ISIS and Social Media

Written By: CENSA Editorial Board

Why does the Islamic State use social media and other factions of the Internet so broadly? Is the Islamic State’s use of social media effective?

A current hot topic of conversation involves the use of the Internet and social media by the Islamic State (IS) for spreading information, facilitating communications, and for coordinating attacks—with the recent attacks in Paris, France, serving as a prime example.

The use of Internet-based activities is not something that is new to terrorists, or to Islamic Terrorist Organizations for that matter; indeed, it can be persuasively argued that these tactics have been in use by Al Qaeda (AQ) and its affiliates for nearly two decades. Some even argue that when the Islamic State first began in Iraq as the ISI, or Islamic State of Iraq, under Abu Musab al-Zarqawi’s leadership, its use of Internet-based activities was a vital part in establishing its presence as a significant and violent force within the region.

Since approximately 2011, however, the world has seen a more advanced and pronounced amount of online activity from the Islamic State, with its Internet-based activities and propaganda efforts occurring with more frequency and growing more common. What once may have been a time-consuming and resource-depleting project to upload a single beheading video is now certainly more routine; to be sure, a major campaign has evolved across multiple online platforms, one involving or engaging strategic messaging, information warfare, recruiting, and important command and control efforts.

As this evolution has taken place, the tactics and techniques used by IS—especially compared to those of AQ—have also evolved. Al Qaeda’s style: initiate information propagation in a closed forum where only vetted members enjoy exclusive access. Then, rely on this group to promote the information into the mainstream media. From there, users on social media pick up the important points and promote it further before the cycle repeats. AQ thus establishes a specific goal and purposely uses the Internet to advance this goal in a deliberate, controlled fashion.

In contrast, IS messaging is disseminated in a much more diverse manner, reaching mainstream news outlets and closed forums after IS engages and releases such information through social media channels. It is an effective model: the organization’s message is propagated immediately and widely; encrypted mobile applications and “dark web” engagements enable and augment the integrity of closed forums; and, ultimately, fundraising efforts, high-level command and control communications, and the sale of illicit goods are facilitated. What once required access to fast super-computers and stable Internet connections is now accomplished through the use of smart phones and social media—enabling the sharing of information in real time with tens of thousands of jihadists and potential recruits and an even broader network of support. The notable shift has been recognized by the Threat Knowledge Group:

“ISIS, or the Islamic State (IS) as it now calls itself, is a far deadlier enemy than Al Qaeda, especially in its understanding and use of Information Warfare and Psychological Operations (PSYOP). A fully fledged insurgency which has recruited tens of thousands of fighters and controls large parts of Iraq and Syria, IS is especially skilled in the exploitation of global social media networks to radicalize, indoctrinate and recruit.” [1]

For example, Twitter has become an important new online tool for jihadists because of its ease of use and ability to provide real time updates to an unlimited number of viewers. Furthermore, Twitter provides the user community the choice of remaining somewhat anonymous, with its alias and muse status options. Indeed, IS’s use of Twitter and its members’ presence there can now be a good indication of their larger social media use.

Consequentially, IS’s use of Twitter has been countered with online tactics, and effectively so, with Twitter’s mass shut down of IS-associated accounts and “take-overs” by the cyber-vigilante group Anonymous serving as prime examples. But such tactics have caused IS to adapt as well. Twitter still remains a popular platform for the extended IS community and Twitter as a medium can be a great starting place for researchers and analysts to gain significant insight into IS’s use of social media. Common hashtags, memes, pictures, links to videos and other sites can be monitored and utilized to follow IS activity and perhaps even operations.

Especially recently, IS online activity has expanded and has grown to include many other platforms and mobile applications for the promotion of its agenda. Over a year ago, for example, SITE Intelligence Group reported on the shift from Twitter to Friendica, an announcement that was made – oddly enough – on Twitter: “In an unexpected move, media outlets of the Islamic State (IS) have announced that they will be suspending Twitter posts for an unspecified amount of time as the group has moved to a different social media outlet. The Twitter account of al-Battar Media, an Arabic-language group dedicated to promoting IS propaganda, declared in a July 12, 2014, tweet that select IS groups should redirect activity to a European server of the social network Friendica:

Important: Al-‘Itisaam Media Foundation and the al-Hayat Center decided to stop publishing on Twitter temporarily and we ask you to disseminate the following links to the official pages on Friendica…

In a follow-up tweet, al-Battar Media provided links to three other IS-linked media accounts on Friendica, labeled as al-‘Itisaam, al-Hayat Center, and Ajnad. The tweet ended with a hashtag translating to “#Support_Accounts_of_the_Islamic_State.” [2]

During that time, and since, a shift to several more online platforms has occurred, all with varying purposes:

  • The frequent use of vK, a Russian-based Facebook-like platform, is likely used both to avoid the shutdown of inappropriate accounts and to hide messages within the “noise” of social media. vK, and especially geo-enabled vK, appears to be used by Russian web-brigades, or “Troll Armies,” to create a deafening level of noise throughout social media. The methodology employs large numbers of geo-location accounts that appear online as either bots or trolls, thus creating a significant distraction and difficult challenge for analysts to comb through and sort out messages in a timely manner;
  • The increased use of temporary paste bins, such as, to post relevant operational information, recruiting and travel information, links to official publications and documents like Dabiq magazine, and to serve as a place for IS members in different countries to communicate (through formal Q&A sessions);
  • The spread of video propaganda across YouTube and LiveLeak as well as in, to mass produce media, attract global attention, and stimulate and exploit emotions across a vast audience;
  • The move to encrypted, mobile, peer-to-peer communication apps such as Snapchat and kik. The use of these platforms is largely seen to be in connection with Twitter and other platforms where a user will display a username for specific mobile accounts and instruct others to take certain conversations out of social media and redirect to these applications.

And yet another online trend has recently emerged with the rise and use of a tool called Telegram. According to its official website, Telegram is “a messaging app with a focus on speed and security, it’s super-fast, simple and free. You can use Telegram on all your devices at the same time — your messages sync seamlessly across any number of your phones, tablets or computers.” [3] The company assures users that the application is secure and “private” with the use of unique end-to-end encryption techniques that allow the deletion of information that may be seen as illegal. Although primarily a mobile application, Telegram also hosts downloadable desktop applications for multiple operating systems, thereby expanding the number of options available to users. These attributes have thus attracted greater IS activity. IS now holds conversations and hosts forums and chat rooms within Telegram, even as it initiates conversations and posts links to Telegram sessions vis-a-vis Twitter feeds.   After the Paris attacks, strong cultural and social pressures have even caused Telegram to intervene in IS use of their platform. 

All this leaves us asking; where will IS go next? Is there a next? Is technology advanced enough at this point for its communications’ agenda to migrate elsewhere? With rapid technology advances, adept users, and evolving needs, the IS almost certainly will be engaged in a constant search for the next “big thing” on social media. Meanwhile, regardless of the nature and availability of applications or platforms, the following will hold true for IS and its larger community: its agenda to establish a global Islamic Caliphate will remain; its pressing and constant need for public attention will continue; and its propensity to pursue and advance its goals through social media and a variety of Internet activities will not waiver. As a result, our nation would be well served if it began to strategically engage this adversary, as opposed to merely believing that online tracking and encryption technologies alone will address and confront these challenges.