The U.S. government, along with industry partners, is working to stymie the Islamic State’s burgeoning social media campaign, which experts say is widespread and highly advanced for a terror organization.
ISIL — which currently controls large swaths of territory in Syria and Iraq — has documented its brutal tactics, such as beheadings, on various social media accounts ranging from Facebook and Instagram to Twitter.
Experts and national security leaders have said that the terrorist organization, which started as an offshoot of al-Qaida, has an advanced understanding of social media, using it to disseminate information and connect with potential jihadists across the globe.
Department of Homeland Security Secretary Jeh Johnson said during a speech in October that ISIL’s social media strategy is highly sophisticated.
A “new phenomena we see among terrorist organizations is the very adept use of social media, literature and propaganda that is very westernized in its language and tone. We look at some of it, it’s about as slick as I’ve ever seen in terms of advertising and promotion,” Johnson said during the Association of the United States Army annual meeting and exposition in Washington, D.C.
Through social media, ISIL is inspiring adherents who have never set foot in a terrorist compound to commit acts of violence, Johnson said.
ISIL has a ground force of more than 30,000 individuals in Iraq and Syria. It is extremely wealthy and takes in over $1 million per day in revenue, Johnson noted.
ISIL’s social media campaign is “very aggressive,” said Peter Bergen, a national security analyst at CNN, during a September panel discussion on jihadist terrorism at the Bipartisan Policy Center, a Washington, D.C.-based think tank. Bergen also co-authored the “Jihadist Terrorism: A Threat Assessment” report released by the center in September.
The report examined trends and threats within jihadist terrorist groups, including al-Qaida affiliates.
The advanced use of media platforms, such as Twitter, while executing an attack is a new occurrence, the report said.
“The use of social media during terrorist attacks to incite and engage with followers and report to the media … is a new phenomenon, changing traditional notions of how terrorist groups communicate and organize,” the report said.
It pointed to the deadly 2014 Westgate mall terrorist attack in Nairobi, Kenya, as one of the first examples of social media being employed during an attack.
“The attack on Westgate was the first time that a major terrorist attack was live-tweeted and also the first time that information released by a terrorist organization on Twitter and other social media sites was at times more reliable and timely than information released by the Kenyan government,” the report said.
One tweet from the group said, “All Muslims inside #Westgate were escorted out by the Mujahideen before beginning the attack,” the report said.
Dozens of people were killed during the incident, which was coordinated by al-Shabaab, an al-Qaida affiliate.
Foreign fighters in Syria are also avid social media users, the report said.
“If Vietnam was the first war to be covered by television, and the Gulf War was the first war carried live by cable news, in many ways Syria is the first social media war — where the conflict is largely documented on YouTube, Facebook and Twitter,” the report said.
The State Department has taken note of ISIL and other jihadist groups’ embrace of social media and is countering it with its own strategy. Using ISIL’s own propaganda, the Center for Strategic Counterterrorism Communications, which operates under the State Department, has produced a number of videos and images showing the brutality of ISIL and other terrorist organizations.
The strategy is part of the CSCC’s “Think Again Turn Away” program, which uses social media platforms such as Facebook, Twitter and YouTube “to expose the facts about terrorists and their propaganda,” according to its mission statement. The center shares images, videos and news clips while also engaging directly with terrorists and their sympathizers online.
A large image of two visibly injured and bloody men plasters the top of the group’s Facebook
page with a message that says, “Is this an act to be proud of?”
On its verified Twitter account, @ThinkAgain_DOS
, the group has sent out tweets that urge followers to reject ISIL.
In one tweet accompanied by an image of ISIL members handing out flour, the groups said, “#ISIS steal, loot — take photos of themselves handing out flour as if they’re heroes for throwing the people crumbs.”
In another tweet, a member of CSCC rebukes a Twitter user who praised Anwar al-Awlaki, a U.S. citizen and terrorist who was killed in a drone strike in Yemen in 2011. Al-Awlaki was one of al-Qaida’s top propagandists who used the internet and other forms of media, including a magazine called Inspire, to recruit members to the organization.
In an Oct. 29 tweet, user @umm_muthanna said, “We will never forget you! America killed you but you are in highest ranks,” in reference to al-Awlaki.
CSCC tweeted back: “Awlaki — another hypocrite held up as a model of piety — visited prostitutes at least seven times.”
In another photo, CSCC tweeted out a censored image of a toddler kicking what appears to be a severed head. “GRAPHIC — #ISIS supporters, fighters teach children disregard for human dignity at young age,” read the message that accompanied the image.
The State Department declined to comment for this article.
Most of ISIL’s members are young adults, said Colin Clarke, a RAND Corp. associate political analyst who researches the group. ISIL has even created a video game that is modeled off of Grand Theft Auto, he said.
“The group is specifically trying to recruit younger fighters, that’s for sure. You see that with things like the video game, that’s not meant to appeal to an older generation,” he said.
One of the most impressive aspects of ISIL is the speed in which it is able to produce its propaganda, Clarke said. It has responded in real time to events, live tweeting attacks and battles.
This deluge of information gleaned from tweets, Instagram photos and Facebook status messages are both blessings and curses for the terrorist organization and Western governments, he said. While social media allow ISIL to disseminate information, they also give governments trying to stop them heaps of information to work off.
“From a United States or a Western perspective, it’s a bad thing that the group is using it to communicate with each other and recruit but … it’s a good thing that now we’re learning things we probably wouldn’t have learned otherwise,” Clarke said.
BAE Systems is one company that is sifting through the endless piles of information insurgency group members have posted on social media, Kyle Lewis, senior regional analyst at the company, told National Defense in an email.
“Our analysts design customized solutions to identify, collect, process, analyze and report useful information from social media, web forums, video posting sites, anonymous text-pasting sites and anywhere else terrorist groups are conversing or posting content,” Lewis said.
Company analysts can collect important information from social media accounts operated by terrorists, however, many providers, such as Facebook or Twitter, often shut down those accounts before analysts can look through them, Lewis noted.
“This is problematic for analysts, because those terrorist accounts are a rich source of information. Once that content or a specific account is banned, it takes knowledgeable analysts to detect the new accounts associated with that terrorist group or to identify that a terrorist group has moved to a new social media platform,” he said. “If you can’t identify those things, you’ve lost a valuable stream of information.”
Analysts are able to identify threats by looking for “non-specific indicators,” he said. These include references to travel, conversations that move from public to private message and unusual patterns in social media use, Lewis said.
“Over time, you’re able to develop timelines and benchmarks that help you identify when and where a car bomb attack is more likely to occur, or whether an anti-government protest is going to turn violent,” he said.
While not specifically confirming that they are watching ISIL members’ social media activity, Lewis said that the company was monitoring “trouble spots” in Iraq and Syria.
This type of social media mining is a burgeoning market, Lewis said.
“The amount of real-time information from conflict zones that is now available to us on social media is unprecedented. In the Middle East and North Africa, it really began with the Arab Spring in late 2010. Since then, social media usage has expanded rapidly. With mobile phone usage proliferating as quickly and widely as it is in the region, the amount of information available to us will continue to grow,” he said.
Another company scouring the internet for threats is MTN Government, a Leesburg, Virginia-based satellite, cyber security and intelligence, surveillance and reconnaissance company.
Through its social media threat intelligence managed service released earlier this year, the company is able to look through the dark corners of the internet for cyber security threats potentially perpetrated by terrorist organizations against the government, Ben Shaw, director of MTN Government’s intelligence service program, said in an email.
“Extremist groups and individuals are constantly searching for new ways to steal our identities, information and intellectual property,” Shaw said. “Leaders across all four branches of our military are currently being impersonated on every major social media network.”
This “can fool many honest Americans into divulging confidential information, national secrets or other information,” he noted.
MTN Government partnered with ZeroFOX, a social risk and cyber threat intelligence company, to deliver the proprietary ZeroFOX solution to government clients.
Over the summer, ZeroFOX released an infographic explaining some of the tactics ISIL has used during its social media blitz. One includes “hashtag hijacking.”
“ISIS activists will use a popular trending hashtag as a means of infiltrating conversations by adding that hashtag onto one of their unrelated tweets. They can also mass tweet using their own designated hashtags, which gets them to trend,” the graphic said.
ISIL also uses computer bots to carry out its campaign, the company said. The bots enable them to “continually regenerate accounts” that have been shut down by social media networks.
Additionally the terror group has created its own Arabic-language Twitter app called the “Dawn of Glad Tidings” that allows ISIL to send tweets through personal member accounts, the company said.
“This allows ISIS’ tweets to reach hundreds or thousands more accounts, giving the perception that their content is bigger and more popular than it might actually be,” the infographic said.
Correction: A previous version of this article misstated that MTN Government partnered with ZeroFOX to create the ZeroFOX solution system.