Cyber Terrorism: Islamic State’s effective exploitation of social media
Authored by Pool Re
Our new cyber terrorism series explores how terrorist organisations are harnessing the Internet to radicalise and train potential recruits, disseminate illegal content, facilitate communication, and incite acts of terrorism. The second instalment examines IS’ tactics and practices and the impact its social media strategy has on recruitment and propaganda.
Terrorist organisations have regularly exploited mass media and novel communications techniques to advance their causes. However, few organisations have come close to demonstrating the skill, scope, and scale of Islamic State (IS) in exploitation of the internet – particularly social media platforms – for the group’s strategic communication. Since the declaration of its so-called caliphate in June 2014, IS has used social media platforms as a tool to recruit new members, raise funds, disseminate propaganda, and effectively capture public attention.
IS has managed to have a significant presence on a variety of social media platforms, taking advantage of the unique features of each one. In this piece, we examine IS’ tactics and practices and the impact its social media strategy has on recruitment and propaganda.
Content masking
IS and its supporters primarily use social media platforms to share propaganda thus gaining attention from media outlets, projecting a narrative and image of power, and potentially drawing in recruits and funding. Given these objectives, social media platforms – under pressure from government legislation – attempt to take down the posts, images, and videos and suspend accounts sharing such content.
As such, IS expends significant effort attempting to circumvent the content moderation policies of these platforms. One way the group and its supporters does this is through overlaying branding from legitimate news sources on its own images and videos. IS also includes short segments from legitimate news clips at the start of a video before switching to its own propaganda to prevent automatic or manual content detection from recognising the video as something other than legitimate news footage.
Other methods include blurring the logo, flags, or emblems on its videos. Some platforms offer in-house filters which allow users to add effects, pictures or emojis onto images and videos, distorting the image to avoid detection, particularly when reviews are automated.
Content masking not only aims to trick content moderators into leaving the content on the platform, but also to legitimise the content using mainstream news branding implying the content is factual and correct instead of propaganda. This tactic is used by IS on sites such as Facebook, Instagram, YouTube, TikTok and Twitter.
Text Disruption/Distortion
IS members and supporters use broken text or slang to evade automated detection of specific trigger words often related to militant Islamist extremism. This includes misspelling words, using specialised fonts, replacing words with emojis, and adding punctuation between letters.
These tactics are used by those posting in numerous different languages including English, Arabic, Farsi, and many others. The text disruption tactics are enough to evade automatic content moderation, but the messaging is still understandable. This tactic is seen on sites such as Facebook, Twitter and Instagram.
Signposting
Mainstream platforms have strict content moderation policies which restrict the sharing of terrorist content. To bypass this, IS supporters will share links within posts or in comments which lead users to graphic imagery, videos and blatant propaganda stored on file-sharing sites or less restricted platforms such as Telegram. They also signpost to audio files on sites such as SoundCloud.
On video sharing platforms such as YouTube, extremists post short segments of propaganda videos, often the least violent aspect, before including a link to “see more” on a less restricted site. They have learnt the point at which content crosses the line and is removed by content moderators and exploit this knowledge to include just enough propaganda to draw attention but still avoid deletion. This tactic allows extremists to reach the large audiences on Facebook, Twitter and other mainstream sites but avoid their content being removed or restricted.
Disingenuous Translations
As IS have a global target audience they will often post propaganda and messages in Arabic alongside a translation into English or other languages. When these messages contain language that could trigger automatic content moderators when translated to English, the translations will be a disingenuous translation of the Arabic messaging. This can sometimes change the meaning of the message in order to evade detection and removal.
This also occurs within their use of hashtags. Their Arabic hashtags are often more open in their support for IS and terrorism than those shared in English. This tactic means that once non-native Arabic speakers decipher the true meaning of an Arabic hashtag, they are able to find a large volume of posts using the same hashtag which may share more severe messaging and propaganda. This is seen on platforms such as Facebook, Twitter, and TikTok.
Co-ordinated Raids
IS use co-ordinated raids to flood comment sections of posts by public figures or organisations, sharing propaganda with wide audiences of individuals who would likely not come across it otherwise. They plan times for supporters to make repeated comments in English, Arabic or other languages and have targeted pages such at the US Army and the US Department of Defense.
By encouraging large groups of supporters to do this simultaneously they overwhelm the comment sections on specific posts to drown out comments from ordinary citizens. Consequently, the page owners cannot keep up with the high comment volume in their attempts to delete them. This is mainly seen on Facebook but has also been seen on Twitter.
Hashtag Hijacking
IS extremists utilise hashtags to spread their propaganda and messaging to reach a broader audience than just their followers and friends. One prominent tactic is hashtag hijacking. Extremists will hijack online discourse around social issues by including the associated hashtag within their propaganda posts, for example #BlackLivesMatter.
By including this hashtag, their propaganda will be shared with the wide audience of people tracking the hashtag. As the hashtags they hijack are often related to social issues, the target audience of individuals following the hashtag are likely more open to social conflict due to their interest in a conflict-related discourse. This tactic is used primarily on Facebook, Twitter and Instagram.
Account Hijacking
IS extremists have been hijacking other users’ social media accounts to exploit their existing friends or followers by turning the accounts into propaganda hubs. They use password reset mechanisms and text message interception tools to hijack the password reset process and take the account for themselves. By hijacking existing accounts this removes the need for extremists to build up an audience of their own.
This tactic also presents the opportunity to hijack the account of a prominent figure which would not only provide a very large audience, but also allows extremists to utilise the user’s name to make their messaging appear more factual and legitimate. This technique is using primarily on Facebook and Twitter.
Propaganda & How-to Videos
Video-sharing platforms and mainstream social media are used by IS to share propaganda videos and ‘how-to’ videos. These instructional videos cover various activities ranging from acquiring a US based phone number, explaining how to hijack a Facebook account, or even explosive-making instructions. The videos are either shared directly to the platform or a link to the video stored elsewhere is shared on the platform.
Methods of masking the videos to prevent deletion are detailed above, however certain videos do not breach content moderation guidelines and may not necessarily be deleted. This is particularly true for instructions about using apps to acquire phone numbers from a particular location. These videos are shared to sites including YouTube, Facebook, Twitter, TikTok and Instagram.
End-to-end Encrypted Messaging
End-to-end encrypted messaging platforms, such as Telegram, have far fewer regulations than the more mainstream platforms mentioned previously. Therefore, these messaging platforms are used to share more graphic imagery, co-ordinate physical action and attacks, and conduct more aggressive recruitment campaigns.
Some of these platforms have group functions where messages can be broadcast to wider groups, and private chats between supporters have also been encouraged by IS. These private chats provide a space for members and supporters to plan attacks or co-ordinate travel to IS-held territories. The main platforms used for this type of messaging are Telegram, Signal and WhatsApp.
