Opinion
The World Cup warning: Riots don’t start in the streets. They start online
The next riot will not start when the first barrier falls or when the video reaches social media. It will start earlier, in public signals that were available but not yet connected.
Riots rarely begin with the first broken window, the first blocked road or the first clash with police. By the time disorder becomes visible, many of the early signals have already appeared online: in public conversations, local reports, community groups, protest calls, fan discussions, transportation complaints and fragmented digital activity. These signals do not usually arrive as a clear warning. They appear as scattered pieces of public information, often disconnected until tension has already moved toward disruption.
That is the challenge facing cities, security agencies, transportation operators and event organizers as the World Cup becomes a global stress test for public safety. Major sporting events are no longer only logistical or security operations. They are information environments, bringing together fans, politics, identity, public frustration and physical infrastructure at massive scale. In that setting, even a small disruption can quickly become an operational problem.
Football has already shown how quickly public emotion can turn into disorder. The scenes that followed Paris Saint-Germain’s Champions League victory were a reminder that celebration, identity and crowded public spaces can collide when large groups move through the same streets and security forces are stretched. As attention shifts to the World Cup, Mexico City offers another warning sign: protests, strikes, road closures and infrastructure pressure show how global events can become focal points for tensions that already exist below the surface.
For public safety teams, the question is not whether every protest becomes violent or whether every online conversation represents a threat. Most do not, and democratic societies must protect the right to demonstrate. The real question is whether relevant public signals can be collected, structured and understood early enough to support better decisions. A blocked road can delay emergency access, a protest near a fan zone can disrupt transportation, and a rumor spreading among supporters can change crowd movement within minutes.
This is why public web intelligence is becoming essential for large-scale event preparedness. Organizations today do not suffer from a lack of information. They suffer from fragmentation. Relevant signals may appear across local news sites, public forums, social platforms, municipal updates, fan communities, event pages, images, videos and open online discussions. Individually, each signal may seem insignificant. Together, they can reveal a shift in public mood, crowd movement, protest coordination or operational pressure.
The difficulty is that early signals rarely look like threat intelligence when they first appear. A transportation complaint may look like a customer service issue. A fan discussion may look like normal pre-match excitement. A protest announcement may seem unrelated to the event itself. But during a global event, the distance between online activity and physical disruption can become very short.
The World Cup is a sporting event, but it is also a test for modern information systems. Police deployment, stadium security and crowd-control planning remain essential, but they are no longer enough on their own. Organizations that understand the public online environment will not predict every incident, but they will be better positioned to see patterns forming before those patterns reach the street.
The next riot, if it comes, will not start when the first barrier falls or when the video reaches social media. It will start earlier, in public signals that were available but not yet connected. For major events, the challenge is no longer only seeing what happens in the streets. The challenge is seeing what begins online before it gets there.
The author is the COO of Vetric, a company providing data infrastructure for detecting impersonations, deep fakes and digital threats.
