False and unverified claims proliferate online following Trump assassination attempt
15 July 2024
By: Isabelle Frances-Wright, Katherine Keneally, and Moustafa Ayad
Unverified claims about the attempted assassination of former President Donald Trump proliferated across social media in the 24 hours following the incident and continue to spread in the absence of more detailed factual information about the shooter. As news outlets and media commentators attempt to fill the gaps, ISD researchers identified a massive spread of false claims online across both mainstream and fringe platforms. Content referencing these narratives received over 100 million views on X (formerly known as Twitter) alone. In comparison, in the 24 hours following the Uvalde school shooting, posts referencing false flag and related conspiracies garnered 35.1 million impressions.
Social media users voiced significant confusion as they tried to keep up with the wide variety of unverified information rapidly emerging and gaining traction, in a post indicative of a wider trend identified by ISD, stated, “I keep seeing different photos. It’s hard to verify what’s accurate and what’s not. We have gone from a Chinese National, to two shooters, an Italian social media influencer and now this. We need facts.”
This Dispatch looks first at the specific narratives which proliferated across the platforms, promoting unverified and false claims targeting a range of individuals and groups. It then focuses on the ways in which these claims spread and mutated, moving fluidly between fringe and mainstream platforms.
Incorrect information regarding the shooter’s identity spread quickly
In the immediate aftermath of the shooting, conspiracy theories largely focused on the identity of the shooter, falsely identifying him as an Antifa member named Mark Violets. A picture of the alleged individual was also circulated. That picture was taken from an Italian YouTuber’s profile and there were no mentions of “Mark Violets” on social media before the incident.
On X alone, conversations surrounding “Mark Violets” and his potential involvement received 10.94 million views. One conspiratorial narrative which quickly gained traction was that a typo in a Trump campaign document, with violent spelled “violet”, foreshadowed the attack (as seen in the image below). A prominent post advancing this narrative received 183,000 views at the time of analysis, as well as 791 reposts.
Figure 1: a typo in a Trump campaign document, used to claim that Trump had foreshadowed the identity of the shooter.
When a supposed image of the deceased shooter on a roof emerged, the conversation shifted to social media users comparing the body type of “Mark Violets” to the shooter on the roof, assessing they were too different to be the same person.
The image that was shared alongside the “Mark Violets” narrative was that of Italian sports commentator Marco Violi. Violi took to social media to clear his name, posting on his Instagram account that he categorically denies being involved in the assassination attempt. Violi wrote he believes the narrative was instigated by a group of trolls who have been targeting him since 2018 and he plans to “file a complaint against the accounts on X that invented this false news and all the newspapers that spread the false news.”
From Italy to China
Following the spread of content claiming “Mark Violets” was the shooter, another narrative emerged alleging the perpetrator was a “Chinese national”. ISD identified a total of 24.9 million impressions of posts using the term “Chinese national” on X since the attack.
This claim was in part driven by an article from a prominent news outlet which stated in an article that “the shooter [was] identified as a Chinese man”. This was later updated within the article to “the shooter, identified only as a white male”. There were also unverified claims online that the news outlet Newsmax had reported the shooter was a Chinese national.
Less common claims included that the shooter was Ukrainian and had attacked Trump in retribution for his stance on the ongoing conflict with Russia. A further narrative alleged that the shooter was a “trans activist”, with different names and images being used to support this claim.
At the time of writing, ISD found that this content was still amassing views and engagement, with no interventions from platforms (e.g. fact-check labels, community notes, warning labels).
A troll emerges
False information about who the attacker was, including images of the wrong individual, spread after an X user posted a video claiming to be Thomas Matthew Crooks, now identified as the shooter, and claiming to hate Republicans and Trump. Though the user later recanted his false claim, temporarily made his account private, and changed his account name, the video and images continue to be shared online. This has contributed to continued spread of false and unverified information about the identity and motivation of the attacker, and raised speculation as to whether Crooks is still alive.
Though context from readers has since been added to some X posts featuring the video, with varied clarifications about the user being an internet troll, the video has gained significant reach across platforms and continues to spread. Two posts that are still available on X featuring the video have received more than 4.9M views. The video was also observed on Instagram, posted by self-described geopolitical and local media accounts. No user- or platform-generated warnings or disclaimers were observed on these videos – one post featuring the video by a “geopolitics” account based in India received more than 57K views on Instagram.
Another incorrect identity
Another persistent false claim identifies the shooter as “Maxwell Yearick”. One X user claimed, “The shooter is Maxwell Yearick, a prior rioter arrested back in 2016 for violence at a Trump rally in Pittsburgh, PA. Thomas Matthew Crooks is alive and posting on his X’s account, he decided to troll the internet by posting the video”.
The earliest posts identified presenting Maxwell Yearick as the shooter originated on 4chan, AR15.com, godlikeproductions.com and greatawakening.win, before spreading rapidly across X; individual posts promoting the claim received up to 4 million views. Mentions of Maxwell Yearick on X have amassed a total of 107.2 million views.
Despite the FBI confirming the shooter to be Thomas Matthew Crooks, content claiming the shooter was Maxwell Yearick persists. One X user states, “Roger Stone posted his sources are telling him the shooter was Maxwell Yearick, not Matthew Crooks. I think he’s right. The photo of the dead shooter matches Yearick, especially when you look at the ear. Yearick’s mug shot shows him with a gauge and the dead shooter has a closed gauge scar. It appears FBI is not telling us the truth. Shocker.” This post alone has received 91.4k views. It is representative of a larger trend identified by ISD, in which social media users attempt to match features of the deceased (such as ears) with features of “potential suspects” to conduct their own analysis. The widely-shared image of the deceased shooter is extremely graphic and violates many of the platforms’ rules.
In the aftermath of the attack, ISD observed that posts that showed a screenshot of Google appearing to add a warning label to searches of the name, stating: “It looks like the results below are changing quickly. If this topic is new, it can sometimes take time for reliable sources to publish information”. This type of intervention could become a useful tool in the future and is one that social media platforms should take note of for the purposes of unfolding crises.
Claims Regarding the Secret Service Gain Traction
Claims that the Secret Service allowed the assassination attempt have received a huge audience across fringe and mainstream platforms. Criticism of the Secret Service has been widespread with many commentators have attributed the lapse to malice. Users on video platform Rumble have posted clips claiming to “prove” that the Secret Service allowed the assassination. Some users on fringe platforms have blamed the failure on female Secret Service agents on former President Trump’s detail and Secret Service Director Kim Cheadle, who they claim was a “diversity hire.” This narrative was also promoted by mainstream figures with significant followings on X.
Late on July 13, an unknown 4chan user claiming to be the agent who shot Thomas Crooks claimed that he was ordered by the “head of the secret service” to allow the assassination attempt to occur. Whilst users in the 4chan thread were generally dismissive, screenshots went viral on X. One post from a Premium X user had received over 5.8 million views as of midday on July 14.
“We’re in a Civil War as of tonight”.
Although calls for civil war often follow high-profile incidents involving the former president, they were elevated to one of their highest levels in the wake of the attack on Trump (see Figure 2). Discussions were frequently accompanied by allegations that the assassination attempt was part of a ‘Deep State’ plot to instigate a civil war between Republicans and Democrats.
Claims include the narrative that Democrats had failed to start a civil war by “missing” Trump and allegations that the attack meant that the US is now in a state of civil war. Analysts identified three posts that received more than 1.03 million views on X which use fearmongering to suggest Trump supporters are under attack by Democrats and justify violence to counter the threat. Individual users on Truth Social responded to posts with similar statements such as “DEMOCRATS JUST OFFICIALLY STARTED CIVIL WAR II” and “We’re in a Civil War as of tonight.”
The spread of conspiratorial claims of involvement of US government officials and fearmongering has the potential to serve as a catalyst to future violence, as has been observed in the wake of previous incidents involving former President Trump.
Figure 2: Volume of mentions surrounding unrest-related keywords on relevant days. Mentions were collected for each day until 11am EST, to allow comparability. Data sources include X, blogs, and various forums and sites.
Narratives spread and mutate: from fringe to mainstream, and from mainstream to fringe
Tracing the origins of false narratives on the internet is fraught with difficulties. Rumors spread from closed, fringe platforms to large and mainstream ones easily, often without the context of where they originated or links to the original user. Misinformation and disinformation spreading in the aftermath of the attempted assassination of former President Trump are no different. To try and understand just how or where some of these falsehoods began to spread, ISD researchers attempted to trace each case to a source based on time stamps of posts following the incident.
As previously evidenced by ISD, there is a growing trend of accounts claiming to conduct open-source intelligence (OSINT) analysis. These accounts thrive during crises, when details from official sources and mainstream media are lacking, and they can present their narratives as confirmed facts as platforms struggle to enforce policies and interventions such as labels.
Based on timestamps, ISD found that several narratives ‘unmasking’ suspects or ‘revealing plots’ behind the shooting began either on 4chan or Telegram before spreading and going viral on mainstream platforms. 4chan and the trolls which use some of the boards have a history of seeding narratives about fake mass casualty suspects, including comedian Sam Hyde; these have become a part and parcel of the online post-incident environment.
However, the case of “Mark Violets” was notable for beginning on X before spreading to Telegram and 4chan. It first began trending on X around 7:07 pm EST/4:07 pm PST, approximately 30 minutes after the footage of the assassination attempt began spreading on X; the posts claimed erroneously that the Butler Police Department had identified “Mark Violets” as the shooter. The spread was driven in large part by a major financial twitter account with Premium status and more than 1 million followers; it has previously promoted other conspiracy theories such as 15-minute cities. Although it was not the first to tweet the false claims and would later delete the tweet, its large following allowed the narrative to spread rapidly on X.
At around 7:20 pm EST/4:20 pm PST, Telegram channels linked to cryptocurrency communities began sharing the same post made by a crypto account on X, often directly linking to it. One of the primary “counterintelligence” accounts on Telegram to its 97,000 subscribers reshared the post without questioning its providence. ISD researchers also found 7 different Telegram channels set up in “Mark Violets’” name in the 24 hours after the shooting.
The 4chan post attributed to the USSS sniper at the rally which alleged an anti-Trump conspiracy spread from the message board to X in the early hours of Saturday. It was reposted as “big if true” at 7 am EST/4 am PST and received more than 10 million views. Many of the posts featured the original 4chan post without questioning its authenticity.
On X, a memeable image with the words “the head of the secret service refused to let me take him out” image was viewed 113,000 times. The narrative also mutated on the platform: in a video viewed more than 500,000 times, one prominent influencer claimed that there was “no doubt in [their] mind” that the would-be assassin “had help from somewhere from somewhere within an agency.” The virality of the post on 4chan and its repeated sharing on a mainstream platform such as X boosted claims that the suspect was either aided by the government or that the USSS played a role in allowing the shooter to fire multiple rounds at Former President Trump.
Conclusion
The response to the attempted assassination of former President Trump shows the major challenge which such incidents pose to platforms and the broader information ecosystem. Although more official information is now available, it is difficult to undo the damage caused by false and unverified claims which spread in the critical hours directly after the attack – not least since at least some of the narratives are still available online. The spread of this mis- and disinformation between fringe and mainstream platforms is another cause for concern. It demonstrates how conspiracy theories can proliferate, mutate and reach wide audiences, while simultaneously being iterated on and pushed by dedicated users in fringe spaces.
The spread of false information and conspiracy theories which threaten to further erode trust in institutions and democracy, and may also have the potential to incite violence, provides yet another example showing that significantly more work is needed on the part of social media platforms.
