Threat Intelligence and the Hydra of decentralised Extreme Right-Wing organisations

Digital threat intelligence helps us respond to harmful entities and their activities online. As our professional investigation capability evolves, so do the online tactics of threat actors themselves, in something of a perpetual cat and mouse game...

One of the most intriguing and potentially destabilising tactic changes of the past few years is decentralisation.

What is decentralisation?

Decentralisation is the process whereby operational control, planning and coordination of an organisation is moved away from a central command structure (HQ) to smaller groups, members or organisations within it. In the context of a threat actor organisation, this means no clear and tangible leadership controlling the day-to-day activities of its members. The most well-known example of a decentralised threat actor is the current day Islamic State; which grew dramatically to eclipse it’s hierarchal, less agile ‘parent’ Al Qaeda. Today, we are witnessing a similar tactical development in violent Extreme Right Wing (ERW) organisations, particularly in Western Europe and America.

With no central command structure or common organisational ‘root’, it’s extremely difficult to combat the issue as a single entity, prove common ownership, or establish affiliation between disparate cells or people. It’s like the mythological Lernaean Hydra: cut off one head and another grows back. Decentralised networks of small cells or autonomous individuals, are more dangerous and unpredictable because they can self-deploy quicker and obscure their links to the wider network with more easily.

Over the last decade, many ERW movements in the US have learnt that operating as centralised cohesive movements under one name or banner has been their undoing. G2roups like Proud Boys, Oath Keepers, and the Three Percenters—using consistent branding, platforms, media and language—have effectively been dismantled following the riots in Washington DC on 06 January 2021. These groups are now implementing the tactics of leaderless resistance, and so threaten our understanding of dangerous groups if we don't evolve at the same pace.

Where did it start?

As with most ERW tactic changes, the shift to decentralisation didn’t happen overnight. It was a gradual change to increase operational security and avoid accountability. A key example of this is the Active Club Network.

The Active Club Network began as a white supremacist street-fighting (mixed martial arts or MMA) club which originally formed as the Rise Above Movement (RAM), created by Robert Rundo in California in 2017 as the ideology of alt-right supremacism started to grow. The movement was presented as the ‘premier MMA club of the alt-right’. Initially, RAM campaigned alongside other alt-right groups for white supremacy, traditional family values, and the removal of the global elite—which they claim is run by a Jewish cabal fronted by a liberal new world order. However, after the 2017 Charlottesville ‘Unite the Right’ rally, RAM lost prominent leaders to arrests and shifted tactics to focus on online propaganda efforts while running MMA and other fitness classes offline.

In late 2020, Rundo moved to Eastern Europe, partnered with neo-Nazi Denis Kapustin, and started the ‘Active Club Podcast’. The podcast encouraged supporters to form local MMA and other contact sports groups. Not to improve male health or discover the next UFC star, but to create ‘warriors’ to ‘preserve’ European and American white heritage. These groups only have two centralised tactics: localised recruitment and mobilisation, and to be cautious about online activity (that links them to a central ideology or command structure). Rundo and Kapustin do not control these groups and are therefore not tied to their illegal activities, such as the terror charges pressed against the leader of the UK-based Active Club ‘White Stag Athletic Club’, Ashley Podsiad-Sharp.

Over the last four years, the Active Club Network has grown exponentially (linked to an increase in far-right extremism both societally and in mainstream and populist politics). As of 2024, PGI has identified over 60 Active Clubs across the US, UK, the Balkans, France, Germany, Norway, Belarus, Australia, and New Zealand. Each group follows its own set of Tactics, Techniques and Procedures (TTPs) for recruitment, propaganda, and training. This was the intention of Rundo and Kapustin, who realised that centralised group TTPs are quickly identifiable and easily attributable by researchers and counter-terrorism law enforcement, who historically rely on stable signals, frameworks, and common tactics to generate intelligence. Dispersed, scattered, and decentralised groups have greater longevity, particularly online as it leads to a much more diverse and harder to track set of TTPs. This means signals and indicators that would otherwise be used to prove association to a designated group (whether proscribed by law enforcement, or just banned by a specific platform) may not be apparent at first (or even second or third) glance.

How will the threat develop?

We expect more groups to adopt the decentralised tactics of the Active Club Network. Well-known, previously centralised, groups like Patriot Front and Proud Boys have already begun implementing the same structural changes, encouraging supporters to start their own independent chapters. With the aim of keeping the ideology of their organisation alive while avoiding the dangers of a centralised movement, such as legal repercussions for the central ‘leaders’ and quicker online deplatforming. These are all lessons learnt from the 06 January 2021 arrests, where centralised leaders such as Proud Boys’ Enrique Tarrio were given lengthy prison sentences for both their own actions at the insurrection, and the actions of others in their organisation.

PGI have also tracked a rise in ERW group partnerships. For example, Patriot Front chapters have been frequently sighted with local Active Clubs, at fight-training sessions and engaging in neighbourhood patrols to place propaganda stickers and graffiti for their respective groups. We have also seen a sharp rise in US-based ERW groups using social media to grow membership and support outside of the US. Some have even sent representatives to EU countries to start transnational chapters and to build partnerships with other ERWs.

These changes present new challenges for the trust and safety landscape. Groups are no longer operating in a single geography, nor are cells or chapters of the same organisation operating under the same TTPs. In 2024, keeping pace with dangerous organisations and individuals requires more agility and big-picture thinking. This is why PGI go beyond investigating the content a group is disseminating and seek to identify and understand how it is being disseminated, by whom, and find the spaces where discussions of tactical shifts are taking place so that we can remain toe-to-toe with the threat.

Talk to us if you want to find out how we do it…