Messing with the Enemy

by Clint Watts

  Harun Maruf released his full telephone interview with Omar on the day of his death. The broadcast eerily outlined the trap Omar was caught in. Hunted by both terrorists and counterterrorists, hiding in the woods with a handful of supporters, Hammami could never leave Somalia, nor could he remain there alive. Until the end, he envisioned himself to be a pseudo-cleric, explaining, in a slightly southern American drawl, why those who didn’t follow his brand of Islam were wrong and could be subjected to violence.

  “You’re either pregnant or not pregnant, you’re either are or you’re not . . . you need to follow all of the Shariah or you are not a Muslim.” Alabama analogies mixed with jihadi elitism—only the bizarre world of social media could create such a collision of cultures.

  Omar and I weren’t friends, because he was a terrorist. As an Army officer or an FBI agent, if assigned the mission, I would have hunted him down as directed, arrested him if mandated, killed him if necessary, and not thought much about it. Even as I watched his slow demise via Twitter, I didn’t feel a bit of surprise or remorse when Shabaab killed him. Omar started digging the shallow grave he ended up in the day he started backing al-Qaeda’s violent ideology. He sealed his own fate when he defected from al-Shabaab and sought his own fame and notoriety on Twitter. If it had been up to me, I would have liked to see the Somali clan Omar had gone to for protection turn him over to the United States for a $5 million reward. I had hoped that Omar would eventually stand trial or make a deal with his native country, becoming a useful defection from terrorists’ ranks and counter to jihad’s bankrupt dogma.

  When I communicated with Omar about America, he sounded like so many soldiers I had met in the Army. If he hadn’t become a terrorist and gone off to kill people, if we’d met at another juncture back in the States, I expect we’d probably have become friends, sharing a box of Krispy Kreme doughnut holes, laughing about a silly eighties movie we watched as kids, or shooting guns at coffee cans in a cornfield or a quarry. The weirdest thing I’ve realized in the global war on terror is that very little differentiates the average foot soldiers on each side of the war. Terrorists and the counterterrorists who chase them have more in common with each other than the al-Qaeda propagandists and American politicians who give them marching orders. All that separates them is a decision: not the decision to kill or not to kill, but the one about why they do it—militant Islam or democracy, freedom or Sharia law, money or piety, family or faith.

  Omar Hammami, trapped amid a failed Shabaab experiment to create a state, anticipated not only the move of young jihadi boys to Syria, but the nature by which al-Qaeda would unravel. While American counterterrorism analysts pontificated about an al-Qaeda comeback, Omar noted, in January 2013, what was to come: “terrorism is a staple so long as shari’ah is followed. Post-aq = broadbased jihad.”

  The Islamic State harnessed this notion, the movement of young men to social media, untethered from the direct orders of jihad’s forefathers, bin Laden and Zawahiri. These terrorist leaders advanced violent jihad’s goals and direction but stymied the zealousness of the “me” generation rallying on social media. Months after predicting a post-al-Qaeda era, Omar Hammami again correctly sensed the global direction of jihad, noting, “We [jihadis] were previously too focused on spreading ‘jihad’ globally, now on establishing ‘shari’ah’ locally. it will equal out to become khilafah.” Omar died before ISIS became the Islamic State, but he could see it coming. As Hammami and his fellow defectors died in Somalia, jihad’s next generation launched a civil war in al-Qaeda’s ranks in Syria.

  I closed out my time with Omar looking at a family photo he’d posted on Twitter. Omar, rifle in one hand, knelt down with his other hand on his wife’s shoulder. His wife and daughter, draped in full burqa, sat next to him in front of a makeshift tent. America meets jihad. It was the equivalent of an Alabama family picnic photo in a Sharia world, and it didn’t work. The two women could be anyone, fully covered and completely unrecognizable. Why put them in the picture? Never, in my years of scanning terrorist pictures on social media timelines, had I observed a devout jihadi taking family photos with fully covered women. Omar was proud of his family, but it didn’t fit with the new culture he’d adopted. His story, like those of so many Western terrorists, was confusing and conflicted. I wonder whether, in his final moments in Somalia, as assassins closed in to kill him, he was still certain in his ideology, or in doubt. Did his dying thoughts reach for jihad and martyrdom, or his home in Alabama?

  As for Shabaab in Somalia, after killing Omar Hammami and executing the spectacular Westgate Shopping Mall attack in Kenya less than two weeks later, it continued its steady decline. Defectors from its ranks grew, and just less than one year after Omar’s murder, a warhead hit the forehead of Ahmed Godane. A U.S. drone strike had killed Shabaab’s murderous leader. Today, Shabaab hasn’t vanished, nor will it. One jihadi terrorist group or another has called Somalia home for decades, and some violent fringe will remain through our lifetimes. But Twitter, the platform the group had used to reach new heights, ultimately helped unravel them from the inside out.

  4

  Rise of the Trolls

  “Who are these assholes?” I whispered to myself.

  By 2014, social media was becoming more antisocial by the day. I stared at my iPhone’s Twitter feed on a cold January morning, watching a fresh batch of anonymous haters.

  I first came to the Twitter platform as a promotional tool for SelectedWisdom.com. Many of the top hands in counterterrorism and foreign policy circles were using it, and commentary and discussions there often proved quite useful as a form of debate. But that changed at some point. Every day Twitter was increasingly a space where the angry, the disgruntled, and the unhappy unleashed their rage on the world. I had been trolled before, but these trolls, emerging about a year after my discussions with Omar Hammami, were relentless. Something was different about them.

  A few days before the troll storm dominated my Twitter feed, Michael Doran, Will McCants, and I published an article in Foreign Affairs website challenging conventional wisdom regarding negotiation with those who may harbor al-Qaeda sympathies. “The Good and Bad of Ahrar al-Sham” offered that the United States might negotiate with an Islamist group to challenge the influence of al-Qaeda’s growing Syrian affiliate Jabhat al-Nusra. Americans loathed the thought of many troops returning to the Middle East, and we posited that this soft-power approach might be worth exploring as an indirect route to curbing terrorist growth amid Syria’s civil war. The trolls didn’t agree.

  These Twitter trolls were different from most trolls I encountered, though. Nearly all labeled me a terrorist supporter and sympathizer. Regardless of where they proclaimed residence—Europe, North America, Asia, or Australia—all agreed that Syrian president Bashar al-Assad’s heavy-handed rule provided the only deterrent to terrorists overtaking the Levant. The trolls kept it up for days, then weeks and ultimately months. Each morning I’d wake to fresh hate from the same accounts, which would be supported by nearly unending waves of retweets at roughly matching intervals. Dozens, sometimes hundreds of odd-looking accounts would favorite some of my tweets. I wasn’t the only one who noticed this phenomenon. Two colleagues from my counterterrorism days noticed the trolls as well, and they both had more technical know-how than I did regarding social media analytics.

  Andrew Weisburd was a natural social media savant. He could look at an online persona, spot it as friend or foe, and trace its connections to a host of bad actors online. As a hobby during the 2000s, Weisburd began tracking al-Qaeda online from his couch. He identified and outed terrorists lurking on the internet so well that al-Qaeda fanatics mailed a white powder package to his house, along with a death threat:

  “To the Jewish asshole Aaron [sic] Weisburd. This is our donation to you. Either you close the website called Internet Haganah by next week or you will [be] beheaded.”

  An FBI inspection found no signs of anthrax, and Andrew resumed his hobby with a bit more caution.
Not long after, his hobby became his work, and he eventually joined me at the Combating Terrorism Center at West Point. Andrew helped train law enforcement, the military, and academics on how terrorists actually operated on the web—debunking much of the media hysteria present at the time.

  By 2014, Weisburd had been doing his work for a decade, and through the course of endless investigations he’d identified thousands of nefarious accounts, many of which surfaced among the troll armies messing with me and others studying the Syrian conflict.

  Weisburd connected some of the trolls to a recent internet nemesis: the Syrian Electronic Army. The SEA presented itself as a new hybrid threat of the online world, embodying the spirit of more popular hacktivist collectives such as Anonymous and LulzSec, but clearly in the bag for President Assad and the Syrian regime. The SEA effectively became the first nation-state cyber proxy force on the internet.

  The SEA had undertaken a string of attacks against American companies since 2011, hitting a wide range of targets but taking aim at many mainstream media outlets that were revealing the horrors of the Syrian civil war. The New York Times, Forbes, the Sun, 60 Minutes, 48 Hours, the Sunday Times, the Independent, Time Out, NBC, the Daily Mail, and Le Monde all suffered attacks, with varying consequences.

  Other than a brief encounter of a few seconds, I’d never met J. M. Berger except on Twitter. After connecting on social media, he and I learned that we lived only a few blocks from each other in Boston. J. M. had a gift for social media and for terrorism research. His interviews and conversations with terrorists, notably Omar Hammami and those Shabaab supporters challenging him, had allegedly earned him the nickname among e-jihadis as the “Loud Shaytan”—a transliteration of “Satan”—a nod to his ability to sow doubt among terrorist conversations. J. M. noticed this new outbreak of trolls as well.

  Most important, J. M. had built his own method to tag and track bad actors who didn’t want to be seen on Twitter but still wanted to influence audiences of supporters. While Andrew, the “Jewish Asshole,” dug into the trolls, J. M., the “Loud Shaytan,” inhaled the social media storm surrounding the SEA, narrowing in on the key centers of influence among this pro-Assad swarm. I, “Watty Kafir,” partook in some Twitter conversations with nefarious accounts and attempted to map out what the trolls were trying to do. The more we dug, the stranger things became.

  On March 21, 2014, a petition was posted to the WhiteHouse.gov website. “Alaska Back to Russia” called for the United States to return its largest state back to the country from which it was purchased in 1867.1 Petitions ranging from the benign to the insane populate the WhiteHouse.gov website all the time. This one wouldn’t have been any stranger than most had it not received more than 39,000 online signatures within only a few days of its inception.

  Analysis of the Twitter accounts posting on this petition showed an odd mathematical pattern. When the signatories to most petitions on the White House website are amassed, they follow a highly normal distribution. Some Twitter accounts have only a few followers but follow many accounts. Others have many followers but follow only a few. In between these poles lies a natural blend of accounts, with most in the sample having roughly similar numbers of accounts following them and accounts they follow.

  The accounts posting the “Alaska Back to Russia” petition didn’t follow the normal distribution pattern, though. Their followers/following combinations were incremental and mathematical, falling in repeated intervals, which suggested that they had been manufactured through the use of mathematical algorithms (i.e., social bots). Oddly, the bots hammering away at the “Alaska Back to Russia” petition overlapped with the pro-Assad trolls seen at the start of 2014 and the SEA hackers breaching American companies for several years. Even more curious were the SEA’s connections to previously identified social media propagandists for Hezbollah and Iran. Strangest of all, though, were the accounts’ linkages back to Russia. Many were tweeting in English and Russian and the trolling effort clearly and overtly sought to embarrass the White House.

  Effective troll armies consist of three types of accounts: hecklers, honeypots, and hackers. Hecklers lead the propaganda army, winning audiences through their derisive banter and content-fueled feeds. Hecklers identify and drive wedge issues into their target audiences by talking up online allies and arming them with their preferred news—both true and false information, loaded with opinion, that confirms audience member beliefs. Hecklers also target social media adversaries and focus the angst of their cultivated supporters against opposing messages and their messengers. In the case of Syria, for example, anyone pointing out President Assad’s human rights violations might immediately be called a terrorist sympathizer and subjected to endless 140-character jeers and taunts. Oddly, examination of these hecklers’ Twitter and Facebook accounts revealed few followers that seemed real, nor did they post pictures of themselves with friends or strolling in their local neighborhoods.

  When hecklers alone can’t stop the challenges of the opposition, honeypots sweep in to compromise adversaries. Honeypots, in the traditional espionage sense, are attractive women who seduce men into compromising sexual situations. On Twitter, females remain the predominant form, but they can also assume the persona of an allied political partisan. Among the SEA, attractive females—or what appear to be women—performed the traditional mission of befriending men in the target audience or sidling up to adversary accounts hoping to compromise their personas or publicly embarrass them. “Can you follow me so I can DM you something important?” might be the siren song for one of these e-ladies. Lady honeypots in 2014 were seeking follower relationships with men, which would lead to a direct message capability. Once virtual relationships were sealed, honeypots could deliver a link via a direct message, one that would allegedly lead to privileged insights but often contained a malware payload allowing them to gain entry to a target’s computer. Not all honeypots were lovely ladies, however, and some posed as motivated political partisans mirroring the views and banter of their targets. Hyperpartisan liberals and conservatives would appear to befriend rabble-rousers along nearly any political pole worldwide.

  Behind the scenes, but still observable in the SEA social media storm, were hacker accounts. Examination of their follower and following relationships showed that they were highly networked with honeypot accounts, likely controlling the conversations between the lovely lady personas and their unwitting targets. The malware that honeypots delivered to unsuspecting men opened doorways to their phones and computers, causing them to give up their personal emails, corporate communications, in some cases, and their contact lists, allowing for malicious spam distribution.

  Honeypots and the hackers behind them waged a highly successful campaign across a swath of companies and Western personalities in 2013 and 2014. Corporate America suffered as unwitting employees clicked onto malicious links and in turn coughed up access to private databases of subscribers and workers. The most damaging of these breaches came in the late spring of 2013. After claiming responsibility for breaking into the 60 Minutes and 48 Hours television shows’ Twitter accounts, the SEA’s most damaging alleged hack came on Tuesday, April 23. The Associated Press Twitter account posted in the early afternoon:

  Breaking: Two Explosions in the White House and Barack Obama is injured.2

  The @AP Twitter account had more than 1.9 million followers at the time, and the SEA’s false information sent the stock market plunging 1 percent in a matter of minutes—the equivalent of $136 billion in value—before recovering five minutes later. The Associated Press Twitter account returned to normal social media operations the next day, but the implications of the SEA’s actions were clear: hacking to steal information was old hat; hacking to influence would be the future.3

  The troll army’s heckler accounts, those that began challenging me in 2014, could work with hackers and their sister honeypot accounts or they could operate independently of these social media allies. Their tactics were far more ingenious and insidi
ous than those of even the most talented internet propagandists of al-Qaeda and the Islamic State. The hecklers weren’t hacking people’s computers; they were hacking their minds, in two ways. In one sense, they sought to change a target audience’s perception on issues, nudging audiences toward preferred foreign policy positions and influencing experts, politicians, and media personalities toward a pro-Assad or pro-Russia stance. When not shaping audience conversations through a barrage of slanted content and supporting banter, hecklers sought to batter adversaries off social media platforms through either endless harassment or compromise.

  Over a three-year period, accounts, primarily on Twitter but also on LinkedIn, would attempt to befriend me. Rather than chide me for publicly being anti-Assad or anti-Russia, these accounts would attempt to send me helpful tips, like my old friend Omar Hammami and his cronies had. News articles that supported my academic think tank writing would be fired my way in hopes that I might follow the referrer’s Twitter account. If I didn’t bite on their support of my research, friendly honeypot accounts tried to play to my ego—heaping on praise for my military or FBI experience or even pulling at my heartstrings regarding an article I authored about my daughter’s autism.

  Whatever the avenue, once I followed the befriending Twitter account, I’d be peppered with direct messages. Conversations generally started with friendly banter about my research or an issue I’d publicly discussed on Twitter. Invariably, though, dialogue would switch to a range of issues, all of which sought to edge me to a pro-Assad, pro-Iran, or pro-Russia stance on foreign policy issues. On select occasions, an account might try to introduce me to other online personas or place me into group discussions of real people and social media personas, some of which I knew and some I’d not noticed before. These group conversations sought discussion among like minds and hoped to move my thinking to a foreign policy position through what appeared to be innocent dialogue. If I wrote an article challenging the authenticity of Saudi counterterrorism partnerships and methods, adversary accounts might point out in private chats how Assad—and, by extension, Iran and Russia—represented the only reasonable alternative to jihadists taking over Syria. They relentlessly pushed the same basic theme: Who is better to govern Syria? A strong Assad or the terrorists of al-Qaeda and the Islamic State?