2011 Norway Attacks

2011 Norway Attacks, are terrorist acts carried out by Anders Behring Breivik on 22 July 2011, involving a bombing in government buildings in Oslo and an armed attack on Utøya Island. The bombing targeting government buildings in Oslo killed eight people, while the armed attack on Utøya Island, aimed at a summer camp organized by the youth wing of the Norwegian Labour Party, resulted in the deaths of 69 people. Following extensive logistical preparation, online radicalization, ideological propaganda, and operational planning, the subsequent investigation and trial process conclusively established the perpetrator’s criminal responsibility; the 22 July Commission was established to evaluate structural and operational deficiencies in the preparedness and response of public institutions.

Lone actor terrorism defines politically, ideologically or religiously motivated violent acts carried out by individuals independently, without direct affiliation to an organizational or hierarchical terrorist group. In this model of terrorism, the perpetrator fully autonomously shapes the operational design, target selection and tactical details of the violent act. The absence of a rigid command-and-control structure, unlike in traditional terrorist organizations, functions as a key operational factor that makes it difficult for intelligence units and security forces to detect lone actors in advance or prevent their actions. Although attackers may draw inspiration from the general ideological infrastructure, publications or rhetoric of terrorist organizations, they are not directly integrated into any organizational structure during the planning and execution phases.^【1】

^{Fail Anders Behring Breivik (}Anadolu Ajansı⁾

In the development of this form of terrorism, the leaderless resistance strategy, popularized for tactical purposes by far-right groups in Europe especially in the late twentieth century, has provided a decisive conceptual foundation. The leaderless resistance approach anticipates that violent acts against state institutions and ideological targets are carried out by small autonomous cells or isolated individuals without any central command and control mechanism. Lone actor attacks are structurally distinct from the concept of sleeper cells as extensions of terrorist networks. While sleeper cells await operational instructions from a leader as hidden components of a hierarchical network, lone actors complete their radicalization process and independently determine the initiative and timing of their actions.^【2】

The fact that lone actors operate alone in operational and tactical terms does not imply absolute social or ideological isolation and seclusion. Individuals continuously interact with extremist groups or other autonomous individuals sharing similar radical views through online platforms, social networks, closed forums and the dark web, deepening their own radicalization processes. The internet infrastructure provides lone actors with an extensive asymmetric training and motivation environment through indirect means on critical issues such as ideological support, theoretical rationalization, explosive manufacturing techniques, weapon modification and attack planning.^【3】

To classify lone actor attacks more systematically, academic literature has developed multidimensional typologies. In Raffaello Pantucci’s model, there are progressive categories such as solitary, lone wolf, lone wolf pack and lone aggressor, while Bates’ model considers analytical variables such as the perpetrator’s radicalization process, ideological motivation and chaos or career-oriented attack forms. Lone actors in the chaos form generally aim to achieve maximum impact in terms of casualties and public visibility by designing a single large-scale destructive attack, and within this strategy they accept from the outset the high probability of their own death or long-term imprisonment by law enforcement.^【4】

The perpetrator of the 22 July 2011 attacks, Anders Behring Breivik, possesses a far-right, anti-multicultural, anti-immigrant and clearly anti-Marxist ideological profile. In his manifesto, based on the belief that Christian Western European culture and demographics are at risk of extinction due to mass immigration policies implemented, he identified halting the Islamization of Europe as his primary mission. This ideology is built on the fundamental argument that Western civilization has been deliberately betrayed by cultural Marxists and left-leaning multicultural advocates, creating the conditions for Muslim immigrants to invade the European continent.^【5】

^{Anders Behring Breivik (}Anadolu Ajansı⁾

The perpetrator’s radical ideology has been detailed and systematized with historical references in a comprehensive manifesto he compiled from data gathered online and published digitally under the title “2083: A European Declaration of Independence.” In this text, it is theoretically explained that the planned violent acts are not directed directly at immigrants or minorities, but at members of the Norwegian Labour Party and future political elites whom he views as the primary enforcers of multicultural policies. The violent acts envisioned by the perpetrator were designed as a strategic shock doctrine to awaken European nations from complacency and were justified as a morally necessary intervention to save the existing Western civilization from collapse.^【6】

The perpetrator’s stages of radicalization over time exhibit a progressive acceleration according to academic radicalization models. According to Fathali M. Moghaddam’s staircase model, the perpetrator developed a sense of injustice and social unfairness at the ground level through international events such as the demographic Islamization of Europe and NATO’s military intervention in Serbia. As he climbed higher steps of the staircase, he became convinced that democratic political avenues were entirely ineffective in preventing cultural decay, redirected his political anger toward political officials who constructed the multicultural integration system, and internalized terrorism as a legitimate and definitive solution for creating a social revolution.^【7】

When examined within Marc Sageman’s leaderless resistance model, the perpetrator’s radicalization was triggered by an intense feeling of hatred developed in response to perceived moral violations and transformed into an operational mission through interactions on online networks. Within the framework of Clark McCauley and Sophia Moskalenko’s idea and action radicalization model, it becomes evident that the perpetrator first became ideologically and intellectually attached to far-right ideologies, and then assumed personal responsibility for translating these ideas into physical violent practice. This ideological radicalization was reinforced by anonymous racist identities on internet forums and evolved into an operational and practical violent design.^【8】

^{The Room Where Breivik Planned His Attacks (}Regjeringen⁾

Online platforms hosting Islamophobic and far-right blog texts, anti-immigrant conspiracy theories and virtual nationalist forums played a decisive catalytic role in the final transformation of the perpetrator’s radical views into a violent act. Within the closed cyber universe he constructed online, he collected ideological articles supporting his views to reinforce his radical belief system, and through these virtual socialization mechanisms, he translated his ideological construct into a concrete terrorist operation. The feeling of being consciously excluded from mainstream democratic politics and traditional media channels accelerated his online radicalization and ideologically prepared him for unlawful military actions to be carried out alone.^【9】

The operational planning and logistical preparation of the 22 July 2011 terrorist attacks began years before the actual date and were conducted systematically, with strict secrecy and over a multi-stage timeline. To procure the key technical component of the explosive device to be used in the bombing in the capital—synthetic fertilizer—without arousing suspicion and in large quantities, the perpetrator established a front agricultural company named Breivik Geofarm in May 2009. The company legally legitimized the bulk purchase of limited chemical substances under the guise of civilian commercial use, enabling the establishment of a heavy logistical infrastructure without attracting the attention of security or intelligence agencies.^【10】

^{Glomma Nehri Kıyısındaki Valstua Çiftliği - Çiftlik, Bomba Üretimi İçin Bir Paravan Olarak Kullanılıyordu (}Regjeringen⁾

The material and financial preparation for the planned attacks was based on a long-term, phased and highly planned banking and credit card strategy. Beginning in the autumn of 2009, the perpetrator obtained at least nine different credit cards by securing high credit limits from numerous financial and banking institutions, but avoided actively using these cards for large expenditures until the final preparation phase of the operation. When the perpetrator’s personal bank accounts were completely depleted in April 2011, he used these credit cards exclusively to finance material purchases, thereby injecting the necessary cash capital into the system for bomb production and military equipment acquisitions, leaving banks with credit debt amounts exceeding tens of thousands of kroner by the day of the attack.^【11】

The procurement of firearms, ballistic weapons and other operational equipment for the attacks simultaneously utilized both domestic Norwegian and global international market channels. The perpetrator obtained legal permits to purchase a rifle, a pistol and a pump-action shotgun by becoming a formal member of local hunting and shooting clubs in full compliance with Norwegian legislation. These civilian-standard weapons were upgraded to near-military assault standards through mechanical modification parts, specialized optical scopes and extended-capacity magazines ordered online from countries such as the United States and Hong Kong. Equipment such as a fake police uniform, camouflage sights and ballistic vests were also acquired piece by piece through international courier companies and the internet and assembled by the perpetrator.^【12】

^{Bomba Ahırın İçinde Üretildi, Dışarıdan İçeri Bakılmasını Önlemek İçin Pencereler Plastikle Kaplandı (}Regjeringen⁾

The construction of the high-explosive device involved the procurement and stockpiling of chemicals such as sodium nitrite, aluminum powder and sulfuric acid through numerous industrial suppliers abroad via the internet. In May 2011, the perpetrator rented a farm in Vålstua, Åsta region, with cash payment to establish a completely isolated and secluded production laboratory, where he personally manufactured a large bomb weighing approximately 950 kilograms composed of ammonium nitrate and a flammable diesel mixture. The homogeneous processing of the bomb components was completed over weeks of intensive work using specialized industrial mixers and technical equipment, and the explosive device’s capacity was physically tested in a controlled detonation on 12 June 2011 in an uninhabited forested area.^【13】

^{The Government District in Its State Prior to the July 22 Terror Attack (}Regjeringen⁾

In the final phase of the preparation timeline, logistical reconnaissance of targets and the global digital distribution of the operational manifesto took place. To transport the bomb prepared at the farm to a location near government buildings in Oslo, the perpetrator rented a commercial cargo minibus and precisely calculated the coordinates for its parking using prior reconnaissance trips. On the day of the massacre, just hours before the bombing, he simultaneously emailed his comprehensive manifesto, explaining the ideological foundation of the attack, to thousands of email addresses and proceeded toward his targets. Throughout this entire process, the perpetrator’s complete isolation from his social circle, careful concealment of banking and digital traces, and use of anonymous methods in communication networks prevented national intelligence and security units from detecting the impending terrorist attack and enabled the attacks to reach their targets.^【14】

^{Bombalı Araç, Yüksek Katlı Binanın Önünde Dönüyor (}Regjeringen⁾

The first phase of the terrorist acts carried out on 22 July 2011 in Norway’s capital Oslo was executed as a bombing directly targeting central government buildings. After a prolonged preparation phase, on 22 July at approximately 15:17, the perpetrator parked a Volkswagen Crafter commercial minibus with license plate BR 99834 immediately outside the main entrance of the H-Blok building, which housed the Prime Minister’s Office and the Ministry of Justice. In the cargo compartment of this vehicle was a homemade explosive device weighing approximately 950 kilograms, specially manufactured from synthetic fertilizer, diesel fuel and aluminum powder. After positioning the vehicle at the target location, the perpetrator activated the detonation mechanism and ignited a fuse with a seven-minute burn time to allow sufficient operational delay for him to walk away from the scene and use his pre-planned escape route.^【15】

^{Patlama Anı (}Regjeringen⁾

The detonated explosive device exploded at precisely 15:25:22, generating an extremely violent blast force and destructive shockwave exactly as the perpetrator had designed. The H-Blok building and surrounding ministry buildings at the epicenter suffered extensive structural damage due to this powerful shockwave. The physical impact of the explosion was so intense that windows of buildings up to 500 meters away were shattered and facades damaged. The shockwave shattered reinforced concrete structures in the lower floors of the buildings and turned office furniture, glass and metal components into lethal shrapnel fragments hurled into the surroundings. Physical structures at Einar Gerhardsen Square and Grubbegata Street were completely reduced to rubble at the moment of the explosion.^【16】

^{Top Photo: The bomb-laden vehicle created a crater two levels deep toward the underground tunnel system. Bottom Photo: A fire broke out in R4 (}Regjeringen⁾

The timing of the attack was one of the most important demographic factors directly affecting potential casualty statistics. The date of 22 July coincides with the middle of Norway’s traditional summer holiday period, and the fact that the incident occurred close to the end of a Friday workday minimized the number of personnel present in the buildings. Although approximately 3,100 public employees normally work in the area known as Regjeringskvartalet (Government Quarter), only about 250 employees were present in the H-Blok building and surrounding structures at the time of the explosion, and approximately 75 pedestrians were on the streets. This human presence, at only about ten percent of normal working capacity, resulted in a mathematically limited number of casualties relative to the destructive capacity of the 950-kilogram explosive used.^【17】

^{Patlama Sonrası (}Regjeringen⁾

As a result of the explosion at the Oslo government buildings, eight people died at the scene. The deceased were civilians and public officials located close to the epicenter, at the H-Blok entrance, in the ground-floor reception area and near the fountain at Einar Gerhardsen Square. Upon examination of the causes of death, it was determined that all victims died instantly at the scene due to massive trauma caused by the primary shockwave’s immense pressure and by debris such as glass, metal and concrete fragments striking their bodies. According to forensic and court records, the victims died from severe crush injuries to the head, chest and abdomen, spinal cord fractures and internal organ damage.^【18】

^{Patlama Sonrası (}Regjeringen⁾

The bombing also caused hundreds of people to sustain injuries of varying degrees. Nine individuals located close to the epicenter suffered extremely severe and life-threatening physical trauma including limb amputations, skull fractures, brain hemorrhages and multiple organ injuries. These critically injured individuals were immediately transported to Ullevål University Hospital by emergency medical teams and underwent prolonged intensive care and successive surgical operations. In addition to the critically injured, at least 200 other people at and around the scene received medical treatment in hospitals and emergency rooms due to shrapnel lacerations, bone fractures, hearing loss and trauma caused by blast pressure.^【19】

The perpetrator, who initiated the bomb’s detonation mechanism, walked away from the scene before the explosion and boarded a second vehicle, a Fiat Doblò with license plate VH 24605, previously parked at Hammersborg Square. At 15:25, as the explosion was heard and chaos erupted in the city center, he drove this civilian vehicle westward through the Festningstunnelen and left central Oslo. Monitoring news reports on the radio, the perpetrator learned that the building had not completely collapsed and that the death toll was lower than expected. He then proceeded directly toward the Tyrifjorden region to carry out the second phase of his operation: the attack on Utøya Island.^【20】

^{Failing's Journey Route from Oslo to Utøya (}Regjeringen⁾

Following the E18 and E16 highways, the perpetrator arrived at the mainland pier serving Utøya Island at approximately 16:26. He parked his civilian vehicle, removed the bulletproof vest he was wearing and put on a tactical vest equipped with ammunition pouches. The perpetrator was dressed in dark-colored pants and a uniform-style top that closely resembled the official uniforms of the Norwegian police force, complete with police emblems on the shoulders and reflective strips. He also wore around his neck a counterfeit copy of the official identification cards used by the police force. This uniform and ID card combination formed the fundamental deception mechanism that enabled the perpetrator to pass security barriers without arousing suspicion upon entering the island.^【21】

^{Saldırı Öncesi Utøya, Çadır Kampı ve Kafe Binası (}Regjeringen⁾

Utøya Island was hosting the annual summer camp organized by AUF (Arbeidernes Ungdomsfylking), the youth wing of the Norwegian Labour Party. A total of 564 people were on the island, including camp administrators, civilian volunteers, guests and mostly young people aged between 14 and 25. As part of the camp program, Norway’s former Prime Minister Gro Harlem Brundtland had given a speech on the island earlier that morning and had departed. The young people had just learned about the Oslo bombing through radio and mobile phones and were gathered around the main building (Kafébygget) and the tent camp, attempting to understand the situation amid great anxiety and information chaos.^【22】

At the pier, the perpetrator encountered a security officer responsible for AUF camp security and introduced himself as a civilian police officer from the Police Security Service (PST). He showed his fake ID, claiming he had been assigned to conduct a routine security check and inform the youth following the Oslo bombing. Although the officer was suspicious that the perpetrator had arrived in a civilian vehicle, he was convinced by the crisis situation in Oslo and assumed all official police vehicles were occupied. The perpetrator’s request to enter the island was approved, and the ferry MS Thorbjørn was summoned to complete the logistical step for his transfer to the island.^【23】

^{Record of Passengers Traveling to Utøya, Last Entry: 17:00, 1 Police Officer (}Regjeringen⁾

At approximately 17:15, the perpetrator boarded the MS Thorbjørn ferry with his equipment and stepped onto the Utøya Island pier at 17:17. He brought with him a heavy plastic crate filled with ammunition, a semi-automatic .223 caliber Ruger Mini 14 rifle, a semi-automatic 9mm Glock 34 pistol, smoke bombs and high-capacity magazines for both weapons. Ballistic examinations revealed that the majority of the ammunition he brought to the island consisted of specialized hollow-point bullets designed to maximize damage upon impact, fragmenting inside the body and causing extensive internal organ destruction.^【24】

^{The Ruger Mini-14 firearm used by Breivik on Utøya (}Regjeringen⁾

As the perpetrator walked from the pier toward the Main Building, the ferry captain assisted him in carrying the heavy ammunition crate. At approximately 17:21, the perpetrator targeted Monica Bøsei, a camp administrator, and Trond Berntsen, a civilian security officer and police officer, near the Main Building and opened fire. He shot both victims in the back and head using his pistol and rifle, killing them instantly at the scene. With these first shots, the armed attack, which would last 72 minutes and result in the deaths of 69 people, was effectively initiated.^【25】

^{Failin Süngü ve Kırmızı Nokta Nişangahlı Ruger Mini-14 Tüfeği (}Regjeringen⁾

Upon hearing the gunshots, panic and a wave of fleeing spread across the island. The perpetrator headed directly toward Kafébygget (Café Building) and the surrounding tent camp, systematically targeting the young people there. He fired at camp participants who were hiding in tents, taking refuge inside buildings or fleeing into the wooded areas. According to court records, the perpetrator shot many victims in the back, torso and limbs, and approached fallen victims to deliver what he called “finishing shots” at close range to their head areas. Dozens of people were killed in the attacks around the Café Building and tent camp alone.^【26】

^{Failin Glock Tabancası (}Regjeringen⁾

Continuing his rampage, the perpetrator headed toward Kjærlighetsstien (Lovers’ Path), a wooded walking trail. There he identified a large group of young people hiding near cliffs and bushes. Using the sense of security provided by his police uniform, he encouraged those hiding to come out by telling them the danger had passed and that he had come as a police officer to help. Those who emerged in response to this call were shot in rapid succession by the perpetrator. As a result of this deception and ambush tactic on Kjærlighetsstien and surrounding areas, the perpetrator killed more than 15 youths by shooting them in the head and neck.^【27】

^{Failin Kullandığı Bir Diğer Silah Olan Benelli Nova Pompalı Tüfek (}Regjeringen⁾

Continuing his movements on the island, the perpetrator moved sequentially to Stoltenberget (Stoltenberg Rock), Bolsjevik Cove and Pumpehuset (Pump House). He targeted victims who had taken refuge along the water’s edge, behind rocks or were attempting to swim away from the island. Particularly at Pumpehuset, he opened fire directly on young people trapped in the area and shot those attempting to jump into the lake from the shore. Some of those who tried to swim away despite the freezing cold water were killed by bullet impacts; one victim drowned and another fell from a cliff. The perpetrator confirmed the deaths of the majority of victims in these areas by shooting them directly in the head, face and back.^【28】

^{2010 Spring Purchase and Used on July 22, Helmet with Visor (}Regjeringen⁾

During the armed attack, the perpetrator called the emergency police line 112 twice from his mobile phone. In calls made at 18:00 and 18:24, he clearly identified himself, describing himself as “Commander of the Knights of the Temple” and “a member of the resistance movement against the Islamization of Europe.” Although he declared that he had completed his operation and wished to surrender to the police, he hung up without answering questions from the call center and continued shooting and killing people on the island after both calls.^【29】

^{A blue light was mounted on the vehicle as it entered the government zone and moved toward the Utøya ferry dock on the mainland (}Regjeringen⁾

This continuous attack sequence, which began at 17:21 and lasted until 18:34, resulted in a total of 69 deaths on Utøya Island. Of the victims, 67 died due to massive brain tissue fragmentation, spinal cord injuries and internal bleeding caused by bullets fired by the perpetrator; two others died from falls and drowning during escape. In addition to the deceased, 33 people were seriously injured by gunfire, suffering bone fractures, limb loss and permanent nerve damage. According to forensic ballistic data, the perpetrator fired 121 rounds from his pistol and 176 rounds from his rifle during this period.^【30】

^{Eldivenleri ve Araç Takibini Önlemek İçin Zincirler (}Regjeringen⁾

The perpetrator’s movements on the island ended when the Norwegian Police Security Service’s special operations unit, Delta (Beredskapstroppen), arrived on the island. The Delta team, which had mobilized from Oslo by road and crossed to the island using civilian boats, landed on the island at 18:27 and began a rapid advance toward the direction of the gunfire. At approximately 18:34, the perpetrator encountered the Delta team in a wooded area near Skolestua (School Building). He did not engage in any armed confrontation, laid down his weapons, raised his hands and surrendered without any physical resistance. He was immediately handcuffed and taken into custody. With this arrest, the armed attack phase of the 22 July 2011 terrorist acts was effectively concluded.^【31】

The Oslo Police Directorate (OPD) operations center was operating with routine personnel capacity when the explosion occurred and immediately faced an extraordinary communication burden. The center continued operations under the obligation to simultaneously respond to hundreds of emergency calls, direct patrol units on the ground, inform relevant senior authorities and manage the operational response to the crisis. This intensity overwhelmed the center’s command and control capacity, causing operators to focus solely on answering incoming calls rather than making strategic decisions. Staff shortages prevented full coordination of the incident site in the first hours of the crisis.^【32】

^{Delta Ekibinin Utøya’ya Vardıktan Sonraki İlerleyişi; İskele (1), Açık Arazi (2), Okul Binasının Yanı (3) ve Oradan Faili Yakaladıkları Ağaçlık Alana Doğru (}Regjeringen⁾

The operations center’s technical infrastructure became non-functional during the crisis because its Geopol system, which tracked patrol vehicle locations in real time, relied on manual data entry. The inability of the PO (Police Operations) log system to share data simultaneously left operators unable to clearly see the number, location and current status of units on the ground. Due to excessive congestion on radio frequencies, direct orders were issued for all units to proceed immediately to the scene without radio announcements, preventing the on-site police commander from establishing an inventory of which units were present.^【33】

The “Riksalarm” (national alarm) system, used to alert other police regions at the national level, was operated by Kripos (National Criminal Investigation Service). Due to low staffing and high call volume at the Kripos operations desk on the day of the incident, activation of the system was delayed. The alarm content was compiled using partial data from Oslo police, and critical information such as the perpetrator’s description, the vehicle used and the presence of a fake police uniform was not included in the initial alarm message. Technical limitations of the system made it difficult to clearly convey the urgency of the message to other regions.^【34】

The first national alarm message sent by Kripos was entered into the system 1 hour and 18 minutes after the explosion, at 16:43. Investigations revealed that only two of the twenty-seven police regions recorded this alarm in their official PO log systems on the day of the incident; most either received the message the next day or did not receive it at all due to technical infrastructure deficiencies. The absence of a feedback mechanism to confirm whether the message had been received prevented the sender from verifying its delivery and stalled the process of increasing security measures in surrounding regions.^【35】

The national counter-terrorism unit of the police force, Beredskapstroppen (Delta), was rapidly mobilized after the Oslo bombing and called its personnel to the operations center. The unit initially participated in search and rescue activities at the government buildings but, upon receiving reports of the armed attack on Utøya, began moving toward the island at approximately 17:30. The Delta team, equipped with armored vehicles and gear, traveled along the E16 highway under heavy traffic and rainy weather conditions. When it became clear that helicopter support could not be provided upon reaching Sollihøgda, it was decided to continue the journey by road.^【36】

The Nordre Buskerud Police Region (NBPD) operations center, to which Utøya Island is administratively attached, was operating with only one operator at the time of the incident. As multiple armed attack reports arrived simultaneously, the single operator was forced to respond to hundreds of calls, contact the Delta team and direct local patrols. The system’s overload caused the operator to completely abandon log-keeping and focus solely on answering emergency calls, effectively disabling the operational command chain within NBPD.^【37】

Communication breakdowns between on-site units and the center became evident during the identification of the rendezvous point for Delta’s transfer to the island. The operations center changed the rendezvous point from Utøya pier to Storøya/Elstangen, 3.6 kilometers away, but this critical change was not communicated to the Delta commander or the first response teams. This gap in information flow caused armored units to head toward incorrect coordinates, resulting in operational delays that directly affected the response time.^【38】

Serious logistical failures occurred in securing maritime vessels for unit transfers to the island. The MS Thorbjørn ferry, which was capable of transporting armored vehicles and was located on the island, could not be operationally used by police; instead, a small civilian rubber boat was preferred. This boat, carrying eleven fully equipped police officers, took on water due to overloading and its engine failed. This mechanical failure forced the team to transfer to civilian boats in the middle of the lake, delaying their arrival on the island.^【39】

One of the primary causes of operational discoordination was the incompatibility of radio infrastructure used by different police regions. Units from Oslo and Asker/Bærum used the digital “Nødnett” system, while NBPD units used the older analog radio system. The lack of integration between systems and topographic barriers in the Tyrifjorden region reduced radio signal strength, preventing units from communicating with each other; command transmission was largely attempted through personal mobile phones.^【40】

The police force’s aerial reconnaissance and response capacity was unavailable on the day of the incident. The Oslo police helicopter had been taken out of operational status and placed in storage due to budget constraints and staff leave, with no emergency crew assigned. Formal procedures for using military helicopters (Bell 412) were followed; verbal requests made at 18:14 were approved at 19:22, and the helicopters took off. However, this delay prevented the helicopters from being used for reconnaissance or personnel transport during the attack.^【41】

The first emergency call following the explosion at the government buildings reached the Oslo/Akershus Acute Medical Communication (AMK) center at 15:26. The center immediately dispatched ten ambulances, one medical leadership vehicle and one motorcycle unit to the scene. Due to the high volume of incoming calls, AMIS (Acute Medical Information System) servers became overloaded and collapsed, cutting off electronic data flow between the center and ambulances. Despite this technical failure, operators switched to manual guidance via radio systems, maintaining ambulance dispatches and coordinating regional resources.^【42】

^{Kurtarma Operasyonunda Tekneler ve Helikopterler Yer Aldı (}Regjeringen⁾

Healthcare teams arrived at the explosion zone at 15:30 and began initial triage (patient classification and prioritization) procedures. The initial gathering area established at Høyesteretts Square was relocated to Youngstorget at 15:36 due to risks of falling debris and limited space. The Health Operations Leader (OLH) and Field Health Leader (FH) managing the triage process classified patients according to international standards, directing ten critically injured patients directly to the major trauma center and 33 less severely injured patients to emergency departments.^【43】

Ullevål University Hospital immediately activated its “red alarm” protocol upon receiving the explosion alert, implementing disaster procedures. The emergency department was emptied within fifteen minutes to prepare for incoming trauma patients; twenty trauma teams and twelve surgical teams were mobilized. Space was created in intensive care units and respiratory equipment capacity to assign a dedicated trauma team to each of the ten critically injured patients arriving from Regjeringskvartalet.^【44】

In medical interventions at Ullevål Hospital, the most experienced trauma surgeon was placed at the emergency entrance, and standard procedures such as routine computerized tomography (CT) scans were abandoned to avoid delays; patients were taken directly to operating rooms. Thanks to this proactive approach, 30 of the 31 critically injured patients presenting with severe internal bleeding, limb amputations and skull fractures were successfully kept alive through surgical operations.^【45】

Oslo Legevakt (Emergency Clinic) served as a critical buffer zone during the crisis, preventing Ullevål University Hospital from exceeding its capacity. Approximately 190 patients with injuries such as glass cuts, minor shrapnel wounds and psychological trauma were distributed to allmennlegevakt (general emergency) and skadelegevakt (trauma emergency) departments for treatment. This triage strategy prevented overcrowding of major hospitals by minor injuries and ensured time and space were preserved for critical cases.

The armed attack on Utøya Island was reported to the Buskerud region AMK center (Vestre Viken) at 17:24. The center immediately coded the incident as “terrorism/war act” and dispatched all regional ambulance resources toward Tyrifjorden. Due to the unclear security situation, ambulances initially established safe waiting areas (staging areas) at a gas station in Sundvollen and private properties in Utvikstranda.^【46】

The first medical gathering point (Samleplass 1) was established at 18:50 on the mainland side of the Utøya pier (Utøya brygge landsiden). Teams consisting of six anesthesiologists and assistants, under heavy armed police protection, provided initial stabilization interventions to critically injured patients brought ashore by boats. However, police command, suspecting a bomb might be in the perpetrator’s vehicle parked near the pier, ordered immediate evacuation of the area, forcing medical teams to search for a secure zone.^【47】

Due to bomb-related security risks, a second and more comprehensive medical gathering point (Samleplass 2) was established at Elstangen, 3.6 kilometers from the island. This area had sufficient space for both ground ambulances to approach and for air ambulances and Sea King rescue helicopters to land. Seven medical teams established here classified injured individuals according to international trauma standards, airlifting ten unstable patients to Ullevål and transporting 40 stable patients by road to surrounding hospitals.^【48】

Ringerike Hospital, due to its geographical proximity, served as the most critical local health facility in the Utøya crisis. Normally with a 120-bed capacity, the hospital activated its crisis plan and called 200 personnel to duty. As the closest medical facility to the island, it accepted 35 patients presenting with hypothermia, shock and gunshot injuries. Specialist surgeons performed emergency hemorrhage control and stabilization surgeries on seven critically injured patients, who were later transferred to Ullevål for further investigation and treatment after surviving the life-threatening conditions.^【49】

During the time when professional health and security units were delayed in entering the island with full equipment, local civilians and volunteers at the camp took initiative and participated in rescue operations. Some civilians, disregarding the threat of bullets, used their private boats and rubber dinghies to enter the lake and rescue young people swimming or taking refuge on the island’s cliffs. This civilian intervention was one of the most important factors in minimizing hypothermia risks and drowning cases, preventing further loss of life.

For the transportation of rescued youths and lightly injured individuals, Hole Municipality and health teams requisitioned the Sundvolden Hotel as the main crisis and evacuation center. The hotel management rapidly evacuated existing guests and allocated all bed capacity, conference rooms and kitchen supplies for crisis management. Dry clothing, blankets and hot food for hundreds of youths brought to the hotel were provided by hotel staff and local volunteers.

Psychosocial support units established at Sundvolden Hotel provided initial interventions to traumatized youths and arriving families. However, the manual paper-and-pen system used for registering individuals brought to the center, combined with the delayed delivery of official victim lists from police, caused major administrative chaos. Crisis teams composed of psychologists, psychiatrists and religious leaders struggled to inform families of unidentified injured persons, increasing anxiety and panic levels at the center.

Immediately after the attacks, the central government activated the Crisis Support Unit (KSE) to maintain operations and establish national security. Due to heavy damage to KSE offices in the government complex, officials relocated to alternative military command centers at the Ministry of Defense (FD) campus, in accordance with pre-established emergency plans. This rapid physical relocation prevented complete paralysis of the government’s decision-making mechanisms and ensured the administrative coordination was re-established under military protection.^【50】

^{The press conference held by Police Director Øystein Mæland on the night connecting July 22 to July 23, 2011, Saturday (}Regjeringen⁾

Considering the multi-dimensional nature of the crisis, the Prime Minister’s Office convened the Government Crisis Council (Regjeringens kriseråd – RKR) in an extraordinary meeting. According to constitutional responsibility principles, the Ministry of Justice and Public Security (JD) was designated as the “lead ministry” for managing the civil crisis. JD’s responsibilities included preparing strategic situation reports, coordinating between ministries, meeting the logistical needs of security units and centrally managing public information processes.^【51】

The evacuation and reactivation of ministries located in the government complex, the epicenter of the explosion, were managed by the Ministry of Government Administration, Reform and Church Affairs (FAD) and Statsbygg (Public Procurement Agency). Due to physical damage to the buildings and destruction of server rooms, ministry staff were relocated to alternative facilities. The collapse of information technology infrastructure blocked access to official electronic archives, so secure mobile platforms and encrypted temporary servers were established to continue essential correspondence and administrative activities for several days through these limited systems.^【52】

The greatest challenge faced by JD and KSE during crisis management was the inability to obtain verified intelligence and factual data from the field. The collapse within police internal communication networks prevented data from being transferred to KSE; this forced the government to rely on unverified information from national television channels and social media when preparing strategic situation reports.^【53】

The Police Security Service (PST) initially operated under the assumption that international radical terrorist organizations were behind the attack. Tactical intelligence units examined bank transactions and communication data of suspected groups and contacted foreign intelligence services (E-tjenesten). However, as the perpetrator’s profile became clear and his manifesto emerged, PST rapidly revised its target toward identifying far-right autonomous cells and preventing a possible second wave of attacks.^【54】

In the first threat assessment reports prepared by PST, the perpetrator’s claim during interrogation that “two additional autonomous cells existed” was taken seriously. Accordingly, immediate high-level security measures were recommended for the protection of government members, the royal family and critical infrastructure facilities. Based on these reports, the Crisis Council raised security protocols to the highest level and considered requesting military support to protect civil authority.^【55】

Military support to civil law enforcement (håndhevelsesbistand) was requested to secure civilian areas. In this context, a total of 140 fully equipped military personnel from the Norwegian Home Guard (Heimevernet – HV-02) and the Royal Guard Regiment (HMKG) were deployed to central Oslo. Military units established armored cordons around the damaged government buildings, parliament and other sensitive targets, performing patrol duties and reducing the operational burden on police units.^【56】

The central government’s crisis communication strategy was personally managed by the Prime Minister, with careful attention paid to presenting a “civilian profile” in public messages. The exclusion of Defense or Foreign Affairs ministers from press briefings was a deliberate choice to reinforce the perception that the crisis was not an international war situation or military threat, but rather an internal security and judicial matter. This communication policy aimed to calm potential public panic and demonstrate state control over the situation through civil authority.^【57】

In the later hours of the crisis, it was decided to centralize the process of victim identification and family notification. Rikshospitalet was designated as the center for forensic procedures and autopsies and for informing families of the deceased; Ullevål Hospital was configured as a clinical crisis center for the injured and their companions. This institutional division prevented psychological devastation caused by having grieving families and trauma survivors in the same environment and ensured a more systematic process.^【58】

On 25 July 2011, the Government Crisis Council (RKR) declared the acute emergency phase over and the normalization process begun. With this decision, the crisis-focused administrative structure was replaced by a “reconstruction council” (gjenoppbyggingsråd) led by FAD to address physical and institutional damage. This transition marked the final administrative step enabling the state apparatus to exit the extraordinary state and return to routine bureaucratic operations while focusing on judicial proceedings.^【59】

The perpetrator’s surrender to law enforcement on Utøya Island occurred on 22 July 2011 at 18:34 without any physical armed resistance. After the special operations unit Delta arrived on the island, the perpetrator emerged from the bushes with his hands raised and placed the weapons used in the attacks approximately fifteen meters behind him. Immediately taken into custody, the perpetrator was recorded as saying “I’m finished now” upon arrest. No confrontation occurred during the arrest; the perpetrator was handcuffed on the spot and transferred to a secure area on the island to begin his first interrogation.^【60】

The first legal interrogation conducted by police forces on Utøya Island began on the day of the incident and lasted uninterrupted for seven hours. According to official police reports, the perpetrator adopted an extremely open, reflective and calm communication style throughout the interview, explaining his actions in a consistent, logical and detailed manner. A total of 220 hours of comprehensive police interrogations were conducted throughout the investigation, and the perpetrator never required any medical intervention during these sessions. During the investigation phase, the perpetrator openly admitted to carrying out the terrorist acts but rejected any legal culpability under Norwegian law, characterizing his actions as a legitimate defense against cultural Marxism and a preventive military attack.

In later stages of the interrogation, a conscious and strategic shift in the perpetrator’s attitude toward police inspectors and judicial authorities was observed. In initial interrogations, he described himself as the ideological leader, military commander, judge and assault unit of a secret organization called the Knights of the Temple. In subsequent phases, he softened his statements regarding the organization’s actual structure and began describing himself merely as a “foot soldier” assigned a task. In response to rational, evidence-based questions from investigators, he displayed flexibility, claiming his initial statements were exaggerated, that the organization was still in its founding stage and that some statements in his manifesto served a propaganda purpose. This demonstrated the perpetrator’s capacity to modify his statements according to legal conditions and his interlocutors’ arguments.^【61】

One of the most fundamental legal debates in the investigation and trial process concerned whether the perpetrator was in a psychotic state at the time of the acts and therefore lacked criminal responsibility under Article 44 of the Norwegian Criminal Code. According to current legal provisions, if the perpetrator was psychotic, severely mentally disabled or in a serious state of consciousness impairment at the time of the crime, he could not be held legally responsible and would be subject to compulsory psychiatric treatment instead of imprisonment. To determine this critical legal finding, the Oslo District Court appointed two separate official forensic psychiatric panels to conduct detailed examinations of the perpetrator.^【62】

The first forensic psychiatric experts appointed by the court, Torgeir Husby and Synne Sørheim, conducted thirteen separate clinical interviews with the perpetrator totaling 36 hours between August and October 2011. In their official report submitted to the court on 28 November 2011, they determined that the perpetrator suffered from paranoid schizophrenia and was in a complete psychotic state during the terrorist acts. The report evaluated the perpetrator’s belief in the Knights of the Temple, his grandiose ideas about having the authority to decide who in Europe should live or die, and his self-perception as a precursor to a civil war in Europe as “bizarre and grandiose delusions” under International Classification of Diseases (ICD-10) criteria. The report also noted the perpetrator’s emotional detachment toward victims and his use of invented words (neologisms) as symptoms of psychotic illness.^【63】

Although the first forensic psychiatric report’s conclusion that the perpetrator lacked criminal responsibility was legally endorsed by the Norwegian Forensic Medical Council, it triggered intense academic and systemic objections within the psychiatric community, media and public opinion. Many clinical experts scientifically argued that the perpetrator’s high operational organization, long-term planning, impulse control and ability to evade law enforcement were inconsistent with a classic schizophrenia diagnosis. The perpetrator himself strongly rejected this report, asserting that labeling his actions as illness undermined their political and ideological foundation and declared that being sent to a psychiatric hospital would be “a fate worse than death.”

In response to emerging legal objections and intense medical ethics debates, the Oslo District Court appointed a second forensic psychiatric panel on 13 January 2012, consisting of Agnar Aspaas and Terje Tørrissen. This second panel re-examined the perpetrator with comprehensive psychiatric tests and, in their final report dated 10 April 2012, concluded contrary to the first panel that the perpetrator was neither schizophrenic nor psychotic at the time of the crime or during evaluation. According to the second report, the perpetrator’s knightly and massacre rationalization thoughts were not clinical psychotic delusions but expressions of the extremist far-right ideological subculture to which he belonged. The second panel officially determined that the perpetrator exhibited antisocial (dissocial) and narcissistic personality disorders along with pathological lying (pseudologia fantastica), noting his ability to display tactical flexibility in communication, adjust his statements in response to opposing arguments and maintain a rational level of intelligence.^【64】

To test and support the second panel’s diagnoses in a clinical setting, the perpetrator was subjected to three weeks of continuous closed clinical observation at Dikemark Hospital by expert staff. During this period, nurses, forensic health personnel and clinicians Eirik Johannessen and psychiatrist Randi Rosenqvist found no signs of schizophrenia, hallucinations or acute psychosis in the perpetrator. Experts reported to the court that the perpetrator’s emotional unresponsiveness and profound lack of empathy toward victims were the result of pathological personality traits and a constructed political strategy, not severe mental perception loss. Thus, two completely opposing forensic psychiatric reports were submitted to the court, leaving the final decision to the court’s legal discretion.^【65】

The trial, which began on 16 April 2012 at the Oslo District Court and lasted ten weeks, was conducted by a panel of five judges led by Chief Judge Wenche Elizabeth Arntzen. The perpetrator declared the court lacked legal legitimacy, claiming it was appointed by political parties supporting multiculturalism in Norway. During hearings, the perpetrator physically admitted to carrying out the terrorist acts and causing deaths but rejected criminal charges, asserting that his actions constituted a preventive defense to preserve Europe’s demographic structure. While the prosecution demanded compulsory psychiatric treatment on grounds of the perpetrator’s lack of criminal responsibility, the defense attorneys argued that their client was mentally sound and deserved imprisonment.^【66】

The Oslo District Court panel, after evaluating the forensic psychiatric reports, delivered its final verdict on 24 August 2012. The court definitively ruled that the perpetrator was not in a psychotic state during the terrorist acts and possessed full criminal responsibility to understand the legal consequences of his actions. Based on this legal determination, the perpetrator was convicted under Article 147a of the Norwegian Criminal Code for terrorism, Article 233 for premeditated murder and Article 148 for causing mass destruction using explosives. As the verdict was read, the perpetrator smiled in the courtroom and declared he would not appeal, as his mental soundness had been confirmed.^【67】

Since capital punishment and traditional life imprisonment are legally prohibited in Norway’s justice system, the court sentenced the perpetrator to the maximum penalty under the law: twenty-one years of preventive detention (forvaring). The court ruling set the minimum enforcement period at ten years. The preventive detention model legally allows the sentence to be extended in five-year increments indefinitely if, after the maximum twenty-one-year period, the convicted person is legally determined to continue posing a danger to society. This specific enforcement condition, recorded as a final legal measure, effectively transforms the perpetrator’s criminal status into a potential life sentence aimed at maximizing public safety.^【68】

Following the 22 July 2011 attacks, the Norwegian government established an independent commission to examine crisis management and extract strategic lessons. The 22 July Commission (Gjørv Commission), established by decree on 12 August 2011 and chaired by lawyer Alexandra Bech Gjørv, operated independently from the government. The commission’s primary task was to comprehensively evaluate the preventive, protective and crisis management capacities of competent authorities in response to the terrorist attacks on government buildings in Oslo and Utøya Island. Composed of ten experts, the commission completed its year-long work and officially submitted its comprehensive final report containing findings to the Norwegian Prime Minister on 13 August 2012.^【69】

The commission conducted its investigations and data collection within a comprehensive academic methodology. During its work, fifteen official closed sessions were held, and thousands of pages of police records, intelligence reports and government correspondence were subjected to technical analysis. To document the experiences of victims, survivors and affected families regarding emergency response, 3,700 people participated in surveys and hundreds of one-on-one interviews were conducted. To enable international evaluation of health services’ emergency responses, an official cross-border collaboration was established with the Swedish National Board of Health and Welfare’s Disaster Medicine Observation Studies (KAMEDO).^【70】

The Gjørv Commission report clearly outlined systemic failures in the Norwegian police force’s prevention phase. It found that although a security decision to close Grubbegata Street to civilian traffic had been approved since 2004, bureaucratic delays prevented its implementation. This administrative negligence and sluggishness allowed the explosive-laden commercial vehicle to be parked directly at the target location, and it was officially documented that the attack could have been stopped by existing approved security measures, clearly highlighting the state’s vulnerability in risk perception.^【71】

In the section examining operational response, the Commission reported that the response time of Oslo police and the Nordre Buskerud local police region to the armed attack on Utøya Island was unacceptably slow. It was stated that police forces failed to organize civilian boat capacity in time and that the rubber boat carrying the police team suffered engine failure due to overloading. The Commission report definitively determined that no clear tactical command chain was established among dispatched law enforcement units and that these logistical delays directly increased the number of casualties on the island.^【72】

^{Gül Memorial and Protests on July 25 (}Regjeringen⁾

The commission’s most severe criticisms targeted the police force’s operational communication networks and command-and-control mechanisms. The under-staffing of operations centers during the crisis led to hundreds of emergency calls going unanswered and prevented effective coordination of on-site units. Incompatibility between outdated analog systems and the new digital Nødnett infrastructure hindered simultaneous communication between police teams from different regions. The commission emphasized that the police force failed to effectively utilize aerial reconnaissance assets such as helicopters and did not leverage the potential of information and communication technologies (ICT).^【73】

In contrast, the commission found the performance of health services in crisis management to be highly successful. Immediately after the explosion in Oslo, the medical interventions and triage strategies implemented at Ullevål University Hospital, Ringerike Hospital and Oslo Emergency Clinic (Legevakt) decisively prevented an increase in casualties by avoiding capacity overload. The rapid establishment of a crisis center at Sundvolden Hotel providing psychosocial support to victims and families, along with the efforts of local civilians in lake rescue operations, were specifically praised by the commission, confirming that health units demonstrated a high response capacity in disaster scenarios.^【74】

The central government’s administrative continuity and communication strategies were also among the commission’s positive findings. The rapid evacuation of personnel from the severely damaged Prime Minister’s Office and Ministry of Justice buildings to alternative facilities ensured uninterrupted state operations. The government’s close communication with the public from the first moments of the crisis contributed to calming panic and establishing trust. The ability of ministries to continue essential administrative duties despite the complete destruction of their physical work environments was reflected in the report as evidence of civil authority resilience and emphasized the determination to uphold constitutional order.^【75】

The report determined that institutional errors during the crisis were not due solely to financial resource shortages but stemmed from management culture, mindset and leadership deficiencies. The root of security units’ challenges lay in the inability to translate theoretical plans into operational action, weak risk perception culture and bureaucratic fragmentation. The commission presented the government with a thirty-point action plan to address these systemic weaknesses. These recommendations included the complete ban on semi-automatic weapons, the establishment of a target-oriented performance measurement system within the police force, the standardization of emergency response times and the direct inclusion of terrorism education within the criminal scope.^【76】

Following the 22 July attacks, Norway’s legal strategy for counter-terrorism and security policies was built on the principle of preserving core democratic values. The central government consciously avoided adopting emergency security measures similar to the U.S. Patriot Act after the 11 September attacks, which broadly restrict civil rights and freedoms. The counter-terrorism policy focused pragmatically on repairing existing institutional structures and legal gaps without undermining the ideal of an open society.^【77】

The most significant legal impact of the terrorist acts in criminal law was the comprehensive amendment to the Norwegian Criminal Code in 2013. The previous law, in effect since 2002, required at least two individuals to conspire and carry out an organizational preparatory process for an act to be legally classified as terrorism. Since the perpetrator acted entirely alone and this autonomous condition had no legal counterpart under the old law, the 2013 amendment brought under the definition of terrorism the planning, preparation and execution of terrorist acts by a single individual without organizational connections.^【78】

^{The Sea of Flowers and Protests Outside Oslo Cathedral (}Regjeringen⁾

The intense psychiatric debates during the trial regarding the perpetrator’s psychotic state and criminal responsibility necessitated new regulations in the country’s mental health laws. In 2012, the Norwegian Mental Health Act was revised, legally guaranteeing the establishment of specialized high-security psychiatric observation units within prisons for inmates with serious violent risks and mental health issues. This legal step created a protective barrier mechanism ensuring public safety and provided clarity to prevent mental illness claims from being used as an absolute escape from criminal responsibility.^【79】

Regarding the international dimension of counter-terrorism, restrictive measures were introduced in 2016 into the Criminal Procedure Act and related legislation. These regulations directly criminalized fighting on behalf of non-state armed actors or receiving ideological or military training at illegal terrorist camps abroad. These reforms, which defined travel to foreign conflict zones as a specific terrorist offense, served as a legal shield against the national security threat posed by radicalized individuals and expanded the judiciary’s definition of terrorism.^【80】

In line with the Gjørv Commission’s recommendations, legal steps were taken to control civilian access to firearms. Amendments to the Norwegian Firearms Act imposed restrictions limiting civilian access to firearms. Based on parliamentary legislation, civilian ownership of fully automatic weapons was banned, followed by a complete prohibition on semi-automatic weapons capable of accepting high-capacity magazines. These weapons were ordered to be collected by the state. This measure aimed to completely prevent potential autonomous attackers from legally acquiring ballistic weapons with high destructive power.

In 2013, revisions to the Aliens and Immigration Act were made to enhance control over international travel mobility. New decisions required all foreign nationals entering Norway from outside the Schengen area to have their biometric data and fingerprints recorded in national security databases.^【81】

Parallel to legal reforms, strategic updates were implemented in the state’s administrative and institutional security architecture. To address intelligence-sharing vulnerabilities, the “Joint Counter-Terrorism Center” was established in 2014 within the Norwegian Intelligence Service (NIS) and Police Security Service (PST), where personnel from both agencies work together. The Ministry of Justice’s mandate was expanded and its name changed to the Ministry of Justice and Public Security, and the Directorate for Civil Protection and Emergency Planning (DSB) was assigned the task of publishing national scenario analyses to assess potential terrorist risks, thereby strengthening preventive intelligence capacity.^【82】

The sociological impact of the 22 July terrorist attacks on Norwegian society was measured through research on public trust in state institutions and political authorities. In the immediate aftermath, a sociological reflex known in political science literature as the “rally ‘round the flag” effect took hold; institutional trust levels among citizens toward the current government, parliament and law enforcement reached statistically historic peaks. The perception of the state as a protective and unifying figure during a national trauma temporarily reinforced Norwegian public political attachment to institutional structures.^【83】

This initial high-trust environment gave way to a “partial punishment effect” after the Gjørv Commission shared its detailed report documenting security weaknesses and administrative failures with the public. Public confidence in the government’s pre-crisis risk-reduction capacity was shaken, and survey evaluations of institutional performance fell below pre-attack levels. This erosion of institutional and political trust was reflected in elections; despite successfully managing the acute crisis phase, the Labour Party, held responsible for failing to prevent the attacks, lost significant votes in the 2013 general elections and left power.^【84】

Norwegian citizens’ willingness to sacrifice civil rights and freedoms due to national security concerns also exhibited a fluctuating trend after the attacks. In initial surveys conducted while the threat was still acute, the majority of the public supported granting police the authority to monitor communication networks without court orders, conduct random street searches and hold suspects in indefinite detention. However, as the perception of threat subsided and the public began to view the risk of a new attack as low, this temporary authoritarian inclination toward restrictive security measures rapidly weakened, and the Norwegian public returned to its traditional democratic attitudes.^【85】

^{Protestolar (}Anadolu Ajansı⁾

The mass public response to the great trauma experienced by Norwegian society was shaped not by hatred and revenge rhetoric but by emphasis on peace, solidarity and democracy. Immediately after the attacks, rallies involving hundreds of thousands of people, known as “carnation marches,” transformed into mass commemorative acts defending multiculturalism and the will to live together. In contrast to the perpetrator’s completely anti-immigrant and anti-Islamic manifesto, a marked positive improvement was recorded in the Norwegian public’s attitude toward immigrants and minorities in the first months following the attacks.

The journalistic practices and framing strategies displayed by Norwegian and global media following the attacks triggered deep academic debates on journalistic ethics and Islamophobia. In the first hours after the Oslo bombing, before the perpetrator’s identity was officially confirmed by authorities, international media channels and some Norwegian newspapers disseminated unfounded reports directly linking the incident to groups such as Al-Qaeda and ISIS. These early, unsubstantiated and premature accusations led to verbal