By Mohammed Al Darwish
A typical Daesh propaganda release goes through multiple phases on its journey from Telegram to reach more popular social web platforms like Twitter.1 This transition from Telegram to a wider audience on a more accessible platform requires the intervention of “fanboys” who dedicate their time and effort to spreading the propaganda material to the largest number of people possible.
Daesh’s approach to disseminating their propaganda material has changed significantly over the years: it began with the group merely posting propaganda material on Telegram along with multiple download links, then it evolved to build suspense by releasing a trailer or a text indicating the imminent release. The second approach has been very effective when it came to mobilising fanboys, therefore, when a trailer is released, fanboys rush to create Telegram channels named after the awaited release.2
After creating such channels or groups, dedicated fanboys accounts provide “ready-made and ready-activated” Twitter accounts and passwords for Daesh supporters to use in their Twitter ghazwah (offensive, invasion). As the accounts are already activated, Daesh supporters only need request the password to a given account by privately contacting the channel or group administrators, for instance the administrator/s of Alansar Bank.
The same channels or other dedicated channels would publish a list of trending or selected hashtags for the fanboys to hijack during their Twitter invasion. These hashtags are chosen based on popularity which Daesh fanboys hope to exploit the exposure they may generate. Such hashtags have routinely featured top grossing films, popular TV shows and series, and have been increasingly aimed at international media outlets and religious and media figures. Hashtags such as #WorldCup, #JustinBieber and #gameofthrones have been routinely appropriated and misappropriated by Daesh fanboys in an attempt to divert social media platforms, audience and topics into their own material. They aimed to expose unsuspecting users to their propaganda material, therefore, exposing the message to users who otherwise would not have been accessible.
This trend was refined when fanboys and Daesh-affiliated accounts began using Twitter’s @reply and @mention functions to increase the likelihood of Twitter users seeing the propaganda material. The channels also provide the names of accounts that fanboys should reply to when disseminating propaganda material.
This paper examines the hashtags hijacked by Daesh during Baghdadi’s latest appearance in the propaganda video “in the hospitality of the leader of the faithful” —released on 29 April 2019 — to provide a practical case study and bring to light the techniques Daesh supporters use to disseminate propaganda material on Twitter.
In the Hospitality of the Leader of the Faithful Twitter Dissemination Analysis
For the analysis, 221 Daesh fanboys’ Twitter handles involved in disseminating the propaganda material from 29 April until 2 May were tracked and examined using the social listening tools Crimson Hexagon and Brandwatch to live-track mentions, hashtags and online chatter of the video. The accounts involved in disseminating the video generated a total of 3,311 recorded posts on Twitter with an average volume of 297 tweets and 1,604,586 potential impressions.3
The 3,311 tweets were then analysed to provide an accurate breakdown of the number of tweets, replies and mentions and insights into the online behaviours of Daesh supporters when it came to the hashtags used. The analysis found that 994 of the tweets posted were in the form of replies, 2,309 were retweets and only 8 were standalone tweets.
Of the 3,311 tweets, 3,120 tweets used hashtags to disseminate the propaganda video.
The paper found multiple techniques employed to maximise the reach of propaganda material. Such techniques involved an individual account retweeting its own tweets (which are mainly about a propaganda material); retweeting the tweets of other accounts and replying to tweets with propaganda material links or instructions on how to download Daesh material.
These techniques are believed to be employed in order to increase exposure and avoid triggering Twitter’s spam-detection algorithms, and thus avoiding immediate suspension by Twitter. Below are the three instances of Daesh fanboys Twitter activity:
- Daesh fanboys retweeting their own tweets whilst replying to other users
Figure 7: Daesh fanboys retweeting their own tweets.
2. Retweeting their fellow-fanboys’ tweets
Figure 8: Daesh fanboys retweeting fellow-fanboys tweets
3. Replying to Twitter accounts that have a significant followership to increase impressions
Figure 9: Daesh fanboys replying to influencers’ Twitter accounts 
Figure 10: Some of the media channels targeted by Daesh fanboys during Twitter ghazwas
After the analysis has been conducted, a list containing the frequency of each used hashtag and mention was populated. The list of hashtags reflects Daesh’s fanboys active involvement in hijacking the most popular and trending hashtags during the time of the propaganda release. Moreover, it shows how fanboys are involved with the use of @mention and @reply functions in an attempt to exploit and leverage media outlets and popular figures to spreading their messages.
Hashtags Occurrences:
Below are some of the top Daesh hijacked hashtags:
| Hashtag | Occurrences |
| #الفرقان | 253 |
| #محيط_الرعب | 178 |
| #التعاون_الهلال | 158 |
| #الدولة_الإسلامية | 60 |
| #isis | 57 |
| #طوني_خليفه | 55 |
| #داعش | 52 |
| #تركيا_تقتل_زكي_مبارك | 51 |
| #صداره_بس | 46 |
| #nottoday | 44 |
| #زعيم_تويتر_فلورز_اهلا_رمضان | 41 |
| #استقاله_محمد_بن_فيصل | 38 |
| #اعلام_الهلال_يستصغر_التعاون | 37 |
| #العراق | 37 |
| #وش_تفكر_بوه | 35 |
| #مؤسسة_الفرقان | 33 |
| #baghdadi | 33 |
| #شروق_المطيري | 33 |
| #قيم_اوف_ثرونز | 33 |
| #battleofwinterfell | 30 |
| #aryastark | 19 |
| #islamicstate | 15 |
| #alanyaspor | 14 |
| #bringbacktrueindology | 14 |
| #charlottestrong | 14 |
| #cybersecurity | 14 |
| #gameofthrones | 14 |
| #happybirthdayrohit | 14 |
| #tripoli | 14 |
| #kurdistan | 12 |
Top 20 of the most targeted accounts include that of some media channels such as @ajplusarabi, @ajarabic, @alarabiya, @ajabreaking, @alhadath, @saudinews50 etc. but also a range of high-profile individual user accounts such as those of Muslim scholars, journalists and analysts.
Conclusion
Whilst this paper has demonstrated how Daesh fanboys use trending Twitter hashtags to increase the reach of their tweets, it has also brought attention to another complimentary and parallel approach emerging alongside hashtag hijacking whereby fanboys exploit mentions and replies to increase exposure and impressions of their Twitter posts through exposing specific unsuspecting followers to their messages. Hence, reply-hijacking is an emerging issue when it comes to Daesh exploitation and weaponisation of technology as it possesses potential to leverage the target profile’s status (profile-hijacking) to use it as a springboard and a portal into a greater userbase. As such, Daesh’s approach has been concerned with increasing the likelihood of Twitter users being exposed their content and thus increasing impressions, exposure and reach.
Dr Mohammed Al Darwish works as Insights Manager in M&C Saatchi World Services. Prior to World Services, he worked on a number of counter-terrorism projects with HMG, worked at BBC Arabic and a number of communications agencies with a focus on VEOs utilisation of social media to disseminate propaganda material.