Is ISIS still Alive and Well on the Internet?

January 14, 2019
admin
Brief Reports

As published in Homeland Security Today

Anne Speckhard & Ardian Shajkovci

With the collapse of the so-called “Islamic State” in Iraq, and much of Syria, an immediate corresponding and steady decline occurred in ISIS’ strategic communication and online propaganda activities. However, as this article illustrates, the group’s “virtual Caliphate” is rebounding and still remains very much alive today; it continues to create new content, as well as recycle old, with discussions and online recruitment into the movement still fiercely carrying on.

The European commissioner for the Security Union, Julian King, recently stated that despite suffering a significant blow both in Iraq and Syria, as well as globally, ISIS continues to be active online and promoting their ideologies. “They’ve suffered reversals on the ground in Iraq and Syria,” King noted, adding, “but they are still producing material, they still use the Internet to traffic their propaganda and their radicalizing material.”^[i]Likewise, recent research conducted by VOX-Pol demonstrates that despite the decrease in ISIS’ violent extremist material to 300 online items produced in December 2017, their production increased to 700 in January 2018 alone. Somehow, ISIS is still continuing to be active and spawn itself online. In addition, Europol recent research indicates that over 150 social media platforms, in multiple languages, continue to be exploited by violent extremist groups like ISIS and al-Qaeda worldwide. ^[ii]

In this regard, enhanced security measures and actions have been introduced to confront and address such threats. For instance, the 2017 EU Directive on Combating Terrorism extended the list of terrorist offences to also include spreading terrorist propaganda online, while a number of other legislative measures mandated the removal of violent extremist and terrorist content from Internet service platforms within one hour of being posted, placing a considerable burden on service providers like Google. In addition, in a coordinated, multi-country operation, law enforcement agencies in Belgium, France, Romania, Bulgaria, Britain, Canada, the Netherlands and the United States recently targeted ISIS’s combined online news outlets: Aamaq news agency, al-Bayan radio, and Halumu and Nasher news sites.^[iii] Unfortunately,ISIS’ Aamaqnews agency, despite the US-Europe coordinated law enforcement efforts, made a comeback only days after being shot-down, namely under a Russian registered Web address. ^[iv]

In tandem with government efforts, private companies and organizations have been steadily working to develop and increase tools and technologies to detect and remove violent extremist content online and apply open source, social media reconnaissance and intelligence tools to predict online radicalization (e.g. PhotoDNA, eGLYPH, Creepy, Maltego, etc.).^[v]Furthermore, the Global Internet Forum to Counter Terrorism, a partnership among the four giants of the Internet—Facebook, Google’s YouTube, Microsoft, and Twitter—was recently formed to “reduce the accessibility of Internet services to terrorists,”including engage in proactive takedown initiatives across Internet distribution sites that groups like ISIS favor.^[vi]

Each has in its own right worked hard to take down violent extremist content. For instance, Twitter claimed significant wins in squashing terrorist activity on its platform, often citing 95 percent accuracy of its algorithms designed to detect and flag terrorism-related content, with 75 percent of violent content being removed even before the first tweet is sent out.^[vii]In 2017, YouTube removed thousands of poisonous sermons and lectures by the radical cleric Anwar al Awlaki.^[viii]Earlier last year, executives from Google, Facebook, and Twitter shared with Congress their strategies of targeting violent online content that goes beyond screening and removing extremist content from their services, namely also “ targeting people likely to be swayed by extremist messages and pushing content aimed at countering that message.”^[ix]

Despite such efforts, ISIS and similar violent extremist groups still somehow persist in operating online. Relying on intel and Open-source Intelligence (OSINT) techniques, this month alone, the International Center for the Study of Violent Extremism (ICSVE) researchers have been able to identify over 500 Facebook accounts in Albanian, Arabic, English and Turkish that are promoting, sharing, endorsing or actively discussing ISIS material and/or supporting anti-Western and pro-ISIS ideologies. These professionally designed ISIS propaganda videos and materials in these four languages continue to engage, seduce, and inspire their followers online. Violence (e.g. beheadings), often depicted as retaliatory or retributive in nature for grievances—imagined or real that are blamed on the West and the Shia opponents—continue to dominate, as do messages aimed at demonstrating the group’s ideological purity and state-building legitimacy, despite ISIS having lost it’s Caliphate. Moreover, the ISIS “dream” of a Caliphate is still powerfully being peddled across national borders and the group is still evading international demise—at least when it comes to the Internet. (See Chart 1 for sample video shares).

Chart 1:Sample Facebook profiles recently sharing violent content online as identified by ICSVE researchers

One of the ISIS propaganda circulated videos (Chart 1) showcases ISIS militants herding a number of captive soldiers down a field; first preparing and then engaging in mass beheadings. The shocking violence finds its way to some users who find them enticing and appealing enough to comment—offering support and license to kill. Another video depicting Islamic State as a flourishing social system and economy garners sympathy and comments from a dozen of users.

While the group continues to hold on to its last sliver of territory in Syria, namely near the Iraqi border, its messages and propaganda online have shifted from claims of statehood and stories from inside the Caliphate to now showcasing a longer-term strategy rooted in a narrative of patience for the long awaited Caliphate to arise again. This is depicted as resulting from protracted insurgent attacks and guerilla attrition against Western powers. There also continues a global appeal to join the movement, with the continued call for hijrah (e.g. for believers to move from Western lands to places where sharia law is practiced, i.e. Afghanistan, Pakistan, etc. versus previous calls to come to the Caliphate), alongside claims of the necessity of fighting for the Caliphate due toMuslim oppression in the West, Sunni oppression in general, and calls for vengeance against those who have collaborated against the Islamic State, among others (See Chart 2 for sample video shares).

Chart 2: Sample Facebook profiles recently sharing violent content as identified by ICSVE researchers

One of the circulated videos (Chart 2) depicts two women wearing a traditional niqab as they are stopped and questioned by several police officers in what appears to be Europe. Many users discussed, shared, and expressed their outrage over the incident. Another video depicts a woman, also wearing a traditional niqab, being arrested by a police officer. One of the account holders comments in Albanian, “ She was imprisoned, not because she told the truth, but because the real men are missing…This is how our sisters will endure, as there are no men like Mu’tesim and Salahudin Ejubi” [i.e. heroic, historic Muslim figures]. Others post, share, and comment on another ISIS propaganda video boasting a new insurgency in Iraq.

While most terrorist recruitment occurs face-to-face at some stage in the process, initial contacts with terrorist groups often occur online. Social media and Internet platforms thus play an important role in facilitating terrorist propaganda to arouse the attention of vulnerable individuals, label and lay blame for their grievances in a manner terrorist approve, and ultimately move individuals along the violent extremism trajectory. In our interviews with a sample of over 100 ISIS and 16 al-Shabaab defectors, prisoners, and returnees, we continue to learn about how these terrorists groups’ strong social media and Internet presence allowed them to attract and focus the attention of many, causing key individuals to becoming interested in violent extremism and ultimately to make contacts with recruiters and facilitators for travel to their terrorist havens in Iraq and Syria, or in the case of al Shabaab, into Somalia.

For instance, Abu Ayad, an Iraqi who joined ISIS in 2016, told ICSVE researchers in 2017, “[I watched their videos on] Twitter and Facebook. They affected me because I was poor. I wanted to improve my living condition [for] marriage. I wanted us to have a house and for me to get married, and to have money. [We were living] in [Baghdad], in Dora. [My family] was good, but we were poor.” Interestingly, Abu Ayad claimed he was turned off by the vicious violence depicted in the ISIS videos, but all the same looked to the terrorist group to positively solve his financial challenges.

“[I watched] about 10 videos, approximately. I used to listen only to what was said, and the videos that had killing or blood, I fast-forwarded through them. I didn’t see them. I didn’t agree on killing people and things,” he added. Yet, he found the group compelling and thought they could address his needs: “[After watching, I contacted] the one who publishes the video or the pages where you find these videos on Twitter and Facebook.” He went on to join and even, according to Iraqi security officials, volunteered to become a suicide bomber, although Abu Ayad disputes this last point. In either case, it illustrates the powerful net that groups like ISIS cast within the Internet to catch vulnerable individuals and, in many cases, to swarm in on them, once they show interest, to bring them furtherinto the violent group and movement.^[x]

Watch Abu Ayad speak about his Internet seduction into ISIS here.^[xi]

Facebook, Twitter, and YouTube, as well as other lesser social media providers, have come to realize that allowing terrorist groups to spread their propaganda on their platforms constitutes a serious and grave danger to the public and national security, and the responsible ones have been working hard and diligently on instituting takedown policies, virtually eliminating most ISIS activity in English in a very short space of time. However, as evidenced in our recent online research,, success in this regard still lags in foreign languages.

As mentioned above, researching on Facebook alone, ICSVE was able to identify over 500 Facebook profiles in the timespan from September 2018 to January 2019, all of which were either distributing, endorsing or positively discussing Islamic State propaganda materials on the platform, making clear that these takedown efforts may be failing in foreign languages where it is harder to detect terrorist activity. Likewise, our research made clear that terrorists, as always, have learned to morph their methods, and now understand how to get around machine-learning takedown attempts. For instance, in the group of 500 Facebook profiles we were able to identify, most users made use of coded names for words that a bot would easily detect. For example, the English word “jihad” in Albanian is spelled as “Xh1had,” as opposed to the Albanian “xhihad.” The English word “minaret” in Albanian is spelled as ”M1nar3t,” as opposed to the Albanian, “minaret,” and so forth. Likewise, anticipating potential takedowns, the Facebook profiles we studied, invited their followers to move off Facebook and onto the encrypted Telegram platform, providing links to follow them there, presumably where law enforcement and security measures would not be able to hinder their activities. Moreover, we were able to observe old accounts getting deleted and new ones being created (almost on a daily basis) in response to takedown policies.

ISIS and other violent extremist groups have shown themselves to be highly resilient in the face of military and virtual challenges to their existence. At ICSVE, our view is that terrorism will continue to seduce vulnerable populations as long as good governance fails to address real and perceived grievances, as well as offer vulnerable populations positive opportunities and lives that make them disinterested in the claims of such groups. While these solutions to terrorism are financially costly, complex and require serious dedication, shorter-term fixes include delegitimizing both the groups and their ideologies, so that those who are being called to join will also turn away from them and look for less violent solutions. This is something we are attempting to do through using ISIS and al Shabaab insiders to denounce their respective terrorist groups in short video clips through our Breaking the ISIS Brand Counter Narrative Project.[i] This is only a part of the answer, however.

Vulnerable individuals who never have the opportunity to read and view terrorist materials are much less likely to take their initial steps down the terrorist trajectory, so limiting exposure to both the groups and their poisonous ideologies is paramount. While social media platforms continue to struggle with the clever feinting maneuvers and workarounds that such groups operationalize, take-down policies continue to be a very important means of cutting down massive exposure of vulnerable populations to terrorist groups and ideologies. However, even with takedowns, there is little that can be done to prevent a user or terrorist organization from opening new, or multiple new accounts, or as we have witnessed, using words or phrases that their followers recognize, but that artificial intelligence (AI) machine learning has not yet learned to recognize as signaling violent content.

User reporting is an important mechanism for achieving better success in fighting terrorist propaganda on mainstream platforms in foreign languages. ^[i]In our own research aimed at identifying ISIS supporters on Facebook, Facebook immediately upon learning of the profiles, took initiative to investigate and shut down the offending accounts. In regard to learning of the accounts promoting ISIS and like minded groups, Facebook emphatically stated “There’s no place for terrorists or content that promotes terrorism on Facebook, and we remove it as soon as we become aware of it. We take this seriously and are committed to making Facebook a safe environment. We know we can do more, and we’ve been making major investments by building out the expertise on our dedicated counterterrorism team, improving the technical tools we use to proactively detect terrorist content, and strengthening partnerships so that we can work with others to combat this global issue.”

However, when the process of shutdown of extremist content is heavily reliant on user reporting of extremist content online, such as is often the case in foreign languages, remains problematic.^[ii]Namely, the argument is that not everybody detecting violent content would care enough or take the time to report it. It would be interesting for Internet and social media companies to think of ways to incentivize such reporting. Likewise, while the removal of extremist online content in English can often be rapid, extremist content in other languages remains present for much longer periods of time, as is also documented in our own research. Moreover, as a whole new “lectionary” of jihadist symbols and words is created, this raises new challenges as well, which are not insurmountable, but again require research and sharing across platforms that do not have the resources that the giants possess. With the aforementioned in mind, it is important to continue to be present online and execute interventions on mainstream social media and communication platforms to both simultaneously engage in aiding take-down activities and offer counter-narratives to the jihadist ideologies and groups still present online.

About the authors:

Anne Speckhard, Ph.D., is Director of the International Center for the Study of Violent Extremism (ICSVE) and serves as an Adjunct Associate Professor of Psychiatry at Georgetown University School of Medicine. She has interviewed over 600 terrorists, their family members and supporters in various parts of the world including in Western Europe, the Balkans, Central Asia, the Former Soviet Union and the Middle East. In the past two years, she and ICSVE staff have been collecting interviews (n=101) with ISIS defectors, returnees and prisoners, studying their trajectories into and out of terrorism, their experiences inside ISIS, as well as developing the Breaking the ISIS Brand Counter Narrative Project materials from these interviews. She has also been training key stakeholders in law enforcement, intelligence, educators, and other countering violent extremism professionals on the use of counter-narrative messaging materials produced by ICSVE both locally and internationally as well as studying the use of children as violent actors by groups such as ISIS and consulting on how to rehabilitate them. In 2007, she was responsible for designing the psychological and Islamic challenge aspects of the Detainee Rehabilitation Program in Iraq to be applied to 20,000 + detainees and 800 juveniles. She is a sought after counterterrorism expert and has consulted to NATO, OSCE, foreign governments and to the U.S. Senate & House, Departments of State, Defense, Justice, Homeland Security, Health & Human Services, CIA and FBI and CNN, BBC, NPR, Fox News, MSNBC, CTV, and in Time, The New York Times, The Washington Post, London Times and many other publications. She regularly speaks and publishes on the topics of the psychology of radicalization and terrorism and is the author of several books, including Talking to Terrorists, Bride of ISIS, Undercover Jihadi and ISIS Defectors: Inside Stories of the Terrorist Caliphate. Her publications are found here: https://georgetown.academia.edu/AnneSpeckhard and on the ICSVE website https://www.icsve.org Follow @AnneSpeckhard

Ardian Shajkovci, Ph.D., is the Director of Research and a Senior Research Fellow at the International Center for the Study of Violent Extremism (ICSVE). He has been collecting interviews with ISIS defectors and studying their trajectories into and out of terrorism as well as training key stakeholders in law enforcement, intelligence, educators, and other countering violent extremism professionals on the use of counter-narrative messaging materials produced by ICSVE both locally and internationally. He has also been studying the use of children as violent actors by groups such as ISIS and how to rehabilitate them. He has conducted fieldwork in Western Europe, the Balkans, Central Asia, Africa, and the Middle East, mostly recently in Jordan and Iraq. He has presented at professional conferences and published on the topic of radicalization and terrorism. He holds a doctorate in Public Policy and Administration, with a focus on Homeland Security Policy, from Walden University. He obtained his M.A. degree in Public Policy and Administration from Northwestern University and a B.A. degree in International Relations and Diplomacy from Dominican University. He is also an adjunct professor teaching counterterrorism and CVE courses at Nichols College.

Reference for this article: Speckhard, Anne & Shajkovci, Ardian (January 14, 2019) Is ISIS Alive and Well on the Internet? Homeland Security Today.

Endnotes

^[i]Browne, R. (November 2018). “ ISIS might be quashed on the ground, but it’s still a ‘problem’ online, EU security official says,” CNBC,available at https://www.cnbc.com/2018/11/06/isis-is-still-a-problem-online-eu-security-official-julian-king.html

^[ii]European Commission (2018). “ Proposal for a regulation of the European Parliament and the Council on preventing the dissemination of terrorist content online,” available at https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=SWD:2018:0408:FIN:EN:PDF

^[iii]Charlton, A. (2018). “ Europe, US police seize servers used by IS propaganda sites,” The Washington Post, available at https://www.washingtonpost.com/world/europe/europe-us-police-seize-servers-used-by-is-propaganda-sites/2018/04/27/ac3a5a30-4a00-11e8-8082-105a446d19b8_story.html?utm_term=.de8121104ddb

^[iv]European Parliament. (2018). “ Europe’s fight against terror,” available http://www.europarl.europa.eu/RegData/etudes/ATAG/2018/614757/EPRS_ATA(2018)614757_EN.pdf

^[v]Security Trails. (April 2018). “ Top 20 reconnaissance and intel gathering tools,” available at https://securitytrails.com/blog/top-20-intel-tools

^[vi]Tech Against Terrorism. (2017). “ Facebook, Microsoft, YouTube, and Twitter form global internet to counter terrorism,” available at https://www.techagainstterrorism.org/article/facebook-microsoft-youtube-and-twitter-form-global-internet-to-counter-terrorism/

^[vii]Murgia, M. (2017). “ Twitter takes down 300,000 terror accounts as AI tools improve,” Financial Times,available at https://www.ft.com/content/198b5258-9d3e-11e7-8cd4-932067fbf946

^[viii]Shane, S. (2017). “ In ‘watershed moment,’ YouTube blocks extremist cleric’s message,” The New York Times, available at https://www.nytimes.com/2017/11/12/us/politics/youtube-terrorism-anwar-al-awlaki.html

^[ix]Shinal, J. (2018). “ Facebook, Google tell Congress they’re fighting extremist content with counter propaganda,” CNBC,available at https://www.cnbc.com/2018/01/17/facebook-google-tell-congress-how-theyre-fighting-extremist-content.html

^[x]Speckhard, A., Shajkovci, A., Wooster, C., & Izadi, N. (2018). “Engaging English speaking Facebook users in an anti-ISIS awareness campaign,” Journal of Strategic Security, 11 (3), available at https://scholarcommons.usf.edu/cgi/viewcontent.cgi?article=1679&context=jss

^[xi]The Clear Path into the Islamic State Caliphate https://youtu.be/l5O4m3t2YGA

^[xii]Speckhard, A, Shajkovci, A., Wooster, C, and Izadi, N. (2018). “ Mounting a Facebook brand awareness and safety ad campaign to Break the ISIS Brand in Iraq,” Perspectives on Terrorism,12 (3), available at https://www.universiteitleiden.nl/binaries/content/assets/customsites/perspectives-on-terrorism/2018/issue-3/04—mounting-a-facebook-brand-awareness-and-safety-ad-campaign-to-break-the-isis-brand-in-ira.pdf; For ICSVE produced counter-narratives, please visit ICSVE YouTube channel: https://www.youtube.com/channel/UCumpEsozixbl-PyKw12hmnw

^[xiii]Warrick, J. (2018). “ In fight against ISIS’s propaganda machine, raids and online trench warfare,” The Washington Post,available at https://www.washingtonpost.com/world/national-security/in-fight-against-isiss-propaganda-machine-raids-and-online-trench-warfare/2018/08/19/379d4da4-9f46-11e8-8e87-c869fe70a721_story.html?utm_term=.4991eefe6cc1

^[xiv]Speckhard, A., & Shajkovci, A. (2018). “ Fighting ISIS in the digital space in Jordan,” Modern Diplomacy, available at https://moderndiplomacy.eu/2018/10/29/fighting-isis-in-the-digital-space-in-jordan/