The Senate’s investigation into the deadly school shooting in Tacloban City has begun to paint a troubling picture of how online spaces and access to firearms may have intersected in the tragedy.
During a hearing led by Sen. Risa Hontiveros this week, lawmakers, investigators and cybersecurity experts presented initial findings while emphasizing that the probe remains ongoing and that many details are still being verified.
Here are four key takeaways from the investigation so far:
1. Authorities are investigating a possible link to the extremist network ‘764’
One of the most alarming revelations from the hearing was the possible connection between the suspects and an online extremist network known as “764.”
Open-source intelligence (OSINT) researcher Bret John Manalo, who told senators that he had gone undercover in online communities associated with 764 as part of his research, said the network is not a traditional organization with a clear hierarchy. Instead, it operates as a decentralized ecosystem of online communities and splinter groups spread across social media platforms, messaging apps, and encrypted channels.
The United States Department of Justice (DOJ) has described 764 as a violent online network that exploits vulnerable populations, often minors, and has charged several alleged leaders and members of the group.
The Federal Bureau of Investigation (FBI) has also said all of its field offices are investigating 764 and related networks, underscoring growing concerns over the group’s international reach.
However, local authorities stressed that there is no evidence yet that the Tacloban suspects were members of the group or that the attack was orchestrated by it.
2. Investigators have identified an alleged adult groomer
Hontiveros disclosed that authorities have identified an adult individual who may have influenced the minors involved in the shooting.
Investigators are now determining the extent of this person’s involvement and whether the individual manipulated or encouraged the suspects through online interactions.
Luis Angelo Talatala of DeepWebKonek told senators that extremist networks often build trust with vulnerable children by offering emotional support and a sense of belonging before introducing them to increasingly disturbing content.
Talatala and Manalo also said these online networks often put recruits through a form of “initiation,” in which minors are gradually pushed to prove their loyalty or commitment to the group.
According to the resource persons, the process can begin with seemingly harmless interactions before escalating into increasingly disturbing requests designed to isolate, manipulate or exert control over young users. The experts said these tactics are intended to desensitize victims and make it harder for them to leave the community.
Cybersecurity expert Angel Redoble, chair of the Philippine Institute of Cybersecurity Professionals, told senators that groomers often target children who are lonely, socially isolated or struggling with mental health issues.
According to Redoble, the recruitment process typically begins on public platforms, such as online games, where predators identify vulnerable minors before moving them to private servers and encrypted messaging apps where relationships are deepened away from public view.
From there, children can be subjected to psychological coercion, isolation and escalating demands designed to exert control over them.
3. Online radicalization is emerging as a major line of inquiry.
Beyond the alleged groomer, investigators are examining whether the suspects were exposed to violent online communities.
Manalo said online radicalization is often a gradual process, with minors slowly being drawn deeper into harmful digital spaces. Talatala also warned that these communities can use psychological manipulation and intimidation to maintain control over their targets.
Authorities are reviewing digital evidence, including social media activity and messaging platforms, to determine whether the students were encouraged to glorify violence or emulate previous attacks.
Redoble also laid out what he described as a seven-stage process of radicalization, beginning with initial targeting and trust-building before progressing to isolation, coercion and the normalization of violence, with the final stage involving real-world violent acts.
He warned that online algorithms can amplify the process by repeatedly exposing vulnerable users to increasingly harmful content and communities.
4. The shooters were reportedly avid players of GoreBox
Initial police findings showed that one of the suspects was an avid user of the mature-rated sandbox video game GoreBox, while investigators later told senators that both minors frequently played the game.
GoreBox allows players to spawn weapons, non-playable characters and explosives in an open environment where they can simulate combat and other forms of graphic violence. It also features blood effects, dismemberment and realistic injuries.
Authorities, however, emphasized that there is no evidence that the game directly caused the shooting.
Talatala cautioned against viewing the incident solely through the lens of video games, saying the larger concern is the online environment that can expose young users to harmful communities.
The Cybercrime Investigation and Coordinating Center has also confirmed that the game is no longer accessible through the Google Play Store and Steam in the Philippines pending further review.
Readers who wish to watch the full Senate hearing may view The Philippine Star’s livestream coverage on its official Facebook page, which includes the testimonies of lawmakers, investigators and resource persons who discussed the alleged links to the 764 network and the broader issue of online radicalization among minors
