The deadly shooting at Banga National High School in South Cotabato, Philippines, has taken a new turn after Philippine officials said the student involved had been heavily exposed to material on the deep web.
Department of the Interior and Local Government (DILG) Secretary Jonvic Remulla made the statement on September 19, saying investigators found evidence of the student’s online activity and notes on his phone.
The disclosure has raised new questions about the role of violent online communities, dark web content and the way young people can be exposed to harmful material online.
But investigators have not established that the dark web alone caused the attack.
That distinction is important.
What Happened at Banga National High School?
The shooting happened on September 18 at Banga National High School in Banga, South Cotabato, in the southern Philippines.
Officials said three students died, including the student identified as the shooter, while several others were injured. Different reports gave varying injury figures as authorities continued updating the casualty count. GMA News and other Philippine outlets later reported eight injured students.
The incident shocked the local community and quickly became a national story.
The Philippine Department of Education said it was coordinating with local authorities and law enforcement while assisting affected students and school personnel.
The incident also became the subject of a wider investigation into school security, firearm access and the student’s online activity.
DILG Says the Student Was Deeply Involved in the Dark Web
During a press briefing, DILG Secretary Jonvic Remulla said investigators found that the student was heavily involved with what he described as the “deep dark web.”
Remulla also said investigators found notes on the student’s cellphone that described depression and ongoing personal difficulties.
According to the DILG chief, the student’s parents had noticed warning signs in April 2026 and attempted to intervene.
Officials have also said the student was reportedly connected to an online “True Crime Community.”
However, authorities are still investigating what that community was, what content the student viewed, and whether it had a direct connection to the shooting.
That means the phrase “dark web influenced the shooter” should currently be treated as an official claim under investigation, not as a fully established explanation for the attack.
What Is the “Deep Dark Web”?
The terms deep web and dark web are often used interchangeably, but they are not the same.
The deep web includes internet content that search engines do not normally index. Private email accounts, online banking portals and password-protected databases are common examples.
The dark web is a smaller part of the deep web that requires special software or configurations to access. The Tor network is one of the best-known technologies associated with dark web services.
Not everything on the dark web is illegal. Researchers, journalists, activists and people who need stronger privacy can use privacy-focused services.
At the same time, hidden services are also used for criminal activity, including stolen data markets, fraud, malware distribution and other illegal services.
Dark Web Decoded’s guide to the dark web explains the difference between the surface web, deep web and dark web in more detail.
Officials Are Also Looking at a “True Crime Community”
The dark web claim is not the only part of the online investigation.
South Cotabato officials previously said the student was allegedly a member of an online True Crime Community, described as a group interested in violent crimes and high-profile criminal cases.
South Cotabato Governor Reynaldo Tamayo Jr. said authorities were investigating the group’s nature and whether it had any connection to the incident. The Philippine News Agency also reported that officials cautioned against concluding while the investigation was still underway.
The Department of Education now wants to examine this part of the case more closely.
Education Secretary Sonny Angara said DepEd would seek help from the Department of Information and Communications Technology (DICT) and DILG to investigate the reported online community and its possible influence.
This is an important development because investigators are not simply looking at whether the student visited a particular website. They are trying to understand the wider online environment around him.
The Gun Came From the Student’s Father
Investigators are also examining how the student obtained the firearm.
Officials said the weapon belonged to his father, a Department of Education employee who had three licensed firearms.
DILG Secretary Remulla said the firearms were not secured well enough to prevent the student from accessing one. Other reports said the student broke open the vault where the weapon was kept.
This has created another major focus of the investigation: firearm security and access by minors.
Education Secretary Angara has also called for stronger school security measures, including greater use of metal detectors.
The Attack May Have Been Planned Earlier
Investigators are also examining evidence suggesting the attack was not entirely spontaneous.
According to Banga Mayor Albert Palencia, messages recovered from a Messenger group chat indicated that the student had discussed plans for an attack earlier in August.
The mayor said the student had previously indicated a September 3 plan that did not happen. Authorities are examining these messages as part of the investigation.
Friends were reportedly warned before the September 18 incident, but they did not treat the warnings as a serious threat at the time.
This part of the investigation could help authorities understand how long the planning process lasted and whether other people were aware of the student’s intentions.
What We Know About the Online Influence
There are now several separate pieces of information about the student’s online activity:
- DILG says he was heavily involved with the “deep dark web.”
- Investigators reportedly found violent online content and extensive internet activity.
- Officials said he was allegedly connected to a “True Crime Community.”
- Investigators reportedly recovered relevant messages and notes from his phone.
- DepEd wants DICT and DILG to investigate the online community further.
- Authorities have not publicly established that one specific website or online group caused the attack.
That last point matters.
A person can consume disturbing online material without committing violence. Researchers and investigators need more evidence to determine whether online content played a direct role in this specific case.
Why the Dark Web Is Being Discussed
The case highlights a real cybersecurity problem: harmful online communities can exist across many layers of the internet, and some can be difficult for parents, schools and law enforcement to identify.
Dark web monitoring is normally associated with threats such as leaked credentials, stolen databases, malware and criminal marketplaces. But hidden online communities can also challenge investigators because their activity may span different platforms and private groups.
As we reported in our investigation of Operation Alice and the massive dark web network it exposed, dark web activity can involve large and complex networks that are difficult to understand from a single website or post.
That does not mean every dark web user is involved in criminal activity.
It does mean that investigators need to look at the full digital trail, rather than focusing on one platform.
Parents and Schools Are Being Urged to Watch for Warning Signs
Remulla urged parents to watch for changes in their children’s online behavior and mental well-being.
He also stressed the importance of professional support when children show signs that they may be struggling.
DepEd has said it is also working on stronger school safety measures and expanding support for student mental health.
For parents, the lesson is not simply to monitor whether a child uses the internet.
It is also to notice sudden changes in behavior, exposure to violent material, threats, extreme withdrawal or other warning signs and seek appropriate professional help when necessary.
The Investigation Is Still Developing
The South Cotabato school shooting has raised several difficult questions about dark web activity, violent online communities, mental health support, firearm security and school safety.
But investigators still need to establish how these factors were connected.
The Philippine government is now examining the student’s digital activity, including the reported deep dark web involvement and True Crime Community connection.
For now, officials have confirmed the online activity as an important part of the investigation. Still, the evidence does not yet establish a simple cause-and-effect link between dark web exposure and the shooting.
As investigators examine the student’s phone, online accounts and communications, more information could clarify what happened before the attack and whether anyone else knew about the plan.
