Two Dangerous Young Men in the UK — Why One Was Stopped, and the Other Was Missed
What pre-attack behaviour reveals about the Southport and Coleman cases — and the gap in UK threat assessment.
In July 2024, Axel Rudakubana walked into a children’s dance class in Southport and murdered three young girls. He tried to kill many more.
- It was deliberate.
- It was sustained.
- And it was planned weeks in advance.
- He had a history of violence.
- He had carried weapons.
- He had been on the radar for years.
- He still wasn’t stopped.
Less than a year earlier, in September 2023, Alfie Coleman was arrested before he could carry out his own attack.
- He had bought a pistol and 200 rounds of ammunition.
- He had written a manifesto.
- He had compiled a hate list.
- He had taken clear, real-world steps towards mass violence.
- He was stopped.
Two young men. Both dangerous. Both are moving in the same direction. One was stopped. One wasn’t.
Why?
The answer isn’t where most people look.
Start with the right question
When attacks like Southport happen, people reach for labels.
- Terrorism.
- Extremism.
- Mental health.
That’s understandable. It also explains very little.
The better starting point is simpler. What is this person moving towards?
That question has structure behind it. The structure is well established in threat assessment, and, crucially, it works without requiring an ideology.
The framework that should have been used
The most useful tool here is Dr J. Reid Meloy’s TRAP-18 — the Terrorist Radicalisation Assessment Protocol. It was designed for exactly this kind of case: lone actors moving towards targeted violence, with or without a coherent cause.
It identifies eight pre-attack warning behaviours that consistently appear in lone-actor attackers, regardless of ideology.
- Pathway — research, planning, and preparation for an attack.
- Fixation — pathological preoccupation with a person or cause.
- Identification — self-image as a warrior or agent of change.
- Novel aggression — an early violent act that functions as a rehearsal.
- Energy burst — acceleration of activity in the run-up.
- Leakage — telling someone, anyone, what they intend to do.
- Last resort — a sense that they must act, and act now.
- Directly communicated threat — explicit warning to a target or authority.
In studies of lone-actor attackers, four of these — pathway, fixation, identification, and leakage — appear in over 70 per cent of cases. Alongside them sit the distal characteristics: personal grievance, ideology, dependence on online communities, and a prior history of violence.
This is the grid both cases sit on.
The contrast at a glance
| Pre-attack behaviour | Axel Rudakubana | Alfie Coleman |
| Pathway | Bought a chef’s knife online 16 days before the attack.
Booked a taxi under the false name “Simon”. Read the al-Qaeda training manual on knife attacks, including instruction on targeting the head and neck — mirrored in the autopsy findings. Produced ricin pulp following the same manual; expert evidence put the potential yield, with further purification, at up to 1,269 fatal doses. Identified a children’s party at a known venue and travelled directly to it. |
Five-year preparation arc from age 14.
Downloaded weapons and explosives manuals; saved several extreme-right manifestos. An earlier plan to attack a mosque in France using a Skorpion automatic and an AK-47 was abandoned. Sourced a Makarov pistol and 200 rounds via online forums. Carried £3,500 cash to the handover. Kept a counter-surveillance bug-detector in his bedside drawer. |
| Fixation | A senior official described him as “absolutely obsessed” with violence and genocide.
Material on his devices spanned the Rwandan genocide, Hitler, Genghis Khan, the Mau Mau rebellion, Somali “clan cleansing”, slave punishments, and multiple wars. Expressed approval of the 2017 Manchester Arena attack — itself targeted at children at a music event. |
Five-year preoccupation with extreme-right material from age 14.
Compiled a “hate list” of colleagues and customers from his Tesco job, including car registrations. “Captivated” by a book commemorating public hangings of “white race traitors”. |
| Identification | Diffuse and incoherent. Admired killers and tyrants across opposed ideologies.
No single warrior identity to lock onto. No manifesto. No group affiliation. His self-image was organised around violence itself, not a cause. |
Idolised Hitler, Thomas Mair (the killer of Jo Cox), Dylann Roof and Brenton Tarrant.
Crisp and ideological. Photographed himself in a skull mask holding a knife. Black Sun flag on the bedroom wall. Swastika rock on the table.
|
| Novel aggression | Took knives into school on at least 10 separate occasions before exclusion.
Aged 13, he returned to the school he had been excluded from, carrying a knife and a hockey stick. Broke another pupil’s wrist with the stick. Police record: he intended to “finish him off with the knife” and was “not bothered by the prospects of prison.” |
Less classical novel aggression. Trajectory visible through escalating weapons collection.
Knives in the bedside drawer; air rifle; small stone axe; Gerber Strong Arm combat knife ordered two days before the gun pickup. The September 2023 weapons buy itself functioned as the operational threshold. |
| Energy burst | Tight pre-attack window once the target was selected.
Knife purchased on 13 July. The attack occurred on 29 July. |
Highly visible acceleration through summer 2023.
Two days before pickup, I ordered the combat knife online. |
| Leakage | As a teenager, he phoned Childline asking: “What should I do if I want to kill somebody?”
Searched for school shootings and weapons during lessons on his school account. Talked openly at school about stabbing people. Three Prevent referrals between 2019 and 2021. Pupils took concerning social media posts to the head teacher. At least 15 contact points with public services. |
Almost entirely online. Forum activity, encrypted chat, and his own diary/manifesto.
Wrote his own diary-form manifesto modelled on those of his idols. Emailed Patriotic Alternative in July 2021, asking to “start participating in activism.” Six days before the arrest, he posted a picture of an armed, balaclava-clad figure with the comment, “Coming soon here, my man.”
|
| Last resort | Less classical. A sustained, brewing intent over several years rather than a clear time-imperative.
But the 16-day operational window and method-shopping (knife or ricin) show settled intent. |
Textbook last-resort signalling.
Two days before pickup, wrote: “Just something has gotta be done, how long can we sit here and talk over the internet?”
|
| Directly communicated threat | None to a named target before the attack.
|
No specific pre-attack threat to a named target.
|
What the contrast reveals
Both men ticked several of the eight pre-attack warning behaviours.
The difference was not what they did.
The difference was how legible their behaviour was to the system.
Coleman’s behaviour was anchored to a coherent ideology. That made him easier to recognise, investigate, and prosecute.
- He wrote a manifesto. He saved Tarrant’s.
- He kept a swastika rock on a table and a Black Sun flag on the wall.
- He photographed himself in a skull mask holding a knife.
- He emailed Patriotic Alternative asking to “start participating in activism.”
- He also idolised Thomas Mair — the man who murdered the Labour MP Jo Cox in 2016.
That places him in a specific UK lineage of lone-actor extreme-right violence. It is the same lineage that, after Jo Cox’s murder, led me to build the specialist threat assessment team inside Parliament that has since identified and prevented a planned terrorist attack against a sitting MP.
He fitted the picture.
Rudakubana didn’t.
- His grievance was internal and chaotic.
- His fixation was on violence itself, not on a cause or ideology.
- His identification reached across opposing extremes — Hitler, Gaddafi, the Manchester Arena bomber, Genghis Khan, the Rwandan genocide, and the Mau Mau.
- He had no manifesto.
- He had no group.
- He had no ideology in the legal sense.
- He had, however, asked Childline as a teenager: “What should I do if I want to kill somebody?”
- He had taken a knife into school on at least ten separate occasions.
- He had walked back into the school, where he had been excluded, carrying a knife and a hockey stick, broken a fellow pupil’s wrist with the stick, and told police he intended to finish the boy off with the knife. He was thirteen.
- He had been referred to Prevent three times.
- He had produced enough ricin pulp to kill, with further purification, more than a thousand people.
- He was not hidden.
The post-Southport Prevent Learning Review concluded he should have been referred to the Channel after the first referral.
The wrong question, and the right one
The system kept asking, “What does he believe?”
Because there was no clear answer, the concern reduced.
The right question was always, “What is he moving towards?”
Behaviourally, the answer was clear from 2019.
- Researching mass shootings.
- Talking about stabbing people.
- Approving of the Manchester Arena attack.
- Carrying knives.
- Acting on his anger.
- Producing a biological toxin.
- Buying a knife online.
- Booking a taxi under a false name.
- Walking into a children’s party with a chef’s knife and the intent to kill all twenty-six girls inside.
- You did not need an ideology to see this.
You needed a framework that could function without one.
And the framework already existed
This is the part that should sit uncomfortably with anyone reading.
In June 2019 — six months before Rudakubana’s first Prevent referral — the Home Office and Counter Terrorism Policing issued joint guidance to all Regional Prevent Coordinators on what they then called Mixed, Unclear or Unstable extremism. MUU.
The guidance specifically named “obsession with massacre, or extreme or mass violence, without specifically targeting a particular group” as a qualifying scenario.
It was written for cases like Rudakubana.
The category was there.
The Prevent Learning Review confirms it wasn’t applied properly.
Coleman’s case fitted the older, ideological model. Rudakubana’s case fitted the newer one.
The newer one wasn’t used.
Why this matters now
There is a generational pattern emerging in the UK that I see in my own threat work, and that senior officers at Counter Terrorism Policing and MI5 have begun to publicly name.
One in five counter-terrorism cases in the UK now involves a child.
Coleman was radicalised at fourteen. Rudakubana was carrying knives into school at thirteen.
Helen Flanagan, head of operations for the Met’s Counter Terrorism Command, has called the trend “sadly becoming more and more prevalent.”
What the two cases tell us together is that the next generation of attackers will not all look like Coleman.
Some will. Many will not.
The ones who don’t will look like Rudakubana — driven by personal grievance, fed by an online diet of indiscriminate violence, untethered from any single cause, and operating below the threshold that ideology-led counter-terrorism was built to detect.
The hard truth
If we keep looking for what these young people believe, we will keep missing what they are preparing to do.
The behaviours are the signal. The ideology is the noise.
The frameworks already exist to read the signal.
The question is whether we are willing to use them.
