Introduction

On the evening of 13 November 2015, three suicide bombers struck outside Stade de France in Paris. This was the beginning of the deadliest event in France since the Second World War, culminating in a mass shooting at the Bataclan theatre later that evening. The terrorist attacks claimed the lives of 137 people including the seven attackers’. Events such as these prompt debates infused with anger, accusations, and hatred, but also sometimes followed by self-reflection, introspection, and soul-searching1,2,3. Amid such turmoil, the public focus suddenly shifts to topics and issues that were marginal before the event and are not even necessarily related to it directly. Events in Paris that night sparked curiosity about Islam and its history, Western colonial legacy, and tourist spots in the Middle East, but also triggered discussions about West and East, Christianity and Islam, and “Us” and “Them”2, 4,5,6. This confrontation has a regrettably violent history, which includes notable incidents such as the Twin Towers attack in 2001 and the London Underground attack in 2005.

Here we ask: Which topics do come to the forefront of the public discourse in the wake of a terrorist attack? Are there any common patterns across various attacks? How long does it take for public attention to return to routine concerns? Past research in this direction has mostly focused on the psychology and politics behind the terrorist attacks and their portrayal in the media7,8,9,10,11,12,13,14,15,16,17, assuming that media coverage reflects the overall public reaction. However, the topics discussed in the media are not necessarily a complete répertoire of issues that people will become interested in18, 19. Other quantitative work utilized election results as a proxy measurement, routinely finding a shift to the political right20,21,22,23,24. While terrorism surely affects the voting decisions, it is hard to separate its real effects from the background political context. Moreover, most such studies are naturally limited to specific countries and specific times. Effects of terrorism on economics were examined, often focusing on macro level25,26,27,28. Medium and long term shaping of public opinion after terrorist events was also studied29, 30, but investigation of immediate and direct effects is still missing.

To fill this gap, one would seek to identify what topics are searched online more frequently after a terrorist attack. However, the diversity of the search terms concerning any subject makes it difficult to use the search engine statistics for gauging the public interest without having a predefined list (répertoire) of keywords. Instead, we employ the viewing statistics of the Wikipedia content. Researchers already shown the correlation between Wikipedia view statistics and Google search volume31, 32, making it a useful proxy measure of the Web public attention33. Wikipedia viewing statistics has in fact become an established instrument, enabling not only to comprehend but also to predict a broad variety of social phenomena19, 34,35,36,37,38,39,40,41,42,43,44,45,46,47. It can safely be argued that Wikipedia encompasses “all” issues of potential interest, including those ignited by terrorist attacks. As its information is organized into articles, it is convenient for mapping the public responses into certain topics and categories. Articles represent the missing répertoire.

We studied the viewing statistics of all articles in English Wikipedia around the time of 15 terrorist attacks in Europe (see “The sample of terrorist attacks” and Appendix A). By detecting the spikes in daily viewcount of specific articles we identified the issues that the public interest is directed towards as a consequence of these events (see “Data preparation”). Unfortunately, this data is available only from 2015 on. This makes the Paris attack of 2015 the first event to commence our analysis.

Results

Changes of collective attention around Paris 2015 attack

We commence by a thorough examination of the Paris attack in 2015, which is the initial event within our sample. We will broaden our analysis to encompass all attacks later. Focusing on the 12 days surrounding the Paris event, we identify 17 articles that received the most attention in this period, shown in Fig. 1 (for details on the identification method see “Sampling the articles around the time of Paris 2015 attack”). Among these 17 articles, we found that five were directly related to the attack while the remaining 12 were not. On the 12 November 2015, a day before the attack, the largest attention was devoted to three articles related to entertainment: Prem Ratan Dhan Payo (Hindi romantic movie released on 12 November), Spectre (2015 James Bond movie released on 26 October), and Fallout 4 (computer game released on 10 November). The attack starts on the evening of 13 November in Paris local time (Since this was still early afternoon in North America, many English-speaking views registered on 13 November, even though the event lasted until the early hours into 14 November.).

This immediately diverts attention to the newly created article November 2015 Paris attacks in addition to The Islamic State of Iraq and the Levant (ISIL, the main perpetrator) and Eagles of Death Metal (rock band that was playing in Bataclan theatre). The attention to these three articles spiked on 14 November, but without dramatically reducing the attention on the above mentioned entertainment articles. On 15 November the collective attention splits among these three attack-related articles, the final fight of the women’s Ultimate Fighting Championship (held on 14 November), and the British TV personality Lady Colin Campbell due to her appearance in a UK reality show on the same day.

The situation is largely unchanged on 16 November, except that attention peaks for other two attack-related articles: Abu Bakr al-Baghdadi (leader of ISIL) and the group Anonymous, who following the attack announced a major hacking operation against ISIL. Meanwhile, the attention to three main attack-related articles declined and is overshadowed on 17 November by the news that the actor Charlie Sheen was HIV-positive. Eventually, on 20 November, attention is taken by three entertainment releases: the album “25” by the popular singer Adele, the detective TV series Jessica Jones, and the new part of the dystopian movie Hunger games.

Of the five attack-related articles, by 23 November most attention is devoted to ISIL. The viewing dynamics of all articles exhibit an intense spike immediately after the triggering event followed by a gradual decay in days to follow, consistently with43, 44. This pattern seems not to differ between attack-related and other articles.

Figure 1
figure 1

Articles identified with excess attention around the date of the Paris attack in 2015. The color encodes the total views of a given article on a given day (also written within each cell). Articles directly related to the attack are shown in boldface font.

Collective memory of terrorist attacks

We now proceed to assess all 15 attacks in our sample, rather than exclusively focusing on Paris 2015. Research has shown that current events not only attract collective attention to themselves but also trigger collective memories of similar past events42,43,44,45,46,47. To examine this for the case of terrorist attacks, we look at the Wikipedia articles devoted to all attacks in our sample and ask how strongly each new attack triggers the attention to the previous attacks. In the top left panel of Fig. 2 we show the viewcount time series for Magnanville 2016 from March 2017 through June 2017. Five terrorist attacks that happened during that interval are indicated. Manchester 2017 made the public intensely recall the events of Magnanville 2016. London Bridge 2017 and Westminster 2017 did so somewhat less intensely, while St. Petersburg 2017 and Stockholm 2017 did not at all. Considering this along with the results from the other two left panels, we note that when a terrorist attack happens, the public is reminded of prior (similar) attacks, albeit of some more and some less.

Figure 2
figure 2

Collective memory of terrorist attacks. Three left panels: time series of viewcounts to articles for Magnanville 2016 (top), Nice 2016 (middle), and Berlin 2016 (bottom), shown for the period of 4 months from March to June 2017. The dates of five terrorist attacks that happened during that time interval are indicated. Right panel: the excess attention Z was received by each attack as triggered by later attacks. Attacks are arranged vertically (and horizontally) in chronological order from top to bottom (left to right). Values of Z for the three panels on the left panel are marked by a bold square.

To study this collective memory more systematically, we focus on a quantity we call “excess attention” denoted with Z. It expresses how strongly a newer attack triggers the attention to an older attack (see “Definition of excess attention”). The calculated values of the excess attention are shown in the right panel of Fig. 2. Most events have triggered considerable excess of attention to the past events, confirming the existence of a collective memory of terrorist attacks in Europe. The strongest reactions are found for pairs of attacks that happened in the same country in line with the findings of García-Gavilanes et al.42. Also, the time elapsed since the attack seems to be a strong factor, as attacks that happened a long time ago are seldom remembered.

General patterns in public reaction across attacks

Reaction to a terrorist attack is shaped by many factors, primarily by the media portrayal of the event, but also by the perceptions established in the target society about itself and the perpetrators. Searching Wikipedia is a matter of individual choice, but this choice is founded on an array of social narratives that entail symbols, stories and memories of a given group, and turns them into a shared conceptual system48, 49. What narratives underpin the searching choices in Wikipedia after a terrorist act? To answer this, we identify the universal effects that attacks have on the collective attention.

Starting from all Wikipedia articles (“Data preparation”), we deployed an exclusion pipeline combining time series analysis and qualitative approaches (“Definition of excess attention” and “Article exclusion steps”), to extract 69 articles to which attention is consistently drawn after terrorist attacks. We then manually grouped them into 19 specific categories according to the commonalities of their thematic codes (“Construction of specific categories”). Finally, by finding coherent patterns among specific categories we grouped them into four broad categories (“Construction of broad categories”). This arrangement is illustrated in Fig. 3 and schematized in the Appendix B. It can be considered in a hierarchy, whereby individual articles belong to one of the specific categories, and each specific category belongs to one broad category. Broad categories represent a coarse, yet robust and interpretable level of description. They are the four core overarching groups of interests that always arise after terrorist attacks.

Enemy:

It is easy to recognize that the concept of enemy, identified as a threat, underpins specific categories related to both terrorism and conspiracies. The basic construction of the enemy goes in two ways: the Islamic extremist, a person driven by extremist ideology posing a danger and/or the terrorist, an individual who is relying on terror as the method of achieving goals in the West and elsewhere. We interpret this as a natural reaction of the English-speaking public to a terrorist attack: Establish the perpetrators (Islamic extremists) as the enemy, and then learn about their methods and actions, especially in the West.

Security:

National security, weapons, transport, insurance, and survival equipment have the idea of security as the common denominator. Seeking shelter is a natural response to the threat of the enemy. Being under attack puts us into fight or flight mode: either to confront the enemy or escape from the threat. Fight mode corresponds to the interest in armed forces, military equipment, police, conscription, and usage/purchasing of weapons. The public wants to rely on the official national security mechanisms, but also be ready for individual defence (“take matters into their own hands”). Flight mode is found in the interest of means of transportation (ways to escape), insurance (financial and otherwise), and equipment for survival in the wild (the ultimate shelter in disruptive circumstances).

Other-perception:

Once established who is the enemy and how to defend/escape from it, one wants to learn about the enemy. We recognize this as the common motif in pronounced interest for Islam and Muslims, which West often perceives4 as the archetype of the “Other”. Of course, this role has deep historical and cultural roots, which quickly spring out upon a terrorist attack. Induced by it is also a curiosity about the practices of Islam, its origins and history, sacred texts, religious figures, presence in the West and elsewhere, and even tourist attractions in the Middle East.

Self-perception:

Finally, one wants to soul-search and re-evaluate who “We” are. This establishes a self-perception that contrasts the perception of “The Other” and relies on both historical and imagined features of the West. It is centered around Western national/religious identities and political activism but also includes anti-Islam groups and figures. Interestingly, there is a large curiosity about violent historic events orchestrated by the Western powers. Given the context of the terrorist attack, it is not surprising that self-perception is built upon (equally) violent aspects of the West. On the other hand, this can be interpreted as a form of self-criticism, a realization that the West has always been violent regardless of Islamic terrorism (“they are bad, but we are no angels either”).

Figure 3
figure 3

Organization of 69 articles that survived all the filters (Table 1) into specific and broad categories (Appendix B). Four broad categories are illustrated by different colors and positioned as to capture the relationships among them, i.e., the distinctions along two independent dimensions: Establishing boundaries and Constructing identities. Two broad categories on the left explain “Them”, while the two on the right explain “Us”. Specific categories are shown schematically by their names, whereby in parentheses we report the number of articles belonging to each specific category.

The organization of the broad categories can be viewed along two independent dimensions. First, it is easy to recognize that two broad categories on the left, Enemy and Other-perception, describe “Them” in very general terms. Readers are compelled to learn about them, not just as the enemy, but to clarify who they are and how shell they perceive them. Readers look for a wider context of where the enemy comes from and why. In contrast, two broad categories on the right describe “Us”. They amount to the construction of a sense of belonging and a safe community, “Our” community. This leads to the introspection of who they are in the face of the enemy. Both “Us” and “Them” can be recognized sharper when placed in opposition to each other. This binary distinction can be interpreted as Establishing boundaries: Enemy vs Security, threat/danger vs safety/belonging, unknown vs known, Other vs Self, “Them” vs “Us”.

Second, two broad categories in the bottom amount to Constructing identities. The disruptive situation makes the public interested not only in the immediate concerns but in a more comprehensive and abstract perspective on the event. The public becomes curious about Islam not exclusively from a retaliatory perspective. On the other hand, that same public is looking for historic and current facts about Western nations and their political/social organization, neither of which is immediately related to the attacks. Both arising interests point to the need for an identity, i.e., the understanding of how “We” perceive ourselves in face of the “Them”. This elucidates how they establish the boundary between what we they as shared within their community in contrast to whatever is outside of it (and potentially threatening). Interestingly, public also gets curious about Islam’s presence in the West—the place where the “They” meet “Us”.

Next, we examine the 15 terrorist attacks through lenses of excess attention Z. For each attack, we calculate its total excess attention by summing over all broad categories. This leads to a single value of Z for each attack, reported in the left panel of Fig. 4. We find the most intense reaction to Paris 2015, Manchester 2017, London Bridge 2017, and Marseille 2017. Other attacks trigger weaker but still noticeable reactions. We could not find meaningful correlations between these values and quantifiable parameters surrounding the attacks, such as the number of deaths or injuries, as it was done by García-Gavilanes et al.33. The same was found true for the size of the Muslim population in the target countries. Still, we noticed that attacks that took place in the UK and France seem to generate somewhat more excess attention than those occurring elsewhere. A major attack in Brussels in 2016 triggered comparatively weaker interest.

Looking at excess attention of four broad categories concerning the attacks (right panel of Fig. 4), we find that the attention was most intensely diverted to the Enemy category after Paris 2015, and somewhat less so after Manchester 2017 and Marseille 2017. Turku 2017 triggered no interest in the Enemy, while Barcelona 2017 and Liege 2018 exhibit very weak interest in the Enemy. We found the weakest overall reaction in the Security category, where seven attacks did not react at all. In contrast, London Bridge 2017 has an extreme reaction in this category. Redirection to the Other-perception category is somewhat related to that of the Enemy category. Many attacks show similar values for both, with Manchester 2017 and Marseille 2017 being the highest. For the Self-perception category we find moderate values across all attacks, but not much correlated with the Security. The intensities of reactions across four broad categories are unique for each event, the strongest being for Paris 2015.

This paints the picture of each attack having a context of its own and impacting the public in a particular way. The public reaction to attacks is diverse and heterogeneous, with different attacks eliciting varying degrees of response within different broad categories. Nevertheless, we emphasize that despite these nuances, all reactions underscore a division between “Us” and “Them”. Furthermore, we stress that the extent of this dichotomy varies across attacks, although we were unable to identify any external variables that could explain these variances.

Figure 4
figure 4

Intensity of the public reaction due to terrorist attacks, which are shown vertically by their abbreviations (“The sample of terrorist attacks” and Appendix A). Left panel: total excess attention for every attack aggregated cumulatively over all of the broad categories. Right panel: total excess attention for every attack broken down over four broad categories, which are shown horizontally. The color bar is truncated for excess attention \(> 80\) for better clarity.

Returning the collective attention to ‘normal’

After an attack, how gradually is the public attention restored to routine concerns? Does this depend on the attack and/or the broad category? We look at three examples: Paris 2015, Brussels 2016, and London Bridge 2017. For each of them, we construct a time series that shows the decay of public attention to each broad category. Results for the period starting a week before the attack to 3 weeks after the attack are shown in Fig. 5.

Figure 5
figure 5

Dynamics of decay of collective public attention after terrorist attacks. Three top row panels: the cumulative time series of viewcounts for Paris 2015, Brussels 2016 and London Bridge 2017, for the broad category Enemy. The time of each attack is marked by a vertical line and the period after it is shaded in grey. Second, third, and fourth rows of panels: the same for the other three broad categories.

After every attack, the decrease pattern of collective attention is similar for broad categories of Enemy, Security, and Other-perception, but it is unique to each event. Specifically, for Paris 2015 we find the slowest decrease followed by a sudden increase 3 weeks after the event in all three broad categories. In contrast, the patterns for Brussels 2016 and London Bridge 2017 are very similar: the decrease is relatively constant and quick for Enemy and Security, and somewhat more gradual for Other-perception. The values 3 weeks after these two attacks are similar to those before the attacks. This is not the case for Paris 2015, which again confirms that it was a unique event, with effects persisting long after the event and even peaking again after 3 weeks. In opposition to these three broad categories, we find a different situation for Self-perception. The behavior for Paris 2015 is close to that of its other three broad categories. For Brussels 2016 and London Bridge 2017 we find a rather irregular pattern, characterized by a mix of decay and sudden spikes. These observations suggest that this broad category, pointing to introspection and soul-searching, is the longest-lasting effect of the terrorist trauma.

Discussion and conclusion

Our findings are three-fold. First, the exhaustiveness of Wikipedia enabled us to systematically study how the public prioritizes their interests in the wake of a terrorist attack and how this arrangement of interests differs from the usual trends. Second, we precisely measured which among them receive more and which had less attention. Third, we found consistent patterns in these awoken interests, grounded in the existing ecosystem of beliefs in the affected European societies.

The reaction of the international English-speaking public to the terrorist attacks reveals the deeply rooted binary distinction between East and West, Islam and Europe, “Them” and “Us”. Amid shock, a natural human (individual and collective) reaction is to search for a community to belong to. This community has to have a meaning and identity. But the identity is always relational and constructed in opposition to “Others”50, 51, perceived as outsiders or even enemies. The enemy serves as a mirror offering a (real or imaginary) distinction between “our” group and their group. This makes “Others” an indispensable ingredient for creating feelings of belonging. When this becomes a part of the collective social imaginary, it further fortifies the boundaries between the groups. The construction of social identity presupposes that the in-group differs significantly from the out-group. It also requires an ongoing process of maintaining and legitimizing these boundaries. In this case, “Us” is a transnational society in the making, based on the characteristics, values, heritage, and history of the Anglo-American, European, Western world. The “Western” world has been identified in opposition to Islam through large parts of its history—ranging from the conflicts throughout the Middle Ages, such as the Crusades and the Ottoman expansion, to the more contemporary tensions, such as the support for Israel and the Iraq wars4. Terrorist acts—especially if perpetrated by the religious extremists—are ideal mechanisms for recreating this effect.

In conjunction with a community and knowing what is and what is not part of it, we also need an understanding of “Us”, a narrative about who we are. This narrative is to contrast the narrative about “Them”, which is to explain who they are. Both narratives are usually articulated as a series of attributes about either side, as clearly revealed by the found broad categories. Specifically, the narrative of threatening Enemy to which “we” respond by Security contributes to the symbolic substance of “Us”, who are residing on “our” side of the boundary51. The social imaginary of the community pertains to a discursive manner of self-understanding, emerging via stories that people tell about themselves and thus construct their collective belonging52. In that regard, identities serve as narratives that enable the continuity of a community, form the foundation of the social collective memory, and unify a group through space and time53, 54.

The imminent threat may generate other ways of defining the enemy. A prominent human feature is to search for patterns in seemingly chaotic situations while maintaining the feeling of connection. We found this in the interest for conspiracies, which replace a visible enemy with a manufactured one. Worrisome adherence to online conspiracy theories is a large topic within computational social science55,56,57,58.

The last decades saw individuals’ lives grow apart from large bureaucratic institutions59. Individualism and consumerism caused the erosion of the collective loyalties, boosting the scepticism towards the state authority. This trend has been already observed in sociological classics60 and accelerated by modern technology and globalization61,62,63. Interestingly, terrorism seems to push in the opposite direction, towards re-establishing the bond with (presumably) protective institutions, operating at national level and provided by state authority.

We also found that intense focus on topics arising from terrorist attacks dissipates after a few weeks. Typically, it is overwhelmed by the never-yielding interest in entertainment. This is hardly surprising, given that the public is known to shorten its attention span43, 44, even during the COVID crisis45. This is in agreement with one of our results, namely, that the public tends to collectively remember only the most recent attacks (cf. Fig 2). In Appendix C, we show a side result: The amount of collective attention redirected from other routine interests due to terrorism is insignificant from the perspective of overall viewing behavior on Wikipedia (about 200–300 million views per day with weekly and seasonal oscillations). In other words, none of the attacks was ‘that interesting’ to divert major and lasting attention from entertainment.

Individuals’ prioritization of topics expresses narratives that they were brought up with. These involve social memories as a basis of collective (for instance national) identity, which includes cultural norms, notions of authenticity, power relations, etc. Our findings indicate that for international English-speaking audiences these narratives are centered around security, enemy, self-perception, and other-perception. In them we recognize a search for belonging and meaning in a globalizing late modern society, triggered by a sudden disruption. These results are in accord with the classical studies on the relationship between Europe (the West) and its neighbours (the East), referring especially to the collective perceptions of the “significant other”4. They call for reconsidering the classical ideas of nationalism, thus advancing the constructivist understanding of society51, which is detached from the actual physical places64. In that regard, we are consistent with the contemporary scholarly consideration of belonging, which is increasingly shifting towards transnational and virtual social reality, articulated through imagined communities and forged via “fragile communication bonds” such as common usage of English Wikipedia65,66,67.

Our results could benefit from an independent verification via sources other than Wikipedia, primarily involving social media. Still, the popularity of any tweet could be due to lack of a systematic répertoire of tweets, rather than genuine public interest in that tweet’s content. On the other hand, what else, besides terrorist attacks, diverts attention to the 69 articles from Table 1? Perhaps some articles react only to the terrorist attacks and could serve as ‘markers’. We examined this in the Appendix D and found no evidence for them. Another methodological challenge is the robustness against the modifications of exclusion criteria. We check this, and found that key results are robust against all meaningful modifications. For more on this and other robustness checks see Appendix E.

There are two main directions for advancing the presented work. First, spontaneous reaction to disruptive situations naturally involves languages other than English, both in Wikipedia and elsewhere. This makes online sources in other languages prime target of future work. Second, from how we made our sample of attacks, it just so turned out that all 15 of them were committed by Islamic extremists. But what about terrorist acts perpetrated, for example, by Western far-right groups? We fully acknowledge that terrorism can have very diverse origins and that public reactions to it must be investigated. In this light, it is also of interest to look at a wider time span, starting for example from Twin Towers attack in 2001.

Our conclusion is that while unfortunately terrorism is not likely to vanish soon, studies like this one can help understand the intricacies of the public reactions to it, and minimize the consequential societal damages such as extremism and polarization.

Data and methods

The sample of terrorist attacks

We considered all confirmed acts of terrorism in Europe starting from November 2015 Paris attacks until the end of 2018. Using Wikipedia’s information, we found 43 such acts but kept only those with at least two casualties excluding the attackers. This led us to a sample of 15 terrorist attacks across Europe (see Fig. 6 for the geographical location and the timeline of the incidents). Note that the available Wikipedia viewership logs commence from July 2015. This restricts our options in selecting the attacks and makes Paris 2015 the most suitable event to start from. Of course, had we had the access to data prior to 2015, we would have started our analysis from the New York attack of 2001 and possibly broaden it beyond Europe.

Figure 6
figure 6

Locations (cities) of 15 terrorist attacks comprising our sample. Attacks occurred between November 2015 (Paris) and May 2018 (Liege), as illustrated in the inset. See Appendix A for a comprehensive overview and details of each attack.

Data preparation

Our overarching aim is to examine the visits to all articles in English Wikipedia during the relevant period and identify those articles that are visited more frequently (receive excess attention) after a terrorist attack. We started by establishing a list of entries that can be considered valid articles68, 69. As of August 2019, this list contained 14,733,158 entries. Through Wikimedia API70 we can obtain the exact viewcount (number of visits) for an article on any day. This daily viewcount is a great proxy for the attention devoted to that topic by the international English-speaking audience. We retrieved the time series of daily viewcounts for the entire list with 14,733,158 entries from 1 January 2015 to 8 August 2019 (1680 days). Each value is the total number of visits to an article on a given day, cumulatively generated by entire online traffic from all devices with access to the Internet. We want to examine only those articles whose viewcounts spiked after terrorist attack(s) and whose content can be meaningfully connected to the attack. After the extensive exclusion procedure described below, we identified 69 such articles.

Sampling the articles around the time of Paris 2015 attack

We sample the articles for Fig. 1 by considering the 12 days surrounding the event. We found this time window most suitable for illustrating the dynamics of collective attention around the attack. We looked at the top 5 articles by viewcount on each of these 12 days. We then selected articles, that on at least 2 days (of these 12 days) received more than 100,000 views. This gave us the sample of 17 articles, shown vertically in Fig. 1.

Definition of excess attention

Excess attention, Z, is defined as follows. Let A be a Wikipedia article and T the time of a specific attack. The mean \(\mu (A,T)\) and standard deviation \({\sigma }(A,T)\) of viewcounts of A before the attack are calculated starting from 1st of January 2015 as:

$$\begin{aligned} \mu (A,T) = \frac{1}{\textit{T-1}}\sum _{\textit{t=1}}^{\textit{T-1}} w (A,t) \;\;, \;\;\;\;\;\; {\sigma }(A,T) = \sqrt{\frac{1}{\textit{T-1}}\sum _{t=1}^{T-1} \Big ( w (A,t) - \mu (A,T) \Big )^2} \;\;, \end{aligned}$$

where w(At) is the viewcount of A on the day t. Next, we compute \(\nu (A,T)\), the average viewcount of A in the week following the attack:

$$\begin{aligned} \nu (A,T) = \frac{1}{7} \Big ( w (A,T) + w (A,T+1) + \cdots + w (A,T+6) \Big ). \end{aligned}$$

Our choice of a week (7 days) as the period for averaging is motivated by pronounced weekly oscillations of overall viewcounts and in line with33 (see also Appendix C). Now we define Z(AT) as:

$$\begin{aligned} Z (A,T) = \frac{\nu (A,T) - \mu (A,T)}{{\sigma }(A,T)}. \end{aligned}$$
(1)

Excess attention measures the increase of mean viewcounts in a week after the event compared to the mean viewcount before the attack, expressed in the units of standard deviation characterizing the trend prior (our measure of Excess Attention is conceptually similar to Z-score, even if it is not exactly the same.) It can be computed for any article A in association with any attack T. For example, if an article displays \(Z=3\) in association with T, it means that in the week following T the visits to A have increased by 3 standard deviations compared to the average before T. This is our main tool in identifying the articles that have reacted to an attack in contrast to those that did not.

For Fig. 2 (right panel), since we need a more stable estimates of \(\mu\) and \({\sigma }\), we exclude the first 2 weeks after the older incident. For Fig. 4 (left panel), we assigned the total (cumulative) Z to each attack by summing Zs for all articles that reacted to that attack, cumulatively across all broad categories. We did the same for Fig. 4 (right panel), but summarizing each broad category separately.

Article exclusion steps

Step 1: Removal of stubs and redirects. Wikipedia uses the term “stub” for abnormally incomplete articles. Using the stub tags we identified and removed them. We also removed articles that only carry an alternative title and a link to the original article with the more conventional title (“redirects”). Starting from the complete list of articles in English Wikipedia, excluding all stubs and redirects left us with 5,876,878 articles.

Step 2: Exclusion of articles with low viewership. To filter our low view articles, we used a cut-off based on the maximal daily viewcount. We kept only the articles whose daily viewcount at least once reached 300. See Fig. 7 for the distribution of maximum daily views and our cut-off determined based on the “elbow rule”. This step left us with 912,192 articles.

Figure 7
figure 7

The distribution of maximal daily viewcounts (maximal number of views reached on a single day) between 1 January 2015 and 8 August 2019, for all 5,876,878 articles after Step 1. We kept only the articles in the shaded area, i.e., excluded those that were never visited more than 300 times on a single day. Note a slight change of slope near 300, making this a natural choice for cut-off.

Step 3: Removal of articles with small excess attention after attacks. Next, for each attack separately, we exclude articles that received no marked increase in attention immediately after the incident (true negatives). As threshold we use \(Z=3\): Assuming that viewcounts are normally distributed, the chance of observing \(Z \ge 3\) at random is \(p \sim 0.001\) (see also Appendix E). Upon excluding articles with \(Z<3\), we were left with 9000–24,000 articles per attack. To better illustrate this step, we show in Fig. 8 the viewcounts for three example articles around the time of Paris 2015. This filter is successful in detecting articles whose increase in viewcounts is related to the attack (true positive), but unsuccessful in filtering out articles that had an increase in viewcounts due to other unrelated events (false positive). An example is G20 that received spike in attention due to G20 meeting that accidentally took place around the same time as Paris 2015. We deal more with false positives later.

Figure 8
figure 8

Viewcounts of three articles around the time of the November 2015 Paris attack. Attention on the article in red peaks immediately after the attack, and given its content, we reasonably expect that this was a reaction to the attack (true positive). The article in grey exhibits no qualitative change, and indeed, given its topic (a city in Serbia), we did not expect any (true negative). The attention is devoted to the example in blue peaks, but this article’s content precludes us to attribute this to the attack (false positive).

Step 4: Automated removal based on content Inspecting the articles which passed the previous filters, we noticed common patterns in their topics, pointing to an overarching picture of the arising interests. Still, as too many events occur simultaneously, there were still too many false positives. To remove them, we employed semi-supervised Google’s text-miner BERT (Bidirectional Encoder Representations from Transformers)71, 72. It outputs a score that expresses how similar is the content of some text to the content of the training text. We prepared the training text by taking a random sample of 10% of articles for each attack and manually filtering out the articles which were not conceptually related to the attacks. We then extracted the summaries (Wikipedia calls ‘summary’ a brief description of the article’s content, available immediately after the title.) of all remaining articles and trained BERT on them. Then, we had BERT recognize the similar content in the summaries of all articles surviving Step 3. Upon completion, we were left with 1000–8000 articles per attack. We evaluated BERT’s performance by manually inspecting a 10% sample of thus excluded articles and indeed found them all true negatives.

Step 5: Distilling the reactions Our next aim is to identify themes that systematically appear in public interests and are not connected to a single attack. We put the surviving articles back together and remove those that reacted to less than three independent attacks, not counting as independent the reactions to events in the same week. In establishing what constitutes a reaction to an attack, we made two additional requirements:

  1. 1.

    Looking at some obvious false positives, we noticed that their viewcounts start increasing before the attack and hence clearly not due to the attack. To account for this we introduce \(Z_0 (A,T) = Z(A,T-7)\), the Z-score for a week immediately before the attack. We found \(Z_0\) to be unusually large for most false positives. Yet, a slightly increased \(Z_0\) is not problematic as long as it is followed by a considerably higher Z post-attack. For consistency with earlier steps, we requested

    $$\begin{aligned} Z (A,T) > 2 + \frac{3}{3-Z_0 (A,T)} \;\; \end{aligned}$$

    for every reaction of A to T. Hence, for an article with \(Z_0 = 1\) we request at least \(Z=3.5\), for articles with \(Z_0 = 2\) at least \(Z=5\), etc.

  2. 2.

    Since the mean \(\mu (A,T)\) appears in the denominator of Eq. (1), Z is more volatile when \(\mu (A,T)\) is small. An unusually high Z found for A with small \(\mu\) could easily be an artifact (division by a number very close to zero). To account for this, we excluded the reactions of articles A to attacks T whenever we found \(\mu (A,T) < 20\).

See Fig. 9 for illustration. This step left us with 86 articles.

Figure 9
figure 9

Examples of four articles identified in Step 5. Top left: viewcount time series of Terrorist incidents linked to ISIL from 1 March 2017 to 1 September 2017. Attacks that occurred during those 6 months are indicated. Top right: the histogram of Z-scores for that article for the entire time span (region \(Z>3\) is shaded). Other panels: same as on the top panels (left and right) for other three examples of articles. These plots demonstrate how well the threshold \(Z=3\) separates day-to-day fluctuations from what we can consider a reaction to an attack.

Step 6: Qualitative (manual) exclusion based on content. We next inspected a broader context of every remaining article around the time of each observed reaction. We assigned a thematic code to each article using open coding73 based on two criteria:

  • consideration of the articles’ ontent and its thematic relevance from the perspective of each particular attack,

  • timing of its appearance in terms of accidental coinciding with other unrelated but simultaneously occurring events (possible false positives).

We excluded 17 articles as we found them to coincide with: sporting events; launching of movies and TV shows; music events, personalities and their media coverage; and other accidentally coinciding events (solar eclipse, legislation procedures, cultural events, etc.). There were three articles on the Syrian civil war: the Palmyra offensive in March 2016, the Russian offensive in November 2015, and the US response to the alleged chemical attack by the Syrian regime in April 2017. Upon very close inspection we could not connect them to the terrorist events in Europe. This left us with 69 articles, shown in Table 1.

Table 1 The list of 69 English Wikipedia articles that have reacted to at least three independent attacks.

Construction of specific categories

Table 1 is a succinct list of what the public becomes interested in following a terrorist attack. Not surprisingly, it includes terrorism, weapons, and anti-Islamism, but also national identity, the violent history of the West, and conspiracy theories. As many articles have similar content, we used axial coding73 to extract their thematic codes and connect them. By this, we manually cluster the articles into meaningful groups, defined by the coherency of their content. We call these groups specific categories and assign a name to each of them that summarizes the content. The 69 articles from Table 1 are arranged into the following 19 specific categories.

  1. 1.

    Terrorism in general. Definitional aspects of terrorism, such as what constitutes a mass shooting and what is a massacre (3 articles).

  2. 2.

    Islamic terrorism. Past Islamic terrorist acts and organizations, regardless of location, context, and targets (9 articles).

  3. 3.

    Non-Islamic terrorism. Far-right and far-left terrorism and extremism in the West, not related to Islam (3 articles).

  4. 4.

    Terrorism in Western countries. Summaries of terrorist activities in the West, including those not part of our sample, regardless of religious/ideological origin (7 articles).

  5. 5.

    Conspiracies. Possible conspiracies behind or related to the attacks (1 article).

  6. 6.

    National security. Western security and defence institutions, their official weaponry, conscription policies and related legal frameworks (9 articles).

  7. 7.

    Weapons. Weapons for personal defence and comparisons among them (e.g. AK47 vs. M16), firearms legislation and purchasing regulations (7 articles).

  8. 8.

    Transport options. Public transportation infrastructure, including air travel, railroads, and highways (5 articles).

  9. 9.

    Insurance options. Financial security and purchasing of insurance (2 articles).

  10. 10.

    Equipment for survival. Purchasing equipment for surviving in the wild (1 article).

  11. 11.

    Islam in general. Islam religious figures (1 article).

  12. 12.

    Islam in Western countries. Muslim religious institutions, figures, and practices in the West (4 articles).

  13. 13.

    Islam in Non-western countries. Role and history of Islam in non-Western countries (1 article).

  14. 14.

    About Middle East. Locations and history of the Middle East (1 article).

  15. 15.

    National identity. Generalities about Western nations and their political order (1 article).

  16. 16.

    Religious identity. Christian religious institutions in the West (1 article).

  17. 17.

    Activism in general. Western political activists and writers, not related to Islam (2 articles).

  18. 18.

    Anti-Islam activism. Western far-right politicians, public figures and anti-Islam extremists (5 articles).

  19. 19.

    Violent history of Western countries Violent historic events in the West, famous battles in the two World Wars, local wars of independence (6 articles).

Arrangement of individual articles from Table 1 into above 19 specific categories is shown in form of table in Appendix B.

Construction of broad categories

The above organization of articles into specific categories is not immune to ambiguities, such as placing an article into one category or another or merging or splitting categories. We resolve this by noticing similarities across specific categories’ thematic codes. For instance, categories 1–4 revolve around terrorism, whereas categories 11–14 deal with varying aspects of Islam and its relation to (real or perceived) perpetrators. This allows us to coarse-grain 19 specific categories into four broad categories: Enemy (Specific categories 1–5, 23 articles), Security (Specific categories 6–10, 24 articles), Other-perception (Specific categories 11–14, 7 articles), and Self-perception (Specific categories 15–19, 15 articles).

We verified that the topical coherency of broad categories is robust against the above ambiguities and even against the most meaningful modifications of the exclusion choices (e.g. requesting the reaction to only two independent attacks). To further increase the reliability and validity, we sought to define their thematic codes in the context of discourse analysis. We applied intra-coding in terms of re-checking broad categories’ thematic codes 12 months after the initial coding process and found them to be consistent (We decided against deploying inter-coded reliability since we did not find it compatible with recursive and incremental nature of our coding process.). Thus constructed broad categories are universal and interpretable as the broad public interests awakened by any terrorist act.