Evolution of terrorists’ use of the Internet

Amy-Louise Watkin & Joe Whittaker, from Swansea University, discuss social media as a tool for terrorism, and how terrorists use the opportunity such sites present to reach audiences less familiar with the deep, dark web

It is often argued that terrorists are among the first to exploit new technologies to achieve their aims. This is, perhaps, unsurprising, as multiple studies have found the average age of a terrorist actor to be in their mid-twenties; usually an age associated with embracing technology. However, it is not just youthful exuberance that accounts for this trend. As governments, law enforcement and civil society begin to catch up with the use of a particular technology, terrorist actors must usually learn to use the next mode of communication to be able to spread their message.

The first era of terrorist content on the Internet was not dissimilar to general user experience – web pages which one could visit and read, as well as the peer-to-peer media of email and online fora. In its early days, the Internet was something of a libertarian paradise, to the point in which even the notion of a ‘cyber crime’ was an ill-defined concept. However, as soon as practitioners began to act against this content something of a cat and mouse game begun. One of two things usually happened. Sometimes websites and fora would be taken down and content creators would strive to make quick replacements, perhaps with greater anonymity than before. If sites remained open, the (usually correct) assumption among users was that security services had infiltrated them for the purposes of intelligence. Multiple studies found that this caused distrust to be rife among these platforms and a number of trust-reassuring systems were put in place. However, transactional terrorist matters rarely took place online. Instead, they tended to be places to share propaganda, socialise, and teach according to specific ideologies. If users showed their dedication to the cause then they were often invited to more private channels, or indeed, to show their support offline.

Web 2.0: social media
However, as the Internet gradually transitioned into the ‘Web 2.0’, the user experience dramatically changed. Suddenly, rather than being found in the deepest, darkest corners of the Internet, the opportunity appeared to engage audiences on the new front pages of the web: social media sites. These sites’ popularity offered an opportunity to reach audiences who would never have considered engaging with such content, and would never have found it if left to their own devices. However, it should not be understood that groups had immediate success with such sites. Many discovered that digital marketing is not easy, especially without significant expertise and personnel. For most, investing considerable time and resources did not seem like a cost worth bearing. Here lies an important misunderstanding. While it is often claimed that terrorists are particularly apt at using technology, this is the result of a survivorship bias. Most groups do not use such technology effectively, and often fall into obscurity as a result.

However, many groups have used ‘Web 2.0’ technologies to disturbing effect, such as al-Shabaab, who became the first group to live tweet an attack during their siege of the Westgate mall in Nairobi in 2013. Despite this early warning of groups being able to utilise social media to their advantage, law enforcement was caught entirely unprepared for the rise of the Islamic State (ISIS) and the declaration of the caliphate in the summer of 2014. Just as important as their physically occupied territories was their virtual caliphate. During that summer, accounts were able to operate with a great deal of freedom, especially on Twitter, which has always prided itself on not taking content down unless absolutely necessary. In fact, the company used to hold the unofficial motto: ‘the free speech wing of the free speech party’.

Twitter quickly became ISIS’ go-to platform as its short form micro-blogging format was perfect for links to other sites or media such as pictures or videos. When new content was released, both official members and ‘disseminators’ would act in a way not dissimilar to a viral marketing campaign, sharing and retweeting to create a buzz to ensure the maximum reach possible. At peak, estimates of the number of users were in the tens, or even hundreds of thousands at any one point. In short, ISIS became the first group to really successfully harness social media because they had the skills and knowledge to use it and the understanding of its potential power. Anecdotal stories from within the ISIS controlled territories say that being a propagandist in the group carries the same social kudos as being a fighter, which is emblematic of how important it is seen.

Encrypted platforms
However, in 2016 this began to change as both governments and private industry started to adapt to this threat. Under an immense amount of public pressure, Twitter adopted a robust suspension policy which severely damaged the group’s ability to act on the site. There are now very few readily available ISIS supporting accounts, and those that do are usually suspended very quickly, and often have no profile pictures and long, undistinguished screen names to avoid detection. However, as with previous technologies, when security services and civil society caught up, ISIS migrated to new platforms. Between these mass suspensions and the loss of territory over the last year, ISIS has shown an increased reliance on other online platforms and incredible adaptability with a giant leap to encrypted platforms such as Telegram.

Telegram hosts many of the same features and capabilities of open platforms, but with the additional components of security and privacy. Telegram is a free, cross-platform app that can be accessed via mobile devices, laptops and desktop computers. There are two main features in this app: channels and chat rooms. Channels allow individuals to release information in several formats (text, images, videos, audio etc.), but do not allow for the consumers of this information to do anything other than consume (i.e. they cannot comment on the posts). Chat rooms, on the other hand, allow for individuals to interact with each other either via conversations or posts, including sending memes and stickers. Telegram has several features that are particularly appealing to terrorist organisations such as allowing secret encrypted one-to-one chats and the option for messages to ‘self-destruct’ after they have been read. It has been argued by some scholars that the chat rooms have become ‘virtual communities’ providing followers with a sense of purpose and belonging. Scholars have also reported that the content being shared on Telegram is not unlike the content that was previously seen on Facebook and Twitter before the suspension crackdowns: recruitment videos, violent imagery, beheading and suicide videos, and images of dead children killed by their enemies. This content, particularly the latter, are all intended to encourage followers to join them and take action.

Telegram now allows for terrorist organisations to reach out to their sympathisers in private encrypted one-to-one chats and call for attacks in their home countries. Research has found that there is prominent discourse around the encouragement of simpler attacks that do not require sophisticated weapons or methods with the primary message being that anyone can undertake an attack for them. These dangers have already been seen in the case where the Istanbul Reina club attacker was told to commit the attack from his Emir in Raqqa over Telegram, and then again when Rachid Kassim, a French-born ISIS propagandist used Telegram to recruit individuals to undertake attacks in France. After the Brussels and Paris attacks, it became apparent that the attackers had used the private chat feature in Telegram to plan the attacks. With the app’s constant increase in popularity, it is unlikely that this will be the last time that this occurs.

New platforms, new problems
However, it is important to note that terrorists’ use of Telegram does not come without problems for them. The private and secure nature of Telegram does not offer the same momentum and ability to reach new recruits in the way that Twitter did. The use of ordinary hashtags on Twitter allowed terrorist organisations to reach those who may not have reached out to them otherwise. Additionally, the use of terrorist-related hashtags allowed the curious to find them fairly easily. Telegram is rather secluded in this sense as it does not allow either of these and is mainly accessible to existing followers. As a result, terrorist leaders have been calling out to their followers, encouraging them not to seclude their efforts just to Telegram but to continue utilising the benefits that come from using open platforms. Interestingly, despite encrypted platforms representing the cutting edge of cyber technology, the anonymity and fear of infiltration by security services results in a level of distrust that is emblematic of the first era of online terrorist content.

On the topic of open platforms, it is important to remember that they are evolving all the time with new features being added fairly regularly which are at risk of exploitation from terrorist organisations. It was only in 2016 that Larossi Abballa killed Jean-Baptsiste Salvaing, a senior police official in Magnanville, France, and his wife, and then turned to Facebook’s feature (which was new at the time), Facebook Live. Abballa used this feature to broadcast a live speech for 12 minutes in which he called for others to undertake similar attacks in France.

The notion of terrorists adapting by utilising new technologies is not a new one and the current terrorist threats are no different. Major suspensions on the most popular open platforms have caused IS to move to encrypted platforms. Despite the greater freedom this allows them, it is not without a new set of difficulties for the group, whose reach has been severely diminished and are hampered by severe distrust. These costs and benefits must be weighed up by practitioners trying to decide whether intelligence or limiting reach is more beneficial.

Please register to comment on this article

Supplier Profiles

Black Watch Tactical

Being a trusted advisor to the Security Industry you have to that one to one commitment with your client and visualize what they require in the way of service and when the time is right act.

SecuLution
FLIR