Seven rules hold on every pass, without exception, and everything else in this document is downstream of them.

We police our own vocabulary here: the terms we reach for, the bars they must clear, and the upgrade that retired "genuine vs. opportunistic" for good.

Loose language is how a monitoring project quietly drifts into advocacy. We use three families of terms consistently everywhere, in every hunt prompt and every published sentence:

2.1Units, movement, and measurement

2.2Terms that need to clear a bar before publication

A hate narrative is a living object. It sparks, it spreads, it decays, and what it leaves behind lowers the ignition energy for whatever comes next.

Three things about that lifecycle are load-bearing enough to shape everything downstream. The unit of analysis is the frame: a compressed claim about what an event means. One event spawns several competing frames at once, and posts stand as evidence of a frame's health. Stages form a state machine: a narrative can skip, stall, loop, or die at the framing contest, which is where most of them end, and triage is the model's first job. And decay leaves embers: a burned-out narrative deposits a reusable lexicon and a dormant network that lower the activation energy for the next matching spark, which is why a narrative can be grafted: recruited into a larger host narrative and scored at the host's own downstream stage. That inheritance has an evidence bar: two of three among lexicon overlap with the host's term set, carrier overlap with the host's amplifiers, and explicit bridging content, recorded on the card. Suspicion alone never inherits the host's posture.

3.2Confirming a cross-platform jump takes more than one crossover

Stage S5 requires plural, independently-acting carriers reinforcing the same lexicon in the same rolling window (72 hours as a working default); a single amplifier hopping platforms falls short of it. That's a well-corroborated finding: Centola & Macy's complex-contagion "wide bridges" result¹ holds up on real political-hashtag data² and real far-right radicalization case data³ alike. We don't hard-code the count itself: the plurality requirement is evidenced while any exact count would be a guess, and an analyst keeps an override path for one ultra-high-reach account that has unambiguously adopted the frame on its own. A single bridge with no plural reinforcement sets an interim S4_to_S5_watch status. That status answers a genuinely different question from the astroturf checklist's "confirmed bridge" signal in §9: one bridge is enough to call covert coordination, and it takes plural carriers to call genuine cross-platform uptake.

3.3Amplifier tracking doesn't default to follower count

A frame carried by a critical mass of ordinary mid-tier accounts is often a stronger durability signal than one large account's momentary spike, which decays faster⁴. Every narrative card codes a carrier_pattern: single_large_account distributed_mid_tier mixed.

We code fourteen dimensions on every item that clears either detection track.

Reading this as one flat JSON object hides what it's actually doing, so we grouped the fields here by the job each one does.

4.1What the grounding and outcome fields close

outtake_evidence gates observed_outcome because a record could otherwise jump straight from "someone saw it" to "it caused harassment" with no checkpoint asking whether the audience noticed, recalled, or repeated the narrative first. We modeled the gate on AMEC's Integrated Evaluation Framework, which inserts exactly that stage between Output and Outcome⁶. recode_ladder_stage and graft_operation turn the project's best piece of analytical work, the five-move recode ladder worked out case by case, into a field that gets coded every time instead of re-derived once per case study. Two further fields close the loop: classifier_provenance gives §5.5's "log which model produced this" mandate a field to live in. And the outtake gate carries a stated cost: with degraded search access, real outcomes go unrecorded for visibility reasons alone, so outcome-frequency claims and cross-narrative outcome comparisons carry an undercount caveat.

The signal that matters lives exactly where legitimate criticism, in-group banter, and coded hate are lexically indistinguishable. No single classifier survives that region, so nothing here is one.

We run both tracks on every item, plus an independent coded-language pass that reads past whatever either gate finds on the surface text. A "no" on Track A means "check the other track"; extremism overall remains an open question at that point.

5.1Track A: protected-group hate

The articulability test is the single highest-precision tool here: the classifier has to state the implied hateful claim in <target> {are/do/commit} <predicate> form. If that sentence can only be built by adding hostility the text and context fail to supply, it's criticism and it stops there.

5.2Track B: political and ideological-outgroup extremism

Gate: is the target a political party, ideological movement, or a proxy for one? If so, check for a dehumanization metaphor (disease, vermin, parasite, "root out," predator/prey; §6 covers the animalistic/mechanistic split), a collective-attribution synecdoche with a criminal or subhuman category swap, an incitement construction that restructures a threat as a prediction, or an eliminationist register whose natural end-state is removal or destruction, past any normal political contest. A trip classifies as political_outgroup_dehumanization or incitement_or_violence_normalization and gets reported under the extremism label. A political-idiom guard: the metaphor check fires on dehumanization applied to people, and stock idiom applied to conduct passes through: "root out corruption" targets a practice and stays protected; "root out these people" targets humans and trips. The gold set carries hard-protected political exemplars so this boundary stays measured (§13).

5.3The coded-language pass, independent of both gates

This pass runs regardless of whether either track's surface-text gate trips. A "coded" classification stands without an explicit predicate or a named group; that is definitionally what coded means.

A technique family is necessary, and a hostile predicate completes it. The predicate can be carried by construction: a known replacement-rhetoric template, a self-avowed motive recycled approvingly, a documented authorial pattern. A satire register is not an exemption if the piece names protected classes and frames their protections as illegitimate.

5.4The dangerous-speech supplement

For anything scored glorifying_violence or calling_for_violence, add Susan Benesch's Dangerous Speech Project hallmarks on top⁷: a narrower question, "does this raise real mass-violence risk," used only at the top of the harm scale: dehumanization, accusation in a mirror (a real, sourced term: the anonymous propaganda manual found in Butare, Rwanda after the 1994 genocide instructing "the party which is using terror will accuse the enemy of using terror," in Des Forges' rendering of the manual⁸), a threat to group purity, an assertion of attack on women or children, and questioning in-group loyalty.

5.5LLM-classifier discipline

• Real-world performance runs far below benchmark performance: in the HateDay study, models averaged 9.4% precision on a representative day of real Twitter traffic, against roughly 40% on curated academic benchmarks and 87% on HateCheck⁹. A human always makes the final classification.
• Identity-term over-flagging persists in LLMs beyond the older tools like Perspective API: current models still misclassify benign statements that mention protected groups as hate¹⁰¹¹. Bigger, multimodal models genuinely do read context better, but demographic and lexical biases persist, especially in smaller models; context-sensitivity and fairness remain separate claims¹².
• A model's self-reported confidence does not track its accuracy. Treat it as decorative. A separately human-adjudicated confidence judgment stays authoritative.
• Persona and role framing in a prompt measurably shifts classifier output, and the more heavily safety-aligned a model is, the better it resists that steering¹³, so we keep prompts minimal and test them periodically for sensitivity to small wording changes.
• The same model API can silently change behavior when a vendor updates policy. Log which model/version produced each classification; re-score a fixed set of past items against the current model periodically. The schema's classifier_provenance field is where that log lives.
• The gold-set agreement baseline covers the verdict alone. A double-coded sample across all fourteen schema dimensions and stage assignment, repeated after any schema change, is what tells us whether two coders can operate this instrument the same way; a field that resists consistent coding becomes a collapse candidate.

Track B's dehumanization check used to treat dehumanization as one bucket. It's actually two, with different psychological correlates.

Haslam's 2006 integrative review is where this split comes from¹⁴, and it's coded every time a dehumanization flag fires. Kteily et al.'s validated 0–100 "Ascent of Man" scale¹⁵ can inform an ad hoc toxicity judgment. It was built and validated as a survey self-report instrument, so any adapted use on rhetorical artifacts is a heuristic.

We try the tiers in strict order and use the first that produces a real, citable number. Tiers stay separate, and we label a low tier as exactly what it is: a ceiling.

7.3Trajectory as a secondary, corroborating signal

tools/reach_lookup.py computes a trajectory ratio from GDELT's narrative timeline¹⁷ (rate-limited to one request per five seconds): two adjacent windows, recent divided by prior. Output always carries a confidence string, literally "provisional (2-point ratio)" at two observations and "trend (n>=3 windows)" beyond that, and the string travels with every printed value. This corroborates the EPS trajectory multiplier in §8; it doesn't replace the primary signal, since GDELT tracks external media coverage, which most early-stage or fringe-only narratives never register on at all.

We combine five factors with a geometric mean, which damps compensation without removing it (a 5 still pulls up a 2): a narrative has to be bad on more than one axis to rank high, and a narrative bad on one axis alone can be suppressed, which is why the floor exists.

Coordination also carries a defined anchor at 4, documented co-platforming: a named event, shared stage, or common organizing hub transmitting the same narrative, without evidence of a persistent cross-platform operation. The factor measures degree of organization; whether the organization was hidden belongs to the coordination verdict in §9, and overt organization scores as high as covert.

The weighted variant weights harm and mainstreaming up; concretely it is (R·T·C·M^1.3·H^1.5)^1/5.8, the normalized weighted geometric mean. It auto-triggers the moment any item in the narrative has actually cleared Track A or B, a deliberate, stated carve-out that closes a real inter-analyst gap where the choice used to be pure discretion. scoring.weighting_applied gets recorded on the card so a tier assignment stays auditable after the fact.

8.3Priority tiers

Ordinary rivalry, satire, and heated-but-non-dehumanizing discourse are supposed to land on P4 and stay logged, resting outside the daily queue; the rubric exists to keep those out of the queue as much as to flag real danger. A grafting narrative scores at its host's downstream posture once it clears the graft evidence bar (§3), which is exactly what pushes it up the queue before its own metrics would justify that on their own.

Two rules close a gap the base formula leaves open. A small-account item carrying a concrete, explicit threat (Reach 1, Toxicity 5, Coordination 1, Mainstreaming 1, Harm 5) computes to roughly 1.9 base, 2.0 weighted, and 1.2 under a decaying τ, which lands on "log only" for a post naming a target, a time, and a place. So: harm-potential 5 now sets a P2 floor regardless of the computed score, recorded as scoring.floor_applied so the quarterly distribution audit can see how often formula and floor disagree. And the §12 escalation ladder runs on its own thresholds, independent of the EPS tier in both directions: the EPS ranks the monitoring queue, and emergencies travel the ladder.

8.2The trajectory multiplier τ

Computed primarily from the narrative card's own already-tracked rate-of-change field, zero cost, always available: above +15% per window is accelerating (τ = 1.3), between −15% and +15% is stable (τ = 1.0), below −15% is decaying (τ = 0.6): illustrative starting bands, tunable after real weeks of data. A low-confidence two-window accelerating reading needs corroboration from at least one other flipped indicator before it can push a narrative into P1. τ applies as a genuine post-hoc multiplier on the already-computed base score, kept outside the geometric mean itself, the same separation cybersecurity keeps between CVSS severity and EPSS exploitation-probability¹⁸¹⁹, on purpose. One caveat: the rate-of-change field is computed over the open-platform footprint only (§11), so a narrative accelerating on X, TikTok, or Meta can read as stable here. τ is footprint-bounded: divergence against a tier-1 lookup or the GDELT check gets recorded for judgment, and τ computed across a surge-mode collection boundary (§11) always carries a flag.

Coordination is neither hate nor inauthenticity by itself. Activists, fandoms, and breaking-news crowds converge on shared language all the time, with nothing hidden about it.

9.1Signals, checked in this order

1. Named event, willing co-participants. Overt coordination, as a documented fact. Name the actual hub; score it as one event-narrative card, since nothing was hidden.
2. The same triggering event, at finer grain than a shared topic. A mixed-trigger cluster gets split explicitly; scoring it as one is a methodology error.
3. A shared semantic payload, checked at the embedding level: the same novel claim, coined term, fabricated detail, or unusual framing sequence recurring across accounts, with shared errors counting most of all. Lexical near-duplication still counts when it appears, and a language model makes rephrasing free, so the absence of matching phrasing now carries almost no exculpatory weight.
4. Synchronized timing. A tight co-timed window, hours to a couple of days, is a real signal. A multi-week scatter is not, by itself.
5. A bridge account that actually cross-links or reposts, the single highest-value check of the five. We always run it before finalizing an "organic parallel" verdict.

Cross-lane convergence is a real, distinct finding on its own, and it becomes coordination only when signal 5 independently turns it up. A vendor's coordination or bot-probability score, however high it reads, serves as supplementary data; a confirmed named bridge remains the required evidence.

We have rejected these marketing and growth-hacking techniques in writing, each one tempting precisely because it looks like harmless self-measurement.

The open-API era is over. Every source here is partial, biased, or sampled, and the honest posture is a portfolio with disclosed gaps.

Reshare-tree data and hook-rate/retention data are both, independent of desirability, largely uncomputable on this exact stack; Bluesky is the one platform where the former is realistically free. Reference pipeline: per-source collectors write append-only raw payloads to object storage, normalization feeds Postgres + pgvector, enrichment runs lexicon match / toxicity / embeddings / coordination signals, and analysis surfaces narrative clustering, actor graphs, spread velocity, and cross-platform hops into a dashboard.

Scale-up path: Junkipedia²⁷ (Truth Social, Gab, GETTR, Rumble, BitChute, VK, with no engineering needed) → a university or nonprofit partner for TikTok Research API / Meta Content Library → funding for a commercial listening seat or metered X → EU vetted-researcher status under DSA Art. 40²⁸ → image-hash matching for cross-platform media tracing.

Surge mode: when a live spark pushes the graft check to hourly (§13), collection surges on a pre-stated plan instead of improvised polling: a reserved share of each rate-limited budget, event collectors first, then P1/P2 cards, with roster-wide baseline polling throttled explicitly and on the record. GDELT stays at its one-request-per-five-seconds limit regardless; it's a corroborating signal on its own timescale. Surge start and stop get logged on the affected cards, because a volume jump at a surge boundary reflects the instrument's own movement.

These are functional requirements, load-bearing from the start. Nothing we run ships without them.

Eight operating principles: watch the hate, not the hated · minimize by default · observe, don't provoke · aggregate over spotlight · punch up, not down · assume the tool will be attacked or misused · reversibility is a feature · independent oversight gates anything that names a person.

12.2The escalation ladder

Publication ethic: strategic silence and de-amplification by default; quantify and contextualize, with reproduction held to the clinical minimum; strip PII; no target lists, no evasion playbook, no manifesto text; delay real-time findings that could steer a live campaign; coordinate disclosure with affected communities.

Researcher wellbeing: hard exposure limits and time-boxing on the worst queues, rotation, no lone-working on the worst material, aggregate-first views, blur/grayscale rendering, trauma-informed training.

Even a two-person team can run this, as long as the roles and the rhythm are written down and explicit.

13.2Rhythm

• Daily: we work the P1/P2 cards and run the graft-tripwire check hourly instead of daily during a live spark/framing-contest event, per our own Euro 2020 finding that hate-narrative latency runs in minutes.
• Weekly: we review the P3 watch list, re-score, and prune P4.
• Per-event: we post-mortem the stage map and the reignition-latency estimate.
• Quarterly: we run the loop-back audit (§3), the EPS score-distribution audit that checks for unnatural clustering at tier boundaries, and the LLM-vs-human agreement disclosure.

The one first-class KPI: false-positive rate on the hard-protected gold set. We reject outright any recall gained by regressing here, and this metric outranks every other on the list on the list, which also includes time-to-detection, lexicon precision per target group, share of escalations meeting the full threshold, and analyst-exposure hours against wellbeing limits.

A false-negative drop audit: every pass records an aggregate screened count, and a quarterly random sample of silent drops gets re-adjudicated blind, with an estimated miss rate published next to the false-positive figure and the sampled content deleted after adjudication. Without this audit, the FP-first KPI plus silent dropping would make conservative drift invisible by construction. A gold-set composition rule: the hard-protected set must include heated-but-protected political speech, so the first-class metric exercises Track B's boundary too, and the distribution of Track B flags across lanes gets disclosed periodically. And a degradation order: when the queue exceeds measured capacity, P3 review slips first, then discovery, then P4 logging; P1/P2 work, escalation checks, and the human gates hold their place at every load level. A parameter provenance register marks every working constant as evidenced, convention, or operational, with a dated changelog on any change.

We carry these forward deliberately, on the record.

• Full coverage is structurally impossible: the three highest-value surfaces, X, TikTok, and Meta, are also the three hardest and most expensive to access.
• Cluster granularity and stance on isolated posts remain unsolved knobs; target resolution and irony detection genuinely fail without conversational context.
• Lexicons rot within days under adversarial drift. Techniques and disambiguation signals are the durable feature; human confirmation stays non-negotiable.
• Academic and regulatory access (TikTok's Research API, Meta's Content Library, DSA Art. 40) is slow and enclave-bound: useful for rigor and history, with real-time alerting beyond its reach.
• The hardest ethical tension has no resolution in general: the same capability that catches a coded campaign early is the capability a bad actor most wants. The mitigations reduce it, and a residue remains.
• We flagged these for future research and left them unfilled from memory: the Rabat Plan of Action's six-part incitement threshold, the most on-point legal framework for harm_level not yet incorporated; SPLC, CCDH, HOPE not Hate, and NCRI as operational analogs; the UK Online Safety Act 2023; the algospeak evasion literature underlying the char-substitution technique this schema already names.

Everything above governs how we code an item once we collect it. This section governs which accounts we watch in the first place.

The roster's own metadata said the quiet part plainly: a seed list, parsed and deduped, no rigor applied to why any specific name was chosen. The project's own cautionary tale for this exact failure mode is CCDH's "Disinformation Dozen" report: NPR reported Facebook's objection that "it was not clear what criteria the group used" to build the list³², and Meta's rebuttal put the twelve accounts at about 0.05% of vaccine-content views on its platforms³³.

15.2The gate every entry has to clear

15.3Discovery: models supply leads, and primary sources decide

1. We anchor on a real, dated event: a rally, a filing, a deplatforming, a viral incident with press coverage.
2. We snowball from primary sources: livestream credits, press bylines, court filings, designated-org lists, and the public network of already-vetted accounts.
3. We triangulate across at least two independent sources before a name becomes a candidate at all; a model counts as at most one lead.
4. If we use a model at all, it supplies a lead to verify independently: we query it about a specific dated event, keep open "list accounts in category X" prompts out of the workflow, and treat non-convergent answers across providers as extra-scrutiny candidates.
5. We actively search for the tail. Popularity-driven discovery, model or otherwise, systematically favors the already-famous; if every candidate we find is someone already recognized, the pass reproduced head-bias and found nothing new.

15.6Two additional categories

Both sit in Track B: the target class is an institution or ideological system and its human proxies. Neither gets a symmetric paired lane, the same way Anti-Semitic & Syncretic Conspiracy Accounts has no paired opposite already.

15.9The circularity problem, and the two-tier fix

Gate 1 requires a documented, rubric-clearing act as a condition of inclusion. That's the right design for a monitoring watchlist, because a watchlist should contain known offenders. It is the wrong design for comparing prevalence across ideological lanes: an account qualifies for the roster because it already produced a qualifying example, so reporting what share of roster accounts produce one in a given period reports a recidivism rate in a population pre-selected on the outcome being measured; an estimate of how much hate exists in that community would require a differently built sample. This isn't hypothetical: the religion-narratives special report's 73% and 78% antisemitism/Islamophobia hit rates were checked against the original ungoverned seed list, while its 2.6% anti-Christian figure came from a hand-supplied roster selected on identity alone. That gap may reflect a real difference between lanes. It may also just reflect that one roster was built the right way for this comparison and the other wasn't; both explanations can be true at once, and the old construction method couldn't tell which was doing how much.

Every externally sourced claim on this page carries a numbered marker that resolves here.

1. Centola, D. & Macy, M. (2007). "Complex Contagions and the Weakness of Long Ties." American Journal of Sociology 113(3), 702–734. journals.uchicago.edu/doi/10.1086/521848
2. Romero, D. M., Meeder, B. & Kleinberg, J. (2011). "Differences in the Mechanics of Information Diffusion Across Topics: Idioms, Political Hashtags, and Complex Contagion on Twitter." Proceedings of WWW 2011, 695–704. archives.iw3c2.org (PDF)
3. Youngblood, M. (2020). "Extremist ideology as a complex contagion: the spread of far-right radicalization in the United States between 2005 and 2017." Humanities and Social Sciences Communications 7, art. 49. nature.com/articles/s41599-020-00546-3
4. Watts, D. J. & Dodds, P. S. (2007). "Influentials, Networks, and Public Opinion Formation." Journal of Consumer Research 34(4), 441–458. academic.oup.com
5. Balfour, B. (2018). "Growth Loops are the New Funnels." Reforge. reforge.com/blog/growth-loops
6. AMEC. "Integrated Evaluation Framework." amecorg.com/amecframework (accessed 2026-07-21)
7. Dangerous Speech Project (Benesch, S., et al.). "Dangerous Speech: A Practical Guide." First published 2018; last revised 2024-08-20. dangerousspeech.org/libraries/guide
8. Marcus, K. L. (2012). "Accusation in a Mirror." Loyola University Chicago Law Journal 43(2), 357–393. lawecommons.luc.edu (the manual's English wording follows Des Forges, Leave None to Tell the Story, 1999, as quoted by Marcus)
9. Tonneau, M., Liu, D., Malhotra, N., Hale, S. A., Fraiberger, S. P., Orozco-Olvera, V. & Röttger, P. (2025). "HateDay: Insights from a Global Hate Speech Dataset Representative of a Day on Twitter." Proceedings of ACL 2025, 2297–2321. aclanthology.org/2025.acl-long.115
10. Dixon, L., Li, J., Sorensen, J., Thain, N. & Vasserman, L. (2018). "Measuring and Mitigating Unintended Bias in Text Classification." Proceedings of AIES '18, 67–73. dl.acm.org/doi/10.1145/3278721.3278729
11. Zhang, M., He, J., Ji, T. & Lu, C.-T. (2024). "Don't Go To Extremes: Revealing the Excessive Sensitivity and Calibration Limitations of LLMs in Implicit Hate Speech Detection." Proceedings of ACL 2024. aclanthology.org/2024.acl-long.652
12. Davidson, T. (2026). "Multimodal large language models can make context-sensitive hate speech evaluations aligned with human judgement." Nature Human Behaviour 10, 514–530. nature.com/articles/s41562-025-02360-w
13. Selvaganapathy, S. & Nasim, M. (2025). "Confident, Calibrated, or Complicit: Safety Alignment and Ideological Bias in LLM Hate Speech Detection." arXiv:2509.00673. arxiv.org/abs/2509.00673
14. Haslam, N. (2006). "Dehumanization: An Integrative Review." Personality and Social Psychology Review 10(3), 252–264. journals.sagepub.com
15. Kteily, N., Bruneau, E., Waytz, A. & Cotterill, S. (2015). "The Ascent of Man: Theoretical and Empirical Evidence for Blatant Dehumanization." Journal of Personality and Social Psychology 109(5), 901–931. pubmed.ncbi.nlm.nih.gov/26121523
16. Le Pochat, V., Van Goethem, T., Tajalizadehkhoob, S., Korczyński, M. & Joosen, W. (2019). "Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation." Proceedings of NDSS 2019. tranco-list.eu
17. The GDELT Project. "GDELT DOC 2.0 API" (timeline volume of global news coverage). blog.gdeltproject.org
18. FIRST.org (2023). "Common Vulnerability Scoring System v4.0: Specification Document." first.org/cvss/v4.0
19. FIRST.org. "Exploit Prediction Scoring System (EPSS)." first.org/epss
20. CISA. "National Cyber Incident Scoring System (NCISS)." cisa.gov
21. World Health Organization (2024). Emergency Response Framework, ed. 2.1. who.int/publications/i/item/9789240058064
22. Reed, C., Biggerstaff, M., Finelli, L., et al. (2013). "Novel Framework for Assessing Epidemiologic Effects of Influenza Epidemics and Pandemics." Emerging Infectious Diseases 19(1), 85–91. wwwnc.cdc.gov
23. Wired (2023). "Twitter Data API Prices Out Nearly Everyone." wired.com (corroborated by TechCrunch, 2023-03-29)
24. TechTarget (2023). "Reddit pricing: API charge explained" ($0.24 per 1,000 calls, effective 2023-07-01). techtarget.com (the $12k/yr figure in the table is a derived illustration at ~50M calls/yr)
25. TikTok for Developers. "Research API." developers.tiktok.com (accessed 2026-07-21)
26. ICPSR / Social Media Archive (SOMAR), University of Michigan. "Meta Content Library." icpsr.umich.edu/sites/somar (accessed 2026-07-21; the ~$371/mo fee is SOMAR's Virtual Data Enclave charge per research team from January 2026; UI access and Meta's own secure research environment carry no fee)
27. Junkipedia (Algorithmic Transparency Institute / National Conference on Citizenship). junkipedia.org (accessed 2026-07-21)
28. Regulation (EU) 2022/2065 (Digital Services Act), OJ L 277, 27.10.2022; Art. 22 (trusted flaggers), Art. 40 (data access and scrutiny). eur-lex.europa.eu
29. Counterman v. Colorado, 600 U.S. 66 (2023). supremecourt.gov (PDF)
30. Brandenburg v. Ohio, 395 U.S. 444 (1969). law.cornell.edu
31. Bellingcat & Global Legal Action Network, Justice & Accountability Unit (2022). Online investigations methodology manual (updated 2022-12-14), "Algorithmic Effects" annex. bellingcat.com (PDF) (the unit wound down in July 2025; the work continues at GLAN as DRAGNET)
32. Bond, S. (2021). "Just 12 People Are Behind Most Vaccine Hoaxes On Social Media, Research Shows." NPR, 2021-05-13. npr.org
33. Bickert, M. (2021). "How We're Taking Action Against Vaccine Misinformation Superspreaders." Meta Newsroom, 2021-08-18. about.fb.com
34. Associated Press (2025). "A timeline of cultlike 'Zizian' group tied to killing of a Border Patrol agent in Vermont." Via PBS NewsHour, 2025-02-18. pbs.org/newshour
35. PauseAI. "Values" ("We will never use, encourage, or tolerate violence"). pauseai.info/values (accessed 2026-07-21)
36. Stop AI ("democratic and non-violent methods"). stopai.info (accessed 2026-07-21)
37. Associated Press (2025). "Shooter attacked CDC headquarters to protest COVID-19 vaccines, authorities say." Via PBS NewsHour, 2025-08-12. pbs.org/newshour
38. US Department of Justice (2020). "Six Arrested on Federal Charge of Conspiracy to Kidnap the Governor of Michigan," 2020-10-08. justice.gov; lockdown-grievance motive per NPR/AP trial coverage, 2022-04-08. npr.org
39. US Department of Homeland Security (2020). Homeland Threat Assessment, October 2020. dhs.gov (PDF)
40. FBI & DHS (2021). Strategic Intelligence Assessment and Data on Domestic Terrorism, May 2021. fbi.gov (PDF)

Fuller working bibliographies (ISD, Moonshot, ADL, HateLab, Latent Hatred, Silent Signals, HateCheck, the Santa Clara Principles, the Menlo Report, and the complete Mexico–England case sourcing) live in the project's internal research files.