By James Stratton

    MADISON, Wisconsin (WISN) -- In the months leading up to a school shooting in Madison last December, 15-year-old Natalie Rupnow was openly discussing an attack online, according to court records, before she killed teacher Erin West, student Rubi Vergara, and then turned the gun on herself at Abundant Life Christian School.

Police rushed to Abundant Life Christian School last December, responding to yet another tragedy striking a place of learning. Since the attack, investigators and researchers have been digging into Rupnow's very public online past, piecing together the puzzle of her actions.

"She exhibits many of the same behavioral characteristics that we've seen in virtually every other mass shooting that's occurred in the United States over the last 10 years," John Cohen, a former counterterrorism official at the Department of Homeland Security and now an ABC contributor, said. Cohen now leads a team of researchers at the Center for Internet Security.

Social media accounts showed Rupnow viewing and sharing content glorifying violence, attacks and other school shooters.

A post on X, from an account believed to be hers, showed video of a Swedish stabbing attack from 2015, where a man killed three people with a sword. Research shows Rupnow viewed and commented on a mass stabbing in Turkey livestreamed on Telegram.

"At least he did it," one Telegram group member commented.

"Credit for that at least," she responded.

True Crime Community:

Researchers say these posts and her online actions fit the mold of the internet group "True Crime Community," or TCC.

The online group often focuses on mass shootings and other crimes, researching and in some cases idolizing previous attacks.

"TCC and other similar online forums are one location online where individuals who are seeking justification for their desire to engage in violence, to express their anger at society, to express their feeling of being a victim, and they consume content found on those forums," Cohen explained.

With no clear motive or ideology, attackers find like-minded individuals and methods all online, "... consuming content that's placed there by terrorist groups, extremists and others," Cohen said.

Rupnow viewed the Turkish attack live in August, and four months later, she committed her own. Minutes before her attack, she shared a photo on X of the "OK" symbol and a locked Google Doc, which may have been a link to what investigators now describe as the manifesto they found.

The manifesto, titled "War Against Humanity," used a derogatory term for Black people, court records state. The manifesto also had names and information about other mass shooters and attackers, and it called the Turkish stabber "[a]n Ultimate saint."

“The Revolution should be well," the manifesto states, according to court records. "The population should be well, but it’s not and never will be. I want to change that, but will I truly?”

"These individuals who are prone to violence consume content, to self-connect with a blend of ideological beliefs, personal grievances, internet culture beliefs, even self-awareness of their own mental health issues, they use that as a justification to go out and commit mass murder," Cohen said.

"Which is what the Madison school shooter did?" 12 News investigative reporter James Stratton asked.

"Which is exactly what the Madison school shooter did," he responded.

Rupnow's online reach:

Rupnow's online web spreads from Madison to Southern California, Florida and Tennessee.

A month after the Madison shooting, 17-year-old Solomon Henderson committed an eerily similar attack near Nashville, killing a classmate, injuring another and turning the gun on himself. Researchers say he posted photos of Rupnow, including a meme of her, the day before he opened fire.

"He was very impressed when he found out that she had committed an attack and that they had direct social media connection," said Peter Smith, a researcher and journalist with the Canadian Anti-Hate Network.

"He was idolizing her in the same way she was idolizing other shooters and attackers?"Stratton said.

"Absolutely," Smith responded.

FBI and local police caught two others planning attacks. Police near San Diego detained Alexander Paffendorf and searched his home. Court records say he told Rupnow he would target a government building.

Prosecutors never charged Paffendorf but barred him from owning or having guns.

"In terms of the gun violence protective order, whatever you feel is necessary and Carlsbad Police Department feel is necessary, I'm willing to accept, just for future reference," Paffendorf said in court.

Near Palm Beach, Florida, in late April, police arrested Damien Allen, who they say was plotting his own attack. They confiscated his weapons, ammunition and police uniforms. In what appeared to be an online relationship with the underage Rupnow, Allen told her he loved her and said he had seven places he would "strike."

Previous online warnings:

Court records show Madison police warned her father she was on the internet engaging in "high-risk behavior." It's unclear what was done then, as Madison police won't share any of the documents. Madison police also declined multiple requests for an interview.

Since her attack, offshoot TikTok accounts with her name have popped up in the TCC community, where people, likely kids and teens, share videos and memes with her photos. Many share Henderson's photo and Rupnow's in the same online videos.

The connection between Rupnow and the others, and the idolatry of Rupnow online, further shows how intertwined the community is, revealing layer after online layer police have to continue to dig through in the months after virtually every tragedy.

"We are in a place today where law enforcement is beginning to catch up with a threat that evolves at internet speed," Cohen said.

Police also arrested Rupnow's father, Jeffrey Rupnow, charging him with giving her access to the guns she used in the shooting.

Cohen emphasized that parents need to act quickly if they see their kid engaging with this type of content online, as quick action and a call to local police can stop an attack from happening.

Please note: This content carries a strict local market embargo. If you share the same market as the contributor of this article, you may not use it on any platform.