The perpetrator of Halle has streamed his attack live on the Internet. However, only five people have followed the approximately 35-minute live broadcast on Twitch. 2200 people subsequently saw the recorded video on the platform before it was locked.
The perpetrator had therefore created his account two months ago and started until yesterday only a streaming attempt. Twitch wants to permanently block all user accounts that are still trying to distribute the video.
Noteworthy is the claim that the video has never appeared in any recommendations, instead "our research suggests that people have coordinated and shared the video through other online services." The company, which belongs to Amazon, does not explain this in any detail. But it suggests that the video is by no means out of the world.
For the distribution of such videos there are already standard tactics
The companies Facebook, Instagram, YouTube, Twitter, Reddit, Snap, LinkedIn and Microsoft, which are organized in the Global Internet Forum to Counter Terrorism (GIFCT), have a tried-and-tested protocol for such cases: In a so-called hash process, they create digital fingerprints of a video and share them with each other in a common database. If the video is uploaded to one of the websites, the operator recognizes it at the unique hash value and can stop the upload or the publication automatically.
Much depends on how Twitch's allegedly co-ordinated distribution of the hall video mentioned in Twitch expired.
- If only the link to the stream or its recording had been distributed, the distribution would have ended with the removal of the video by Twitch, the links would go nowhere.
- If the original video itself is also distributed as a file in mp4 format, at least within the anti-terror network GIFCT, the hash procedure is used. Because the always identical video always has the same hash value, the upload can be prevented automatically.
- However, if the original video is changed, the hash value also changes. It starts a cat and mouse game between platforms and uploaders: Crucial is how good the algorithms or moderators are in recognizing an altered video in order to hash this and block it.
The changing of the videos is now a standard tactic, as has shown at the latest the dissemination of the perpetrator video of Christchurch. Facebook wrote in March: "First, a core community of malicious actors has repeatedly uploaded edited versions of the video that should overcome our recognition systems." Second, many more people, some of them unintentionally, made more difficult-to-read versions circulate by filming the video from another screen on their smartphones or using screen-grabbing software. As a result, Facebook ultimately discovered more than 800 visually distinguishable variants of the clip.
Recognition based on the soundtrack
In response, Facebook began to expand its detection technology to include audio matching. The sound in the video, be it background music, conversation or other sounds, should help to recognize a changed video since then. However, it is also clear that such a thing can be handled easily, if one does not place increased value on the original soundtrack as a propagator.
In the case of Halle, Facebook also claims to have identified several versions of the video. How many and how often the video was finally shared and viewed on Facebook's platforms, can not or does not want to say so far.
Regardless of the efforts of Facebook and the other major platform operators, there are plenty of vendors who are not members of the GIFCT and have less rigorous uploads of their users. 4chan and other message boards are among them, according to Reuters news agency, copies of the video were distributed there, as well as in the telegram channels of far-right groups.
Researcher Megan Squire, who is investigating the spread of extremist content on the Internet for the Center for Analysis of the Radical Right (CARR), confirmed this in a first, superficial analysis. She has found that one short and one long version of the hall video alone has reached about 15,000 users via public telegram channels - within 30 minutes. The number does not have to be exact, but it still shows how unimportant the numbers of Twitch are, the original channel the offender chose.