After a pause, the account returned on February 20 as @wa3tasimu, and Twitter did not intervene. Through March, the new account accrued more than 18,000 followers. In contrast, its chief rival, Jabhat al Nusra, had more than 50,000.35
But beyond the follower counts, there were oddities in ISIS’s social media profile, hidden patterns that betrayed a hidden purpose.
Day after day in the month following ISIS’s return to Twitter, a strange effect became visible. Each group used its formal name as a hashtag to identify media releases and supporter content. Despite its huge follower deficit, ISIS’s hashtag was consistently tweeted more often than al Nusra’s, by about four to one.36 A data-driven analysis of the followers of both accounts helped reveal the hidden dynamics.
Over the years, information scientists had observed a pattern of activity in online communities sometimes known as the 90-9-1 rule. Generally speaking, focused online communities tend to break down in predictable groups. As a rule of thumb, about 90 percent of users will be mostly passive, about 9 percent are active, and 1 percent are very active. In social media networks, this dynamic also applies to the distribution of influence, defined as the ability to prompt interaction and participation by other users.37
The followers of both al Nusra and ISIS roughly broke out into the same pattern, but the devil was in the details. ISIS users in the 9 percent group were measurably more active than their counterparts following al Nusra. ISIS had a few thousand active online supporters who were more enthusiastic—and more organized—than their counterparts in the 9 percent group of al Nusra supporters.38
This was no accident; it was strategy. ISIS had a name for these users—the mujtahidun (industrious).39 The mujtahidun could be observed repeatedly using specific tactics to boost the organization’s reach and exposure online.
For instance, media releases followed a predictable pattern. After being posted and authenticated by official ISIS members, a second-tier group of several dozen online activists would retweet the link with a hashtag, then retweet each other’s tweets and write new tweets, all using the same hashtag. Other activists would upload the release to multiple platforms, so that it could be found even when Internet providers pulled the content down. After that, a third tier—the ansar muwahideen (general supporters)—would repeat the process on a larger scale.40
Similarly, online hashtag campaigns were designed by activists on jihadist forums, largely out of sight, then implemented on Twitter in the same systematic way, with key users repeatedly tweeting the same hashtag and each other, and the next tier retweeting the previous tier and each other. The technique would routinely result in hundreds of similar tweets with hashtags at coordinated times, sometimes referred by participants as a “Twitter storm.” Using the most inclusive criteria, around 3,000 users were part of this social media battalion (as ISIS called it) at its height, although some of those accounts were automated bots.41
The coordination was designed, in part, to game the systems that identified trending topics on Twitter. By concentrating their tweets in a short period and repeatedly tweeting the same hashtag, the media battalion could cross the threshold that would trigger trending alerts that would be displayed by Twitter on its website, as well as by third-party services such as “Active Hashtags,” an automated Twitter account with more than 160,000 followers that highlighted trending topics in the Arabic language.42 A strong performance could also influence search results, as seen during the World Cup and the march on Mosul.
There was a cascading effect to these efforts. Each time a hashtag ranked as trending, it was exposed to more people, generating still more activity. When an ISIS hashtag appeared on the Active Hashtags account, for instance, the tweeted announcement was retweeted an average of 72 times—making the tag trend even higher just on the basis of its appearance in that tweet, without accounting for those who might click the link and take a legitimate interest in the content.43
The jihadis soon developed their own version of the account, @al3r_b, which purported to retweet the most important “Muslim” news, but whose content consistently favored ISIS and its prominent online supporters. Tweets picked up by @al3r_b would be retweeted as many as nine times more than other tweets by the same user. (Twitter suspended the account in September or October 2014).44
It was a classic case of “fake it till you make it” marketing—the boost in visibility and exposure created an appearance of momentum that gradually turned into real momentum and a growing base of support, especially within the online jihadist communities where ISIS was now directly competing with al Qaeda for legitimacy and resources (see Chapter 8).
Smart—if deceptive—social media strategies boosted ISIS across the board. In contrast, the al Qaeda–controlled al Nusra had simply replicated the old style of media distribution on the new platform of Twitter, with a focus on relatively simple propaganda videos and fund-raising channels, where it outperformed ISIS significantly.
Ultimately, al Nusra’s organically grown social network was no match for ISIS’s engineered network features, such as the mujtahidun and the Dawn of Glad Tidings app. When the app rolled out in April, it automated and enhanced the efforts of the mujtahidun, resulting in a huge surge in the group’s visibility.
None of this online activity existed in a vacuum, and much of it was strategic. In March, for instance, one highly organized Twitter campaign featured a hashtag demanding that ISIS emir Abu Bakr al Baghdadi “declare the caliphate.” It was an unprecedented tactic by an extremist group, essentially providing an online focus group to test its messaging before making it official, allowing ISIS to fine-tune the actual announcement when it arrived months later.
The Dawn app also coordinated to offline activities, reaching new heights just as ISIS rolled into Mosul in June. At its peak, during the attack on Mosul, the app generated about 40,000 tweets in one day (including retweets of the app’s content by other users). The termination of the app on June 17—just twelve days before the announcement of the caliphate—struck a blow against ISIS’s messaging strategy at a critical moment.45
As a result, supporters had to work harder for lesser gains. At one point, ISIS activists resorted to posting lists of tweets that users could cut and paste in an effort to simulate the app’s function, but these efforts could not offset the loss of automation.46
When ISIS announced its caliphate on June 29, it took the major media almost twenty-four hours to discover, authenticate, and report the story. The messaging apparatus was not unstoppable and it was not all-powerful. It was down, but far from out.
BEYOND THE OFFICIAL ACCOUNTS
Individual foreign fighters with all of the factions in Syria could be found on social media by the hundreds, at first, and soon by the thousands. While they were represented on a number of platforms (the Dutch fighter named Yilmaz, mentioned earlier, accrued a massive following on Instagram before being suspended), a significant proportion of activity gravitated toward Twitter.
Due to its simplified interface, Twitter was well suited to situations where users had limited Internet access—tweets could even be posted and read via SMS text, which could be sent over any functional cell phone network and did not require an Internet connection. Additionally, Twitter was still reluctant to suspend accounts for terrorist content, which allowed users to accrue more followers and spend less time rebuilding networks than on other platforms, such as Facebook.
In some ways, the fighters used social media like anyone else, to chat with friends and post the mundane details of their lives, often in their native languages. The tabloid media, particularly in the United Kingdom, had a field day breathlessly reporting on the fighters’ selfies with kittens and cravings for Nutella, as well as “terrifying” threats posted by accounts of questionable significance (for instance, claims that ISIS had a “dirty bomb” or that its operatives would infect themselves with Ebola and enter the United States).47
Not everyone who tweeted in support of ISIS was actually linked to the gro
up, and not everyone who looked like a foreign fighter was one in real life. But all of them quickly learned that the global media reliably pounced on whatever they said, and the more outrageous the better.
Google searches for “ISIS” soared in July 2014, after the announcement of impending U.S. air strikes in Iraq ignited a Twitter storm of threats from ISIS supporters. Using the English-language hashtag #AMessagefromIStoUS, at least hundreds of Twitter users directed a barrage of threats both vague and specific at Americans, promising retribution on U.S. soil if the United States attacked ISIS. Activity spiked again in September, after ISIS released videos of the beheading of American journalists.48
Not all of this activity was confined to ISIS. Fiery clerics took to the social “airwaves,” exhorting supporters to action and praising their faction of choice. Dozens of prominent Persian Gulf fund-raisers took to Twitter and Facebook, where they posted bank transfer information to “help the Syrians,” which in many cases meant funding non-ISIS jihadist fighters, although they avoided explicitly naming the recipient of the funds. Their followers swelled into the hundreds of thousands, with clear signs of covert activity constantly bubbling beneath the surface (for instance, clusters of accounts that all had established links with each other but never tweeted, or accounts with tweets marked as private that had posted thousands of tweets but had no followers).49
Then there were the recruiters. Prior to 9/11, jihadist recruiters had done much of their work in “brick-and-mortar” settings, with former foreign fighters traveling from city to city to tell potential recruits about their experiences and urge them to join the conflict du jour.50 In Syria, a new dynamic emerged. Fighters could do the work of recruitment without ever leaving the front lines, a phenomenon Shaarik Zafar of the U.S. National Counterterrorism Center dubbed “peer-to-peer recruiting.”51
Potential fighters could follow actual fighters from their home countries on Twitter, talk to them, ask questions, and eventually receive guidance about how to join the fight. In addition to Twitter and Facebook, many fighters signed up for ask.fm, the question-and-answer website where they entertained queries that ranged from banal to practical.
Recruits might travel on their own initiative to Turkey near the Syrian border, then log on to Twitter and ask for someone to come and pick them up. Incredibly, it seemed to work on a regular basis.52
People specifically tasked with recruitment also stalked the vulnerable online,53 although the old ways did not completely fade. Many groups maintained dedicated recruitment networks on the ground. For instance, ISIS had operatives recruiting in Minneapolis, once a major pipeline for al Shabab fighters.54
Individuals worked the community, promising money and marriage to young men (and women), some of whom belonged to gangs that had adopted street names based on famous jihadist figures.
All of them also followed each other on Twitter, where the recruiters could keep tabs on what was happening and communicate privately with those who seemed willing. One fighter who was closely connected to that online recruiting network was Douglas McAuthur [sic] McCain, a Minnesotan killed fighting for ISIS in late summer of 2014, who maintained multiple Twitter accounts that followed and were followed by members of the recruitment network back home.55
But some professional radicalizers and recruiters simply moved their whole portfolios online, where they could operate more privately, away from the target’s friends and family, a practiced tactic.56 The primary work of the recruiter was building relationships, after all, and social media was made for that. Dozens of men and women on Facebook who listed their profession as dawah (an Arabic word for evangelical preaching) could be found working their way through Muslim social circles, seeking the vulnerable and providing them with connections that would lead them to Syria.
Evidence of these networks could be found in the case of Nicholas Teausant, a California native indicted in March 2014 for attempting to join ISIS. Although his social network connected him to legitimate radical communities supporting ISIS in the United Kingdom, Teausant was diverted by the intervention of an FBI informant and arrested. Just days later, two men from North Carolina with connections to the same social network online were arrested for planning to travel to Syria.57
ISIS social media operatives liked Facebook, with its rich media capabilities and multiple network options (such as fan pages and moderated groups that resembled the old forums), and they took a sophisticated approach to establishing its presence.
Fan pages for Abu Bakr al Baghdadi quickly accrued more followers than those of better-known extremists such as Anwar Alwaki. ISIS laid other plans signaling the announcement of its caliphate, creating accounts on Twitter (@islamicstatee) and Facebook two weeks in advance.58
One English-language page, Bilad al Shaam (a reference to Syria under the historical Umayyad caliphate), was created, suspended, and rebuilt dozens of times. Each time it returned, with a number denoting how many iterations it had gone through and sometimes a jab at the “Facebook thugs.” Each time it met with a quick end. Another popular campaign using the slogan “We Are All ISIS” launched on Facebook before expanding to other social media. At least forty-eight iterations of the Facebook page were created after repeated terminations, according to Jeff Weyers, an analyst closely tracking extremist use of Facebook.59 Facebook kept whacking the more visible moles, and terminating the accounts of bomb-making instructors and active terrorist plotters, but it was more difficult to intercept the recruiters, who often presented themselves simply as devout Muslims, avoiding obvious indicators of their affiliation and doing most of their work through private interactions.
But Facebook’s vigilant policing had still paid benefits. While they had by no means exterminated the infestation, jihadis began to express frustration with the platform. As on Twitter, a core group of mujtahidun helped populate pages with content and likes, but the frequent suspensions limited ISIS’s ability to reach an outside audience where fresh recruits could be lured.
Throughout 2014, more and more ISIS supporters moved their main activity to Twitter, where they could reliably expect to operate free from interference. While it was easier for jihadis to operate on Twitter, the social media strategies of ISIS were fueling public and private pressure on the libertarian social media platform. A showdown loomed.
TWITTER VS. ISIS
As ISIS rose in prominence, Twitter once again came under scrutiny for its practices. Unlike Facebook and YouTube, which allowed users to flag terrorist content for review, Twitter initially offered few reporting options.
“Users are allowed to post content, including potentially inflammatory content, provided they do not violate the Twitter Rules and Terms of Service,” its guidelines read.60
At the time, Twitter’s abuse reporting form was lengthy and restrictive, asking for substantial information on the user filling out the report and recommending that people just block accounts they didn’t like. Blocking is a procedure that prevents other users from “mentioning” the blocker and thus showing up on their Twitter timeline, but it did not, at the time, prevent the blocked user from other activity, including reading the blocker’s tweets by going directly to their Twitter profile page.61
There were other ways to get around blocking as well, raising issues that were more problematic in areas other than counterterrorism. For instance, blocking was virtually no impediment to stalkers or sexual harassers.
The platform’s policy on violence was similarly narrow. Only “direct, specific threats of violence” were explicitly banned in the “Twitter rules.” That generally meant naming an individual and threatening specific bodily harm against him or her. When al Shabab was first suspended for threatening to execute a hostage, it had crossed that line.
During the Westgate Mall siege (Chapter 6), Twitter took a broader view of its existing policies, with threats against Kenya during an ongoing terrorist attack against Kenyans apparently being specific enough to merit a response. Or perhaps the prospect of headlines such as “
Are mass murderers using Twitter as a tool?” made the difference.62
After Westgate, the operating environment on Twitter slowly began to change. Several hundred al Shabab members maintained accounts on Twitter. Slowly and steadily, many of those accounts began to disappear. Three of the most important accounts in the Shabab network with the largest follower counts were among the first to go. They came back, smaller, but were soon suspended again.63
In addition, a number of tiny accounts began to blink out of existence, one or two at a time, often including new followers of the few prominent Shabab accounts that remained active. These were not noisemakers engaged in highly visible social media campaigns; some had only dozens of followers.64
This pattern suggested the suspensions were the result of government requests, although it was unclear which government. Some government requests came packaged in a form that prohibited Twitter from disclosing whether the requests had taken place and whether it had complied with them.
“The data in these reports is as accurate as possible, but may not be 100% comprehensive,” Twitter’s “transparency” page noted laconically. Its blog post on transparency was considerably blunter, noting that, within the United States alone, it was prohibited from reporting on suspension requests that were received in the form of official “national security letters” (NSLs) and certain types of Foreign Intelligence Surveillance Act (FISA) warrants.
Twitter’s complaints about transparency had significant merit, but its efforts to win the right to even disclose generalities about such requests were rebuffed by the government.65 In October 2014, Twitter filed suit against the government seeking the right to disclose more information. As of this writing, the lawsuit was still in progress.66
ISIS Page 17