Content warning: This Insight contains mentions of suicide and terrorist violence.
Introduction
An assailant injured at least five people with a knife in a tea garden in Sehit Rustem Demirbas Park, Eskisehir, northwestern Turkey, on 12 August. Police apprehended the 18-year-old suspect within a few minutes of the violence starting. He was dressed in camouflage trousers and an assault vest, helmet, goggles and skull mask, and also reportedly carried an axe. Video footage and images circulating on social media of the attacker show that he wore the neo-Nazi “black sun” insignia on his vest.
A nearly three-minute video filmed via a body-mounted camera circulated on multiple online platforms following the attack. Archived versions of a Kick account, shared via Telegram, indicate that it was likely originally live streamed there, although some Turkish press outlets have said that it was streamed via X. The footage shows the suspect filming themself before approaching a group of people sitting in the courtyard, attacking people seemingly at random with a knife. The assailant attempts to flee the area but is apprehended by a group of men and the video cuts out. This Insight analyses the manifesto associated with the alleged attacker and its manifestations in the online right-wing extremist ecosystem.
The Manifesto
A 17-page Turkish-language document reported to be a “manifesto” produced by the perpetrator includes several potential indicators of the suspect’s potential ideological influences, including several clear references to a militant accelerationist ideology. On its front page, it includes the logo of the Schutzstaffel (SS), the paramilitary organisation of Nazi Germany, and the Atomwaffen Division logo is included later in the document. It pays tribute to the perpetrators of several right-wing violent extremist attacks, including the Oklahoma City bombing in 1995; the right-wing terrorist attacks in Utöya, Norway in 2011; a far-right sword attack at a school in Trollhättan, Sweden in October 2015; the Christchurch attacks in New Zealand in March 2019; and a gun attack at a synagogue in Halle, Germany in October 2019.
Screenshot of an image included in the manifesto linked to the attack.
The document is replete with other sentiments indicative of right-wing extremism. The author describes themselves as a “national socialist”, and rails against “blacks, feminists, leftists, communists, kurds” and “every other degenerate person”. Its title, “Mass Cleaner Manual”, is likely a reference to ethnic cleansing in a broad sense, but may also be a more specific reference to the neo-Nazi group “The Cleaners”, who murdered more than 15 people with knives and hammers in the Moscow and Yaroslavl Oblasts of Russia between 2014 and 2015.
Other references in the document indicate a broader range of influences and support for even more indiscriminate forms of violence, that of other right-wing terrorists. The author of the document expresses a general support for acts of mass murder and even the annihilation of the human race via “nuclear apocalypse”. The manifesto also paid tribute to the perpetrators of the 1999 Columbine school shooting and the mass shooting in Las Vegas, Nevada, in 2017.
The document’s author explicitly states that they were motivated by misanthropy and a desire to kill themself and “as many insects” (a reference to people) as they could. In response to the question “what kind of society do you want” in a Q&A section reminiscent of the Christchurch attacker’s manifesto, the author answered: “a dead society”. The document also indicates support for the anarcho-primitivism espoused by Ted Kaczynski, known as the Unabomber, who mounted a string of anti-tech mail bombings in the United States between 1978 and 1995.
There are several gaming references throughout the document. Its author sets out three “difficulty levels” with regard to acts of mass violence and includes a long list of suggested targets where large crowds of people are likely to gather. It starts with “easy” targets such as schools, care homes, parks, churches, mosques and synagogues, where “the number of insects that will oppose you is almost zero”. In the “intermediate” category are hospitals, malls, theatres, train stations and universities. Airports, government buildings, police stations and military bases are rated as “difficult” based on the increased likelihood of a rapid law enforcement response. It awards “points” to different pieces of equipment if used by prospective future attackers, and to the number and type of casualties inflicted. The author indicates their desire to be included on the list of “saints” populated by other right-wing terrorist attackers in recent years.
Digital Footprint
Some Turkish press reports have linked the perpetrator of the attack to an online alias, “skreewie”, a name used to sign off the manifesto document and to circulate it on Telegram. The document appears to have originally been shared via a Telegram account of the same name on 12 August to a channel of nine members called “THD” (Total Human Death), based on a screenshot circulating online. The post linked to the Kick account, two Mediafire folders, and a private Telegram group, alongside the message “come see how much humans I can cleanse”. The Kick account had been removed by 13 August, but an archived version of it on 12 August suggested it had just one follower at the time of the livestream.
Despite it likely not receiving a significant number of viewers on Kick, unredacted copies of the video spread widely elsewhere online in the 24 hours following the attack, including via the accounts of mainstream media outlets. Some attracted hundreds of thousands or even millions of views before a limited number were removed during the day on 13 August. It has also been shared across multiple platforms, particularly those that are popular with right-wing extremists.
The Mediafire folders shared by the initial Telegram message were identical; the second was described as a “backup”, presumably to mitigate the impact of one of them being removed. In the folders were 17 PDFs, including previous right-wing terrorist manifestos from the US, Norway and New Zealand; publications from the “Terrorgram Collective”; instructional material on building explosives or improvised munitions; Mein Kampf; the Unabomber manifesto; Siege by James Mason; and other right-wing extremist publications.
The folders also included five images of an individual who appeared to be the same person as in the live stream, and a copy of the manifesto. The manifesto had been downloaded 214 times as of the evening (BST) on 13 August. The files had been last modified on Mediafire on 7 August, suggesting that they had been hosted there for almost a week prior to the attack taking place. Another copy uploaded to the Internet Archive was taken down on 13 August.
A Meme ridiculing the attacker, shared on TikTok on 13 August.
The nature of the content’s initial circulation suggests that the attacker may have had assistance from another person. The files hosted in the Mediafire folder were also shared on X by an account called “Total Human Death”, which claimed to be owned by a “friend” of skreewie. A second account with the alias “Hansen” also forwarded the original Telegram post. On Vidlii, where there was also a skreewie account, Hansen was its only follower, although 16 other users have since followed the account. Skreewie had favourited videos on Vidlii, including an edited version of the Christchurch attack livestream and a graphic murder video originally created by Ukrainian serial killers, the Dnepropetrovsk maniacs. A skreewie account on Steam had an image of Breivik as its profile picture, and had posted reviews for a variety of war-focused video games between March 2021 and August 2024. On the day before the attack, the account reviewed the First-Person Shooter (FPS) video game “Receiver” as being “good for practising gun handling virtually”. An account on Roblox under the name of skreewie has been blocked by the company, although was still visible in API calls as of 14 August. It was created in 2019. A skreewie X account, which had also been removed, followed 12 other users, including Roblox.
Members of a pro-suicide forum identified an account as having been owned by the perpetrator in the evening of 12 August, although they did not provide evidence beyond the username, which matched the name given by the author of the manifesto. The account had started or engaged with several threads on the forum in April and June 2024, including to share their self-harming and suicidal thoughts. If confirmed to have been owned by the attacker, the accounts activity suggests that they may have initially considered killing themself, rather than mounting an attack on other people.
Context
The attack in Eskisehir is the latest indication that the threat of international militant accelerationist terrorism is not an exclusively Western phenomenon. A local teenager of Indian ethnicity was arrested in December 2020 in Singapore, for example, on suspicion of plotting an attack inspired by the Christchurch shootings. There have been a string of attacks on schools in southern Brazil by individuals exhibiting support for neo-Nazism. And domestic right-wing extremist groups operate in Turkey, including the neo-fascist paramilitary group, Ataman Kardeşliği (Ataman Brotherhood), or the ultranationalist far-right organisation, Grey Wolves. However, there is not yet any evidence to suggest that the perpetrator of the attack in Eskisehir was linked to either of these groups.
The perpetrator stated in their manifesto that they wanted to be “included in [the] list” of “saints” already populated by other notorious right-wing terrorists. But few in the right-wing violent extremist online ecosystem have celebrated the attack. Instead, the perpetrator has been largely ridiculed in spaces like on Telegram, 4chan and KiwiFarms, either based on an assumption that the attacker was non-white, or on a perception that he failed to inflict as many casualties as other right-wing terrorist attacks.
Conclusion and Recommendations
The preliminary evidence covered in this Insight refutes what are likely to be overly simplistic claims in the Turkish press that the attacker was ‘inspired by a video game’. The complex relationship between gaming and violent extremism has been well documented, particularly by the Extremism and Gaming Research Network (EGRN). The picture built up by available evidence in open-sources suggests that the attacker was likely influenced by a much more diverse range of factors than just ‘video games’ whilst using digital platforms.
Available information on the attack and its perpetrator suggests that they fit with a long-standing trend in which some attackers demonstrate interest in a range of ideologies including right-wing extremism, misanthropy and a broader nihilistic fascination with extreme violence. Although more information on the perpetrator and his motivations will likely be released in the coming days and weeks, and this Insight has focused almost exclusively on preliminary digital evidence, the material covered in this Insight suggests that he likely engaged with a range of terrorist, extremist or otherwise violent content prior to mounting the attack, including on platforms where such content has proliferated.
This incident has also highlighted the long-standing role played by some mainstream press outlets and social media commentators in disseminating and amplifying unredacted graphic or inciteful material produced by violent extremist actors. Reporting on these incidents is in the public interest, but there is also a public interest in respecting the dignity of victims and in reducing the availability of materials that play a role in radicalising vulnerable individuals to violence.
This attack and the related spread of violent material online indicates that the threat of live streamed violence by individuals inspired by militant accelerationism and other ideologies is both persisting and diversifying internationally. Material produced by these networks continues to be posted simultaneously on a diverse range of platforms, large and small. These ecosystems call for holistic approaches to countering terrorist and extremist content that are not solely focused on any one platform. Regulators should feed primary data related to the frequency and volume of violent extremist content on specific platforms – and the effectiveness of platforms’ responses – into their assessments to help prioritise their time and efforts. Collaboration with researchers and non-governmental organisations is crucial in this regard.
The tech industry and the public sector should continue their efforts to improve the speed and scope of their responses to crisis incidents like in Eskisehir. This should include continuing to strengthen cross-platform, cross-industry and cross-jurisdictional communication and coordination, particularly via organisations like the Global Internet Forum to Counter Terrorism (GIFCT), the Christchurch Call Foundation, and Tech Against Terrorism.
Arthur Bradley is a freelance open-source intelligence specialist who focuses on the exploitation of digital platforms by terrorists, violent extremists, and other hostile actors.