ISIS

by Jessica Stern

  In January 2013, al Shabab tweeted a threat to execute a French prisoner it had captured. This was a rare example of a threat direct and specific enough to violate Twitter’s extremely permissive rules, and the account was suspended after users reported the violation.50

  The mole soon popped up under a new name.

  “For what it’s worth, shooting the messenger and suppressing the truth by silencing your opponents isn’t quite the way to win the war of ideas,” the account tweeted on its return, a deeply ironic statement coming from an insurgent group notorious for executing and imprisoning its internal dissenters.51

  On the surface level, the suspension had cost nothing in intelligence value—for analysts who had the foresight to save copies of Shabab’s original Twitter account. The old information was still accessible, albeit no longer conveniently online, and the new account continued the stream of press releases.

  And in this case, the suspension improved the intelligence outlook. All Twitter accounts naturally accrue followers over time, not all of whom are especially interested in the account’s content. The suspension wiped out a tremendous amount of analytical noise, and the low-hanging fruit of al Shabab’s official tweets meant little compared to the value of the social network that had sprouted up around the HSMPress account.

  Analysts who delved deeper could look at who followed the new account and deduce with some accuracy who was a member of al Shabab, by examining the relationships and interactions among the accounts, as well as their content. Similar capabilities were also being developed by analysts using Facebook and other social networks.

  Such social network analysis required a critical mass of data, but the list of users following the original al Shabab Twitter account had grown large, and the data had become noisy. Some of the followers were curiosity-seekers, drawn in by headlines. Some were Somalis not associated with Shabab. Others had only a casual interest. Many were journalists and terrorism analysts.

  After the new account surfaced, several hundred users rushed to follow within the first several hours. Analysts had previously been forced to sift through 21,000 accounts to pan for gold, but the new account had far fewer followers in its earliest hours, and the first ones to show up were among the most motivated. It was relatively simple to analyze the new accounts, removing the journalists and analysts. Most of what remained were hard-core al Shabab supporters and members on the ground. The suspension of the account had made it easier to glean real intelligence, not harder.52

  Although it was nearly impossible to keep extremists from returning again and again to social platforms, it now became clear that suspensions were not an exercise in futility. A suspension cost the terrorists time. It deprived them of an easy archive of material. They had to reconstruct their social networks and reestablish trust, often exposing themselves to scrutiny in the process. Other users in their social networks were suspended and came back under new names and using different kinds of camouflage. It was not always obvious who your friends were.

  There were also clear numeric costs. It might take a Facebook page weeks or months to build up a following of thousands of users, work that could be erased in an instant. An analysis of the pace at which al Shabab’s second Twitter account accrued followers suggested it would take months, if not years, to regain all the followers it had lost.53

  In September 2013, al Shabab commandos seized control of the Westgate Mall in Nairobi, Kenya, in an attack that lasted almost four days and left sixty-seven victims dead.54 Its resuscitated Twitter account began live-tweeting details of the attack in progress. Although the account had previously tweeted terrorist attacks within Somalia, the media latched on to the activities of the high-profile account as the siege dragged on.55

  After users complained about the account using Twitter’s abuse-reporting forms, the mole was whacked, and a new account popped up.56 Because it was breaking news, users flocked to the new account, which was whacked again in short order. Another popped up, and was whacked. The process continued for days. Each time, al Shabab was online for shorter and shorter periods.57

  Finally, something remarkable happened. The mole stayed down.

  It was unclear whether Twitter had permanently banned it using technical tools it normally reserved for spammers, or the terrorists had simply surrendered. What was clear was that it was over. Al Shabab had been denied the use of Twitter. The moles had definitively lost.

  But that wouldn’t stop the argument from reviving yet again in 2014, as ISIS burst onto the scene.

  CHAPTER SEVEN

  THE ELECTRONIC BRIGADES

  “This is a war of ideologies as much as it is a physical war. And just as the physical war must be fought on the battlefield, so too must the ideological war be fought in the media.”

  —Nasser Balochi, member of ISIS’s social media team1

  The World Cup took Twitter by storm in 2014. More than 672 million tweets were posted referencing the global sporting event, peaking at more than 600,000 tweets per minute at the height of the excitement.2

  But on June 14, Arabic-speaking fans who turned to Twitter for the latest scores discovered that their party had been crashed by ISIS. Mixed in with the highlight pictures and discussions of scores were shocking images of ISIS fighters executing hundreds of captured and unarmed Iraqi soldiers, and other atrocities.3

  The next day, as ISIS consolidated its hold on Mosul (see Chapter 2), worried Iraqis took to Twitter amid rumors that the militants were closing in on the capital city. When they searched in Arabic for “Baghdad,” they were greeted by ISIS banners containing the threat “we are coming” and images of a black flag flying over the Iraqi capital.4

  ISIS had found a new way to put its message before the public—a Twitter app.

  The app was the brainchild of J, a Palestinian living with his family in Gaza (we are withholding his name since he has not been publicly identified by investigators). J was a Web developer, graphic designer, and programmer who claimed to have been educated at Harvard and a “Los Angeles School of Arts” (which could not be confirmed through public records searches).5

  J was associated with a large number of websites and social media accounts, under a variety of names and aliases, such as Azzam Muhajir and @DawlaNoor (a play on the Islamic State’s name in Arabic). He had a day job as a commercial app developer. In his spare time, he split his days between issues related to Gaza and ISIS, but connections within his social network pointed to a heavy—and official—involvement in the latter.

  J began experimenting with apps for Twitter and for smartphones that use Google’s Android operating system. Some provided inspirational quotes from the Quran that could be read on a phone or pushed out to a user’s Twitter account. Others appeared to be work for hire, such as a commercial app selling jewelry.6

  In April 2014, J rolled out an app called the Dawn of Glad Tidings, devoted exclusively to ISIS content. It contained two components.

  The first was an Android smartphone app that let users read headlines from a series of officially sanctioned ISIS news feeds. It was capable of collecting users’ phone numbers and data about what networks the user connected to, which in turn could reveal where they were based and when they accessed the app.7 The app also served advertising, which may have profited J or ISIS or someone else entirely—the ultimate destination of the revenue was unknown. In addition to reading stories on their phones, users could post them to Twitter, and J was working on adding Facebook functionality.8

  The second component was a Twitter app, computer code that could take control of a consenting user’s account to automatically send out tweets. An ISIS supporter could use their own account, which would function normally otherwise, or set up an empty account that tweeted nothing but content sent out by the person running the code.9

  Prominent official ISIS members and supporters signed up for and formally endorsed the app as a trusted and official source of news.10 The Dawn of Glad Tidings automatically sent out links to official ISIS ne
ws releases and media, and hashtags that the ISIS social media team wanted to promote.

  A hashtag is a word or phrase preceded by the # sign, in order to make it a clickable Twitter search term. So, for instance, if an event in Syria is making news, users might tweet #Syria so that other users can easily find related tweets. Hashtags are also used by Twitter and outside services to identify “trending” topics—what’s hot—in order to suggest content to other users. The more a hashtag is tweeted, the more often it shows up on “trending” lists, resulting in more tweets and more people reading tweets that contain the tag.

  At its peak, the app was a formidable force, sending groups of hundreds of tweets at periodic intervals carefully timed to avoid raising red flags with Twitter’s automatic antispam protocols.

  A typical day might feature six or seven major broadcasts highlighting one to three official ISIS propaganda releases, such as video from an occupied area or photos of captured weapons. The app also promoted ISIS releases in advance, further evidence of its connection to the organization’s official structure. Virtually every tweet included at least one hashtag and a link for new users to sign up for the app.11

  The Dawn of Glad Tidings app was functional from April to June 2014. Although its existence had been reported before in counterterrorism circles,12 the story broke widely in June after ISIS exploded into the news with its capture of Mosul.13

  Twitter and Google soon suspended the app. Google removed all other apps by the author, while Twitter flagged the Web page where users could sign up with a warning that the site could be dangerous to their privacy.14

  The volume of tweets from a monitored group of more than 2,000 pro-ISIS accounts dropped almost 50 percent overnight when the Twitter app was shut down, with hundreds of accounts falling entirely silent.15

  When questioned by the app’s users, J promised it would soon return, but heavy fighting broke out between the Israelis and Palestinians soon after the suspension, and he found himself distracted by the explosions rocking his neighborhood (which he tweeted about).16

  In September, another supporter took up the slack and began creating accounts that tweeted systematically, controlled by simple scraps of computer code known as bots, usually designed to perform repetitive tasks. Bots have a variety of uses, many of them positive. For instance, there are bots that monitor Wikipedia and tweet any time a page is edited by a congressional staffer, in order to promote accountability.17 Other Twitter bots are primarily spam machines, sometimes set up to look like real users. Hackers use such bots to get unsuspecting Internet users to click on links that can infect their computers with viruses or worse.18

  The new ISIS bots fells into the spam category. Most of them tweeted in English, but the content suggested that the developer might be from Indonesia (a region where ISIS enjoyed wide support). By December 2014, thousands of new bots were operational. To help avoid detection, the new bots did not advertise their existence or try to attract new users. They were created in medium-sized clusters with similar names. For instance, some eighty bots were all named some variation of “IS Ghost.” Another cluster had Twitter handles with variations on the phrase pagdade (a homonym for Baghdad that pointed to the developer’s Indonesian origins).19

  The bots mostly tweeted links to official ISIS releases, such as the propaganda video “Flames of War” or videos of the beheading of Western hostages, projecting the appearance of broad support for ISIS on Twitter in excess of reality.

  But social media tactics and trickery were only part of ISIS’s arsenal. The group has won legitimate support online, while benefiting from intense global interest in the Syrian civil war. The world had a ringside seat to the conflict, although the information flowing over social media was sometimes heavily edited.

  THE TWEETED REVOLUTION

  Starting in 2010, the Arab world was rocked by a series of popular protests known as the Arab Spring, beginning in Tunisia and Egypt, where citizens lobbied for an end to longtime dictatorships and the birth of participatory government.

  Social media played an important role in publicizing the issues at play in those countries, and in organizing and publicizing the protests. Young activists used Twitter, Facebook, and YouTube to publicize corruption by the leaders of Egypt and Tunisia, according to a study by the Project on Information Technology and Political Islam. The content of social media reflected and amplified conversations from the streets, the study found, and it provided a fast way to mobilize tens of thousands of people for protests.20

  For months, the popular uprisings flooded the squares of Cairo and Tunis with protesters demanding an end to decades of ironclad dictatorships, and social media was used to document every stage of the revolutions. When Egyptian president Hosni Mubarak sent the Egyptian Army to roust protesters out of Cairo’s Tahrir Square, the event was chronicled on Twitter for a rapt worldwide audience, pushing the international community to condemn the crackdown. And when army officers dramatically defected to join the protesters, the world watched and cheered.21

  In these early, heady days, it seemed as if a revolutionary wave of positive change was washing over the region thanks to the emergence of this new technology.22

  Fueled by the fall of iron-fisted regimes in those countries (Tunisian president Zine al-Abidine Ben Ali stepped down in January 2011, Mubarak in February), Syrian activists opposed to the brutal regime of President Bashar al Assad adopted some of the same tactics.23

  But the Arab Spring froze into winter, and the longtime dictatorships in Tunisia and Egypt were replaced not by progress but by newly imperfect regimes.24 In Syria, a vision of nonviolent regime change gave way to a violent crackdown and then civil war in early 2011. From the start, social media played a crucial role in disseminating and sometimes distorting information about the conflict.25

  Syria had been a key way station for jihadists entering Iraq during the U.S. occupation, with the Assad regime turning a blind eye (in the most charitable interpretation) to frequent border crossings by militants associated with what was then al Qaeda in Iraq. There was little question that this activity was permitted by the Assad regime as a passive-aggressive hindrance to the U.S. occupation, and it may have provided more active support.26 But the networks that had supported these efforts now turned against the regime, and foreign fighters began to flow back into Syria in greater and greater numbers.

  Virtually everyone involved in the conflict began working social media to advance their agendas, almost from the start. Anti-regime activists continued to put out information about regime atrocities in very organized ways, while the regime turned to sophisticated disinformation tactics, using hackers to compromise the websites of opponents; professional trolls to unleash a steady stream of abusive tweets and posts, as well as disinformation; and “honeypots,” friendly-seeming accounts offering access to valuable information or affection, but actually intended to seduce critics into giving up compromising personal information and computer passwords.27 In addition to the organized disinformation, which proliferated wildly, rumors and genuine misunderstandings could be found in ample supply.28

  The flood of new information created new opportunities and complex challenges for journalists, academics, and intelligence officials. On the one hand, open-source intelligence was being generated at a speed and volume unprecedented in the history of conflict. In Afghanistan during the 1980s, for instance, it might take weeks or months for videotape of a muhajideen battle to travel back to the United States for viewing, where it enjoyed only limited circulation.

  In Syria, the turnaround could be hours or days, and the audience was immense. Many sources were inconsistent or unreliable. As competition grew into conflict among Syrian rebel factions, activists often produced “evidence” of each other’s dirty deeds.29 Supporters of some factions, particularly jihadists, would post images of conflict they had found on the Internet and claim they represented recent events. These images could go viral quickly, before anyone checked their veracity.30

&nbs
p; The major fighting factions quickly established official media accounts on a number of platforms for disseminating “authenticated” propaganda and activity reports, and smaller fighting factions (of which there were many) soon followed suit. The major players included the secular Free Syrian Army, the Syrian al Qaeda affiliate Jabhat al Nusra, the independent jihadists of Ahrar al Sham (later folded into the Syrian Islamic Front), and what was then known as the Islamic State in Iraq and Syria.

  ISIS set up its first official Twitter account as an official “media foundation” under the name al I’tisaamm, an Arabic reference to maintaining Islamic traditions without deviation. Its first Twitter handle was @e3tasimo, established in October 2013 to little fanfare and scant notice from the media, although it quickly gained more than 24,000 followers.31

  The official account tweeted out videos and other propaganda at a steady but slow rate. Individual accounts for members of ISIS were more active and accrued more followers as a result. One of the most prominent accounts, using the handle @reyadiraq, claimed to be unaffiliated with ISIS, a deflection tactic that supporters would try over and over again, with little success.

  In late February, after a steady diet of increasingly grisly documentation of ISIS activities, including live tweeting of the amputation of an accused thief’s hand in Aleppo, Syria, with accompanying photos, Twitter suspended “Reyad,” by which time he had accumulated more than 90,000 followers.32

  The account returned in March under the name @dawlh_i_sh, a play on the Islamic State’s acronym, but even after months, it never regained its full follower strength. It was suspended again at the end of the summer of 2014, with just under 28,000 followers, and did not return in a clearly identifiable form. Whacking the mole once again seemed to have some lasting effect.33

  The @e3tasimo account was also suspended by Twitter in late 2013 or early 2014, for reasons that were not entirely clear. ISIS attempted to re-create the account several times in January, but five or six new accounts in a row were suspended almost immediately. The pattern suggested that a government request was behind the takedown, but (as detailed later in this chapter), Twitter was restricted from disclosing such requests under certain circumstances.34