Social Media and Situation Awareness during Terrorist Attacks: Recommendations for Crisis Communication

Social Media Use in Crisis and Risk Communication

ISBN: 978-1-78756-272-1, eISBN: 978-1-78756-269-1

Publication date: 1 October 2018


This chapter summarises the findings of a case study on social media activity during the 22 July 2011 terrorist attacks in Norway. Based on these findings and on theories and previous research on the role of social media in situation awareness (SA) configuration during crisis situations, the chapter offers seven recommendations for key communicators in official crisis management and response institutions, journalistic institutions, NGOs and others: (1) acknowledge social media as important and master monitoring and management of features across social media; (2) synchronise communication and establish a standard operating procedure (SOP); (3) establish and make known a joint social media emergency account; (4) participate, interact and take the lead; (5) be aware of non-hashtagged content; (6) implement verification tools and practices and (7) engage with and learn from celebrities.



Steensen, S., Frey, E., Hornmoen, H., Ottosen, R. and Konow-Lund, M.T. (2018), "Social Media and Situation Awareness during Terrorist Attacks: Recommendations for Crisis Communication", Hornmoen, H. and Backholm, K. (Ed.) Social Media Use in Crisis and Risk Communication, Emerald Publishing Limited, Bingley, pp. 277-295.



Emerald Publishing Limited

Copyright © Steen Steensen, Elsebeth Frey, Harald Hornmoen, Rune Ottosen and Maria Theresa Konow-Lund. Published by Emerald Publishing Limited


This article is published under the Creative Commons Attribution (CC BY 4.0) licence. Anyone may reproduce, distribute, translate and create derivative works of this article (for both commercial and non-commercial purposes), subject to full attribution to the original publication and authors. The full terms of this licence may be seen at


Terrorist attacks have become an unwanted but increasingly common type of crisis situation. Fifty-five per cent of all terrorist attacks with more than 50 casualties that have been carried out throughout the world during the last 100 years have occurred since 2007. 1 Countries such as Iraq, Pakistan, Afghanistan and Syria frequently have to deal with such massive acts of terror, while the attacks in Nice in 2016 (84 casualties), Paris in 2015 (137 casualties), Ankara in 2015 (102 casualties) and Oslo and Utøya in 2011 (77 casualties) are examples of how such massive terrorist attacks have also become frequent in Europe.

Massive terrorist attacks represent a type of crisis situation which is complex and chaotic, and in which it is extremely important to acquire as quickly as possible what Endsley (1995) has called situation awareness (SA). Efficient and accurate communication is the key to SA, and authorities such as the police, emergency personnel, fire departments, etc., need to have efficient communication with each other, with governmental officers and other public bodies, the media and the public, in order to establish SA for all parties. Adding to the complexity of such crisis situations and the challenges of communication they create is the fact that the past decade has seen the emergence of what Bruns (2014, p. 351) has called ‘a new ecology of emergency media’, in which social media play an ever more important role.

The authorities have been slow to implement social media in their crisis communication strategies (Hornmoen et al., 2018; Perng et al., 2012). There is a need for more knowledge on what role social media can play during crisis situations such as severe terrorist attacks, so that the authorities and others (NGOs, journalists, those targeted, etc.) can become better equipped to acquire and share SA. This chapter presents some recommendations for the authorities and others on the uses and functions of social media during severe terrorist attacks, based on an analysis of social media activity during the 22 July 2011 attacks in Oslo and on Utøya. 2 The chapter briefly presents the analysed data, the theoretical framework of SA as it relates to social media and crisis communication and the key findings of the case study, before concluding with the main recommendations for the authorities in particular on how to deal with social media in a crisis situation such as a severe terrorist attack.

Situation Awareness and Social Media in Crisis Communication

A key communicative challenge during a crisis event is to achieve adequate SA for all parties: those directly affected, official crisis management and response institutions, journalistic institutions, NGOs and other institutions and the public. Endsley (1995, p. 36) defines SA as ‘the perception of the elements in the environment within a volume of time and space, the comprehension of their meaning, and the projection of their status in the near future’. SA is, in other words, being aware of what is going on at a given time and in a given space; how to understand it, and how to act on that knowledge immediately and properly.

Mundane and everyday activities such as walking and driving require constant SA, as do many other activities in a wide array of environments. However, it is in complex and changing situations – like a sudden crisis – that SA becomes difficult to acquire, according to Endsley (1995, p. 33). Achieving and maintaining SA is a process involving a lot of ‘situational assessment’ (Endsley, 1995, p. 36), and it is in this process of assessment that social media can play a crucial role in a crisis. Social media are potentially an ‘awareness system’ (Maireder & Ausserhofer, 2014) that can engage citizens in crowdsourcing information activities; they thereby take on importance in disseminating emergency alerts, in citizens’ self-organisation of local responses to a crisis and, ultimately, in how a crisis situation is assessed.

Social media do, however, make the acquisition of SA more complex, as the process becomes networked instead of individual and more improvisational (Mendonça, 2007). Perng et al. (2012, p. 9) argue that the theory of SA does not sufficiently take into account ‘how awareness is developed and updated through distributed collaboration by those who are situated in very different socio-technological circumstances, and how this is a matter of “configuring awareness”’. Viewing the acquisition of SA as a networked collaboration, in which awareness is configured through joint efforts, is important for fully understanding how crisis communication functions in social media. It is not enough for key communicators in official crisis management and response institutions to send out an official statement in a tweet, a Facebook update or similar. They need to understand how that message is disseminated within social networks, what is required for its proper dissemination, how people in different socio-technical contexts might receive and interpret the message and also expect feedback in the form of questions, worries and possible updates. All this requires participation and interaction on a completely different level than in other mass media channels of communication.

Furthermore, awareness configuration is not something which is transferred from one person or institution to another in social media. It is a many-to-many process, in which official crisis management and response institutions, journalistic institutions and others are parts of a larger network to which they need to listen in order to acquire and maintain SA themselves. The Norwegian Twitter-sphere during the 22 July 2011 terrorist attack is a good example of how this many-to-many awareness configuration might work (see Chapter 1 in this volume). As analysed by Ottosen (2015) and in Chapter 3 in this volume, this process is difficult if crisis authorities do not participate in social media.

Key communicators in official crisis management and response institutions, and to an extent, journalists too, are lagging behind in dealing with this networked, collaborative way of creating SA, according to Perng et al. (2012). Research has shown how members of the public might use social media to organise help and respond to a crisis (Perng et al., 2012; Starbird & Palen, 2011); such efforts might be important in the general assessment of a crisis situation.

About the Case and the Data

On Friday 22 July 2011 at 15.25 a massive car bomb exploded in the government quarter in the centre of Oslo. Eight people were killed in the blast, which left neighbouring quarters resembling a war zone. The national newspaper VG, the regional newspaper Dagsavisen and the commercial broadcaster TV 2, which all had offices close to the government quarter, had to evacuate their premises due to the bomb blast.

The lone terrorist, Anders Behring Breivik – a 28-year-old right-wing extremist who wanted to attack the social democratic party, whom he regarded as traitors to Norway – then drove 38 km northwest of Oslo to the Tyrifjorden lake, where, dressed as a policeman, he arrived at the ferry landing Utøyakaia at 16.55. He was transported by local ferry to the small island of Utøya, where the social democratic party’s youth organisation (AUF) was holding its traditional, annual week-long summer camp. A total of 564 people were on the island when Breivik arrived at 17.18. For more than an hour, he searched the island for people to kill; he was able to kill 69 people, mostly adolescents, and severely injure 56 before being apprehended by the police at 18.34. Many youngsters fled the island by swimming away, while others hid as best they could (Dyb et al., 2014).

At 19.30, the police confirmed that seven people had been killed by the bomb. At 21.30, the police reported 10 deaths on Utøya. At 22.45, the minister of Justice, Knut Storberget, confirmed that the apprehended terrorist was ethnically Norwegian. At 03.17 on 23 July, the police stated that the number of causalities on Utøya was far greater than previously presumed, and at 03.50, they reported that 80 people had been killed on Utøya. The correct number of casualties was not announced until Monday 25 July.

The 22 July commission, appointed by parliament to investigate how the Norwegian authorities handled the crisis, concluded that the damage done by the terrorist could have been considerably minimised, had the police and other authorities been better coordinated, and in possession of better communication routines (NOU, 2012; see also Chapter 4 in this volume). The commission also commented on the role of social media during the crisis:

Never before have the members of government personally received information by text messages, telephone calls and social media directly from victims, at the same time as they were supposed to be dealing with a national crisis. (NOU, 2012, p. 454)

Some of the youngsters trapped on Utøya used Twitter and Facebook to communicate with each other and the outside world on what was happening on the island, and news about the terrible events broke on Twitter before any other medium. Social media were also pivotal in establishing the ‘meet hate with love’ discourse that dominated the Norwegian public sphere in the aftermath of the terrorist attacks (Kverndokk, 2013). For example, peaceful rose parades, organised in all the big cities in Norway on Monday 25 July 2011, were initiated as Facebook events by ordinary citizens.

Although some research projects have previously examined aspects of social media activities during the 22 July attack (see, for instance, Eriksson, 2016; Kaufmann, 2015; Kverndokk, 2013; Perng et al., 2012), the RESCUE project is the first research project to carry out a comprehensive analysis of the uses, functions and activities of social media in the context of the attack.

The data analysed in the RESCUE project on the 22 July 2011 case consist of:

  • a collection of 2.2 million tweets acquired from Gnip, Twitter’s enterprise API platform, representing the Norwegian Twitter-sphere from 20 July to 28 August 2011 (see Chapter 1 for a further presentation and discussion of this data);

  • qualitative interviews with survivors from Utøya and content from their Facebook accounts (see Frey, 2018 and Chapter 2 in this volume for a further presentation and discussion of this data);

  • qualitative interviews with Norwegian information officers and key communicators in the relevant sectors, and with journalists (see Hornmoen et al., 2018 and Chapter 4 in this volume for a further discussion and presentation of this data);

  • qualitative interviews with journalists who worked on 22 July 2011 (see Konow-Lund & Olsson, 2017 and Chapter 7 for a further presentation and discussion of this data); and

  • content from Norwegian online and print newspapers on 22 and 23 July 2011 (see Ottosen & Bull, 2016; Steensen & Eide, forthcoming 2018, for a further presentation and discussion of this data).

Key Findings

The findings of the case study of social media activity during and after the 22 July terrorist attacks in Norway are fully presented and discussed in various journal articles, book chapters, and in the chapters of this volume. These publications will be referred to in the following summary of key findings, divided into three sections: (1) findings from the analysis of the Norwegian Twitter-sphere and newspaper content; (2) findings from interviews with survivors from Utøya and (3) findings from interviews with journalists, information officers and other key communicators.

Findings from the Analysis of the Norwegian Twitter-sphere

The terrorist attacks prompted a 200 per cent increase in Twitter activity in Norway on 22 July 2011; the Norwegian Twitter-sphere was dominated by the event. Hashtags were used to structure and make sense of the otherwise chaotic communication, and the 10 most used hashtags during 22 and 23 July were all related to the attacks, accounting for 60 per cent of all hashtag use over those two days. The most popular hashtags were #prayfornorway, #Utøya and #Oslo, while the hashtag #osloexpl was the most used during the critical hours on 22 July (see Chapter 1 for a further presentation and discussion of these findings).

Although hashtags were used more during the critical hours of 22 July (15.25–21.00) than during the following days, less than half the tweets posted in these hours contained hashtags. Furthermore, many of the hashtags used early on were misleading and it took more than 30 minutes after the bomb blast before the Twitter-sphere had established a hashtag (#osloexpl) that made it possible to monitor Twitter appropriately for updates about the crisis situation (see Chapter 1).

Given the delay in identifying the perpetrator, the Twitter-sphere was vulnerable to rumour and speculation. In the early phase, rumours about a possible al-Qaida attack circulated in the Norwegian Twitter-sphere, and a large number of tweets blamed radical Muslims. This was, to a certain extent, accompanied by hostility to immigrants and Muslims in general, though this tendency was also criticised by others, warning about a blame game before the facts were on the table (Ottosen, 2015).

The Norwegian Twitter-sphere was not dominated by just a few key communicators. The top 10 most active tweeters during the attack only accounted for 4 per cent of all Twitter activity in Norway during the same period; none of the most active tweeters were previously established as public figures. The most active tweeter was a young film critic and journalist, and the Norwegian Twitter-community was dominated by young girls seeking the attention of international pop idols such as Justin Bieber, whose Twitter account was by far the most mentioned both during and after the attacks. Tweets containing the hashtag #prayfornorway and referring to @justinbieber constituted the most common combination of hashtag and reference in the Norwegian Twitter-sphere during and after the attacks (see Chapter 1). As to where the information posted on Twitter came from, Steensen and Eide (forthcoming 2018) found that 14 per cent of all tweets posted between 15.25 on 22 July and 11.00 on 23 July contained hyperlinks, and that more than one-third of these tweets linked to national or international news media. Contents from traditional news media were much more important as sources on Twitter than social media were important as sources for traditional news media.

The Norwegian authorities and public bodies were not particularly visible on Twitter during and after the attacks. Of the 8,290 different Norwegian Twitter accounts posting at least one tweet between 15.25 and 21.00 on 22 July, only nine came from public bodies. These nine accounts posted in total 22 tweets during the critical hours; the official account of Oslo Airport was the most active with eight tweets containing updates on how the terrorist attack was affecting traffic to and from the airport. The operating police departments, the Norwegian Security Police (PST), the fire departments or other public emergency offices were absent from Twitter, even though they were mentioned several times by other Twitter users who wanted them to communicate on the social medium. There is, however, one notable exception to this lack of communication on Twitter from public bodies: Oslo University Hospital used Twitter successfully to attract and coordinate blood donors (see Chapters 3 and 4).

Findings from Interviews with Survivors from Utøya

As part of the case study, eight survivors from Utøya were interviewed in-depth about their social media use and experience prior to, during and after the terrorist attack. All of them were users of social media. Three of them actively used social media during the attack, while some did not even consider using their phones because they were too preoccupied with simply surviving (all findings reported here and later are presented and discussed in Frey, 2018).

Facebook was their preferred social medium for contacting their near and dear ones, and for giving and receiving information, especially after the perpetrator had been apprehended by the police. One of the interviewees had a large follower base on Twitter and tweeted information on what was going on during the attack. This interviewee found Twitter more efficient than contacting the police, which she/he also did, but without the sense that they were taking him/her seriously. Another of the interviewees used Facebook to update his/her network about the shootings, and understood from comments that those outside the island were not aware of the extent of the shooting. The active social media users all muted their phones and checked Twitter, Facebook and online news media for updates as a way of acquiring SA. One learned via social media that the shooter was dressed as a policeman, which was important information. Another was told there was only one terrorist, whom she/he later learned had been captured by the police.

However, all interviewees told how young people on the island experienced many practical obstacles: their mobile phones were running low on battery power, or they lost their phones when fleeing or swimming. Some were afraid that the terrorist(s) was monitoring social media. Nevertheless, young people on Utøya used Facebook and Twitter to tell outsiders not to call them, afraid that the sound and light of mobile phones ringing could attract the terrorist’s attention. Furthermore, all the interviewees remarked on the difficulty of ascertaining whether something on social media is a rumour or misinformation, when under attack, although one interviewee pointed out that it is possible to verify Twitter accounts.

Once rescued, all the interviewees used Facebook to contact friends and family to let them know they were safe. A few also tweeted. In the event of being caught up in another crisis situation, six of the eight would use social media, probably Facebook and Snapchat, or a new, as yet unknown social medium. They stressed that people under attack would benefit from having genuine two-way communication with crisis authorities on social media.

Findings from Interviews with Journalists, Information Officers and Other Key Communicators

As part of the RESCUE-project, we interviewed key communicators in crisis management organisations (NGOs and public agencies), first responder organisations (fire brigade, police and emergency units), the PST and journalistic institutions. Some of these findings are reported in Hornmoen et al. (2018) and reveal that the key communicators generally see great potential in using social media to create SA and improve management of risks and crises. However, they point to several deficiencies in current uses of social media in emergencies. Interviewees in both crisis management organisations and journalistic institutions point to lack of personnel, problems with organisational routines and coordination and insufficient training.

The three groups of communicators differ slightly in their views on what the benefits and challenges of using social media in crises are. Crisis communication managers tend to view dialogical communication as a way of correcting public misconceptions during crisis situations. The first responder communicators largely see postings from social media users as containing potentially vital information, enabling them to act swiftly and effectively in acute situations. The journalist group also sees the potential value of communicating information in their news stories that originates from social media users present at crisis scenes. However, a challenge with social media pointed out by all informants was how to monitor efficiently, and verify, user-generated content during a crisis.

Key police and health communicators in government agencies in Norway were also interviewed (see Chapter 4 in this volume) about their use – or lack of use – of social media during and after the 22 July attacks. The police interviewees stressed how their unpreparedness in social media use in 2011 alerted them to the urgent need to include social media in their emergency communication. Routines they later established show their recognition of the importance of engaging with social media in daily communication in order to strengthen their public presence and thereby be prepared for effective use of social media in crises. Although police interviewees stress that social media can contribute to saving lives and resolving crises, they do not believe that social media communication would have had any impact on the emergency operations on the island of Utøya.

In comparison with the police interviewees, the health communicators we interviewed actually used social media – particularly Twitter, when the crisis unfolded. However, those health interviewees with different roles and functions in crisis management stressed the need for a better coordination between different actors and agencies in their own sector, and – equally importantly – between the different sectors’ emergency services. It is vital that the different emergency services coordinate and strengthen their plans for using social media in crises in order to prevent escalating a crisis through social media use.

Konow-Lund and Olsson (2017) interviewed 17 Norwegian journalists a couple of months after the terrorist attacks in 2011 and found that they predominantly used social media as sources of information in line with any other source of information during the crisis. However, as the response to the event moved into a phase of grief and collective sadness, journalists became open to increased audience participation and the potential incorporation of social media use into their coverage. Konow-Lund and Olsson conclude that the journalists were driven by how the public used social media, and that they quickly adapted their professional practice rather than sticking rigidly to their own norms and routines.


Based on the case study findings presented earlier, we can conclude that:

  1. Twitter was an important medium in acquiring SA for at least some of the victims, for the public, and potentially also for the police, other emergency institutions, governmental bodies and public offices during the attacks on 22 July 2011;

  2. Key governmental bodies and public offices did not use social media as important sources of information and channels of communication during the attacks. This obstructed proper situation assessment for members of the public and for the authorities themselves, for instance, by allowing rumours and speculation about the identity of the terrorist to flourish and

  3. A lack of resources, and social media routines and strategies made it difficult for key communicators in official crisis management and response institutions, to a certain degree also in journalistic institutions, to use the potential of social media as crisis communication tools.

In 2011, Facebook and Twitter were the two dominant social media in Norway and elsewhere. Since then, the breadth of social media has increased, and it is today difficult to foresee what social medium will be the most important, or if various groups within the public will turn to different kinds of social media, during future crisis situations. It is, therefore, important for key communicators to understand and master social media monitoring tools and cross-social media features such as hashtags. Furthermore, such tools and features need to be embedded in the routines of everyday professional practice, otherwise they run the risk of being forgotten and seen as conflicting with already established communication routines. Our first recommendation is therefore:

Recommendation 1: Acknowledge social media as important and master monitoring and management of features across social media

Key communicators and crisis communication institutions should acknowledge that social media are important channels of information dissemination and communication in crisis situations; they should implement social media monitoring tools in their daily communication routines and learn to understand and master cross-social media features like hashtags.

As our case study shows, hashtags were an important feature in structuring communication on Twitter during the terrorist attacks. However, it took time for a relevant and much-used hashtag to be established, and the majority of tweets about the attack did not contain hashtags. Eye-witnesses and victims who post important information are not likely to be skilled communicators and therefore might not consider using hashtags. Furthermore, during the first crucial and chaotic minutes after the bomb blast in Oslo, several misleading hashtags were in use.

This delay in agreeing on a common hashtag and the lack of hashtag use on Twitter during the attacks might have something to do with the absence of strong communicative leadership in the micro-blogging service and the absence of the authorities and well-known journalists among the top communicators. Even though the Norwegian Twitter-sphere was thematically dominated by the terrorist attacks during 22 and 23 July, it was not dominated by a few, important communicators. The most active tweeters were unexpected actors like a young film critic/journalist, a local politician and several young girls. The victims on Utøya did not know which accounts to follow and who they should direct their social media emergency alerts to.

There is, therefore, a need for key communicators in crisis management and response institutions to synchronise their communication and to establish common social media accounts. The authorities in Kenya managed successfully to do exactly that during the Westgate Mall terrorist attack in 2013; they established a standard operating procedure (SOP) to synchronise communication and used WhatsApp for that purpose (Simon, Goldberg, Aharonson-Daniel, Leykin, & Adini, 2014).

This leads us to the following four recommendations:

Recommendation 2: Synchronise communication and establish a standard operating procedure

Official crisis management and response institutions should establish a clear standard operating procedure (SOP) on who communicates what, where and with whom during a crisis, and how communication to and from the various institutions should be synchronised.

Recommendation 3: Establish and make known a joint social media emergency account

Authorities involved in crisis management and response should have a joint social media emergency account which is well known to the public, similar to emergency numbers like 911 in the US and 112 across the EU countries.

Recommendation 4: Participate, interact and take the lead

This joint emergency social media account should be active in everyday communication routines, thereby securing a large base of followers; this will enable the account to become a key communicator during crisis situations. Being a key communicator in social media means participation and interaction, and it involves (1) active and rapid communication in all relevant social media; (2) a dialogical approach (involving, for instance, retweets and replies, addressing rumours and false information) towards the audience and (3) taking the lead as quickly as possible in establishing relevant hashtags for all social media communication about the unfolding crisis.

Recommendation 5: Be aware of non-hashtagged content

Authorities, journalists and other potential key communicators should not base all monitoring of social media content during a crisis on hashtag-based searches only, especially not in the critical minutes after a crisis has occurred.

A problem with social media communication during emergencies for all parties involved – victims, the public, the authorities, NGOs, etc. – is how to know what information to trust. In our case study, the youngsters at Utøya addressed this problem, as did the journalists and key communicators in official emergency management and response institutions. Many resources are currently being invested (in research, commercial software development and in professional communicative practices) in social media verification tools and practices (see for instance Brandtzaeg, Lüders, Spangenberg, Rath-Wiggins, & Følstad, 2016; Chen et al., 2017; Fletcher, Schifferes, & Thurman, 2017). Such verification tools and practices need to address the growing importance of visual images and videos (both recorded and live streamed), which are becoming increasingly popular as ever more social media communication is based on visual communication. In 2011, the image sharing social media network Instagram had not yet been fully launched; third party image sharing services were necessary to share images on Twitter, and Facebook had not yet launched its video streaming function.

This social-media-based escalation of what Manovich (2001), at the turn of the millennium, described as an on-going move from a textual to a visual culture is especially important in crisis assessment, as images can convey information crucial to the acquisition of SA. This, therefore, leads us to our sixth recommendation:

Recommendation 6: Implement verification tools and practices

Authorities, journalists and other potential key communicators need to get training in – and actively take part in the development of – social media verification tools and practices. Such tools and practices should be specially equipped to identify and help verify relevant visual content.

One interesting, and perhaps surprising, finding from our analysis of the Norwegian Twitter-sphere during and after the terrorist attacks on 22 July 2011 was the role played by international celebrities such as Justin Bieber. Youngsters, especially girls, used Twitter to get the attention of such celebrities and clearly directed their need for comfort to them. Social media have clearly narrowed the communicative gap between fans and celebrities, and those growing up with social media experience a more personal and direct relation to their idols than previous generations. In her analysis of adolescents’ interactions with celebrities on Twitter, Bond (2016) found that feelings of connectedness and even friendship were common, especially among those who had experienced direct contact in the form of a retweet or reply from their idol. It may, therefore, not necessarily come as a surprise that young people, who connect more with celebrities than with politicians, journalists and other public figures, reach out first and foremost to their idols during a crisis. This cultural phenomenon should be acknowledged and taken seriously by official crisis management and response communicators, especially when the crisis situation involves young people, as was the case on Utøya. This leads us to our seventh and final recommendation:

Recommendation 7: Engage with and learn from celebrities

Authorities, journalists and other potential key communicators should acknowledge the importance of celebrities in social media during crisis situations and the ways in which young people in particular turn to their idols in times of crisis.


This chapter has summarised the findings of a case study on social media activities during the 22 July 2011 terrorist attacks in Norway. Based on these findings, we offer seven recommendations for key communicators in official crisis management and response institutions, NGOs, journalistic institutions and, to a degree, also the public and victims: (1) acknowledge social media as important and master cross-social media monitoring and features; (2) synchronise communication and establish a SOP; (3) establish and make known a joint social media emergency account; (4) participate, interact and take the lead; (5) be aware of non-hashtagged content; (6) implement verification tools and practices and (7) engage with and learn from celebrities.

We believe that implementing these recommendations is crucial for the authorities in particular, but also for NGOs, journalistic institutions and others who might have a role as key communicator during a crisis. Underpinning these recommendations is a recognition of the important role played by social media in the configuration of SA during and after a crisis situation. As our case study of the terrorist attacks in Norway shows, social media will be used as vehicles for configuring SA, even if the authorities are not taking part in the process. Acknowledging this means acknowledging that SA configuration during a crisis situation has become a collaborative and networked process, in which the authorities, journalists and other traditional key communicators need to take a different role than perhaps used to be the case.



Based on a list of terrorist attacks on Wikipedia (accessed 23 July 2017):


The analysis of social media activity during the 22 July 2011 terrorist attacks in Oslo and on Utøya is one of three case studies in the RESCUE-project (REsearching Social media and Collaborative software Use in Emergencies).


Bond (2016) Bond, B. J. (2016). Following your “friend”: Social media and the strength of adolescents’ parasocial relationships with media personae. Cyberpsychology, Behavior, and Social Networking, 19(11), 656660. doi:10.1089/cyber.2016.0355

Brandtzaeg, Lüders, Spangenberg, Rath-Wiggins, & Følstad (2016) Brandtzaeg, P. B. , Lüders, M. , Spangenberg, J. , Rath-Wiggins, L. , & Følstad, A. (2016). Emerging journalistic verification practices concerning social media. Journalism Practice, 10(3), 323342. doi:10.1080/17512786.2015.1020331

Bruns (2014) Bruns, A. (2014). Crisis communication. In S. Cunningham & S. Turnbull (Eds.), The media and communications in Australia (pp. 351355). Sydney: Allen & Unwin.

Chen et al. (2017) Chen, N.-C. , Brooks, M. , Kocielnik, R. , Hong, S. R. , Smith, J. , Lin, S. , & Aragon, C. (2017). Lariat: A visual analytics tool for social media researchers to explore Twitter datasets. Retrieved from

Dyb et al. (2014) Dyb, G. , Jensen, T. K. , Nygaard, E. , Ekeberg, Ø. , Diseth, T. H. , Wentzel-Larsen, T. , & Thoresen, S. (2014). Post-traumatic stress reactions in survivors of the 2011 massacre on Utøya Island, Norway. The British Journal of Psychiatry, 204, 361367. doi:10.1192/bjp.bp.113.133157

Endsley (1995) Endsley, M. R. (1995). Toward a theory of situation awareness in dynamic systems. Human Factors: The Journal of the Human Factors and Ergonomics Society, 37(1), 3264. doi:10.1518/001872095779049543

Eriksson (2016) Eriksson, M. (2016). Managing collective trauma on social media: The role of Twitter after the 2011 Norway attacks. Media, Culture & Society, 38(3), 365380. doi:10.1177/0163443715608259

Fletcher, Schifferes, & Thurman (2017) Fletcher, R. , Schifferes, S. , & Thurman, N. (2017). “Building the ‘truthmeter’: Training algorithms to help journalists assess the credibility of social media sources”. Convergence: The International Journal of Research into New Media Technologies, doi:10.1177/1354856517714955

Frey (2018) Frey, E. (2018). ‘Do you tweet when your friends are getting shot?’ Victims’ experience with, and perspectives on, the use of social media during a terror attack. Social Media + Society, 4(1), 111. doi:10.1177/2056305117750715

Hornmoen et al. (2018) Hornmoen, H. , Backholm, K. , Frey, E. , Ottosen, R. , Reimerth, G. , & Steensen, S. (2018). Key communicators’ perspectives on the use of social media in risks and crises. In R. Anderson & P. L. de Silva (Eds.), Routledge companion to media and humanitarian action. London: Routledge.

Kaufmann (2015) Kaufmann, M. (2015). Resilience 2.0: Social media use and (self-)care during the 2011 Norway attacks. Media, Culture & Society, 37(7), 972987. doi:10.11777/0163443715584101Opinion

Konow-Lund & Olsson (2017) Konow-Lund, M. , & Olsson, E.-K. (2017). Social media’s challenge to journalistic norms and values during a terror attack. Digital Journalism, 9(5), 113. doi:10.1080/21670811.2016.1243990

Kverndokk (2013) Kverndokk, K. (2013). Et nettverk av sorg. Sosiale medier og minnekultur etter 22. juli. [A network of grief. Social media and memory culture after 22 July]. In P. K. Botvar , I. M. Høeg , & O. Aagedal (Eds.), Den offentlige sorgen. Markeringer, ritualer og religion etter 22. juli (pp. 169189). Oslo: Universitetsforlaget.

Maireder & Ausserhofer (2014) Maireder, A. , & Ausserhofer, J. (2014). Political discourses on Twitter: Networking topics, objects and people. In A. Bruns , K. Weller , J. Burgess , C. Puschmann , & M. Mahrt (Eds.), Twitter and society (pp. 305318). New York: Peter Lang Publishing Inc.

Manovich (2001) Manovich, L. (2001). The language of new media. Cambridge, Mass.: MIT Press.

Mendonça (2007) Mendonça, D. (2007). Decision support for improvisation in response to extreme events: Learning from the response to the 2001 World Trade Center attack. Decision Support Systems, 43(3), 952967. doi:10.1016/j.dss.2005.05.025

NOU (2012) NOU . (2012). Rapport fra 22 juli kommisjonen (NOU No. 14) [Report from the 22 July Commission]. Oslo: Departementenes servicesenter, informasjonsforvaltning. Retrieved from

Ottosen (2015) Ottosen, R. (2015). Islamske terrorister eller norsk ekstremist? Fiendebilder på Twitter 22. juli. [Islamist terrorists or Norwegian extremist? Enemy Images on Twitter 22 July]. Pressehistorisk Tidsskrift, 24, 115124.

Ottosen & Bull (2016) Ottosen, R. , & Bull, C. A. (2016). Insane or evil? How Norway’s Dagbladet and Aftenposten newspapers covered the perpetrator of 22 July 2011. Journal of Applied Journalism and Media Studies, 5(1), 2750.

Perng et al. (2012) Perng, S.-Y. , Buscher, M. , Halvorsrud, R. , Wood, L. , Stiso, M. , Ramirez, L. , & Al-Akkad, A. (2012). Peripheral response: Microblogging during the 22/7/2011 Norway attacks. In J. Rothkrantz, J. Ristvei, & Z. Franco (Eds.), Proceedings of the 9th international ISCRAM conference. Vancover, Canada. Retrieved from

Simon, Goldberg, Aharonson-Daniel, Leykin, & Adini (2014) Simon, T. , Goldberg, A. , Aharonson-Daniel, L. , Leykin, D. , & Adini, B. (2014). Twitter in the cross fire—The use of social media in the westgate mall terror attack in Kenya. PLOS ONE, 9(8), e104136. doi:10.1371/journal.pone.0104136

Starbird & Palen (2011) Starbird, K. , & Palen, L. (2011). Voluntweeters: Self-organizing by digital volunteers in times of crisis. In Proceedings of the SIGCHI conference on human factors in computing systems, Vancouver, BC, Canada, May 7–12. New York: ACM (pp. 1071–1080). doi:10.1145/1978942.1979102

Steensen & Eide (2018) Steensen, S. , & Eide, T. (forthcoming, 2018). Flows of terror. An analysis of information flows between traditional and social media during the 22nd of July 2011 terrorist attacks in Norway.


The Research Council of Norway (Grant No. 233975/H20) and Oslo Metropolitan University have funded this research, for which we are grateful.

Social Media Use in Crises and Risks: An Introduction to the Collection
Part 1 Using Social Media in Risks and Crises
Chapter 1 Tweeting Terror: An Analysis of the Norwegian Twitter-sphere during and in the Aftermath of the 22 July 2011 Terrorist Attack
Chapter 2 Victims’ Use of Social Media during and after the Utøya Terror Attack: Fear, Resilience, Sorrow and Solidarity
Chapter 3 Blood and Security during the Norway Attacks: Authorities’ Twitter Activity and Silence
Chapter 4 Social Media in Management of the Terror Crisis in Norway: Experiences and Lessons Learned
Chapter 5 News Workers’ Reflections on Digital Technology and Social Media after a Terror Event
Chapter 6 Old Wine in New Bottles? Use of Twitter by Established UK News Media during the 2014–15 West African Ebola Outbreak
Chapter 7 Flows of Water and Information: Reconstructing Online Communication During the 2013 European Floods in Austria
Part 2 Developing a Tool for Crisis Communicators
Chapter 8 Tailoring Tools to the Rescue: Lessons Learned from Developing a Social Media Information Gathering Tool
Chapter 9 What Eye Movements and Facial Expressions Tell Us about User-Friendliness: Testing a Tool for Communicators and Journalists
Part 3 Recommendations for Social Media Use in Risks and Crises
Chapter 10 ‘When the Levee Breaks’: Recommendations for Social Media Use During Environmental Disasters
Chapter 11 Social Media Communication During Disease Outbreaks: Findings and Recommendations
Chapter 12 Social Media and Situation Awareness during Terrorist Attacks: Recommendations for Crisis Communication