This section describes the criteria that can be useful in determining how likely it is that an online threat may turn into a physical attack.

Environment: Any risk assessment needs to take into consideration the overall security environment in which the threats take place. In a context in which physical attacks against journalists are frequent, either as a consequence of widespread impunity for aggression against the press or a climate of generalized violence, threats need to be dealt with very seriously and newsroom managers as well as the targeted journalists will need to consider the possibility of relocation, requesting police protection, and pushing for serious investigations into the origin of the threats. Journalists and newsroom managers, however, need to keep in mind that online threats have resulted in physical attacks against journalists even in environments generally perceived as safe.

Intensity: Is the journalist the target of an isolated threat or a campaign? Both situations carry possible risks, which need to be assessed differently:

  • If the journalist has been targeted by an isolated attack, the assessment should focus on determining who the aggressor is so as to assess the likelihood that the threat might turn into a physical attack. This assessment should be made on the basis of any information available about the aggressor, in particular social media behaviour and content shared. Explicit threats of physical harm and Cyber-stalking should be reported to the authorities immediately.
  • If the journalist is the target of a coordinated campaign, the assessment should focus on the likelihood that others may feel encouraged or legitimized by this campaign to physically attack the journalist. Journalists who work on camera or who are otherwise recognizable by their audiences run a much greater risk of being physically attacked, for the simple reason that they can be easily identified in any public place. The risk of physical attack may be higher when the coordinated harassment is legitimized, supported or even initiated by a high-level politician or a well-known public figure.

Typical traits of coordinated online harassment campaigns are:

  • Numerous aggressive comments posted within a short period of time, typically between 24 to 48 hours
  • An influential figure, in some cases close to a government sends an initial message or series of messages targeting a journalist. The messages may or may not name the journalists explicitly, but it will be clear from the content to whom they refer. The message is picked up by these figures’ followers, who repost and share organically, creating a discrediting narrative around the journalist. These attacks usually adopt a common hashtag
  • Memes or elaborated graphic designs that suddenly appear on the social media feeds within seconds or minutes from the first hateful message
  • Botnets: Software-run accounts that increases dissemination of the hate exponentially
  • Repetitive propaganda: Smear articles published on propaganda sites that feed from the same wave of online hate on social media
  • Hacking attempts to gain access to the journalist’s electronic devices

Orchestrated campaigns are constantly refined to avoid legal prosecution or being banned. Social media managers and comments moderators should be trained to spot these types of campaigns.

Content: An analysis of the content of the abusive messages is important to assess the intentions of the aggressors. In some cases, it is clear that aggressors aim to challenge the credibility of the journalist in the public eye and thereby weaken the journalist’s ability to contribute to public debate, or cause stress to the journalist that may ultimately result in self-censorship.