Media Mujahidin on Telegram: Overview of 2019

Many column inches of commentary have been dedicated in recent months to the purported shift from Telegram to other platforms. We have shown previously that despite efforts to ‘cull’ jihadi channels on Telegram, disruption did not have a meaningful impact on the core network. This core allowed jihadi groups to maintain a persistent presence. The greatest impact of that attempted disruption appears to have been the much tweeted about inconvenience caused to pundits and commentators who had only been able to access the peripheral Jihadi channels and Nashir News network that were deleted in the disruption effort.  

In this post we look at the content sharing network between January and May 2019. This produces a strategic overview of the network, to assess whether the network has been forced to evolve how they use the platform.

The analysis shows that at present the Jihadi network on Telegram is vast and remains functional. The URL sharing in core groups indicates core users are not currently preparing to make the jump to another platform. 

Overview:

  • The primarily Arabic Jihadi Telegram Network is very large, spanning 9,000 channels / groups and has produced over 1.7 million updates.
  • al-Dawlat al-Islamiyya, AQ, Taliban and pro-Jihadi supporters all connect into a single network which also draws on theological content at the Salafi-Jihadi Nexus.
  • This network has shared over 31,489 Unique URL from 486 domains / subdomains between January and May 2019. Active content sharing is still occurring on the surface web, despite punditry to the contrary.
  • By contrast there are very few links to the dark web, highlighting how important remaining on the surface web is for the Jihadi movement. 
  • The most frequently used domains do not offer a serious alternative to Telegram. In the period to May 2019, the behaviour previously seen in the transition between Twitter and Telegram of mass link sharing to the accounts on the new platform is not currently being repeated.   
  • A model of the information flow between platforms which are used within the jihadi information ecosystem continues to exhibit a dispersed network comprised of beacons, content stores and aggregators. 
  • Tech resources, such as apps, disposable phone numbers, encrypted email, and VPN are an important part of both the Telegram network and the entire information ecosystem.  

Data

Using the curated feed of human verified jihadi channels and groups archived by BlackLight between January and May. This dataset contains 1.7 million updates of which 878,795 (approximately 50%) were forwarded from other channels and groups.

Analysis of these messages produced a network of over 85,000 connections (content sharing or cross posting). The network is made up of 9,000 accounts and groups. The connections between nodes show that groups of channels form specific clusters, each of which containing some common theme or allegiance to a Jihadi group. 

As discussed in previous posts there is a dispersed network with many accounts that have some importance to the network (rather than one or two very important accounts – which would make the network vulnerable to disruption).

As in previous analyses, ISIS, AQ, and Taliban channels all appear in the same interconnected network. This is often because:

  • they draw on similar other channels (those with a specific historical or theological focus for example) or
  • pro-Jihadi channels / groups who share the overarching theology and purpose, but do not have specific organizational allegiance, aggregate material from both al-Dawlat al-Islamiyya and AQ.   

The network structure and emergent communication architecture of the clusters indicates that they will likely remain resilient to the removal of even a large proportion of the channels and groups. Of the different clusters, those closest to the al-Dawlat al-Islamiyya have the most dispersed network architecture – providing the greatest resilience, while Taliban appear to have adopted the distributed structure to a lesser extent.

External Links.

This section examines over 1 million (1,048,575) URL identified in messages and captions. Within this million URL sample the research found 31,489 Unique URL from 486 domains / subdomains.

Calculating the number of times URL representing content on specific domains had been observed, Telegram links appeared most frequently in posts.  It is a common observation that the domain on which data is being collected is also the most frequently linked to domain in the dataset, as users often include the link for a channel or chat in their posts.  

Domains as proportion of total observations

Looking at the number of unique URL gives an alternative perspective. It shows that while Telegram links appear frequently, they are a relatively small number of URL appearing frequently. In contrast, there are relatively higher numbers of URL from other domains, each of which appear relatively infrequently. This is logical, as many URL outside Telegram host a specific piece of content, and hence it is shared when it is released and subsequently falls out of use.

Number of different URL per domain

Examining the URL from outside Telegram provides an overview of the other locations within the Jihadi information ecosystem. This shows the number of times domains were observed in posts.    

Similarly, analysing the domains by the number of different URL shared from that domain, shows how the information ecosystem combines branded content from jihadi groups, located on content stores and aggregators, with a wide range of other material including mainstream news sites.

From this we find:

  • Despite the claims Jihadi groups have not been driven off the surface web, sites such as archive.org, telegra.ph, and justpaste.it are frequently used as Jihadi content stores and aggregators.
  • None of the most observed domains offer a serious alternative to Telegram. In the period of adjustment, which occurred in the autumn of 2015 and Spring 2016, Jihadi twitter accounts regularly shared links to Telegram channels to allow sympathisers to maintain access to the Jihadi information ecosystem. In the period to May 2019, the behaviour previously seen in the transition between Twitter and Telegram is not currently being repeated.   

Flow across the Ecosystem.

In examining the flow of users across the ecosystem in 2019 we find there are two distinct clusters, one focused on tech and the other on Jihadi content and related news. This uses the same method as was discussed during the GRNTT conference at Brookings.  

The tech cluster on the lower portion of the graph fulfils an important role for the movement, as it provides access to services such as VPN, disposable / free phone numbers and a range of communication programmes distributed as .apk files (Andriod Package File).

Overview of network graph showing traffic across Jihadi Information Ecosystem

The content cluster features platforms from the three main roles in the Jihadist information ecosystem:

  • The signposts including Telegram and Facebook,
  • Content stores such as Archive.org, Google Drive, imgur, and Files.fm
  • Aggregators such as Justpaste.it and Telegra.ph
Annotated network image

Other findings of note;

  • Obedient Supporters and Nashir 1440 are content aggregators which provide content downloads on the surface web.
  • Tgho.st – is a file sharing system native to Telegram. Tgho.st operates by users sending the file to a Telegram Bot, the bot subsequently returns a URL where that file can be downloaded by anyone using the download link in a browser. The service advertises that “These files are not deleted and will always be available for download”.
  • Videopress – URL to Videopress were frequently extracted from videos posted on the earlier version of Jihadology, although without the full Jihadology page / URL. Such a finding illustrates the importance of focusing on the Jihadi primary language, Arabic, rather than drawing conclusions from fringe languages, particularly English. However, this is likely to fall out of use following the recent update to the site.  

Conclusion

  • The primarily Arabic Jihadi Telegram Network is very large, spanning 9,000 channels / groups and has produced over 1.7 million updates.
  • al-Dawlat al-Islamiyya, AQ, Taliban and pro-Jihadi supporters all connect into a single network which also draws on theological content at the Salafi-Jihadi Nexus.
  • This network has shared over 31,489 Unique URL from 486 domains / subdomains between January and May 2019. Active content sharing is still occurring on the surface web, despite punditry to the contrary.
  • By contrast there are very few links to the dark web, highlighting how important remaining on the surface web is for the Jihadi movement. 
  • None of the most observed domains offer a serious alternative to Telegram. In the period to May 2019, the behaviour previously seen in the transition between Twitter and Telegram is not currently being repeated.   
  • A model of the information flow between platforms which are used within the jihadi information ecosystem highlights a dispersed network comprised of beacons, content stores and aggregators. 
  • Tech resources, such as apps, disposable phone numbers and email, and VPN are an important part of both the Telegram network and the entire information ecosystem. 

Documents in Caliphate Library

Many Telegram channels and groups operated by Jihadi groups, distribute lengthy Arabic documents.

An analysis of the content shared by one such channel, ‘The Caliphate Library’ Telegram Channel shows how the Jihadi movement thrives on lengthy documents that sets out their theology, beliefs, and strategy.*

Overview of findings:

  • This individual library contained 908 pdf documents, which collectively contain over 111,000 pages. This is far from what one might expect from a movement which thinks in 140 characters, as some Western commentators suggest.
  • In addition to the material produced by Dawlat al-Islamiyya, the channel;
    • republished earlier writing through Maktabat al-Himma, a theological driven publication house of Dawlat al-Islamiyya.
    • shared earlier work produced by al-Qaeda
    • distributed historical and contemporary Salafi writing which intersects with their theology.
  • ISI era is an important part the identity for Dawlat al-Islamiyya – over 15% of the pages in ‘IS media products’ category originate from that period.
  • While 10% of PDF were encrypted, most documents were produced using tools easily available on most modern laptops.
  • Not one of the texts envisages a ‘Jihadist Utopia’ nor proposes a ‘Utopian narrative’. The idea of a ‘Utopian Narrative’ is an artefact of Western misinterpretation. It is not rooted in the texts of of Dawlat al-Islamiyya nor their predecessors.

The following infographic summerises the analysis of over 1000 documents in this Caliphate Library.

*The Caliphate Library is a loose translation of its actual name, as at time of writing the Channel is still live.

How Jihadist Groups exploit Western researchers to promote their theology

And why this exploitation allows Jihadists to maintain a persistent information ecosystem.

This is the second in a series of posts that uses data science to sort the anecdotal observation from evidence-based research. After the hype, what about the data? Part 2.

The recent reports of UK government pressure on Automattic and WordPress to remove content posted on Jihadology, has resulted in plenty of opinionated tweets and longer form commentary.

As the UK government has claimed that Jihadology could be used as a convenient platform by extremists, the first past of the post looks at;

  • Whether this is a theoretical possibility, or if there is evidence that Jihadology is used by jihadist groups, and if so, how and for what purpose do they use it?  

The second part of the post examines whether this is an isolated case;

  • is there evidence that individual pieces of Jihadist material which pundits and researchers post on social media and the surface web are subsequently exploited by Jihadist groups.  
  • Is there evidence that when the aggregated impact of individual tweets and surface web posts are analysed as a collective behaviour, rather than as isolated events, that this creates a resource which is exploited by Jihadist groups – resulting in pundits unwittingly becoming part of the Jihadist information ecosystem?

The evidence shows that Jihadology:

  • is used by jihadist groups as a convenient platform through which to share access to videos, and text documents.
  • is a source of media to feed JihadistContent Aggregators, allowing material to be shared within a Jihadist context while not being subject to removal.    
  • is recommended to fellow Jihadist sympathisers as a good place to find content, emphasizing the content on Jihadology does not get banned or removed.  

The data further shows:

  • More broadly, there is a network of researchers and commentators who are publishing Jihadist material on the surface web. The aggregated result of these individual actions is the unwitting creation of an online resource which has been exploited by Jihadist groups and has become part of the Jihadist information ecosystem.  

It is perhaps the greatest irony that Government sessions to discuss how to make it harder for Daesh to spread their message online, are often attended by researchers who frequently publish that same content on the surface web and social media.

Introduction

Jihadology describes itself as a ‘clearinghouse’ for jihadi primary source material, original analysis and translation services. As a result, it allows researchers who lack the expertise or experience to find content themselves to publish research.

For those with genuine access, Dawlah al-Islāmiyah, recently released an archive of over 5,200 Media Foundation and Wilayat produced video files (which included multiple language versions of some videos).

They have also followed the tradition of jihadist media groups of releasing numerous astuwanat [barrels / أسطوانات] of content. Each “barrel” contains a collection of material organised by theme, organisation, or specific media production. While previously astuwanat were made available via CD, DVD or ISO file, they are now more often released via torrent or direct download in Telegram – although the banner images promoting them often still contain an image of a disk. 

In combination with the ‘Archive’ channels on Telegram, policy professionals and researchers with requisite knowledge, language skills and experience, should be able to access Jihadist material without using Jihadology as a crutch with which they can limp through what should be basic research tasks for those doing more than an undergraduate research essay.   

Afterall, given their inability to master the simple task of finding content, it is perhaps unreasonable to expect those leaning on the Jihadology crutch to provide an authentic interpretation of what they find on the site.  Furthermore, basing analysis on what is found on the site, leaves the researcher studying what is posted on Jihadology (which is not exhaustive), rather than the range of material extremist groups actually produce.    

European Context

The current discussion of Jihadology and pressure on WordPress, occurs within the context of the UK government position that:


“It is reckless to publish terrorist propaganda online without safeguards to stop those vulnerable to radicalisation from seeing it”.

It should perhaps be needless to state that those who are vulnerable to the message of Jihadist groups must as some point become consumers of jihadist material or messages, if they are to be anything other than theoretically vulnerable.

For Jihadist groups da’wa is given via printed material, images, audio, video, speeches, conversations or communicated through specific behaviours. Through this range of delivery methods, individuals are provided with role models and theological guidance for actions, and in which they can use online platforms to gain unfiltered access to the universe of content that is of great importance to jihadist groups.

It is in this context that a report from the UK Parliament’s Intelligence and Security Committee (ISC) criticised social media companies for not acting fast enough to remove content. Furthermore, the FT reported that UK security officials argue Jihadology:

could be used as a convenient platform for extremists to access videos and messages from outlawed terror groups such as ISIS and al-Qaeda”. (emphasis added).

However, various European countries take different views on what to do about sharing content from groups they deem illegal or extreme. At the time of writing, in France Jihadology is unavailable.

Germany threatens fines for companies not reacting quickly enough to content posted, and the UK imposes prison time for those sharing this content. For example:

  • December 2018 – Abdulrahman Alcharbati (diagnosed as bipolar according to the BBC report) was jailed for seven years, for offences including posting ISIS videos on Facebook.
  • December 2016 – Abdul Hamid, who Judge Peter Rook QC accepted had ‘significant physical and mental health problems’ was sentenced to two years in prison for posting the video ‘No Respite’.

At this point, in the UK while two men with mental health problems have been sentenced to years in prison for posting ISIS videos, another man is lauded by academics for making the same videos freely available.

This raises important and complex issues as global communication networks exist alongside international borders, and the extent to which Jihadist groups and sympathisers use Jihadology as a platform to access content, and furthermore, the role Jihadology plays within the jihadist information ecosystem.

Reusing individual links

In the New Netwar, we observed that Jihadist groups and their supporters locate individual URL of videos posted on Jihadology and reuse those links within the context of their own channels and groups.

Jihadist Telegram channels re-purposing individual URL from Jihadology

A similar theme was picked up in recently in the Twitter discussion, following the story in the Financial Times, noting it is not just the videopress links (which have previously appeared on Jihadology) but references to the site itself. As @Charlie_KDN noted in a tweet;

Each week 100’s of @Jihadology_Net links are published on ISIS TG chans and groups to rebroadcast suspended content on other platforms.

@Charlie_KDN

For example, links to videos including ‘Honor is in Jihad’ and issues of al-Naba that have been posted on Jihadology are shared on pro-ISIS Telegram channels (as are links to a site run by Pieter van Ostaeyen).


Jihadist Telegram channels re-purposing individual URL from Jihadology

Once the videos are neatly archived by Jihadology – the links are then shared as collections. For example, on a single day in October 70 unique Videopress URL were observed being shared a total of 1,125 times via core Telegram channels.


Jihadist Telegram channels re-purposing individual URL from Jihadology

A potential additional advantage to sharing the Videopress links is that it opens a video player in a web browser, providing a seamless experience for the viewer and ensuring the content is shared in a pro-Jihadist context rather than with a research focus.  

Feeding Content Aggregators

In addition to using individual links to content, Jihadist supporters use Jihadology to feed material to their content aggregators. For example, a PasteThis.at link shared in a pro-ISIS Telegram channel, provided a single page from which users could access over 100 issues of al-Naba.


PasteThis.at page re-purposing individual URL for al-Naba up to issue #147 posted on Jihadology

The actual files from which this PasteThis.at page link to were stored on azelin.files.wordpress.com. Using this method Jihadist groups and supporters can provide access to content from within the context of their own discussions, Telegram groups, and theological worldview.

In addition, when Jihadist supporters build individual websites to aggregate content, they have been observed using Jihadology as a source of content. In this example the aggregator was built using Cloud9 which operates as part of Amazon AWS.

The al-Ajnad and al-Furqan options both direct uses to the pages on Jihadology for those entities. Those links have been clicked over 350 and 240 times respectively.

Content aggregator directs users to Jihadology

This cloud9 based aggregator also contained a section in which users could select videos by clicking on the banner advertising their chosen video. Many of the links made available in this section were to videopress files, the link for which had previously been shared on Jihadology. 

Clickable banners using videopress URL many originally posted on Jihadology

As in the previous example, Jihadology is used to provide a stable source for much of the content. However, the way the site is built a user may be unaware of the actual file location – allowing the aggregator to promote a Jihadist worldview

Why Jihadists use Jihadology:

In addition, to re-using individual links or feeding content aggregators, pro-jihadist or pro-IS Telegram users have been observed posting recommending Jihadology as a source of material. Much of these comments follow a similar theme.

In this example, the Arabic reads.

“and I prefer links to the site jihadology which is specialized in studying jihadists as it states, therefore it neither gets deleted nor any content it hosts gets banned

Within core IS channels links to the main IS category on jihadology are shared, leading to videos, video series, or the weekly editions of the al-Naba’ magazine:

كامل اعداد صحيفه النبأ من واحد إلى 110 ماعليك الا بالنقر على الرقم وتتحمل. برابط غير قابل للحذف لن يفتح الرابط الا بعد تشغيل ألفي بي ان vpn

#نشر

The text reads:

“All editions of the al-Naba’ magazine, from edition 1 to 110, just change the number in the link and download it. This link will not be deleted and do not open this link without employing a VPN.”

Another message advised:

هنا في هذه الروابط صفحات #لكامل_إصدارات_الدوله_الاسلاميه_من_ولاية_حلب_بروابط_غير_قابله_للحذف

“this site gives you all the links of the releases from wilaya Halab of the Islamic State, the link does not get deleted.”

Conveniently, for the author of this message in a core IS channel, viewers can quickly get the current videos by IS from the province of Aleppo.

It is important to the author of the Telegram message, that while content may be removed elsewhere it is kept in a safe and orderly manner on sites like Jihadology. This allows IS to project their content in an orderly manner, allowing placement of – in this case – geographic located collections to the benefit of ISIS.

This evidence demonstrates it is not that users theoretically “could’ use Jihadology as a convenient platform for extremists to access videos and messages from outlawed terror groups such as ISIS and al-Qaeda” … Jihadists supporters and sympathisers do use it to access individual URL, feed their content aggregators, and recommend it to their peers because the content is not removed. Unfortunately, the recommendation that users adopt VPN to access Jihadology may blunt the efficacy of traffic analysis, a problem which may also be compounded by the many commentators and policy professionals who have recently claimed to be regular users.  

This means that while tech and social media companies are pressured, and threatened with fines, the content is still findable and IS supporters and sympathisers know it. As a result, ISIS (and other Jihadist groups) do not have to struggle to maintain a persistent presence for their content online, in addition to using Telegram, they can release the content and then allow sites like Jihadology to archive it for them.

The defence of Jihadology:

In defence of Jihadology, there have been many commentators saying a version of:

“the site is a vital research portal that provides a valuable service for academics, policymakers and journalists researching Islamist extremism”.

There have been numerous researchers who have recently been tweeting that they regularly use Jihadology – effectively announcing they rely on Jihadology as a crutch for their inability to locate or access Jihadist content. Penetrating Jihadist networks (beyond the entry level Nashir type channels) relies on being able to recognise the theologically encoded references and follow the content. As such, one wonders if in future those publicly stating they use Jihadology regularly may reflect on why they consider themselves qualified to conduct the complex task of analysing content when they can’t complete the simple task of locating that content by themselves. The inability to find content, and thereby having to rely on what is posted on Jihadology, may perhaps explain why Arabic language jihadist materials are so rarely referenced or cited in research.

As locating content is a significant part of research production, and given the number of people currently claiming they use Jihadology to find content, it appears Aaron Zelin deservers credit on many more research papers than he is currently recognised as making a significant contribution.

One wonders why commentators on Twitter talk of the valuable contribute made by Aaron and Jihadology, only to reduce that contribution to a reference to jihadology.net in a URL buried in a footnote when that same author publishes their research?

Others steer away from the ‘value’ of the contribution, and instead take the view that the “Content by itself does jack shit”. This follows the rationale that;

“How the message is received and incorporated into a broader worldview and acted upon is one aspect of what we, perhaps too vaguely, call the “process of radicalization”.

This particular researcher visits Jihadology several times a week – one assumes to view content disconnected from “the process of radicalisation” and thereby to study it doing “jack shit” if he follows his own logic, but who knows.

The description of what is broadly an ideational model of behaviour change highlights wider factors in the process. Nobody lives in a vacuum, but ideational models still require an idea to fulfil a fundamental role in this type of behaviour change process.  As demonstrated above, links are not shared in a vacuum. Jihadist supporters have become adept at accessing the content posted on Jihadology and sharing it via Telegram channels and through Content Aggregators which project and reinforce their theologically driven worldview. It is in this context that potentially vulnerable people may access Jihadist media production. It is naïve to imagine the content posted on Jihadology can only be accessed by visiting Jihadology.net and searching the site for content.   

While Jihadology was never intended to be a platform for jihadist groups, the data shows Jihadology has become a repository for video and written material exploited regularly by ISIS / Jihadist supporters and sympathisers. The links to specific videos or collections of material are shared within the context of aggregators or Jihadist Telegram channels, where the meaning of the content is discussed and Jihadology is recommended as a source that can be relied upon as it is not be deleted.  

Just Jihadology?

The data show users in Arabic language Telegram channels recommend Jihadology to their peers as a location for them to view or download content. However, is Jihadology an isolated case or is it unfair for European governments to pick on Jihadology and Aaron Zelin specifically? Is this an example of a wider research sub-culture which actively publishes Jihadist content across social media and the surface web?   

Wider Research Sub-culture

Rumiyah

To test whether there is evidence that Jihadology is an isolated case, we turn to the releases of the multilingual magazine Rumiyah using the #Rumiyah hashtag. If Jihadology is an isolated case, we would expect the initial release of each edition of the magazine, to be met with a surge of tweets about it on Twitter from ISIS accounts and supporters. The example below shows that the surge of tweets occurred.

Spikes in traffic around releases

Closer analysis of the data reveals that there are relatively few original tweets, but many retweets. This tends to indicate that there is less emphasis on conversation / interpretation and instead a greater focus on spreading information.

If these spikes were driven by ISIS supporters tweeting until their accounts are suspended one would expect to see many accounts being active for one release and a separate network active for the next release. One would not expect there to be a network infrastructure to span numerous releases. The way this would happen is if accounts were able share news of the release, without being suspended.  

To examine nature of the network of retweets (which make up a large proportion of the overall tweets), we used Social Network Analysis (SNA) of the retweets. SNA shows the structure of the network through which news of the magazine release flows. In the case of Rumiyah releases, SNA shows that there was a network of accounts which spans numerous releases.

While Twitter suspends many pro-ISIS accounts, this prominent cluster is able to maintain a persistent presence. A closer examination of this persistent cluster shows it is populated by Academics, Commentators, Reporters and organisations selling monitoring services.

Network of accounts tweeting / retweeted about Rumiyah

However, are these accounts coincidentally engaged in discussion of the meaning of ‘Rome’ and ‘Romans’ within Jihadist theology, lacking deeper Arabic connectivity, or is this announcing the release of the magazine and / or sharing content from it?

  • Note: the coincidental appearance is not as ludicrous as it first sounds. One of the ‘Lend me your ears’ series of videos featuring John Cantlie was released on the same day as an entirely disconnected toga party. Both just happened to use the hashtag #lendmeyourears at the same time. And both ISIS and toga partiers were surprised by the juxtaposition of content.      

In reality a review of the tweets shows that this is not coincidental. The network of academics is publishing announcements about the release of the magazine, including the banners ISIS created to promote the release, and sections of the magazine, such as text and graphics.

Tweets featuring Rumiyah announcement or content

The sharing of content likely provides greater reach for the content than ISIS could have achieved alone. Reaching as many people as possible was after all one of the main purposes of producing and releasing the magazine, and media material more broadly.

The release of Rumiyah issues was not the only times academics and commentators have probably provided greater reach and longevity for Jihadist content than ISIS could have achieved alone. Looking back over data from recent years, across a range of video announcements, audio releases, and claims of attacks a pattern emerges.

Speeches:

al-Zawahiri – April 2017

In April 2017, al-Qaeda leader al-Zawahiri released a new speech. After an initial tweet by Elizabeth Kendall, covering the key points from the speech @marypgkeating responded posting a link to the speech on YouTube with ‘English subtitles’, while others join in retweeting.

Tweets sharing al-Zawahiri speech details

al-Baghdadi

In November 2016, al-Furqan released a speech by al-Baghdadi. The release was greeted by: “Wow – it’s Baghdadi” from Mr Winter, followed by the name of the audio so others could find it and comments on the contents of the speech.

Could this type of tweeting be used to find content? To test this and mimic a ‘naïve searcher’ trying to find content, a search on Google.co.uk in May 2017 (six months later) used the title of the speech as tweeted.

In the results,

  • an English translation posted by al-Naba on archive.org,
  • a swath of other related ISIS documents including an English translation of a speech by the Abu Muhammad al-Adnani; Official spokesman for the Islamic State and
  • an ISIS video from the province of Ṭarabulus which had a similar name. That link lead to the video posted on Jihadology.net.  

The test shows that this information could lead uninitiated users to access ISIS content. In addition, the data highlights that individual unwitting actions rapidly combine to provide easy access to a range of genuine ISIS content. 

Battle footage and executions

Mosul

In addition to speeches, there were numerous ISIS videos of the fighting in Mosul. For example, the image from this video release from Ninewe province, would have allowed those able to read Arabic or Latin characters to search for the title of the video.

Tweet announcing video release

The ‘naïve searcher’ test was conducted in May 2017, using google.co.uk with the English title. This returned both the first and second parts of this series. At the time, ten of the top fifteen results provided a link to the video.

The same test in December 2018 still returned the video via Jihadology.net. This despite the same researcher (who now receives funding from Facebook) giving a bullish claim about the difficulty of finding IS content on social media and surface web.

He recently claimed;

“It isn’t just a case of googling “IS propaganda” and seeing what comes up (any more). This stuff isn’t readily available on the surface web like it used to be. If you’re not on Telegram or in a forum, the options are increasingly limited.”

Beyond the parochialism and evident Western habitus which leads a researcher to imagine the go-to search terms used by Jihadist supporters would include the word ‘Propaganda’, he is also apparently oblivious to the evidence that is available to anyone who bothered to do even the simplest research.

Just putting the content of one of his own tweets into a search engine delivers … IS propaganda. His assurances sound bold, but like many others that circulate within the field, it could not be considered “research-based in any rigorous sense” to use Alex Schmid’s phrase. That is “a very polite, typically academic way of putting it”, Nafeez Ahmed would likely suggest another.

Just like the previous insistence on media ‘decline’, fully fledged collapse, content production correlated to territory, and the ‘naïve notion’ of Utopia, claims about the findability of content have joined the list of claims which have turned out to be, as Rüdiger Lohlker recently highlighted, “an empty fog of words without inner content”. Quoting German philosopher G. W. F. Hegel, the section quoted by Rüdiger Lohlker continues:

This sort of chatter, though lacking the idea of philosophy, gains for itself a kind of authority through its very prolixity and arrogance. Partly this is because it seems almost incredible that such a big shell should be without a kernel…

G. W. F. Hegel

While those at institutions with links to Facebook insist content is hard to find, the actions of ‘experts’ who publish Jihadist content enable even uninitiated individuals to locate the content about the fighting in Iraq and Syria (and elsewhere). In this particular case, the publishing of announcements, pictures, statements and other ISIS material was not an isolated to a couple of examples. The Twitter timeline documented here shows the extent to which publishing of ISIS content made widely available. 

Attacks

Responsibility and da’wa

One of the ways in which terrorist groups, of almost all types, have sought to extend their influence, is through claiming responsibility for attacks. Announcing attacks and recognising those responsible for them is important for ISIS and the Jihadist movement. As Abu Mus’ab al-Suri wrote in his Call for a Global Islamic Resistance;

The issue of individual jihad was a great da’wah success. It had great influence on awakening the spirit of jihad and resistance within the ummah, and it transformed unknown individuals such as al Diqamsa, Salman Khatir, Sayyid Nusayr and Ramzi Yusuf into becoming symbols of a nation. The crowds cheer their names, people’s thirst for revenge is satisfied, and a generation of youth dedicated to the Resistance follow their example

Similarly, Anwar al-Awlaki explained (while discussing the seventh meaning of victory);

Prevail here means the prevailing of their da’wah and not always their battles. They could loose (sic) the battle but their da’wah will achieve victory and be available. Nobody can stop their da’wah. The idea is that it will keep this group strong from generation to generation.

Seventh Meaning of Victory, Yusuf al ‘Uyayree Thawaabit ‘ala darb al Jihad (Constants on the Path of Jihad) Lecture series delivered by Imam Anwar al Awlaki (Quoted as transcribed)

For jihadist groups, statements claiming an attack or detailing a battle are not simple information updates, they are part of da’wa; spreading their theology by retelling the actions of the believers. Afterall, as Abdullah Azzam argued, “Jihad is da’wah with a force”.  

Following the 2017 attack on the Manchester Arena ISIS issued statements in Arabic and English. A review of data from the time shows a range of researchers, including those based in the UK, either tweeted or retweeted the actual announcement, with collectively 100 retweets of just the four versions identified below.

Tweets sharing announcements of the attack in Manchester

A snapshot from Twitter on the day following the attack at the Manchester Arena, finds the OSCE held the World Counter Terrorism Conference in Vienna. The conference included discussion of how to make it harder for terrorist groups to spread their message, while some of those at the event were also publishing ISIS content on social media.

One of the attendees tweeted;

  • about the OSCE event,
  • the OSCE response to the attack in Manchester,
  • republished the ISIS claim of the attack,
  • before returning to the content of the OSCE event. 

The tweeting of announcements was not a single ephemeral event, claims of responsibility were also shared for the attack on the Champs Elysees.

This has also continued in 2019, the current Director of ICSR published ISIS claims of responsibility for the bombing which killed US personnel in Manbij, Syria  

Claims by Islamic State published on Twitter

The tweeting of this material from Rumiyah to speeches, videos and announcements, has the potential to increase the reach of Jihadist messages. In addition, as shown with the reuse of links to content on Jihadology, Jihadist supporters can also reuse that URL for their own purposes. In the example below from January 2019, an account with a username referencing ISIS responds to a story of Troop withdrawal by posting a link to a section of an ISIS video.

ISIS video with 35k views

Among the numerous notable elements:

  • this specific clip from an ISIS video has 35,600 views on Twitter, despite claims by researchers this material is difficult to find (for them).
  • the original video clip was not posted by an ISIS, or Jihadist, account. It was an OSINT focused account, which a supporter subsequently used. This is one of the ways in which Jihadist groups exploit content sharing by commentators and pundits.

What this indicates is an increasingly sophisticated approach in which a user can create a seemingly pro-ISIS account, find a version of an ISIS video posted by an OSINT commentator and subsequently exploit the reticence of Twitter to remove such content from non-jihadist accounts by reposting the URL to the tweet containing the video.       

An approach fit for a 21st Century Sisyphus, Yes Minister or Monty Python

Tech companies are understandably reticent to remove content published by researchers. Yet while European governments pressure social media companies to remove content, and try to create upload filters and image hash databases etc. European governments are also giving things of value (salaries, grants, travel, and hotels) to researchers who publish this same material on social media.

As a result, while CTIRU, EUROPOL, Twitter and social media companies more broadly were making efforts to reduce circulation of ISIS content on social media – academics and for-profit organisations publish and republish jihadist content on the same social media platforms, and to an audience beyond that which ISIS could achieve alone.

It is perhaps the greatest irony that Government sessions to discuss how to make it harder for Daesh to spread their message online, are attended by researchers who frequently publish that same content on the surface web and social media. 

It is an approach fit for Yes Minister, Monty Python or a 21st Century Sisyphus.     

Why this matters to Jihadist groups:

First the evidence above shows that jihadist groups recognise the opportunity to give da’wa by aggregating links to content posted by pundits and researchers. Second, when Western organisations and pundits immediately repost jihadist content, this is then re-posted in pro-ISIS Telegram channels and used to galvanize the mujahid vanguard.

Third, part of their theological understanding of da’wa is to spread their message as widely as possible. This goal of broad dissemination is considered successful if others hear the message of their theology.  This has been covered in numerous documents written by a range of leaders of the jihadist movement. These documents have emphasized that spreading their theology as widely as possible is an important component of jihadist activity.

For example, Yusuf al-‘Uyairi recorded in his Constants on The Path of Jihad,

  • Jihad will continue until the Day of Judgment (or as referenced in numerous ISIS videos, ‘Until the final hour’), which also connects it to Sahih Muslim / Book 41 / Hadith 6924
  • Jihad is not dependent on a particular land, but Jihad must be part of your life,  
  • Seventh meaning of victory: victory of your idea (Anwar al-Awlaki’s translation is quoted above)

Viewed collectively, in the context they are used by Yusuf al-‘Uyairi, these points recognised that there will always be people to reach, both those to fight and those to give da’wa. Therefore, spreading the message is a constant for the Jihadist movement. 

The importance of this task was also covered by ibn Nuhaas, who highlighted the The Virtues of Encouraging Jihad. He quotes Surah al Nisa 84,

“So fight, [O Muhammad], in the cause of Allah; you are not held responsible except for yourself. And encourage the believers [to join you] that perhaps Allah will restrain the might of those who disbelieve. And Allah is greater in might and stronger in punishment.”

Surah al Nisa 84

The phrase “you are not held responsible except for yourself” is interpreted by Jihadists within the context of da’wa to mean that they will be individually judged on whether the individual sought to spread the word, not on whether those who heard that message subsequently responded. Therefore, their interpretation of the duty is to find ways to spread their theology. The purpose of the da’wa effort was also noted by Ayman al-Zawahiri. In his General Guidelines for Jihad, (as-Sahab media) there were two elements to the communication or media work.

First: Educating and cultivating the Mujahid vanguard, which shoulders, and will continue to shoulder, with the permission of Allah, the responsibility of confronting the Crusaders and their proxies, until the Caliphate is established.

Second: Creating awareness within the masses, inciting them, and exerting efforts to mobilize them so that they revolt against their rulers and join the side of Islam and those working for its cause

In more specific guidance he wrote:

Focus on spreading awareness amongst the general public so as to mobilize it. Similarly, focus on spreading a greater level of awareness and understanding amongst the Mujahid vanguard to create an organized, united, ideological, and aware Jihadi force that strongly believes in the Islamic faith, adheres to its rulings, shows humbleness to the believers and deals with the disbelievers with firmness. At the same time, full effort should be put in immediately to ensure that people with scholarly and propagational abilities come forth from within the ranks of the Mujahideen so that our message & belief set may be preserved and the call to Jihad may be spread amongst Muslims.

Researchers publishing the announcements are, in the eyes of jihadist groups who produced the original statements, spreading the da’wa which these acts were intended to give. 

In the jihadists mindset, these researchers are tools for their divine mission. The reposting of links to Jihadology clearly indicates the Jihadist mindset on the issue – these are not two separate worlds but one interconnected ecosystem, however unwitting some of the participants are within it.

Why Pick on Aaron?

The data on content releases, from magazines to speeches, to videos and announcement of attacks, shows that Jihadology is not alone in publishing Jihadist content.

The data analysis shows a research sub-culture has developed in which posting jihadist content on social media is an acceptable norm; Aaron Zelin is just one part of a much wider network of researchers publishing ISIS and jihadist content on social media and surface web.

Given the extent to which publishing jihadist content on social media and the surface web has become a norm for pundits who make up this research sub-culture, it seems both unfair and entirely ineffective for European governments to target Jihadology and Aaron Zelin as if he and his website are an aberration distinct from the research sub-culture of which he is part.

To what extent can European governments threaten social media companies with fines (or individuals with prison time), when those same governments work with, give things of value to, or employ the researchers and commentators who post that same content on the same social media platforms?

Ethical approaches and leadership.

The kneejerk censorship vs. academic freedom arguments move nothing forward. It merely provides more time for Jihadist groups to distribute their material by exploiting the current way . 

Researchers who publish ISIS theologically driven content (and almost invariably without real analysis) often claim to offer these materials to a wider audience for the ‘greater good’. The evidence shows, they are complacently enabling the jihadist movement to remain a coherent online presence – a situation inevitably to the advantage of the movement.

Years ago, when I had the privilege of working on a project with researchers at CEOP, their professionalism, integrity and approach eclipsed that which currently passes as the norm in what might loosely be termed Terrorism Studies.

They had a robust approach to mental health. Upon finding new material or images of child exploitation they did not franticly tweet them. Upon hearing of an attack, they did not reach for their phone to alert journalists to their availability for interview. Finding indecent images of children on a new platform, they did not begin pitching the story of the ‘next big thing’ to whoever would take it. When serious events caused the issue to make the headlines, they did not use it as a reason rush to the TV studios and tweet about being on TV.

These researchers did not spend any time on how many Twitter followers they had, and they certainly didn’t tweet about how many followers they had. From my limited experience of working with researchers from CEOP, they avoided behaviours that could make the situation worse, that could make the content more widely available, or could exacerbate the suffering of victims. From the evidence above, the study of terrorism is generations behind their example.

After the hype, what about the data? Part 1: the Telegram ‘Cull’

After the hype about the removal of ISIS Telegram channels, this post examines the data on the information ecosystem to sort the anecdotal observation from evidence-based research.

Central to the authentic understanding of the Jihadist movement is the ability to locate and understand the content. Unfortunately there is tendency among some researchers to give prominence to and draw conclusions from the limited content they can locate. This is a problem we have highlighted previously including in the New Netwar and in earlier posts:

Content, especially Arabic language content, is fundamental to the movement, yet the lingual & theological expertise to understand it is almost constantly neglected and lacking in research. This blind spot allows the jihadist movement to reorganize and recuperate out of view of contemporary research and commentary.

Notes on the ecosystem

The difference between the content commentators hype and tweet about because they can find it, and the content that is important to the Jihadist movement, is one of the fundamental and often poorly understood distinctions in contemporary academic study of the Jihadist movement. 

Two recent events, the recent purge of Nashir channels on Telegram and the UK government putting pressure on Jihadology, have, individually and collectively, highlighted how important it is for researchers to have a sufficiently nuanced understanding of the movement to be able to locate content themselves. Research should get beyond the easy to find Nashir network, which are there to give entry level access to the movement. 

The inability to penetrate beyond a few entry level daily news channels, leads to challenges compounded by the lack of serious data analysis on the extent to which material produced by ISIS, AQ and other Jihadist groups, is actually available online.

In just the last few weeks there have been conflicting accounts.In one a researcher with funding from Facebook claimed that “This stuff isn’t readily available on the surface web like it used to be. If you’re not on Telegram or in a forum, the options are increasingly limited.” While Peter Neumann defended Jihadology by saying  “the online nature of this makes it ubiquitous”. 

Something being ubiquitous tends to be mutually exclusive with not being readily available. What these comments and other commentary has laid bare is how often commentary is based on opinion and anecdotal observation, at best, rather than evidence-based research.

In the following pair of two posts we look at the data behind these two events.

  • This first post examines theextent to which the removal of fringe Nashir channels on Telegram impacted the information ecosystem.
  • The second uses data analysis to test the recent UK government suggestion that Jihadology could be used as a convenient platform for extremists to access videos and messages from outlawed terror groups such as ISIS and al-Qaeda, to answer the question whether Jihadology is used to access content by groups such as ISIS and examine whether some researchers and commentators play an unwitting role in the jihadist information ecosystem.

Part 1: The Telegram Cull.

BBC Monitoring reported that what they term the ‘Telegram cull’ followed attempts by ISIS to “beef up its presence on the platform”. Focusing on Nashir, BBC Monitoring continued …

jihadist group operates a network of multiple channels and groups on Telegram under the “Nashir News Agency” brand.


https://monitoring.bbc.co.uk/product/c200h0s4

The focus on Nashir channels was repeated by others, Pieter VanOstaeyen noted; “Remarkably large take down of ISIS Telegram channels and groups tonight”and in a later Tweet “Of around 60 Nāshir News accounts I was following 4 remained active”.

Shiraz Maher, had similar problems, “It was a rough morning for me. Major take downs of the channels/groups I was in”.  These and similar observations fueled the impression that the jihadist network was under significant pressure. “Not only ISIS accounts, everything that even remotely reeks of Jihad is getting hit” tweeted Pieter Van Ostaeyen.  He later joked “There was a major disruption in the Dark Side of The Force, but they’re back again”

Jihadist Ecosystem – 10 December 2018  

To ascertain the actual impact, a review of 410 human verified Jihadist groups and channels on Telegram, using the same methodology as the previous post, was conducted. It showed that the information ecosystem has remained resilient. The data from the 410 channels and groups shows that many survived the purported cull.

Followers

The followers / members of the groups remain at an average of over two thousand with the largest garnering over 70,000 followers. There are over 200 channels with more than 400 followers. However, it is currently unclear if these are different individuals in the groups – as discussed in an earlier post


Mean 2,870: Median 452: Maximum 71,807

Longevity

The time elapsed since the creation of the channel / group also provides clear evidence that the information ecosystem has remained uninterrupted. The average length of time a channel has been operating is greater than one year (Mean 380.1 and median 380.6 days). 

The average length of time a channel has been operating is greater than one year

The longevity of channels shows that recent chatter about losing access to channels has had an impact only on those with limited access to Jihadist channels, and who struggle to locate the content. For the wide range of jihadist sympathisers who can read and understand the meaning of the content, access has continued largely unabated.

Views

Access to content shown by views on individual posts shows that users are accessing the content. Even an overly cautious estimate where all duplicate view counts are removed to avoid double counting, produces a conservative 135,256,000 total views. 

The Network

Decoding the Swarm logic of the Media Mujahidin is in part based on understanding the network structure.

Analysing the last 500 posts from each of the channels / groups and extracting the data of posts forwarded from other channels / groups /users, produces the network graph.

The graph has 3410 nodes in total, 2831 (83%) of which are part of an interconnected giant component. 

The network perspective confirms what the longevity and availability of accounts had suggested, that the information ecosystem has remained intact.

This is a repeat of much of the analysis on Twitter where an inability to find content was misconstrued as evidence the content did not exist.

Unfortunately, as we demonstrated in the New Netwar, at the same time that researchers were reporting they could find very little content on Twitter, the platform was used to drive a large portion of traffic to Jihadist content. Similarly, today commentary based on the narrow soda straw of Nashir and similar channels is to miss a wide range of the content, communication and meaning which occurs on Telegram.

Information Ecosystem on Telegram

Despite the chatter about a ‘wave’ of channels and groups becoming inaccessible and commentators losing access to large numbers of Nashir channels the network is still there and remains accessible to those who know how to access it. From the user perspective, the removals would barely rank as an inconvenience.  

The findings of this post repeats the findings of the previous analysis of Telegram Channels. Those findings were:

  • The graph shows that Jihadist Telegram Channels form a series of interconnected clusters.
  • Despite attracting the greatest attention from Western commentators, the Nashir News cluster is a tiny part of the overall ecosystem.
  • AQ and ISIS clusters are distantly connected.
  • There is a cluster of Jihadist sympathizers and supporters which align closely with neither ISIS nor AQ.
  • The creation of content archives on Telegram ensures users who see themselves as murabiteen (horse backed warriors guarding Muslim territory) are able to access the content needed to conduct ghazawat (raids) onto other platforms.

Major IS cluster

A closer look at the major IS cluster shows 27 statistical interconnected clusters. Each of these clusters has a particular thematic focal point, including a range of specifc theological elements. Within this major cluster there is a further ‘core’ group of channels, as well as channels relating to a range of Wilayat.

Even within just this major IS cluster there is significant range of material which provides a deeper view of the movement than may be realised if one begins from a perspective that nashir are a core part of the ecosystem. The idea of ‘core nashir’ is an oxymoron. Losing access to nashir would barely register if one genuinely has access to the breadth of content at the core which, needless to say, is mainly in Arabic.  

Soda Straws

Adopting a soda straw mentality, where a small part of the information ecosystem – in this case the Nashir network – is talked up and given an overblown sense of prominence in the jihadist information ecosystem, inhibits the authentic understanding of ISIS and Jihadist activity online.

The soda straw mentality comes in numerous forms the study of jihadist groups and terrorism more broadly. Some are based on the very limited access to content. The recent commotion and Twitter chatter about a wave of Nashir deletions highlights many of those caught up with this particular issue as genuine access would deter anyone from thinking the nashir represent anything other than a small fraction of the activity.

Other soda straws appear from the way individuals handle data or cherry pick time periods which create impression of decline, strong correlations to territory and ‘full-fledged collapse’. Nafeez Ahmed’s The Astonishingly Crap Science of ‘Counter-Extremism’ should be required reading.   

Conclusion

This post replicates the earlier finding that the Nashir network is part of the ISIS Telegram network, and a very small part of the overall information ecosystem. As a result, much of the contemporary commentary suggesting Telegram (and largely Nashir channels) is the place to get content, is based on anecdotal observations derived from gazing down a narrow soda straw at an often fringe group of accounts. There is a largely unobserved network of accounts which meant those with genuine access barely noticed the removal of Nashir channels.

If commentary is based on a level of access to Jihadist content where removal of the Nashir channels is noteworthy, for example for the authors of this report,one has to view claims that the research authentically reflects the breadth of ISIS activity with a degree of skepticism.

Central to the authentic understanding of the Jihadist movement is the ability to locate and understand the content. Otherwise the study of Jihadist groups becomes dislocated from the meaning and purpose of the movement and produces interpretations of the movement using misplaced notions of crime,rap, and the ‘naïve notion’ of Utopia. In contrast, Jihadist groups have produced tens of thousands of documents, outlining their understanding and intended application of theology. For example, Anwar al-Awlaki described;   

People like Shaykh Abdullah Azzam and Shaykh Yusuf al ‘Uyayree.They wrote amazing books, and after they died it was as if Allah made theirsoul enter their words to make it alive; it gives their words a new life.

Rasoolullah (sallallahu ‘alayhe wassallam) said the at-Taifah will prevail. Prevail here means the prevailing of their da’wah and not always their battles. They could loose the battle but their da’wah will achieve victory and be available. Nobody can stop their da’wah. The idea is that it will keep this group strong from generation to generation.


Seventh Meaning of Victory, Yusuf al ‘Uyayree Thawaabit ‘ala darb al Jihad (Constants on the Path of Jihad) Lecture series delivered by Imam Anwar al Awlaki (Quoted as transcribed)

Put simply, whether it is a battle or a channel on Telegram, for Jihadists part of the victory they seek stems from ensuring their actions give da’wah. It is the encoded theological aspects such as this, rather than speculation about crime and utopia, that allows users to move beyond the Nashir based fringes. Being able to identify theological elements which allow individuals to access a greater breadth of Arabic content should be a basic requirement for anything above a degree level researcher.


ISIS: Sunset on the ‘decline narrative’

In 2017 the ‘decline narrative’ had become widely accepted by Western researchers focused on the Jihadist movement. In contrast, in November 2017 we predicted that ISIS media would continue to fluctuate in 2018. This was based on an archive of digital and digitized content. The digital Jihadist content which stretches across more than two decades, 300,000 pages of Arabic text, 6,000 videos, hundreds of hours of audio (including 600 hours of ISIS radio programs). The archive of digitized content stretches even further back, given the nature of content of the 1980s, for example, that was later digitalized and is part of what the Sunni extremist movement shares.

During 2017 much was being written about the ‘sharp decline’ of ISIS media and even demise of a physical Caliphate. Our prediction faced opposition from those who were pushing the ‘post-Caliphate’ decline ‘narrative’ and particularly those who seemed to be staking their reputation on the continued decline correlated to territorial loss.

In January 2018 Jade Parker and Charlie Winter announced “a full-fledged collapse” of ISIS media.[i] Only days later, it became clear January 2018 had also witnessed a 48% month-on-month increase in ISIS content production.[ii] In addition, rather than a full-fledged collapse, in March 2018 ISIS were still able to drive traffic to their content, with some videos getting over 12,000 views on Twitter.

image1

As we have said before, just because non-Arabic and faux-Arabic speaking researchers cannot find it, does not mean the content does not exist – nor does it mean the target population for the content cannot find it.

It is clear today that rather than moving from media decline to “full-fledged collapse”, ISIS media continued to fluctuate as we predicted. This more complex representation relies on differentiating decline and degradation from a period of reconfiguration – as we have been saying since 2014.

This post shows that the Jihadist movement is much more complex than those pushing the ‘decline narrative’ suggest. It shows why counting the number of videos has little bearing on the amount being communicated – which after all is the purpose of producing the videos.

Recognising the limits of the contemporary ‘metrification’ approaches, along with the cherry-picking of timepoints and the overemphasis of pictures on which the decline narrative relies, we focused on in-depth analysis of strategy, Arabic documents, audio and video to produce an authentic representation of the movement.

 

So, how did we know?

Based on a genuine collaboration between subject matter expertise and data analysis, we uncovered the answer as a combination of two factors;

  • The jihadist movement operates on a much longer timeline than appreciated by pundits looking to produce tweet-ready metrics.
  • While many western commentators were pushing the ‘decline’ narrative, based on the over-representation of pictures, video production which had been low over the summer had already begun to increase again during the autumn.

These elements and in-depth analysis of the movement allowed us to make the prediction before the event, in contrast to the many ad-hoc descriptive responses after the event.

 

How did we do it?

After building an archive of over 300,000 pages of Arabic text, and 6,000 videos, and hundreds of hours of audio produced since the 1990s, it was clear that long form matters to the core of the Jihadist movement. And this does not even touch on the wealth of magazines created in the 1980s by Sunni extremist groups.

In the thousands of pages of Arabic text, strategy was clearly articulated for those able to read Arabic and willing to invest the time to understand the references, context and encoded meaning. Getting past what Nico Prucha refers to as the “Initiation firewall”, means you need to have read and consumed the content in Arabic to understand the depth of theology which is used as coded communication. Yet, in most research not even transliterated Arabic keywords that matter for the Sunni extremist movement and are used as codes in English-language publications matter and are properly analysed.

Content, especially Arabic language content, is fundamental to the movement, yet the lingual & theological expertise to understand it is almost constantly neglected and lacking in research. This blind spot allows the jihadist movement to reorganize and recuperate out of view of contemporary research and commentary. This allows the movement to develop strategy and tactics by leveraging a wealth of material shared online – and re-organize and develop new outreach strategy. These online spaces provide a safe-haven of coherent theological framework and invites individuals – based on their individual degree of initiation – into more and more clandestine networks, involving layers of online vetting processes.

These clandestine networks are protected by:

  • Arabic language required to access clandestine networks, the ongoing paucity of these language skills amongst researchers is appalling (lingual firewall),
  • Knowledge of the coherent use of coded religious language and keywords, which few researchers can demonstrate in their writing (initiation firewall),
  • With the migration to Telegram, ISIS succeeded in shifting and re-adapting their modus operandi of in-group discussions & designated curated content intended for the public (as part of da’wa).

Passing these firewalls provided access to what ISIS – and the Jihadist movement more broadly – are trying to achieve. [Spoiler alert] What they seek has nothing to do with ‘Utopia’.

Unfortunately, a rigorous understanding of Arabic and deep appreciation for the theological references that Jihadists use simply do not seem to matter to commentators who have become pre-occupied with the few English items and pictures that they have found (though even these are not necessarily understood).

Using the strategic approach adopted by ISIS, and the Jihadist movement, as a point of departure, we examined the amount of video being produced since ISI transitioned to ISIS.

image2

Using the longer timeline and rolling mean of the number of videos produced, it is easy to see that the most likely outcome would be that ISIS media would continue to fluctuate rather than follow the linear ‘direction’ of decline.

Two points provide an important book-ends that further disrupt the decline narrative. First, the highest peak falls before the much talked-up ‘high-point’ in content production. Second, the next highest period of video production fell at the end of 2016 and is much higher than the rest of 2016, exceeding almost the entire history of ISIS video production. This repeats the finding of earlier research which also highlighted the fluctuation in content.

Just as magazine production going back to the 1980s and 1990s fluctuated, so all forms of media production fluctuates.

Equally, as the end of 2017 approached and many western commentators were pushing the ‘decline’ narrative, video production which had been low over the summer had already begun to increase again.

These findings are in sharp contrast to the massive overemphasis on pictures and tweet-ready metrics, by western researchers.

[Another spoiler alert] those who are able and inclined to read the Arabic magazines of the 1980s and 1990s will recognise all the theological themes, articles on mujahidat, defining wilaya etc. currently being passed off as new or unprecedented by Western commentary about ISIS.

Not all content is created equal.

We have written before about the methodological flaw that results from counting pictures, video, newspaper all equally in the attempt to produce a linear metric. To examine the differences in content we looked at the length of videos measured in minutes.

Three hugely important points emerge. First, the direction of the trendline, second that measured in minutes video production peaked at the end of 2016, and third, the volume of video during late 2017 and early 2018 was higher than it had been earlier in the year.

image3

If you take a view of ISIS from 2013 to present the trend in production is up, not sharp decline.

While picture-centric counting was hailed as showing ‘total collapse’ – the longer, more complex, and arguably much more resource intensive / important videos, were not following that pattern.

Video production in minutes during the second half of 2017 was not in decline but had been increasing.  This allowed us to predict that overall production would continue to fluctuate in the face of howls of protest and decliners insisting we were ‘wrong on direction’.

Five months into 2018, the band of committed decliners has thinned significantly. Some are now even trying to sweep under the carpet the earlier claims of collapse, single downward direction, linear / steady decline, or a strong correlation with territory.

Furthermore, the assumed correlation with territory is problematic as the publications from the pre-ISIS era highlights. AQ derived great value from curated videos and writings that spanned from Afghanistan, Pakistan, Yemen etc. where little to no territory was held at the time.

 

Authenticity

We covered before why basing analysis on a cherry picked high point produces a nice narrative, but not an authentic result.

Contrasting the number of videos produced with the average length of production we find further startling results. The high point of video production comes at one of the lowest points for average length. This means that the high point was produced because ISIS published a higher number of shorter videos. While at other points, such as now, they produced fewer longer videos.

image4

This highlights that counting the number of videos has little bearing on the amount being communicated – which after all is the purpose of producing the videos. Here we see one of the flaws in drawing conclusions from counting the amount of content produced. Producing one long video does not communicate half as much as two short videos so cannot support conclusions of ‘decline’ and collapse.  Equally worth noting, the linear trend lines both show a rising trend rather than a decline in number and average length over the entire period.[iii]

Metrification:

Tweet-ready punditry has led commentary to focus on finding and tracking a magic metric rather than developing an authentic understanding of the movement (a trend policy has, to an extent, followed). However, there can be no doubt now that magic metrics pushing decline and full-fledged collapse have failed to provide an authentic representation of the movement.

These metrics have been used to justify pronouncements of decline and ‘total collapse’ in ISIS media and claims production is strongly correlated with territory – which, while headline grabbing, have failed to hold up to scrutiny in 2018, just as the passage of time has shown previous claims of decline and degradation to be more wishful thinking than evidence based conclusions.

Three elements, previously highlighted by Richard Jackson, are particularly prescient when reflecting on the recent metrification of research into the Jihadist movement.

Specifically, the tendency toward:

  1. treating the current problem as unprecedented and exceptional
  2. descriptive over-generalisation,
  3. problem solving approaches that risk reducing research to ‘an uncritical mouthpiece of state interests’

 

Unprecedented and exceptional

Richard Jackson observed that there has been a “persistent tendency to treat the current terrorist threat as unprecedented and exceptional”.[iv] Representing the current threat as unprecedented and exceptional in nature, is a helpful tool if one were to want to start analysis at a preferred point – rather than account for what came before – or account for any relationship between previous iterations of the movement and the contemporary situation. This is important not least because ISIS draw extensively on content and experiences from previous iterations of the movement.

There have been a rash of studies over recent years focusing on ‘official’ social media accounts or what is often termed ISIS ‘official’ media. They use data which starts in 2014 (or strangely 2015) and occasionally – the totally bizarre approach of drawing conclusions using only a single time point before 2017. This approach enables a simple metrification – but undermines authenticity by separating the analysis of the movement from its historical roots. The cherry picking of time points allows everything to be boiled down to a magic number without reference to what came before thereby providing a  policy friendly ‘narrative’.

However, the Media Mujahidin did not appear one day out of nowhere. It evolved over two decades of online activity – tied into the jihadist tradition of producing media since the 1980s during the jihad against the Red Army in Afghanistan.

A previous post demonstrated that once we get away from the narrow discussion of ‘core’ nashir channels we can escape the over-generalisation based on a tiny sample of channels. Taking a wider perspective shows that rather than being a few disconnected channels, the network structure allows Jihadist groups to maintain their resilience and distribute the full range of content. Jihadists groups have been observed using these structures since 2013, and building on these observations, it is clear that this current iteration, like the movement in general, is neither unprecedented nor exceptional.

 

Descriptive over-generalisation

Reviewing the articles published since 9/11, Richard Jackson observed “the vast majority of this literature can be criticised for its orientalist outlook, its political biases and its descriptive over-generalisations, misconceptions and lack of empirically grounded knowledge”.[v]

Over the years, metrification and over-generalisation have resulted in numerous claims of degradation and decline, culminating in recent pronouncements of ‘total collapse’. In time, all these claims have been shown to be misplaced. This is because, as noted in 2014, “the nature of the mobile-enabled swarmcast means it can appear to be degraded, but it has really only reconfigured”.

The level of over-generalisation from a few limited observations and ongoing metrification have been key parts of the decline ‘narrative’. Unfortunately, it risks peering down a soda straw at a large-scale complex problem , to borrow an analogy from Kill Chain. For example, the VOX-Pol study Disrupting Daesh concluded “IS’s ability to facilitate and maintain strong and influential communities on Twitter was found to be significantly diminished” and that “pro-IS accounts are being significantly disrupted and this has effectively eliminated IS’s once vibrant Twitter community”.[vi]

These findings are an overgeneralisation, just like previous claims, based on extrapolating from the soda straw perspective of researcher’s inability to find twitter accounts. The evidence from beyond the soda straw shows ISIS continued to drive traffic to their content. Twitter represented 40% of known referrals to ISIS content during the time period of the VOX-Pol study.[vii] If ISIS had been significantly disrupted – where was the traffic coming from?

This type of over-generalisation has been key to the decline narrative. In another example, Peter Neuman claimed:

Instead of populating mainstream social media platforms such as Facebook and Twitter, Islamic State supporters have been pushed into the darker corners of the internet, especially the private messaging app Telegram, where reaching out to new supporters is more difficult.

image5

Directly contradicting that claim, in addition to the 12,000 views on a video in March, shown earlier, a sample from consecutive days in May 2018 shows ISIS videos still being watched thousands of times on Twitter – 7,351 views, 9,192 views and 8,699 views on 12th, 13th and 14th May respectively. A clear indication that outreach is ongoing via Ghazwa, as core members access content via Telegram.  The success of this uninterrupted outreach process adds to the coherency that ISIS texts and videos offer to their target audiences.

 

Risks of being an uncritical mouthpiece

A third observation central to the development of Critical Terrorism Studies equally highlights the limitation of an approach based on problem-solving metrification;

“It is fair to say that the vast majority of terrorism research attempts to provide policy-makers with useful advice for controlling and eradicating terrorism as a threat to Western interests”. This problem-solving approach can “be a real problem when it distorts research priorities, co-opts the field and turns scholars into ‘an uncritical mouthpiece of state interests’”.[viii]

The narrative of ISIS in decline, in addition to undermining what they claim as a “utopian picture of life under Daesh rule”, or what Rex Tillerson referred to as the “false utopian vision”,  have been parts of the strategy adopted by the Global Coalition against Daesh.

That the decline ‘narrative’ has been pushed so hard by some commentators insisting on their being a ‘direction’ – there has been a growing risk of some becoming uncritical mouthpieces.[ix] For example, the idea of ISIS seeking to project a utopian vision is uncritically accepted by many Western commentators. This subsequently distorts the interpretation of ISIS media. For Jihadist groups Utopia is not a concept to which they aspire. This is due to the theology which draws a clear distinction between the worldly concerns or the temporal world (dunya) and paradise (janna). Even so, academic references connecting ISIS to Utopia proliferate, without reference to original jihadist content that discuss ‘Utopia’ as a goal for their activity.

More troubling than the lack of critical thinking about the core concepts of the jihadist movement are the whispers of researchers working with / for Coalition members and their contractors one day, and the next day representing themselves as independent journalists writing about ISIS decline or Coalition success.

Clear disclosures of potential conflicts of interest between journalism, research, and Government interests are fundamental parts of producing credible academic findings.

If these whispers are confirmed, it would realise one of the objectives outlined by Jihadists including Abu Mus’ab as-Suri, to show Western society contradicting the values to which they claim to adhere. It would be a completely ridiculous and entirely avoidable own goal.

It would also be a breach of journalistic ethics akin to Sean Hannity’s less than full disclosure and represent one of the most profound breaches of trust in the publication of research since the CIA was found to be covertly channelling money to Encounter Magazine and the Congress for Cultural Freedom.

Conclusion

Problem-solving punditry, metrification, and the ‘decline narrative’ have become widely accepted by Western researchers focused on the Jihadist movement. However, as this post has shown the Jihadist movement is much more complex than those pushing the ‘decline narrative’ suggest.

Recognising the limits of metrification, the cherry picking of time points and decliner emphasis on pictures rather than in-depth analysis of documents and video, will allow researchers to produce a more authentic understanding of the movement than is possible from simple linear metrics.

As Rüdiger Lohlker wrote in September 2016,

“without deconstructing the theology of violence inherent in jihadi communications and practice, these religious ideas will continue to inspire others to act, long after any given organized force, such as the Islamic State, may be destroyed on the ground;”[x]

ISIS has the upper hand by inhabiting places that are blind spots for outsiders. They use these blind spots to their advantage. Rather than collapse, ISIS continue to produce coherent content in Arabic – content of which hardly seems to matter to most policy makers and researchers. They build resilient, regenerative online networks – that are now completely in the dark for outsiders. They have battle-hardened fighters on the ground, and the intellectual capital— “their weapon designs, the engineering challenges they’ve solved, their industrial processes, blueprints, and schematics” – from what Damien Spleeters calls “the industrial revolution of terrorism“.

With the commitment, knowledge and ongoing access to resilient networks, ISIS continue to publish new content (videos, articles, newspapers, radio programs etc.) from locations across MENA and ‘East Asia’.

 

Notes

[i]               https://www.lawfareblog.com/virtual-caliphate-rebooted-islamic-states-evolving-online-strategy

[ii]               Analysis: IS media show signs of recovery after sharp decline, BBC Monitoring, (23rd February 2018)

https://monitoring.bbc.co.uk/product/c1dov471#top

[iii] Worth note here, the R2 values are very low – suggesting polynomial or a longer window rolling mean might give better representations, but as we are discussing linear metrics we show it here.

[iv]              Richard Jackson, The Study of Terrorism after 11 September 2001: Problems, Challenges and Future Developments, Political Studies Review7, 2, (171-184), (2009)

[v]               Jackson, Richard. “The Study of Terrorism 10 Years after 9/11: Successes, Issues, Challenges.” Uluslararası İlişkiler 8.32 (2012): 1-16.

Jackson, R. ‘Constructing Enemies: “Islamic Terrorism” in Political and Academic Discourse’, Government and Opposition, 42, 394–426 (2007)

[vi]              Conway, Maura, et al. “Disrupting Daesh: measuring takedown of online terrorist material and it’s impacts.” (2017): 1-45. http://doras.dcu.ie/21961/1/Disrupting_DAESH_FINAL_WEB_VERSION.pdf

[vii]             Frampton, Martyn, Ali Fisher, and Dr Nico Prucha. “The New Netwar: Countering Extremism Online (London: Policy Exchange, 2017

[viii]             Jackson, Richard, “The Study of Terrorism 10 Years After 9/11: Successes, Issues, Challenges”, Uluslararası İlişkiler, Volume 8, No 32 (Winter 2012), p. 1-16 quoting,  Ranstorp, “Mapping Terrorism Studies after 9/11”, p.25

[ix]              Here ‘uncritical’ refers to critical thought, rather than being negative.

[x]               Rüdiger Lohlker, Why Theology Matters – The Case of ISIS, Strategic Review July –September 2016, http://sr-indonesia.com/in-the-journal/view/europe-s-misunderstanding-of-islam-and-isis

 

How well established is the Jihadist movement on Telegram?

This post looks at a network of 462 human verified Jihadist channels on Telegram and over 6,000 additional Telegram channels and groups on which they draw. It demonstrates that the network is much bigger and exhibits a greater level of interconnection than indicated by recent references to munasir and supposed Core Nashir Channels Telegram. The post then highlights the ‘veil of silence’ that has been cast over the majority of activity conducted by the Jihadist movement on Telegram – activity which is primarily in Arabic, focuses on applied theology, and references a vast library of earlier writing, audio and video.

The use of Telegram by the Jihadist movement has attracted the attention of politicians, who have called on platform owners to deny the movement ‘safe spaces‘ – with inevitable push-back from others including Telegram CEO Pavel Durov. At the same time, rumors circulate of Silicon Valley VCs looking to invest in Telegram, while many column inches have been filled with the usual punditry and superficial commentary about ISIS and social media.

Nashir / News

The often referenced Nashir and other news related channels are a natural starting point for analysing Jihadist groups. Many of this type of channel allows users to see the other followers who are also members of that channel. Network Analysis shows the real number of users in the network (6,266 users) and the clusters of users (blue dots) who make similar combinations of choices about the channels to follow (orange dots).

 

Channel_Network_2a

Channels on the right of the network focus on the formally branded content distributed via Nashir and Amaq channels. Those channels on the left tend to blend the formally branded content with a greater level of supporter generated and affiliated media foundation content. Far from being less important, due to being ‘unofficial’ as is often presented, this blending of content reflects the shared purpose, rather than shared organisational structure, as had been outlined by Abu Mus’ab as-Suri over a decade ago.

BlackLight_picsThe BlackLight image feed (which updates with newly posted content from Jihadist Channels every 90 seconds) frequently shows a wide variety of content which ranges from branded content to pictures of former ideologues and leaders, to imagery which conveys concepts which will resonate with sympathizers versed in Jihadist theology, that of course is distributed primarily in Arabic.

Wider Telegram Network

This range of content is inline with what we expected to find. Nico Prucha has taken “a closer look at what Telegram is, and how IS uses it for different purposes: not only operationally, but also for identity building“. More than just narrowly defined ISIS branded content, the range of content “conveys a coherent jihadist worldview, based on theological texts written by AQ ideologues and affiliates as far back as the 1980s”.

To break away from the narrow discussion of ISIS content, we analysed the wide ecosystem of Jihadist channels. This ecosystem allows the Jihadist groups to maintain their resilience and distribute the full range of content out of view from those focused on Nashir / News content.

ISIS_NPTG_network2a

The graph is based on 290,000 posts and shows the content sharing behaviour of 462 human verified Jihadist Telegram channels, and over 6,000 channels from which they share content. Initial observations:

  • The graph shows that Jihadist Telegram Channels form a series of interconnected clusters.
  • Despite attracting the greatest attention from Western commentators, the Nashir News cluster is a tiny part of the overall ecosystem.
  • AQ and ISIS clusters are distantly connected.
  • There is a cluster of Jihadist sympathisers and supporters which align closely with neither ISIS nor AQ.
  • The creation of content archives on Telegram ensures users who see themselves as murabiteen (horse backed warriors) are able to access the content needed to conduct Ghazwa (raids) onto other platforms.

While the Nashir gain the attention of commentators and pundits, there is a large number of channels and huge amount of content going undetected. This content is also reaching large numbers of people, given that the content in the 293,000 posts has been viewed over 460 million times. (This is the number once the duplicate views have been removed). Below, for example, has been viewed over 309,000 times.

nashir stats sample

A subordinating silence

Caron E. Gentry and Katherine E. Brown have both shown how particular approaches, including cultural essentialism and neo-Orientalism, can cause a ‘subordinating silence’  which veils particular groups or perspectives from view.(1) These, like many of insights derived from the work on subordinating gendered narratives about terrorists who are female, provide valuable perspectives and parallels closely the issue of which parts of Jihadist ideational content matter to, or get attention from, Western researchers and policymakers.

As Caron E. Gentry has shown, the women who gain media attention are those “that present threats to the Western ‘us’ and not the Middle Eastern ‘other’.” Specifically highlighting coverage of women who either left the west to fight in Iraq, or with ties to AQ and as such threatened to attack Western interests elsewhere. By contrast, for ‘women who did not (yet) pose a threat to Western interests…, virtually no image exists in the public eye. They almost do not exist’.(2) Similarly one finds many studies of English language sources, with significantly fewer studies of the Arabic sources – despite Arabic being the primary and vastly more heavily used language of the Jihadist movement.

As the late Reuvan Paz noted, the movement is “almost entirely directed in Arabic and its content is intimately tied to the socio-political context of the Arab world”.(3) Yet the vast majority of research focuses on English sources. Perhaps this is the content Western researchers are able to find, or because so few researchers are able to listen to and understand the nuances of spoken Arabic nor read Arabic quickly enough to digest the volume of content which circulates in Arabic each week. It is hard to tell definitively which of these two interrelated problems cause the phenomena, but the result is a vast overexposure of sources in English compared to those texts meaningful to the core of the movement – written in Arabic.

naba 117 stats with banner.jpg

Above, the pdf version of issue 117 of al-Naba has been viewed over 7,000 times. Yet analysis of 12-16 pages of Arabic text by al-Naba’ warrants barely a mention, and is erroneously given the same weight as a single picture. Equally, text and images such as those below are often excluded from ‘analysis’ because they come from Amaq, despite being viewed over 9000 times on Telegram alone.

Both items are from the notorious Nashir channel, which is often cited and referred to in the context of IS’ media decline. One may wonder though, why the number of times for instance the al-Naba’ edition has been downloaded in the Telegram application never gets a mention. Perhaps letting slip that this newspaper usually gets around 7000 – 8000 downloads in just the Nashir channel, Amaq posts can get 10,000 views and some Nashir content has been viewed over 300,000 times, contradicts the drum beat that ISIS media is in decline?

Amaq view number sample

Here the study of rhetoric in gender subordination provides a valuable explanation of how such a process can cause a ‘veil of silence’ to descend over an entire area of study.

As Caron E. Gentry wrote:

Across time and place in global politics, rhetoric has often been used to perpetuate certain social ‘truths’ and norms. A speaker or author uses language to direct an audience toward a manufactured truth, one in which some information is emphasized while other information is concealed. In this way, the speaker designates certain ideas, norms, and events superior to others and ignores actions or events that might challenge them.(4)

With a particular focus on neo-Orientalist Narratives, Gentry highlights:

The othering so intrinsic to neo-Orientalism is deeply troubling because it blinds scholars, researchers, and law enforcers to any deeper realities or nuances in people’s lives.(5)

Whether caused by neo-Orientalist perspectives or other reasons, the veiling of particular aspects of the Jihadist movement through ‘terministic screens’ proposed by Kenneth Burke, means ‘the rhetor uses terminology that leads an audience to a specific figurative location (reflection) rather than to an unwanted place (deflection)’.(6)

Focusing only on a few munasir and supposed Core Nashir Channels is particularly dangerous as these are only the channels most readily findable by those in Western and predominantly English language dominated habitus. While much has been made of alleged access to a few secretive ISIS Telegram Channels, the data presented here highlights that approach risks becoming a terministic screen reflecting only a particular part of the Jihadist movement. See, for example, the announcement of a ‘total collapse’ of ISIS media. A month later, the initial fanfare had become ‘Total Collapse … Postponed‘ as the same commentators struggled to explain why ISIS media was on the rise again.

The narrow focus on ISIS branded content analysed from a Western habitus is, as Katherine E. Brown wrote in her discussion of  istishhadiyyat (female martyrdom operatives), further compounded by the security frame in which it is set:

in this mainstream view in which the principal frame of reference is the state, and in particular Western states, female suicide terrorism simply becomes a variant of an already known threat to the state. This security approach consequently leads to homogenization based on method of attack and its security impact rather than a recognition of the politics of those involved…. Research that adopts the security approach is thus blinded by the glare of the explosion: the corporality and immediacy of the violence and state responses are overexposed at the expense of other features of the phenomenon.(7)

There are striking parallels between the subordination of gendered narratives and subordination of Arabic sources, by the prioritization of sources accessible to a Western and English speaking audience. In the study of the current movement, scouring ISIS English language magazines for European locations, repeats the overexposure of Western State responses.

nashir execution stats 14032018

Prioritising the impact on Western countries means the underexposure of the Arabic theologically driven core of the movement. Likewise interpreting the theologically driven, primarily Arabic content using Western terms and solely English language publications risks creating a ‘subordinating silence’ around the intentions and strategy of the Jihadist movement. Particularly if commentators are still fast forwarding through videos showing violence and wondering to whom ISIS might be speaking.

 

Notes:

  1. Brown, Katherine E. 2011. “Blinded by the Explosion? Security and Resistance in Muslim Women’s Suicide Terrorism,” in Laura Sjoberg and Caron E. Gentry, eds. Women, Gender, and Terrorism. Athens: University of Georgia Press, 194-226.
  2. Gentry, Caron E. 2011. “The Neo-Orientalist Narratives of Women’s Involvement in al-Qaeda.” In Laura Sjoberg and Caron Gentry, eds. Women, Gender, and Terrorism. Athens: University of Georgia Press, 176-193
  3. Paz, Reuven. “Reading Their Lips: The Credibility of Jihadi Web Sites as ‘Soft Power’ in the War of the Minds.” (2007)
  4. Gentry, Caron E. 2011. “The Neo-Orientalist Narratives of Women’s Involvement in al-Qaeda.” In Laura Sjoberg and Caron Gentry, eds. Women, Gender, and Terrorism. Athens: University of Georgia Press, 176-193
  5. ibid.
  6. ibid.
  7. Brown, Katherine E. 2011. “Blinded by the Explosion? Security and Resistance in Muslim Women’s Suicide Terrorism,” in Laura Sjoberg and Caron E. Gentry, eds. Women, Gender, and Terrorism. Athens: University of Georgia Press, 194-226

 

How 6th Graders would see through decliner logic and Coalition Information Operations

The nature of the mobile-enabled swarmcast means it may appear to be degraded, but it has really only reconfigured. 

This observation made in 2014 was based on earlier studies of Jabhat al-Nusra, ISIS and the online activity of the wider Jihadist movement – produced at a time when some commentators already claimed ISIS capacity on social media had been ‘degraded’.

The ‘bluckling’ of the ISIS media system, much talked up by decliners at the end of 2017, and presented as “not just a media decline—it is a full-fledged collapse” will, in 2018, turn out to be to have been a lull as the swarmcast reconfigured, rather than signs of collapse. 

This post shows:

  • How 6th grader math class could explain what is wrong with the current decliner logic and their approaches to quantifying output.
  • Why decliners ignore 2016 – and why 2016 destroys the claim of a pseudo-correlation between content production and area controlled.
  • What about 2014? – how 2014 further disrupts decliner logic.
  • A thought experiment – what would decliner logic predict about the direction in volume of social media Global Coalition?

War by the numbers

Wars often turn on numbers, data, and the real-life experiences of the individuals represented by those numbers. The habitus of those interpretting information about the war also influences how it is understood. This includes the lived experience of target audiences in the physical world and virtual domains. As Douglas Rushkoff predicted, the battle for reality continues online.[i]

In this vein the Global Coalition information operations have long sought to present ISIS or Islamic State as being in ‘decline’ or weak. This has included tweeting images which question the ability of ISIS to produce media content and presenting this as a measure of their decline.

P1

While the tactic is not new – it is currently recognised by ISIS and earlier versions were discussed in depth by Anwar al-Awlaki – there is risk in confusing wishful thinking, the Information War, and academic study.

For example, ISIS has launched a new magazine al-Anfal, now on the 7th issue and the newspaper al-Naba is now on issue 116. It is noteworthy that al-Anfal is vastly better known by those in an Arabic habitus than by English and faux-Arabic language commentators – for whom it has barely warranted a mention.[ii]

6th grade math class – A holiday anecdote

The holiday season is often a time when people encounter others with different perspectives and experience. A maths teacher I spoke with highlighted why, the even in an information war, accurate data work is important to avoid becoming transparent propaganda.

p2

In response to hearing that claims of decline are often calculated by counting the pieces of content irrespective of type, content, or length, the maths teacher originally responded; “that’s just stupid”. He was ready to dismiss the premise that anyone would count an hour-long video, a newspaper, a speech from the leader, an infographic and a picture as if they are all the same.

His reasoning was persuasive, he said;

If I set five assignments, then ask two students to hand in their homework

  • Student A hands in two of the assignments each on a separate sheet of paper
  • Student B has done all five assignments in his book & hands in the book

Student A has not done twice as much work as Student B because they handed in two sheets while Student B only handed in one book. The maths teacher concluded, I’ve taught a number of 6th graders that would have a problem with that logic.

Anecdote aside, there is a problem trying to build credibility with an audience using an approach which infantilises the intended audience with an argument which 6th graders can see through. This is the 6th grader problem.

Despite the clear limitations in the data, (for example, previous research has proven ISIS weekly production exceeded the CTC estimate of monthly production. (New Netwar p. 38) ) some have claimed that “the destabilization of the Islamic State’s territorial strongholds is correlated to a decrease in the volume of media production”.[iii] The problems with this way of thinking are numerous, of which the two most prominent are;

  • There is no calculation of correlation in the published research, so it is an assumed pseudo-correlation which is not based on any demonstrable relationship in the data.
  • The apparent relationship between territory and production can only be maintained by cherry picking certain points in time – entirely ignoring 2016. In fact, the entire decliner ‘narrative’ relies on ignoring the fluctuations in content during 2016.

Research has already shown why the summer of 2015 is convenient to cherry pick as a start point if your goal is to claim decline. As discussed in depth elsewhere, picking a time which logic dictates is most likely to be an outlier can make for a nice soundbite for coalition propaganda, and may even sound smart in 20 seconds of air time, but does not work for an authentic understanding of the movement.

The root of the problem, as Reuven Paz noted in 2007,

Jihadi militancy is … almost entirely directed in Arabic and its content is intimately tied to the socio-political context of the Arab world.[iv]

People who live in that socio-political context, or habitus, easily pick up on the factors likely to play into the spike in content over the summer 2015.[v] This is because;

the habitus is itself a generative dynamic structure that adapts and accommodates itself to another dynamic mesolevel structure composed primarily of other actors, situated practices and durable institutions (fields).[vi]

And because habitus allowed Bourdieu;

to analyze the social agent as a physical, embodied actor, subject to developmental, cognitive and emotive constraints and affected by the very real physical and institutional configurations of the field.[vii]

While it is tempting to focus on Western interpretations of Jihadist content, particularly if you can only draw on faux-Arabic, the habitus of the intended audience has to be foremost when analysing the meaning of the content.[viii]

p3

Why decliners ignore 2016

Most of the recent claims of decline, including those by the Global Coalition, pick 2015 as the start point, then jump over the awkward hurdle of 2016 and head straight for 2017. This allows them to get past the fluctuations in 2016 and present “huge and steady decrease”.

To understand how this works, first it is important to understand the 2015 ‘highpoint’, from one of the often-referenced studies about 2015.

Journalists writing about the 2015 ‘highpoint’ have claimed ISIS “was producing more than 200 videos, radio programmes, magazines and photo reports each week” resulting in “just under a thousand unique data points, ranging from radio bulletins and electronic magazines to videos and photographic essays”[ix]

Perhaps not immediately clear to the reader;

  • “Just under 1000 unique data points” is in reality 892. This makes the ‘highpoint’ sound 10% higher than the reality. 892 could be described as just under 900 … but it is just under 1,000 like I’m just under 8 feet tall.
  • Composition of the content is around 80% pictures (just under 700 of 892 data points).

Problem 1:

Even for the astute reader it can be hard to tell what is being counted. As best as can be ascertained from the terms ‘events’, ‘photo reports’, ‘photographs’ and ‘photos’ being used interchangeably, this is unlikely to be 700 photo-essays (one every hour for a month) as the description of “200 videos, radio programmes, magazines and photo reports each week” would require.

Alternatively, if one differentiates a photo report from a photo by assuming a minimum of two pictures, and the graph showing approximately 700 ‘photos’ accurately reflects the data, then 700 / 2 = 350 reports. ISIS photo reports regularly have more than two images, but this is just a theoretical minimum.

p4

If the non-photos account for the remaining 200 pieces (approx.) of content, which recent articles suggest, and this is added to the maximum number of photo reports it would be around 550 pieces.[x]

This is still a lot, but would still eliminate the claim of “200 videos, radio programmes, magazines and photo reports each week”.  Let alone the claim made in September 2017 of “hundreds and hundreds of unique media products, videos, magazines, radio bulletins, in lots of different languages coming out every single day.”

Problem 2:

As noted in a previous post, just counting a photo, speech, and video as the same makes little sense;

“It should be needless to write, this audio-release [of ISIS leader’s speech] by al-Furqan is of much greater importance than a single image, or photo report – at least for IS sympathizers and operatives. Although currently we still find ourselves having to write it”.

How the 2015 data is compared to 2017 production is illustrative of the way the decliner narrative is constructed. Recent journalism around ISIS decline, (which has since been publicised by UK government on Twitter) has used some creative ways to display longitudinal data, which fall well short of what would be required to pass 6th grade math class.

Edward Tufte, has “set out a detailed analysis of how to display data for precise, effective, quick analysis” in his Visual Display of Quantitative Information. This includes demonstrating that inappropriate use of data can lead to an apparent, but entirely spurious, connection between the fortunes of the New York Stock Exchange and the level of Solar Radiation.

Contrary to the ideas set out by Edward Tufte, the chart featured in a recent wired article gives the impression of a steep, linear decline by evenly spacing the bars, even though the chronological space between data points varies significantly. Two of the time points are only a single month apart while the other gaps are 6 and 17 months respectively.[xi]

p5

When the image is quickly resketched, so all months are represented equally – both months with and without data – the problems become evident.

  • First, the impression of sharp decline is reduced.
  • Second, what happened to 2016?

Why does recent decliner narrative rely on ignoring 2016 and compressing these 17 months in the graph? Was there nothing to report in 2016?

Genuinely longitudinal data, rather than cherry-picked points, show there is much more to the story than drawing an imaginary line across that 17-month gap and claiming correlation.[xii]

p6

Data from February 2016 to March 2017 shows production actually fluctuated, despite research claiming a “huge and steady decrease” or 30% to 40 % reduction.[xiii] At times in 2016 content was rising, at others falling. This nuance is entirely missing from decliner logic (whether from Coalition Information Operations or recent journalism).

Decliner logic insists on there being a single direction and that direction being decline – this despite decliner commentary also claiming to have identified recently a 25% increase in content – (barely 20 pieces per week in November and 25 pieces for week in December).

Using rolling mean to examine how production changed over 2016 uncovers some important results. For example, there was an increase of 132% in content production between low points in September / October 2016 and the decliner cherry-picked month of February 2017. This means, February 2017 occurred during a period of rising content production, rather than production heading in the single downward direction, as the Global Coalition imply and decliners explicity claim.

Equally, despite the counting of photos being used to show decline between 2015 and February 2017, video production increased. By adding all media types together, a decrease in easily produced photographs hides an increase in the higher resource requirement and greater impact of video production.

What about 2014?

Analysis which uses no-Arabic, faux-Arabic or google translate is no substitute for being able to read and listen fluently in Arabic. It is essential researchers are genuinely able to recognise the encoded references, historical precedents, and understand the habitus of the intended audience. 

Recent commentary has suggested:

“there can be no questioning the fact that the Islamic State’s media capabilities largely relied on its territorial clout between 2014 and 2017”.

However, a different picture emerges once the flaw in decliner logic and fluctuations in content have been exposed by genuine data science. This different picture is one which has long been evident to anyone embedded in an Arabic context and “crystal clear to virtually anyone who has the linguistic capacity to grasp and the opportunity to witness what jihadists are actually saying, writing and doing, both online and offline”.[xiv]

Unfortunately, it is a picture which is too often obscured from view by commentators writing from the perspective of a Western, English language dominated, habitus. These commentators often exhibit masculinist understandings of power, success, and victory and rely on faux-Arabic or google translate.[xv]

Just as genuinely longitudinal data disrupts the narrative of a consistent downward direction in content production, analysis of the territory held alongside the media production also shatters the illusion of a pseudo-correlation between the territory held and content production.

The Global Coalition has reported on the reduction in ISIS territory as a percentage area held at the territorial highpoint of August 2014. Yet, decliners claim summer 2015 as the media highpoint, which occurs while ISIS was losing ground, including parts of Sinjar and Kobane (14% in total during 2015).  Put simply, the count of content was increasing toward the claimed ‘highpoint’ while territory was decreasing.

Furthermore, the claims of a relationship between territory and media production after the 2015 media ‘highpoint’ are problematic because content production went up 132% between October 2016 and February 2017, yet territory held by ISIS went down. The Coalition territorial estimate for October 2016 shows that the territory ISIS had lost was 56% Iraq 27% Syria, by February 2017 this had become 63% and 35% respectively.

Contrary to what they expect, decliners asking ‘what about 2014?’ reminds us that the claimed media and territorial ‘highpoints’ occur a year apart and that the pseudo-correlation between the two evaporates when the change in production and territory are compared with genuinely longitudinal data rather than cherry-picking.

Conclusion: Appropriate use of Data Science emphatically destroys claims of pseudo-correlation between content production and area controlled. Saying ‘what about 2014’ just makes this clearer.

A supplemental thought experiment:

For the sake of a thought experiment, as the Global Coalition has been claiming success and territorial gains against ISIS – what would decliner logic predict about the volume of social media produced by the Global Coalition? So has the Coalition social media increased or decreased?

Using the last 3,000 tweets from each of the accounts run by the Global Coalition Against Daesh (Arabic, English and French respectively) all could be described as ‘in decline’ from an earlier highpoint. For Arabic and English, the ‘highpoint’ is in 2017, for French it is in 2016. If production is linked to battlefield success – Arabic and French speaking forces are in deep trouble – as production is down (over 90% for Arabic) from their social media height.

p7

p8

No doubt you are reaching for alternative explanations other than the collapse of coalition forces. If so you have understood the problem with decliner logic perfectly.

It is perhaps telling that the logic when applied to anything else is utterly transparent. The coalition propaganda even trips over its own logic, seeking to claim decline and how gaps in the production of magazines should be interpreted.

p9

The above images show the Global Coalition has highlighted the time since the last issue of Rumiyya, but those with a longer memory will recall that before Rumiyya there was another now discontinued magazine, Dabiq. Both magazines are examples of communicating to the secondary – at best – target audience, namely English speakers. However, it is instructive as, in this case as Dabiq, there was a gap in production which began in September 2015 and lasted over 100 days (second longest gap between Dabiq issues). This, it should be noted, came the month after the claimed peak in ISIS content production, which decliners present as the zenith of the Caliphate.

If gaps in production of a prominent magazine (available in English) indicates weakness and territorial losses, as the Coalition implies, how was it Dabiq exhibited this ‘weakness’ during the period the Coalition refers to as the ‘high point’ of ISIS media production?

Indeed, as the Coalition and decliner journalists focus on a masculinist, post-Westphalian measure of victory, ISIS engage with their intended audience on a different plane. As narrated in a recent video اهل الثبات (The people who are steadfast) from ولاية كركوك (Kirkuk):

Morale is not something you can buy with money, and victory is not measured in square kilometres rather it is measured by the overall outcome, including the outcome in the hereafter, and not short-term achievements.

It is true that we lost ground, but with every day that passes the reality of the battle is becoming apparent to the Muslims worldwide, that this is a global campaign against Islam and the Muslims, it is a campaign against the Sharia and the very basic fundamentals of Islam.

Praise be to Allah that the mere existence of the Khilafah said what no long lectures and books could ever do to the hearts and minds of the Muslims worldwide.

I guess it is clear from the overall situation that we have already won the battle on the field of morale and ideas, winning it on the ground is just a matter of time, by the grace of Allah.

Victory is a complex concept in Jihadist interpretation of Islam.[xvi] Just as there is no meaningful relationship between Solar Radiation and NYSE, so Coalition propaganda, decliner logic, and the claimed pseudo-correlation between media and territory fail to provide an authentic representation of the current fortunes of the jihadist movement, their strategy nor their tactics.

As noted in 2014, the media mujahedeen are constantly reconfiguring and finding new outlets. In 2018, content production will continue to fluctuate.

The much talked up bluckling of the ISIS media system, presented as “not just a media decline—it is a full-fledged collapse” is likely in retrospect to have been a lull as the swarmcast reconfigured, rather than signs of  ongoing decline.  

 

Notes

[i] See for example;

Rushkoff, Douglas. Cyberia: Life in the trenches of hyperspace. Clinamen PressLtd, 2002.

[ii] It is also worthy of note, that in highlighting the gap in Rumiyah production (above) and the ‘high’ point in 2015 (below) the Global Coalition get themselves in a logical tangle. This is because the second longest gap in the production of Dabiq began in September 2015 the month after the claimed peak in content production. Was it strong – as the ‘high point’ would suggest – or weak as the long gap in publication of a magazine would imply in their logic about Rumiyah.

[iii] Mehdi Semati & Piotr M. Szpunar, ISIS beyond the spectacle: communication media, networked publics, terrorism, Critical Studies in Media Communication Vol. 35 , Iss. 1,2018

[iv] Paz, Reuven. “Reading Their Lips: The Credibility of Jihadi Web Sites as ‘Soft Power’ in the War of the Minds.” (2007).

[v] Lizardo, Omar. “The cognitive origins of Bourdieu’s habitus.” Journal for the Theory of Social Behaviour 34.4 (2004): 375-401.

[vi] Lizardo, Omar. “The cognitive origins of Bourdieu’s habitus.” Journal for the Theory of Social Behaviour 34.4 (2004): 375-401.

[vii] Lizardo, Omar. “The cognitive origins of Bourdieu’s habitus.” Journal for the Theory of Social Behaviour 34.4 (2004): 375-401.

[viii] This is not to say the intended audience is sympathetic to the message, just that the message is intended for their consumption.

[ix] In the following section it is unclear whether the dubious data handling is due to the ignorance of the required skills / methods, or a sleight of hand in the presentation.

[x] The published research lists the titles of only 140 pieces of content

[xi] This trick is also used here: https://twitter.com/charliewinter/status/920651729393389568

[xii] There is a lot wrong with counting content – except where you are comparing total files detected for takedown vs. files released – this section shows what is wrong with decliner logic even in their own terms, rather than because the approach itself is insightful.

[xiii] This data comes from the torrent files released containing a collection of all the content for the ‘week’. These files were not released consistently in a seven-day cycle, but often varyied between a six and ten day cycle. As we have used the torrent file date to produce date of production, there are some periods of seven days without a total. This however, does not effect the total production and rolling mean is used to provide an authentic view of the ongoing levels of production.

[xiv] Rüdiger Lohlker, “Why Theology Matters – The Case of ISIS,” Strategic Review, July –September 2016; http://sr-indonesia.com/in-the-journal/view/ europe-s-misunderstanding-of-islam-and-isis

[xv] From an IR perspective see:

Sjoberg, Laura. Gendering global conflict: toward a feminist theory of war. Columbia University Press, 2013.

For a jihadist perspective see:

Anwar al-Awlaki, State of the Ummah.

[xvi] See for example; Constants of Jihad and the discussion of the contents of the book by Anwar al-Awlaki.