Death Weapons: How a Reporting Team Infiltrated Online Neo-Nazi Networks

In the summer of 2021, a 16-year-old boy walks onto a former army post in Potsdam, Germany, and sets off two homemade bombs. Lukas F. (a pseudonym) posts a film of the explosions to the online group for young neo-Nazis he set up in November 2020. This group, known as the Totenwaffen or “death weapons,” shares far-right ideas, Nazi propaganda, and videos of attacks in the belief they are fighting a “race war.” (The military site was abandoned and no one was injured by the blasts.)

Nabert created several fake profiles: some for monitoring or exporting messages and one to engage in around 24 private messaging groups, posting just enough to appear active… without posting anything illegal.

Totenwaffen is an example of a neo-Nazi Telegram chat group that’s part of a wider global network of online chats involving teenagers and young people from the US to Western Europe and the Baltics. In the UK, 18 teenagers were convicted of terrorist offenses between 2017 and 2021. According to the anti-fascism campaign group Hope not Hate, Telegram is involved in many of these cases, where it has been used by far-right extremists to organize. Improvised weapons are noted as a trend amongst these groups with Telegram used to distribute instruction manuals.

Lukas F.’s case shows how online radicalization can contribute to the perpetration of offline terror offenses and is central to the award-winning Death Weapons investigation that explores how these groups operate and influence young people. The joint investigation by Welt Am Sonntag, Politico, and Insider — all part of the Axel Springer media group — involved months of undercover infiltration of neo-Nazi chat groups, an analysis of more than 98,000 Telegram chat messages from about 900 users, and offline and open source research and verification. In all, the investigation took more than a year and eventually won a European Press Prize earlier this year.

Some participants in the groups investigated have been charged with crimes related to plots to bomb or burn synagogues and gay bars or to illegally traffic firearms. Chat messages seen by the investigating team involved members inciting the murder of minorities and discussing how to make explosives or procure weapons.

“They are super young, they radicalize very fast and they organize internationally,” explains Christina Brause, an investigative journalist and former deputy investigations editor at Die Welt and Welt Am Sonntag.

Launching an International Investigation

Brause wanted to expand coverage of extremism beyond a national perspective. With Die Welt’s then-head of investigations Anette Dowideit taking on a new role as international coordinator, the time was right to pitch an international investigation into extremist networks. Working with US colleagues could also aid access to US official sources, such as intelligence agencies and the US government, Brause adds.

The core team involved three journalists working at or with Welt am Sonntag: Brause, independent investigative journalist Alexander Nabert, and Dowideit, with support from other editors in constructing the final narrative published in July 2022. Nick Robins-Early, at Insider at the time, and Bryan Bender, former senior national correspondent and defense editor at Politico, came on board to investigate the links between the groups and the US.

“It’s a subject that crosses borders and boundaries, and either proliferates through online networks or in other cases has members flying between countries,” says former senior editor of investigations at Insider Robins-Early.

The reporting team met online every two weeks to share new leads and information, and, crucially, any successes or failures since the last meeting.

Undercover Profiles

Infiltrating the online networks used by the teenagers was central to the investigation, but hanging out in those groups is “not a normal thing to do as a journalist,” says Nabert, who went undercover to understand “the inner workings of that far-right, lone wolf kind of terrorism.” This tactic gave him exposure to and analysis of where and how this radicalization take place. “We need to get a feel of how it is to engage in those groups.”

Nabert created several fake profiles: some for monitoring or exporting messages and one to engage in around 24 private messaging groups, posting just enough to appear active — updates about when a user was last seen online, for example — without posting anything illegal. While details of Nabert’s profiles cannot be shared, for credibility he ensured the profile picture and bio reflected the language and visual style of other members in the groups. Groups would occasionally disappear or reappear under other names. By being present in enough chats, Nabert was able to locate or get invites to new groups as they emerged.

A Telegram channel for Feuerkrieg Division (FKD), a known neo-Nazi organization and terrorism group with known links to a number of planned and attempted terrorist attacks worldwide, was a starting point. Propaganda shared from other channels and non-public messaging groups helped Nabert identify other messaging groups of interest.

Open Source Data

Members of private Telegram chats can export messages. The chat exports as a local HTML file, including images and videos if specified. Exporting on a regular basis is essential, because if a chat is deleted all the messages disappear with it. Every fresh export includes all previous messages up to the point you joined, leading to files with duplicate historical messages. Brause does not recommend overwriting the old file: if profiles have since been deleted, earlier messages will now show as written by “anonymous”; in the old file, you still see the picture of the profile and the name.

Brause wrote some Python code that could find duplicate messages and retain the earliest message. The code would grab information from a folder of the HTML files and send information to an Excel file for team use, including when a message was written, its author, and if the message included text, a picture, a member, a link, or video.

Cross-referencing the messages and activity of different profiles across chat groups, the team identified the heaviest users and analyzed member crossover between groups. The profile of the person suspected to be Lukas F. was one of the top 10 most prolific posters in the chats. “It confirmed we were not just talking about some teenager, who as part of finding his identity ended up in a chat group, but that this is an important person in the group,” says Brause.

Brause’s code could also extract just the messages from each individual: “Seeing only what that person wrote, and reading it line after line gives a new impression of them. Combining his online behavior with his offline life made the story more interesting.”

The team was able to identify users who joined Lukas F.’s chat group from Romania and Poland, reportedly as young as 13 and 11 years old, respectively. Analysis also showed that the newly appointed “commander” of FKD was at one point a member of the Totenwaffen chat group and in contact with Lukas F.

Connecting the Online and Offline Worlds

“In certain cases, extremists are extremely online and have a lot of experience with doxing people and will issue threats of physical violence… Those are real threats that anyone reporting on extremism needs to take seriously.” — Former Insider investigations editor Nick Robins-Early 

Beyond Telegram, the team combined open source information with sources and other reporting on extremism and the far right to verify information and get leads from social networks, online shopping sites, forums, and police reports for information about individual extremists’ offline lives. In terms of identifying and verifying teen members of the Telegram chats who had committed offline crimes, the greatest leads came from outside Telegram, says Nabert.

Teens in the extremist Telegram chats monitored by the team are entrenched in online culture, he adds, and frequently post about their lives and other online activities: “It’s thousands of messages between teenagers and sometimes they make mistakes, because they feel safe talking to their friends.” Details in pictures and screenshots or sharing of their offline lives can provide leads to identify who is posting the picture, for example. Verifying offline identities and marrying them with online profiles also requires strong sources, including police officers, security experts, and intelligence sources.

Brause recommends creating a physical timeline of the investigation. The visualization can help show contradictions between people’s accounts or behavior. In this instance, the timeline showed that Lukas F. had ordered the Unabomber’s manifesto on Amazon and left a comment under his full name after he told police investigating him that he was no longer interested in right-wing ideology.

Security Measures and Risks

Infiltrating far-right networks online and investigating extremists carries significant risks, so don’t forget the basics, warns Nabert. Don’t use personal accounts to investigate social networks, for example, to avoid exposing yourself or your contacts. Brause removed her phone number from her email signature when contacting the brother of Lukas F.

“In certain cases, extremists are extremely online and have a lot of experience with doxing people and will issue threats of physical violence,” warns Robins-Early. “Those are real threats that anyone reporting on extremism needs to take seriously.”

The team set boundaries for the undercover investigation before creating fake profiles, including rules for engaging in far-right chats: they wanted profiles to be convincing but not to have to post racist or illegal content. Brause says a written document explaining the public interest objective of the investigation and a commitment to no illegal activity was signed by the team in advance.

The team used Signal to communicate between meetings and reduced communication by email. Exported Telegram chats were saved to secured, non-personal-use laptops and external hard drives. Some sensitive data was stored on USB sticks and only opened on computers with no internet access. For in-person reporting, Brause sent her live location to her editor when interviewing Lukas F.’s brother and any doorstepping of suspected extremists was done in pairs.

Dealing with Underage Subjects

Investigating and reporting on teenagers, albeit extremists, requires the same care as any story involving minors. The team did not include details about irrelevant aspects of the teenagers’ lives shared online and blurred faces in personal photos. Details such as plans to buy guns and 3D printers were included to make it clear these weren’t just passive teens sharing online, they were active and engaged in illegal activities.

“People could look at younger groups of extremists and say, teenagers do stupid things. But it’s important to make clear one of the goals of these extremist networks is to recruit younger members,” says Robins-Early.

“To read that young people radicalize at increasingly younger ages is different from reading a first-hand account from a 16-year-old practicing to blow up buildings, or to read about an 11-year-old neo-Nazi ringleader,” says Agnes Venema, a researcher in intelligence and national security, commenting on the death weapons exposé. “Investigative journalists provide us with faces and names behind the stories. They provide a story beyond the statistics and policy debates, and at times they shape the policy debate. This is a role that should never be underestimated or diminished.”

---

Laura Oliver is a freelance journalist based in the UK. She has written for the Guardian, BBC, Euronews, and others. She is a regular journalism trainer for the Thomson Foundation and Thomson Reuters Foundation and works as an audience strategy consultant for newsrooms. You can find her work here.