ISIS

by Jessica Stern

  Even hobbled by these disclosure restrictions, Twitter made it clear the pace had changed. During the first six months of 2013, Twitter reported receiving 60 requests from governments and other entities67 around the world. During the second half of 2013, that number skyrocketed to 377, an increase of more than sixfold, which did not include the exempted requests noted above. The number of documented requests increased by another 14 percent in the first six months of 2014.68

  Initially, Twitter’s suspensions of ISIS accounts were similarly ambiguous. When the official ISIS account was first suspended in February 2014, there was no obvious provocation to which it could be attributed.

  The second time the official account was suspended, around the end of May, the reason was clearer. The suspension closely corresponded to the release of Salil al-Sawarim 4, Arabic for The Clanging of the Swords Part 4, the latest installment in a series of increasingly sophisticated and violent propaganda videos (see Chapter 5). The video showed hundreds of executions in graphic detail.

  The tactics ISIS used for distribution online were designed to inflate the appearance of its popularity. The Dawn of Glad Tidings app blasted out thousands of tweets promoting the video,69 which quickly racked up large numbers of views on YouTube (likely also fueled by repeated clicks from the mujtahidun and bots that could automatically access the video over and over again without involving a human viewer, although this could not be conclusively proven).70

  Regardless, the fake-it-till-you-make-it principle applied and ultimately resulted in the video being widely viewed and discussed, with some Western analysts calling it the “most successful” jihadi video in history. That is almost certainly true, but ISIS’s manipulations played a critical and generally underestimated role in inflating its importance. There is no way to know how many people actually viewed the video.71

  The second official ISIS account was suspended almost immediately after the release of The Clanging of the Swords 4, with a speed that again suggested a government hand. But many other Twitter accounts remained online, including top influencers with more followers than the official account, such as ISIS media distributor Asawirti (Interpreter) Media, popular Chechen foreign fighter Abu Walid al Qahtani, and a notorious English-speaking tweeter using the name Shami (Syria) Witness (a user based in India who was arrested in December 2014).72 Each had tens of thousands of followers, and the calculated ISIS distribution strategy was in full effect.

  The timing of the release, and its focus on the mass execution of Iraqi soldiers taken prisoner, was significant. ISIS was employing social media as a tool for military and psychological offense. It foreshadowed actions with deliberation and strategic intent. On the surface, The Clanging of the Swords appeared to be just another ISIS video production, albeit a very successful one, but it came into play on the ground just a couple of weeks later.

  Starting in early June, ISIS forces stormed through northern Iraq. When they reached Mosul on June 9, Iraqi troops defending the city turned and ran, some stripping their uniforms off as they fled. Some Western analysts and many ISIS supporters credited the video for inspiring the fear that led to this stunning retreat.73

  Within a week, several official regional ISIS Twitter accounts had been shut down, including one of the only sources providing information on the attack against Mosul.74 While Twitter refused (or was prohibited) from discussing the reasons for the shutdown, government requests were again suspected. On June 17, Twitter suspended the Dawn app, likely for violating its terms of service and related to news coverage rather than government requests.75

  These setbacks came less than two weeks before ISIS’s next big move, the declaration it was changing its name to simply the Islamic State and claiming the mantle of the caliphate.

  While the losses weakened ISIS’s distribution of content on the day of the announcement, June 29, and in the days to follow, the announcement was big news in the jihadi world, and ISIS supporters were fired up. Their burst of hyperactivity helped offset the disadvantages and distribute a string of important media releases, including an unprecedented video of emir Abu Bakr al Baghdadi giving a sermon in conquered Mosul (along with translations in multiple languages) and the first issue of an ambitious English-language magazine named Dabiq, after a town in Iraq featuring prominently in Islamic prophecies (see Chapter 5). After Baghdadi showed his face for the first time, thousands of Twitter and Facebook fans began to use his image in their profiles.

  But the announcement still underperformed relative to social media campaigns earlier in the year. ISIS supporters were extremely disappointed in the reaction of Muslims in general and their fellow jihadis in particular.

  One mujtahidun complained that no one had showed up for a Twitter storm he announced. “Where are the others? Let’s terrorize the kuffar on #Twitter. Is it too much difficult? Kuffar is doing their best to fight us. What about us?” Others complained petulantly that if people didn’t want to swear allegiance to ISIS, they could at least refrain from mocking the would-be caliphate.76

  The regional accounts—ISIS had one for each of its major geographical holdings—trickled back after a few weeks, with sporadic resuspensions and respawns. As the summer stretched on, whack-a-mole continued at a simmer, as did ISIS’s aspirations for global support (see Chapter 8). Some ISIS accounts went down; most remained.

  Then, on August 13, things began to ramp up. The official ISIS regional accounts were again suspended, but this time they were knocked down as soon as they came back, sometimes within minutes of returning. This continued for some hours, through dozens of iterations, until the message finally became clear. While some of the big influencers remained online, official ISIS accounts would no longer be tolerated on Twitter.

  Some dozens of smaller accounts went down as well, including several prominent foreign fighters tweeting in English. Almost a week later, Twitter suspended the biggest and most influential ISIS accounts, including Abu Walid al Qahtani, Asawirti Media, and “al Khansa’a,” a female former al Qaeda supporter who had become a powerful voice supporting ISIS and helping to organize its online recruitment of women (see Chapter 4). Al Qahtani went dark for a time, while the latter two kept popping out of holes to get whacked again periodically.77

  Other jihadi accounts, including some associated with al Qaeda and Jabhat al Nusra, were also suspended, but sporadically. The main focus was ISIS.

  A comedy of errors ensued. While the number of suspensions had climbed to more than one hundred, they still represented only a fraction of the active ISIS supporters on Twitter. Nevertheless, panic began to spread among ISIS tweeters.

  Some, like Shami Witness, made their accounts private on the theory that it would help insulate them against suspension. Others changed their screen names and user handles (because surely that would fool Twitter). Many changed their profile pictures from ISIS’s characteristic black flag emblem to pictures of flowers and kittens. One changed his screen name to “Syrian Food” and profile pictures to a restaurant. Many users subsequently abandoned these tactics, as their effectiveness was questionable and they made it much more difficult to do the work of social media activism.

  Stalemated with Twitter, ISIS began trying to reconstitute its official accounts on alternative social networks. It moved to an obscure Twitter alternative called Quitter, where it was quickly suspended. It went to a pro-privacy social network called Friendica, which killed the accounts quickly and posted a message to anyone who came looking: “Islamic State not welcome on friendica.eu.”78

  ISIS then moved to Diaspora, an open-source social network specifically designed to let individuals and groups host the service using their own infrastructure, which in principle should have insulated the accounts from suspension on a purely technical basis. But the social network’s designers and users found a way to take them down yet again.

  Finally, in what must have been desperation, ISIS moved its accounts to VKontakte, a popular Russian equivalent to Facebook. This was, in many ways, an amazing tu
rn of events. VK, as it is popularly known, had some months earlier lost a struggle for independence against pro-Putin forces in the Russian marketplace. There was good reason to suspect that sharing user data with VK was functionally indistinguishable from simply handing it over to the FSB, the Russian intelligence service. Hundreds and hundreds of ISIS followers did just that, until even VK grew weary of them and suspended the official accounts.79

  ISIS had not been idle during all this tumult. On August 19, it released the now-infamous video of the beheading of American journalist James Foley.80 ISIS Twitter accounts hit the ground running, distributing the video using the English hashtag #AMessagetoAmerica and directing tweets to the accounts of random Americans in an effort to spread them among the American public. ISIS supporters also paid spammers based in the Persian Gulf region to send out tweets that included the hashtag.

  Twitter, apparently on its own initiative, began to take down accounts that were spreading the video and graphic images included in it. The sweep of this crackdown was so broad it took down the accounts of some journalists and analysts who had tweeted the content (they were restored later).81 Still, only about fifty ISIS accounts were suspended in the first twenty-four hours after the video released. It was more than Twitter had suspended in one sweep before, but still a tiny fraction of all ISIS-supporting accounts.82

  The move may have been empowered by a new policy Twitter announced just hours after the video was released.83 The policy had been in the works for days prior and was prompted by the suicide of actor Robin Williams on August 11. Internet trolls had tweeted Photoshopped images that they claimed showed the actor’s corpse.84

  “In order to respect the wishes of loved ones, Twitter will remove imagery of deceased individuals in certain circumstances,” Twitter wrote, adding that it “considers public interest factors such as the newsworthiness of the content and may not be able to honor every request.”85

  Although news reports attributed the policy to the Williams incident, there were hints that Twitter might have known the Foley video was in the works. The crackdown on ISIS had started prior to the video’s release. In the thirty days preceding the Foley video, Twitter had suspended at least eighty ISIS accounts, including all of its official outlets. A number of ISIS accounts had foreshadowed the release by tweeting images from the 2004 beheading of Nicholas Berg.

  In keeping with its typical silence, Twitter refused to comment on why specific accounts were suspended, but in the wake of the Foley video, it referred curious reporters to the family request policy.86 Some ISIS supporters took the hint and stopped tweeting the video and images. Others persisted and were suspended, often multiple times.

  In the weeks following the Foley video, Twitter continued suspending the accounts of ISIS supporters, usually dozens at a time, with periods of inactivity between.

  News coverage and Twitter intervention seemed to track uncomfortably with the race of the victims depicted. When ISIS publicized the executions of Iraqis and Syrians, news coverage and organizational responses were minimal, but the beheadings of white Western journalists—which continued throughout the fall—led to more Western media coverage and more suspensions by Twitter.87

  ISIS supporters joked about being Twitter shahids (martyrs), and when they created new accounts, they began listing the number of times they had been previously suspended in their profiles. As both the suspensions and the beheadings continued, it became more difficult for ISIS to push its message to the widest possible audience. It turned more heavily to manipulative tactics such as bots and purchased tweets.

  The number of suspensions began to climb. More than 400 accounts went down in one seven-hour period in late September. Between September 1 and November 1, at least 1,400 ISIS-supporting accounts were suspended—a very conservative estimate.88 As frustration mounted, many ISIS users took to threatening to kill Twitter executives, sometimes by name. The social media platform had been weaponized against itself.89

  In December 2014, Twitter announced it would overhaul the process of reporting abusive or violent behavior, making it easier to report accounts or specific tweets that violated Twitter rules and preventing users from viewing the profile pages of someone who had blocked them. Some online advocates continued to insist more changes were needed, and Twitter said its policies would continue to evolve.90

  In the meantime, the suspensions were starting to have an effect on ISIS. The number of retweets that an average ISIS supporter could expect to receive dropped significantly. From August, when the major crackdown began, through the end of October, the average number of retweets for every tweet by a monitored ISIS supporter (excluding bots) plunged 42 percent, from 5.02 to 3.49. The percentage of tweets by ISIS supporters that received no retweets at all climbed from 57 percent to 62 percent.91 Other metrics (such as the number of followers and number of tweets per day) also appeared to drop dramatically.

  While these analyses pointed to an impact from the suspensions, it is important to note the difficulty of creating a reasonable comparison set. One especially large challenge stems from the fact that there is no definitive estimate of how many ISIS supporters are active on Twitter.

  In late 2014, we attempted to answer the question of how many ISIS supporters were active on Twitter, in a research project commissioned by Google Ideas and coauthored by J. M. Berger and Jonathon Morgan. As of press time, we estimated that at least 45,000 pro-ISIS accounts were online between September and November 2014, along with thousands more pro-ISIS bot and spam accounts.

  This represents only an initial finding. The research project will be completed between the writing of this book and its publication, and the complete results will be published by the Brookings Institution and will also be available at Intelwire.com by the time this book is published. Once a baseline set of ISIS supporters has been identified, it will be possible to conduct better research on the effect of suspensions.

  ISIS STRIKES BACK

  Although analysts continued to debate the merits of whack-a-mole, ISIS supporters delivered their verdict loud and clear.

  “As the accounts of the caliphate’s supporters become scattered, their effectiveness rises and falls, and the control the supporters have decreases,” wrote Shayba al Hamd, an ISIS social media activist, on September 12, calling the campaign “devastating” and a “dirty war.”92

  “The Crusaders tremble at the media power of Dawla [the Islamic State], which has taken up permanent residence in the depths of Twitter,” he wrote.

  ISIS strategy documents diagnosed the problem as emanating from the top down, with the official accounts targeted first and the industrious mujtahidun second. The ansar supporters were less vulnerable, and a fourth tier, “the silent supporters,” was therefore required to step up and become more active. If Twitter closed a tier, he wrote, the next tier would simply rise up to take its place (not addressing the fact that the supply of tiers appeared finite).

  “Why must you return to Twitter?” al Hamd asked rhetorically. He compared it to war: If the frontline fighters desert, what hope has the army?

  Other ISIS users specifically pointed to the amount of time and energy that they were now wasting on rebuilding the same networks over and over again, and the fact that even the hard-core mujtahidun were growing weary of promoting newly resurrected accounts for days on end.93

  Some devised elaborate countermeasures, based on ISIS social media experts’ beliefs about how Twitter decided whom to suspend and whom to permit. In addition to a brief bout of camouflaging accounts, some periodically changed their online names. Others blocked anyone following them who “looked suspicious” (these might be anonymous accounts or journalists and terrorism researchers who failed to take steps to hide their own presence online).

  Twitter largely remained silent about its ISIS problem, even when the group’s supporters began threatening to kill and behead their employees, sometimes by name and photo.94 But it quietly made a change to its terms of service, which allowed it to req
uest a valid phone number to verify the identity of any user. A spree of suspensions followed almost immediately. ISIS noted this, and guided users to services that provided false phone numbers that could be used to verify accounts.

  Some also made more elaborate plans. ISIS had, for some time, been recruiting and training hackers, some with links to broad international cybernetworks that later repudiated them.95 These activists, including many on the social media team, were part of the “Islamic State Electronic Army” and were active on both Twitter and Facebook.

  The army had a “brigade” devoted to media operations, which included many key members of its social media team (known as i’lamiy nasheet, or “the energetic journalists”) and a “technical brigade” that worked on hacking and security operations.96 The two sometimes overlapped and collaborated, for instance to design the bots and apps that were so important to ISIS’s social media success.

  One unsigned technical brigade strategy document suggested supporters should hijack older accounts with significant numbers of followers that had been abandoned by their Western users, providing detailed instructions; examples of success were not abundantly detected in the wild (that is, actually being implemented on Twitter). The document then provided overly complex instructions on how to gain followers.97

  All of these strategies were predicated on the incorrect assumption that such tactics would also provide protection. Most of the proposed countermeasures were stabs in the dark. At best they might slow down the process of suspension. At worst they contributed to a growing sea of confusions.

  At first, the technical brigade recommended that someone whose account had been suspended should return with the same name and a number added to the end (a tactic also used on Facebook), to make it easier for supporters to find each other. It was also recommended that users create multiple backup accounts and let their followers know where to find them if they were shut down.