1

Physical Indicators

Physical signs alone are not sufficient to determine knife crime involvement but should be documented and factored into a welfare assessment alongside behavioural and social indicators.

On the young person's body

On or around the young person

Stop and Search — Safeguarding First

If a knife is found on a young person under 18, record safeguarding indicators alongside any criminal process. Arrest for possession does not preclude a MASH referral — it may be required. Consider whether the young person is a victim of exploitation before treating them solely as a suspect. Refer to Resource 05 (Modern Slavery Act s.45 defence) before charging.

2

Behavioural Indicators

Attendance and social patterns

Communication and demeanour

Fear and coercion markers

3

Digital Drilling & Social Media

Drill music and its associated social media ecosystem are operationally significant. Gangs use TikTok, Snapchat, and Instagram Reels not merely to share content but to conduct real-time psychological warfare against rivals — goading violent responses, broadcasting perceived victories, and maintaining hierarchical dominance. Officers should treat a young person's social media footprint as potential intelligence, not background noise.

Legal Reminder — Evidence Capture

Videos or posts used in a threat-to-life assessment must be captured with timestamps and URLs before they are deleted. Use a screen recording tool or approved force capture method. Downloading content to a personal device is not an approved method of preservation. Consult your Digital Media Investigator (DMI) or Economic Crime Unit guidance.

Platform-by-Platform: How Gangs Use Social Media

TikTok
Drill music uploads and "diss tracks" targeting named rivals. Videos frequently contain coded references to weapons, postcodes, or deceased individuals. The algorithm amplifies content with high engagement, meaning violent provocations reach large audiences quickly. Officers should search suspected gang members' TikTok handles for recent uploads before welfare checks — content may predict planned violence or retaliation.
Snapchat
Dead drops and meet-up coordination. Snapchat's ephemeral messaging is used to relay drug drop-off coordinates ("the pack's at the spot"), distribute county lines "run" instructions, and share cuckooed address details. The "My Eyes Only" vault feature is used to store evidence of drug activity or violence away from casual inspection. Snap Map is manipulated by line controllers to monitor the location of groomed young people carrying drugs — a Bitmoji that never moves may indicate a phone left at a cuckooed address while the line runner operates nearby.
Instagram
Reels and Stories for status and goading. Rival gangs post Reels showing postcodes, gestures, or symbolic imagery taunting other groups. A young person with otherwise limited means will be gifted a secondary "finsta" (fake Instagram) account to maintain gang identity online while parents or carers monitor a clean primary account. Instagram Stories disappear after 24 hours — again, capture before conducting a welfare visit.
YouTube / Shorts
Drill music as coded record-keeping. Lyrics reference specific postcodes, named rivals, weapons used in previous attacks, and financial debts. Academic research (Ilan, 2015; Gunter, 2017) and the Metropolitan Police's Gangs Unit have documented lyrical content that accurately maps gang territorial disputes. Cross-reference lyric mentions with known intelligence subjects.

🔴 Decoding Online "Scoresheets"

Some gangs maintain public or semi-public digital scoresheets — tracking "points" accumulated through violent acts against rivals. These appear as:

  • Comment threads under drill tracks using tally marks, emojis (🔪, 💧, ⭐), or numbers
  • WhatsApp or Telegram group broadcasts listing initials or nicknames followed by a score
  • Graffiti photographed and posted on Stories — postcode tags with numbers alongside indicating incidents
  • Coded language: "waved" or "caught lacking" = victim of an attack; "spinning" = travelling to attack rivals
  • Instagram comments under drill videos: numbers in replies correlate to specific violent incidents

If you identify a scoresheet-style thread, submit an intelligence log immediately. These are often real-time threat indicators, not retrospective boasting.

Indicators a young person is engaged in digital drilling

4

Environmental & Social Factors

Location intelligence

Family and home environment

5

Referral Decision Matrix

Indicator Type Single Instance Multiple Instances / Pattern Action
Unexplained injury Monitor High Risk MASH referral + intelligence log
Knife found on person High Risk High Risk MASH referral mandatory; consider NRM
Known gang associate / scoresheet mention Moderate High Risk Intelligence log + welfare visit + Early Help referral
Digital drilling activity identified Moderate High Risk Capture content + intelligence log + school liaison
Carrying cash / burner phone Moderate High Risk Intel log; MASH referral if exploitation suspected
School non-attendance pattern Low-Moderate Moderate Early Help referral; notify DSL (Resource 08)