How a Jewish Group’s Online Surveillance Uncovered a Synagogue Plot

Early signs of a threat to shoot up a Manhattan synagogue were detected on Friday morning not by law enforcement officials but by an online security analyst working in a Manhattan office building.

A Twitter user with the handle @VrilGod posted a series of alarming tweets caught by the analyst’s filters used to identify possible online threats.

In one post, the user warned: “Big moves being made on Friday.”

In another, the user wrote: “Gonna ask a Priest if I should become a husband or shoot up a synagogue and die.”

Another post — “This time I’m really gonna do it” — seemed to reinforce the threat of attack, which the user indicated could be carried out at 10 p.m. Friday night along with a willingness to “die by cop.”

When the analyst saw these tweets, “alarm bells went off,” said his boss, Mitchell Silber, who leads the Community Security Initiative for the UJA-Federation of New York. They resulted in a police investigation that ended in the arrest of Christopher Brown, 21, and Matthew Mahrer, 22, just before midnight on Friday at Pennsylvania Station.

Incidents of harassment and violence against Jews and Jewish institutions have increased nationwide and have only intensified as celebrities like the rapper Kanye West, who goes by the name Ye, and the basketball player Kyrie Irving have come under fire for antisemitic posts on social media. This month, federal investigators issued a rare warning about a security risk at New Jersey synagogues and questioned a man who holds “radical extremist views” in connection with it.

On Tuesday, city and state authorities in New York announced increased security at synagogues and other Jewish institutions going into a long Thanksgiving weekend and with Hanukkah approaching on Dec. 18.

Gov. Kathy Hochul directed the State Police to intensify monitoring and increase support for communities that are potential targets of hate crimes. She also signed legislation requiring people convicted of hate crimes to undergo sensitivity education and training, as well as establish a new campaign under the state’s Division of Human Rights to promote inclusion and tolerance.

In New York City, Police Commissioner Keechant Sewell said her department would be responding by “strategically deploying assets at sensitive locations.” She credited the work done by her department and other law enforcement agencies.

Analysts on Mr. Silber’s team who contacted the authorities about the threat were monitoring filters that scrape the internet for possible local attacks by employing search terms like “Jewish, New York, synagogue, kill, shoot and die,” said Mr. Silber, a former director of intelligence analysis with the New York City Police Department. The initiative was created after the 2018 Tree of Life synagogue attack in Pittsburgh, he said in an interview on Tuesday.

The filters search mainstream social media platforms like Twitter and Facebook, as well as other chat forums including 4Chan, 8chan, Gab.com and Telegraph, he said.

The tweets on Friday morning, from an account linked to Mr. Brown, stood out from the online antisemitic chatter his analysts comb through daily because “they were talking about action” and included a time and day, Mr. Silber said.

Initially, the tweets indicated that perhaps the threat might occur on Long Island, so the consultants immediately alerted law enforcement authorities there. By early afternoon, the security team found additional online profiles seemingly linked to Mr. Brown that mentioned other threats, Mr. Silber said.

And by 2 p.m., it became apparent that the threat could be in New York City, at which point Mr. Silber’s team alerted city police officials.

“We basically told them that, ‘We know you get a lot of incoming, but you should pay attention to this,’” he said.

In a statement, Commissioner Sewell said that the department’s “exhaustive intelligence gathering led to the arrest.”

“Working with their law enforcement partners,” the statement said, the department’s Joint Terrorism Task Force with the F.B.I., as well as its Counterterrorism and Intelligence Bureau “uncovered a developing threat to the Jewish community on Friday and moved swiftly to gather information, identify those behind it and operationally neutralize their ability to do harm.”

By 9:30 p.m. Friday, the police sent out a widespread “be on the lookout” alert and a photo of Mr. Brown to officers’ cellphones.

A full manhunt was underway, and the two men were arrested by two “sharp-eyed” Metropolitan Transportation Authority officers before midnight while entering Penn Station, said Commissioner Sewell.

They were charged with felonies, including criminal possession of a weapon and making a terroristic threat.

Authorities seized an eight-inch military style knife and an illegally held gun with a 30-round magazine from Mr. Brown, who they said was also in possession of a swastika arm patch and ski mask.

Police said that Mr. Brown had a history of mental illness and had recently expressed an interest in coming to New York to buy a gun. Mr. Brown also told authorities that he operated a white supremacist Twitter group and that Mr. Mahrer was one of his followers.

Lawyers for both men had no immediate comment on Tuesday.

On Saturday, Mr. Brown told the police that he and Mr. Mahrer had first gone to St. Patrick’s Cathedral on Fifth Avenue to “get the blessings” before being driven to Pennsylvania by a friend of Mr. Mahrer’s to buy a gun.

The reference to a priest’s blessing in one of the tweets that analysts detected on Friday helped convince them that the threats were serious.

“The fact that someone is talking about a specific time and a specific day, and they are going to a religious authority, all suggested they wanted some level of approval for what they wanted to do,” Mr. Silber said. “And the fact that they were willing to die by cop.”

Luis Ferré-Sadurní contributed reporting.