The recent school attack at the Brinell secondary school in Fagersta, Sweden, has raised questions why the perpetrator managed to fly under the radar despite his posting of messages glorifying violence in a chatgroup on social media platform TikTok.
The suspect, an 18-year-old student with access to the school, attacked them on Friday afternoon, August 21, with a sword which he had had hidden in guitar case. A 17-year-old girl was killed and three boys were injured, two of them seriously. Police arrived quickly at the scene and were able to arrest him. He was taken into custody on suspicion of murder and attempted murder.
According to a summary of the incident published yesterday by the Swedish ‘Center for Preventing Violent Extremism’ (CVE), the police has been cautious about releasing information about the perpetrator. At a press conference, the local police chief said the police was facing an extensive investigation.
On Wednesday, the police announced that another adolescent had been arrested, suspected of aiding and abetting the crime. He has no connection to the school and was not said to have been present during the attack. It concerns a boy under 18 who planned a school attack in the Stockholm area and who had been in contact with the perpetrator in Fagersta via a digital platform.
According to CVE, it can be difficult to detect young people planning a school attack. Research has shown that they often signal their intentions to those around them before an act. However, these signals can take many different forms and be difficult to detect. They can involve vague references or violence-related comments being dismissed as jokes.
Writing on the wall
In this case, the writing was on the wall before the school attack. The perpetrator has been linked to a TikTok account which was part of an online subculture known as the ‘True Crime Community’ (TCC). In this digital space, users romanticize, glorify, and swap content celebrating people who have committed serious violent crimes, often mass killings in schools.
According to researchers tracking the TCC, the suspect held a high level of influence within this network for producing this specific style of content. The account remained active right up until the attack.
His account had reportedly accumulated over 3,500 followers during the month before the attack but he is suspected of a wider digital footprint. He used to generate and share disturbing motion-capture AI videos. These posts took static photos of mass murderers and artificially animated them to perform upbeat dance routines (‘rampage dances’).
He was also known to the social authorities and had been placed in a foster home due to his troubled home situation and a previous conviction of assault in a school. He reportedly recovered in the foster home but at the age of 18 he had to leave and lived alone in a flat provided by the local social authorities without any follow-up.
Roughly 20 minutes before the attack began, the account posted a highly specific, threat-signaling image. A photograph showed a sword resting on top of what appeared to be a guitar case on a floor. The background matched the interior of a restroom inside the Brinell school. The image was overlaid with the phrase ‘No more edits’ accompanied by a sad emoji.
TikTok removed the account hours after the attack took place but then it was already too late. His threatening posts had not been flagged and deleted in time. Other members of the TCC had also already grabbed his material to manufacture new ‘edits’ praising his actions, possibly inspiring future school killings.
The European Commission told The Brussels Times that it was deeply saddened by the tragic incident that happened in Fagersta. It declined to comment on the on-going investigation of the school attack. The office of TikTok in Sweden declined to reply to specific questions by daily Dagens Nyheter.
Very large on-line platforms, among them TikToK, are subject to enforcement actions under the Digital Service Act (DSA) by the European Commission. TikToK, with up to 2 billion monthly users globally (from 135 to 178 million average monthly users in the EU in 2025) is the fifth-largest social media platform in the world.
The investigation opened into TikTok’s compliance with the DSA obligations are related to safe accounts for minors, addictive design, ad transparency and election integrity. All platforms are obliged to flag and delete illegal content. A Commission spokesperson confirmed that none of the on-going cases are dealing with incitement to violence.
Lack of trusted flaggers
TiKToK’s moderation of illegal content, which is defined by national legislation, is automated and has been criticized for overstating the removal rate of illegal content and for uneven enforcement by language and country. Automated moderation is not enough because it misses posts that should be deleted.
According to the DSA, on-line platforms must take reasonable measures to ensure that, where automated tools are used to conduct moderation activities, the relevant technology is sufficiently reliable to limit to the maximum extent possible the rate of errors. In addition, the points of contact for users may not rely solely on automated tools.
The Commission underlines that ‘trusted flaggers’, appointed by national Digital Services Coordinators, is an important complementary feature of the DSA framework. More than 80 entities have been awarded the status, across almost all Member States. Under the DSA, platforms are required to prioritise the review of notices of illegal content from trusted flaggers.
Awarding trusted flagger status is the competence of the national Digital Services Coordinators. In principle all EU Member States should appoint enough trusted flaggers so that they can cover all kinds of illegal content, incl. incitement to violence, but this is not the case in Sweden, according to its national coordinator, the Post and Telecom Authority (PTS).
“It is voluntary to apply to PTS for Trusted Flagger status, but it is not voluntary for online platforms to have to act on reports coming from them,” a PTS spokesperson told The Brussels Times. He confirmed that only two organisations have currently been granted this status by PTS. Neither of them has violent extremism as their specific area of expertise.
The status is valid across Europe, he added, so it is possible for a trusted flagger in another member state to flag content hosted on an on-line platform established in another country or written in another language. This, however, did not happen.
The Board for Digital Services, which gathers all Digital Services Coordinators, provides a mechanism for exchange of best practices, e.g. on how to act against platforms so that they will remove illegal content as soon as possible. The Swedish national coordinator said that it cooperates continuously with its interlocutors in the EU with the aim of ensuring consistent application of the DSA.
According to the Commission spokesperson, all Member States should have expertise to monitor crypted messages in closed groups such as TCC. “The Commission would welcome the Swedish Coordinator’s assessment of what happened and why postings by the perpetrator in the school attack flied under the radar.”
The European Commission closed recently a targeted public consultation on collecting input to drafting guidelines on trusted flaggers under the DSA. All stakeholders were invited to share their views, good practices, recommendations and related evidence. The Commission is currently analysing the input and will publish a summary of the contributions.
The guidelines are scheduled to be adopted in the second half of 2026. It is too early to say if they will be binding.
In a common expression of sorrow, following the school attack in Fagersta, Prime Minister Ulf Kristersson and opposition leader Magdalena Andersson set aside their election campaigns ahead of the parliamentary elections on 13 September to visit the memorial site on August 22, 2026, credit: AFP / Belga
School safety revisited
Following the attack, the Swedish government announced that it is appointing a school violence commission. The commission will conduct a broad survey and analysis of all school violence that has occurred in Sweden over the past 15 years. It aims to analyze how future school violence can be prevented, to stop recruitment to violent acts on the internet, and to strengthen school safety efforts.
In fact, a public inquiry on safety in schools was published already in December 2024. The inquiry, chaired by Jonas Trolle, director-general at the Swedish National Council for Crime Prevention, focused on preventive measures such as tighter control of who has access to schools and boosting crime prevention information in education.
“Ideally, it is important to identify signs, such as messages on social media, that may indicate that a person will commit an act of violence,” he told The Brussels Times after the mass shooting in a school in Örebro in February 2025. It could be difficult in case the perpetrator has lived a lonely life without any social contacts, has broken with his family and completely fallen under the police radar.
“Our proposals in the school safety inquiry have largely become legislation,” he said now. “At the Brinell school there was a contingency plan for cooperation with the police. The school was locked but the perpetrator could open the door because he studied there. Schools have the right to search bags and other objects but staff are not particularly security-trained.”
Schools and other actors are obliged to provide information to the police and other law enforcement authorities. On-line platforms bear a massive responsibility. Swedish police in its daily intelligence work are trying to identify persons that are threatening to commit violent acts. In most cases they manage to prevent such acts but there are exceptions when they fail as in the Fagersta school attack.
Whether there is competence in the Swedish police to detect encrypted messages promoting violence in on-line groups like TCC is a question which has to be addressed by the police, spokespersons of the 'Center against Violent Extremism' and the 'Post and Telecom Authority' told The Brussels Times.
