The bumpy paths of online sleuthing: Exploring the interactional accomplishment of familiarity,evidence,and authority in online crime discussions

Investigative practices online

Online sleuthing can be defined as investigative efforts within digital communities to solve a crime case or identify a suspect. It covers aspects of digital vigilantism since it includes private research and fact-findings around individuals’ wrongdoings or crime mysteries with the help of digital technologies and the Internet, but it is also different since it does not have to include the aspect of “taking the law into one’s own hands” (Loveluck, 2020: 214). It is not the same as witch hunts, harassment, or shaming but still exemplifies the contributions of Internet users to crime governance today, often undertaken in the name of justice, order, or safety (Myles et al., 2016: IV; Loveluck, 2020: 213).

Loveluck (2020: 214) distinguishes four ideal types of digital vigilantism: flagging, investigating, hounding, and organized leaking. Flagging involves shaming procedures of low-intensity cases (for instance badly parked cars or misbehaving passengers); investigating aims at solving a criminal puzzle or identifying a person suspected of wrongdoing; whereas hounding goes further and includes punitive intention (for instance by doxing, or discrediting and humiliating in other ways). Organized leaking represents a higher degree of orderliness, with WikiLeaks as the archetype. Both flagging and organized leaking are peripheral variants, Loveluck (2020: 235) argues, while the core forms are investigating and hounding. Digital vigilantism typically means some kind of detective work online (investigating) in combination with a punitive intention (hounding). Our data from Flashback seldom entail the latter aspect, but investigation is highly present. Posters often show their familiarity with the case and present pieces of claimed evidence related to it, and they operate in a setting whose members expect this.

Myles et al. (2016) present a slightly different typology, with four kinds of contributions of Internet users to crime governance: non-institutionalized surveillance, crowdsourced policing, online vigilantism, and civilian policing. Online sleuthing is close to crowdsourced policing, with its employment of a heterogeneous group of citizens to solve a security problem defined by an organization, but the Flashback posters we study in this article do not work for anybody and have not accepted any tasks “from above.” They have to create their case-related authority on their own and within the discussion threads. The empirical case that Myles et al. shed light on—the Reddit Bureau of Investigation (RBI), a subgroup on Reddit for citizens wishing to solve crimes—is similarly anarchic, and it also deviates from the penalizing dimension. In fact, the identity of RBI members is constructed in reaction to mob justice, with recurrent remarks against posters who advocate revenge or the use of force (Myles et al. 2016: XVII–XVIII; Myles et al., 2020). The definition used by Myles et al. (2020) suits our study best (although they use the term “websleuthing” instead of “online sleuthing”), that is, investigative practices undertaken online by individuals who are not professional security providers.

This means that we do not view vigilantism or substantial contributions to the police as crucial. Crime case discussion can be interesting to study per se, to specify how the community members construct the discussion as online sleuthing, and do so along collectively recognized lines. Still, much of the research that is closest to our study is concerned with both penalizing and informative practices. Many researchers are interested in how citizens not only share information about crimes but also track down, investigate, and punish criminals, sometimes by baiting them through their online behavior, as when chasing pedophiles. Huey et al. (2012), for instance, have found extensive collectives in the United States which engage in policing and vigilantism along these lines. Researchers give them many names: “cyber-sleuths,” “cyber-vigilantes,” “digilantes,” “websleuths,” “keyboard sleuths,” “social media sleuths,” “armchair detectives,” etc. (Nhan et al., 2017; Pantumsinchai, 2018; Yardley et al., 2018).

Researchers sometimes argue that the benefit for the criminal justice system from Internet users is underestimated (Huey et al., 2012), and define them as a dormant “security capital” (Nhan et al., 2017: 345). Some are interested in online sleuths’ capability to serve as “additional ‘eyes and ears’” by, for instance, matching surveillance videos to Facebook pictures (Shaw, 2014), or by joining in peer production about crimes related to animal cruelty (Wikhamn et al., 2019). The activity can be seen as “a complement or even replacement to ordinary police work” (Wikhamn et al., 2019: 65) and appears to be especially celebrated in the Greater China region (Chia, 2019). Chang and Poon (2017) use the term netilantism in their study of Hong Kong students and argue that search engines, widening social media activity, and the possibility to register numerous accounts all contribute to “cyber crowdsourcing,” which in China is known as renrou sousou, “human flesh search” (Chang and Poon, 2017: 1914; Nhan et al., 2017: 345). Trottier (2014) describes how Internet users in the United Kingdom can monitor hours of CCTV footage to find significant sequences in crime cases, “leaving the police to concentrate on other efforts” (Trottier, 2014: 616).

However, many unsubstantiated “truths” are cherished within online communities and can motivate researchers to take the opposite stance. In an analysis of two cases (the 2013 Boston bombing and the 2015 Bangkok bombing), Pantumsinchai (2018) shows that online investigations may create feedback loops in which uncertain claims are constructed as unquestioned facts. Statements take on a life of their own, even though new revelations may cause the loops to collapse. This demonstrates, Pantumsinchai (2018: 774) argues, that online speculation can define something as indisputable even if it turns out to be a house of cards. She points to Phillips’ (2013: 503) finding that online sleuths and mainstream media are situated in an amplificatory relationship, in which trolls and ideologues operate at high speed. In our data, too, we have noted that posters operate in several threads and forums in parallel. Trottier (2017) describes digital vigilantism as both intense and enduring, ranging from “naming and shaming” to online as well as embodied harassment. In a study of how images of torture, abuse, and humiliation are used, Kasra (2017: 186) even identifies “a new means of oppressive control.” Such practices have been widely criticized. Sometimes online sleuths produce an overabundance of tips that put pressure on strained police resources, and misidentifications of perpetrators may cause similar troubles (Nhan et al., 2017: 358; Pantumsinchai, 2018). “People who oppose netilantism,” Chang and Poon (2017: 1916) write, “claim the randomness and unstructured nature of vigilantism may punish innocent people.”

Scholars have thus found both information-generating and penalizing online communities, producing both helpful and misleading clues, as well as digital frenzy and folk justice. Some observations are particularly interesting, for instance on: (a) the closeness between online communities and mainstream media (which is often cited in posts), (b) anonymity and pluralism in online identities (a user may have multiple aliases in several threads), alongside strong commitments to aliases, (c) the fact that many activities are aimed not only at solving a crime but at managing huge information flows and correcting other posters, and (d) broad options for posters to suggest “deep knowledge” or personal experience of the case (Chang and Poon, 2017; Nhan et al., 2017: 352–353; Wikhamn et al., 2019: 63).

We build on these observations in this article, but our study is not on information-crowdsourcing or punishment. Our focus is the accomplishment of three meanings within online sleuthing—familiarity, evidence and authority—through interaction. We argue that being engaged in anarchistic and non-penalizing discussions of cases—for instance on the Swedish forum Flashback, but also on Reddit, 4chan, and similar settings—is a phenomenon in its own right, regardless of the assistance it can offer to police investigations (Nhan et al., 2017) or the ethical concerns regarding vigilantism. As Loveluck (2020: 224) has pointed out, this activity belongs to an infotainment culture (Yardley et al., 2018), in which citizens reproduce a shared preoccupation with crimes in self-reinforcing interactions. Online sleuthing is not only tied to punitive and informative concerns; it is also a social and cultural practice (Hannerz et al., 2022). The fact that Flashback presents digital interactions in a format that reflects their original emergence—the order of posts in a thread is retained, for example, as they do not move around based on the likes (“upvotes”/“downvotes”) of others, as on Reddit—has given us good opportunities to trace and identify some patterns that constitute this practice. What seems missing in previous research is precisely this: a closer look at the specific interactions that produce and sustain the meanings of online sleuthing on a given platform. How do posters indicate to other posters their alleged familiarity with the case? What counts as evidence? How should a poster behave digitally, to achieve investigative authority?

Seeking answers to such questions can expose the interactional origin of investigative practices and help us better understand the local turbulence—or the “bumpy paths”—of online sleuthing. Our empirical focus is the Swedish forum Flashback, but our ambition is to pinpoint processes that are likely recognizable on several digital sites.

Collins, Maloney, and the interactionist tradition

Collins (2004: 23) puts the spotlight on interactions and how they shape people’s actions and emotions, in particular through interaction rituals. When people congregate formally or informally—in everything from a coffee break to a wedding—they come to share a situation because of their co-presence, their focused interaction and the dominance of a specific definition of the situation. Social cohesion emerges and so-called sacred objects (or particularly significant ones) are charged with meaning. Following Durkheim’s (1995 [1912]) line of thought, collective effervescence is created, so that identities and symbols at the center of the interaction are given meaning. Whether at a wedding or a coffee break, the individuals involved get boosted by their focused interaction, which in turn inspires them to further actions. If the interaction is disturbed somehow, interactants may feel discomfort or annoyance. They tend to defend what is going on, as well as the meaning-making consequences.

Acknowledging that Collins (2004) originally required bodily co-presence in interaction rituals, Maloney (2013) has extended this theory to encompass also online interactions. In her studies of pro-anorexic websites she has found how emotional energy can be generated and identities formed even though the interactants never meet face-to-face. The bulk of Collins’ criteria is there online—a gathering with shared focus under a dominant definition of the situation and a tendency to defend the boundaries. Online exchanges, Maloney shows, can also be analyzed through an interactionist lens, not least authority creation. Maloney (2013: 15) observes, for instance, how a newcomer on a “pro-ana” site gradually becomes an expert on the anorectic lifestyle in the eyes of the other posters and is thereby bestowed an authoritative identity in this social world in and through online interaction.

While not emphasizing the ritual aspect as much, we take from Maloney’s extension of Collins’ theory an analytic interest in posters’ interactions and what they generate. Collins draws on Mead and Blumer and their insistence on putting interaction at the center of social analyses. For Mead (1967 [1934]: 182), the human self is “an eddy in the social current,” as he wrote, “and so still part of the current”—in our case, an identity both situated in and shaped by the stream of activities online. For Blumer (1986 [1969]: 2), people act toward objects on the basis of the meaning ascribed to them (any object, also figurative or imagined ones), so that meanings are constructed and sustained in interactions.

This means that our analysis of what occurs in discursive gatherings on crime cases online can benefit from pursuing posters’ interactions, paying close attention to what meanings posters indicate and construct, as well as what identities and categories they constitute. Posters sustain “a condition of heightened intersubjectivity” (Collins, 2004: 34) around “their” crime cases. As a theory of situations (Collins, 2004: 3), interactionism takes momentary encounters as its starting point to trace how identities and categories are “charged up” in focused interaction.

An ethnographic approach to online discussions

Similar to Collins’ advice, the pursuit of indigenous meanings is what Emerson et al. (1995: 12–13, 112–141) recommend in ethnographic research. Rather than imposing exogenous meanings—stemming, for instance, from the researcher’s circles—ethnographers should be responsive to what field members are concerned about, in their own terms. Members of any field frequently provide descriptions of their setting, and they tell stories, employ typologies and provide accounts. They categorize occurrences themselves, sometimes implicitly. In our case, “evidence” is such a category, shaped by subsequent posters’ responses to the candidate evidence provider. Instead of saying “this is real evidence” and “this is not” (based, for instance, on a police report or mainstream media) and thereby externally validating this or that post, ethnographers should try to witness what field members validate internally. Categories in situated use are stronger data, Emerson et al. argue, since they point at what occurs in a given setting, not at what occurs within the researcher’s collective (Emerson et al. 1995: 127). Open online communities may in this respect provide fruitful data since long chains of naturally occurring interactions (Silverman, 2007) are accessible.

Like Collins, Emerson et al. (1995) do not write for researchers of the Internet. Still, ethnographic ideals are relevant and vivid in netnography and virtual ethnography. As Hines (2019: 2–3) points out, mediated communication can be both appropriate and sufficient for ethnographic studies even though ethnography was originally founded on the premise of bodily presence and face-to-face interactions. Mediated communication is what many people use when discussing and relating to crime today, so ethnographers need to take part in this communication, too—and while doing so, being open to the meaning-making in which Internet users are engaged (Hine 2019: 176, 187). An ethnographic approach to crime case communities seems a fruitful way to understand how and why the Internet matters in peoples’ lives (Hine 2019: 196). Moreover, it entails an interest in the politics of the field, rather than in politicizing it from researchers’ point of view. When Myles et al. (2020), for instance, study how Reddit posters disqualify other posters’ requests for punitive efforts, they employ such an approach. They study the interplay between various stances made by fieldmembers rather than articulating a stance on their own. To pay close attention to members’ cues and gestures is to appreciate “how much interactional and political ‘work’ it takes for people to create their meanings” (Emerson et al. 1995: 133).

Thus, with this framework—interactionism and ethnography—we find good reasons to not reduce online crime case engagement to a question of helpful or harmful contributions to the criminal justice system but to cultivate a field-sensitive attitude. These discussions take place in the online version of an infotainment culture in which posts and nicknames are “charged up” with significance (Collins, 2004: 85), and by becoming responsive to this, we may start to describe the collective concerns of the field members.

Familiarity as interaction

Posters’ efforts to present familiarity with the case often entail allusions to personal context. First, many posters situate the case in personal terms, spatially and temporally. Personal background is related, made adequate, and inserted close to the case description:

My parents live in the house with the Internet café [where the shooting took place]. I grew up there and spent some time there at the café too, in 2002–2004

I’ve been to that Internet café more than 300 times

I live in the area

This is an effective way of invoking familiarity with the crime by stepping right into the case in a way that traditional media seldom allows. It often works as a platform for subsequent arguments with relatively high credibility in the community. Indeed, posters regularly ask for such familiarity—“isn’t there anyone from [city X, the place of the crime] here?”—especially in those cases it seems to take “too long” before such posts show up:

No pupil at the school [where a rape took place] hanging here on Flashback? Come on, now! [show yourself]

Somebody here who’s done any suspicious observations on X street recently, primarily the . . . restaurant and the tobacco store? [regarding a murder case]

Local talents [here on Flashback] should be able to tell what house it is [the crime scene], at least when more pictures arrive?

Making the crime scene familiar is thus an interactional accomplishment. It is frequently called for in the community so that even when it appears without being explicitly requested it still feels expected, as if responding to a silent call. The rhetoric on display is analogous to what Sacks (1998 [1992]: Vol. I, 36) terms a private calendar, where world events can be located by reference to one’s own biography (e.g. “Kennedy was assassinated two weeks after we got engaged”), but here it is also a matter of a private map. The event is located with reference to one’s whereabouts, past or present, and this contextualization is typically appreciated.

A similar meaning can be accomplished by invoking others whom the poster knows well and efficiently communicating vicarious observations: “my colleague’s wife came to the place by car, 1 minute after the shooting. . .,” she saw how the blood was starting to spread on the [victims’] shirts, “according to my brother a guy ran away with a gun visible in his hand.” “My colleague,” “my brother”—intimate and private knowledge is thus conveyed with the help of relations, and the posters appear as quick to detect and contextualize others’ important observations.

Still, the “I”—“I live. . .,” “I’ve been. . .,” “I grew up. . .”—is a fast lane to advancing analysis, and counts as stronger than vicarious views, such as in the post below. Here, the poster objected to a previous commentator who suggested that the shooting could not be about a conflict between criminal gangs, but a racist Swede, and did so by invoking a general and yet personal place-experience:

Probably not [a racist Swede]. Many young criminals around 20 to 25 hang around at the Internet cafés throughout Malmö, and spend their days on computer games. I have worked as a receptionist at an IT café in Malmö myself, and the most shady types were regulars, when they weren’t out in the streets and sold drugs or were occupied with gang-related activities, they were at the café and played war games.

“I have worked as a receptionist at an IT café in Malmö myself”—thus, the posters inscribe themselves and their work experience in the case to downplay other posts and advance the discussion, in this instance indicating that Internet cafés in general indeed are a place for ethnic minority criminals and that the shooting most likely does originate in such settings (and not among racist Swedes). Such posters may engage in a stream of “I’ve seen these places myself” postings, personally vouching for a certain interpretation.

When posters indicate a high degree of seriousness about personalizing angles, they simultaneously indicate how others in the community are supposed to comport themselves in the presence of such indications: with approval and respect (cf. Collins, 2004: 17). To case-relate one’s own background is valued in this social world, and having “been there” oneself ranks especially high.

Evidence as interaction

A step further in posters’ sleuthing ambitions, and sometimes embedded in the exchanges described above, is to dress personal observations as directly relevant to, or even part of, the crime drama:

I saw a black big car

I think I saw some guys from the old [faction of criminals] (. . .) earlier this night (. . .) just 50 meters away

I saw quite a lot of police cars coming from the north (. . .) so they seem to mobilize larger forces in Malmö

Live there and heard the shots [goes on talking about “my assessment” of the probable weapon]

I live just at the corner and heard the shooting, I look down from the window and I see 6 to 7 people running from the place (not the Internet café but the pedestrian crossing next to it), in panic, as it seemed. Then I heard somebody who seemed to feel a fucking pain, and animated voices in Arabic

Here, posters portray themselves not only as competent to employ their personal knowledge but also as providing data about the case, as empirical notetakers and witnesses joining the collective interaction. They add to the case by attaching their “I” to noted facts that, if correct, make their comments potentially much more significant than others’. The occasional use of the historical present reinforces a dramatic feeling: “I look down. . .,” “I see. . . .” Although the tone may be casual, these posts do not necessarily belong to the “whatever” quality of the community that criminal reporters and other experts dismiss, that is to say the “noise,” the “means of self-expression” (Wikhamn et al., 2019: 63; Nhan et al., 2017: 346–347) and the abundance of seemingly nonsensical or random utterances. Rather, they are getting closer to what might be defined as substantial, even in the eyes of skeptical lurkers, and beginning to charge up their online investigation (cf. Collins, 2004: 84–85). Posters know that individual nicknames can be charged with significance through the crime-solving effervescence of the online conversations to which they contribute.

Some posters go to the crime scene and report their observations to the community:

Been to the place today, and I take for granted that the shot was fired from a very close distance (. . .) the car drove by just in front of the IT café. When the victims stepped out on the little staircase, they were shot down. (. . .) The gunner must have sat in the backseat, leaned the gun upwards through the open window at the back. [continues speculating]

This poster, though, meets with resistance. Others object to the idea that several cars came behind the first one, or to details such as the direction in which the perpetrators disappeared. Still, others come to the rescue: “Are you stupid, or what?” they ask the objectors. The proposed route does make sense, they argue, though later a correction is issued which confirms the objection. A given post is seldom guaranteed permanent value. If it does not seem possible to define a claim as substantial or serious (as validated by active posters further down the thread), the poster making that claim will have a hard time achieving investigative authority. As posters interact with one another to settle details, like the weapon used or the number of cars at the crime scene, they scrutinize others’ posts and weigh their proposed evidence, making the detective performance far from a smooth ride.

Still, the post quoted above is locally meaningful. It attracts an array of responses and chains of meta-comments and contributes to energizing the debate as a whole. Simply by encouraging rectifications (which typically quote some of the post and add some angry lines) it may fuel the discussion. The very activity of assessing posts and categorizing them into “good” or “bad,” “clever” or “stupid,” and so on belongs to the phenomenon of online sleuthing, we argue, and as analysts, we benefit from studying rather than imitating this activity (cf. Nhan et al., 2017: 346–347; Wikhamn et al., 2019: 63). To categorize is what members themselves do in their ongoing constructions of meaning, and few posters can count on undivided support.

Authority as interaction

The online setting is liable to rapid change. Posters can be generous with affirmation, but they may also unsentimentally put down those they consider to be pretending to know things. Let us take a look at the sequence of what eventually turned out to be a failed detective performance in the thread about the shooting at the Internet café in Malmö. One poster writes the following, about 90 minutes after the thread started (which was directly after the first news report):

I can confirm that 3 are dead. fourth has 10% chance to survive.

Crisis meeting now between the authorities and the Police, the Security Police tonight. (friend who works at the emergency unit) [implies the source of information]

This poster gets some supportive responses, such as queries about who the dead victims are, and comments like:

Really serious. I hope this isn’t the start of a new wave of violence in Malmö.

Within 3 minutes, though, another poster quotes the report that “3 are dead,” but adds a note of skepticism about the claim that the authorities are holding a crisis meeting:

Sounds unlikely that a person within health care [the alleged friend of the previous poster] would have gotten knowledge about which authorities are involved in the investigation.

This takes the air out of the first quoted poster, although they return to the thread within about 3 minutes and respond to the skeptical comment by once more referring to the “friend” at the hospital:

I’m just telling what my friend said. There are police officers at the hospitals at these occasions you know [implying that the police told the friend about the authorities involved]

Nonetheless, this poster does not succeed in maintaining authority. The responses fade, others take the stage, and the fact that it “sounds unlikely” that “authorities” would openly discuss crisis meetings with the security police so that a “friend” at the hospital could hear about it undermines the poster’s attempt to sustain investigative authority. In this case, the interactional support was too weak, a responding actor highlighted the weakness in the post and no one (except the original poster him- or herself) rushed to defend it.

Another, more successful poster in the thread is a user we here call Elgangetty, even though the support proved to be temporary here, too. Elgangetty starts to write things like “now I got an SMS, also the other guy is dead,” and “also him driven privately to the hospital,” implying that they have a personal channel to secret information. Elgangetty goes on to post detailed descriptions of the victims, their names and backgrounds, and how they are considered suspects by the police in previous investigations. Other posters quote this, say “thank you,” and make comments like:

You seem to have a decent understanding of the situation, do you know the injury picture for those injured . . .

Elgangetty also gets responses like:

awesome with an account [like that]. One can tell that you [Elgangetty] know what you’re talking about in this case considering your previous posts

Elgangetty starts to emerge as insightful and their comments are reposted: “here is what the writer ‘Elgangetty’ wrote, who has been very right during the whole event . . .” Based on what we know from other threads, to be “right” about a case—even before it has been resolved by a police investigation—and “to know what you’re talking about” is a dream position in the community. Such responses single out the poster as a star and communicate—sometimes only through quotations—that others ought to comport themselves respectfully in the presence of their posts. Effervescence (Collins, 2004: 35) is created, and a feeling of progression. Elgangetty starts to add informed questions to the thread, and evaluates others’ posts, taking on a position as master-detective who enjoys the privilege of supervising and corroborating as well as finding faults: “everything said here is correct. But . . .”

Soon, though, Elgangetty comes under attack. “Your info equals shit!!!” the poster Ingfotady writes, arguing that Elgangetty falsely portrayed one of the victims as a “vegetable” because of his injuries:

what have you got that info from [about the injuries]? weird that you can watch a vegetable [ironically said] walk around and feel almost perfectly alright at the funeral today! stop act [as if you were] important!

Elgangetty’s status declines, and at one point they even get suspended by the moderator, but still some posters defend previous posts, calling them partly correct and excusing their misinformation. Subsequently, the excellence of other sleuths gains prominence. They have a tone more clearly associated with the hoods in Malmö (close to the social contexts in which journalists and the police place the shooting) and start to replace Elgangetty’s authority.

In another thread, one of the prominent sleuths we interviewed experiences both ups and downs under the alias Tionwho. Over time, he gains support from a team of posters who join his efforts to question a certain image of the criminal event belonging to the police. But an opposing team also takes shape in the thread, attacking Tionwho with “hate . . . almost frightening,” as he described it in our interview. Tionwho devotes a lot of time to the thread, especially while traveling for work (when he can concentrate better), and eventually the intense emotions and hard work pile up:

Considering the hate and anger this thread has created I have decided to “retire” my nickname (. . .) I won’t use the nick Tionwho in new threads. (. . .) To wrap up a thread like [the one under discussion] will probably only be possible if one decides to stop responding, otherwise one is pulled back in again.

Tionwho had been excelling as an analyst but now decides to back off. The interactional constitution of online sleuthing is not only illustrated in the insights he presents on wrapping up (to “stop responding” equals desisting interaction) but also in the idea of “retirement.” The poster known as Tionwho analyzes how his alias has been molded in long chains of digital encounters (cf. Collins, 2004: 5) and finds that it is less shining. By “retiring” the nickname he withdraws from the work of defending it, which opens up new avenues. This poster has several aliases on the platform, under which he engages in other crime threads and which receive less “hate and anger,” and he switches to using those instead.

Some of the posters we interviewed not only accounted for their own alternative aliases but also described ways that posters could be delegitimized by—allegedly—disclosing their manipulations of identity. For instance, two seemingly different aliases with similar phrasings might be looked upon as hiding one and the same poster. Such observations were exchanged and acclaimed using the site’s personal messaging system.