Ten “Rs” of Social Reaction: Using Social Media to Analyse the “Post-Event” Impacts of the Murder of Lee Rigby

ABSTRACT This article provides a case study analysis of social reactions to the murder of Fusilier Lee Rigby in 2013. Informed by empirical data collected by systematic monitoring of social media platforms, the analysis identifies a number of online behaviours with offline effects—labeled the ten “Rs”—that collectively constitute the process of social reaction to the crime. These are defined as: reporting; requesting; responding; recruiting; “risking”; retaliating; rumouring; remembering; reheating; and “resiliencing”. It is argued that the ability to observe these behaviours through the application of qualitative social media analysis has considerable potential. Conceptually, the analysis provides new insight into the complex and chaotic processes of sense-making and meaning attribution that arise in the aftermath of terrorist attacks. It illuminates how patterns of social reaction on social media are nuanced and complicated, with different segments of the public interpreting the same developments very differently. In addition, the findings and the conceptual framework outlined have implications for policy and practice development in terms of establishing a more effective and evidence-based approach to the consequence management of “post-event” conflict dynamics and social reactions.

Speaking shortly after the terrorist attacks in Paris upon the staff of Charlie Hebdo magazine in January 2015, the Director General of the UK Security Service cautioned that future successful attacks on British soil were almost inevitable. 1 It was, he elaborated, impossible for the police and security agencies to prevent all of the plots and attempts being brought forward. As well as delineating an ongoing sense of threat stretching into the future, these remarks also implicitly and intriguingly highlight a neglected issue in the terrorism studies literature.
Over the past decade there has been a significant increase in the quantity of research on nearly all facets of terrorism, emanating from a diverse range of disciplines. The vast majority of these studies have, in different ways, focused upon issues of prediction, preemption, and prevention, especially with respect to individuals and groups thought likely to engage in terrorist activities. 2 However, far less is known about what happens in the aftermath of terrorist attacks and how processes of social reaction unfold and develop. If, as the Director General suggests, future attacks are almost inevitable, this begins to look like a significant gap in our knowledge. For if you cannot prevent such incidents happening, there would seem to be considerable public value in understanding what happens following attacks of this kind, in order to leverage more effective management of their community impacts and consequences.
It is with this issue that the current article engages. Informed by empirical data collected in the days, weeks, and months following the killing of Fusilier Lee Rigby in London in 2013, it sets out an account of how processes of social reaction emerge, evolve, and adapt. These data were collected by monitoring social media from the first tweet from an eyewitness at the scene of the attempted beheading on the street in Woolwich, through to the conclusion of the court case. The dataset collected thus spans 35 million data points, cast as digital traces of social action and emotions, to provide a high-resolution picture of what happened following this particularly heinous killing. The point being that, certainly compared with more orthodox research methods that can be applied to study processes of social reaction to defined events, collecting and analysing social media affords a higher resolution and more agile way of tracking and tracing how processes of social reaction develop and evolve over time.
There have been several investigations of the Rigby case, including the application of social media analytics. Understandably the most detailed commentary upon the case relates to the enquiry conducted by the House of Commons Intelligence Select Committee, which had a particular focus upon the extent of the opportunities that police and the Security Service had to detect and interdict the two suspects. 3 A rapid content analysis of 20,000 Twitter messages to the Metropolitan Police Service in the wake of the Rigby murder was undertaken by researchers at the think-tank Demos to ground an argument that police organisations need to develop a "SOCMINT" (social media intelligence) capability. 4 Quantitative analysis also underpins the approach of Burnap et al. and Williams and Burnap 5 and their focus upon modeling the propagation of "cyber-hate" by co-opting aspects of Cohen's 6 phases of moral panic. McEnery et al. 7 provide an alternative, more qualitatively-inspired, methodological take on the issues, finding that mainstream media accounts play an important role in steering and guiding the social media conversation (but the reverse is less true). The latter point was harnessed in support of the present work.
Compared with these previous studies though, the approach reported herein represents the most thorough and rigorous analysis of the Rigby case conducted to date. The raw volume of data collected, in conjunction with the duration over which it was gathered, afford unrivalled opportunities to understand how processes of social reaction, enabled by social media communications, unfold and develop. The application of qualitative analytic approaches to studying the whole of the case, from crime scene to court, enables the article to identify a number of hitherto neglected aspects. This in turn affords a number of new theoretical insights and innovations in the form of ten distinct behaviours that collectively configure the overarching process of social reaction that occurred in the aftermath of the Rigby case. Documenting and describing these constitutes the main body of the article. Prior to this though, a more detailed account of the research design and methodology is provided. This includes mapping the contours of the dataset. The conclusion returns to the policy and practice implications of generating new insights into processes of postevent reaction. In addition, we also seek to develop a more conceptual account of why the neglect of these issues represents a significant oversight.

Research design and method
At around 14:20 on May 22, 2013, a member of the public made an emergency call to the Metropolitan Police reporting an unfolding incident in Woolwich, London. Within 14 minutes armed officers were at the scene where they shot and apprehended two armed suspects. Lying dead in the road was the body of Fusilier Lee Rigby, whom the two suspects had attempted to behead in what was later identified as an Islamist extremist terrorist attack. In response to the attack the English Defence League (a Far-Right political group) mobilized to engage in violent public disorder that night, throwing bottles and stones at the police. Following this, for a number of weeks afterwards, mosques were attacked and those perceived to be Muslim received insults and were subject to physical attack in the street, including an arson attack on the Al-Rahma Islamic Centre in Muswell Hill, London. In June and July in Walsall, Wolverhampton, and Tipton, a series of explosive devices were detonated outside mosques-the Tipton device being packed with nails. Pavlo Lapshyn, a White Supremacist Ukrainian student, was later charged and convicted of those offences, and with stabbing to death an elderly Muslim man in Birmingham near the Green Lane Mosque.
From the initial incident, right through to the conclusion of the sentencing of the two killers ten months after the initial attack, details about all of these events were being communicated via social media platforms. At the time of the original attack the authors were working in South London testing an experimental social media data-mining software program called "Sentinel." By chance, the software was collecting data when initial social media posts first appeared about the incident in Woolwich. Although it had never been run at scale, given the clear significance of the unfolding events in Woolwich, a decision was taken to keep the collector running. By the conclusion of the suspects' criminal trial a total of 35 million individual pieces of social media had been collected, mostly from Twitter.
The research-grade platform used to collect and analyse the data possesses much of the functionality available in other similar commercial packages. However, a key feature of Sentinel is that it is designed as a "glass" rather than "black box." That is, it enables transparency in terms of how decisions taken to alter data collection or processing protocols shape and guide the materials and insights that result. This approach seeks to engage with an issue of increasing concern about the extent to which deliberately obscured algorithms are subtly and imperceptibly crafting what is rendered visible and invisible, and thus what constitutes knowledge in the social world. 8 In terms of performing its data collection functions, the Sentinel platform plugs directly into social media feeds through free API keys. In relation to this study, this included Twitter and a series of blogs. The stream of data accessed via this route is filtered by a series of "channels," each of which consists of up to 400 linked search terms covering relevant people, places, problems, and issues. In the process of developing the platform, several "pre-built" ontologies were developed-usually related to a geographical area, but in addition, and as happened in relation to the Lee Rigby case, these can be more datadriven. This combination allows Sentinel to monitor social media through a bottom-up ontological approach utilising FlexiTerm 9 and a top-down set of high-level terms, but when an event or issue of interest is detected it can be rapidly "tuned" to an event by users programming in new sets of words and terms as the details about the event in question are revealed. In this study, the breaking events were picked up on the basis of a pre-built ontology which was rapidly refined to focus upon key terms associated with the specifics of the case including "Woolwich" and "soldier." As more details became available, a second "channel" was brought online focusing upon the activities of the English Defence League as it became quickly clear they were key actors in the unfolding narrative. Then a third channel with a lot more specific situational detail was developed and deployed by the end of the second day. Figure 1 below plots the volume of social media data in relation to the murder of Lee Rigby collected via these channels for this study over a six-month period. Plotted onto the graph are some of the key events that occurred in order that the association between communication volumes and important developments can be ascertained.
It can be observed that there was a massive spike in the volume of communications traffic on the day of the murder. This fell back, albeit remaining at a comparatively high level for a couple of weeks. Subsequently, there was a progressive diminution in the levels of interest, although there were significant increases in social media communications relating to key incidents and events.
Splitting the data into three "streams"-"Woolwich," "Rigby," and "EDL"-intimates aspects of how the public narrative of the incident evolved over time. For instance, the initial public interest on social media gravitated around the place where the crime happened-Woolwich-in the absence of any more detailed information. Once the identity of the victim was established and publicised then "Rigby" became a more important signifier for the story and became a focal point for the organisation of the public conversation. However, this ebbed away quite quickly, re-emerging at key points such as around the funeral (see below). Contrastingly however, the "EDL Channel" demonstrates a more sustained level of interest and activity according to the graph. Originally this channel picked up in terms of the volume of activity around 4 hours after the murder, as members of the EDL sought to mobilise their members, whilst other political groups  opposed to their views engaged in a counter-mobilisation effort. These interactive dynamics continued for several weeks, as an artefact of how the Far-Right membership sought to use the Rigby case as a "condensing symbol" via which to project their ideological agenda. 10 As implied by the above, the operationalisation of Sentinel as a research tool took place in two modes. There was a dynamic "fast-time" mode where, as the case developed over the first few days, the stream of text and image data was being monitored and queried in "real-time" by members of the research team to get a sense of what was happening, with interesting occurrences, developments, and accounts being recorded. Importantly, whilst this fast-time analysis was ongoing, the programme was acting like a digital recorder, storing relevant material for a slower-time more deliberative analysis in the second mode of operation.
Full analysis of the data commenced by developing a quantitative overview across the event as a whole and then, on the basis of the fast-time analysis and other sources (largely broadcast media and press accounts) identifying the key sub-events in the case narrative and connecting these to the social media timeline (as plotted on Figure 1 above). Data for more detailed coding were then sampled at those points where there were significant "spikes" in the volume of social media data, across the twelve-month period covered. The focus here was on the build-up to and the period of high volume traffic. These periods were divided into 3-hour units and further sub-divided into 15-minute sub-units with the data relating to these periods of time being screened for interest and relevance. This involved members from the research team rapidly reading and "screening" around 500,000 Tweets in total and differentiating those that helped understand the story of the sub-event in question, or appeared to relate to the conceptual themes emerging to orient the study overall (see below).
From the resulting dataset, around 17,000 messages were subject to more detailed axial coding 11 including: whether the content was extremist in terms of expressing Far-Right/Far-Left/Islamist views; the presence of emotional attributes including fear, anger, shock, revulsion; and whether it could be identified with a particular group. This work was undertaken by a small team with regular inter-rater reliability checks, especially when some new or innovative dimension to the data was identified. An additional 2,000 tweets were subject to even more detailed coding to try and obtain insight into the complex interactional dynamics that were observed as taking place between different ideological positions. By reading large volumes of material, the researchers were able to detect patterns in the material which were coded and subsequently used to derive conceptual categories to account for them. This interpretative and sense-making work was framed by several sociological themes that had been defined as pivotal to the intellectual orientations of the study, including: issues of "conflict dynamics"; 12 the literature on processes of social reaction emanating from symbolic interactionist sociology; 13 the social psychology of risk perceptions and rumours; 14 and how and why some events function as "signal crimes" that re-orient the institutional and interactional ordering of reality. 15 It is through this blended approach of conceptually-driven and data-driven interrogation of the data collected that the ten conceptual categories reported in this article were derived. As such, the data reported in this study are representative and illustrative of broader patterns and trends, selected on the grounds that they are especially "luminous," in the sense that Katz 16 uses the term, of some of the principal conceptual interests of this article.
An important finding of this qualitative coding effort was that approximately 20% of the Twitter messages that the data collection algorithms had identified as connected to the Rigby case actually emanated from several previous conflicts, in particular the Boston Bombing that had taken place some months earlier. This is of considerable import for more quantitative analyses 17 on the grounds that the data they are processing may actually contain a lot of "noise," in terms of including communications relating to other similar but distinct events, thereby decreasing the accuracy of the statistical models being developed.
One further aspect worth noting with respect to some of the sub-events was the integration of attempts to validate what happened and why through recourse to external datasets. This included, for example, accessing recorded hate crime data supplied by the Metropolitan Police Service to check an apparent association identified through the social media analysis between the occurrence of extreme language and reports of hate violence towards Muslims.

Social reactions to crime and terrorism
In his case study account of the social impact of, and reaction to, the 1991 assault by Los Angeles Police Department officers on Rodney King, Jacobs 18 made two important generalizable points with respect to the study of social reactions to crime. First, he notes a general failure to attend to the impact of specific and defined events with any rigour. Second, there is, he posits, a tendency to portray public reactions in an overly homogenized fashion, neglecting the extent to which differently situated segments of a population can interpret the same event very differently.
Studies of the processes of social reaction to major crimes and associated issues have been dominated by two key theoretical perspectives: a) moral panics; and b) the fear of crime. There have of course been other contributions, pivoting around more sociopsychological ideas, but in terms of exerting a sustained gravitational influence upon the study of social reactions to crime, such accounts have achieved far less traction than the concepts of moral panic and fear of crime.
In his original formulation of moral panics, Cohen 19 was concerned with setting out the politico-cultural processes via which, when subject to troubling or concerning episodes and events, key institutions of the state engaged in forms of collaborative collective action via which a sense of order was reasserted and potential risks or threats neutralised. It is a mode of analysis that has subsequently been picked up, adapted, and applied widely by scholars addressing a diverse range of social problems, including gang violence 20 and terrorism. 21 In setting out his theoretical frame, Cohen was precise in specifying what conditions did and did not qualify as a de facto moral panic. He was clear it required a threat stimulus posing a normative challenge to the extant ordering of reality. In this sense, it was not just the ramifications of a nasty or vicious act-rather a perceived threat had to be imbued with wider symbolic meaning. Cohen was equally adamant that a sense of "panic" had to be induced, defined as an intense, relatively short-lived sense of irrational concern and anxiety. Of particular relevance to terrorism is that whilst evoking panic was not part of the intent of the youth subculture that Cohen was interested in, such extreme affective reactions are the aspiration of terrorist groups.
The second core influence upon studies of social reactions to crime and disorder has been the concept of fear of crime. The vast number of studies of fear of crime can be differentiated according to whether they position fear as a "cause" of other issues and problems, or as a "consequence" to be reduced and managed. 22 Although there have been a number of studies utilising qualitative research instruments to attend to fear of crime as a defined form of social reaction, these are dwarfed in number by those based upon crosssectional analyses of large-scale structured surveys. 23 These methodological considerations are important inasmuch as they point to how the issues and problems that are highlighted and privileged in social scientific studies are derivatives of the methods used. As Hacking 24 amongst many others has argued, the methods deployed in our studies are simultaneously "ways of seeing and not seeing." That is, they inherently and ineluctably guide analytic attention towards some aspects of a setting or situation. This is especially true in terms of understanding fear of crime and moral panics as forms of social reaction, but even more so when attending to the influence of social media on the contemporary dynamics and mechanics of social reaction. Especially given how the algorithms that process these data and impose an ordering of reality upon them are functioning as profound new instruments of social perception, selectively steering collective attention towards some matters and away from others. 25 Innes 26 suggests, with respect to the former in particular, it is noticeable that fear of crime has tended to be treated and studied as an aggregated artefact of levels of crime, rather than as an attributable consequence of individual incidents. This is because traditional research methodologies have proven prohibitively expensive and insufficiently agile to afford the opportunity to study the impact and effects of individual crimes with sufficient levels of validity and reliability. Indeed, the study of social reactions has been curtailed by the fact that, in terms of collecting "high-resolution" and fine-grained data, the orthodox and established research methodologies are just not up to the task. However, the premise of this article is that this is a limitation that "big" social media datasets have the potential to overcome. 27 The analysis of these data identified ten distinct components of social reaction: reporting; requesting; responding; recruiting; "risking"; retaliating; rumouring; reheating; remembering; and "resiliencing." These will now be addressed in turn.

Reporting
Ohhhh myyy God! I just seen a man with his head chopped off right in front of my eyes! Woolwich (14:09, 22 May 2013) 28 Shortly after, this witness at the scene used Twitter to report the police shooting the two suspects as follows: Oh my God. The way the Feds took them out! It was a female police officer, she come out the whip and just started bussing shots (14:17, 22 May 2013) Before sending a further message that filled in some important details about what he had witnessed: The two black bredas run this white guy over then hop out the car and start chopping mans head off with machete! HellsEmpty (14:20, 22 May 2013) This sequence of messages clearly captures one of the key behaviours enacted by social media users in the aftermath of significant events-reporting to others what they have seen and heard via public and semi-public platforms. In addition to this individual, others in the vicinity to the crime also broadcast written descriptions, and others used the cameras on their mobile devices to capture and transmit images of what was happening.
These tweets and associated images of the assailants at the scene with blood-soaked hands and carrying meat-cleavers had a profound impact upon how the incident was subsequently reported by national press and broadcast media. 29 Indeed, the tweeter of the messages reproduced above was contacted directly via Twitter by journalists within an hour, offering him money for pictures and rights to his tweets. This is symptomatic of a new media ecology whereby citizens at the scene of a crime are not just witnesses in a legal sense, but enmeshed in the reporting of such events to the wider world. By the end of May 22nd, the messages mentioned above had been re-tweeted 11,000 times and had been cited in nearly 34,000 other social media posts. A second online response to the images being tweeted from the scene came from the Metropolitan Police Twitter account asking people not to disseminate images from the scene on the basis that they might identify their SO19 firearms officers. Similar forms of "reporting" behaviour via social media were evident throughout the dataset, whenever important events or developments occurred. However, it is worth dwelling a little more on how news was "broken" about the principal crime, as such patterns may have especially profound implications. For prior to the mass availability of social media platforms on mobile technologies, most such public stories relied on breaking events coming to the notice of journalists who would be dispatched to the scene. In the case of broadcast media this would also involve getting a camera crew to the scene. This effort very frequently meant that by the time the media were present, police first response procedures were well under way, and they had established a degree of control over the scene and who had access to it. Contrastingly, what the above data convey is how an eyewitness directly observing the unfolding of events is broadcasting updates about the crime and initial police response to it in almost real-time. 30 Inevitably this has implications for the social control work of police responding to terrorist incidents. For the speed of communication that is involved fundamentally challenges some of the core standard operating procedures used by the police to guide their initial response to critical incidents. Through their training, police are encouraged to think in terms of there being a "golden hour" at the start of an investigation, which is critical in determining the quality and quantity of evidence available to any criminal investigation. As such, police first responders need to establish control of the scene of the crime. This sense of control encompasses both who is allowed access once the area is "sealed," and equally importantly, what information about the crime is made available, and when. 31 In the Association of Chief Police Officer's "Murder Investigation Manual" 32 the imposition of a sense of control, during what are often confused and initially fairly chaotic social situations, is a permeating narrative. For example, a key part of the investigative strategy is to use press briefings and conferences to release information to the public. In terms of these kinds of implications therefore, rather than the increasingly over-used notion of "big data," it may be more insightful for police to think in terms of "fast data." What can be observed in relation to the materials emanating from the scene of the Rigby murder is just how difficult information control has been rendered in a social media era. "Crime scenes" have become more permeable than they were in the past, with details being reported directly into the public sphere about aspects of what has happened. In this case, there was an almost contemporaneous reporting of unfolding events.

Requesting
Accompanying the use of social media by citizens to report were ongoing requests for information or updates about what was occurring. Often these kinds of requests came initially from people who were not quite in the right place at the right time to be able to report what happened, but who picked up on a range of signifiers in their situated environment, connoting that something might have occurred. They immediately used their social network to try and ascertain what might be transpiring. This is exemplified by the following Tweet: Across the dataset as a whole, for all the key developments and events associated with the killing and its aftermath, it was observed that social media played an important role in enabling these reporting and requesting sequences. So that as more details started to reach more people, the nature of the requests being made via Twitter and other social media platforms evolved and effectively matured as people were searching for more valid and reliable sources: Anyone with any 'verified' info on what happened in Woolwich? (15:11) Here it can be observed that the request has moved on from being "any" information about what is transpiring in Woolwich-as this was now circulating-to materials that can be interpreted with some confidence.
What emerges from analysis of these reporting and requesting sequences of behaviour is just how effective they are in piecing together a reasonable definition of the situation, with several members across the social network sharing accurate information about a rapidly unfolding event. It was also notable that official sources did not respond to any of these requests for information; in the first few hours, it was an informal effort. In sum, the availability of social media data enables a detailed account to be reconstructed of how, in the first few hours after the terrorist attack, there was a confused and chaotic form of public sense-making, where social media functioned as an important informational resource for members of the public in the local area.

Responding and recruiting
As details about what had happened in Woolwich were more widely shared and broadcast, so there was a detectable shift in the predominant patterns of communication. This involved a move from Twitter users requesting information to an articulation of their emotional, cognitive, and behavioural responses to the news of the attempted beheading. Initially, the emotional tenor of these responses pivoted around expressions of shock and horror, which later evolved into anger and fear.
A second group of "responses" identified in the data were in fact responses to messages put out by the authorities and political leaders about the event. Many of these "responses to the responses" engaged in forms of commentary and critique of what was being conveyed. It was observed with respect to both categories of responses some communications were translated into attempts to "recruit" people into participating in specific actions and/or groups.
That terrorist acts are designed to function as "propaganda by deed" is now well established. 33 It is accepted that the intent of those launching terrorist attacks is to sustain and embolden the commitment of their core support, and attract those whose support is "softer" in its constitution. In the datatset collected after the murder of Lee Rigby, whilst there was some evidence of these kinds of activity being undertaken by Islamist groups, this did not make up a substantial proportion of the data overall. Far more of the "recruiting" activities detected were undertaken by Far-Right and Hard-Left groups trying to mobilise potential participants in collective action events. Thus "recruiting" is used here in a fairly catholic sense. It does not just involve formally joining or aligning to a defined membership group, but can involve sympathising with an ideological viewpoint, expressions of solidarity for a group, and ideally direct involvement with them.
The instigation of recruiting activity can be observed occurring quite rapidly after the attack on Fusilier Rigby. By 18:00, social media channels were being used by representatives of the English Defence League and allied groups to organise a protest on the streets of Woolwich that night. Deploying a rhetoric of outrage and what Collins 34 dubs "righteous anger," growing numbers of messages were being sent calling for established EDL members and any "fellow travellers" to their ideas to meet in Woolwich at 21:00 to mount a public demonstration.
From an analytic point of view, the intriguing aspect of the recruiting process is how it triggered a counter-mobilisation effort amongst Left-Wing and anti-Fascist groups. Monitoring the public social media traffic via which the Right-Wing recruiting calls were being made, a perceived threat was detected which led those of a different political persuasion to launch their own recruitment drive urging those sympathetic to their views to mobilise in opposition: It is clear that social media has become an important recruitment tool for a range of groups, who use it to try and persuade both known members and those sympathetic to their views, to involve themselves in collective actions in dynamic and rapidly developing events. It is also evident how data derived from these sources provide nuanced insight into the emergence of conflict dynamics in the aftermath of terrorist atrocities, and the ways that constructions of different threats function as stimuli for particular recruitment efforts.

"Risking"
A key category of communications in the dataset comprises messages intended to either amplify or mitigate the perceived risks arising in the aftermath of the incident. A conceptual distinction can be drawn between social media communications that were seeking to: a) anticipate and "rehearse" likely developments; b) purposively increase the level of risk through, for example, deploying hate-filled and highly emotive language; and, c) reassure and mitigate the public perceptions of risks using social media.
What might be termed "rehearsing" behaviours were forms of communicative action used to anticipate and make predictions about what was likely to happen next. On the first evening for example, a number of those commenting on the unfolding events, at least as they appeared across social media platforms, were rehearsing that the reaction to the killings of Lee Rigby were likely to involve further problems and violence: This beheading, if it is to a serving soldier and by non-white persons, is going to be a propaganda goldmine for the EDL and UKIP (17:20) There will be a response no matter who ever the identities of those responsible are, This disgraceful act cannot be ignored (17:38) Frightening that EDL are calling for 'revenge' after #Woolwich attack (17:40) These rehearsals came to the fore around moments where key events were happening and especially when community tensions were elevated.
Distinct from these kinds of communication, there were messages whose content seemed explicitly designed to amplify perceptions of risk and crisis: OF COURE #EDL will capitalise on this! More Hate Attacks, More retaliatory crimes. WELCOME TO HELL! #UK #WOOLWICH (17.46) Typically, as with this message, these risk-amplifying tweets used inflammatory and extreme rhetoric, to "prepare the ground" for a shift to retaliatory behaviours and conduct. Opposed to these risk amplifying communications were messages from the police and other political and civil society leaders, intended to mitigate these, and reassure about the actual levels of risk.

Retaliating
Both of the previous two behaviours were effectively foreshadowing a move to retribution and retaliation. This is the sixth "R" in our analysis. As is evident from the preceding sections, social media plays an important role in terms of the social organisation of moves towards retaliation. Equally however, it provides a useful documentary record of retaliation events when they occur.
In their recent article on the aftermath of the Lee Rigby attack, Williams and Burnap 35 attend to how the killing elicited outrage that in turn occasioned a significant increase in levels of online "cyberhate" in the first day following the murder. Consistent with the thrust of their argument, the present analysis also identified a rapid pick-up of hate crimes and sentiments being conveyed via social media. However, where they focused upon quantified measures of these emotions, we think it important to understand the content of what is being communicated. This is on the grounds that, within the aggregated messages, there are some that are especially important and influential in seeding the move from communicational retaliation to physical retaliatory violence. For example, through the detailed qualitative coding of tweets drawn from the initial reaction phases, the following message was identified as being highly significant: @Official_EDL: ****CONFIRMED WE HAVE BEEN SUBJECT TO A TERROR ATTACK BY ISLAM, WE ARE CURRENTLY UNDER ATTACK**** (18:06) Broadcast via the EDL's official Twitter account, this raised the stakes-seeking to establish a new definition of the situation. It was a deliberate attempt to frame the events in Woolwich in a way legitimising retaliatory action. There then followed a number of messages from this account and other associated ones seeking to mobilise and organise a collective dimension to the retaliation: EDL leader Tommy Robinson on way to Woolwich now, Take to the streets peeps ENOUGH IS ENOUGH (18:26) @Official_EDL: Message from Tommy-Feet on the streets anyone want to go to Woolwich contact him/me, he will be there around 9pm (18:59) Some of these messages were trying to co-ordinate a collective mobilisation effort, whilst others were explicitly seeking to escalate the emotional "heat" of those exposed to these communications: Its time we had a national shoot a paki day and have it every year at £5 a head(money to charity) cull them (18:15) I HOPE THE EDL COME AND KILL THESE WANKERS ALL OF THEM. #woolwich #EDL (18:16) The first two messages in this sequence probably constitute hate crimes in their own right. However, the EDL mobilisation effort to get "feet on the streets" that evening was not very successful. Only a relatively small number of EDL supporters congregated in Woolwich, but according to reports on social media contained within our dataset they were significantly outnumbered by the police presence and were rapidly dispersed.
This points to a key policy and practice decision for police in terms of the consequence management of terrorist attacks. How much should they focus upon managing online versus offline reactions, especially given how in such circumstances their capacity and capability is stretched anyway? Importantly what transpired with respect to the Rigby case, it was actually not in the first twenty-four hours that the most egregious instances of retaliatory physical violence took place. Rather these kinds of repercussions occurred in the days following. Indeed, the reaction pattern in terms of actual hate-inspired violence appeared to conform to Randall Collins' 36 model of conflict dynamics. Collins presciently identifies that it is once the initial shock of an attack has passed that the potential for further violence becomes most acute.

Rumouring
Research on the functions of social media across a range of social settings and situations has identified that it plays an important role in disseminating rumours about unfolding events, some of which turn out to be accurate whilst others are false. In his seminal work on rumours, Shibutani 37 classed them as forms of "improvised news" that are brought forward when important developments are occurring about which there is a lack of reliable and verifiable information. Developing this line of thinking, Innes 38 conceptualizes rumours as "soft facts"-that is information whose provenance is uncertain and the content of which may be remoulded and updated as time passes.
In the first few hours after the killing, spurred on by the reporting of eyewitnesses in the vicinity of the crime scene, much of the social media commentary was attributed the status of rumour. In keeping with the conceptual definitions outlined above, these were not totally false, but neither were they capturing the full picture: For days and weeks afterwards, as new developments in understanding what had transpired in Woolwich emerged, rumours continued to swirl about on social media. Some of these were inflections of fully formed conspiracy theories, whilst others were remarkably accurate. Of particular note in this regard was the fact that rumours about the identity of the two killers emerged on social media several hours before appearing in the broadcast media or press.

Remembering and reheating
As the process of social reaction evolved and developed in relation to some of the events and occurrences outlined previously, so a number of acts of "remembering" were evident across the social media platforms including Facebook and Twitter. Some of these were large-scale and bound up in the construction of the collective memory of the killing, pivoting around key rituals such as the funeral of the victim, as described more fully in the next section. 39 But prior to this, there were more individualized recollections and remembrances that seeded these more collective memories. For example, those who knew Lee Rigby, such as his commanding officer in the army, provided accounts of him that were circulated and shared widely.
Although not a large component of the overall social media traffic, some of the messages analysed indicate how attempts were being made to use Twitter to disseminate propaganda. This was clearly evident in the communications activity of representatives of established Islamist groups, who sought to celebrate and justify the killing. Similar efforts were also evident in the activities of other participants in the social media conversation. For instance, variations on the following theme were detected repeatedly: #woolwich attack. This is war. First gang raping our children now beheading people on the streets of south London in broad daylight #EDL (18:18) Evident here is a process of connecting the most recent atrocity event to a previously established litany of social problems that can be attributed to the perceived "enemy." Reheating prior grievances in this way is a device for "stitching" the latest atrocity into a wider and more well-established narrative. This serves two functions from the point of view of those involved. First, the most recent event in the sequence of grievances that form the overarching narrative serves as an "evidential warrant" for the more generalised claims that the narrative sets out. Second, the established narrative implicitly steers and justifies the attribution of blame to particular groups. This is accomplished by setting out additional examples of where other problematic behaviours by members of the group under suspicion have been identified. Of course, the validity and reliability of such narratives and interpretations is often contested. But that is not the point. For people with an established viewpoint and ideological perspective, reheating past atrocities to connect them to more recent events serves to further instantiate their values and views.

"Resiliencing"
Within the academic and policy literature on terrorism, there has been increasing interest in the concept of individual and community resilience. 40 The preponderance of this attention has focused upon social-psychological factors that function to insulate people from the influence of terrorist ideologies and narratives. But opening up the concept of resilience to look a bit more widely, it has also been used to capture qualities that help mitigate the social impact of disasters on urban areas and communities. 41 Blending aspects of these two conceptualisations, in the current dataset, there are several examples where social media communications were being used to design and organise a range of activities intended to constrain the social consequences of the murder. This work of mobilising groups to demonstrate and enact "pro-social" responses to the presence of risk and threat can be, somewhat inelegantly labeled "resiliencing." A clear example of this kind of behaviour pivoted around the funeral of Lee Rigby. In the context of a process of social reaction marked by multiple secondary conflicts and periods of considerable community tension, events around the funeral played an important symbolic role. As well as more official communications from senior political and establishment figures, many ordinary people sought to use social media channels to convey condolences and respect. Taken as a whole, many of these messages were suffused with tones of salute, patriotism, and importantly, solidarity: Lee Rigby. You have united this country. You will be remembered with dignity. Your comrades and countrymen salute you. Rest in peace . . ..hero (10:00) On the morning of the funeral a Twitter campaign began to build calling for two minutes of silence to be observed at 11:00. Individuals and businesses nationwide posted their support and at one point someone tried to convert this into a Twitter silence by suggesting people post a particular hash tag to represent the act. These collective displays of solidarity and remembrance have been noted before, particularly post 9/11. Such displays, as Cialdini 42 has argued, work as "social proof" of collective solidarity and resilience.
An especially important "condensing symbol" in these collective expressions of remembering, solidarity, and resilience that blended together and traversed offline and online behaviours, was performed by an image of Lee Rigby's son at his father's funeral. A picture of him wearing a t-shirt with the words "My Daddy My Hero" was re-tweeted hundreds of times in the following few hours.
As had been widely reported, his father was wearing a "Help For Heroes" T-shirt at the time of his murder. Indeed, one of the earliest public displays of symbolic resilience following the murder involved large numbers of people trying to purchase "Help for Heroes" t-shirts from the charity concerned, after this fact was reported. It is notable that similar public rituals of "associative resilience" can be observed in response to other more recent terrorist incidents. For example, the widespread uptake of the "Je suis Charlie" moniker on social media and as a t-shirt slogan following the events in Paris in 2015 has a very similar feel to it.
Prior to the public memorialisation associated with the funeral, there had been multiple examples of resilience being enacted, often involving collective civil society actions to control and curtail prospects of retaliatory violence and public disorder by members of Right-Wing political groups.
In the days and weeks following the murder there were a number of media reports from around the country of serious violence against members of the Muslim faith and against several mosques. Community tensions were running high. One story however, "cut through" this general climate of unease and concern. It told of how tensions relating to an EDL march in York had been diffused when local mosque members had talked with the marchers over a cup of tea, and a friendly game of football had ensued. This story was picked up by many national media outlets and was repeatedly recounted by journalists. It became almost iconic in the narrative of the Lee Rigby murder, conveying how community impacts were being managed and a sense of order restored. For implicit in the narrative worked up by the journalists was the idea of how symbols of English identity (a cup of tea and biscuits, and football) were effective at diffusing the potential for conflict. However, analysis of the communications on Twitter surrounding this event suggest that the reality of what happened was rather different from the mediated narrative.
On May 23, 2013, the day after the murder in Woolwich, and after a night of EDL disturbances with the police, the message displayed in Figure 2 appeared on the Scarborough EDL Division Facebook page.
This protest was planned for the day following a large demonstration planned for Newcastle, and there was another scheduled for the day after on Downing Street. This may explain why only five supporters attended on May 26, from a division capable of fielding many more. The EDL support that did attend was significantly out-numbered by the counter-protest that was mobilised. The Facebook post by the Scarborough division of the EDL on the 23rd had acted as a source of alarm for some Twitter users, given the febrile and tense atmosphere across the country more generally. Consequently, on the day of the demonstration between 100 and 150 local people and students gathered at the mosque named by the EDL, to show their solidarity and counter any actions staged by the EDL. Given the large differences in numbers on the two sides, it is perhaps unsurprising that the small number of EDL activists preferred to have a cup of tea and play football.
Analysis of the data collected via Twitter suggests that the counter-mobilisation effort was scaffolded by a pre-existing social network established between the mosque and students and staff of York University. Social media platforms were important communications vehicles for getting the message out. This is consistent with Sampson's 43 recent revisions to his theory of collective efficacy, where he identifies that local institutional infrastructures are important in performing some of the "heavy lifting" required to resolve what are otherwise fairly intractable structural issues.
On Saturday the 25th of May the University of York's student newspaper, which is published online and in print, ran a story entitled "Twitter raises fears of York EDL rally." 44 The piece quoted the Facebook post above, and stated an anti-EDL protest was being organised that also involved the University's Amnesty International section and Student Union.
Details about the counter-action were widely re-tweeted. On the morning of the planned EDL demonstration, Twitter traffic repeatedly reiterated an invitation to participate: The #York community has been invited for tea at York Mosque (Bull Lane) today from 2pm to stand up to EDL threats. Pls RT YORK PEOPLE: Bull Lane Mosque, just off Lawrence Street has received threats of an EDL action. A counter-demo is assembling.
When the handful of EDL members did arrive outside the mosque to be greeted by a much larger crowd of people, members of the latter group used Twitter and other social media platforms to engage in "reporting" behaviour designed to capture the resilience being demonstrated by local communities: At #YorkMosque the EDL (we assume) have just appeared. Everything calm. They're about to be invited to tea. Some EDL at #Yorkmosque. All peaceful now. Tea and biscuits with the fascists. Oh #york.
Opposed by 100-150 supporters of the mosque, the 4-6 EDL supporters were invited in for tea. A number of tweets and blogs carried a picture of a female EDL supporter taking a cup of tea from a member of the mosque congregation. Later the supporters and protesters dispersed peacefully. It was only after everything had dispersed at the scene that the construction of what would become the public narrative started to become evident. That evening, several tweets put a very different spin on the event. There was no mention of the tiny EDL turn out. Bearing in mind there had been hundreds of EDL supporters in Newcastle the day before, one might be forgiven for believing that a significant defeat had somehow been wrought by the liberal application of tea and cake: Amazing rumours that the EDL has been thwarted in York by a Tea party hosted by the Mosque. Bloody love my home town #EDL showed up for a rally outside a York mosque today only to find 100 locals defiantly sipping tea and eating cake.
These tweets cleverly invoked a quintessential symbol of Britishness-a tea party-and link it with the mosque. It implicitly conveys a sense of how a very different faith tradition has been integrated within the local rituals and rhythms of life in Yorkshire. A symbol of Britishness was mobilised to manage a potential threat to community relations.
These passages and the social media data extracts embedded within them help to capture how social media communications are increasingly important in doing the work of organising resilience efforts. More conceptually, and equally intriguing, is the display of how the amplification of the perceived threat through a febrile mix of communications and communicators actually served to inflate the implicit significance of the resilient response that is performed. This was such a good story that it served to convey powerful messages about levels of integration and cohesion at a stressful time. Ultimately, we have not been able to ascertain whether this was happenstance or a quite brilliant propaganda initiative. Either way, it does suggest some potentially important lessons for what might work in responding to major terrorist incidents in the future.

Conclusion
Terrorist attacks engage communicative violence designed to induce specific effects in the public audience. 45 They seek to terrorise, polarize, and mobilize. For the general public, the intent is to evoke feelings of shock, horror, and fear. With respect to those groups whose social identities and interests the perpetrators of the violence purport to represent, the motivation is to polarize opinion-to establish which members of the wider communities are "with us" or "against us." And then finally, it is anticipated that the attack will lead to mobilization. This includes encouraging others to commit subsequent acts of violence, but also instigating conflict by pressuring opponents into a response.
Given the purpose of terrorist violence is to drive social reactions in this way, it is perhaps surprising that more work has not attended to the issue of how far and fast public reactions to terrorist attacks "travel." It is not that there are no such studies, but rather they are comparatively few and relatively weak in terms of the empirical evidence provided in terms of capturing the dynamics of social reaction across space and time. Through a case study of the aftermath of the terrorist murder of Fusilier Lee Rigby in 2013, this article has identified ten specific online behaviours with offline consequences that collectively constituted the reaction process. Derived from qualitative analysis of social media data, the findings reported help to demonstrate how the availability of such materials afford new and creative ways to study the aftermath of terrorism and other major events to illuminate hitherto largely invisible aspects of how and why processes of social reaction take the form they do. For whilst there is a strong tradition across the Social Sciences of studying social reactions to major crimes and disasters, the insights that have been offered to date have been constrained by limitations associated with more orthodox and established methods. Surveys of public opinions and perceptions, for instance, can provide a "snapshot" of public attitudes at one moment in time, but it is difficult to trace how such attitudes develop and evolve via such research instruments. Equally, more qualitative approaches, such as those utilised by Slucka, 46 afford a sense of how perceptions and attitudes bend in response to different events and interventions. However, the views ascertained pertain to only small groups of people.
By casting social media data as "digital traces" of social action, it is possible to use them to reconstruct a fine-grained understanding of what happened and why, and the ways in which different segments of the public interpreted these developments. As such, they enable new "ways of seeing" with respect to processes of social reaction to major terrorist attacks, providing digital indicators of how large numbers of people who are members of particular social media communities thought, felt, and behaved in relation to various developments in the aftermath of the attack. As with all research methodologies it has its strengths and limitations. But we are confident in asserting that it is an approach that has framed the most rigorous and intensive investigation into what happens in the aftermath of terrorist atrocity events yet conducted.
A key insight derived concerns the complex and somewhat chaotic nature of public sense-making and interpretation that arises in the aftermath of a terrorist attack. Sociologists routinely invoke concepts of the "definition of the situation" to configure an approach to understanding who did what to whom and why, in terms of private troubles and public issues. However, discussion of such matters typically takes place when the definition is relatively settled. The unique value of the kinds of data available to this study was the capacity they afforded for tracking and tracing how the process of defining the incident unfolds and evolves over time in high-resolution detail. Moreover, they render observable the moments where innovations in public understandings are first brought forward and sometimes contested.
Police investigators have become accustomed to talking about "the golden hour" for major investigations, wherein their first responders have an opportunity to establish physical and informational control of the scene and what comes out of it. However, with witnesses at the scene providing "live" reports of what is happening, the level of control available to police appears increasingly limited.
A related implication for counter-terrorism practice concerns the role of social media in the organization of retaliation and secondary conflicts. For it captures the complexities of the reaction patterns that are performed by the different actors who engage in the aftermath of atrocity events. Analysis of the data collected shows how Far-Right groups sought to respond to the murder of Lee Rigby by organizing protests across the country, but in turn their mobilization efforts were met with counter-mobilizations from a coalition of anti-Fascist and Left-Wing political groups. The ability to observe, in fine-grained detail, the interplay and interactions between these groups in states of heightened tension has considerable potential to enhance the ability to anticipate and degrade conflict dynamics in such situations. Significantly, whilst the murder of Lee Rigby was defined as an act inspired by Islamist terrorist ideologies, much of the secondary conflict elicited did not involve groups supporting such perspectives. This is important learning for the future in terms of understanding how and why such incidents impact upon community tensions and cohesion.
Understanding who does what in terms of the consequences that follow from a major terrorist attack, and how these contributions interact and interface with each other, is important in managing the extent that these incidents fulfill the intent of their authors to impact upon the public audience. This has been a neglected aspect of terrorism studies. There has been a clear and understandable preference to fund and deliver knowledge that might assist in preventing individuals from acquiring the motivations to engage in violence, pre-empting their actions when they do and providing explanations as to why they do so. However, in a situation where the capability to prevent all plots and attacks from occurring appears unrealistic and the police and security agencies anticipate failing to do so on a minority of occasions, it does seem reasonable to ask "what research evidence is there about how to effectively manage the consequences of such attacks when they do occur?" Funding This work was supported by grant number ES/L008181/1 from the Economic and Social Research Council (ESRC).

Notes on contributors
Martin Innes is Director of the Crime and Security Research Institute and Universities' Police Science Institute, both at Cardiff University Colin Roberts is affiliated with the Cardiff University Crime and Security Research Institute and is a member of the Universities' Police Science Institute. Alun Preece is a Co-Director of the Cardiff University Crime and Security Research Institute and is a computer scientist in the School of Computer Science and Informatics. David Rogers is a computer scientist who is affiliated with the Cardiff University Crime and Security Research Institute.