Winning the Cyberwar Against ISIS

Despite the efforts of the United States and its allies to fight the Islamic State (also known as ISIS), the group remains a formidable danger. It holds territory in Afghanistan, Iraq, Libya, Nigeria, and Syria and directs cells in Bangladesh, Egypt, France, the North Caucasus, and Yemen. ISIS operatives have conducted terrorist attacks in Europe—including one in November 2015 in Paris that killed 130 people—and lone wolves inspired by its propaganda have committed violence throughout the West.

The administration of U.S. President Donald Trump, like that of former President Barack Obama, has publicly committed itself to defeating ISIS using conventional military means. This approach has its benefits, but it ignores a significant part of the threat posed by ISIS. The group is strong not only on the battlefield but also in cyberspace, where it uses sophisticated techniques to communicate with sympathizers, spread propaganda, and recruit new members all around the world. As one ISIS defector told The Washington Post in 2015, “The media people are more important than the soldiers.”

To defeat ISIS in cyberspace, an entirely new strategic approach is needed: one that emphasizes close coordination, flexibility, and adaptability.

Yet U.S. efforts to monitor ISIS’ use of social media—and counter its online propaganda—have thus far been tentative, hesitant, and amateurish. Responsibility for countermessaging has shifted among various organizations, including the State Department’s Center for Strategic Counterterrorism Communications and the military’s Central Command (CENTCOM) WebOps team. But these entities do not appear to share lessons learned or even operate with a cohesive strategy. To defeat ISIS in cyberspace, an entirely new strategic approach is needed: one that emphasizes close coordination, flexibility, and adaptability.

TERRORISM AS THEATER

In his seminal 1974 article “International Terrorism: A New Kind of Warfare,” Brian Jenkins, an analyst at the RAND corporation, noted that “terrorism is theater.” Terrorist attacks, according to Jenkins, are not mindless but instead “are often carefully choreographed to attract the attention of the electronic media and the international press.” They are “aimed at the people watching, not at the actual victims.”

Jenkins’ basic analysis still holds. Today, however, ISIS and similar groups no longer need the media to disseminate their message; thanks to the Internet, they have the means to reach a global audience anytime they care to produce a fresh video. And since most of ISIS’ members are young enough to have lived their entire lives surrounded by online communications, it is no surprise that the group has a sophisticated presence on platforms such as Facebook, Telegram, Tumblr, Twitter, and YouTube. Indeed, social media is the primary means by which ISIS recruits new members, especially outside the Middle East. There is virtually no young Muslim, in either the West or the Islamic world, who does not have ready access to jihadist propaganda.

ISIS’ online messaging has evolved from that of older jihadist groups. Islamists have long used hostage videos for tactical purposes, but the practice of filming executions or attacks on videos intended for public release is a recent development. It dates to 2002, when al Qaeda–affiliated terrorists in Pakistan released a video of themselves beheading the journalist Daniel Pearl. Even then, such videos caused considerable controversy among Islamists and were reportedly disapproved of by Osama bin Laden. It was not until 2004, under the direction of al Qaeda in Iraq leader Abu Musab al-Zarqawi, that graphically violent videos featuring the gruesome murder of hostages became popular. Zarqawi used these video messages to promote his calls to jihad, in the process making himself a household name among Iraqis.

ISIS has taken Zarqawi’s basic concept and extended it, creating even more horrific, brutal, and expensively produced videos depicting mass torture and executions. Like Zarqawi’s, these grisly videos possess their own twisted logic. First and foremost, they are intended to induce terror in the group’s enemies. Second, they solidify ISIS’ legitimacy by portraying the killers as heroic defenders of the Islamic faith against infidels and “crusaders.” And third, the videos play a role in internecine warfare among jihadist groups in places such as Syria and Iraq, where rival organizations jockey for power and influence. The use of violence to create a gruesome spectacle before a global audience enables ISIS to present itself as the active leader of radical Islam, pushing aside and supplanting other groups that might have similar goals.

Yet ISIS propaganda is not limited to violence or brutality. The group’s messages contain a complex array of narratives, in which ISIS attempts to portray itself and its so-called caliphate simultaneously as a religious utopia, the preeminent military adversary of non-Muslims, and a sophisticated society governed by Islamic justice. These can be seen in the countless “visual reports” created and released by each of ISIS’ provinces: the videos show children on playgrounds, soldiers sitting in bucolic fields, and the elderly happily shuffling through bustling marketplaces. Its fighters are always shown on the offensive, often firing weaponry at unseen adversaries. Justice, too, is important. Whenever an individual is executed or punished—whether a POW or a subject of the caliphate—the group is careful to frame it as the outcome of a judicial process. ISIS presents evidence of the crime and justifies its choice of punishment with quotes from religious texts and precedents from previous Islamic rulers.

THE FIGHT FOR CYBERSPACE

So far, Western governments’ efforts to push back against the group’s online messaging have met with few successes and a number of high-profile failures. The U.S. State Department, for instance, faced criticism in 2014 for its awkward and ineffective attempts at countermessaging, including a fruitless Twitter war with ISIS supporters over the Abu Ghraib prison scandal. Yet three years later, U.S. tactics have not significantly improved. For example, a January 2017 AP investigation revealed that CENTCOM’s WebOps team brought in countermessaging specialists who were unfamiliar with the basic tenets of Islam and unable to speak fluent Arabic. As a result, the operation has had little impact on ISIS’ online recruitment.

There have nonetheless been some bright spots, especially with regard to nongovernmental organizations (NGOs), which have worked on their own and in tandem with the U.S. government to combat ISIS’ online presence. The Counter Extremism Project, for instance, has adapted a hashing software, originally used to combat child pornography, for use in counterterrorism. The software identifies digital signatures in images, audio, and videos uploaded to the Internet and compares these signatures with a database of known terrorist material. If the signatures match, the material is flagged and can be automatically removed. The European NGO Families Against Terrorism and Extremism (FATE) works to help families defend against the radicalization of youth. FATE has released videos in multiple languages, including English, French, and Arabic, countering ISIS propaganda and provided resources for parents and teachers on how to talk to their children about extremism. And hacktivist groups such as Anonymous have even conducted their own anti-ISIS campaigns, hacking into the group’s websites and producing fake propaganda laced with malware.

Yet to truly counter ISIS’ online presence, the United States needs to thoroughly overhaul its strategy. A useful first step would be for Washington to emphasize coordination and information sharing—not only among government agencies, but also between U.S. agencies, international partners, and NGOs engaged in the global effort to fight extremism. There is currently very little cooperation among organizations working on countermessaging, leading to a tremendous duplication of effort, repetition of mistakes, and constant reinvention of the wheel. Routinizing contacts among counterextremism organizations would go a long way to improving the effectiveness of each.

The United States should also create nimble “cyber cells,” or specialized, flexible, and adaptable units capable of carrying out online surveillance and information operations. These could operate under the direction of the Global Engagement Center, an interagency organization housed at the State Department, which was created in 2016 to coordinate the United States’ counterextremism messaging efforts. The GEC is well suited to the information sharing that these cells would need in order to succeed, and the center has already shown a willingness to innovate—since late last year, for instance, the GEC has used public data from Facebook and other social media sites to find users interested in jihadist causes and then target them with anti-extremism YouTube ads.

ISIS’ patterns of propaganda dissemination are evolving but predictable, based on trial and error. Understanding them, and creating countermessaging to undermine them, is fully within reach of skillful analysts. Eventually, U.S. cyber cells dedicated to fighting online propaganda should be able to expand current countermessaging to reach all those interested in jihad, despite what their public social media profile data show. And just as policymakers accept the risk of occasional misfires in kinetic warfare, they should allow cyber cells the freedom to operate without excessive restraint.

As skillful as ISIS is at manipulating its online followers, its reliance on social media leads to particular vulnerabilities.

AN EVOLVING BLUEPRINT

The good news is that as skillful as ISIS is at manipulating its online followers, its reliance on social media leads to particular vulnerabilities. For instance, it has been fairly obvious about how it sets up new social media accounts after its old ones are taken down. On Twitter, ISIS and its supporters have had to develop ways to transfer their network of followers from one account to the next. The most popular method is to simply add a number to their Twitter username and then to increase that number each time they are shut down and open a new account: when the account of ISIS supporter @Muslimah6 was shut down, followers knew she would reappear on the Twitter handle @Muslimah7.

This method of maintaining followers is used for Telegram as well. ISIS’ unofficial news channel, Khilafah News, is left public so that new users can easily find it, but this also allows Telegram to shut it down at any time. The administrators of Khilafah News also add a number to the end of their channel’s invitation link and increase this number every time the previous channel is shut down. This predictability creates an opportunity for those attempting to combat ISIS’ narratives. If they know which Telegram channel or Twitter account ISIS supporters will follow, they can attempt to create the account before ISIS does, replacing extremist content with their own. For example, cyber cell analysts could create a Telegram channel called Khilafah News 235, knowing that ISIS supporters would migrate there once Telegram shuts down Khilafah News 234. The same technique can be used to disrupt ISIS’ YouTube channels. Fake accounts would utilize the names and logos of actual ISIS-affiliated groups, and recruits would view their content, believing it to be real. In the best-case scenario, ISIS recruits will be exposed to some level of countermessaging. But at the very least, the tactic will make it more difficult to find authentic ISIS accounts.

Another potential weakness is ISIS’ use of Twitter hashtags. In 2014, the group famously hijacked World Cup hashtags in English and Arabic, posting propaganda with the hashtag #WorldCup2014 and thereby shocking social media users with images of graphic violence. ISIS has also called upon its supporters to use special hashtags when tagging and finding new propaganda. For example, issue nine of ISIS’ English-language magazine, Dabiq, gave instructions for users to check a specific Arabic-language hashtag for more propaganda releases. The same strategy could be adopted by countermessaging teams—anti-ISIS messages could be posted using the group’s own hashtags, putting alternative narratives into the same social media conversation. The United States has already begun to take tentative steps in this direction, with government analysts taking over #ISIS, #IslamicState, and other popular ISIS hashtags. But such efforts could be vastly expanded given a clearer understanding of ISIS’ marketing techniques and better-trained personnel with native fluency in ISIS’ preferred languages.

Adopting a new cyberstrategy along these lines would enable the United States and its European allies not only to create viable, proactive alternatives to ISIS’ messages but also to reach their desired audiences—potential recruits. Currently, the terrorist group is winning the online war for the hearts and minds of tens of thousands of Muslims around the world. The United States must act quickly to beat ISIS at its own game.