What does research reveal about "leaking behavior" — where do people reveal their intentions, online or offline?
71% of pre-attack "leaking behavior" occurs offline, while only 29% happens online — meaning social media monitoring alone is insufficient for threat detection.
* Most pre-attack warning signs surface offline — social-media monitoring alone catches under a third. *
Key statistics from the research (Schuurman et al., 2017):
- 71% offline — Most people who later commit attacks reveal their intentions through face-to-face conversations, behavioral changes noticed by family/friends, or physical activities
- 29% online — Less than a third of leaking happens through social media posts, forum activity, or digital communications
Additional findings on the same slide:
- Mobilization: Only 4-7% of people who consume extremist content online actually mobilize toward violence (Reynolds & Hafez, 2017)
- Digital roles: "Critics" (commenters/sharers) far outnumber "Creators" (content producers) in online extremist communities
- Internet usage by terrorists: 76% for knowledge acquisition, 44% for consuming content, 50% for propaganda
Why this matters: These statistics challenge the assumption that monitoring social media alone can prevent attacks. Most warning signs appear in the physical world, reinforcing that SOCMINT is just one piece of the puzzle and must be combined with traditional intelligence methods.