Online Library

VOX-Pol Blog post.

The primary objective of this paper is to map the online presence of Hayat Tahrir al-Sham’s (HTS) media branch – Ebaa News Agency (ENA) – on the surface web. It also measures three years of propaganda output of the group and its viewership, as well as outlines the thematic landscape of its productions based on the content analysis of a sample. It argues that Ebaa’s messaging pattern constitutes a peculiar mixture of opposing priorities. It paid a great deal of attention to portraying itself as an independent news agency that has nothing to do with violent terrorist organizations (VEOs). In effect, its productions are easily available on the surface web. A closer look, however, proves that since 2017 ENA has been dedicated to supporting HTS’s radical Islamist agenda. This paper provides evidence of this. Moreover, Ebaa adopted a two-vector distribution strategy of its productions, composed of standalone websites and Telegram channels. In this context, the output of this media cell appears to be quite impressive. Between 2017 and 2020, it was capable of releasing more than 13,000 pieces of propaganda on its websites. At the same time, however, their viewership was lower than initially expected.

This article discusses the reasons why content moderation and control in cyberspace, being a primary means of online countering violent extremism (CVE), does not work as intended. It makes four main arguments. Firstly, despite years of efforts from CVE stakeholders, the propaganda of militant Islamist VEOs is still easily accessible on the Internet. This study has mapped hundreds of addresses engaged in digital jihadist activities at the turn of 2020–2021. It effectively proves that the current approach to online CVE brought few tangible effects. Secondly, these programs have been unevenly applied to militant Islamist organizations. There have been groups which represent violent extremist ideology but are not actively combated by stakeholders. As a result, these groups have been able to establish a solid foothold on the surface web. Thirdly, the efficiency of CVE strategies based on content takedowns are decreased by the relative ease of terrorists reestablishing banned communication channels, the availability of vast alternatives for online propaganda dissemination, the introduction of impractical legislation by governments, overlapping jurisdictions on the Internet and the “Streisand effect.” Finally, adequate strategies aimed at curbing digital jihad should be primarily based on offline and online activities which fall outside of the remit of CVE.

This study maps the surface web information ecosystem exploited by the Islamic State (IS) and its followers between December 2020 and June 2021. Open-source intelligence investigation allowed a massive online presence of Daesh, manifested by hundreds of communication channels, to be detected. Its propaganda dissemination was founded mainly on one “central” Arabic domain, linked to a constellation of auxiliary standalone websites, blogs, encrypted messaging apps, as well as file-sharing and streaming services. Aside from it, the Islamic State utilised other surface web environments, including numerous Internet Archive profiles and a network of communication channels established by Afaaq Electronic Foundation. This study also shows that URLs banned by law enforcement in 2020 and 2021 were usually quickly restored by the IS’s media offices.

This paper maps communication channels exploited by the Salafi-jihadist violent extremist organisations (VEOs) and their followers between March 2020 and June 2022 on The Onion Router (TOR). It argues that the true scale of digital jihadist presence on TOR has remained insignificant for years. Militant Islamists have mostly used .onion domains as backup propaganda dissemination channels, which enable content takedown policies introduced by countering violent extremism stakeholders to be circumvented. Aside from propaganda distribution, TOR attracts Salafi-jihadist VEOs and their followers for other reasons, as it facilitates anonymous communication, crowdfunding, sharing of terrorist manuals or the organisation of terrorist attacks.

This article, which combines social network analysis and open-source intelligence, discusses the functions, structure, and evolution of al-Qaeda’s (AQ) information ecosystem on the surface web in the second half of 2023. It argues that despite preferring Rocket Chat as a primary communication channel, this terrorist organisation developed an extensive and robust propaganda distribution network detectable from the surface web. The pro-AQ ecosystem on this Internet communication layer relied primarily on standalone websites, message boards, and blogs, interconnected with a broad range of file-sharing services and channels on encrypted communication apps. Aside from them, the group manifested limited activity on mainstream social media. In the second half of 2023, the group demonstrated resilience to content takedowns, as most of its key domains used to disseminate propaganda continued to be active under the same or changed URLs. This study shows that, in contrast to the Islamic State, alQaeda’s information ecosystem was largely decentralised, which was primarily caused by the differentiated approaches of its branches to maintaining their presence in this environment. The lack of centralisation of AQ’s propaganda distribution network may be considered both an advantage and a disadvantage. On the one hand, it potentially increases its resilience to content takedowns. On the other hand, however, it also demonstrates a lack of coordination between branches, which decreases their media operations’ potential efficiency and reach.