Many column inches of commentary have been dedicated in recent months to the purported shift from Telegram to other platforms. We have shown previously that despite efforts to ‘cull’ jihadi channels on Telegram, disruption did not have a meaningful impact on the core network. This core allowed jihadi groups to maintain a persistent presence. The greatest impact of that attempted disruption appears to have been the much tweeted about inconvenience caused to pundits and commentators who had only been able to access the peripheral Jihadi channels and Nashir News network that were deleted in the disruption effort.  

In this post we look at the content sharing network between January and May 2019. This produces a strategic overview of the network, to assess whether the network has been forced to evolve how they use the platform.

The analysis shows that at present the Jihadi network on Telegram is vast and remains functional. The URL sharing in core groups indicates core users are not currently preparing to make the jump to another platform. 

Overview:

• The primarily Arabic Jihadi Telegram Network is very large, spanning 9,000 channels / groups and has produced over 1.7 million updates.
• al-Dawlat al-Islamiyya, AQ, Taliban and pro-Jihadi supporters all connect into a single network which also draws on theological content at the Salafi-Jihadi Nexus.
• This network has shared over 31,489 Unique URL from 486 domains / subdomains between January and May 2019. Active content sharing is still occurring on the surface web, despite punditry to the contrary.
• By contrast there are very few links to the dark web, highlighting how important remaining on the surface web is for the Jihadi movement. 
• The most frequently used domains do not offer a serious alternative to Telegram. In the period to May 2019, the behaviour previously seen in the transition between Twitter and Telegram of mass link sharing to the accounts on the new platform is not currently being repeated.   
• A model of the information flow between platforms which are used within the jihadi information ecosystem continues to exhibit a dispersed network comprised of beacons, content stores and aggregators. 
• Tech resources, such as apps, disposable phone numbers, encrypted email, and VPN are an important part of both the Telegram network and the entire information ecosystem.  

Data

Using the curated feed of human verified jihadi channels and groups archived by BlackLight between January and May. This dataset contains 1.7 million updates of which 878,795 (approximately 50%) were forwarded from other channels and groups.

Analysis of these messages produced a network of over 85,000 connections (content sharing or cross posting). The network is made up of 9,000 accounts and groups. The connections between nodes show that groups of channels form specific clusters, each of which containing some common theme or allegiance to a Jihadi group. 

As discussed in previous posts there is a dispersed network with many accounts that have some importance to the network (rather than one or two very important accounts – which would make the network vulnerable to disruption).

As in previous analyses, ISIS, AQ, and Taliban channels all appear in the same interconnected network. This is often because:

• they draw on similar other channels (those with a specific historical or theological focus for example) or
• pro-Jihadi channels / groups who share the overarching theology and purpose, but do not have specific organizational allegiance, aggregate material from both al-Dawlat al-Islamiyya and AQ.   

The network structure and emergent communication architecture of the clusters indicates that they will likely remain resilient to the removal of even a large proportion of the channels and groups. Of the different clusters, those closest to the al-Dawlat al-Islamiyya have the most dispersed network architecture – providing the greatest resilience, while Taliban appear to have adopted the distributed structure to a lesser extent.

External Links.

This section examines over 1 million (1,048,575) URL identified in messages and captions. Within this million URL sample the research found 31,489 Unique URL from 486 domains / subdomains.

Calculating the number of times URL representing content on specific domains had been observed, Telegram links appeared most frequently in posts.  It is a common observation that the domain on which data is being collected is also the most frequently linked to domain in the dataset, as users often include the link for a channel or chat in their posts.  

Looking at the number of unique URL gives an alternative perspective. It shows that while Telegram links appear frequently, they are a relatively small number of URL appearing frequently. In contrast, there are relatively higher numbers of URL from other domains, each of which appear relatively infrequently. This is logical, as many URL outside Telegram host a specific piece of content, and hence it is shared when it is released and subsequently falls out of use.

Examining the URL from outside Telegram provides an overview of the other locations within the Jihadi information ecosystem. This shows the number of times domains were observed in posts.    

Similarly, analysing the domains by the number of different URL shared from that domain, shows how the information ecosystem combines branded content from jihadi groups, located on content stores and aggregators, with a wide range of other material including mainstream news sites.

From this we find:

• Despite the claims Jihadi groups have not been driven off the surface web, sites such as archive.org, telegra.ph, and justpaste.it are frequently used as Jihadi content stores and aggregators.
• None of the most observed domains offer a serious alternative to Telegram. In the period of adjustment, which occurred in the autumn of 2015 and Spring 2016, Jihadi twitter accounts regularly shared links to Telegram channels to allow sympathisers to maintain access to the Jihadi information ecosystem. In the period to May 2019, the behaviour previously seen in the transition between Twitter and Telegram is not currently being repeated.   

Flow across the Ecosystem.

In examining the flow of users across the ecosystem in 2019 we find there are two distinct clusters, one focused on tech and the other on Jihadi content and related news. This uses the same method as was discussed during the GRNTT conference at Brookings.  

The tech cluster on the lower portion of the graph fulfils an important role for the movement, as it provides access to services such as VPN, disposable / free phone numbers and a range of communication programmes distributed as .apk files (Andriod Package File).

The content cluster features platforms from the three main roles in the Jihadist information ecosystem:

• The signposts including Telegram and Facebook,
• Content stores such as Archive.org, Google Drive, imgur, and Files.fm
• Aggregators such as Justpaste.it and Telegra.ph

Other findings of note;

• Obedient Supporters and Nashir 1440 are content aggregators which provide content downloads on the surface web.
• Tgho.st – is a file sharing system native to Telegram. Tgho.st operates by users sending the file to a Telegram Bot, the bot subsequently returns a URL where that file can be downloaded by anyone using the download link in a browser. The service advertises that “These files are not deleted and will always be available for download”.
• Videopress – URL to Videopress were frequently extracted from videos posted on the earlier version of Jihadology, although without the full Jihadology page / URL. Such a finding illustrates the importance of focusing on the Jihadi primary language, Arabic, rather than drawing conclusions from fringe languages, particularly English. However, this is likely to fall out of use following the recent update to the site.  

Conclusion

• The primarily Arabic Jihadi Telegram Network is very large, spanning 9,000 channels / groups and has produced over 1.7 million updates.
• al-Dawlat al-Islamiyya, AQ, Taliban and pro-Jihadi supporters all connect into a single network which also draws on theological content at the Salafi-Jihadi Nexus.
• This network has shared over 31,489 Unique URL from 486 domains / subdomains between January and May 2019. Active content sharing is still occurring on the surface web, despite punditry to the contrary.
• By contrast there are very few links to the dark web, highlighting how important remaining on the surface web is for the Jihadi movement. 
• None of the most observed domains offer a serious alternative to Telegram. In the period to May 2019, the behaviour previously seen in the transition between Twitter and Telegram is not currently being repeated.   
• A model of the information flow between platforms which are used within the jihadi information ecosystem highlights a dispersed network comprised of beacons, content stores and aggregators. 
• Tech resources, such as apps, disposable phone numbers and email, and VPN are an important part of both the Telegram network and the entire information ecosystem.