon functionality and pursuing objectives, create an implicit stance of insecurity. This is also presented through Balliet’s negative judgments of capacity of himself, that is, how (in)capable he views himself. Furthermore, Balliet portrays this insecurity through more overt inscribed evaluations through conditional clauses, typographical strikethroughs, hedges, possibility modals and explicit references to failing. These invoked and inscribed stances demonstrate that he presents himself as aware of, and expecting to, fail. Martin and White (Reference Martin and White2005, p. 49) describe (in)security as covering “our feelings of peace and anxiety.” As such, Balliet’s expressions of insecurity are understood as presenting an anxious disposition. This disposition is further discussed in Section 6.3.

As shown in (29), Balliet also provides a physical description of himself through tokens of normality:

1. (29) as a young, fit, white male with blond hair and blue eyes and without tattoos, piercings or other degenerate shit (beside being a weeb) I already look like a terrorist.

In describing himself as a weeb, Balliet evaluates himself with negative judgment. He compares his physical appearance with a negatively appraised description of degenerate shit, which, from Balliet’s perspective, would make his plan more feasible and make him look less like a terrorist. This highlights that for Balliet, perceptions of others are important, and that look[ing] like a terrorist is an obstacle in acting like a terrorist. In labeling himself as a terrorist, he inscribes negative judgment towards himself.

Balliet also presents positive emotional stances of happiness, invoking a sense of humor. This is done through two instances of expressions of laughter (jej) and recurring themes of cruel humor (see Sections 3.2 and 4.3).

Another patterned way in which Balliet evaluates himself is through the almost exclusive use of the grammatical first-person singular, save for the one instance in (25). While he may share an ideological agenda with others of the far-right, he presents himself as alone in his actions. Balliet’s various expressed stances towards himself contribute to an eventual heroic positioning should he “succeed.” Through negative evaluations of his weapons, plans and target location, Balliet positions himself as having to overcome numerous obstacles and expecting to fail, so if he does “succeed,” he wins. This relates to the quest for significance discussion in Section 4. This framing occurs amongst the alignment with the far-right, such that despite acting alone, his actions and goals contribute to ideological aims.

5.7 Conclusion

The appraisal analysis provides insight into Balliet’s constructed intersubjective positioning and interpersonal meanings with his weapons and equipment, targets, plans, goals, audience and himself. These evaluations reveal a dynamic relationship between his ideological framework and his language use expressed through varied attitudinal stances, contractive and expansive utterances, and upscaled and downscaled language. Through these discursive means, Balliet presents himself as aligned with the far-right, demonstrating (ideological) motives for his violent actions.

We reiterate that findings of downplayed investment should not be understood as a reduced threat level. For example, the observation that language evaluating the targets and the plan were downscaled does not imply that the threat is understood as downscaled. Rather, the findings presented here challenge popular beliefs of threatening language in that such “weak” language is sometimes present in these communications (see Gales, Reference Gales2010, Reference Gales2015). This demonstrates that authors such as Balliet rely on a range of linguistic resources to express attitudinal assessments, construct negotiated relationships and identities, and (dis)align with ideological frameworks. As discussed in the following sections, understanding this ideological positioning and how it manifests in language provides insights for our understanding of violent far-right actors and has important implications for improving threat assessment practices and preventing these types of attacks.

6.1 Behavioral Analysis

Lone-actor terrorist incidents generate questions including what in the subject’s background and personality characteristics may have motivated that person to attack innocent people.Footnote ¹⁵ The linguistic data covered in previous sections offers certain clues. This section moves beyond the language evidence created by Stephan Balliet and primarily considers different testimonies from the Halle trial to discuss his life and inform those involved in both researching and investigating lone-actor terrorists about clues that often precede those types of targeted attacks. Some of these violent acts could potentially be thwarted in the future if indicative patterns in the life events, pre-attack behaviors and motives of lone-actor terrorists, along with significant language in their TVMs, can be identified and then reported to authorities (see Section 7).

A logical place to start our behavioral analysis is with an examination of significant life events in Balliet’s background, followed by an assessment of his red flags, triggering events and behaviors he displayed as he moved on a pathway towards violence. Court transcripts compiled by Pook et al. (Reference Pook, Stanjek and Wigard2021) from Balliet’s trial were reviewed, translated, summarized, categorized and analyzed for this section. The perpetrator’s trial was held in Germany where privacy laws specify that only first names of most witnesses are revealed to the public. For some witnesses who were law enforcement officers, only their job descriptions were publicized without revealing their names. The reader will see testimonial information attributed accordingly. Family members are not compelled to testify in Germany, and none of Balliet’s family members did.

6.2 Stephan Balliet’s Background

6.3 Red Flags, Triggering Events and Pathway Warning Behaviors

Studying various factors such as red flags, triggering events and pathway warning behaviors in perpetrators’ lives can help those who analyze these attacks better understand the context in which they are more likely to occur and the psychological factors that are often present when they do occur. However, any single behavior, event or psychological factor is not sufficient to indicate the potential for violent action.

6.4 Conclusion

Balliet’s life was marked by failures in several significant areas. Socially awkward, he was bullied and humiliated in school and the military. Unable to maintain mentally challenging and financially stabilizing work, he also failed to establish romantic relationships with women and even friendships with anyone outside his family. Lacking healthy coping mechanisms, Balliet turned his anger and frustration outward away from his own failures. Instead, he projected blame onto non-Germans and refugees who began immigrating into Germany en masse in 2015. He also blamed Jewish people whom he considered the masterminds of the Great Replacement conspiracy against white men. It appears he may have tried to alleviate his internal pain with illicit drugs, leading to his life-threatening illness that probably only increased his resentment and isolation. Balliet’s alienation, paranoia, entitlement, irresponsibility, lack of empathy and need to blame others likely fueled his racism and radicalization, which led him down the pathway to violence. Tarrant’s attack in 2019 became the catalyst he needed to energize him into action. Constructing his weapons, explosives and ammunition finally gave his life purpose and illuminated, in his mind, a goal worthy of elevating him to the status of a revered figure in the terrorist community. Like Tarrant, Balliet wanted to be admired as someone who could construct death dealing tools and carry out an attack against their jointly perceived enemy, a plan that likely offered some relief from his wounded self-image. Balliet arrogantly boasted of his xenophobic views and the knowledge he acquired on the dark web to the prison psychiatrist, yet underneath he likely was an ashamed, unhappy victim, full of rage, blaming others for the inadequacies in his life. Insecure and displaying abnormalities corresponding to schizoid and paranoid personality disorders, according to the psychiatrist, along with some characteristics associated with psychopathy, he lacked resilience and had woefully inadequate coping skills.

As discussed in the next section, better understanding the dangerousness posed by lone-actor terrorists can assist security authorities in investigating their crimes and potentially intervening in some cases to prevent violence.

7.1 Security Constraints

The attack on the synagogue in Halle is one of a worldwide series of targeted violence events committed by lone-actor terrorists that security authorities and experts from various disciplines have classified as far-right terrorism (Europol, Reference Europol2020; Thorleifsson & Düker, Reference Thorleifsson and Düker2021).Footnote ¹⁶ In at least six attempted or completed mass attacks that occurred between October 2018 and October 2019 in Pittsburgh (US), Christchurch (NZ), Poway (US), El Paso (US), Bærum (NO) and Halle (DE), far-right motives were identified as the main ideology. This is substantiated by (1) the choice of targets (Jewish, Muslim and black communities), (2) comparable patterns in the planning and execution of their crimes (Manemann, Reference Manemann2020; Schattka, Reference Schattka2020; Wahlström, Reference Wahlström2020), and (3) the self-reports published by the perpetrators, namely TVMs (Kupper & Meloy, Reference Kupper and Meloy2021; see Sections 3, 4, 5 and 8).

From a security and statistical perspective, the likelihood of being targeted in a mass attack is minimal as terrorism events are infrequent and have a low base rate (Bundeskriminalamt, 2023; Europol, Reference Europol2023). However, the impact and fear of such incidents remain profound, causing widespread concerns – especially for often-targeted populations – due to their unpredictable nature, severe consequences and societal effects. Some of the potential offenders may display concerning behaviors or commit other crimes prior to their attacks; however, the challenge for security measures lies in detecting individuals who radicalize (online) in near-isolation, and who often plan covertly over extended periods, leaving limited intervention opportunities (see Sections 4.2, 5.2 and 6.3). The central question here is whether assessing the particular dangerousness of these individuals from the available information is possible pre-attack, or if such information justifies intervention by investigative or intelligence agencies.

Subsequent to the Halle event, the actions of security authorities, primarily law enforcement, became the subject of public scrutiny and debate. This prompted a domestic political discourse and resulted in the establishment of the 19th Parliamentary Committee of Inquiry within the state parliament of Saxony-Anhalt, Germany. The Committee’s investigation focused on evaluating the assessment of the threat situation pre-attack, the effectiveness of implemented security measures and the execution of police operations on the day of the incident (Striegel, Reference Striegel2021). Moreover, Balliet’s trial delved into various aspects of his pre-event behaviors, including an exploration of his personality (see Sections 6.2 and 6.3), the police’s investigations of his online and offline preparatory indicators and the authorities’ broader understanding of lone-actor terrorists (Pook et al., Reference Pook, Stanjek and Wigard2021).

The following examination encompasses (1) security authorities’ findings of the threat Balliet posed pre-attack, (2) retrospectively gathered insights into his personality and (3) preparatory digital and on-the-ground behaviors he demonstrated in the lead-up to the event. Notably, Balliet’s radicalization only became apparent through meticulous retrospective analysis, collating information gleaned from court proceedings and subsequent criminal investigations following his act of targeted violence. The report of the 19th Parliamentary Investigation Committee of the state parliament of Saxony-Anhalt (Striegel, Reference Striegel2021) and the documentation of the trial against Balliet (Pook et al., Reference Pook, Stanjek and Wigard2021) served as the basis for this section, along with data from academic studies and publications on the phenomenon of far-right lone-actor terrorism (e.g., Dittrich et al., Reference Dittrich, Rathje, Manemann and Müller2022; Ellis et al., Reference Ellis, Pantucci and van Zuijdewijn2016; Manemann, Reference Manemann2020; Thorleifsson & Düker, Reference Thorleifsson and Düker2021). This review is neither an evaluation of the police work in the run-up to, or on the day of, the attack but intended to assess the information on which the security authorities were able to base their pre-incident actions, and the extent to which the Halle perpetrator showed potential warning signs prior to the attack.

7.2 Challenges in Detecting Lone-Actor Terrorists

Preventing lone-actor attacks is dependent on the early identification of subjects of concern who are a potential threat to national security. At the same time, recognizing indicators of radicalization that precede a serious, targeted violence act is one of the greatest challenges for intelligence and investigative authorities. Particularly when warning indications appear sporadically in various places or are only indirectly recognizable, security agencies often reach the limits of their abilities to detect potential risks at an early stage (see Section 6.2).

Particularly in far-right online ecosystems, shared ideological narratives are visible on various platforms where these types of perpetrators tend to radicalize as hatred is incited and serious acts of violence are advocated (see Prologue and Sections 4.3, 5.5 and 8.4). The communities’ reliance on anonymous access, encrypted communication and platform operators’ minimal content control and reluctance to cooperate with authorities are all key factors in facilitating online radicalization (Gerster et al., Reference Gerster, Kuschta, Hammer and Schwieter2021; Guhl, Ebner & Rau, Reference Guhl, Ebner and Rau2020; Pook et al., Reference Pook, Stanjek and Wigard2021). Perpetrators of the most severe attacks and with the highest kill counts, such as Anders Breivik and Brenton Tarrant, are glorified as saints in virtual forums, reinforcing enemy stereotypes and eliciting allegiance to them (Manemann, Reference Manemann2020; see Sections 4.3, 6.3 and 8.4). The recurring connecting themes in these digital spaces include the idea of an all-controlling “Jewish world conspiracy,” for example, the Great Replacement (see Sections 4.2, 5.2 and 6.3). In particular, toxic ideals of masculinity, along with a desire for a patriarchal, hierarchically organized world under the dominance of white men, play an important identity-forming role for this subculture (Thorleifsson & Düker, Reference Thorleifsson and Düker2021).

Thus, security agencies need to consider the crucial role of digital spaces and online warning behaviors in combination with on-the-ground activities when potential perpetrators mobilize to violence (Kupper & Meloy, Reference Kupper and Meloy2023). Once alarming offline behaviors – such as interactions with extremist groups – prompt reports to authorities, it is vital to examine the individual’s online activities, including social media profiles. A structured approach that explores openly accessible digital spaces with ideological inclinations serves as a starting point for preventive actions (e.g., investigations or ongoing monitoring) to avert potential threats (Amman & Meloy, Reference Amman and Meloy2021; Papadopulos, Reference Papadopulos2022). At this juncture, security authorities grapple with the vast communication avenues used by far-right actors on online platforms, which in itself creates challenges in gathering and evaluating terrorism-related information. Identifying users within digital spaces is complex due to concealment tools and platform privacy policies. Additionally, targeted data acquisition or surveillance by law enforcement demand indications of concrete plans for acts of targeted violence in Germany. Although intelligence agencies have a lower threshold for this type of monitoring, transmitting data on an impending event to the police would occur at a relatively late stage. Hence, preventative law enforcement actions heavily rely on information from bystanders, domestic authorities or foreign intelligence and call for extensive investigative efforts.

7.3 The Halle Terrorism Case

Alongside other attackers in 2018–2019 and beyond, Balliet belonged to a group of lone-actor terrorists who radicalized in far-right digital spaces, both on the clearnet and darknet (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022). This section discusses challenges faced by security authorities when dealing with such offenders, including an examination of Balliet’s behaviors in the run-up to his crime. This is particularly relevant for organizational considerations that involve preventative law enforcement measures, as these are crucial in identifying at what point in time and to what extent information on these types of solo protagonists is available to security authorities pre-attack.

7.4 Consolidated Assessment

As detailed in Section 7.3, the 2018 BKA situational report highlighted a general terrorism threat level from Germany’s far-right extremist spectrum but lacked details on specific threat scenarios (Striegel, Reference Striegel2021). The Pittsburgh (2018) and Christchurch (2019) mass casualty events did not heighten concerns about domestic terrorism in Germany and security authorities deemed such attack scenarios unlikely. Additionally, there were no indications of imminent threats in Saxony-Anhalt or specific security inquiries from the Jewish community regarding Yom Kippur in 2019.

The retrospective assessment of the Halle threat situation raises questions about whether Balliet exhibited any overt security-related behaviors before the attack that could have flagged him as a threat to authorities, both online and offline. However, to identify Balliet as a potentially radicalized perpetrator would have required some form of evidence, which security authorities lacked. Indeed, witnesses testified during his trial that Balliet was socially withdrawn with latent insecurities. His tendency to isolate himself and lack of interaction made it difficult for others to recognize and interpret potential warning signs before the attack.

Balliet’s conduct epitomizes a dangerous blend of far-right extremist ideologies, a validation of violence on his quest for significance and an intense preoccupation with weapons; however, these relevant behaviors were not reported to security authorities. Furthermore, his intentions for planned violence through a terrorism attack were not publicly disclosed until minutes prior to the event, aligning with a common strategy of operational secrecy to maximize the attacker’s success. Even an earlier reported threat involving Balliet using a knife was either concealed or tacitly accepted within his social circle. He managed to hide his weapon design and construction, even from his family, utilizing a 3D printer stored in his father’s house, though parts of the assembled weapons were housed in his parents’ home. The percussion rifle he obtained in 2015 did not trigger security authority intervention as it could be legally purchased without a permit from the age of eighteen and was thus not registered in Germany’s National Weapons Register. Consequently, it was not documented to be in Balliet’s possession; however, even if the weapon had been registered, he likely would not have been detected due to his covert preparatory actions. Although Balliet’s family did not express any concerns about his firearm possession, their stance could not be further explored during the trial as they declined to testify.

Balliet managed to keep his offline activities, including his weapon construction, hidden from detection. However, combining his online engagement in far-right extremist circles, interest in past attackers, equipment procurement and focus on potential targets could have raised alarms for security authorities if he had already been flagged as a concern by authorities, such as Germany’s domestic intelligence agency. Individually, and acknowledging our hindsight bias when drawing these conclusions, these factors might not have triggered assessments, but identification within a politically motivated group could have prompted surveillance measures, for instance. Regardless, Balliet did not fit this profile and had not drawn attention as a potential threat, and pre-incident detection was almost impossible in this case. Despite the analyses in Sections 3, 4 and 5, which identified Balliet’s alignment with the far-right, his TVM was not available to security authorities pre-attack, as it was only disseminated minutes prior to him driving to his target location, thus providing no time for intervention.

7.5 Conclusion

Stephan Balliet represents a lone-actor terrorist who submerged into an expansive global far-right online community as an anonymous user where he underwent unnoticed radicalization within a very limited offline social circle until carrying out an act of targeted violence. The Halle case demonstrates the legal and factual limitations of preventative measurements if concerning behaviors are not recognized and reported to security authorities that can assess the level of risk an individual might pose. Despite the challenges encountered by security authorities, there are potential strategies to address the threat of lone-actor terrorists. Studying the behaviors, actions and communications – and particularly the movement from online to on-the-ground preparatory activities – in a structured approach helps identify potential traits and patterns. In addition, improved information sharing between investigative and intelligence services aids in early threat detection and mitigation.

The next section evaluates the impact of preceding lone-actor attacks on the Halle shooter and the uptake of Balliet’s attack and communications in different online ecosystems of the far-right.

8.1 The Contagion and Copycat Effect

Within the world of terrorism and threat assessment, intertextual links and references between targeted violence perpetrators’ communications have been tied to contagion and copycat effects, as evidenced in the writings of offenders that committed ten seemingly unrelated transnational far-right terrorist attacks, including the Halle incident (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022).Footnote ¹⁷ Contagion alludes to the imitation of the violent act in an acute period – usually several weeks – following a publicized mass casualty incident (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022). Copycat refers to a chronic phenomenon – generally extended over months or years – and involves the imitation of both the act and actor (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022; van der Meer, Meloy & Hoffmann, Reference Van der Meer, Meloy and Hoffmann2017). Kupper et al. (Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022) corroborated the emergence of a new, complex genre set of different interrelated text types that has become increasingly consolidated in form and function, consisting of TVMs and live-streams, attack announcements on online platforms and writings on equipment utilized during the attacks. The strategic goal of inciting others to violent action with do-it-yourself guides for lone-actor attacks is part of the authors’ terror orchestration, intended to circulate ideological motivations, operational strategies and tactical advice in furtherance of inspiring the next imitator (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022; Kupper, Reference Kupper2022). The presence of shared lexical and structural components across these types of language evidence indicates the traceable links between the consumption of violence-justifying content and self-radicalization in the online sphere (Kupper, Rękawek & Kriner, Reference Kupper, Rękawek and Kriner2023). This intertextuality between perpetrators signals that they study previous TVMs and live-streams and use them as templates during the planning and preparation, mobilization and implementation phases (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022). In other words, the illicit genre set of TVMs and live-streams is taken up by subsequent far-right terrorists (Bojsen-Møller et al., Reference Bojsen-Møller, Auken, Devitt and Christensen2020; Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022). In the following section, we outline the framework of uptake (Freadman, Reference Freadman, Coe, Lingard and Teslenko2002), which forms the basis of our analysis of the intertextual links and the immediate and later uptakes – reactions and responses – that followed the Halle attack.

8.2 Uptake as Intertextuality

Genres are intertextually connected to other genres or to manifestations of the same genre. This means that genres influence each other in a multitude of ways, for instance by indirectly referencing or even directly quoting earlier utterances. These interconnections are called uptakes (Freadman, Reference Freadman, Coe, Lingard and Teslenko2002; see also Bojsen-Møller, Reference Bojsen-Møller2021). Uptakes are defined as all explicit reactions and responses that a given genre receives. As such, they are “part of the perlocutionary domain” of utterances (Bojsen-Møller, Reference Bojsen-Møller2021, p. 101), which has to do with “the feelings, thoughts, or actions of the audience” (Austin, Reference Austin1962, p. 101). The term uptake was originally coined by Austin (Reference Austin1962), but we use Freadman’s (Reference Freadman, Coe, Lingard and Teslenko2002) understanding of uptake, which is primarily inspired by Bakhtin’s (Reference Bakhtin, Emerson, Holquist and McGee1986) concept of dialogism (see Section 3.1 on addressivity). Dialogism refers to the fact that all utterances are inherently dialogic, which means that they will likely receive responses and reactions from others. Such uptakes can consist of responses from the audience, for instance in the form of expressions of outrage towards an utterance, direct intertextual references or links to preceding utterances belonging to the same genre.

Uptakes can roughly be divided into immediate and later categories, which may vary considerably (Bojsen-Møller, Reference Bojsen-Møller2023) as demonstrated in the following. Since the genre of TVMs is intrinsically linked to the author of the documents and, if realized, to the act of targeted violence that follows it, our analysis will not only focus on uptakes of Balliet’s communications but also on uptakes of his attack and references to his name. In accordance with this, Freadman (Reference Freadman2020) argues that the agent (the author) of a genre, the genre itself and the social action that the genre is tied to, all coincide. This claim is substantiated by the fact that intertextual links and references between perpetrators can be tied to contagion and copycat effects (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022).

In order to assess a possible contagion and copycat effect across and beyond Stephan Balliet’s attack, we conducted a manual, qualitative content analysis of the offender’s written and spoken language evidence and examined the transcripts from his court trial (Pook et al., Reference Pook, Stanjek and Wigard2021). This was completed to analyze any potential intertextual links, that is, uptakes, to other targeted violence communications connected to acts of violence that preceded this incident. For the second part of the analysis, we investigated four sets of data: (1) different types of targeted violence communications from terrorism incidents that succeeded the Halle shooting; (2) archived threads from several imageboard forums that were obtained from extremism research colleagues; (3) over 200 channels on Telegram; and (4) numerous testimonies from the Halle trial. This was conducted to analyze how Balliet’s communications and his attack were taken up by others in different online settings.

8.3 Uptakes by Stephan Balliet

The contagion and copycat framework laid out in Kupper et al. (Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022) suggests that perpetrators often:

• reference names of notorious same-genre authors in their TVMs or on the weapons they display during live-streams;

• copy structural components and cite, rephrase or plagiarize textual elements from previous writings or recordings; and/or

• include self-interviews in a Q&A format in their communications that mirror self-interviews made by other targeted violence offenders.

In comparison to preceding and succeeding lone-actors that committed attacks motivated by far-right sentiments, Balliet’s publicized written and spoken language evidence does not entail any direct references to names of infamous predecessors or explicit citations from previous texts. However, his unpublished self-interview titled Your F&A Guide – the German equivalent of Q&A guide – includes an explicit example of the copycat effect and was inspired by previous self-interviews in terms of layout and structure.

Brenton Tarrant’s attack in New Zealand was one of the triggering events that mobilized Balliet to violent action (see Sections 6.3 and 7.3). It is perhaps unsurprising that the only clear reference to a previous attacker across all of Balliet’s materials is a direct mention of Tarrant in his self-interview in (30):

1. (30) Is there anyone you want to thank?

   Yes, Brenton Tarrant.

   Before his glorious Operation, I was nearly completely black-pilled about

   the future. Around the great brown flood in 2015 I first started to gear

   up.Footnote ¹⁸ […] But seeing that Mad Cunt lighting up dozens of ragheads like

   an ancient avatar of war lit up something inside me I thought was long

   gone, maybe even never really there in the first place. I can only

   describe it as the faint echo of our racial soul. Yeah, maybe whites have

   already lost, maybe there is no hope. So what? If we are destined to

   vanish, why not go out fighting?

In this quote, he directly explicates how Tarrant’s attack and ideological stance have been primary sources of inspiration for his own act of violence. This copycat effect is also reflected in the structure of the self-interview, which includes intertextual links to earlier instances of the genre: In terms of structural components, the entire Your F&A Guide consists of twenty-three questions, two of them being identical to Tarrant’s Q&A in his TVM: Who are you? and Are you a Racist? (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022). Balliet’s self-interview is thus both structurally and ideologically an uptake of previous examples of the genre of Q&As written by targeted violence offenders.

8.4 Uptakes of Stephan Balliet’s Communications and Attack

8.4.2 Later Uptakes

Uptakes by Subsequent Lone-Actor Terrorists

The legacy of the communications and actions associated with attacks such as Balliet’s are in a tradition of those aspiring to achieve the admired status of saints within the militant accelerationist movement, which celebrates successful lone-actors in far-right online ecosystems such as Terrorgram and “the chans” (Kriner & Ihler, Reference Kriner and Ihler2022; Kupper, Rękawek & Kriner, Reference Kupper, Rękawek and Kriner2023). Terrorgram “is a loosely connected network of Telegram channels and accounts that adhere to and promote militant accelerationism” (Kriner & Ihler, Reference Kriner and Ihler2022), blending the words Telegram and terrorism.Footnote ²⁰ Militant accelerationism is “a set of tactics and strategies designed to put pressure on and exacerbate latent social divisions, often through violence, thus hastening societal collapse” (Kriner, Reference Kriner2022), a belief that is often utilized by the far-right to advance solo terrorist actions. As Macklin (Reference Macklin, Dafinger and Florin2022, p. 224) has explained, the “dark fandom” of saints or martyrs within this online far-right ecosystem (see Sections 4.3, 6.3 and 7.2) is comparable to the heroization of school shooters and serial killers. It therefore moves beyond the copycat aspect and evolves into a cultural script for others to follow (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022). After the New Zealand mosque shootings, the perpetrator Brenton Tarrant was immediately valorized within the far-right online milieu and started being compared to medieval saints in memes and other forms of online images (Macklin, Reference Macklin, Dafinger and Florin2022).

Since the act of violence in Halle in October 2019, we identified two lone-actor terrorists that directly referenced Balliet in their targeted violence communications, which again shows that both the physical acts of violence and the textual products of terrorism offenders are imitated and taken up by subsequent copycats. The most clear-cut example of Balliet’s influence and impact on successive attackers is the case of Hugo Jackson, who, motivated by far-right sentiments, stabbed one of his teachers with nonfatal injuries at his school in Eslöv, Sweden (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022). During his interrogation, Jackson stated that he was inspired by Brenton Tarrant, Stephan Balliet and Anton Lundin PetterssonFootnote ²¹ (Lunds Tingsrätt, 2021). Several direct, intertextual uptakes of Balliet’s live-stream, as well as references to his name, were evidenced in Jackson’s targeted violence communications (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022):

• A quote from Balliet’s live-stream was written on Jackson’s bedroom wall: “Hi my name is Anon, and I think the holocaust never happened. Feminism is the cause of decline of the West which acts as a scapegoat for mass immigration and the root of all these problems is the Jew” (Lunds Tingsrätt, 2021, p. 159).

• Copying his idol Balliet, Jackson live-streamed his attack on Twitch and also uttered the words “Ah, Scheiße” (the German equivalent of “oh, shit”) twice, a direct reference to Balliet’s broadcast, who used identical words when his equipment malfunctioned (Lunds Tingsrätt, 2021, p. 473).

• Balliet’s name was written on the skull mask worn by Jackson during the incident (Lunds Tingsrätt, 2021, p. 183).

The quote on the bedroom wall creates an intertextual link to the ideological stances of Balliet, that is, that he has a strong antipathy towards feminism, mass integration and Jewish people – all themes of the Great Replacement conspiracy theory (see Sections 4.2, 5.2, 6.3 and 7.2). The fact that whole sections (“Hi my name is Anon […]”) and even specific German phrases (“Ah, Scheiße”) that Balliet used are repeated by Jackson shows how linguistic imitation and imitation of acts of extremist violence often go hand in hand. The reference to the Halle shooter’s name on Jackson’s skull mask is likely a way of paying homage to Balliet as a hero and to treat him as one of the saints of the far-right extremist community.

The second perpetrator that referenced the Halle assailant multiple times is Payton Gendron, who conducted a mass shooting at a supermarket in Buffalo, New York, in May 2022 (Kupper & Meloy, Reference Kupper and Meloy2023). Gendron makes three references to Balliet in his online diary, which he disseminated on Discord – a messaging platform popular amongst gamers – approximately thirty minutes prior to his attack. These references are not uptakes of the language of Balliet but, rather, uptakes on his act of violence and references to his name (see (31) and (32)):

1. (31) Jimboboiii – 03/11/2022 […] Mistakes will be made. Stephen Balliet and John Earnest are examples. […] What’s important is to honor these men who at least tried, and to learn from their mistakes so future attackers don’t repeat them. Stephen’s mistake was that he had improvised weaponry that didn’t work and couldn’t make it in the synagogue.

1. (32) Jimboboiii – 03/11/2022 [discussing which names to write on his firearms that would be used during the act of violence] I had Stephen [Balliet] and John [Earnest] removed from this list because they were unsuccessful, but I’m keeping them in because they had the balls to fight back

While Gendron thus primarily focuses on the fact that Balliet’s weapons did not work properly during the attack, he does also praise his bravery and chooses to glorify his actions by writing Balliet’s name on his weapon of choice. This kind of uptake, referencing the author of a text, can be seen as a metonymic way of referencing the person’s actions and communications, which is then part of the same uptake chain.Footnote ²²

In addition, there is a direct uptake of one of Balliet’s communications in Gendron’s TVM, namely a reference to the Halle shooter’s live-stream (see (33)):

1. (33) Tools

   GoPro Hero7 Black:

   This is the tool that would live stream the attack on Twitch. I chose Twitch because:

   1. 1. It was compatible with live streaming for free and all people with the internet could watch and record.

   2. 2. A previous attack was recorded on Twitch (Halle Synagogue Shooting) that lasted about 35 minutes, which for me shows that there is enough time to capture everything important.

In (33), the importance of being able to “capture everything important” is mentioned as the primary goal in Gendron’s uptake of Balliet’s live-stream. This confirms Kupper et al.’s (Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022) conclusion that live-streams are crucial instruments of propaganda for far-right terrorists.

Lastly, it has been argued by Kupper et al. (Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022) that Gendron modeled his Goals section after Balliet’s Objectives segment, and also copied other structural components from his TVM, such as adding pictures of his firearms that would be deployed during the shooting, along with the headline The Weapon and a description of the gun, in his writings. It can be anticipated that all of these documents will inspire and incite further acts of violence within the far-right sphere. The uptakes by Hugo Jackson and Payton Gendron verify that both the modus operandi and the communications of previous attackers are studied by subsequent terrorists for a successful implementation of an impending event. However, while Gendron only mentions Balliet’s name and live-stream, Jackson quotes his TVM and live-stream directly.

Uptakes on Terrorgram

Balliet’s name and references to his attack, TVM and live-stream continue to be circulated within far-right online ecosystems. Schwarz testified that users on Telegram were also quick to circulate content on the Halle attack in the immediate aftermath of the shooting (Pook et al., Reference Pook, Stanjek and Wigard2021). Several screenshots of Balliet’s live-stream and direct quotes from the perpetrator’s broadcast were initially disseminated to glorify the act of violence and express support for his efforts. However, Schwarz later noted a shift to labeling the assailant a “loser,” rejecting him because he killed two Germans (Pook et al., Reference Pook, Stanjek and Wigard2021, p. 591 and 593). Lone-actor terrorists with less successful attacks than perpetrators such as Robert Bowers, Brenton Tarrant and Patrick Crusius are often “mercilessly mocked and lampooned” in the form of memes that highlight pitfalls (Macklin, Reference Macklin, Dafinger and Florin2022, p. 226). However, some of them are still declared saints by the Terrorgram community, likely to keep the momentum going and support even failed attackers to continuously incite others to violence (A. Ritzmann, private communication, December 2023). Although Balliet failed to claim instant saint status, it was awarded to him at a later stage by the Terrorgram community, despite his low kill count but because of his high efforts to encourage further acts of lone-actor terrorism.

A corpus of 318 Terrorgram channels and 1,864,007 messages that were composed between March 23, 2017 and June 6, 2024 was analyzed for this study by CEMAS (Center for Monitoring, Analysis and Strategy), a nonprofit organization that examines right-wing extremism, disinformation and conspiracy theories. A concordance search for “Stephan Balliet” revealed that references to the Halle shooter intermittently surfaced in posts since October 2019 (see Figure 2).Footnote ²³ The highest number of mentions in 2021, 2022 and 2023 occurred in the month the attack was carried out, October, likely as a form of remembrance. Balliet has also been officially included in several “Days of Action” saint calendars, which highlight specific dates relevant to the names of lone-actor terrorists associated with the militant accelerationism movement, providing details of their respective attacks, for example, date and kill count. Further mentions on Terrorgram included news articles about Balliet’s trial and attempted escapes from prison. Other channels linked him to articles related to Mr. Bond, a neo-Nazi musician, who was arrested in 2021, because Balliet played one of his songs during his live-stream. In other posts, the perpetrator was labeled “Saint Brenton Tarrant’s 4th Disciple,” which designates him as one of the assailants that succeeded Tarrant’s attack and who made a reference to him. These uptakes directly signal a belonging to this community and highlight a strong copycat and contagion effect of these events.

Figure 2 Terrorgram posts related to Stephan Balliet.

Additionally, Balliet was lionized in Terrorgram’s White Terror production, a twenty-four-minute video that was released on the Telegram channel White Terror on October 14, 2022. The documentary celebrates 106 individuals for their attacks on a diverse range of targets that occurred from April 1968 to May 2022; some of these perpetrators are depicted as having achieved sainthood within the Terrorgram community (Accelerationism Research Consortium, 2022). Particular praise is attributed to perpetrators who live-streamed their attacks, which will likely encourage future broadcasts of targeted violence acts (Kupper & Dittrich, Reference Kupper and Dittrich2024). Theoretically, the difference here between what we could call “uptake as saint” and “uptake as loser” of Balliet shows the complex and unpredictable nature of uptakes; an author can never fully anticipate the reactions that may follow their utterance.

8.5 Conclusion

In this section, we have evidenced a variety of responses and reactions that occurred in (1) Balliet’s targeted violence communications, (2) several online far-right ecosystems, including “the chans” and Terrorgram, and (3) different genre sets of subsequent lone-actor terrorists associated with the militant accelerationism movement.

Balliet only made one direct reference to a preceding attacker (Brenton Tarrant) in an unpublished Q&A-style document. However, his attack and targeted violence communications had an indisputable influence on two subsequent lone-actor terrorists (Hugo Jackson and Payton Gendron) during their radicalization, mobilization and implementation phases, as can be seen through their uptakes of his name, TVM and live-stream.

Moreover, Balliet’s act and communications were heavily taken up by digital communities in comparable sequences: First reactions and responses focused on the Halle attack itself in the form of written comments on imageboards and messenger apps. Later, this evolved into the dissemination of Balliet’s TVM and live-stream, which either occurred in distributing the original materials, or spreading them in the form of direct quotes, screenshots, memes and other visual formats, thus creating complex intertextual chains. We note that such later uptakes had different evaluations of Balliet’s attack, which were expressed with distinct terms and memes. These two contrasting themes formed a discourse battle between praising and ridiculing the perpetrator and the event. All of these examples not only illustrate an interlaced network of uptakes across different text types but also a strong contagion and copycat effect in the community of saint-pursuing emulators with the goal of inciting violence in the form of a mass casualty events.

9.1 Forensic Linguistic and Threat Mitigation Takeaways

Stephan Balliet carried out his attempted mass casualty event solitarily and, in this sense, he can be classified as a lone-actor terrorist.Footnote ²⁴ Nonetheless, the common thread linking the findings of our analyses is his yearning to be part of something larger: the intricate, online far-right ecosystem where assailants with a high kill score are lionized as saints. His language delineates the communities that he aligns with and orients towards, with his separate communications deliberately constructed to form intertextual links – both internally within the genre set and externally to a plethora of discourse contexts and online subcultures that he makes relevant in his writings. In all its complexity, Balliet’s TVM functions as a Rorschach test of co-alignment with his intended audience: Those who recognize and respond to the pattern of overlayed objectives and in-group references will be able to take up the mantle from him and continue on the quest to counter the Great Replacement through acts of violence.

The genre analysis accentuated the communicative functions of Balliet’s TVM by examining the genre labels he used, which shed light on the motivations behind his writings and – thus indirectly – behind his attack. The analysis detailed how he tailored his document towards his desired audience by choosing to prioritize his self-made weapons and operational plans with insider knowledge and darkly humorous elements to engage with his readers. The genre section also yielded important takeaways for threat assessment professionals: A self-deprecating, humorous tone and lack of details regarding planning an attack in the communications of a possible future violent terrorist should not be taken as an indication of low probability of a realized attack.

The text linguistic section revealed that Balliet’s TVM signaled in-group membership in a network of partly overlapping communities: adherents of far-right conspiracies, weapons constructors and the “extremely online.” In addition, his objectives were assessed to be strategic rather than tactical, that is, providing a template for other extremists to construct their own weapons, and thus encouraging further attacks. The text linguistic analysis also provided the significant result that weapons and violence fascination can trump specific targets or extremist ideologies for far-right terrorists. It also underlined how internet citizenship and affiliation with online gaming communities play an important role in lone-actor terrorism cases, which confirms findings in the genre section regarding the importance of connecting to an in-group.

The appraisal analysis provided insight into how Balliet’s expressed stances demonstrated his ideological framework, his alignment with the far-right and his insecurities regarding his own abilities and chances of success. Through the expressed stances, it became evident that his belief system overpowered his rationality, for instance when selecting his primary target location, the synagogue. Additionally, the stance section offered the important insight for threat assessment professionals that a subject’s expression of insecurity regarding their own abilities or beliefs in the viability of their plan for a targeted violence act is not an indication of reduced threat level. This corroborates earlier research that finds mitigating language to be present in realized threats and pledges to harm (Gales, Reference Gales2010, Reference Gales2015; Hurt Reference Hurt2020).

The retrospective threat assessment emphasized that Balliet was a loner that did not have any real-world friends and only communicated with close family members, despite his interactions with various online communities. It also showed that it was not until Brenton Tarrant conducted his mass shooting in March 2019 that Balliet felt elevated to conduct his own targeted attack against their jointly perceived enemies. Moreover, the behavioral analysis yielded critical information on some of the red flags and warning indicators that family and friends might recognize and act upon before a targeted violence attack, that is, Balliet’s far-right sentiments, social isolation and previous violent incidents. The information on his issues of self-esteem is in line with the findings of self-deprecating and insecure language use in the genre, text linguistic and stance sections, and his lack of empathy is also evidenced in the genre section.

The organizational review highlighted that Balliet was not on the radar of any intelligence or investigative agencies in Germany as he was able to shield his online and offline preparatory activities from the external world. This was mainly due to his overall low visibility and secrecy in planning the attack, since no concerning behaviors had been recognized or rather reported to authorities. Balliet was not recognized as being part of an extremist movement, had no criminal history and did not test his weapons outside of his family environment. Hence, he was not singled out as a subject of concern by security agencies and remained below a threshold for preventative law enforcement measures. This corroborates the findings of the threat assessment section that the public is the first line of defense in the fight against mass casualty events.

The uptake analysis considered how actual readers and intended audiences responded and reacted to Balliet’s attack and utterances by creating intertextual links to his TVM and live-stream in different online ecosystems, such as “the chans” and Terrorgram. Furthermore, it was corroborated how subsequent far-right terrorists have taken up the Halle shooting in their targeted violence communications that were associated with attempted and executed mass casualty events. Lastly, the uptake assessment showcased the vital significance of the interconnectedness and intertextuality between violent attackers, thereby further evidencing the circle of contagion and copycat effects on multiple levels (Kupper et al., Reference Kupper, Christensen, Wing, Hurt, Schumacher and Meloy2022). The analysis confirms findings from the genre, text linguistic and stance sections regarding the importance of in-group connections in the Halle terrorism case.

9.2 Concluding Remarks

Looking backwards in the form of a retrospective analysis allows us to move forward in our aims of detecting and preventing future acts of targeted violence. Overall, the results depict a scene of a secluded male who methodologically moved along the pathway to violence in secret and silence, meticulously preparing for his act over several months. In his quest for significance and in the fight to “save” the white race against the conspiratorial Great Replacement, Balliet followed in the footsteps of preceding attackers while simultaneously paving the way for succeeding copycats. In addition to aligning himself with his in-group of extreme right online subcultures, the Halle shooter disaligned with his targeted out-groups, particularly non-whites “threatening” the existence of his ethnic group. This ideological framework is reflected both throughout his targeted violence communications and modus operandi of the attack when he selected preplanned and spontaneous targets. Having a diverse range of targets not restricted to any specific location, but rather reflective of where out-group populations frequent, allows transnational violent actors to deem and evaluate local target locations as appropriate. Within the far-right belief system, different victim groups can be selected to counter the alleged Great Replacement, such as the Jewish, Muslim and black communities, which all became targets during the Halle attack. Even though his plan to kill Jewish and Muslim people failed, Balliet’s rampage resulted in killing other random victims. Seeking an end to his misery, Balliet created even more suffering – for his family, the families and friends of those he attacked and any future victims of those who may choose to copy his behavior. This highlights the critical importance of studying lone-actor terrorists, like Balliet, and sharing knowledge gained about their behaviors and writings, in the hope of preventing future attacks.

Signs of personal grievances and extreme ideologies that might evolve into a desire to conduct a targeted attack might be intercepted by bystanders becoming upstanders in advance (Federal Bureau of Investigation, 2015). Families, friends, coworkers, classmates and other non-law enforcement observers tend to be the first to detect concerning behaviors when an individual moves along the pathway of intended violence and can act as an early warning system if the threat reporting is destigmatized. Thus, it is imperative to continuously educate the general population about risk factors and warning behaviors, for instance in the form of workplace violence workshops or instructional events at educational facilities. The careful observation and reporting of such indicators are essential to assist intelligence and investigating authorities in assessing the level of threat of an impending attack, formulating mitigation strategies and therefore preventing these types of terrorism attacks. This is accentuated by the fact that most perpetrators disseminate their TVMs or links to live-streams in the minutes or hours prior to an attack, which tends to result in no time for intervention.

9.3 Limitations and Future Research

All data are retrospective and thus subject to the authors’ hindsight and confirmation biases. We have attempted to mediate this concern with careful assessments and discussions and numerous systematic, internal peer-reviews of each section by all six authors. To enhance the reliability and validity of the study, we focused on primary sources created by Balliet for the forensic linguistic analyses; however, the threat assessment and organizational review relied on secondary sources, which introduces perceptual biases. Lastly, the confidential nature of the Your F&A Guide file limits the replicability of the analysis.

The data and findings of this Element provide a wealth of ideas for future studies. For instance, we originally intended to analyze Balliet’s targeted violence live-stream, particularly the bilingual code-switching between English and German. However, we decided to predominantly focus on the written language evidence in this Element and will publish our findings from the analysis of the spoken corroboration in a separate study. Furthermore, we intended to explore the inherent tension between the dynamic interplay of security and freedom of speech when working in a threat assessment context to mitigate future acts of targeted violence. This becomes particularly relevant when examining the intervention thresholds for preventive police measures within the legal framework “freedom, security and justice” from the European Union. These assessments will also be published as separate projects.