On 25 March, a 13-year-old student carried out a stabbing attack at his middle school in Trescore Balneario, near Bergamo, Italy. The attacker deliberately targeted his French language teacher, seriously injuring her, before being subdued by other school staff and later arrested. Despite suffering severe stab injuries, the teacher was subsequently discharged from the hospital.
The student streamed the stabbing attack on a Telegram channel, using an improvised harness to turn his mobile phone into a body-worn video (BWV) device. On the same channel, which had been created the day prior to the stabbing and where the attack had been announced, the attacker published a short English-language manifesto – titled “the Final Solution” – as well as other “propaganda” material. In a search of the suspect’s residence, police reportedly found materials that could be utilised as precursors to manufacture explosives.
This Insight analyses the Trescore Balneario attack and its placement within extremist subcultures online, particularly in non-English-speaking countries. It then focuses on the changing extremist threat landscape in Italy and highlights current policy gaps that could complicate Preventing and Countering Violent Extremism (P/CVE) efforts.
The Insight argues that the current Italian legislative framework is insufficient to address cases like the Trescore Balneario attack, in that it has severe deficiencies in its approach to extremist ideology and lone-actor extremism. While the Insight focuses on Italy, several European states share common threats and vulnerabilities, making some of its points more broadly relevant.
Aesthetics Before Ideology, Uniqueness and “Cosplaying”
Compared to other cases of school attacks, such as the Eslöv, Antioch, and Evergreen incidents, the Trescore Balneario attacker had a relatively limited online footprint. Nevertheless, the media he published and shared demonstrates a close affinity to online, “post-ideological” extremist subcultures such as No Lives Matter (NLM) and the True Crime Community (TCC), using shared lexicon and terminology (the phrase “no life matters” appears in the manifesto). Other language, including claims of “superiority” over his classmates, could hint at a link to incel subcultures, as they apparently mirror the language used by the Isla Vista attacker in his diary/manifesto (arguably the “template” for incel-related violence over the past decade).
Most of the visual media published by the attacker is preoccupied with aesthetics. On the Telegram channel he created, the attacker showcased different possible “outfits” he would wear during his attack to the other users. His eventual choice of clothing included a t-shirt inscribed with the word “Vendetta” (also used as the name of the channel, which has since been closed), camouflage trousers, and a skull mask, mirroring outfits worn by previous lone actor terrorists (skull masks are a staple of far-right extremists; the attacker, however, distances itself from them, only claiming that he chose the mask because of its aesthetic appeal). In the manifesto, the attacker claims that this choice of clothing is not random but serves as a “uniform”, a point further reinforced by his choice of weapon: a knife inscribed with the word “soldier”.
Figure 1: Pictures shared by the attacker on Telegram. From l-r: the weapons the attacker planned to use (the BB gun was not used in the attack), the t-shirt worn by the attacker, and a message shared by the attacker with a “proposed” outfit (note the improvised smartphone harness).
Finally, the attacker posted a selfie with a ‘puppy filter’, telling other channel members to use it in “edits”. This last point demonstrates an expectation, common to several attackers and most explicitly embodied by Saints culture, that sympathetic communities will expand the reach of violent actions by turning their perpetrators, and indeed the violence itself, into a meme, to facilitate its repetition. The images described above, as well as fan art of the attacker (some using an aesthetic copied from Saints culture and Terrorgram), have been largely shared on TikTok (see figure 2) by several accounts (not solely Italian) with links to NLM and TCC.
The content glorifying the attacker, in which he is portrayed as a “Saint”, demonstrates how similar acts of violence can rapidly accumulate followings, and motivate potential imitators. Little more than a week after the attack, a 15-year-old was arrested for reportedly pledging to carry out a copycat action in Arezzo, Italy. “Fan” communities, particularly on Telegram and TikTok, have produced a considerable amount of material glorifying the attacker, often borrowing from the Saints’ “registry”. Such content is in direct violation of TikTok’s policies on Violent and Hateful Organizations and Individuals, which do not permit the promotion of such behaviours and actions.
Despite these performative aspects, the Trescore Balneario attacker repeatedly claims a degree of independence, explicitly describing himself as unique, and writing, for instance, that his actions are not a “copycat of any previous school attack” nor that he is linked to a specific ideology. He further pre-emptively dismisses the “natural selection” trope – a reference to the 1999 Columbine shooting – again reiterating his self-ascribed uniqueness.
Figure 2: “Fanart” and edits of the attacker shared on TCC-linked accounts on TikTok after the shooting. Portraying attackers next to their “kill count” is a common TCC “template”. The picture on the bottom left is linked to Saints propaganda – where attackers are portrayed holding their manifestos as if they were “scripture”.
These two elements – the “cosplaying” of previous attackers, freely “borrowing” from nihilistic extremists, far-right attackers, and school shooters, and the constant reiteration of a personal uniqueness – are evidently contradictory. However, this contradiction is far from novel – several recent attacks, such as the Antioch, Jakarta, and Eskişehir incidents, were perpetrated by individuals whose chosen aesthetics, performed identities, and ideologies were extremely dissonant. These attackers, as with the one in Trescore Balneario, almost certainly sought to create this discursive contradiction as part of their efforts to confer meaning on their attacks.
Italy’s P/CVE Approaches and Blind Spots
The Trescore Balneario incident is likely the first successful school attack linked with Nihilistic Violent Extremism (NVE) in Italy. It follows, however, several thwarted attack plans. These include the March 2026 arrest of a 17-year-old for planning a Columbine- and Neo-nazi accelerationism-inspired attack at his high school in Perugia, and that of a 15-year-old in February 2025 for planning a 764-linked attack in Bolzano. The last notable lone actor terrorist attack in Italy was the 2018 Macerata shooting, carried out by a self-radicalised neo-Nazi who deliberately targeted migrants, injuring six people. The Trescore Balneario case, however, is qualitatively different from the Macerata attack and showcases significant developments in the country’s extremism threat landscape.
As of this writing, Italy lacks a coherent P/CVE structure to guide responses to cases like those in Trescore Balneario, Bolzano, and Perugia. The following section highlights three key weaknesses in Italy’s counterterrorism effort: the lack of attention to lone actors, a restricted, entrenched focus on jihadism, and the lack of interest in deradicalisation programmes for children and young adults.
Italy’s contemporary legal P/CVE framework is built on three pieces of legislation (“Decreti Legislativi”, or “DL”): the 2001 DL n. 374, the 2005 DL n. 144, and the 2015 DL n. 150. All three were introduced in response to major terrorist attacks by jihadist groups, and, as such, reflect an exclusive preoccupation with organised terrorist groups. In doing this, they restrict their categorisation of terrorist profiles to only operating within hierarchical systems. For example, the 2015 law recognises the importance of Internet-driven radicalisation, but mostly links it to the phenomenon of foreign fighters and thus to vertically coordinated recruitment structures. This, moreover, makes technology only an “instrument” of terrorism, while online subcultures of nihilistic violence and other forms of contemporary extremism show that devices and online platforms play a fundamental meaning-conferring role. While presumably falling within the “terrorism” category, lone actors are not conceptualised independently or coherently.
In focusing primarily on transnational, jihadist terrorism, Italy’s P/CVE initiatives have lacked solutions to apply within schools and other environments where self-radicalisation is, today, increasingly a threat. Where deradicalisation initiatives have appeared, they have mostly been ad hoc at the regional level, resulting in uneven territorial coverage and a lack of coordination among state institutions. Moreover, these have mostly targeted detention facilities, with a rehabilitative, rather than preventative focus. As a 2024 summary by the Italian Observatory on Radicalism and Counter-Terrorism (ReaCT) notes, Italy has “not adopted national strategy or legislation on P/CVE.”
These weaknesses have been further exacerbated by the failure of several proposed reforms, such as a 2017 draft law which would have introduced structures such as the National Centre on Radicalisation (CRAD) and regional Coordination Centres on Radicalisation (CCR), responsible for developing national strategy documents and creating a uniform structure to address the issue. Still, while moving past local and ad hoc initiatives, this proposal (amended versions of which were put forward in 2018 and 2021), still largely focused on jihadist terrorism, and within a group-level scope.
Conclusion and Policy Recommendations
The Trescore Balneario attack and the thwarted attack plans that preceded it point to a growing threat from forms of terrorism that increasingly involve children and young adults; this cannot be sufficiently addressed by Italy’s current P/CVE framework. The attack follows several other thwarted plots, and it is highly likely that further NVE-adjacent attacks could take place in Italy, in line with similar trends that can be observed in non-English-speaking countries.
Italian authorities should reevaluate definitions of terrorism, shifting away from ideology and towards behaviour-centric approaches. This is in line with recent analyses published by the EU Knowledge Hub on Prevention of Radicalisation, which have increasingly highlighted the NVE threat within young demographics. Italian officials should invest in increasing knowledge-sharing efforts with EU and extra-EU partners, including Canada, the UK, France, and the Netherlands, that have better-established frameworks in place to address these threats.
Second, Italy should invest in diversifying its institutional framework for dealing with domestic terrorism. Re-purposing structures such as CRAD and CCRs, as envisioned by the 2017 draft law, could prove valuable to better coordinate responses across different regions and ensure a more coherent adoption of P/CVE measures at different levels of governance.
Finally, addressing the challenges posed by new forms of terrorism will almost certainly require greater cooperation between state and non-state actors, including civil society groups and private companies. Pierre Sivignon highlights “the relevance of a ‘public health approach’ to nihilistic violence, focused on reducing ‘risk factors’ and strengthening ‘protective factors’ at individual and societal levels, rather than on ideology or at-risk groups”. Such an approach cannot be solely state-directed: local community referents – including school staff, families, friend groups – can be effective at spotting early signs of radicalisation and violent ideation, and should be supported holistically to ensure their ability to report cases safely. Online platforms have a fundamental role, likewise, and authorities should reinforce their cooperation with them to identify online radicalisation vectors – including communities, narratives, patterns of engagement, and other “pipelines” – and to create mechanisms to encourage vulnerable users to seek assistance, while respecting their right to privacy.
—
Manfredi Pozzoli is a master’s graduate in International Affairs at LSE and SciencesPo Paris. His research interests include the intersection of social media and terrorism, especially in the context of Europe and North America.
—
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.