Quantifying extremism: A data-driven analysis of UK riot-related far-right Telegram networks

13 September 2024

ISD & CASM Technology

Following the most significant far-right violence in the UK in a decade, social media platforms have come under renewed scrutiny as spaces for ideological inspiration and operational organising. This article demonstrates how far-right extremists leveraged a range of mainstream and smaller ‘alt-tech’ social media platforms in the wake of the Southport attack to grow their following, promote hate and organise. The first part of the research is a quantitative analysis of online far-right networks, including the volume and nature of conversation about the riots; it demonstrates how links to different social media platforms were used to build an ecosystem which promoted a sense of impunity among participants. The second part of the article details a timeline of online mobilisation; this included the organisation of protests on Telegram and the unification of disparate far-right factions.

---

Key Findings

• Nearly 45,000 messages across 55 British far-right Telegram channels were collected in the run up to and aftermath of the Southport attack.
  • In the 10 days after the Southport attack, posting activity on far-right Telegram channels rose by 327% compared to the 10 days before.
  • Discussion topics were diverse during this period, including the Southport attack, the US election and the Israel/Gaza conflict. The most discussed figures were English Defence League (EDL) founder Tommy Robinson, former US President Donald Trump and UK Prime Minister Keir Starmer.
  • More than 400 links to other Telegram channels were posted in these groups. Additionally, our research found more than 3,000 links to mainstream platforms (most commonly YouTube, X – formerly known as Twitter – and TikTok) as well as alternative and fringe sites including Rumble, Odysee and Bitchute. This shows how the far right was able to build a cross-platform ecosystem by sharing content across groups and channels on multiple social media platforms.
  • A total of 459 individual YouTube links were shared more than 6,000 times. This included more than 100 livestreams, predominantly of the riots, while videos also shared anti-Muslim and anti-migrant views.
  • A constellation of Telegram channels played key roles ranging from organising activity to transnational amplification to target selection. ‘SOUTHPORT WAKE UP’, which was not included in the 55 channels in the quantitative research, became a central organising group for riots and grew from only 44 members the afternoon after the attack to more than 15,000 members by the time it was removed a week later. Channel data shows hundreds of users, a majority with Chinese-character names, joining on 3 August within minutes of each other. This may indicate inauthentic activity, such as a paid-for bot farm.
  • Mentions of locations of riots were posted before they took place in Bristol, Leeds and Manchester. This is a strong indicator of the use of Telegram channels to either draw attention to a specific location, with the aim of directing hate or violence, or for specific mobilisation and rally planning (many of which turned violent).

Quantitative analysis of the UK online far-right ecosystem

Qualitative analysis by ISD has shown the centrality of Telegram to far-right organising following the Southport stabbing, continuing the app’s importance in cultivating extremist ecosystems for many years. To build a quantitative picture of the far-right British digital ecosystem around the Southport attack, analysts collected messages from 55 channels known to be based in the UK and relevant to far-right extremist communities.

In total nearly 45,000 messages were collected from the period 19 July to 8 August 2024. The 55 channels included both broadcast groups (where only administrators can post) and chat groups where every user can post; the latter generated a greater volume of activity due to greater interactivity. More than three-quarters were posted on a single chat group seemingly linked to Tommy Robinson, Britain First and the For Britain movement.

In the ten days after the Southport attack, activity on far-right Telegram channels increased by 327% compared to the ten days before. In the two days after the Southport attack, the volume of messages increased by 87%. However, it was not until 3 August (5 days after the attack) that there was a significant uptick in volume. The highest volume of messages, recorded on 4 August (7,021 messages), reflects the period of the most significant far-right rioting in cities like Belfast, Middlesborough and Rotherham. The significant drop in volume of messages after 5 August may be due to several channels being deleted or going private soon after the riots.

Far-right Telegram channels referenced a broad range of individuals and groups

The nature of discussion collected across these channels in the 20-day period was diverse. This analysis used a form of natural language processing (NLP) called named entity recognition to identify the groups and individuals most commonly discussed among the channels.

Tommy Robinson was among the most common topics of discussion, demonstrating his continued centrality as a rallying figure among the British far right. Among the almost 200 mentions of the EDL were posts either mocking authorities for attributing blame to the inactive group, or claiming that the attribution of blame showed how white British people are unduly held responsible for disorder.

Many of the posts referencing Prime Minister Keir Starmer or the Labour party were highly negative, accusing them of laying the groundwork for the riots through allegedly supporting uncontrolled immigration. Anti-establishment narratives also blamed mainstream media outlets, referred to as the ‘MSM’, including the BBC and Sky News, for allegedly deliberately disparaging white British people.

Although most posts discussed events in the UK, US politics were also commonly discussed with posts about President Biden, former President Trump and Vice President Kamala Harris. This demonstrates the high level of interest in international events and interconnectivity between far-right movements transnationally.

Another international topic that was central to discussions was the Israel/Gaza conflict with specific reference to current tensions with Lebanon and Iran. Posts relating to this topic often contained antisemitic conspiracy theories with some white nationalist channels accusing the riot organisers of being paid by “Zionist” or Israeli interests.

Telegram channels linked into a wider cross-platform ecosystem

Our analysis points to a highly interlinked online extremist ecosystem, both across Telegram and a wider tranche of social media platforms. These channels were not isolated from one another, but highly interlinked. Over 400 links to other Telegram channels were posted, demonstrating the interconnected nature of the nebulous far-right ecosystem on Telegram. While channels were ideologically diverse, they regularly referenced one another’s content, directing members towards new sources and sharing ideas across internal divides. This is vital for the conceptualisation of digital far-right communities, whereas organising was publicly attributed by law enforcement to the EDL, the reality is a flatter and more disorganised ecosystem comprising known figureheads, self-proclaimed independent journalists and opportunistic instigators. Sharing links across different channels is central to the Telegram user experience and platform functionality, allowing content to seamlessly flow between diverse digital spaces.

Far-right Telegram groups also shared links to large mainstream platforms, including YouTube, X, TikTok, Facebook and Instagram. Alternative social media platforms, which are commonly host to more extremist and hateful ecosystems, were also shared. These included Rumble, Odysee, Bitchute and Truth Social. Telegram does not function as an isolated extremist ecosystem but is highly networked into other platforms. This evidence shows the importance of sufficient regulatory focus on high-risk smaller and medium sized services. This distinction is increasingly out of touch with the far right’s cross-platform networking.

YouTube videos of the riots were celebrated on Telegram

Due to the high volume of YouTube links shared, ISD and CASM Technology conducted a specific study of videos hosted there. A total of 459 unique YouTube links were disseminated across the 55 Telegram channels; in total, they were shared a total of 6,064 times.

101 were livestreams, of which the most shared covered riots and protests across major UK cities.  Other streams focused on broader national issues – for example, commentary from Patriotic Alternative leader Mark Collett on ‘the state of Britain’ and social unrest. A review of a random sample of 20 posts revealed that most links to livestreams originated from a single Telegram user.

Despite our analysis showing they are an important central feature of far-right extremist online activity, livestreams depicting extremist violence seem to fall into a grey area for platform enforcement. While there are specific incident protocols around terrorist livestreams, this wider category of livestreamed violent content continues to proliferate.

Non-livestream YouTube videos, by contrast, largely composed of content related to the underlying sentiments driving these protests.

Figure 4 covers a random sample of 10% of all videos shared, categorised by theme. Where videos were not relevant to a theme (such as songs) they were not included.

The most shared categories were footage from riots, discussion of the Southport attack, and videos either defending or attacking Tommy Robinson. They were accompanied by more explicitly ideological videos promoting anti-Muslim or anti-migrant ideas, or conspiracy theories. Other videos contained an anti-establishment sentiment, blaming the Labour party or the Prime Minister for the events, or used the riots to promote strong anti-Democrat and pro-Trump narratives.

ISD and CASM Technology also found repeated mentions of ‘grooming gangs’ (group-based sexual exploitation) are a symptom of migration, or linked to the ethnicity or religion of their perpetrators. This common far-right narrative has been significantly mainstreamed in recent years. Other events discussed included the recent Manchester airport incident and the war between Israel and Gaza, which continues to dominate far-right forums 10 months after Hamas attack on 7 October 2023.

These narratives, combined with content from prolific far-right figures like Tommy Robinson, serve to amplify distrust, fear and anger. One user posted a video multiple times on how to make a petrol bomb, clearly inciting extreme violence. This is emblematic of the impunity with which Telegram users have become accustomed to acting, where there is little fear of retribution from the platform.

Case study of chaos: How far-right Telegram networks mobilised offline violence

Telegram was also used to mobilise offline action in the wake of the Southport attack, amidst widespread misinformation about the perpetrator.

The first message in the dataset referencing offline mobilisation was posted on 30 July at 09:44 by a Telegram channel associated with the British far right, which conducted a poll asking users if they would attend a protest in Cardiff. The poll garnered 892 views and 119 votes. Shortly after, posts promoting a Southport demonstration began circulating, initially forwarded from a Welsh nationalist channel. The post, titled “Enough is Enough – Protest”, depicted silhouetted figures holding hands. It was later reshared by a channel promoting British traditionalism at 15:12, gaining 1.4k views, 70 likes, and 21 comments (since removed).

At 15:22, a large channel associated with Tommy Robinson drew attention to the protests with a post reading, “The people at boiling point as crowds gather in Southport”, which received 16.9k views. This post was then re-shared into other far-right channels; this appears to have been the moment where the idea of offline mobilisation began circulating widely among larger channels with significant audience numbers.

A far-right channel with over 7,000 subscribers posted the first livestream from Southport at 19:04, which was quickly reshared into other larger far-right channels and chats. Another livestream followed shortly after at 19:07, posted by a prominent far-right activist. Users also posted the location of the local mosque, which subsequently became an epicentre of violent disorder.

By 20:23 a far-right Telegram group which claims to promote ‘traditionalism’ shared a message from an X user, ending with, “Tonight, let the message be clear. We will not be intimidated. We will not be silenced. The war on our streets ends now, and it ends with us taking back control. Our streets, our rules, our laws, and our country”.

As the afternoon progressed, mentions of Southport became increasingly frequent, focusing exclusively on the unfolding disorder. The tone of these messages became increasingly hostile, expressing outrage, anger and a sense of vindication for the unfolding disorder which continued late into the evening and the following days.

Mobilisation continued throughout the following week

A further review of Telegram messages mentioning UK locations between 31 July and 8 August reveals a pattern of opportunistic and widespread mobilisation attempts by various users across multiple channels, with a notable regional focus. Posts framed the riots as both a unique opportunity to make themselves heard and a duty to defend children.

A large chat group associated with Tommy Robinson, Britain First and the For Britain movement was particularly active. A post on 31 July stated: “WELL DONE LAST NIGHT LADS, TO ALL YOU HEAVY HITTERS… ARE YOU READY FOR ROUND 2??? LIVERPOOL MOSQUE, WEST DERBY ROAD FRIDAY 8PM”. This attempt to incite unrest in Liverpool however does not seem to have led to any recorded engagement. This is demonstrative of the fact that although a large number of protests were seemingly planned or mentioned, only some of them were realised. Subsequent posts about mobilisation in Liverpool saw greater engagement, such as a 2 August post which stated: “SATURDAY NIGHT 8PM COUNTY ROAD LIVERPOOL 🔥🔥🔥🔥”, which received 1,977 views.

Similar posts on 1 August promoted protests in multiple cities including Liverpool, Bristol, and Blackpool. A post in the same group mentioned above received 4,060 views indicating a broader attempt to incite unrest across multiple locations. The tone across these messages was consistently inflammatory. A message on 3 August following a protest in Liverpool, posted in the same large chat, read: “We scare the shit out of the establishment… Fight hard and remember, your ancestors are watching, make them proud”. This rhetoric underscores attempts to galvanise support through a narrative of defending the nation.

The group ‘SOUTHPORT WAKE UP’, which became a central organising chat for riots, grew rapidly in the week after the attack. On the afternoon of 30 July, the day after the attack and the first evening of riots, the channel had only 44 members, rising to 88 as of 1 August.

Membership ballooned over the weekend of 3 and 4 August, reaching more than 15,000 members by the time it was shut down a few days later. Channel data shows hundreds of users, a majority with Chinese-character names, joining on 3 August within minutes of each other. This could indicate coordinated and potentially inauthentic activity, such as a paid-for bot farm, constituted a proportion of this membership. Nevertheless, the pace of channel growth demonstrates the significant capacity of Telegram channels for rapid mobilisation with real-world consequences.

After the main Southport-related groups were shut down by the platform, new chats emerged to replace them, sometimes using slightly altered names to avoid moderation. On the evening of 5 August, a third ‘SOUTHPORT WAKE UP’ channel was set up, announcing ‘ROUND 3 LADS’. This is a common organising technique in extremist networks and demonstrates their resilience to moderation strategies. Although this group was also quickly shut down, its users are likely to have simply moved their activity elsewhere.

Such calls to action illustrate how Telegram was used to fuel far-right activism and disorder across the UK, with varying levels of engagement. The opportunistic nature of these posts is evident as users seized on existing tensions to amplify their calls for action. Despite the widespread distribution, messages had inconsistent reach with only some receiving high engagement.

Telegram was used to organise cross-UK protests

Figure 6 shows the volume of mentions over time of locations where far-right rallies took place, which often became riots. In many cases, such as Bristol, Leeds and Manchester, conversation about a location began in advance of the first riots in those cities. This is a strong indicator of the use of Telegram channels to either draw attention to a specific location with the aim of directing hate or violence, or for mobilisation and planning rallies (many of which became violent).

In the aftermath of violent incidents, some larger channels linked to individuals were careful not to explicitly celebrate violence. Instead, they posted videos which neither specifically praised nor condemned the riots but which were celebrated by followers. Videos also reframed the riots around law enforcement reactions, seeking to blame institutions for their perceived attacks on protestors.

Telegram, with its anonymity and effective lack of moderation, has long been an organising ground for extremist violence. Among the far right, this has sometimes translated into terrorist acts inspired by niche and violent ecosystems on the platform. The evidence that far-right networks used Telegram to incite violence and organise offline activity in multiple locations shows the urgent need for stronger moderation of the platform.

Future prospects

Across far-right Telegram channels, users promoted anti-Muslim and anti-migrant hate, shared videos of the riots and organised protests offline. Far-right networks operating across multiple platforms sought to seize the opportunity to promote their ideas and celebrated the ensuing violence. Transnational networks amplified and glorified violence on British streets, showing the international connectivity within such extremist ecosystems.

The recent arrest of Telegram owner Pavel Durov in France has caused far-right communities on the platform to question its potential longevity, although there are few signs of migration to different services. The European Commission is considering designating Telegram as a Very Large Online Platform in its enforcement of the Digital Services Act, which would require additional mandatory risk assessment and mitigation around the spread of illegal content. While users may simply turn to another service, any move will at the very least serve to disrupt networks in the short term and make harmful ecosystems less accessible for the unassuming user to stumble across.

The British far right has long suffered from fractures and internal competition which has limited effective mobilisation for years. The data analysed in this article shows in real-time the mobilisation of British far-right Telegram channels in the aftermath of the Southport attack. Multiple channels across different platforms came together to support a shared goal. This represents the commonality and mobilising power of anti-Muslim and anti-migrant ideas, which rose sharply following the Southport attack.

However, the organisation also represents a moment of unity for a movement typically preoccupied with infighting. This may be, in some senses, a ‘January 6’ moment for the UK, mirroring the unification of diverse movements under a single tent in the January 6 2021 US Capitol insurrection. The British far right have celebrated the riots as a win not experienced for years; with domestic and international networks increasingly interconnected, the movement is arguably in a stronger position than it has been for decades. This growth will only serve to further entrench and normalise anti-Muslim and anti-migrant hate.

As Ofcom cements guidance for the implementation of the Online Safety Act (OSA), this activity will have significant impact on the efficacy of enforcement of regulation. Cross-platform connectivity necessitates a consistent approach to both very large platforms and smaller high-risk services. Meanwhile, platforms both large and small must consolidate and implement their approaches to the removal or hateful or violent content, including livestreams.

The sole responsibility for any content supported by the European Media and Information Fund lies with the author(s) and it may not necessarily reflect the positions of the EMIF and the Fund Partners, the Calouste Gulbenkian Foundation and the European University Institute.