This pilot study examines the correlation of online and on-the-ground behaviours of three lone-actor terrorists prior to their intended and planned attacks on soft targets in North America and Europe: the Pittsburgh synagogue shooter, the Buffalo supermarket shooter and the Bratislava bar shooter. The activities were examined with the definition of the proximal warning indicator energy burst from the Terrorist Radicalization Assessment Protocol (TRAP-18), originally defined as an acceleration in frequency or variety of preparatory behaviours related to the target. An extensive quantitative and qualitative assessment of primary and secondary sources was conducted, including raw data from different tech platforms (Gab, Discord and Twitter–now X) and open-source materials, such as criminal complaints, superseding indictments and court trial transcripts.

Preliminary findings of this small sample suggest an inverse relationship between the online and offline behaviours across all three perpetrators. The average point of time between the decision to attack and the actual attack was five months, with an elevation of digital activities in the three months leading up to the incident, along with some indications of offline planning. In the week prior to the event, social media activity decreased–specifically on the day before the acts of violence with two subjects going completely dark–while terrestrial preparations increased. On the actual day of the incident, all assailants accelerated their tactical on-the-ground actions and resurfaced in the online sphere to publish their final messages in the minutes or hours prior to the attack. It appears that the energy burst behaviours in the digital sphere and the offline actions can be measured in both frequency and variety. Operational implications of this negative correlation are suggested for intelligence analysts, counter-terrorism investigators and threat assessors.