Tweeting Terror: An Analysis of the Norwegian Twitter-sphere during and in the Aftermath of the 22 July 2011 Terrorist Attack

Social Media Use in Crisis and Risk Communication

ISBN: 978-1-78756-272-1, eISBN: 978-1-78756-269-1

Publication date: 1 October 2018


This chapter analyses the Norwegian Twitter-sphere during and in the aftermath of the terrorist attack in Norway on 22 July 2011. Based on a collection of 2.2 million tweets representing the Twitter-sphere during the period 20 July–28 August 2011, the chapter seeks answers to how the micro-blogging services aided in creating situation awareness (SA) related to the emergency event, what role hashtags played in that process and who the dominant crisis communicators were. The chapter is framed by theories and previous research on SA and social media use in the context of emergency events. The findings reveal that Twitter was important in establishing SA both during and in the aftermath of the terrorist attack, that hashtags were of limited value in this process during the critical phase, and that unexpected actors became key communicators.



Steensen, S. (2018), "Tweeting Terror: An Analysis of the Norwegian Twitter-sphere during and in the Aftermath of the 22 July 2011 Terrorist Attack", Hornmoen, H. and Backholm, K. (Ed.) Social Media Use in Crisis and Risk Communication, Emerald Publishing Limited, pp. 15-41.

Download as .RIS



Emerald Publishing Limited

Copyright © Steen Steensen. Published by Emerald Publishing Limited


This article is published under the Creative Commons Attribution (CC BY 4.0) licence. Anyone may reproduce, distribute, translate and create derivative works of this article (for both commercial and non-commercial purposes), subject to full attribution to the original publication and authors. The full terms of this licence may be seen at


In recent years, social media have gained much attention in crisis communication research, thus paving the way for new, interdisciplinary fields of inquiry such as crisis informatics. Analysis of Twitter communication has been key to this development since the micro-blogging service has turned out to be particularly relevant for rapid information diffusion when major events break. The role and characteristics of Twitter communication in emergency situations such as natural disasters, public riots and terrorist attacks – and research on emotional resilience and questions of trust, accuracy and verification of Twitter communication in such cases – are growing fields within crisis informatics and related crisis communications fields (see Simon, Goldberg, & Adini, 2015 for an overview).

This chapter adds to the growing body of research by analysing how the Norwegian Twitter-sphere responded to the 22 July 2011 terrorist attack in Norway. On this day, the terrorist Anders Behring Breivik exploded a massive car bomb in Oslo’s government quarter before he started a massacre at the island of Utøya, where members of the Norwegian social democratic party’s youth organisation (AUF) were having their summer camp. The terrorist shot and killed 69 youngsters at Utøya, in addition to the eight he killed with the bomb.

From the time the Oslo bomb exploded at 15.25 to the news spreading that the perpetrator had been apprehended and identified, late in the evening the same day, the Norwegian Twitter-sphere was dominated by the horrific events. However, a comprehensive analysis of the Norwegian Twitter-sphere during and in the aftermath of the attack has never been undertaken. Such an analysis is important to understand exactly what role Twitter played during and after the crisis, who the dominant communicators were, and how SA and sense-making was negotiated and created on Twitter. It is also important to gain more knowledge about the role of social media in emergency situations to better prepare emergency officers, journalists, authorities and others on how to use social media as sources of information, how to monitor and participate in social media communication related to such events, and how to understand social media as channels for comprehending public reactions.

This chapter provides an analysis based on a collection of 2.2 million Norwegian tweets published between 20 July and 27 August 2011. The main question to be answered is: How did the Norwegian Twitter-sphere establish situation awareness during and in the aftermath of the terrorist attack on 22 July 2011 and who were the key communicators?

This question is partly answered by analysing the use and relevance of hashtags in the dataset. Much current research into crisis communication on Twitter is based on hashtag-specific samples, like tweets containing the hashtags #osloexpl and #utoya in the case of the 22 July 2011 attack. Such established hashtags provide an easy way of sampling tweets related to a specific topic. However, a problem with such a sampling strategy is that the relevance of hashtags is pre-supposed. Research approaches that only take into account tweets containing established hashtags are ‘unable to shed sufficient light on the early, formative stages of such crisis communication efforts on the platform’ (Bruns & Burgess, 2014, p. 382). Since the dataset to be analysed here contains all tweets, not only the ones that contain hashtags, a secondary aim is to determine the relevance of hashtags to Twitter communication when major and unexpected news events such as a terrorist attack occur.

The chapter starts with a discussion of SA related to emergency situations and social media, before looking at relevant research on social media and crisis communication. The methodology is then presented, before findings related to hashtags and key communicators are analysed and discussed.

Twitter and Situation Awareness of Crisis Events

A key communicative challenge during a crisis event is to achieve an adequate situation awareness for all parties: those affected, rescue institutions, police and other public and governmental bodies, and the public. Endsley (1995, p. 36) defines SA as ‘the perception of the elements in the environment within a volume of time and space, the comprehension of their meaning, and the projection of their status in the near future’. SA is, in other words, being aware of what is going on at a given time and in a given space, how to understand it, and how to act on that knowledge immediately and properly.

It is in complex and changing situations – like a sudden crisis – that SA becomes difficult to acquire. Achieving and maintaining SA is a process involving a lot of ‘situation assessment’ (Endsley, 1995, p. 36), and it is in this process of assessment that social media can be crucial during a crisis. The rapidly increasing popularity of social media in the twenty-first century has paved the way for what Bruns (2014, p. 351) calls a ‘new ecology of emergency media’, in which traditional mass media coexist with social media and messaging services, including SMS, in such a way that crisis communication (on a general level) cannot be effective unless it considers all these media. Furthermore, social media are important in how a crisis is interpreted, explained and understood by various groups of the public, and they can be vehicles for the formation of collective responses in the crisis aftermath (Kverndokk, 2013). In this respect, social media are tools for making sense of an emergency event (Heverin & Zach, 2012).

However, situation assessment, sense-making and achieving SA based on social media content might differ from how these processes function in traditional media. Social media to a much larger degree represent alternative framings and counter-discourses on how to assess and understand a crisis (Eriksson, 2016; Lindgren, 2011). Especially micro-blogging services such as Twitter have proven to be ‘privileged as platforms for backchannel activity’ (McNely, 2009, p. 297), in which the dominant discourses of mainstream media can be countered and sense-making negotiated.

Furthermore, when a major crisis such as a massive terrorist attack occurs, it is not obvious who the key communicators will be, or if indeed there will be any key communicators. Social media such as Twitter are dispersed networks with no predefined dominant actors and a ‘new logic of distribution’ (Klinger & Svensson, 2015, p. 1248) in which ordinary users are important actors in the dissemination of information. Previous research has shown that highly motivated individuals with no prior experience with mass communication can gain significant roles as ‘remote emergency operators’ (Starbird & Palen, 2011) and that ordinary people can be ‘crowdsourced to prominence’ (Meraz & Papacharissi, 2013) during a crisis. Social media like Twitter, therefore, have many similarities with discussion forums, which, according to Graham and Wright (2014), rely heavily on ‘superparticipants’ (both ‘superposters’ and ‘agenda setters’) to function well.

The Relevance of Hashtags

Hashtags are manually entered keywords with the prefix ‘#’ that draw on Twitter’s search functionality so that users can search and subscribe to tweets containing the same hashtag. They ‘enable users to communicate with an ad hoc community around the hashtag topic’ (Bruns & Burgess, 2012, p. 804). Hashtags are therefore a way of structuring communication that might aid in the acquisition of SA. For similar reasons, hashtags are popular as objects of research. They provide a relatively easy way of sampling tweets related to specific topics, and have proven vital in research, especially on how social media alter political communication, participation and political movements and uprisings (see for instance Boulianne, 2015 and Bruns, Enli, Skogerbo, Larsson, & Christensen, 2015).

Hashtags have also been useful in research on social media and emergency situations such as natural disasters (e.g. Bruns & Burgess, 2014; Bruns, Burgess, Crawford, & Shaw, 2012; Bruns & Liang, 2012) and of special interest here, terrorist attacks. Burnap et al. (2014) investigated Twitter communication related to the terrorist attack in Woolwich, London in 2013 and found that tweets related to the event by hashtags were more influential due to their discoverability. This finding is supported by previous non-terror-related research on the significance of hashtags (Petrovic, Osborne, & Lavrenko, 2011; Suh, Hong, Pirolli, & Chi, 2010), but is contested by Lee, Agrawal, and Rao (2015) who found that tweets related to the 2011 Boston marathon bombing that did not contain hashtags were more likely to get retweeted than tweets with hashtags. It is, in other words, disputed how important hashtags are to the formation of SA in an emergency situation.

Previous research has also provided insight into the kinds of hashtags that typically dominate the Twitter-sphere during an emergency event. Simon, Goldberg, Aharonson-Daniel, Leykin, and Adini (2014) investigated Twitter communication related to the Westgate mall terror attack in Kenya in 2013 and identified four categories of hashtags related to the event: (1) hashtags emphasising geographical locations (e.g. #WestGate, #WestGateMall, #Kenya, #Nairobi); (2) hashtags related to the attack (e.g. #WestGateAttack, #WestGateSiege, #WestGateMallAttack and #WestGateShootout); (3) hashtags showing social support, resilience and cohesiveness (e.g. #WeAreOne and #UnitedWeStand) and (4) hashtags identifying relevant organisations (e.g. #RedCross and #AlShabaab).

Hashtags have also been important to the few studies that have analysed Twitter communication related to the 22 July 2011 terrorist attack in Norway. Based on an analysis of a selection of tweets drawn from a hashtag-based sample, Eriksson (2016) identified four general event-related themes during the six days following the attack. The first theme concerned the Norwegian nation, the second concerned expressions of solidarity, the third was related to explanations of the attack and the fourth detailed the events of the attack. Perng et al. (2012) also analysed tweets based on hashtag searches in order to investigate the role of Twitter in mobilising resources during and after the terrorist attack. They found that the micro-blogging service enabled ‘collective awareness’ to arise from networked communication involving both peripheral and centrally located communicators.

Even though hashtags provide a fruitful way of sampling and analysing social media communication related to specific events, there are some problems with limiting a Twitter sample to only hashtagged tweets. First, not all tweets contain hashtags, so ignoring the ones without hashtags means ignoring an unknown, but possibly large part of the Twitter communication. Second, people might misspell a hashtag or use hashtags that are not the most commonly used, which in both cases might leave their tweets out of a hashtag-based sample. In an analysis of tweets related to natural disasters, Potts, Seitzinger, Jones, and Harrison (2011, p. 235) found that ‘hashtag usage was somewhat mired by inconsistent formats, spellings, and word ordering’. Third, when a sudden emergency occurs, such as a natural disaster or a terrorist attack, it might take time before the Twitter community agrees on which hashtags to use. And fourth, people experiencing an emergency event and wanting to alert or inform about it on Twitter do not necessarily have the time or capacity to think about which hashtag to use.

A contribution of the research presented here is therefore to look more closely at the significance of hashtags during and after a massive and complex emergency event such as the 22 July 2011 terrorist attack in Norway. Since the research to be presented is based on an analysis of almost all tweets sent from Norway during and after the event, the use of hashtags and their significance can be traced from the outbreak to the aftermath. This provides important insights into the significance of hashtags during emergencies.

About the Event

On Friday 22 July 2011 at 15.25 a massive car bomb exploded at the governmental quarter in the centre of Oslo. Eight people were killed in the blast, which left the nearby quarters looking like a war zone. The lone terrorist, Anders Behring Breivik – a 28-year-old right-wing extremist who wanted to attack the social democratic party, which he considered as traitors to Norway – then drove 40 km northwest of Oslo to the Tyrifjorden lake, where, dressed as a policeman, he arrived at the ferry landing Utøyakaia at 16.55. He was transported by the local ferry to the small island of Utøya, where the social democratic party’s youth organisation (AUF) held their traditional and yearly week-long summer camp. Five hundred and sixty-four people were on the island when Breivik arrived at 17.18. Four minutes later he started to shoot people. For more than an hour, he searched the island for people to kill, and managed to kill 69 youngsters and injure 33 before he was apprehended by the police at 18.34. Many youngsters fled the island by swimming away, while others hid as best they could.

At 19.30, the police confirmed that seven people had been killed by the bomb. At 21.30, the police reported 10 deaths on Utøya. At 22.45, the minister of Justice, Knut Storberget, confirmed that the apprehended terrorist was ethnically Norwegian. At 03.17 on 23 July, the police stated that the number of casualties at Utøya was far greater than previously assumed, and at 03.50 they stated that 80 people had been killed on Utøya. The correct number of causalities was not announced before Monday 25 July.


The data to be analysed here was drawn from a query run and purchased via Gnip, Twitter’s enterprise API platform. The query was built to get, as close as possible, all the tweets from Norway in the period 20 July to 28 August 2011 from Twitter’s Historical PowerTrack API. The query 1 resulted in a total of 2.2 million tweets, which were downloaded and imported into an SQL database for analysis. A total of 39,205 unique users are registered as active in the database, implying that they posted at least one tweet during the period (the Norwegian Twitter-sphere consisted of about 200,000 registered users in 2011 (Kverndokk, 2013, p. 172)). But the network reached far beyond that, as 1,363,241 Twitter user IDs are mentioned in the database.

For a number of reasons, the dataset is not a complete representation of the Norwegian Twitter-sphere during the selected period. The query was built as a Boolean expression combining operators such as ‘country_code’, ‘bio_location’ and ‘twitter_lang’ to select tweets only from the Norwegian Twitter-sphere. However, due to the limited capabilities of Twitter’s language detection tool in 2011 and the uncertainty as to whether Twitter users actually had posted information on their country in their bios or elsewhere when registering with the micro-blogging service, it is impossible to determine to what degree the dataset actually represents the whole Norwegian Twitter-sphere. A manual reading of a selection of approximately 60,000 tweets from the hours of the attack on 22 July 2011 revealed that some previously known tweets were missing from the sample, and that some non-Norwegian tweets were included. Nevertheless, the dataset represents a fairly accurate depiction of what went on in the Norwegian Twitter-sphere in the selected 40-day period, and it represents a solid foundation for analysing Twitter responses in Norway both during and in the aftermath of the attack.

For the purpose of this chapter, queries were run in the SQL database to detect the use of hashtags during the event and in the following weeks. Previous research has indicated that a sudden, breaking news event occupies the attention of the general public for approximately two weeks, which has proven to hold true also for the Twitter-sphere (Burnap et al., 2014). A 40-day period should therefore be more than sufficient to determine the life cycle of trending hashtags related to the terrorist attack. The aim of the hashtag analyses in this chapter is to pinpoint (1) the significance of hashtags for communication about the event on Twitter during the acute phase and (2) how hashtags shaped the conversation around the 22 July terrorist attack, and if and when other, non–terror-related conversations rose in popularity – which would then reveal how quickly the Twitter-sphere ‘normalised’. Together, these two aims provide insights into the formation of SA both during and in the aftermath of the emergency event and what role hashtags played in this formation.

The third aim of the chapter is to analyse who the dominant communicators were during and in the aftermath of the terrorist attack. I have therefore looked at (1) who posted most tweets; (2) who got most mentioned by others and (3) who got retweeted the most. The basic assumption behind this way of analysing the data is that if a person tweeted a lot, got a lot of mentions and/or was frequently retweeted, we can conclude that this person was a key communicator and dominant actor. Finally, the relationship between the most popular hashtag and key communicators is analysed.

Unfortunately, the dataset does not contain information on how many followers each account had or when accounts were created, thus making it impossible to analyse how and if the attack attracted new users to Twitter, the role of the number of followers and the significance of the duration of Twitter presence.


Previous pre-2011 research on Twitter use in large-scale emergencies (Starbird, Palen, Hughes, & Vieweg, 2010) has shown that Twitter activity rises significantly during emergencies. This was also the case in Norway on 22 July 2011, as the attack prompted a 200 per cent increase in number of tweets posted compared to the previous day (from 40,000 tweets posted on 21 July to 120,000 tweets posted on the day of the attack). However, it did not take more than two days before Twitter activity stabilised at a level of about 50,000 tweets posted per day, which still represents a 25 per cent increase compared to the days before 22 July.

The high increase in Twitter activity on 22 July suggest that the Twitter community in Norway was preoccupied with the event, and that Twitter was found to be a relevant medium for spreading news and talking about what had happened, especially during and immediately after the critical phase.

The Relevance of Hashtags on 22 July

On average, 22 per cent of the tweets in our dataset contained one or more hashtags. Figure 1 shows the 10 most popular hashtags during the period 20 July to 27 August 2011.

Figure 1: 
The 10 Most Used Hashtags on Twitter in Norway (20 July to 27 August 2011).

Figure 1:

The 10 Most Used Hashtags on Twitter in Norway (20 July to 27 August 2011).

The highest level of hashtag use was on 22 July, the day of the attack. Figure 2 displays the relative use of hashtags hour by hour on this day from 15.00. The bomb exploded at 15.25, but only 26 per cent of the tweets posted between 15.00 and 16.00 contained hashtags, while almost half (46 per cent) of the tweets posted between 17.00 and 18.00 contained one or more hashtags. By then it was clear that a massive bomb had exploded in Oslo. Similarly, by 23.00 it was clear that the terrorist had killed several youngsters at Utøya and that he had been apprehended.

Figure 2: 
Proportion of Tweets with Hashtags, 22 July 2011.

Figure 2:

Proportion of Tweets with Hashtags, 22 July 2011.

The numbers in Figure 2 suggest that the more that is known about an unsuspected, major breaking news event, the more likely it is that the Twitter community will use hashtags to talk about this event. It also suggests that it takes time for the Twitter community to turn its attention to the event. This is related to what Romero, Meeder, and Kleinberg (2011) refer to as ‘complex contagion dynamics’, which implies that people hold back from using hashtags until they see which hashtags are trending. We find support for this explanation in the actual Twitter communication, as people started to post instructions on which hashtags to use, like this tweet posted at 18.07: ‘Best hashtag for the covering from Oslo is #osloexpl Thats what the norvegians in Oslo uses’ (sic!).

During the first five minutes after the explosion, 95 tweets related to the blast were posted (25 per cent of all tweets posted during these minutes). Only 10 of these 95 tweets contained hashtags (9.5 per cent), and many of these hashtags were misleading in the sense that they placed the blast in a false location or assumed the blast was caused by thunder or an earthquake. Similarly, when news about the shootings at Utøya started to appear on Twitter, hashtags were of little use. The Utøya shootings started at 17.21 and the first tweet using an event-specific hashtag (#utøya) was posted at 17.52. By then, 78 tweets about the events on Utøya had been posted, only ten of them (13 per cent) containing hashtags. And these hashtags were not providing new information since they were all connected with the bomb blast in Oslo (#oslo, #prayforoslo, #osloexpl). 2

The Critical Phase: Breaking News and Prayers

A total of 216,331 tweets were posted in Norway on 22 and 23 July, according to our dataset. Of these, 37 per cent contained hashtags. A total of 4,703 different hashtags were used in these tweets in total 77,000 times. The average occurrence of a specific hashtag was, in other words, 16.

The top 10 hashtags used during 22 and 23 July 2011 occurred in total 48,570 times, thus representing more than 60 per cent of all hashtag use during this period. This suggests that the Norwegian Twitter community was largely part of the same, few dominant conversations held during these two days.

Most of these top 10 hashtags were English and thus directed at an international audience. The most frequently used hashtags during this period were #PrayforNorway (13.733 occurrences – 18 per cent of all hashtag use), #Utøya 3 (10,595 occurrences – 14 per cent) and #Oslo (9,702 occurrences – 12 per cent). In the initial phase of the attack, from when the bomb exploded at 15.25 to news starting to break about the shooting on Utøya after 17.40, the Twitter-sphere was dominated by Oslo-centred hashtags, such as #oslo, #osloexpl and #PrayforOslo. The #oslo hashtag was immediately established as important, while #osloexpl occurred for the first time at 16.01, 36 minutes after the explosion. At 18.00, the #Utøya hashtag started to trend, and the #PrayforNorway hashtag replaced #PrayforOslo as the most popular.

The #prayfor… hashtags connected the event to other, similar events internationally. #prayfor… hashtags were already, in 2011, established as a common way of expressing sympathy when terrible events struck, beginning with the #PrayforJapan hashtag after the Tohoku earthquake earlier the same year (Lin & Margolin, 2014). The #prayfor… hashtags are therefore a way of establishing the event as belonging to a specific genre, namely terrible breaking news events, which require a specific rhetorical response. Such genre affiliation thereby helps in acquiring SA, as it links the event to previous and similar events with known outcomes.

If we look at the tweets that did not contain hashtags (63 per cent of all tweets posted on these two days), we find that the majority of these are linked to the terrorist attack as well. The most common word in these tweets (disregarding prepositions) is ‘Oslo’, and the most common phrases that the word Oslo occurred in are ‘Oslo and Utøya’, ‘Oslo 7 killed short after shooting’, ‘Oslo and the massacre’, etc. 4

The Aftermath: Love and Justin Bieber

The first week after the critical phase, from Sunday 24 July to Friday 29 July, was marked by national displays of grief, shock and sorrow. The king, the prime minster and several others gave speeches in which they encouraged solidarity. On Monday 25 July, a peaceful rose parade was organised in Oslo, in which approximately 200,000 people participated. Similar commemorative ceremonies were arranged in other cities around the country as well.

According to our dataset, 326,683 tweets were published in Norway in this week; 12,888 hashtags were in use, occurring on average six times. The 10 most used hashtags during this period account for 25 per cent of all hashtag usage during the same period, thus representing a far smaller part of the Twitter-sphere than the top 10 hashtags during the 22 and 23 July period. This suggests that the Norwegian Twitter-sphere became much more fragmented as time passed by.

As in the first two days, most of the popular hashtags during the following week used English spelling. #Oslo was the most used hashtag (3,065 occurrences) in this period, followed by #PrayforNorway (3,061 occurrences) and #Utøya (3,059 occurrences) – each of them representing about 4 per cent of the total hashtag use. On Monday 25 July, the day of the commemorative ceremonies, the hashtag #oslove trended as the most popular, and two days later, the hashtag #showyourhearts trended as the most used hashtag, each of them representing an emotional, love-based response to the attack in line with the mainstream discourse in the Norwegian public sphere (Kverndokk, 2013).

By Friday 29 July, one week after the attack, it seems as if the Twitter-sphere was about to normalise, as the hashtags #ffnor and #ff dominated. These two hashtags were part of the Follow Friday routine, which was common in the Twitter-sphere at the time. Every Friday, Twitter users would use #ff hashtags followed by an array of user account mentions to indicate people worth following on Twitter. These hashtags were then used to generate lists of the most popular Twitter accounts every week.

The top 10 hashtags during the week 30 July–5 August account for only 11 per cent of the total hashtag use, a significant drop from the 25 per cent of the previous period and the 60 per cent during 22 and 23 July. The Twitter-sphere had in other words by now become even more fragmented, and the most popular hashtags had nothing to do with the terror attack, but with Justin Bieber (#BieberFact and #Someday – related to the perfume the pop idol launched in June 2011).

The Superposters

During the acute phase from 15.25 to 21.00 on 22 July 2011, 35,739 tweets (excluding retweets) were posted in Norway by 15,987 different user accounts, according to our dataset. More than half of these tweets (56 per cent) were posted by 5 per cent of the user accounts, suggesting that only a few per cent of active Twitter users during the acute phase used Twitter as their main channel of communication.

During the aftermath (from 21.00 22 July to midnight on 29 July), 339,904 tweets (excluding retweets) were posted by 21,343 different user accounts. The 5 per cent most active accounts accounted for 37 per cent of these tweets, suggesting that a larger part of the Norwegian Twitter-community used Twitter as a main channel of communication in the aftermath than during the acute phase.

Table 1 displays the ‘superposters’ (Graham & Wright, 2014) in terms of number of tweets posted during the critical hours and the week following the terror attack. These 10 most active Twitter posters account for 4.0 per cent of all tweets during the acute phase and 3.3 per cent during the whole period 22–29 July. This suggests that the Twitter communication was dispersed rather than centralised, but that there was a slightly higher degree of concentration around some dominant communicators during the acute phase than during the following week.

Table 1:

The 10 Most Active Twitter Accounts in Norway in Terms of Number of Tweets Posted (Excluding Retweets) During the Acute Phase of the Terrorist Attack 22 July 2011 (15.25–21.00) and in the Aftermath of the Attack, from 21.00 22 July to 00.00 29 July. (Usernames in italics are made anonymous.)

Top 10 Tweeters 22 July, 15.25–21.00 Top 10 Tweeters 22 July 21.00 to 29 July
Username Profile Tweets Username Profile Tweets
1 @Journalist1 Journalist 203 @YoungGirl8 Personal, Liam Payne fan 1768
2 @YoungGirl1 Personal 180 @YoungGirl1 Personal 1,430
3 @YoungGirl2 Personal 146 @YoungGirl9 Personal 1,321
4 @YoungGirl3 Personal 146 @YoungGirl2 Personal 1,288
5 @YoungGirl4 Personal, Justin Bieber fan 135 @YoungGirl4 Personal, Justin Bieber fan 1,155
6 @TWnorway Fan account 132 @Man1 Personal, Britney Spears fan 951
7 @Journalist2 Ex-journalist 126 @YoungBoy Personal 880
8 @YoungGirl5 Personal 122 @YoungGirl10 Personal, The Wanted fan 863
9 @YoungGirl6 Personal, Justin Bieber fan 119 @YoungGirl11 Personal 853
10 @YoungGirl7 Personal, Justin Bieber fan 114 @YoungGirl12 Personal, Justin Bieber fan 850

As Table 1 shows, many of the superposters both during the acute phase and in the aftermath, were young girls, many of whom showed some kind of affiliation with pop/fan culture in their Twitter profiles. Three of these young girls are on the top ten list in both periods. These girls’ Twitter activity seems not to have been directed towards a general public, but to their peers and fellow fans of Justin Bieber especially, but also Liam Payne, the boyband The Weekend and others. A closer look at their Twitter activity reveals that at least a couple of these girls probably were friends who tweeted a lot to and from each other and seem to have used Twitter as their primary channel of communication, as a messaging service.

However, the most active Twitter user in terms of number of original tweets posted during the acute phase, was a journalist. This journalist was not the typical breaking news journalist from one of the major news outlets. He was a young film critic with NRK P3, the Norwegian public broadcaster’s radio channel targeting teenagers and young adults. Still, this journalist was the only one among the top 10 tweeters in both periods who was close to being a public figure. He started tweeting about the terror attack at 15.28 – 3 minutes after the bomb blast, and was pivotal in establishing the #osloexpl hashtag as important, as he used this hashtag 169 times during the acute phase (15.25–21.00) and instructed others to use it. He clearly found hashtags important, as 76 per cent of all his tweets during the acute phase contained one or more hashtags.

The Most Mentioned Twitter Users

Table 2 displays the Twitter accounts that were most mentioned by others during both the critical phase and the whole week. All in all, 52,779 user names were mentioned during the whole week, with an average of 4.7 mentions per user name. During the acute phase, 8,497 user names were mentioned on an average of 2.6 mentions per user name.

Table 2:

The 10 Most Mentioned Twitter Accounts in Norway during the Acute Phase of the Terrorist Attack 22 July 2011 (15.25–21.00) and in the Aftermath of the Attack, from 21.00 22 July to Midnight 29 July. (Usernames in italics are, made anonymous.)

10 Most Mentioned Accounts 22 July 15.25–21.00 10 Most Mentioned Accounts 22 July, 21.00 to 29 July
Username Profile Mentions Username Profile Mentions
1 @justinbieber Pop idol 609 @justinbieber Pop idol 10,398
2 @jensstoltenberg Prime minister of Norway 202 @jensstoltenberg Prime minister of Norway 2,280
3 @Victim1 Utøya victim 200 @youtube Service 1,543
4 @selenagomez Pop idol 194 @selenagomez Pop idol 693
5 @Politician1 Regional politician (AP) 167 @Real_Liam_Payne Pop idol 604
6 @miffno Pro-Israel activist 103 @Victim2 Utøya victim 556
7 @YoungGirl13 Personal 71 @YoungGirl2 Personal 542
8 @Journalist1 Journalist 70 @YoungGirl13 Personal 510
9 @YoungGirl14 Personal 67 @AddThis Service 494
10 @YouTuber1 Swedish YouTuber 67 @YoungBoy2 Personal 491

The top mentions list is more diverse than the top tweeters list in Table 1, as we here find pop stars (Justin Bieber and his girlfriend Selena Gomez, who celebrated her birthday on 22 July), politicians (including the prime minister Jens Stoltenberg), journalists (the same journalist who was the top tweeter in Table 1), young girls, services (like YouTube and Addthis), activists and victims of the terror attack.

The 10 most mentioned user names account for 8 per cent of all mentions during the acute phase and 7 per cent of all mentions during the whole week. Justin Bieber’s official account, @justinbieber, is by far the most mentioned in both periods, with three times as many mentions than number two on the list (Prime Minister Jens Stoltenberg) during the acute phase and with more mentions than the nine next on the list taken together during the whole week. Mentions of @justinbieber account for 7 per cent of all mentions during the acute phase, and 4 per cent of all mentions during the whole week. The Norwegian Twitter-sphere had in other words a tendency to seek attention from Justin Bieber, and more so during the acute phase than later on.

Tweets mentioning @justinbieber are quite often combined with the hashtag #prayfornorway, especially in the early period. During 22 and 23 July, 43 per cent (1,706 tweets) of all tweets mentioning Justin Bieber included the #prayfornorway hashtag, making this the most common combination of a hashtag and an account mention in our dataset. This implies that a main reason for mentioning Justin Bieber was to reach out to him in order to make him become engaged with what was going on in Norway.

The Most Retweeted Accounts

Retweets accounted for 36 per cent of all tweets posted during the acute phase, decreasing to 26 per cent during the first week after the attack.

Table 3 displays the Twitter accounts that were retweeted most during the acute phase and the following week. The list is dominated by American pop stars and celebrities (Justin Bieber, Chris Medina, Katy Perry, Taylor Swift and Sophia Bush) who all tweeted their sympathies with what had happened in Norway. The journalist who was a top tweeter (@Journalist1 – see Table 1), one other journalist and a news service (@BBCBreaking) are also present on the list in Table 3, as are the prime minister, the politician that got a lot of mentions (@Politician1 – see Table 2) and one of the young girls who also tweeted a lot (@YoungGirl4 – see Table 1).

Table 3:

The 10 Most Retweeted Twitter Accounts in Norway in Terms of Number of Total Number of Retweets during the Acute Phase of the Terrorist Attack 22 July 2011 (15.25–21.00) and in the Aftermath of the Attack, from 21.00 22 July to 00.00 29 July. (Usernames in italics are made anonymous.)

10 Most Retweeted Accounts 22 July, 15.25–21.00 10 Most Retweeted Accounts 22 July, 21.00 to 29 July
Username Profile Retweets Username Profile Retweets
1 @OfficialMedina Pop idol 355 @justinbieber Pop idol 4,211
2 @Politician1 Regional politician (AP) 332 @jensstoltenberg Prime minister of Norway 1,142
3 @Journalist3 Local radio journalist 329 @Oslounivsykehus Oslo University Hospital 607
4 @ Journalist1 Journalist at NRK P3 273 @Journalist3 Local radio journalist 589
5 @YoungGirl4 Personal, Justin Bieber-fan 216 @katyperry Pop idol 559
6 @SophiaBush Actress 188 @celebrity1 Norwegian celebrity 509
7 @BBCBreaking News service 188 @Author1 Norwegian author and publisher 482
8 @Oslounivsykehus Oslo University Hospital 182 @taylorswift13 Pop idol 477
9 @jensstoltenberg Prime minister of Norway 156 @Woman1 Personal 428
10 @Author1 Norwegian author and publisher 150 @KennyHamilton Actor and producer 421

The Twitter account of Oslo University hospital (@Oslounivsykehus) is the fourth most retweeted account during the whole week and the only public body among the most retweeted accounts. The activity of this Twitter account was related to the hospital bloodbank’s efforts to secure enough blood to save all the injured (see Chapter 3 in this volume, for an analysis of this activity).

Findings Summarised

The findings presented earlier can be summarised in the following points:

  • The terrorist attack more than doubled the activity in the Norwegian Twitter-sphere during the day of the attack and was kept at a higher level than previous days during the following week.

  • Hashtags were important in framing conversations and for the dissemination of news about the terrorist attack, as more tweets contained hashtags on 22 July than the following days. But hashtags were not relevant and were even misleading during the first few minutes after the attack; it took more than 30 minutes from when the bomb struck in Oslo until a relevant and much-used hashtag (#osloexlp) was established.

  • The Norwegian Twitter-sphere was concentrated on a few hashtag-based conversations related to the event during 22 and 23 July, but became much more fragmented during the following week (23–29 July).

  • The attack was almost immediately framed as an international event, with English being the preferred language for the most popular hashtags, and through the use of generic hashtags like #prayforNorway.

  • In terms of dominant users, the Norwegian Twitter-sphere was decentralised rather than concentrated around a few key communicators. None of the top 10 superposters were previously established as highly public figures. However, there was a higher concentration around the top 10 communicators and a higher degree of retweeting activity during the acute phase than the following week.

  • The Norwegian Twitter-sphere was, both during the critical phase and the following week, dominated by young girls craving the attention of international pop idols like Justin Bieber.


The research question guiding this chapter was How did the Norwegian Twitter-sphere establish situation awareness during and in the aftermath of the terrorist attack on 22 July 2011 and who were the key communicators?

The findings show that Twitter was important to the sense-making process of what we might call long-term SA. First, the quickly established international orientation of the Norwegian Twitter community framed the crisis as one of international proportions. The dominant hasthtags were written in English (‘expl’ instead of the Norwegian spelling ‘ekspl’, ‘prayfor’, etc.) and the #prayforOslo/#prayforNorway hashtags generically framed the event as a catastrophe similar to the tsunami in Japan earlier the same year.

Second, reactions on Twitter were dominated by passive emotions of care and love rather than active displays of anger and calls for an uprising. Two out the four categories of hashtags that Simon et al. (2014) found to dominate the Twitter-sphere after the Westgate mall terrorist attack in Kenya dominated the Norwegian Twitter-sphere on and in the aftermath of the 22 July 2011 attack: hashtags oriented towards geographical location (#Oslo, #Utøya) and hashtags showing social support, resilience and cohesiveness (#prayfornorway, #showyourhearts and #oslove). The dominance of this second group of hashtags created a long-term SA in which the terrorist attack was understood as something that would strengthen the bond between, and community feeling among, Norwegians.

This discourse of resilience, cohesiveness and love established a ‘proper’ way of understanding and reacting to the terrible event and went hand-in-hand with the dominant discourse found in the mainstream media (Kverndokk, 2013). In her hashtag specific analysis of the Twitter-sphere during the six days following the 22 July 2011 attack, Eriksson (2016) found that Twitter served as a backchannel for discourses countering the discourses of the mainstream media. These counter-discourses focused on ‘vocabularies used to explain the attacks as well as the sensationalisation of the event’ (Eriksson, 2016, p. 13). They were undoubtedly present in the Twitter-sphere, but they were by no means dominant. As the findings of this study show, Twitter was primarily a platform where mainstream discourses were formulated and reinforced.

This study also shows that hashtags are not immediately relevant for Twitter-communication when a major emergency event breaks. Future research should take this into consideration and try to sample social media data not based on hashtag searches. Hashtags were, however, important in creating SA once information about what had happened became known. Hashtags therefore functioned as a way of structuring communication and making the Twitter-sphere more united in the processes of making sense of the event.

Furthermore, the Norwegian Twitter-sphere was not centralised around a few key communicators during and after the 22 July 2011 terrorist attack, and those who were the most active in terms of numbers of tweets and retweets posted, were unexpected actors such as a young film critic journalist and a local politician, thus confirming previous research on the importance of crowdsourcing and amateurs in Twitter communication related to sudden crisis situations (Meraz & Papacharissi, 2013; Starbird & Palen, 2011). A striking feature of the findings presented here is the absence of the police, fire department and other public and governmental bodies among key communicators. In Chapter 3, Ottosen and Steensen analyse how authorities responded to the attack on social media. They found that there was a lack of coordination of communication, and that the few efforts that were made were dependent on individual initiatives.

Another striking feature of the Norwegian Twitter-sphere during and after the attack is the general dominance of fan culture and celebrities like Justin Bieber, and especially young girls’ need to get their idols to care about what happened in Norway. Becoming a key communicator during a crisis event is difficult without a previously established network of followers. Celebrities and others with many followers tend to play important roles during a crisis ‘by lending their follower base to the amplification of news and information about the crisis event’ (Bruns & Burgess, 2014, p. 378). Celebrities like Justin Bieber were important in attracting international attention to the terrorist attack, perhaps even more so than during previous crises (such as the 2011 Queensland and Christchurch earthquake analysed by Bruns & Burgess, 2014) because the terrorist attacked teenagers.

This link between fan culture and crisis communication should be treated with importance in future research into social media and crisis communication. Authorities, NGOs, journalists and others have something to learn on how to create strong bonds with the public in social media – bonds that will be important when a major crisis breaks.



The query was made up of the following Boolean expression: ‘country_code:no OR twitter_lang:no OR bio_location:norway OR bio_location:norge OR bio_lang:no OR bio_location_contains:norway OR bio_location_contains:norge’.


The findings in this section are based on a manual reading of the tweets.


The number here represents the sum of both the Norwegian (#Utøya) and the English version (#Utoya) of the hashtag.


The open source and web-based automated textual analysis tool Voyant tool (available at, developed at the University of Alberta, was used to perform the lightweight textual analysis presented in this paragraph.


Boulianne (2015) Boulianne, S. (2015). Social media use and participation: A meta-analysis of current research. Information, Communication & Society, 18(5), 524538. doi:10.1080/1369118X.2015.1008542

Bruns (2014) Bruns, A. (2014). Crisis communication. In S. Cunningham & S. Turnbull (Eds.), The media and communications in Australia (pp. 351355). Sydney: Allen & Unwin. Retrieved from

Bruns & Burgess (2012) Bruns, A. , & Burgess, J. (2012). Researching news discussion on Twitter. Journalism Studies, 13(5–6), 801814. doi:10.1080/1461670X.2012.664428

Bruns & Burgess (2014) Bruns, A. , & Burgess, J. (2014). Crisis communication in natural disasters: The Queensland floods and Christchurch earthquakes. In K. Weller , A. Bruns , J. Burgess , M. Mahrt , & C. Puschmann (Eds.), Twitter and society (pp. 373384). New York, NY: Peter Lang.

Bruns, Burgess, Crawford, & Shaw (2012) Bruns, A. , Burgess, J. E. , Crawford, K. , & Shaw, F. (2012). # qldfloods and@ QPSMedia: Crisis communication on Twitter in the 2011 south east Queensland floods. Brisbane, QLD, Australia: ARC Centre of Excellence for Creative Industries and Innovation, Queensland University of Technology. Retrieved from

Bruns, Enli, Skogerbo, Larsson, & Christensen (2015) Bruns, A. , Enli, G. , Skogerbo, E. , Larsson, A. O. , & Christensen, C. (Eds.). (2015). The Routledge companion to social media and politics. New York, NY & Abingdon, Oxon: Routledge.

Bruns & Liang (2012) Bruns, A. , & Liang, Y. E. (2012). Tools and methods for capturing Twitter data during natural disasters. First Monday, 17(4). Retrieved from

Burnap et al. (2014) Burnap, P. , Williams, M. L. , Sloan, L. , Rana, O. , Housley, W. , Edwards, A. Voss, A. (2014). Tweeting the terror: Modelling the social media reaction to the Woolwich terrorist attack. Social Network Analysis and Mining, 4(1), 114. doi:10.1007/s13278-014-0206-4

Endsley (1995) Endsley, M. R. (1995). Toward a theory of situation awareness in dynamic systems. Human Factors: The Journal of the Human Factors and Ergonomics Society, 37(1), 3264. doi:10.1518/001872095779049543

Eriksson (2016) Eriksson, M. (2016). Managing collective trauma on social media: The role of Twitter after the 2011 Norway attacks. Media, Culture & Society, 38(3), 365380. doi:10.1177/0163443715608259

Graham & Wright (2014) Graham, T. , & Wright, S. (2014). Discursive equality and everyday talk online: The impact of “superparticipants”. Journal of Computer-Mediated Communication, 19(3), 625642. doi:10.1111/jcc4.12016

Heverin & Zach (2012) Heverin, T. , & Zach, L. (2012). Use of microblogging for collective sense-making during violent crises: A study of three campus shootings. Journal of the American Society for Information Science and Technology, 63(1), 3447. doi:10.1002/asi.21685

Klinger & Svensson (2015) Klinger, U. , & Svensson, J. (2015). The emergence of network media logic in political communication: A theoretical approach. New Media & Society, 17(8), 12411257. doi:10.1177/1461444814522952

Kverndokk (2013) Kverndokk, K. (2013). Et nettverk av sorg. Sosiale medier og minnekultur etter 22. juli [A network of grief. Social media and memory culture after 22 July]. In P. K. Botvar , I. M. Høeg , & O. Aagedal (Eds.), Den offentlige sorgen. Markeringer, ritualer og religion etter 22. juli (pp. 169189). Oslo: Universitetsforlaget.

Lee, Agrawal, & Rao (2015) Lee, J. , Agrawal, M. , & Rao, H. R. (2015). Message diffusion through social network service: The case of rumor and non-rumor related tweets during Boston bombing 2013. Information Systems Frontiers, 17(5), 9971005.

Lin & Margolin (2014) Lin, Y.-R. , & Margolin, D. (2014). The ripple of fear, sympathy and solidarity during the Boston bombings. EPJ Data Science, 3(1). doi:10.1140/epjds/s13688-014-0031-z

Lindgren (2011) Lindgren, S. (2011). YouTube gunmen? Mapping participatory media discourse on school shooting videos. Media, Culture & Society, 33(1), 123136. doi:10.1177/0163443710386527

McNely (2009) McNely, B. (2009). Backchannel persistence and collaborative meaning-making. In Proceedings of the 27th ACM international conference on design of communication, New York, NY: ACM (pp. 297–304) doi:10.1145/1621995.1622053.

Meraz & Papacharissi (2013) Meraz, S. , & Papacharissi, Z. (2013). Networked gatekeeping and networked framing on #Egypt. The International Journal of Press/Politics, 18(2), 138166. doi:10.1177/1940161212474472

Perng et al. (2012) Perng, S.-Y. , Buscher, M. , Halvorsrud, R. , Wood, L. , Stiso, M. , Ramirez, L. , & Al-Akkad, A. (2012). Peripheral response: Microblogging during the 22/7/2011 Norway attacks. In J. Rothkrantz, J. Ristvei, & Z. Franco (Eds.), Proceedings of the 9th international ISCRAM conference, Vancouver, Canada, 22–25 April.

Petrovic, Osborne, & Lavrenko (2011) Petrovic, S. , Osborne, M. , & Lavrenko, V. (2011). RT to win! Predicting message propagation in Twitter. In Proceedings of the 5th international AAAI conference on weblogs and social media, Barcelona, Catalonia, Spain, July 17–21, 2011, Menlo Park, CA: The AAAI Press (pp. 586–589).

Potts, Seitzinger, Jones, & Harrison (2011) Potts, L. , Seitzinger, J. , Jones, D. , & Harrison, A. (2011). Tweeting disaster: Hashtag constructions and collisions. In Proceedings of the 29th ACM international conference on design of communication, Pisa, Italy, October 3–5. New York, NY: ACM (pp. 235–240). doi:10.1145/2038476.2038522

Romero, Meeder, & Kleinberg (2011) Romero, D. M. , Meeder, B. , & Kleinberg, J. (2011). Differences in the mechanics of information diffusion across topics: Idioms, political hashtags, and complex contagion on Twitter. In Proceedings of the 20th international conference on world wide web, Hydrabad, India, March 28–April 1. New York, NY: ACM (pp. 695704). doi:10.1145/1963405.1963503

Simon, Goldberg, & Adini (2015) Simon, T. , Goldberg, A. , & Adini, B. (2015). Socializing in emergencies—A review of the use of social media in emergency situations. International Journal of Information Management, 35(5), 609619. doi:10.1016/j.ijinfomgt.2015.07.001

Simon, Goldberg, Aharonson-Daniel, Leykin, & Adini (2014) Simon, T. , Goldberg, A. , Aharonson-Daniel, L. , Leykin, D. , & Adini, B. (2014). Twitter in the cross fire—The use of social media in the westgate mall terror attack in Kenya. PLOS ONE, 9(8), e104136. doi:10.1371/journal.pone.0104136

Starbird & Palen (2011) Starbird, K. , & Palen, L. (2011). Voluntweeters: Self-organizing by digital volunteers in times of crisis. In Proceedings of the SIGCHI conference on human factors in computing systems, Vancouver, BC, Canada, May 7–12. New York, NY: ACM Press, (pp. 1071–1080). doi:10.1145/1978942.1979102

Starbird, Palen, Hughes, & Vieweg (2010) Starbird, K. , Palen, L. , Hughes, A. L. , & Vieweg, S. (2010). Chatter on the red: What hazards threat reveals about the social life of microblogged information. In Proceedings of the 2010 ACM conference on computer supported cooperative work, Savannah, GA, USA, February 6–10. New York, NY: ACM Press (pp. 241–250). doi: 10.1145/1963405.1963503

Suh, Hong, Pirolli, & Chi (2010) Suh, B. , Hong, L. , Pirolli, P. , & Chi, E. H. (2010). Want to be retweeted? Large scale analytics on factors impacting retweet in Twitter network. In 2010 IEEE second international conference on social computing, Minneapolis, MN, USA, August 20–22. (pp. 177–184). doi:10.1109/SocialCom.2010.33


The Research Council of Norway (Grant No. 233975/H20) and Oslo Metropolitan University have funded this research, for which we are grateful.

Social Media Use in Crises and Risks: An Introduction to the Collection
Part 1 Using Social Media in Risks and Crises
Chapter 1 Tweeting Terror: An Analysis of the Norwegian Twitter-sphere during and in the Aftermath of the 22 July 2011 Terrorist Attack
Chapter 2 Victims’ Use of Social Media during and after the Utøya Terror Attack: Fear, Resilience, Sorrow and Solidarity
Chapter 3 Blood and Security during the Norway Attacks: Authorities’ Twitter Activity and Silence
Chapter 4 Social Media in Management of the Terror Crisis in Norway: Experiences and Lessons Learned
Chapter 5 News Workers’ Reflections on Digital Technology and Social Media after a Terror Event
Chapter 6 Old Wine in New Bottles? Use of Twitter by Established UK News Media during the 2014–15 West African Ebola Outbreak
Chapter 7 Flows of Water and Information: Reconstructing Online Communication During the 2013 European Floods in Austria
Part 2 Developing a Tool for Crisis Communicators
Chapter 8 Tailoring Tools to the Rescue: Lessons Learned from Developing a Social Media Information Gathering Tool
Chapter 9 What Eye Movements and Facial Expressions Tell Us about User-Friendliness: Testing a Tool for Communicators and Journalists
Part 3 Recommendations for Social Media Use in Risks and Crises
Chapter 10 ‘When the Levee Breaks’: Recommendations for Social Media Use During Environmental Disasters
Chapter 11 Social Media Communication During Disease Outbreaks: Findings and Recommendations
Chapter 12 Social Media and Situation Awareness during Terrorist Attacks: Recommendations for Crisis Communication