Case Study: Alt-Social Media’s Lack of Moderation Enabling White Nationalists’ Targeting of Critical Infrastructure

Pyrra's review of alt-social media illustrates white nationalists, particularly those who identify as "accelerationists," remain hyper focused on targeting the energy and utility sectors. We judge these groups will continue this rhetoric in the runup to the 2024 US general elections while also pushing disinformation about controversial topics, in part because of the lack of moderation on these platforms. 

In 2022, there were 163 reported incidents against power infrastructure across the US attributed to acts of violence, vandalism, or suspicious activities, which was a 56% increase from 2021, judging from a review of Department of Energy information. ¹

• Accelerationism is a belief by some white nationalists that the current form of a capitalist government and societal order is unstable and must be violently overturned to hasten a race war and institute an all-white society. Accelerationists advocate, in part, for the destruction of energy and telecommunications infrastructure, to achieve their goals.

• Several alt-social media platforms have promoted publications promoting attacks against critical infrastructure including electrical substations. Some of these channels host easy-to-follow "manuals" that provide guidance on how to target critical infrastructure, what firearms and ammunition to use, what to target within a power substation to cause maximum damage, and how to elude authorities. Some of these manuals are also permanently "pinned," meaning individuals can anonymously obtain these instructions to possibly plan attacks against critical infrastructure. Moreover, some of these sites encourage followers to download and take “heavy inspiration” from these documents.

• As of June 2023, alt-social media platforms (including Telegram and 4chan) continue to host accelerationist-related channels that discuss news regarding threats to critical infrastructure. A review of publicly accessible channels within these mediums indicates members regularly share and react to press or government releases about threats to or attacks on critical infrastructure, probably to anonymously promote attacks.

We judge that accelerationists and other fringe groups will continue to use alt-social media platforms like Telegram because of the ability to freely share publicly available information to inspire attacks and a lack of content moderation. Telegram has over 700 million users, according to their terms of service, and prides itself on protecting users' private communications, even if that is used to criticize governments.² Telegram's use of public and private channels, one-on-one encrypted chats, blending of social media and encrypted messaging, and loose moderation make it a "convenient" tool for extremists, according to the Southern Poverty Law Center.³

• Alt-social media members have promoted publicly accessible resources to discuss or obfuscate planning attacks. In late January 2023, Sarah Beth Clendaniel used an encrypted messaging application—later identified in the press as Telegram—to provide an FBI source the website “Open Infrastructure Map” ⁴ (OIM) to locate five electrical substations in Baltimore to attack in one day, according to the unsealed federal indictment.⁵ Clendaniel and her co-conspirator, Brandon Russell, were members of the accelerationist/white nationalist group, “Atomwaffen Division,” aka the “National Socialist Order,” and federally charged in February with conspiracy to damage an energy facility.
• The OIM website has been repeatedly shared on other alt-social media outlets like 4chan in posts discussing recent and historical attacks, including the 2013 attack against the Metcalf power substation in California⁶, suggesting this site should be used in planning and executing future attacks.

• Accelerationists probably use private, invite-only channels or point-to-point communications on alt-social to conduct operational activities, hampering our ability to provide timely warning of an impending attack. Monitoring public channels or rooms on alt-social mediums, however, can provide some indicators that critical infrastructure may be targeted.