Attacker attribution, whether online or physical, is tremendously difficult.
In some cases, the attacker or attacker group will claim the incident, but especially in the case of physical or alleged terror attacks, those claims are not always immediate.
This creates a haunting, even more unsettling time in which it is tempting for those with access to both open web and deep web forums that house jihadi communities to share the "chatter" they read or see -- and sometimes those with access are bona fide journalists. Not all terrorists are jihadists, though with recent incidents, it's understandable that folks will first look at jihadi communities for information.
However, that is just it -- information.
In its basic form, chatter in these instances is just as its name indicates: Unproven commentary or opinion. Sometimes it can align to earlier true activities, but the chatter itself is speculation, and relaying it prematurely or without data or true facts can be alarmist, or it can even interfere with active investigations on the scene of the attack. We saw a lot of this in the last few weeks around London, St. Petersburg, and Stockholm, and regardless of the targets or outcome, the implications of sharing unverified facts are dangerous.
Amarnath Amarasingam, senior research fellow at the Institute for Strategic Dialogue, said that it's important to be strict about what is considered to be newsworthy and in the public's interest, especially as the news move so fast, and that reporting, for instance, so-called Islamic State (ISIS) "fanboys" celebrating on Telegram or re-posting mainstream news article, is not particularly relevant.
"It creates the impression for the general public, most of whom still don't really understand ISIS or terrorist groups, that, first, ISIS claims everything (which is not true) and, second, that somehow ISIS is everywhere (which is also not true)," said Amarasingam. "This was particularly the case around reporting ISIS 'kill lists'. It created a lot of panic for, I think, no reason. These kill lists were posted on channels with a few dozen followers and they were needlessly amplified by mainstream media."
In fact, the kill lists that Amarasingam mentioned were not even official ISIS products, but were compiled and released by pro-ISIS groups.
Of course, with a random attack on civilians in a major city, it could very well be instigated by ISIS or al-Qaida. Or it could be a "lone wolf" attack by someone who has an affinity for either group. But while history may point in one direction or another, correlation is not causation. And even more challenging, even with a so-called verified claim, proving legitimacy is difficult. Attribution in these cases is almost a sliding scale, with "direction" at one end (ISIS official directs operatives) and "influenced" at the other end (individual launches an attack in its name, without direction). Therein lies the bigger problem -- even with claims, so many forms of associations with these groups exist in different degrees -- that claims of credit even mean less and less these days.
In addition to making assertions about attack responsibility, Amarasingam also warned of individuals and the media about posting pictures of the attack right after the attack. Basic human decency of not showing images with bodies is one reason, and the potential interference with ongoing investigation is another.
"I think we often have to ask ourselves about why we are posting something, and whether it has some educational or news value, as opposed to simply posting any and everything," he said. "The speed at which all of this moves has also resulted in people getting hurt."
Graeme Wood, correspondent at The Atlantic, has similar views, especially around the role of journalistic responsibility post major physical attacks. His guiding principle is that information is worth sharing if and only if it brings his readers news (in the basic sense of information that is new to them).
"I am not under pressure to report just anything that comes my way. Indeed, I feel the opposite pressure: If I report unproven chatter, I am risking my credibility," said Wood.
Wood shared that it is not uncommon to see reporters occasionally mistake ISIS fan activity for official statements, but it is not hard to tell these things apart. There are two critical effects that can come from these mistakes: One, readers are misled, and two, it reveals which reporters "have no idea what they are talking about or have no regard for truth or accuracy."
"This second effect is a useful sorting mechanism," he said.
Finding qualified sources to determine the facts behind ISIS or al-Qaida, or any terror activities, is much more difficult than other more mainstream threats. The sources don't look the same, and they are sometimes required to be anonymous due to safety fears.
"In my research, so-called 'egg accounts' on Twitter have often been deeply informed about what is happening in Syria and Iraq, and sometimes they have been parents and family members of foreign fighters," Amarasingam said.
Of course, journalistic standards must be maintained, and that standard differs depending on the outlet. Amarasingam said that some magazines and papers won't publish interviews conducted over Telegram or Twitter with supposed ISIS fighters because their standards of verification are strict.
"With the current ISIS media landscape, you can almost never be 100-percent sure you are talking to a fighter, but you can be fairly confident over time," he said.
Yet all of this is starting to change in unpredictable ways. For example, after the London attack, when the name Abu Izzadeen was mentioned as a suspect, some analysts made it clear that the name was being pushed by Russian trolls and bots to sow confusion in media reporting -- even though it was later reported Izzadeen was still in prison.
"I initially fell for this as well because some analysts and outlets I trusted were talking about it," Amarasingam continued. "It turned out we were all duped. So, I think we have to be very careful going forward."
If mainstream media outlets, reporters, or simple watchers just take the volume of open web or deep web chatter as evidence, then they will fall victim to bots and trolls. Constant correction of stories after unwittingly reporting false information also erodes trust in experts, individuals and media alike.
"There has to be a certain standard that is maintained, using old fashioned journalistic standards. We need these more than ever," he said.
While speculative chatter should not be considered worthy of reporting, true ISIS or al-Qaida or any other terrorist group claims are worth reporting, once proven, since it is factual information that could aid in public awareness and safety, and it could better educate them on the realities of these groups.
"Until you know who perpetrated the attack, you don't know who perpetrated the attack," Wood said. "But there are characteristics of individual attacks that are clearly suggestive... I have no problem with reporters' mentioning these early suggestions in their initial reports on attacks. But they are just that -- suggestions rather than proof."
VIDEO: Fake news is a result of the media having no stable business model