Online Library

Islamic State of Iraq and Syria (ISIL) supporters fanned out large amounts of Arabic content across Twitter all through the week in the wake of the news surrounding the death of Abu Bakr al Baghdadi. Many accounts were exhibiting strong and multiple signals of automated behavior1, spawning every hour, on the hour, and Institute for Strategic Dialogue (ISD) researchers monitored and tracked these accounts, and their tactics for the past week following the news. Twitter, and accounts specifically designed to report ISIL activity, were limiting some of the effects of what researchers were calling the ‘Baghdadi Net.’ However, it was clear the accounts were able to generate again, sometimes seconds within a takedown period, and spread video, and audio, as well as new ISIL-news content. Many accounts used western avatars, linked to real people, as well as hashtags that were trending across the Middle East and North Africa, including those being used in the Iraq and Lebanon protests. Latching on to trending topics is a well-documented tactic by ISIL and other groups to increase impressions and overall reach of content. As of Friday, the accounts were tweeting out audio content produced by al Furqan media heralding the ascension of the new ISIL leader Abu Ibrahim al Hashimi al Qurashi.

This new investigation from the Institute for Strategic Dialogue (ISD) delves into the inner workings of a pro-ISIS account network on Facebook, providing a case study of the resilient network dynamics, technological loopholes, and cross-platform activity that allowed a web of accounts to survive and flourish for over three months on a platform which purports to be a hostile environment for terrorist actors.

This briefing outlines research uncovering thousands of users viewing extremist content in Arabic language across mainstream social platforms including Facebook and YouTube. The findings emerged as world leaders, policymakers, and technology companies gathered in Jordan earlier this month to discuss counter-terrorism and extremism as part of the Aqaba Process and the convening of the Global Internet Forum for Countering Terrorism (GIFCT).

Researchers identified:

• More than 77 pieces of Arabic content promoting influential Islamist extremists from al-Qaeda, the Islamic State of Iraq and Syria (ISIS) as well as affiliates for both organizations, and precursors to both groups on both YouTube and Facebook;
• More than 275,000 users have watched the videos on both Facebook and YouTube;
• The research finds evidence of Islamist extremist supporters sharing content between sites, spreading the content further than their primary YouTube Channels and/or Facebook pages and groups. Approximately 138 individual users have shared links from the YouTube to their networks on Facebook.

This joint report by the Institute for Strategic Dialogue (ISD) and the Combating Terrorism Center (CTC) at West Point offers a preliminary survey and analysis of one of the largest known online repositories of Islamic State materials in order to increase understanding of how violent extremist groups and their supporters manage, preserve, and protect information relevant to their cause. Seemingly managed by sympathizers of the Islamic State, the large cache of digital files, here nicknamed the “Cloud Caliphate,” provides researchers, policymakers, and counterterrorism practitioners additional insights into how and why groups and their adherents maintain archives of such material.
The core analysis breaks into seven different parts. After reviewing the likely origins of the repository, the first section describes its composition, and the second discusses evidence concerning cyber support from other online actors. Sections three through six explore specific folders within the archive, which pertain to matters concerning the Islamic State’s organizational predecessors and a range of notable leaders, ideologues, and scholars. Section seven of the report highlights a real-world case involving the use of the “Cloud Caliphate” archive by an Islamic State supporter. The report concludes with a reflective discussion that notes potential policy considerations for those tasked with confronting the Islamic State’s exploitation of information and communications technologies.

This report highlights the networks, supporters, and the platforms of Islamic State disinformation disseminators, focusing on popular social media platforms as well as encrypted messaging applications. These disinformation networks are creating self-branded media outlets with followers in the tens of thousands, and often with innocuous names like “Global Happenings,” “DRIL” and “Media Center,” to evade moderation and takedowns. These same networks use coded language and a codebook of emojis to spread Islamic State “news” to other networks of supporters, who similarly evade moderation. These ‘alternative news outlets’ are trying to outcompete narratives publicized by government officials as well as independent mainstream media and individual journalists – groups that were also heavily targeted by Islamic State.

VOX-Pol Blog post.