Folk studies are not a source of analysis often used in the P/CVE space. However, the field is littered with cases that highlight how collectively told narratives can shape and drive human behaviour from online engagement to offline participation with violent consequences.
The clearest example of this phenomenon occurred in 2014 in Waukesha, Wisconsin, when twelve-year-old Anissa Weier and Morgan Geyser led their friend and classmate, Payton Leutner, to a nearby woods and stabbed her 19 times. The girls claimed to have done this as a way of participating in a myth they read about online called “The Slender Man.” The Slender Man is an example of creepypasta – a form of collaboratively developed social-media fiction designed, in part, to appear as posts by real people online. The girls stated that they carried out their attack to become proxies, or acolytes, for the Slender Man – believing him to be a real entity they could summon through the sacrifice of their friend.
The attack, which became known as ‘the Slender Man stabbing’, gained international notoriety due to its shocking nature, but also the blend of digital culture, memes, and fiction. In its wake, police and governors issued numerous warnings to parents about the dangers of unfettered online access. Using folk frameworks allows us to draw parallels between the Slender Man stabbing and threats posed by Nihilistic Violent Extremist (NVE) actors today via the common threads of collective narrative, group participation, and individual offline actions.
This Insight examines acts of violence arising from ideologically diffuse online environments through the lens of ostension. Ostension is a term used in linguistics and folk studies to mean the representation of a thing in itself; to indicate the point where an idea, phrase, or narrative graduates from telling to acting out. This Insight will use the term to explore the nature of participation in narratives disseminated within emergent online networks and subcultures, using the True Crime Community (TCC) as an example. Here, we demonstrate how the concept of ostension allows us to understand and map the escalation from content consumption to content production to offline action. It further seeks to demonstrate how strategic narratology can support policymakers and practitioners in countering ideologically diffuse extremist communities by conceptualising online-to-offline escalation as a shift from symbolic narration to ostensive performance of the narrative itself.
Folk Frameworks
The case of the Slender Man stabbing highlights two key concepts relevant to the contemporary digital threat landscape: legend and ostension. Folklorist Bill Ellis describes contemporary legends as “normative definitions of reality” (p.202) that are communally navigated. In a foundational study on the satanic panic of the 1980s and 90s and its influence on real-life murder investigations, Ellis demonstrates how local fears, national anxieties, and narratives feed into what are known as ‘legend complexes’. In his view, folklore exists
[…] not simply as verbal texts to be collected, transcribed, and archived. They are also maps for action, often violent actions. Our conception of folklore, therefore, must be expanded to consider the ways in which legends reflect both what has “really” happened but also what a person or persons can make happen. (Ellis, 1989, p.218)
Linda Dégh similarly calls for the sensitive treatment of legends, noting that they are readily available (and ideologically sensitive) collective sense-making genres in modern society. She warns that “the legend, even if it is not founded on reality, can create reality” (p.5). Legends are powerful tools in collaborative and communicative sense-making of our world, providing descriptive narrative frameworks that codify actions into communicative blueprints, influencing behaviour as they are disseminated.
This power of legends to “create reality” at the collective and individual levels leads us to define our second key concept: ostension and ostensive action. Ostension, in its folkloric context, is defined by Dégh and Andrew Vázsonyi as the real-life occurrence of events previously described by a legend via the practice of acting them out in real life. Relevant to our examination, Dégh and Vázsonyi highlight legends that precede and help prompt harmful acts. For example, copycat murders that follow legend narratives that are formed around a single original murder.
Ostensive Action in the True Crime Community
The concepts of legend and ostensive action are of critical importance to the emergent ideologically diffuse digital threat landscape, the most notable elements of which are the Nihilistic Violent Extremist milieu and its adjacent subset, the True Crime Community (TCC). Viewing the behaviours of these groups through the lens of legend and ostension provides a framework for understanding how online communal narratives can drive offline action.
The TCC has been described by the Institute for Strategic Dialogue “as one of the most significant contributors to acts of public violence in the United States and around the world.” The TCC is a broad, cross-platform online network of individuals who are fascinated by real-world acts of violence, serial killers, and perpetrators of mass-casualty attacks. This fascination often consists of a re-telling of killers’ actions, focusing on the minutiae of their attacks and iterating and re-emphasising various aspects over time.
While engagement and fascination with TCC varies, the extreme end of the spectrum exhibits an obsession with and valorisation of the act of these attacks, reducing violence to aesthetic action. Common through-lines are extracted from their artefacts, such as disaffection, nihilism, and a disdain for humanity or society at large, and attackers are discussed with a celebrity-like fervour.
Figure 1. A TCC video reading the journals of the Columbine attackers as an ASMR source.
Figure 2. The landing profile of a page producing romantic videos dedicated to Abundant Life Christian School attacker, Natalie Rupnow.
The creation, circulation, and consumption of memes, images, lore dumps, and videos all constitute participation in the TCC’s legend complex. These forms can be understood as symbolic, memetic communication, what Limor Shifman defines as a “collection of texts sharing content, form, or stance” (p.41) intended for circulation, iteration, or imitation. Artefacts from killers that generate attention and interaction by the TCC, such as manifestos, footage, and online footprints, become artefacts that feed into a narrative that functions, as Ellis describes, as a “map for action.”
Ideologically disparate figures, ranging from the Columbine shooters through to the mass-attackers of Sandy Hook (2012), Christchurch (2019) and beyond, are unified under the TCC legend, becoming folk heroes, characters, and part of the wider ‘lore’. This TCC legend complex allows participants and would-be attackers to create a bricolage of motivation, blending the community’s map for action with personal grievance. In her analysis of the October 14th Bandar Utama school stabbing in Malaysia, Munira Mustaffa illuminates this function, examining how an “active selection of content” symbolic of the TCC legend complex was integrated into the suspect’s driving internal narratives. Using a manifesto, popular TCC references, and ‘extremely online’ terminology indicates that the attack was, in part, an ostensive act – an attempt to participate in the TCC legend complex.
Participatory Memetic Ostension
Ostensive action explains how carrying out an attack is a way for individual actors to participate in the collective TCC legend complex and tell their narrative through action. The Abundant Life Christian School shooting in December 2024, carried out by 15-year-old Natalie Rupnow, can be examined through this lens. Rupnow was active in the TCC, and her activity within the community provides insight into how legend and ostensive action shape behaviour. Soon after the attack, an older selfie of Rupnow circulated online, showing her wearing a T-shirt identical to a T-shirt worn by Columbine shooter Eric Harris. Rupnow’s selfie can be read as layered communication; both symbolic (in which the T-shirt functions as a signifier for being a fan of the Columbine shooters rather than the band KMFDM) and ostensive (in which, by wearing the T-shirt, she was acting as Eric Harris – participating in TCC’s mass shooter legend).
Of course, Rupnow’s ultimate ostensive act was the attack itself. In following the TCC legend’s map of action, Rupnow’s act both actualised the legend and inducted her into it. Members of the TCC have since replicated the photo she posted immediately before her attack, both as their own ostensive enactment of the TCC legend and as a declarative act of affiliation.
The lenses of ostensive action and legend allow us to understand the reciprocal nature of TCC participation in a second attack just one month later, in January 2025, when 17-year-old Solomon Henderson opened fire at Antioch High School in Tennessee. Like Rupnow, Henderson was following a map of action built on the legend complex of prior mass shooters as a narrative through target selection, means of attack, and writing of a manifesto. His social media footprint revealed an individual ‘plugged into’ the TCC and wider NVE spaces, and it is very likely that he shared online subcultural spaces with Rupnow.
In his examination of Henderson’s diary and manifesto, Marc-André Argentino shows a journey that is distinctly narrativised, participatory, and memetic. Henderson demonstrates a deep knowledge of mass killers, both infamous and niche, and an understanding of a variety of ideological tributaries. However, as Argentino notes, the overall emphasis of Henderson’s manifesto is “extreme polylateral hate, attacking multiple demographic groups with no coherent unifying ideology.” Although inconsistent ideology complicates traditional approaches to understanding violent extremism, viewing these acts through folk legend and ostension allows us to interpret perpetrators’ actions without misrepresenting their motives. Henderson’s attack, like Rupnow’s, was an ostensive enactment of the narratives in his manifesto, drawn from his participation in violence-obsessed online communities like the TCC and wider NVE milieu.
As a more recent example of participatory memetic ostension, on 7 November 2025, a 17-year-old perpetrator set off bombs at State High School 72 in Jakarta. At the time of writing, motivations and drivers for the attack are still under investigation. However, the attacker’s online footprint and attack demonstrated clear ostensive actions as well as more commonly understood symbolic reference. While the method of attack was via homemade explosives, the attacker carried replica firearms adorned in phrases referencing previous attacks and white supremacist ideology, a practice popularised by Brenton Tarrant, with the replica nature of the weapon demonstrating its importance in the ostensive action over its practical offensive inclusion. In addition, his clothing featured a t-shirt with the phrase “Natural Selection” and empty green tactical webbing; an outfit that was worn by Eric Harris. Finally, prior to his attack, he posted himself doing an ‘OK’ symbol, acting out Rupnow’s final post to indicate his aims via ostensive action (showing rather than telling).
Figure 3. The ‘OK’ symbol posted by the State High School 72 attacker. Note also the hashtags and choice of accompanying song.
Each of the attackers detailed above made and posted real-life acts of ostension and symbolic memetic action prior to their attacks; be that selfies wearing clothing associated with previous attackers, seeking out and listening to associated music or other media, or making reference to the symbology of the wider TCC legend complex. As such, a pattern and model for countermeasures can be developed from a folk-forward behavioural analysis.
Conclusion: Towards Participatory Memetic Violence
The use of folk frameworks for analysis enables a deeper understanding of the connection between narrative, community, and individual actors in violence-fascinated online spaces. The TCC’s fascination with mass casualty attacks creates a legend complex that serves, for some, as a map of action, sustained by online participation and memetic symbols and representations.
When a community’s legend involves a patchwork of violent attacks, the only way to extend that legend ostensively is by repeating or adapting those acts of violence. The ever-evolving language of the TCC legend-complex, and similar legends of the wider NVE milieu, presents a significant challenge for both law enforcement and platform trust and safety teams. As such, the principles of folk narrative perpetuation (group participation, repetition, action and iteration) can be used to define this distinctly online subcultural violent phenomena. To assist in the understanding of such a complex online threat that challenges our common frameworks of ideological adherence, we have developed the following definitions of what we call Participatory Memetic Violent Extremism.
Short definition:
Participatory Memetic Violent Extremism (PMVE) is violence enacted as a symbolic statement of affiliation with or participation in groups that valorise violent or transgressive action, either as an end in itself or for its perceived social and cultural significance, in lieu of any clear strategic, political, or ideological goal.
Full definition:
PMVE is a form of extremism that places an emphasis on violence as an end in itself, rather than as a means to further a political or ideological agenda. To PMVE communities, violent attacks are viewed as a symbolic rite that adds to a collective mythos based solely on socially transgressive action.
Communities involved in PMVE often deploy a diffuse (and sometimes self-contradictory) combination of ideological and online culture symbols. These are used as references to signal subcultural participation rather than ideological affiliation.
The use of in-group signalling combined with the symbolic nature of an attack itself means that actors without prior affiliation with PMVE communities can still carry out attacks in dialogue with these groups that can then be referenced in the future by others.
These definitions shift the emphasis away from classification based on group identity, which can be imprecise or rely on an understanding of closed group networks and affiliations, towards concrete semiotic signals with an understanding that such signals can be appropriated by any actor rather than those with prior affiliation with an online network.
As such, moderation frameworks can be developed based on the strength of participatory signals across social media platforms. This will allow for a more holistic understanding of how the legend of PMVE attacks is engaged with and iterated on online. Further study through this lens could focus on identifying participatory signals that imply an ostensive shift in an actor’s behaviour, allowing for intervention before symbolic participation online becomes violent participation offline.
Effective countermeasures rely on skilled analysts and practitioners who understand and can ‘speak’ the language of violence fascination, transgression, and particular manifestations of online nihilism. The aim of PMVE and the frameworks detailed in this insight is to equip those in the field with a grammar to assign to the ever-growing set of references that bleed from online to offline.
It is our hope that reframing these emerging, ideologically diffuse online threats through the relationship between narrative, group, and individual participation, rather than through the search for a unified ideology, will offer a better way to understand them. This can help inform a shift towards behavioural models of detection based on the formation of legend complexes as unifying narratives, which are then participated in to varying degrees by different actors.
–
Dr. Joe Ondrak is lead subject matter expert in hate groups for Resolver and principal consultant at Peryton Intelligence. He specialises in digital extremist behaviours, semiotics, and online culture.
Laura Vitelli is a social media intelligence analyst and independent scholar researching connections between extremism and digital culture.
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.