Content uploaded by David Wästerfors
All content in this area was uploaded by David Wästerfors on Mar 14, 2023
Content may be subject to copyright.
new media & society
© The Author(s) 2023
Article reuse guidelines:
The bumpy paths of online
sleuthing: Exploring the
of familiarity, evidence, and
authority in online crime
David Wästerfors , Veronika Burcar Alm
and Erik Hannerz
Lund University, Sweden
Much of today’s public discourse on crime cases take place on online platforms, as
long chains of high-speed posts: speculations, analyses, and laments, as well as ironic,
sarcastic, and derogatory comments. These give excellent (and yet risky) possibilities
to engage in homemade investigation, with other posters as instant reviewers
and audiences. In this article, we explore the interactional origin of case-related
familiarity, evidence and authority in crime discussions on the Swedish platform
Flashback. Through Internet data and interviews, we show how online sleuths
interact digitally with one another so that familiarity with the case is performed,
leads and evidence suggested, and investigative authority recognized. We argue that
an interactionist and ethnographic approach is needed to uncover such recurring
processes in online crime case discussions. The accomplishment of sleuthing is highly
dependent on others’ shifting responses, and is, therefore, a “bumpy” path.
Crime case discussions, digital ethnography, interaction, online sleuthing
David Wästerfors, Department of Sociology, Lund University, Lund 221 00, Sweden.
1149909NMS0010.1177/14614448221149909new media & societyWästerfors et al.
2 new media & society 00(0)
One summer night in 2018, a drive-by shooting took place outside an Internet café in
Malmö, Sweden. Three young men were killed and three others were injured. The shoot-
ing was followed by a series of tit-for-tat murders between two criminal factions and is
now considered one of the worst gang murders in Swedish history. Joakim Palmkvist
(2020), a renowned crime reporter, argues that the drive-by shooting might have been
revenge for a kidnapping the week before, and if so, it was a failed attempt since the man
who had allegedly ordered the kidnapping was not among those killed.
The crime scene immediately turned into a commemoration site for the victims, with
photographs, candles, and flowers. One of us (David Wästerfors) visited the site a couple
of times just after the crime and witnessed how the gatherings paid respect to the victims
and showed curiosity about the case. There was an air of solemnity. People sighed or just
stood silent, passersby slowed down on their bikes to take a long look.
At the same time, a more heated, online “gathering” emerged on the Internet, in par-
ticular on Flashback, an open and well-known Swedish online community with a vibrant
subgroup devoted to criminal cases. The thread on the 2018 shooting alone consists of
more than 4000 posts, with the most intensive posting just minutes after the shooting
happened. Unlike the crime scene gathering, the discussion here was quite wild. Instead
of solemnity, the thread is full of speculations, rumors, interpretations, and accusations,
typically addressing other posters.
This article uses this Flashback thread as a case to explore people’s engagement in
online discussions of crime, and specifically, the interactional accomplishment of case-
related familiarity, evidence, and authority. The purpose is to try out a more processual
and less normative frame compared to previous research. For this purpose, we also draw
on other instances from our overall project Citizens as Crime Investigators, funded by
the Swedish Research Council, in which additional 13 threads on Flashback are studied
along with interviews with posters and journalists. Our main case in this article, though,
is the thread on the drive-by shooting in 2018.
In the rest of this introduction, we will discuss our definition of online sleuthing, with
reference to previous research. We will also clarify our contribution and research ques-
tions. In the two sections that follow, we will present our conceptual framework, research
design, and methodology. We will then present our analysis, with excerpts from our data,
and finally, our conclusions.
Investigative practices online
Online sleuthing can be defined as investigative efforts within digital communities to
solve a crime case or identify a suspect. It covers aspects of digital vigilantism since it
includes private research and fact-findings around individuals’ wrongdoings or crime
mysteries with the help of digital technologies and the Internet, but it is also different
since it does not have to include the aspect of “taking the law into one’s own hands”
(Loveluck, 2020: 214). It is not the same as witch hunts, harassment, or shaming but still
exemplifies the contributions of Internet users to crime governance today, often under-
taken in the name of justice, order, or safety (Myles et al., 2016: IV; Loveluck, 2020: 213).
Wästerfors et al. 3
Loveluck (2020: 214) distinguishes four ideal types of digital vigilantism: flagging,
investigating, hounding, and organized leaking. Flagging involves shaming procedures
of low-intensity cases (for instance badly parked cars or misbehaving passengers); inves-
tigating aims at solving a criminal puzzle or identifying a person suspected of wrongdo-
ing; whereas hounding goes further and includes punitive intention (for instance by
doxing, or discrediting and humiliating in other ways). Organized leaking represents a
higher degree of orderliness, with WikiLeaks as the archetype. Both flagging and organ-
ized leaking are peripheral variants, Loveluck (2020: 235) argues, while the core forms
are investigating and hounding. Digital vigilantism typically means some kind of detec-
tive work online (investigating) in combination with a punitive intention (hounding).
Our data from Flashback seldom entail the latter aspect, but investigation is highly pre-
sent. Posters often show their familiarity with the case and present pieces of claimed
evidence related to it, and they operate in a setting whose members expect this.
Myles et al. (2016) present a slightly different typology, with four kinds of contribu-
tions of Internet users to crime governance: non-institutionalized surveillance, crowd-
sourced policing, online vigilantism, and civilian policing. Online sleuthing is close to
crowdsourced policing, with its employment of a heterogeneous group of citizens to
solve a security problem defined by an organization, but the Flashback posters we study
in this article do not work for anybody and have not accepted any tasks “from above.”
They have to create their case-related authority on their own and within the discussion
threads. The empirical case that Myles et al. shed light on—the Reddit Bureau of
Investigation (RBI), a subgroup on Reddit for citizens wishing to solve crimes—is simi-
larly anarchic, and it also deviates from the penalizing dimension. In fact, the identity of
RBI members is constructed in reaction to mob justice, with recurrent remarks against
posters who advocate revenge or the use of force (Myles et al. 2016: XVII–XVIII; Myles
et al., 2020). The definition used by Myles et al. (2020) suits our study best (although
they use the term “websleuthing” instead of “online sleuthing”), that is, investigative
practices undertaken online by individuals who are not professional security providers.
This means that we do not view vigilantism or substantial contributions to the police
as crucial. Crime case discussion can be interesting to study per se, to specify how the
community members construct the discussion as online sleuthing, and do so along col-
lectively recognized lines. Still, much of the research that is closest to our study is con-
cerned with both penalizing and informative practices. Many researchers are interested
in how citizens not only share information about crimes but also track down, investigate,
and punish criminals, sometimes by baiting them through their online behavior, as when
chasing pedophiles. Huey et al. (2012), for instance, have found extensive collectives in
the United States which engage in policing and vigilantism along these lines. Researchers
give them many names: “cyber-sleuths,” “cyber-vigilantes,” “digilantes,” “websleuths,”
“keyboard sleuths,” “social media sleuths,” “armchair detectives,” etc. (Nhan et al.,
2017; Pantumsinchai, 2018; Yardley et al., 2018).
Researchers sometimes argue that the benefit for the criminal justice system from
Internet users is underestimated (Huey et al., 2012), and define them as a dormant “secu-
rity capital” (Nhan et al., 2017: 345). Some are interested in online sleuths’ capability to
serve as “additional ‘eyes and ears’” by, for instance, matching surveillance videos to
Facebook pictures (Shaw, 2014), or by joining in peer production about crimes related to
4 new media & society 00(0)
animal cruelty (Wikhamn et al., 2019). The activity can be seen as “a complement or
even replacement to ordinary police work” (Wikhamn et al., 2019: 65) and appears to be
especially celebrated in the Greater China region (Chia, 2019). Chang and Poon (2017)
use the term netilantism in their study of Hong Kong students and argue that search
engines, widening social media activity, and the possibility to register numerous accounts
all contribute to “cyber crowdsourcing,” which in China is known as renrou sousou,
“human flesh search” (Chang and Poon, 2017: 1914; Nhan et al., 2017: 345). Trottier
(2014) describes how Internet users in the United Kingdom can monitor hours of CCTV
footage to find significant sequences in crime cases, “leaving the police to concentrate on
other efforts” (Trottier, 2014: 616).
However, many unsubstantiated “truths” are cherished within online communities
and can motivate researchers to take the opposite stance. In an analysis of two cases (the
2013 Boston bombing and the 2015 Bangkok bombing), Pantumsinchai (2018) shows
that online investigations may create feedback loops in which uncertain claims are con-
structed as unquestioned facts. Statements take on a life of their own, even though new
revelations may cause the loops to collapse. This demonstrates, Pantumsinchai (2018:
774) argues, that online speculation can define something as indisputable even if it turns
out to be a house of cards. She points to Phillips’ (2013: 503) finding that online sleuths
and mainstream media are situated in an amplificatory relationship, in which trolls and
ideologues operate at high speed. In our data, too, we have noted that posters operate in
several threads and forums in parallel. Trottier (2017) describes digital vigilantism as
both intense and enduring, ranging from “naming and shaming” to online as well as
embodied harassment. In a study of how images of torture, abuse, and humiliation are
used, Kasra (2017: 186) even identifies “a new means of oppressive control.” Such prac-
tices have been widely criticized. Sometimes online sleuths produce an overabundance
of tips that put pressure on strained police resources, and misidentifications of perpetra-
tors may cause similar troubles (Nhan et al., 2017: 358; Pantumsinchai, 2018). “People
who oppose netilantism,” Chang and Poon (2017: 1916) write, “claim the randomness
and unstructured nature of vigilantism may punish innocent people.”
Scholars have thus found both information-generating and penalizing online commu-
nities, producing both helpful and misleading clues, as well as digital frenzy and folk
justice. Some observations are particularly interesting, for instance on: (a) the closeness
between online communities and mainstream media (which is often cited in posts), (b)
anonymity and pluralism in online identities (a user may have multiple aliases in several
threads), alongside strong commitments to aliases, (c) the fact that many activities are
aimed not only at solving a crime but at managing huge information flows and correcting
other posters, and (d) broad options for posters to suggest “deep knowledge” or personal
experience of the case (Chang and Poon, 2017; Nhan et al., 2017: 352–353; Wikhamn
et al., 2019: 63).
We build on these observations in this article, but our study is not on information-
crowdsourcing or punishment. Our focus is the accomplishment of three meanings
within online sleuthing—familiarity, evidence and authority—through interaction. We
argue that being engaged in anarchistic and non-penalizing discussions of cases—for
instance on the Swedish forum Flashback, but also on Reddit, 4chan, and similar set-
tings—is a phenomenon in its own right, regardless of the assistance it can offer to
Wästerfors et al. 5
police investigations (Nhan et al., 2017) or the ethical concerns regarding vigilantism.
As Loveluck (2020: 224) has pointed out, this activity belongs to an infotainment cul-
ture (Yardley et al., 2018), in which citizens reproduce a shared preoccupation with
crimes in self-reinforcing interactions. Online sleuthing is not only tied to punitive and
informative concerns; it is also a social and cultural practice (Hannerz et al., 2022).
The fact that Flashback presents digital interactions in a format that reflects their origi-
nal emergence—the order of posts in a thread is retained, for example, as they do not
move around based on the likes (“upvotes”/“downvotes”) of others, as on Reddit—has
given us good opportunities to trace and identify some patterns that constitute this
practice. What seems missing in previous research is precisely this: a closer look at the
specific interactions that produce and sustain the meanings of online sleuthing on a
given platform. How do posters indicate to other posters their alleged familiarity with
the case? What counts as evidence? How should a poster behave digitally, to achieve
Seeking answers to such questions can expose the interactional origin of investigative
practices and help us better understand the local turbulence—or the “bumpy paths”—of
online sleuthing. Our empirical focus is the Swedish forum Flashback, but our ambition
is to pinpoint processes that are likely recognizable on several digital sites.
In this article, we theorize data from crime case discussions on Flashback within an inter-
actionist and ethnographic framework. Our interactionist approach stands close to
Collins’ (2004) theory of interaction ritual chains, as well as Maloney’s (2013) extension
of this theory to include online groups. Our ethnographic approach stands close to
Emerson et al.’s (1995) recommendations, which can be applied to Internet research with
the help of reasonings from Hine (2019).
Collins, Maloney, and the interactionist tradition
Collins (2004: 23) puts the spotlight on interactions and how they shape people’s actions
and emotions, in particular through interaction rituals. When people congregate formally
or informally—in everything from a coffee break to a wedding—they come to share a
situation because of their co-presence, their focused interaction and the dominance of a
specific definition of the situation. Social cohesion emerges and so-called sacred objects
(or particularly significant ones) are charged with meaning. Following Durkheim’s (1995
) line of thought, collective effervescence is created, so that identities and symbols
at the center of the interaction are given meaning. Whether at a wedding or a coffee
break, the individuals involved get boosted by their focused interaction, which in turn
inspires them to further actions. If the interaction is disturbed somehow, interactants may
feel discomfort or annoyance. They tend to defend what is going on, as well as the
Acknowledging that Collins (2004) originally required bodily co-presence in interac-
tion rituals, Maloney (2013) has extended this theory to encompass also online interac-
tions. In her studies of pro-anorexic websites she has found how emotional energy can be
6 new media & society 00(0)
generated and identities formed even though the interactants never meet face-to-face.
The bulk of Collins’ criteria is there online—a gathering with shared focus under a
dominant definition of the situation and a tendency to defend the boundaries. Online
exchanges, Maloney shows, can also be analyzed through an interactionist lens, not
least authority creation. Maloney (2013: 15) observes, for instance, how a newcomer on
a “pro-ana” site gradually becomes an expert on the anorectic lifestyle in the eyes of the
other posters and is thereby bestowed an authoritative identity in this social world in
and through online interaction.
While not emphasizing the ritual aspect as much, we take from Maloney’s extension
of Collins’ theory an analytic interest in posters’ interactions and what they generate.
Collins draws on Mead and Blumer and their insistence on putting interaction at the
center of social analyses. For Mead (1967 : 182), the human self is “an eddy in
the social current,” as he wrote, “and so still part of the current”—in our case, an iden-
tity both situated in and shaped by the stream of activities online. For Blumer (1986
: 2), people act toward objects on the basis of the meaning ascribed to them (any
object, also figurative or imagined ones), so that meanings are constructed and sustained
This means that our analysis of what occurs in discursive gatherings on crime cases
online can benefit from pursuing posters’ interactions, paying close attention to what
meanings posters indicate and construct, as well as what identities and categories they
constitute. Posters sustain “a condition of heightened intersubjectivity” (Collins, 2004:
34) around “their” crime cases. As a theory of situations (Collins, 2004: 3), interaction-
ism takes momentary encounters as its starting point to trace how identities and catego-
ries are “charged up” in focused interaction.
An ethnographic approach to online discussions
Similar to Collins’ advice, the pursuit of indigenous meanings is what Emerson et al.
(1995: 12–13, 112–141) recommend in ethnographic research. Rather than imposing
exogenous meanings—stemming, for instance, from the researcher’s circles—ethnogra-
phers should be responsive to what field members are concerned about, in their own
terms. Members of any field frequently provide descriptions of their setting, and they tell
stories, employ typologies and provide accounts. They categorize occurrences them-
selves, sometimes implicitly. In our case, “evidence” is such a category, shaped by sub-
sequent posters’ responses to the candidate evidence provider. Instead of saying “this is
real evidence” and “this is not” (based, for instance, on a police report or mainstream
media) and thereby externally validating this or that post, ethnographers should try to
witness what field members validate internally. Categories in situated use are stronger
data, Emerson et al. argue, since they point at what occurs in a given setting, not at what
occurs within the researcher’s collective (Emerson et al. 1995: 127). Open online com-
munities may in this respect provide fruitful data since long chains of naturally occurring
interactions (Silverman, 2007) are accessible.
Like Collins, Emerson et al. (1995) do not write for researchers of the Internet. Still,
ethnographic ideals are relevant and vivid in netnography and virtual ethnography. As
Hines (2019: 2–3) points out, mediated communication can be both appropriate and
Wästerfors et al. 7
sufficient for ethnographic studies even though ethnography was originally founded on the
premise of bodily presence and face-to-face interactions. Mediated communication is what
many people use when discussing and relating to crime today, so ethnographers need to
take part in this communication, too—and while doing so, being open to the meaning-
making in which Internet users are engaged (Hine 2019: 176, 187). An ethnographic
approach to crime case communities seems a fruitful way to understand how and why the
Internet matters in peoples’ lives (Hine 2019: 196). Moreover, it entails an interest in the
politics of the field, rather than in politicizing it from researchers’ point of view. When
Myles et al. (2020), for instance, study how Reddit posters disqualify other posters’ requests
for punitive efforts, they employ such an approach. They study the interplay between vari-
ous stances made by fieldmembers rather than articulating a stance on their own. To pay
close attention to members’ cues and gestures is to appreciate “how much interactional and
political ‘work’ it takes for people to create their meanings” (Emerson et al. 1995: 133).
Thus, with this framework—interactionism and ethnography—we find good rea-
sons to not reduce online crime case engagement to a question of helpful or harmful
contributions to the criminal justice system but to cultivate a field-sensitive attitude.
These discussions take place in the online version of an infotainment culture in which
posts and nicknames are “charged up” with significance (Collins, 2004: 85), and by
becoming responsive to this, we may start to describe the collective concerns of the
Research design and methodology
Most of our data is from Flashback, one of Sweden’s largest online forums, with 1.4 mil-
lion members who share opinions anonymously on anything from gardening to prostitu-
tion and serious crime, typically in unpolished ways. Anyone over the age of 18 can
register an account and start or join a discussion, subscribe to threads, exchange private
messages, and check what others have posted previously. The forum started in 2000 with
its roots in a punk magazine from the 1980s, and its moderators are known to be tolerant.
Thirty-three percent of Swedes say they use Flashback, although mostly sporadically
(only 1% use it daily) and it is more commonly used by those with higher household
incomes. Men aged 26–35 years are the largest category of users (60% of them use
Flashback; see the report Svenskarna och internet, 2018: 55–56).1
We followed 14 threads on crime cases on Flashback for one-and-a-half years. The
cases include shootings, disappearances, murders, rape, and a famous photographer
caught forging his own photographs. Some have about a hundred comments; the biggest
has more than 100,000. All threads are required (by the forum) to begin with a citation
(often a media link) and some kind of description, and then the discussion swings in
We also interviewed 30 informants of various ages, both women and men, some
through email or messenger systems, others by phone, Skype, or in face-to-face encoun-
ters.2 All are related to online crime case communities, as moderators, posters, lurkers,
podcasters, or journalists. We have analyzed all data in the original language (Swedish)
and only translated the excerpts published in this article. We have tried to stay as close as
possible to the original phrasings and expressions, which means that there can be
8 new media & society 00(0)
grammatical errors and unclear passages. All nicknames are fictive and consequently not
the same as those used on the platform.
Our focus in this article is the Flashback thread on the drive-by shooting in 2018, and
future writing will include a more in-depth analysis of the interview data. Still, the inter-
views have been helpful in our analysis, since recurring themes in the transcripts have
refined our focus when observing the threads. Familiarity with the case, providing evi-
dence and accomplishing authority are all talked about in interviews as significant parts
of online participation. Interviewees underline that they are attracted to the crime discus-
sions on Flashback since they want to know “more than the media,” that they search for
more facts and details around a case than officially reported, that they want to figure out
who the perpetrators and the victims are, and understand the context. They both indicate
and exemplify that posts deemed as contributing to solving the case must be seen as
highly valued. Such posts “help” the thread and advance the case. Posters who distract
from this project, on the other hand, are seen as less helpful, sometimes as sabotaging. As
case-related familiarity, evidence and authority recur both in the interviews and the
online data, we may talk about different specimens (Alasuutari, 1996: 62–65) of the
We will start our analytic section below with a few excerpts from the interviews to
exemplify these themes, and then continue by showing how they reappear in online
A characteristic of our research design compared to many others is that we have not
dismissed posts a priori, but paid attention to how the posters set things aside (or confirm
them), that is, how they themselves engage in crafting familiarity, evidence, and author-
ity. This is due to our interactionist and ethnographic approach. By appreciating posters’
assessments rather than assessing ourselves, we try to get closer to the members’
Case-related familiarity, evidence, and authority
To introduce our analysis of the online data, we would like to exemplify how the inter-
viewees stress the importance of case-related (a) familiarity, (b) evidence, and (c) author-
ity. We will also show how online interactivity in general is talked about.
One poster, for instance, argues that “good posts” move the case “forward” by con-
tributing new observations from the crime scene—showing how familiar the poster is
with the case—and that especially those “knowing somebody” involved in the case
should be treated as authoritative. This is how a poster (not active in the drive-by shoot-
ing case) in his 50s expresses it:
[Good posts] move the discussion forward, for instance by some kind of nuance in analysis, or
substantiated and reasonable hypotheses. Not “it must be. . .,” but “maybe. . . .” Or, of course,
through contributing new information with a source. Or through a summary of previous
information in the thread. Maybe somebody who knows the local conditions, “no, on that
pavement there is no street lighting” or “I biked by the place just an hour ago and it was
entrance 4B that was sealed off by the police.” Many good posts also come from persons who
know somebody involved in the case, or those situated in the setting some other way. They can
be tainted by loyalties, but they are still interesting.
Wästerfors et al. 9
Concrete findings close to the scene—the pavement, the street lighting, and so on—are
highly valued, as well as posts originating from people “situated in the setting.”
Consequently, to insert case-related familiarity and evidence in the online discussion
counts as essential, as well as to be a poster “who knows. . .,” that is, one with investiga-
tive authority in the eyes of the others.
Similarly, another interviewed poster says that he is especially attracted to posts by
“somebody who has lived in the area,” “somebody who has passed the place [the crime
scene],” or somebody who testifies “now there are so-and-so many police officers here.”
Thus, the interviewees argue that (a) to be familiar with the case and (b) to be able to
present new evidence are tightly connected to being positioned as (c) authoritative in the
threads. As we now move on to present how case-related familiarity, evidence, and
authority are accomplished in interaction, we would like to underline that interactivity in
general is also acknowledged in our interviews. Posters point out how the validation
process of familiarity, evidence, and authority depends on how a given comment is
responded to. It is “almost like playing chess,” a poster in her 60s explains:
One writer posts a comment, another reacts to this, and a third one develops it, a fourth links to
previous important posts, and so on. Different posts can be likened with chess-players’ different
‘moves’—and one “move” (post) is depending on previous moves.
This means posters point out that not only posts with new facts should be considered
“good” or “interesting,” but also seemingly modest or simple posts—“at the right
moment, at the right point in the thread” as the above poster formulates it—can be seen
as very valuable, as they may clarify or summarize things, clear up misunderstandings,
etc., just because of their timeliness.
The patterns we will now discuss show how the online interactions on Flashback—in
line with the above excerpts—constitute familiarity, evidence, and authority.
Familiarity as interaction
Posters’ efforts to present familiarity with the case often entail allusions to personal con-
text. First, many posters situate the case in personal terms, spatially and temporally.
Personal background is related, made adequate, and inserted close to the case
My parents live in the house with the Internet café [where the shooting took place]. I grew up
there and spent some time there at the café too, in 2002–2004
I’ve been to that Internet café more than 300 times
I live in the area
This is an effective way of invoking familiarity with the crime by stepping right into the
case in a way that traditional media seldom allows. It often works as a platform for sub-
sequent arguments with relatively high credibility in the community. Indeed, posters
regularly ask for such familiarity—“isn’t there anyone from [city X, the place of the
10 new media & society 00(0)
crime] here?”—especially in those cases it seems to take “too long” before such posts
No pupil at the school [where a rape took place] hanging here on Flashback? Come on, now!
Somebody here who’s done any suspicious observations on X street recently, primarily the . . .
restaurant and the tobacco store? [regarding a murder case]
Local talents [here on Flashback] should be able to tell what house it is [the crime scene], at
least when more pictures arrive?
Making the crime scene familiar is thus an interactional accomplishment. It is frequently
called for in the community so that even when it appears without being explicitly
requested it still feels expected, as if responding to a silent call. The rhetoric on display
is analogous to what Sacks (1998 : Vol. I, 36) terms a private calendar, where
world events can be located by reference to one’s own biography (e.g. “Kennedy was
assassinated two weeks after we got engaged”), but here it is also a matter of a private
map. The event is located with reference to one’s whereabouts, past or present, and this
contextualization is typically appreciated.
A similar meaning can be accomplished by invoking others whom the poster knows
well and efficiently communicating vicarious observations: “my colleague’s wife came
to the place by car, 1 minute after the shooting. . .,” she saw how the blood was starting
to spread on the [victims’] shirts, “according to my brother a guy ran away with a gun
visible in his hand.” “My colleague,” “my brother”—intimate and private knowledge is
thus conveyed with the help of relations, and the posters appear as quick to detect and
contextualize others’ important observations.
Still, the “I”—“I live. . .,” “I’ve been. . .,” “I grew up. . .”—is a fast lane to advanc-
ing analysis, and counts as stronger than vicarious views, such as in the post below. Here,
the poster objected to a previous commentator who suggested that the shooting could not
be about a conflict between criminal gangs, but a racist Swede, and did so by invoking a
general and yet personal place-experience:
Probably not [a racist Swede]. Many young criminals around 20 to 25 hang around at the
Internet cafés throughout Malmö, and spend their days on computer games. I have worked as a
receptionist at an IT café in Malmö myself, and the most shady types were regulars, when they
weren’t out in the streets and sold drugs or were occupied with gang-related activities, they
were at the café and played war games.
“I have worked as a receptionist at an IT café in Malmö myself”—thus, the posters
inscribe themselves and their work experience in the case to downplay other posts and
advance the discussion, in this instance indicating that Internet cafés in general indeed
are a place for ethnic minority criminals and that the shooting most likely does origi-
nate in such settings (and not among racist Swedes). Such posters may engage in a
stream of “I’ve seen these places myself” postings, personally vouching for a certain
Wästerfors et al. 11
When posters indicate a high degree of seriousness about personalizing angles, they
simultaneously indicate how others in the community are supposed to comport them-
selves in the presence of such indications: with approval and respect (cf. Collins, 2004:
17). To case-relate one’s own background is valued in this social world, and having
“been there” oneself ranks especially high.
Evidence as interaction
A step further in posters’ sleuthing ambitions, and sometimes embedded in the exchanges
described above, is to dress personal observations as directly relevant to, or even part of,
the crime drama:
I saw a black big car
I think I saw some guys from the old [faction of criminals] (. . .) earlier this night (. . .) just 50
I saw quite a lot of police cars coming from the north (. . .) so they seem to mobilize larger
forces in Malmö
Live there and heard the shots [goes on talking about “my assessment” of the probable weapon]
I live just at the corner and heard the shooting, I look down from the window and I see 6 to 7
people running from the place (not the Internet café but the pedestrian crossing next to it), in
panic, as it seemed. Then I heard somebody who seemed to feel a fucking pain, and animated
voices in Arabic
Here, posters portray themselves not only as competent to employ their personal knowl-
edge but also as providing data about the case, as empirical notetakers and witnesses join-
ing the collective interaction. They add to the case by attaching their “I” to noted facts
that, if correct, make their comments potentially much more significant than others’. The
occasional use of the historical present reinforces a dramatic feeling: “I look down. . .,”
“I see. . . .” Although the tone may be casual, these posts do not necessarily belong to the
“whatever” quality of the community that criminal reporters and other experts dismiss,
that is to say the “noise,” the “means of self-expression” (Wikhamn et al., 2019: 63; Nhan
et al., 2017: 346–347) and the abundance of seemingly nonsensical or random utterances.
Rather, they are getting closer to what might be defined as substantial, even in the eyes of
skeptical lurkers, and beginning to charge up their online investigation (cf. Collins, 2004:
84–85). Posters know that individual nicknames can be charged with significance through
the crime-solving effervescence of the online conversations to which they contribute.
Some posters go to the crime scene and report their observations to the community:
Been to the place today, and I take for granted that the shot was fired from a very close distance
(. . .) the car drove by just in front of the IT café. When the victims stepped out on the little
staircase, they were shot down. (. . .) The gunner must have sat in the backseat, leaned the gun
upwards through the open window at the back. [continues speculating]
12 new media & society 00(0)
This poster, though, meets with resistance. Others object to the idea that several cars
came behind the first one, or to details such as the direction in which the perpetrators
disappeared. Still, others come to the rescue: “Are you stupid, or what?” they ask the
objectors. The proposed route does make sense, they argue, though later a correction is
issued which confirms the objection. A given post is seldom guaranteed permanent value.
If it does not seem possible to define a claim as substantial or serious (as validated by
active posters further down the thread), the poster making that claim will have a hard
time achieving investigative authority. As posters interact with one another to settle
details, like the weapon used or the number of cars at the crime scene, they scrutinize
others’ posts and weigh their proposed evidence, making the detective performance far
from a smooth ride.
Still, the post quoted above is locally meaningful. It attracts an array of responses and
chains of meta-comments and contributes to energizing the debate as a whole. Simply by
encouraging rectifications (which typically quote some of the post and add some angry
lines) it may fuel the discussion. The very activity of assessing posts and categorizing
them into “good” or “bad,” “clever” or “stupid,” and so on belongs to the phenomenon
of online sleuthing, we argue, and as analysts, we benefit from studying rather than imi-
tating this activity (cf. Nhan et al., 2017: 346–347; Wikhamn et al., 2019: 63). To catego-
rize is what members themselves do in their ongoing constructions of meaning, and few
posters can count on undivided support.
Authority as interaction
The online setting is liable to rapid change. Posters can be generous with affirmation, but
they may also unsentimentally put down those they consider to be pretending to know
things. Let us take a look at the sequence of what eventually turned out to be a failed
detective performance in the thread about the shooting at the Internet café in Malmö.
One poster writes the following, about 90 minutes after the thread started (which was
directly after the first news report):
I can confirm that 3 are dead. fourth has 10% chance to survive.
Crisis meeting now between the authorities and the Police, the Security Police tonight. (friend
who works at the emergency unit) [implies the source of information]
This poster gets some supportive responses, such as queries about who the dead victims
are, and comments like:
Really serious. I hope this isn’t the start of a new wave of violence in Malmö.
Within 3 minutes, though, another poster quotes the report that “3 are dead,” but adds a
note of skepticism about the claim that the authorities are holding a crisis meeting:
Sounds unlikely that a person within health care [the alleged friend of the previous poster]
would have gotten knowledge about which authorities are involved in the investigation.
Wästerfors et al. 13
This takes the air out of the first quoted poster, although they return to the thread within
about 3 minutes and respond to the skeptical comment by once more referring to the
“friend” at the hospital:
I’m just telling what my friend said. There are police officers at the hospitals at these occasions
you know [implying that the police told the friend about the authorities involved]
Nonetheless, this poster does not succeed in maintaining authority. The responses fade,
others take the stage, and the fact that it “sounds unlikely” that “authorities” would
openly discuss crisis meetings with the security police so that a “friend” at the hospital
could hear about it undermines the poster’s attempt to sustain investigative authority.
In this case, the interactional support was too weak, a responding actor highlighted the
weakness in the post and no one (except the original poster him- or herself) rushed to
Another, more successful poster in the thread is a user we here call Elgangetty, even
though the support proved to be temporary here, too. Elgangetty starts to write things like
“now I got an SMS, also the other guy is dead,” and “also him driven privately to the
hospital,” implying that they have a personal channel to secret information. Elgangetty
goes on to post detailed descriptions of the victims, their names and backgrounds, and
how they are considered suspects by the police in previous investigations. Other posters
quote this, say “thank you,” and make comments like:
You seem to have a decent understanding of the situation, do you know the injury picture for
those injured . . .
Elgangetty also gets responses like:
awesome with an account [like that]. One can tell that you [Elgangetty] know what you’re
talking about in this case considering your previous posts
Elgangetty starts to emerge as insightful and their comments are reposted: “here is what
the writer ‘Elgangetty’ wrote, who has been very right during the whole event . . .”
Based on what we know from other threads, to be “right” about a case—even before it
has been resolved by a police investigation—and “to know what you’re talking about” is
a dream position in the community. Such responses single out the poster as a star and
communicate—sometimes only through quotations—that others ought to comport them-
selves respectfully in the presence of their posts. Effervescence (Collins, 2004: 35) is
created, and a feeling of progression. Elgangetty starts to add informed questions to the
thread, and evaluates others’ posts, taking on a position as master-detective who enjoys
the privilege of supervising and corroborating as well as finding faults: “everything said
here is correct. But . . .”
Soon, though, Elgangetty comes under attack. “Your info equals shit!!!” the poster
Ingfotady writes, arguing that Elgangetty falsely portrayed one of the victims as a “veg-
etable” because of his injuries:
14 new media & society 00(0)
what have you got that info from [about the injuries]? weird that you can watch a vegetable
[ironically said] walk around and feel almost perfectly alright at the funeral today! stop act [as
if you were] important!
Elgangetty’s status declines, and at one point they even get suspended by the moderator,
but still some posters defend previous posts, calling them partly correct and excusing
their misinformation. Subsequently, the excellence of other sleuths gains prominence.
They have a tone more clearly associated with the hoods in Malmö (close to the social
contexts in which journalists and the police place the shooting) and start to replace
In another thread, one of the prominent sleuths we interviewed experiences both ups
and downs under the alias Tionwho. Over time, he gains support from a team of posters
who join his efforts to question a certain image of the criminal event belonging to the
police. But an opposing team also takes shape in the thread, attacking Tionwho with
“hate . . . almost frightening,” as he described it in our interview. Tionwho devotes a lot
of time to the thread, especially while traveling for work (when he can concentrate bet-
ter), and eventually the intense emotions and hard work pile up:
Considering the hate and anger this thread has created I have decided to “retire” my nickname
(. . .) I won’t use the nick Tionwho in new threads. (. . .) To wrap up a thread like [the one under
discussion] will probably only be possible if one decides to stop responding, otherwise one is
pulled back in again.
Tionwho had been excelling as an analyst but now decides to back off. The interac-
tional constitution of online sleuthing is not only illustrated in the insights he presents
on wrapping up (to “stop responding” equals desisting interaction) but also in the idea
of “retirement.” The poster known as Tionwho analyzes how his alias has been molded
in long chains of digital encounters (cf. Collins, 2004: 5) and finds that it is less shin-
ing. By “retiring” the nickname he withdraws from the work of defending it, which
opens up new avenues. This poster has several aliases on the platform, under which he
engages in other crime threads and which receive less “hate and anger,” and he switches
to using those instead.
Some of the posters we interviewed not only accounted for their own alternative
aliases but also described ways that posters could be delegitimized by—allegedly—
disclosing their manipulations of identity. For instance, two seemingly different ali-
ases with similar phrasings might be looked upon as hiding one and the same poster.
Such observations were exchanged and acclaimed using the site’s personal messaging
In this article, we have explored the interactional origin of case-related familiarity, evi-
dence, and authority in today’s online gatherings around crime cases. We have shown
how posters try to make the crime scenes “their own” by situating themselves close to
them and start supplying evidence that allegedly might help solve the case. With the help
Wästerfors et al. 15
of data from our interviews with posters, we have shown field members’ interest in and
respect toward case-related familiarity, evidence, and authority, and with the help of
online data we have shown how these meanings are accomplished in recurring ways in
crime case discussions. As posters engage more and more, they expose their contribu-
tions to other posters, who respond with support or critique: these represent what we
have called the “bumpiness” of the paths. This is a risk-taking procedure since the post-
ers put themselves “out there” and take the chance of validation or rejection (Goffman,
1967). An individual post can be approved or disapproved by other posters, scorned or
ignored, and so on—and we, as ethnographers and interactionists, try to “move forward,”
as Collins (2004: 97) argues: “witnessing how the intensity and focus of the interaction
generates symbols [in our case: meaningful familiarity, evidence and authority] to be
used in subsequent interactions.”
Our study implies that online crime case discussions need not be analyzed regarding
their informative and penalizing functions alone but also as social worlds per se. They
belong to today’s true crime infotainment (Seltzer, 2007; Yardley et al., 2018) and they
are constituted by intense and sometimes thorny interactions. As online sleuths sculpt
breakthroughs and setbacks based on watching over others in society, they are also care-
fully watching over themselves and their ongoing digital exchanges (cf. Trottier, 2017:
67). Familiarity, evidence, and authority may, at first sight, look like individual accom-
plishments, but in fact they are interactional ones.
The main case discussed in this article—the drive-by shooting in Malmö in 2018—
undoubtedly limits our analysis. Other threads may, for instance, be characterized by
more clearly defined camps of posters, more durable sleuth identities, or an initial
consensus on who is guilty and who is the victim. Some posters never aspire to inves-
tigative authority and instead present a momentary commitment to accuracy. They may
comment just once or twice, correct a description, and then disappear (“I just wanted
to say this”). But when posters start contributing with their personal angles, making the
crime scene “their own” (e.g. with a private calendar or map) and supplying evidence
and hypotheses, they enroll in the locally accountable processes of crime case discus-
sions. With the support of other posters, they might come to shine as online sleuths in
the community’s shared reality (cf. Collins, 2004: 7). This fame can be quite provi-
sional—any attempt to assert oneself in relation to the case can be shot down—but
there are also ways to handle such setbacks by, for instance, joining a team, question-
ing objectors in turn, or shifting between aliases.
These processes cannot be understood, we argue, without an interactionist and ethno-
graphic approach. We have to acknowledge that meanings and identities are constructed
in interaction, and we have to closely follow how this is done, without a normative gaze.
We have learned that to understand this online setting, we cannot disregard posts to begin
with (e.g. by calling them “noise” or “irrelevant”). Field members are engaged in setting
aside posts themselves—and they account openly for their sorting—an act that belongs
to the setting. For this reason, we need a field-sensitive approach, not merely an evaluat-
ing or criminal justice-oriented one.
This means that our suggestion for wider research is to engage less with legal and
policing perspectives on online sleuthing, and more with ethnographic and interactionist
16 new media & society 00(0)
ones. These digital settings—whether Flashback, Reddit, 4chan, or other platforms—
have subtly composed chains of interactions that cannot be explored if they are reduced
to helpful or harmful contributions to the criminal justice system. They must be exam-
ined from a more fundamental and mundane point of view: as discursive online gather-
ings, granting fleeting identities as well as motivations in and through the never-ending
posting of messages.
We do not argue that posters engage in discussions on crime because they want to
shine as authoritative sleuths; rather, they become posters, and step by step, they become
a particular poster defending a particular nickname and committed to particular angles,
embedded in a reviewing and receptive collective. Indeed, the concept of self that we
find in Blumer’s 1986 , Mead’s (1967 ), and Collins’ (2004) works is utterly
social. Selves arise and are shaped within the plurality of responses in these online gath-
erings, within the conversation of digital gestures, and any motive and feature ascribed
to them do so, too. Investigative authority online is molded in the eyes of other posters
in a process overlapping with the platforms “lateral surveillance” (Trottier, 2017: 67). It
is joining this occasionally effervescent interaction around a case that is attractive, not
necessarily the product of that interaction.
The author(s) disclosed receipt of the following financial support for the research, authorship, and/
or publication of this article: The article belongs to the project Citizens as Crime Investigators.
Digital crowdsourcing in civil policing and intelligence work, funded by the Swedish Research
Council (Dnr 2018-01607).
David Wästerfors https://orcid.org/0000-0001-6271-5659
1. Besides Flashback, we also followed Facebook groups on crime in Sweden, as well as crime
podcasts, which were sometimes referred to on Flashback. Facebook is the dominant platform
in Sweden and is used by 76% of the population (Svenskarna och internet, 2018: 48).
2. Most of the interviews were conducted by the assistant Johanna Oellig.
Alasuutari P (1996) Researching Culture: Qualitative Method and Cultural Studies. London;
Thousand Oaks, CA; New Delhi, India: SAGE.
Blumer H (1986 ) Symbolic Interactionism: Perspective and Method. Berkeley, CA:
University of California Press.
Chang LYC and Poon R (2017) Internet vigilantism: attitudes and experiences of University stu-
dents toward cyber crowdsourcing in Hong Kong. International Journal of Offender Therapy
and Comparative Criminology 61(16): 1912–1932.
Chia SC (2019) Crowd-sourcing justice: tracking a decade’s news coverage of cyber vigilantism
throughout the Greater China region. Information, Communication & Society 22(14): 2045–
Collins R (2004) Interaction Ritual Chains. Princeton, NJ and Oxford: Princeton University Press.
Wästerfors et al. 17
Durkheim É (1995 ) Elementary Forms of Religious Life. New York: Free Press.
Emerson RM, Fretz RI and Shaw LL (1995) Writing Ethnographic Fieldnotes. Chicago, IL:
University of Chicago Press.
Goffman E (1967) Where the action is. In: Interaction Ritual: Essays on Face-to-Face Behavior.
New York: Pantheon Books, pp. 149–270.
Hannerz E, Burcar Alm V and Wästerfors D (2022) Accomplishing reality media: the affective
lure of online crime discussions. Cultural Sociology. Epub ahead of print 17 November. DOI:
Hine C (2019) Ethnography for the Internet: Embedded, Embodied and Everyday. London:
Huey L, Nhan J and Broll R (2012) “Uppity civilians” and ‘cyber-vigilantes’: the role of the gen-
eral public in policing cyber-crime. Criminology & Criminal Justice 13(1): 81–97.
Kasra M (2017) Vigilantism, public shaming, and social media hegemony: the role of digital-net-
worked images in humiliation and sociopolitical control. The Communication Review 20(3):
Loveluck B (2020) The many shades of digital vigilantism: a typology of online self-justice.
Global Crime 21(3–4): 213–241.
Maloney P (2013) Online networks and emotional energy. Information, Communication & Society
Mead GH (1967 ) Mind, Self, and Society from the Standpoint of a Social Behaviorist.
Chicago, IL: University of Chicago Press.
Myles D, Benoit-Barné C and Millerand F (2020) “Not your personal army!” Investigating
the organizing property of retributive vigilantism in a Reddit collective of websleuths.
Information, Communication & Society 23(3): 317–336.
Myles D, Millerand F and Benoit-Barné C (2016) Solving crimes online: the contributions of citi-
zens on the Reddit Bureau of Investigation. Réseaux 197–198(3): 173–202.
Nhan J, Huey L and Broll R (2017) Digilantism: an analysis of crowdsourcing and the Boston
Marathon Bombings. British Journal of Criminology 57(2): 341–361.
Palmkvist J (2020) Mordvågen startade med en kidnappning [The murder wave started with a
kidnapping]. Sydsvenskan [Swedish Daily], 5 July.
Pantumsinchai P (2018) Armchair detectives and the social construction of falsehoods: an actor-
network approach. Information, Communication & Society 21(5): 761–778.
Phillips W (2013) The house that fox built: anonymous, spectacle, and cycles of amplification.
Television New Media 14(6): 494–509.
Sacks H (1998 ) Lectures on Conversation, Volumes I and II. Oxford and Cambridge, MA:
Seltzer M (2007) True Crime: Observations on Violence and Modernity. New York:
Shaw E (2014) Philly hate crime suspects tracked down by anonymous Twitter Hero. Gawker.
Available at: https://gawker.com/philly-hate-crime-suspects-tracked-down-by-anonymous-
Silverman D (2007) A Very Short, Fairly Interesting and Reasonably Cheap Book about Qualitative
Research. London: SAGE.
Svenskarna och internet (2018) Stockholm: Internetstiftelsen. Available at: https://internetstif-
Trottier D (2014) Crowdsourcing CCTV surveillance on the Internet. Information, Communication
& Society 17(5): 609–626.
Trottier D (2017) Digital vigilantism as weaponisation of visibility. Philosophy & Technology
18 new media & society 00(0)
Wikhamn BR, Ljungberg J, Rolandsson B, et al. (2019) Given enough eyeballs, all crimes are
shallow—the organizing of citizen collaboration to solve an online detective story. Journal of
Technology Management & Innovation 14(2): 59–67.
Yardley E, Lynes AGT, Wilson D, et al. (2018) What’s the deal with ‘websleuthing’? News
media representations of amateur detectives in networked spaces. Crime Media Culture
David Wästerfors is professor of Sociology at the Department of Sociology, Lund University,
Sweden, and teaches in sociology and criminology. His research is often focused on interactions,
institutions, emotions, and social control. He has completed three research projects with ethno-
graphic data from Swedish detention homes (on conflicts, schooling, and violence) and recently
published the book Violence at Routledge (2022). A related interest is qualitative methodology,
shown in the book Analyze! Crafting Your Data in Qualitative Research, written with Jens
Rennstam and published in 2018.
Veronika Burcar Alm is associate professor of Sociology at the Department of Sociology, Lund
University, Sweden. Her research interests include youth, violence, and victimhood. Among her
recent publications are two anthology chapters (written in Swedish): ‘Young people’s vulnerabil-
ity to crime’ in The Swedish Juvenile Delinquency (eds F Estrada, J Flyghed and A Nilsson) and
‘Men’s experiences and coping with crime’, written together with Anna Rypi, in To Meet Abused
Men: Understandings, Assessments and Relief Efforts (eds M Skillmark and C Kullberg), both
published 2022 at Studentlitteratur.
Erik Hannerz is senior lecturer in Sociology at Lund University, Sweden and faculty fellow at the
Center for Cultural Sociology, Yale University. His research interests focus on subcultural theory,
cultural criminology, and urban ethnography. Among his recent publications: with S. Tutenges:
‘Negative chain referral sampling: Doing justice to subcultural diversity’ in Journal of Youth
Studies (2021) and with J. Kimvall: ‘Keeping it clean: Graffiti and the commodification of a moral
panic’ in Visual Inquiry (2020) 9(1–2): 79–92.