Prevention has no anniversary
Photo of Utøya taken by Bjørn Ihler on a drive towards a conference against polarisation.
This week, Norway marked fifteen years since the attacks of 22 July 2011, in which 77 people were killed in the government quarter and on Utøya. As a Norwegian company focused on counter terrorism, the attack is an important part of the origin story of Revontulet.
Commemoration is, by its nature, concentrated: a day of ceremonies, coverage, and public commitment, followed by a return to ordinary attention. The threat the commemoration refers to follows no such calendar.
This is not a criticism of commemoration. Remembrance days are important: they transmit the record to people who were not there, they honour those who were lost, and they renew public commitments that would otherwise fade. But a prevention capability cannot be built to the rhythm of commemoration. It must work every day.
The extremist ecosystems Revontulet tracks operate continuously. The Guardian's reporting this week on the 764 network and the wider Com ecosystem describes children being groomed, extorted, and pushed toward violence and self-harm as a matter of routine, across games and chat platforms, with perpetrators and victims in dozens of countries. Recruitment into these environments happens wherever young people are, every day.
Disruption, when it succeeds, happens at the same tempo. When our analysts identified discussions of a planned attack on a Pride festival in channels linked to a neo-Nazi network, as Digi.no reported this week, the discovery was made in the course of ordinary monitoring on an ordinary working day, and the attack was averted through sustained work with police and intelligence services in the days that followed. None of that work coincided with a date of significance. It could not have: by the time a date matters, prevention has already failed.
The factual record itself now also requires continuous maintenance. This week, together with Factiverse, we published an audit of how nine leading AI models handle the factual record of 22 July and the conspiracy theories constructed around it. Nine in ten Norwegian students use AI in their studies, and for a generation born after 2011, a chatbot is increasingly the first place questions about the attack are asked. The audit found that models largely reproduce the facts correctly while mishandling the framing. Conspiracy narratives were repeated without being labelled as such, or at times rejected outright and then reintroduced in softer language, or reproduced through translation requests. In responses to public coverage on Revontulet’s work on the day, we also saw commenters promoting harmful and conspiratorial narratives. Memory, in other words, is not something a society keeps only by intending to. Memory is infrastructure, and infrastructure degrades without maintenance.
Prevention faces a structural disadvantage in sustaining that kind of continuous effort: its successes are, by design, invisible. When the work succeeds, nothing happens. There is no incident to report, no anniversary to mark, no image for the news. Attacks that did not take place, networks dismantled before they found their next recruit, young people reached before the pull became irreversible: these outcomes produce no coverage. Fields where the victories are invisible are systematically easier to fund in the aftermath of failure than in the long quiet stretches that are, in fact, the evidence of success.
Revontulet was founded on the conviction that no threat emerges in isolation. Fifteen years of evidence since 2011 support the mirror image: no defence is built in isolation either. Prevention that works is a web of actors doing continuous, mostly unglamorous work: schools and health services that recognise patterns early, municipalities that maintain a real threat picture, platforms that act on network analysis, police services handed evidence they can use, researchers who share what they find, journalists who cover without amplifying.
Our role in that web is specific. We map the networks and carry the intelligence layer across platforms, languages, and jurisdictions the threat crosses. But the web holds, or fails, as a whole.
The practical conclusion is the one the anniversary itself cannot deliver: prevention has to be resourced as standing infrastructure rather than as crisis response. That means institutions that fund and staff this work in the months when nothing is in the news, cooperation that runs across sectors and borders as the default rather than the exception. And it requires capital patient enough for safety technology whose successes will never generate headlines. The measure of a society's commitment to "never again" is not what is said each July. It is what is maintained in the other 364 days.
Our founder, who survived Utøya, has written for fifteen years and worked every one of them under a single commitment: keeping future generations safe from the kind of pain and suffering of 2011.
Revontulet's contribution is narrower and constant: we watch, so that the quiet days stay quiet.
Links:
The Guardian on 764 and the Com: https://www.theguardian.com/technology/ng-interactive/2026/jul/21/764-network-gamification-of-harm-the-com-cybercrime-ntwnfb
Digi.no on the averted Pride attack: https://www.digi.no/artikler/overlevde-utoya-bidro-til-a-avverge-pride-angrep/574904
Factiverse x Revontulet LLM audit: https://www.factiverse.ai/reports/llm-audit-22-july-conspiracy-theories