Christchurch and its copycats

Content note. This page describes mass killings of worshippers and shoppers, and quotes a few words of the racist framing the attackers used. The words are quoted as evidence of the method. The page does not link to or reproduce the attackers' videos or documents.

In one line: a gunman killed 51 people at two Christchurch mosques while streaming the attack on Facebook Live, after posting a document to 8chan that dressed the "Great Replacement" conspiracy theory in forum jokes; at least four later attackers cited him, copied his format, and were in turn turned into "saints" by the forums that celebrated them.

Diagram: an 8chan post and document frame migrants as invaders; a livestream turns the attack into content; copies spread faster than takedowns; forums turn the attacker into a "saint"; later attackers cite and copy him

What happened

15 March 2019, Christchurch. An Australian man, named in his sentencing record as Brenton Harrison Tarrant, attacks the Al Noor Mosque and the Linwood Islamic Centre during Friday prayer. He kills 51 people. Before the attack he posts links on 8chan's /pol/ board to a long document and to a Facebook Live stream, announcing an attack on "the invaders". Graham Macklin (CTC Sentinel) reports that 17 minutes of the attack were streamed, that fewer than 200 people watched live, and that the video was viewed about 4,000 times before Facebook removed it.
The first 24 hours. Facebook says it removed 1.5 million copies of the video worldwide, 1.2 million of them blocked at upload. Macklin describes copies being edited, re-cut and re-uploaded faster than moderators could act.
The document. ISD researchers Jacob Davey and Julia Ebner describe it as built on the "Great Replacement", a term coined by the French writer Renaud Camus in his 2011 book of that name. The theory claims that white European populations are being deliberately replaced by non-white, especially Muslim, migrants with the complicity of elites. Researchers describe it as a conspiracy theory; demographic change through migration and birth rates is real, but the claim of a planned replacement is not supported. Much of the document, Macklin and others note, is written as "shitposting": in-jokes, memes and bait aimed at forum readers and at journalists.
27 April 2019, Poway, California. A gunman attacks a synagogue, killing one woman. An open letter posted to 8chan under his name praises the Christchurch attacker, says he began planning after Christchurch, and says he planned to livestream on Facebook. No stream of the attack was broadcast.
3 August 2019, El Paso, Texas. A gunman kills 23 people at a Walmart. A four-page document posted to 8chan minutes before voices support for the Christchurch attacker and calls the attack a response to a "Hispanic invasion" of Texas. Macklin calls the sequence a "chain reaction" within online right-wing subcultures.
9 October 2019, Halle, Germany. A gunman tries to enter a synagogue on Yom Kippur, fails, and kills two people nearby while streaming on Twitch. GIFCT members then shared hashes of 36 visually distinct videos of the attack.
14 May 2022, Buffalo, New York. A gunman kills 10 Black people at a Tops supermarket, streaming on Twitch. Twitch removes the stream within about two minutes, but a viewer's recording spreads to other sites. The New York Attorney General's report says the attacker was radicalised on 4chan and that his document copied passages from the Christchurch one; he credited the Christchurch livestream as the start of his own path.
Throughout. ISD and GNET researchers document a "saints" iconography on Telegram and imageboards. The Christchurch attacker was the first to be depicted as a Christian saint; later attackers were added to the list.

Al Noor Mosque, Christchurch, two days after the attack

Masjid Al Noor, Christchurch, on 17 March 2019, with flowers along the fence. Photo by James Dann, CC BY-SA 4.0.

How it works

Fear appeal: the "Great Replacement" stages an imminent, total harm, the disappearance of a people, and offers violence as the only protection. Davey and Ebner trace how this story, which they say also circulates in milder form in mainstream politics, is taken by attackers to its violent end. The structure is the one the technique describes: the threat is staged at maximum size so that no ordinary response (voting, argument, policy) seems adequate.
Scapegoating: complex changes (migration, birth rates, economic insecurity) are placed on bounded out-groups. The target changes from attack to attack: Muslims in Christchurch, Jews in Poway and Halle, Hispanic people in El Paso, Black people in Buffalo. Researchers note that the scapegoat is interchangeable while the frame stays the same.
Name-calling: "invaders" is the label that comes before any argument. It recasts worshippers and shoppers, many of them citizens, as soldiers of a hostile army. The El Paso document's "Hispanic invasion" does the same work.
Accusation in a mirror: GNET researchers describe Great Replacement narratives as weaponised victimhood, in which the attacker's violence is presented as defence against a claimed genocide of white people. The Poway letter accused Jews of planning a genocide of Europeans. In each case the target is accused of the extermination the author is preparing, so that the massacre can be framed as a response.
Transfer: the "saints" images borrow the visual language of Christian sainthood (halos, icons, martyr lists) and paste it onto mass killers. ISD says the purpose is to glorify the violence and encourage more of it by promising the next attacker a place in the canon.
Format, audience and spread. The livestream used a helmet camera and a first-person view that researchers compare to shooter video games. Suraj Lakhani and Susann Wiedlitzka (Terrorism and Political Violence) analyse the 8chan thread as a gamified audience experience: "Press F to pay respects", a meme from a Call of Duty game, appears 36 times in the thread. A New Zealand man later jailed for sharing the video had a version made with crosshairs and a "kill count" added. GNET's 2021 study found the Christchurch attacker represented on imageboards far more often than other far-right attackers, including in cartoonish, ironic forms. The intended first audience was forum users; mainstream platforms and news coverage then carried the material much further than the live audience of fewer than 200.

How it was countered

Classification and prosecution. New Zealand's Chief Censor, David Shanks, classified the full video objectionable on 18 March 2019 (announced 20 March) and the document on 23 March, making it an offence to possess or share either. Journalists and researchers can apply for an exemption. In June 2019 Philip Arps was sentenced to 21 months in prison for distributing the video to about 30 people. Legal experts told RNZ the possession ban on the document went too far, and news organisations divided over it.
Refusing the name. On 19 March 2019 Prime Minister Jacinda Ardern told Parliament she would not say the attacker's name, and asked others to speak the names of the dead instead.
The Christchurch Call. On 15 May 2019 Ardern and French President Emmanuel Macron launched the Christchurch Call in Paris, a non-binding pledge by governments and tech companies to eliminate terrorist and violent extremist content online. The United States declined to join in 2019, citing free-speech concerns, and joined in May 2021. The Electronic Frontier Foundation praised parts of it but warned that upload filters cannot judge context and that civil society was consulted only at the last minute.
Platforms. GIFCT built a Content Incident Protocol, under which member companies share hashes (digital fingerprints) of attacker-made video. It was first activated for Halle in October 2019 and again for Buffalo in May 2022. On 4-5 August 2019, after El Paso, Cloudflare ended service to 8chan; its chief executive called the site "lawless". 8chan went offline and later returned as 8kun.
The inquiry. The Royal Commission of Inquiry reported on 8 December 2020. It made 44 recommendations, found that security agencies had focused disproportionately on Islamist threats, and recorded the attacker's own statement that YouTube was a more significant source of information and inspiration for him than the forums.
Did it work? The record is mixed. Twitch cut the Buffalo stream within about two minutes, much faster than Facebook in 2019, and the New York Attorney General credits post-Christchurch reforms for faster removal by large platforms. But copies still spread through smaller sites, and the same report says fringe platforms radicalised the attacker and that livestreaming was used to encourage copycats. It recommended making perpetrator-made recordings a crime and fining platforms that fail to act. Critics of that approach, and of the Christchurch Call, raise the civil-liberties costs. Whether banning the document drew more attention to it (a "Streisand effect") remains debated; the record does not settle it.

Jacinda Ardern visiting the Muslim community in Christchurch, 16 March 2019

Prime Minister Jacinda Ardern meets members of the Muslim community at the Phillipstown Community Centre, Christchurch, 16 March 2019. Photo by Kirk Hargreaves, Christchurch City Council, CC BY 4.0.

Then and now

Remember Belgium: Enlist To-Day (1915)

Remember Belgium — Enlist To-Day, Parliamentary Recruiting Committee (United Kingdom), 1915. Public domain.

The British recruiting poster used the invasion of Belgium to turn fear into a call to fight: a soldier stands between the viewer and a fleeing mother and child, and enlisting is the only response offered. The 2019 attackers used the same fear-appeal structure, "invasion" plus a threatened people, to make violence feel like defence. The differences are large and should be stated plainly. Belgium was invaded by an army in 1914; the event was real and documented. The "invasion" in the Great Replacement is migration and birth rates recast as a war. The poster recruited for a state army in a declared war; the 2019-2022 documents urged individual civilians to murder unarmed worshippers and shoppers. The poster's reach was national and state-funded; the attackers' reach came from forums and platform copies, often against the platforms' will.

Positions on the record

The attackers' stated position: that white populations face deliberate replacement and that violence is defence against "invaders". The documents present this as a last resort.
What is documented: the attacks, the death tolls, the 8chan and Twitch posts and streams, the citations from each later attacker to Christchurch, the plagiarised passages in the Buffalo document, and the "saints" imagery. Researchers treat the documents themselves as propaganda: a 2025 University of Auckland study compared the Christchurch document with the attacker's earlier forum posts and concluded that its self-portrait as an ordinary man driven to a last resort was deliberately misleading.
What is contested or not shown: how much weight each factor (forums, YouTube, mainstream rhetoric, personal history) carried in any one attacker's path; whether takedowns reduced copycat attacks; and whether mainstream politicians who used "replacement" language bear any responsibility, which remains a political dispute this page takes no side on.

Same-method test

The finding would be the same for any ideology. Islamic State recorded executions and attacks and released them as recruitment media (see The Islamic State's media machine: Dabiq, Rumiyah, Amaq and the 'virtual caliphate'), and in June 2016 an attacker who pledged allegiance to it streamed on Facebook Live after killing a police couple at Magnanville, France. A jihadist who posted a document built on an invasion frame, streamed his attack, and was canonised as a martyr by his followers would be scored with the same technique ids. The ids describe the method, not whose side the method is on.

How to spot it

A story in which a whole group is "invading" or "replacing" you, and which rules out every peaceful response, is a fear appeal built to end in violence. Ask who is making the claim and what evidence of a plan they offer.
Religious or heroic imagery pasted onto a killer (halos, icons, "saint" lists) is transfer. It is recruitment, whatever the joking tone.
Jokes, memes and gaming language around real killings are a signal, not a defence. Researchers treat the irony as part of the packaging.
Don't share attacker-made footage or documents, even to condemn them. Share the names of the victims and the findings of inquiries instead.

Images

Image	Source	Licence
Mechanism diagram (above)	Drawn for FRAME from the sources below (`make_diagrams_extremist.py`)	CC BY 4.0, FRAME
Al Noor Mosque with flowers (17 Mar 2019)	Wikimedia Commons	CC BY-SA 4.0, James Dann
Jacinda Ardern in Christchurch (16 Mar 2019)	Wikimedia Commons	CC BY 4.0, Kirk Hargreaves / Christchurch City Council
Remember Belgium: Enlist To-Day (1915)	FRAME gallery, from Wikimedia Commons (Library of Congress)	Public domain

Image gaps

The livestreams, documents and 8chan posts. Not included and never to be hosted: they are attacker-made propaganda, classified objectionable in New Zealand, and hashed by GIFCT for removal. Researchers cited below describe them.
"Saints" posters from Telegram channels. Not included: they glorify the attackers and are made to recruit. ISD and GNET describe them in text.
The Linwood Islamic Centre and the Buffalo supermarket. Openly licensed photographs of both are on Wikimedia Commons (CC BY-SA 4.0) and could be added. This gap can be filled.

Christchurch and its copycats:livestreamed attacks and 'manifesto culture', 2019-2022