Violent extremist ecosystems increasingly persist online despite sustained moderation efforts by technology companies. Individuals who formally disengage from extremist movements—whether through incarceration, deradicalisation programmes, or personal exit—often remain connected to, or re-engage with, the same digital environments that previously shaped their worldviews (Morrison et al., 2021; De Roos & Caon, 2026).
This presents a distinct challenge for platforms: ‘How do you distinguish between those who have genuinely disengaged from those who still hold extremist views beneath the surface?’
Current moderation systems are designed primarily to detect policy violations – direct incitement to violence, terrorist content, or explicit hate speech. They are less equipped to identify the subtle, coded signals of ideological persistence that may indicate risk of re-engagement or backsliding. This gap leaves tech companies without a working mechanism for understanding post-release online behaviour.
This Insight proposes a framework for identifying online ideological markers that may signal continued engagement with extremist ecosystems after disengagement, while remaining consistent with platform governance standards and data protection norms.
The framework is designed as a foundational stepping stone – the initial phase of a larger vision for evidence-based extremism prevention. By establishing baseline indicators and ethical parameters, it lays the groundwork for a continuously evolving knowledge system that will ultimately enable technology companies to refine their prevention methods with empirical data from incarcerated populations.
For the purposes of this framework, the term “extremist” refers exclusively to violent extremists – including jihadist and far-right violent extremist actors – who advocate for or engage in violence to achieve political, ideological, or religious goals. The framework is designed to be ideology-agnostic, applicable across violent extremist ecosystems while excluding non-violent extremist groups.
The Adaptive Nature of Online Extremist Ecosystems
Understanding post-disengagement behaviour requires examining how extremist ecosystems function and adapt online. Three interrelated dynamics are briefly summarised below:
- Platform Literacy and Moderation Evasion – Extremist actors develop a sophisticated understanding of platform governance, using coded language, memes, and symbolism to evade detection (Saltman & Hunt, 2023).
- Platform Switching and Multi-Platform Infrastructure – Extremist communities maintain coordinated presence across multiple services, migrating after deplatforming rather than disengaging. (GIFCT, 2023, p. 13; UNICRI & VOX-Pol, 2025, p. 22).
- Structural Moderation Gaps – Enforcement varies by region and language, with fewer restrictions in the Global South and less attention to non-English or audio-based content (UNICRI & VOX-Pol, 2025, pp. 8, 15, 28).
Post-Disengagement Exposure in Online Environments
The transition from incarceration or formal disengagement to community reintegration occurs against a backdrop of persistent online extremist infrastructure.
Formerly incarcerated individuals often return to digital spaces where extremist networks remain active. They may re-encounter ideological networks through routine platform use, as these networks maintain a continuous presence through adaptive strategies (GIFCT, 2023, pp. 5-7).
In contexts where formal reintegration support is limited – particularly in the Global South – online communities can become primary sites of social connection, making it difficult to distinguish healthy reintegration from ideological re-engagement (UNICRI & VOX-Pol, 2025, p. 34). Platforms consistently struggle with content that is ideologically concerning but not explicitly violative – the ‘grey zone’ of extremist expression (GIFCT, 2023, p.4).
A Framework for Identifying Online Ideological Markers
The following framework proposes five categories of indicators that technology companies can use to assess whether post-disengagement online activity may signal ideological persistence. These categories are designed to be evaluated in combination, recognising that patterns of behaviour carry greater significance than isolated indicators.
- Symbolic Markers
Symbolic markers encompass the coded language, memetic content, and ideological iconography that function as in-group signalling within extremist communities. As documented in research on far-right aesthetic adaptation, these include seemingly innocuous references that carry hidden meaning for those initiated into extremist subcultures (Tuters & Hagen, 2024, p.5). Identifying symbolic markers requires moving beyond keyword analysis to understand the visual and cultural vocabulary of contemporary extremism.
- Network Markers
Network markers are about how a person’s online relationships and connections can indicate whether they remain connected to extremist ecosystems. Research on platform switching demonstrates that indicators include repeated interaction with known extremist accounts, participation in ideological clusters, and cross-platform follower relationships that persist despite individual account enforcement (Tuters & Hagen, 2025, p.268; UNICRI & VOX-Pol, 2025, p. 22).
- Behavioural Markers
Behavioural markers capture how individuals navigate platform ecosystems in ways that suggest ongoing connection to extremist networks. Drawing on findings on split communication strategies, indicators include: migration between platforms following enforcement actions against affiliated accounts, systematic engagement with propaganda-dissemination channels, and participation in coordination spaces (Galen Lamphere-Englund, 2025, p. 15; UNICRI & VOX-Pol, 2025, p. 22).
- Aesthetic and Cultural Markers
Aesthetic and cultural markers encompass visual symbolism and cultural references embedded in extremist discourse that may signal affiliation without explicit ideological statement. Research on far-right aesthetic adaptation documents the appropriation of historical or pop cultural imagery and participation in aesthetic subcultures that serve as entry points for extremist ideology (Tuters & Hagen, 2024, p. 24). This category directly addresses GNET’s thematic priority on understanding the behavioural and aesthetic markers of online subcultures of nihilistic violence.
- Contextual Markers
Contextual markers capture environmental factors shaping extremist engagement. Research documenting regional disparities in moderation and the growth of audio-based extremist communication indicates that markers include migration toward lightly moderated platforms, reliance on voice-based communication to evade detection, and language usage patterns that exploit enforcement gaps (UNICRI & VOX-Pol, 2025, pp. 8, 15).
Methodology: Developing the Framework
The framework presented below was developed through a three-step process designed to ensure empirical grounding and practical relevance for technology companies.
Step 1: Metric Development – Drawing on existing research into extremist adaptation (Tuters & Hagen, 2019, p.10; UNICRI & VOX-Pol, 2025), five categories of online ideological markers were identified: symbolic, network, behavioural, aesthetic, and contextual. These categories reflect observed patterns of how violent extremists maintain presence across digital platforms post-disengagement.
Step 2: Longitudinal Data Collection – The framework is designed to be validated through ongoing data collection with incarcerated populations, capturing ideological orientation at prison intake, mid-sentence, and pre-release. This longitudinal design enables comparison between individuals who participate in rehabilitation programmes and those who do not.
Step 3: Continuous Refinement – The framework is not static. Findings from periodic data analysis will be fed back to technology companies, enabling iterative refinement of indicators as extremist tactics evolve. This creates a living knowledge system rather than a one-time framework.
Operationalising the Framework Through Responsible Technology
For tech companies, translating this analytical framework into operational capabilities requires investment in detection systems, cross-platform collaboration, and privacy-preserving technologies.
Multi-Modal Detection Systems
Effective identification of ideological markers requires combining multiple analytical modalities. Platforms should integrate text analysis capable of detecting coded language, image recognition trained on extremist visual culture, audio analysis to address growing voice-based communication, and network mapping to identify relational patterns. Partial examples of these systems exist. For instance, Meta and YouTube have deployed automated systems for text, image, and audio-based moderation in counter-terrorism contexts (Meta, 2023; YouTube, 2024). However, fully integrated multi-modal systems combining all four modalities simultaneously remain largely aspirational rather than standard industry practice. The following recommendation, therefore, stands as a forward-looking goal.
The growth of audio-based extremist communication, documented in recent research, underscores the need to move beyond text-only moderation (UNICRI & VOX-Pol, 2025, p. 15).
Cross-Platform Intelligence Collaboration
Given extremists’ reliance on platform migration and distributed infrastructure, individual platforms cannot fully assess risk without awareness of activity across services. Collaborative threat intelligence sharing – through bodies such as the Global Internet Forum to Counter Terrorism – enables platforms to track emerging symbols, narratives, and coordination patterns as they migrate across the digital ecosystem (Galen Lamphere-Englund, 2025, p.17). Such collaboration must be structured to prevent function creep beyond counter-extremism purposes.
Privacy-Preserving Risk Assessment
The European Commission-led CounteR project demonstrates that risk detection systems can incorporate machine learning, social network analysis, and behavioural modelling while preserving individual privacy through techniques such as differential privacy (CounteR Project Consortium, 2024, p. 5). This suggests that monitoring frameworks can operate effectively without intrusive surveillance of private communications. By prioritising analysis of public-facing indicators and community-level patterns rather than individual private data, platforms can identify risk while respecting user privacy (CounteR Project Consortium, 2024, p. 18).
However, these operational capabilities must be governed by robust ethical and legal safeguards to ensure responsible implementation.
Ethical and Legal Safeguards for Monitoring Ideological Persistence
Any framework for analysing ideological markers must be embedded within robust safeguards. The following principles are essential for responsible implementation.
Lawful Scope of Data Collection
The proposed framework limits analysis to publicly available content or data already lawfully processed under platforms’ terms of service. It does not require access to private communications, covert surveillance, or expanded monitoring authorities. This scope limitation ensures that analysis operates within existing platform capabilities and legal mandates, consistent with data protection requirements reflected in frameworks such as the General Data Protection Regulation (GDPR).
Data Minimisation and Purpose Limitation
Preventive monitoring must remain proportionate to its objectives. Recommended safeguards include limiting analysis to indicators demonstrably relevant to ideological relapse risk, restricting secondary use of data for law enforcement purposes without separate legal authorisation, and periodically reviewing data retention for continued necessity. These practices align with established data protection principles requiring that processing be adequate, relevant, and limited to what is necessary.
Transparency and User Awareness
Platforms implementing risk-based tools should ensure clear policy language explaining safety-oriented monitoring practices, aggregated transparency reporting on programme use, and notice mechanisms where automated systems materially affect user experience. Where direct engagement with flagged individuals occurs – such as referral to intervention services – transparency should accompany that interaction. Transparency builds user trust and enables external accountability.
Human Oversight and Due Process
Automated risk-scoring systems should not operate autonomously. Safeguards must include human-in-the-loop review before consequential action, clearly defined thresholds distinguishing ideological risk indicators from simple policy violations, and accessible appeal mechanisms for users affected by moderation decisions.
The CounteR project’s emphasis on explainable AI – requiring that risk scores be accompanied by human-readable rationales (CounteR Project Consortium, 2024, p. 29) – offers a model for enabling meaningful human oversight.
Bias Mitigation and Independent Oversight
Given the sensitivity of ideological profiling, frameworks should incorporate regular independent audits of risk models, testing for disparate impact on protected characteristics, and documentation of system design logic, false-positive rates, and unintended consequences.
Independent validation and bias testing built into platform governance from the outset, as demonstrated in the CounteR project (CounteR Project Consortium, 2024, p. 33), prevent the reproduction of systemic inequalities through algorithmic systems.
Alignment with Existing Global Standards
Although no universal operational standard governs post-release digital monitoring specifically, the framework aligns with widely recognised global norms. These include human rights due diligence under the United Nations Guiding Principles on Business and Human Rights, data protection principles reflected in the GDPR (lawful basis, transparency, proportionality, right to contest automated decisions), and emerging responsible AI governance standards emphasising human oversight, auditability, and explainability.
Practical Recommendations for Technology Platforms
The following recommendations represent initial steps toward a larger vision of evidence-based extremism prevention.
Invest in Foundational Indicator Research – Platforms should support research identifying and validating specific indicators of ideological persistence, disengagement, and desistance relevant to online environments.
Develop Multi-Modal Detection Tools – Building on validated indicators, platforms should invest in detection capabilities across text, image, audio, and network data. These tools should be understood as evolving systems requiring continuous refinement.
Establish Collaborative Information-Sharing Partnerships – Platforms should establish structured partnerships with corrections authorities and researchers studying incarcerated populations to collect longitudinal data on ideological change during incarceration.
Commit to Continuous Learning and Framework Refinement – Platforms should treat extremist detection systems as continuously evolving knowledge platforms, with periodic analysis of emerging data and systematic updating of indicators.
Implement Privacy-Preserving Risk Assessment with Oversight – Platforms should adopt risk-assessment tools prioritising privacy through differential privacy, community-level analysis, independent auditing, and external advisory input (CounteR Project Consortium, 2024, p. 33).
Conclusion
This framework is a foundational stepping stone toward a continuously growing knowledge system that systematically gathers empirical data on ideological persistence and feeds that intelligence back to technology companies.
The ultimate vision involves three subsequent phases: (1) developing validated PVE metrics, (2) administering longitudinal tools to incarcerated populations at intake, mid-sentence, and pre-release, and (3) populating a structured database for comparative analysis.
Preventing extremist exploitation of digital platforms requires living knowledge systems that evolve alongside the phenomena they seek to address. The framework presented here offers a starting point; the work of building a genuinely evidence-based, continuously learning approach lies ahead.
–
Maya Yamout is a PhD candidate in Sociology, Criminology, and Social Policy at Swansea University. She has over 15 years of experience in forensic social work, countering violent extremism, prison work, and psychosocial interventions in conflict zones. Maya is Vice President and a board member of Rescue Me, an NGO dedicated to rehabilitation, crime prevention, and trauma-informed care. Her research and consultancy mainly focus on Lebanon, the UK, and international contexts, especially on extremism, prisons, gender issues, trauma, and social justice.
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.