TWEETING TERROR: AN ANALYSIS OF THE NORWEGIAN TWITTER-SPHERE DURING AND IN THE AFTERMATH OF THE 22 JULY 2011 TERRORIST ATTACK

This chapter analyses the Norwegian Twitter-sphere during and in the aftermath of the terrorist attack in Norway on 22 July 2011. Based on a collection of 2.2 million tweets representing the Twitter-sphere during the period 20 July (cid:1) 28 August 2011, the chapter seeks answers to how the micro-blogging services aided in creating situation awareness (SA) related to the emergency event, what role hashtags played in that process and who the dominant crisis communicators were. The chapter is framed by theories and previous Steensen. research on SA and social media use in the context of emergency events. The ﬁ ndings reveal that Twitter was important in establishing SA both during and in the aftermath of the terrorist attack, that hashtags were of limited value in this process during the critical phase, and that unexpected actors became key communicators.


INTRODUCTION
In recent years, social media have gained much attention in crisis communication research, thus paving the way for new, interdisciplinary fields of inquiry such as crisis informatics. Analysis of Twitter communication has been key to this development since the micro-blogging service has turned out to be particularly relevant for rapid information diffusion when major events break. The role and characteristics of Twitter communication in emergency situations such as natural disasters, public riots and terrorist attacks À and research on emotional resilience and questions of trust, accuracy and verification of Twitter communication in such cases À are growing fields within crisis informatics and related crisis communications fields (see Simon, Goldberg, & Adini, 2015 for an overview).
This chapter adds to the growing body of research by analysing how the Norwegian Twitter-sphere responded to the 22 July 2011 terrorist attack in Norway. On this day, the terrorist Anders Behring Breivik exploded a massive car bomb in Oslo's government quarter before he started a massacre at the island of Utøya, where members of the Norwegian social democratic party's youth organisation (AUF) were having their summer camp. The terrorist shot and killed 69 youngsters at Utøya, in addition to the eight he killed with the bomb.
From the time the Oslo bomb exploded at 15.25 to the news spreading that the perpetrator had been apprehended and identified, late in the evening the same day, the Norwegian Twitter-sphere was dominated by the horrific events. However, a comprehensive analysis of the Norwegian Twitter-sphere during and in the aftermath of the attack has never been undertaken. Such an analysis is important to understand exactly what role Twitter played during and after the crisis, who the dominant communicators were, and how SA and sense-making was negotiated and created on Twitter. It is also important to gain more knowledge about the role of social media in emergency situations to better prepare emergency officers, journalists, authorities and others on how to use social media as sources of information, how to monitor and participate in social media communication related to such events, and how to understand social media as channels for comprehending public reactions. Such established hashtags provide an easy way of sampling tweets related to a specific topic. However, a problem with such a sampling strategy is that the relevance of hashtags is pre-supposed. Research approaches that only take into account tweets containing established hashtags are 'unable to shed sufficient light on the early, formative stages of such crisis communication efforts on the platform' (Bruns & Burgess, 2014, p. 382). Since the dataset to be analysed here contains all tweets, not only the ones that contain hashtags, a secondary aim is to determine the relevance of hashtags to Twitter communication when major and unexpected news events such as a terrorist attack occur.
The chapter starts with a discussion of SA related to emergency situations and social media, before looking at relevant research on social media and crisis communication. The methodology is then presented, before findings related to hashtags and key communicators are analysed and discussed.

TWITTER AND SITUATION AWARENESS OF CRISIS EVENTS
A key communicative challenge during a crisis event is to achieve an adequate situation awareness for all parties: those affected, rescue 17 Tweeting Terror: An Analysis of the Norwegian Twitter-sphere institutions, police and other public and governmental bodies, and the public. Endsley (1995, p. 36) defines SA as 'the perception of the elements in the environment within a volume of time and space, the comprehension of their meaning, and the projection of their status in the near future'. SA is, in other words, being aware of what is going on at a given time and in a given space, how to understand it, and how to act on that knowledge immediately and properly.
It is in complex and changing situations À like a sudden crisis À that SA becomes difficult to acquire. Achieving and maintaining SA is a process involving a lot of 'situation assessment' (Endsley, 1995, p. 36), and it is in this process of assessment that social media can be crucial during a crisis.
The rapidly increasing popularity of social media in the twenty-first century has paved the way for what Bruns (2014, p. 351) calls a 'new ecology of emergency media', in which traditional mass media coexist with social media and messaging services, including SMS, in such a way that crisis communication (on a general level) cannot be effective unless it considers all these media. Furthermore, social media are important in how a crisis is interpreted, explained and understood by various groups of the public, and they can be vehicles for the formation of collective responses in the crisis aftermath (Kverndokk, 2013). In this respect, social media are tools for making sense of an emergency event (Heverin & Zach, 2012).
However, situation assessment, sense-making and achieving SA based on social media content might differ from how these processes function in traditional media. Social media to a much larger degree represent alternative framings and counter-discourses on how to assess and understand a crisis (Eriksson, 2016;Lindgren, 2011). Especially micro-blogging services such as Twitter have proven to be 'privileged as platforms for backchannel activity' (McNely, 2009, p. 297), in which the dominant discourses of mainstream media can be countered and sense-making negotiated. Furthermore, when a major crisis such as a massive terrorist attack occurs, it is not obvious who the key communicators will be, or if indeed there will be any key communicators. Social media such as Twitter are dispersed networks with no predefined dominant actors and a 'new logic of distribution' (Klinger & Svensson, 2015, p. 1248 in which ordinary users are important actors in the dissemination of information. Previous research has shown that highly motivated individuals with no prior experience with mass communication can gain significant roles as

THE RELEVANCE OF HASHTAGS
Hashtags are manually entered keywords with the prefix '#' that draw on Twitter's search functionality so that users can search and subscribe to tweets containing the same hashtag. They 'enable users to communicate with an ad hoc community around the hashtag topic' (Bruns & Burgess, 2012, p. 804  Even though hashtags provide a fruitful way of sampling and analysing social media communication related to specific events, there are some problems with limiting a Twitter sample to only hashtagged tweets. First, not all tweets contain hashtags, so ignoring the ones without hashtags means ignoring an unknown, but possibly large part of the Twitter communication. Second, people might misspell a hashtag or use hashtags that are not the most commonly used, which in both cases might leave their tweets out of a hashtag-based sample. In an analysis of tweets related to natural disasters, Potts, Seitzinger, Jones, and Harrison (2011, p. 235) found that 'hashtag usage was somewhat mired by inconsistent formats, spellings, and word ordering'. Third, when a sudden emergency occurs, such as a natural disaster or a terrorist attack, it might take time before the Twitter community agrees on which hashtags to use. And fourth, people experiencing an emergency event and wanting to alert or inform about it on Twitter do not necessarily have the time or capacity to think about which hashtag to use.

20
Steen Steensen A contribution of the research presented here is therefore to look more closely at the significance of hashtags during and after a massive and complex emergency event such as the 22 July 2011 terrorist attack in Norway.
Since the research to be presented is based on an analysis of almost all tweets sent from Norway during and after the event, the use of hashtags and their significance can be traced from the outbreak to the aftermath.
This provides important insights into the significance of hashtags during emergencies.  For the purpose of this chapter, queries were run in the SQL database to detect the use of hashtags during the event and in the following weeks.

ABOUT THE EVENT
Previous research has indicated that a sudden, breaking news event occupies the attention of the general public for approximately two weeks, which has proven to hold true also for the Twitter-sphere (Burnap et al., 2014). A 40-day period should therefore be more than sufficient to determine the life cycle of trending hashtags related to the terrorist attack. The aim of the hashtag analyses in this chapter is to pinpoint (1)  However, it did not take more than two days before Twitter activity stabilised at a level of about 50,000 tweets posted per day, which still represents a 25 per cent increase compared to the days before 22 July. On average, 22 per cent of the tweets in our dataset contained one or more hashtags. Figure 1 shows the 10 most popular hashtags during the period 20 July to 27 August 2011.
The highest level of hashtag use was on 22 July, the day of the attack. Figure 2  The numbers in Figure 2 suggest that the more that is known about an unsuspected, major breaking news event, the more likely it is that the Twitter community will use hashtags to talk about this event. It also suggests that it takes time for the Twitter community to turn its attention to the event. This is related to what Romero, Meeder, and Kleinberg (2011) refer to as 'complex contagion dynamics', which implies that people hold back from using hashtags until they see which hashtags are trending. We During the first five minutes after the explosion, 95 tweets related to the blast were posted (25 per cent of all tweets posted during these minutes). Only 10 of these 95 tweets contained hashtags (9.5 per cent), and many of these hashtags were misleading in the sense that they placed the blast in a false location or assumed the blast was caused by thunder or an earthquake. Similarly, when news about the shootings at Utøya started to appear on Twitter, hashtags were of little use. The Utøya shootings started at 17.21 and the first tweet using an event-specific hashtag (#utøya) was posted at 17.52. By then, 78 tweets about the events on Utøya had been posted, only ten of them (13 per cent) containing hashtags. And these hashtags were not providing new information since they were all connected with the bomb blast in Oslo (#oslo, #prayforoslo, #osloexpl). 2

24
Steen Steensen      (Lin & Margolin, 2014). The #prayfor… hashtags are therefore a way of establishing the event as belonging to a specific genre, namely terrible breaking news events, which require a specific rhetorical response. Such genre affiliation thereby helps in acquiring SA, as it links the event to previous and similar events with known outcomes.
If we look at the tweets that did not contain hashtags (63 per cent of all tweets posted on these two days), we find that the majority of these are linked to the terrorist attack as well. The most common word in these tweets (disregarding prepositions) is 'Oslo', and the most common phrases that the word Oslo occurred in are 'Oslo and Utøya', 'Oslo 7 killed short after shooting', 'Oslo and the massacre', etc. 4 The Aftermath: Love and Justin Bieber The first week after the critical phase, from Sunday 24 July to Friday 29 July, was marked by national displays of grief, shock and sorrow.    (Graham & Wright, 2014) in terms of number of tweets posted during the critical hours and the week following the terror attack. These 10 most active Twitter posters account for 4.0 per cent of all tweets during the acute phase and 3.3 per cent during the whole period 22À29 July. This suggests that the Twitter communication was dispersed rather than centralised, but that there was a slightly higher degree of concentration around some dominant communicators during the acute phase than during the following week.
As Table 1 shows, many of the superposters both during the acute phase and in the aftermath, were young girls, many of whom showed some kind of affiliation with pop/fan culture in their Twitter profiles.
Three of these young girls are on the top ten list in both periods. These girls' Twitter activity seems not to have been directed towards a general public, but to their peers and fellow fans of Justin Bieber especially, but also Liam Payne, the boyband The Weekend and others. A closer look at their Twitter activity reveals that at least a couple of these girls probably were friends who tweeted a lot to and from each other and seem to have used Twitter as their primary channel of communication, as a messaging service.
However, the most active Twitter user in terms of number of original tweets posted during the acute phase, was a journalist. This journalist was not the typical breaking news journalist from one of the major news outlets. He was a young film critic with NRK P3, the Norwegian public broadcaster's radio channel targeting teenagers and young adults. Still, this journalist was the only one among the top 10 tweeters in both periods who was close to being a public figure. He started tweeting about the terror attack at 15.28 À 3 minutes after the bomb blast, 29 Tweeting Terror: An Analysis of the Norwegian Twitter-sphere and instructed others to use it. He clearly found hashtags important, as 76 per cent of all his tweets during the acute phase contained one or more hashtags. The top mentions list is more diverse than the top tweeters list in Table 1, as we here find pop stars (Justin Bieber and his girlfriend Selena Gomez, who celebrated her birthday on 22 July), politicians (including the prime minister Jens Stoltenberg), journalists (the same journalist who was the top tweeter in Table 1   with what had happened in Norway. The journalist who was a top tweeter (@Journalist1 À see Table 1), one other journalist and a news service (@BBCBreaking) are also present on the list in Table 3, as are the prime minister, the politician that got a lot of mentions (@Politician1 À see Table 2) and one of the young girls who also tweeted a lot (@YoungGirl4 À see Table 1).

The Twitter account of Oslo University hospital (@Oslounivsykehus) is
the fourth most retweeted account during the whole week and the only public body among the most retweeted accounts. The activity of this Twitter account was related to the hospital bloodbank's efforts to secure enough blood to save all the injured (see Chapter 3 in this volume, for an analysis of this activity).

Findings Summarised
The findings presented earlier can be summarised in the following points: • The terrorist attack more than doubled the activity in the Norwegian Twitter-sphere during the day of the attack and was kept at a higher level than previous days during the following week.
• Hashtags were important in framing conversations and for the dissemination of news about the terrorist attack, as more tweets contained hashtags on 22 July than the following days. But hashtags were not relevant and were even misleading during the first few minutes 33 Tweeting Terror: An Analysis of the Norwegian Twitter-sphere • The Norwegian Twitter-sphere was concentrated on a few hashtagbased conversations related to the event during 22 and 23 July, but became much more fragmented during the following week (23À29 July).
• The attack was almost immediately framed as an international event, with English being the preferred language for the most popular hashtags, and through the use of generic hashtags like #prayforNorway.
• In terms of dominant users, the Norwegian Twitter-sphere was decentralised rather than concentrated around a few key communicators. None of the top 10 superposters were previously established as highly public figures. However, there was a higher concentration around the top 10 communicators and a higher degree of retweeting activity during the acute phase than the following week.
• The Norwegian Twitter-sphere was, both during the critical phase and the following week, dominated by young girls craving the attention of international pop idols like Justin Bieber.

CONCLUSION
The research question guiding this chapter was How did the Norwegian  Two out the four categories of hashtags that Simon et al. (2014) found to dominate the Twitter-sphere after the Westgate mall terrorist attack in Kenya dominated the Norwegian Twitter-sphere on and in the aftermath of the 22 July 2011 attack: hashtags oriented towards geographical location (#Oslo, #Utøya) and hashtags showing social support, resilience and cohesiveness (#prayfornorway, #showyourhearts and #oslove). The dominance of this second group of hashtags created a long-term SA in which the terrorist attack was understood as something that would strengthen the bond between, and community feeling among, Norwegians.
This discourse of resilience, cohesiveness and love established a 'proper' way of understanding and reacting to the terrible event and went hand-inhand with the dominant discourse found in the mainstream media (Kverndokk, 2013). In her hashtag specific analysis of the Twitter-sphere during the six days following the 22 July 2011 attack, Eriksson (2016) found that Twitter served as a backchannel for discourses countering the discourses of the mainstream media. These counter-discourses focused on 'vocabularies used to explain the attacks as well as the sensationalisation of the event' (Eriksson, 2016, p. 13). They were undoubtedly present in the Twitter-sphere, but they were by no means dominant. As the findings of this study show, Twitter was primarily a platform where mainstream discourses were formulated and reinforced.
This study also shows that hashtags are not immediately relevant for Twitter-communication when a major emergency event breaks. Future research should take this into consideration and try to sample social media data not based on hashtag searches. Hashtags were, however, important in creating SA once information about what had happened became known. Hashtags therefore functioned as a way of structuring communication and making the Twitter-sphere more united in the processes of making sense of the event.
Furthermore, the Norwegian Twitter-sphere was not centralised around a few key communicators during and after the 22 July 2011 terrorist attack, and those who were the most active in terms of numbers of tweets and retweets posted, were unexpected actors such as a young film critic journalist and a local politician, thus confirming previous research on the importance of crowdsourcing and amateurs in Twitter communication

36
Steen Steensen related to sudden crisis situations (Meraz & Papacharissi, 2013;Starbird & Palen, 2011). A striking feature of the findings presented here is the absence of the police, fire department and other public and governmental bodies among key communicators. In Chapter 3, Ottosen and Steensen analyse how authorities responded to the attack on social media.
They found that there was a lack of coordination of communication, and that the few efforts that were made were dependent on individual initiatives.
Another striking feature of the Norwegian Twitter-sphere during and after the attack is the general dominance of fan culture and celebrities like