The Nature of Salafi-Jihadi Communication: Salafi-Jihadi groups communicate based on deeply rooted theological principles. Their messaging has remained consistent over time, as evidenced by materials produced before and after major global events, such as the U.S. invasion of Afghanistan or Iraq that enabled the rise of AQ.
To counter their strategic communication effectively, it is essential to understand the core concepts and doctrinal frameworks they use to engage their primary tartget audience worldwide.
Empirical Insights from Mujahid Mind AI
Mujahid Mind AI analyzed over 6,600 images published between mid-2020 and early 2025. The findings reveal that, despite claims of their decline and defeat, the Islamic State (IS) continues to document its activities and engage with supporters through photo reports. This contradicts narratives suggesting IS has been incapacitated. Their communication remains active regardless of Western attention.
The full article giving an overview of the findings was published by ITSTIME:
The relationship of Web 1.0 to the Web of tomorrow is roughly the equivalence of Pong to The Matrix
Darcy DiNucci, 1999
This paper adopts the progressive approach to Terrorism Studies, which focuses on an evidence-based analysis, in this case examining the purpose, strategy and tactics of the Media Mujahidin. It examines the recent evolution of the Salafi-Jihadi information ecosystem including the adoption of Web3 and the emergence of the Salafi-Jihadi Swarmcast 2.0.
The paper demonstrates:
The emergence of Web3 significantly (if not completely) undermines the current approaches to disrupt the online activity of the Salafi-Jihadi movement.
The Salafi-Jihadi movement and specifically al-Dawlat al-Islamiyah (IS) have already adopted Web3 technologies.
The Web3 technology currently in use already represents a significant circumvention of existing tactics and techniques intended to disrupt their online activity. From EthLink and IPFS pinning, to the integration of onion links which underpin the strategy to deliver a resilient surface web distribution infrastructure, Web3 is already in use.
With the advent of Web3, the current approaches to content removal may be a necessary clean-up of Web2.0, but no longer represent a viable strategy to disrupt the activity of the Media Mujahidin.
The multiplatform communication paradigm (MCP) adopted as part of the Salafi-Jihadi Swarmcast 2.0 has created a network of significant resilience, vastly outstripping that short period which was seen when the Salafi-Jihadi movement was heavily reliant on Twitter in multiple languages.
Social media users on average use 7 platforms in each month. Adopting a multiplatform strategy provides the Salafi-Jihadi movement with multiple entry points to reach their target audience.
While the core of the Salafi-Jihadi movement communicates through Telegram, the existence of multiple platforms mitigates against the disruption on any single platform, as users can redirect their attention elsewhere.
Platforms which act as the primary ‘beacons’ within the Swarmcast2.0 are Telegram, Rocket, and Matrix, while many second-tier networks exist across the so-called tech giants and comparative newcomers.
The current ‘success narrative’ produced by the Transatlantic orthodoxy of Terrorism Studies (OTS), has overstated the effectiveness of contemporary disruption efforts.
The OTS refrain that accessing Salafi-Jihadi content requires having access to Telegram or an old Jihadi forum, is not supported by the available evidence.
An evidence-based approach contradicts the claims that Salafi-Jihadi groups have been forced off tech giants such as Facebook and Twitter onto smaller platforms.
Despite the significant resource and effort expended by larger platforms, Salafi-Jihadi networks and content are easily identifiable on all four of the biggest social media platforms, i.e., Facebook, Instagram, YouTube and WhatsApp
Twitter has strong name recognition amongst policymakers and OTS researchers. However, due to the changes in the tech landscape, some of the so-called ‘smaller’ or ‘niche’ platforms used by the Salafi-Jihadi movement, now have significantly bigger userbases than Twitter.
Conclusion
A Web3 enabled Swarmcast2.0 has arrived. Swarmcast2.0 is much more dynamic, secure, encrypted, decentralised, and resilient than the original version which emerged by 2014.
Swarmcast2.0 circumvents or renders obsolete many of the current tactics intended to disrupt the online activity of the Media Mujahidin.
The need for a strategic level approach to disruption, and collaborative strategies, are increasingly pressing and can no longer be held back by the comfort and reassuring rhetoric of the OTS ‘success narrative’.
The future of disruption efforts requires a Web3 strategy. The risk posed by relying on Web 2.0 disruption approaches in an increasingly Web3 world, approaches the equivalence, to lean on Darcy DiNucci’s analogy, of planning to play Pong but finding yourself in The Matrix.
The Salafi-Jihadi movement has to date maintained a persistent presence for its networks and content despite the pressure from governmental organisations, the efforts of the tech sector and active attacks from other online groups including cyber-divisions of Shia militia groups.[1] The Salafi-Jihadi movement has achieved the persistent presence because “the movement can leverage collective behaviours across multiple platforms to maintain a persistent presence for their content”.[2] This is the Swarmcast, which combines the speed of dissemination, the agility of users and the resilience of network structures. In many ways the Media Mujahidin and supporters of Salafi-Jihadi groups more broadly have been early adopters of technologies and platforms within their multiplatform communication paradigm (MCP) which have enabled them to remain many steps ahead of disruption efforts.[3]
For over 20 years, the activity of the Media Mujahidin has been in state of constant evolution as their multiplatform zeitgeist has continued to reconfigure.[4] Having been pioneers in using electronic communication, the Media Mujahidin are an established side of any real-life conflict and became of greater importance with the wars in Afghanistan 2001 and Iraq, 2003. As of now, Salafi-Jihadi groups have already fully embraced many of the characteristics of Web3, including decentralisation, in a self-governing distributed and robust multi-server, and multiplatform network.
While the Media Mujahidin have been forging ahead, exploiting new technologies and approaches, many researchers and ‘embedded academics’ in the transatlantic orthodoxy of Terrorism Studies, have perpetuated a ‘success narrative’ about the online efforts against Salafi-Jihadi groups.[5] This ‘success narrative’ in many ways echoes elements of the wider War on Terror since 2014, in which attempts to demonstrate policy success and announcing the decline, collapse, defeat, and demise of Salafi-Jihadi groups has taken centre stage. Unfortunately, the extent to which the Transatlantic orthodoxy of terrorism studies has defined these groups as defeated, has little to do with their continued ability, willingness, and theological drivers to wage their particular form of Jihad.[6] Salafi-Jihadi groups remain undeterred by the Western claims of success against them.[7]
While the digital environment has gone through significant changes, much of OTS research has focused on the same old places from the early Web 2.0 era[NP1][AF2] , with any change in tactics made by the Media Mujahidin being ascribed to the success of Western pressure. One will often hear OTS pundits and researchers use a version of the supposed truism that IS presence ‘it is not like it used to be’ implying or explicitly claiming success of disruption. And indeed, it is not like it used to be. However, this is primarily because the tech landscape has changed significantly, including the usability and accessibility of platforms, and the Media Mujahidin have evolved their tactics to maximise the impact of their efforts in this changing tech landscape.
In an OTS context, the phrase is often used as part of the success narrative to hark back to a short-lived era when the Media Mujahidin heavily relied on Twitter, with the implication, in the OTS mindset, that the situation is much better now. Some OTS researchers have even claimed that accessing Salafi-Jihadi material is limited to Telegram or an old Jihadi forum. However, the contemporary reality is that the Swarmcast2.0 is much more dynamic, secure, encrypted, decentralised, and resilient than it was in 2014. It is also using platforms with a much greater reach than 2014. Ultimately, like almost everything about the way we use technology and access the web in 2022, it is not like it used to be. That change, however, is not necessarily the result of Western success against Salafi-Jihadi groups, nor has it become harder for the Media Mujahidin to operate in any strategically meaningful sense.
The paper is divided in four parts.
Part 1 tests the orthodox success narrative about Salafi-Jihadi groups being driven onto smaller platforms.
Part 2. Introduces the conceptual underpinning of Swarmcast2.0, both through the Swarm metaphor and the concept of Web3.
Part 3 examines how Swarmcast 2.0 thrives in practice by examining the contemporary digital environment, and the three contemporary distribution pillars which contribute to the multiplatform zeitgeist.
Part 4 provides concrete evidence of the steps the Media Mujahidin have taken with Web3.
[5] The role of ‘embedded academics’ in the transatlantic orthodoxy of Terrorism Studies, Jackson, RDW, ‘The Case for a Critical Terrorism Studies’ (2007) http://hdl.handle.net/2160/1945
Session 1 of the Progressive Terrorism Studies Webinar Series. “The Persistent Online Presence: The Shift in Platform Exploitation Over Time”
How the Salafi-Jihadi movement has been able to exploit the internet to distribute their message has been a key concern of those seeking to challenge these narratives. The first webinar in the Progressive Terrorism Studies Webinar series provided a data-driven update on how the Arabic speaking core of the Salafi-Jihadi information ecosystem has continued to evolve. This is not a new phenomenon – nor restricted to the pop cultural and pseudo-scientific hype regarding al-Dawlat al-Islamiyya – rather, jihadists have been exploiting all means possible on the Internet for decades.
This research comprises over 6.4 million Telegram updates collected in near real-time since June 2017. These updates were collected from channels and groups confirmed to be part of the Salafi-Jihadi movement, stemming from Jihadist exploitation of the internet for over a decade, but focused here on their operation on Telegram. From within this vast archive of material a collection of 4 million instances of URL sharing were recorded for analysis.
The session emphasised the importance of robust design and data collection in the study of Salafi-Jihadi groups.
The subject of study needs to be identified by someone able to:
recognise the theological references and imagery,
join online groups by passing the vetting conducted by the Salafi-Jihadi movement in Arabic. If a researcher cannot respond to Q&A in Arabic, it is a sure sign they cannot enter the core of the movement.
Similarly, for analysis which examines change over time the data collection needs to occur in near real-time, as downloading weeks, months, or years after the event does not provide a credible dataset for analysis. This is because the attempted disruption from outside, internal purging of some groups, and the activity of bots, all combine to undermine confidence in time-series analysis of Telegram data collected using a retrospective approach.
The large-scale analysis provides a strategic level overview of the way the Salafi-Jihadi movement has operated since Telegram became its primary platform for communicating with supporters and acting as a core platform for their media output – in combination with other platforms since Europol’s claim of they had removed IS from the internet in November 2019. By examining the URL they share, the analysis shows the breadth of the Salafi-Jihadi presence across platforms and provides an overview into whether there are detectable patterns in their use of different online services.
A reduced version of the domain tool used in the time-series analysis shows the engagement profile of various domains in the study.
The tool can be viewed here and more detail on the analysis can be found on github.
The analysis showed:
Some platforms experience persistent engagement profiles, while others experience sudden spikes in use, or short-term exploitation.
Correlations between the use of different platforms could be used to develop a rapid alert system to locate material.
Co-citation style network analysis can be used to detect clusters of platforms which are used collectively. This would allow clusters of platforms which are being exploited in a similar way to be supported or work collectively.
The session built on 2019 the publication by Emily Winterbotham, Dr Ali Fisher and Dr Nico Prucha. This is the largest ever study of traffic between the online platforms that comprise the Jihadi information ecosystem. This study included 24 months of data from the core of the Salafi-Jihadi Telegram network and revealed the inner workings of their multiplatform communication paradigm. The paper demonstrated the different roles that platforms play within the multiplatform information ecosystem, including Telegram, Tamtam, and Matrix.
This I have resolved on … to run when I can, to go when I cannot run, and to creep when I cannot go.
Pilgrim’s Progress – Part 2 Chapter 6.
The role of the Feeble-mind character in Bunyan’s religious allegory Pilgrim’s Progress is to highlight the importance of continuing to make progress towards an identified goal.
A more progressive approach to Terrorism Studies could focus on extending the depth at which the Salafi-Jihadi movement is understood. This would be based on robust data science and human expertise, a focus on the primary language of the Salafi-Jihadi movement – Arabic – and the extensive archive of theologically inspired thought which the movement has produced.
It is the archive of theology as expressed and interpreted by the core of the movement which provides the best predictor of the actions of the movement. In contrast, some researchers and commentators within the orthodoxy of Terrorism Studies claim to see artefacts of their western habitus in Salafi-Jihadi material – the focus on crime, rap music, and naïve notions of a Jihadi ‘Utopia’.
Since the 1980s research has shown that the study of terrorism has struggled with availability, handling and analysis of data. Despite the length of time and frequent observations about the problems with data, rather than making progress, these problems within orthodox Terrorism Studies have remained. In addition, “the dispersed nature of much of the more rigorous, ‘critical’ and conceptually innovative research on ‘terrorism’” means that level of rigor in research is conducted outside the orthodoxy.
Over a decade ago Magnus Ranstrop highlighted the ongoing problem, which Alex Schmid and Berto Jongman originally identified back in 1988; that ‘there are probably few areas in the social science literature in which so much is written on the basis of so little research’. As a result, much of the writing in Terrorism Studies is “impressionistic, superficial, and at the same time often also pretentious, venturing far-reaching generalisations on the basis of episodal evidence”.
Rüdiger Lohlker recently recently continued this theme when he highlighted, the tendency for orthodox Terrorism Studies to contain “an empty fog of words without inner content”. Quoting German philosopher G. W. F. Hegel. The section quoted by Rüdiger Lohlker continues:
This sort of chatter, though lacking the idea of philosophy, gains for itself a kind of authority through its very prolixity and arrogance. Partly this is because it seems almost incredible that such a big shell should be without a kernel…
G. W. F. Hegel
Such is the coagulation of mediocrity within a section of orthodox Terrorism Studies that unscientific, methodologically flawed and statistically unsound commentary is talked up as ‘data science’ and ‘groundbreaking research’, while the evidentiary basis goes unquestioned within the mainstream scholarship and peer review. Over the last decade – rather than being addressed – these issues have become systemic.
Making progress
As noted in the development of Critical Terrorism Studies, “it is not enough to simply point out what is lacking in current research; a clear and realistic alternative must be provided”. Sections of the orthodox Terrorism Studies, and offshoots in the CVE industry, have an opportunity to break from the contemporary stagnation and develop a strong data culture and emphasis on evidence-based research. A progressive approach to analyzing the complex, theologically driven, Salafi-Jihadi movement, will move away from the contemporary obsession with finding so-called ‘gaps’ in the largely superficial and stagnant orthodox literature.
Many of the criticisms highlighted at the start of CTS remain within sections of the orthodoxy. CTS itself – with a focus on Western policy and Western academia – has struggled to break free from the Western frames of reference, among other challenges. The framing of Terrorism, with 9/11 as a moment of temporal rupture, still dominates CTS. This inhibits the deeper understanding of the Salafi-Jihadi movement which maintains different temporal reference points to those which dominate CTS and traditional approaches to Terrorism Studies, both in relation to time in the physical world and in relation to this world (Dunya) as an abode through which a soul passes.
To address the superficial, orientalist and neocolonialist tendencies of the orthodoxy, and the temporal framing of CTS, a progressive movement within Terrorism Studies would probe the intended meaning of Salafi-Jihadi content in their understanding of the world, rather than in a Western-centric English language dominated habitus. Critique of the orthodox Terrorism Studies has highlighted “its poor methods and theories, its state centricity, its problem-solving orientation and its institutional and intellectual links to state security projects”. Many of these problems have also concerned scholars within terrorism studies “who have long acknowledged the deficiencies and limitations of current research”.
In addition, a progressive Terrorism Studies approach would uphold standards for the appropriate use of statistical data to produce a clear break from the systemic malaise in data handling which have existed within orthodox Terrorism Studies. With a strong data culture and robust research design, a dynamic approach to Terrorism Studies could utilise the changes in the technological environment for research. This is not dissimilar from the way Salafi-Jihadi groups have adapted to the opportunities which evolving technology has created.
The way the object of study, such as the groups who make up the Salafi-Jihadi movement, choose to operate has evolved:
The evolving concept of the electronic ribat. Since 2011, members of jihadist forums have issued media strategies that encourage the development of a media mujahideen. This encouragement has been accompanied by the release of guides to using social media platforms, which often include lists of recommended accounts to follow.
By 2013, Jihadists had aggressively expanded their use of Twitter, in addition to Facebook and YouTube, especially since the outbreak of violence in Syria. This propagation effort by the “media mujahideen” was approved and sanctioned by movement leaders and contributed to the interconnected jihadist zeitgeist.
Learning from each interaction on the electronic ribat, the media mujahidin rapidly developed to maintain a persistent presence based on the speed, agility, and resilience of the Swarmcast.
In this struggle for survival, the media mujahidin have benefited from collective approaches and emergent behaviors, these have allowed a decentralised network to thrive in the face of increasingly aggressive content removal.
The media mujahidin frequently use widely available software for media production – this software would also be easily accessible to researchers to provide a window into the production methods.
In addition the current technological environment provides many opportunities for research:
Servers are cheap and easy to access – for example if you use Amazon for shopping, then that is enough to access cloud computing through AWS.
Processing power and RAM are cheaper than they have ever been, allowing relatively complex calculations and data analysis to be produced rapidly.
Most modern personal laptops and desktops have hardware sufficient to run the analysis required for many data science projects which would extend current research into the use of the internet by Salafi Jihadi groups, or ‘extremist’ groups more broadly. Of note, most contemporary material published by salafi Jihadi groups is produced on the same widely available hardware / software (more on that in a later post).
While there are many commercially available and hugely powerful ‘data systems’ which integrate a range of data storage and analytical processes within a single platform, there are also many open source programs which can be used to conduct academic research. These open sources software options may not permit all the analysis to be conducted within one platform, requiring the researcher to use a range of approaches to achieve the desired analysis.
There are many ‘how to’ guides for those aspiring to become better at using python, java, or any of the other popular coding languages. Similarly, resources are freely available which researchers can use to learn more about data science or using specific open source software more generally in their work, whether in the form of walkthroughs or articles packed with quick tips and tricks.
To build a stronger data culture will mean;
Acknowledging the problems with evidence and data which have to date beset orthodox Terrorism Studies,
Reviewers and editors robustly enforcing actual standards for statistical analysis, for example,
if you are going to claim something such as a correlation or a long-term trend – it will need to be backed up by a statistical calculation using data acquired through a scientifically appropriate method.
if the analysis is based on subjective ‘coding’ of data – is there an appropriate intercoder reliability score. If there is not, there is little reason for readers to be confident that the research presented would be repeatable, that coding remains unchanged over time, and that other researchers would apply the same coding definitions in the same way. Without intercoder reliability there is little reason to have confidence in the resulting ‘analysis’ rendering it largely unpublishable.
Editors and publishers insisting on clear conflict of interest reporting,
The Terrorism Studies community putting methodology above attention grabbing headlines and tweetable pseudo-metrics.
If the methodology is flawed or the statistical analysis unsound – no matter if the ‘findings’ are appealing or even intuitively correct – the study lacks the necessary basic elements to be considered publishable research.
Sample:
If research is claiming to have analysed a sample, to what extent can the sample be considered representative of the whole?
Was that sample derived from a consistent methodology, or a hodgepodge of pieces cobbled together?
How was the sample identified and collected? In effect research design (architecture) and data collection (acquisition) to use two of Jeffrey Stanton’s four A’s of data science.
If you cannot do the calculation to produce a statistical result, do not use the word related to that calculation e.g. correlation, trend etc.
Correlation:
When an author claims correlation – a range of questions should spring to mind; do you mean a positive or negative correlation?
how strong a correlation?
Did you use Pearson, Spearman, or Kendall?
Trend:
If a trend / trendline is claimed, what is the R-squared value? Is your line a good representation of the data?
A trend requires more than two or three data points.
Do you mean one point in time has fewer of ‘x’ than another? This is not a trend, upward or downward, one point just has fewer than the other.
Based on what is currently being published within the orthodoxy of Terrorism Studies there are a range of issues, including;
Journals specifically focused on terrorism research, a range of journals in related disciplines which have hurried to do ‘special issues’ on ISIS, and ‘research centers’ self-publishing special reports, which have published articles as if they are either unaware of the basic scientific and statistical standards or are content to publish material that they know falls short of the minimum acceptable scientific standards.
Senior researchers, including Professors, who will cite work that falls short of scientific or statistical standards without commentary or critique, some even talking it up as ‘ground breaking’ or ‘data science’.
The current state of orthodox Terrorism Studies must be judged on the behaviour of those in the discipline. Such is the coagulation of mediocrity in orthodox Terrorism Studies, senior researchers have not questioned unsound methodologies, and journals through their peer reviewers and editors, have not upheld standards. The previously observed problems of data and data analysis within some sections of orthodox Terrorism Studies have now reached systemic levels.
In a scientific discipline,
If the relevant scientific or methodological information is not present in an article submitted to a journal, then that paper is going in the bin because it does not reach minimum standards for undergraduate level work, let alone peer review.
When individuals deliver presentations, which make statistical claims about trends or correlation without any calculations, or use substandard / misleading data visualisation to support their argument, they could expect to be laughed out of the building.
If statistical and data analysis in Terrorism Studies do not adopt the standards adopted by other fields, it cannot take full advantage of the potential offered by increasing integration of data science or forms of statistical analysis into the study of Salafi-Jihadi groups.
The following series of posts examines specific tangible reasons why robust data science and evidence-based analysis is important and offers a critique of contemporary uses of data within orthodox Terrorism Studies.
A progressive focus on what events and material means to Salafi-Jihadi groups – Da’wa As Constant on the Path of Jihad:
The purpose of research is to develop deeper understand the object of study. While Western-centric interpretations of ‘utopia’ and claims the ‘West is Winning‘ or that Salafi-Jihadi groups are defeated may be easier to produce and more comfortable for policymakers to read, they do not capture what the Salafi-Jihadi movement means or believes. The message that ISIS is defeated, may be politically expedient when tweeted by Donald Trump and echoed by researchers including the authors of the ISIS Reader. Yet, while it is possible to produce a definition of ‘defeat’ to back such a claim, that definition is unlikely to be a useful indicator of the current state nor future behaviour of the group. Far from defeated al-Dawlat al-Islamiyya, as a fighting force, “is bigger now than it was nearly six years ago”, according to Kurdish forces – a claim supported by a CIA assessment. UN Under-Secretary General, Vladimir Voronkov, has suggested that the number is even higher, some 27,000 Daesh fighters in Syria and Iraq, with up to a 100,000 civilians having some level of dependency on the group.
In addition to expedient notions of ‘defeat’, the focus on concepts such as ‘Utopia’ are artefacts which result from Western researchers’ tendency to view material through their Western-centric lens. A progressive approach would focus on understanding what the intended audience understands by the material such groups produce, and be able to quote prior Salafi-Jihadi material to back that interpretation. In effect, progressive Terrorism Studies would focus on reading the lips of the Salafi-Jihadi movement, as Reuven Paz suggested over a decade ago.
Progressive commitment to scientific methods to escape the impressionistic and statistically unsound representations of data in orthodox Terrorism Studies:
The failure to uphold statistical methods in orthodox Terrorism Studies has become systemic. Methodologically flawed, statistically unsound, unpublishable garbage is now talked up within the orthodoxy of Terrorism studies as ‘data science’ by professors and published in journals or circulated as ‘special reports’. This section provides a critique of the unscientific approaches to data and statistics considered acceptable within orthodox Terrorism Studies. The adoption of a progressive approach to Terrorism Studies would demand a clear break from this flawed research, putting robust methodology above tweetable headlines.
Orthodoxy claims decline – time for a reality check:
While production of media content by IS has fluctuated, some commentators have sought to coerce the data into a linear direction – a so-called decline. This section examines how the narrative has been constructed and shows that committing to the decline narrative has meant overlooking some serious methodological flaws and fluctuation in content. The decline narrative was built by shifting the goalposts both in terms of definition and time-periods rather than robust statistical analysis. In fact, while some claimed consensus around the decline narrative – a robust statistical analysis reveals average weekly video output increased in both quantity and longevity of production between 2017 and 2019.
Neo-Colonialist tendency to devalue ideas in Arabic:
This section unpacks some of the methods widely accepted within orthodox Terrorism Studies to show how they devalue material in Arabic in favour of English language sources and Western-Centric interpretations. A progressive Terrorism studies would focus on the primary language of the Salafi-Jihadi movement (Arabic).
Decline narrative as strategic communication tool:
The so-called decline has been more than a narrative deployed in commentary; it has also been used as a strategic communication tool. This section highlights the need for genuine scientific methodologies, appropriate statistical analyses, and robust conflict of interest reporting to ensure the field can escape the current coagulation of mediocrity and rebuild confidence in the academic output.
Progressive commitment to robust statistical analysis; the end to Mc_Data:
Scientific methodologies and robust statistical approaches can lift orthodox Terrorism Studies out of the current malaise of mediocrity, and enable the field to embrace the opportunity available through evidence-based research and a stronger data culture.
A progressive Terrorism studies, using robust data science and evidence-based analysis, is important because contrary to the dominant narratives of IS having collapsed or been in terminal decline, al-Dawlat al-Islamiyya (IS) used the time on the open front in Iraq and Syria as an educational opportunity, to build a base of supporters running into the thousands. This is why al-Dawlat al-Islamiyya, as a fighting force, “is bigger now than it was nearly six years ago”.
As such, the theology which groups such as al-Dawlat al-Islamiyya sought to promote, will remain, will endure and, when given the opportunity of fertile soil, it will expand visibly when it suits their strategic cause.
Much has been written – and claimed – about the importance of the “Nashir” setup for the online presence of IS. By its logo, most times despite some variations, Nashir is easy to identify, even for non-Arabic speakers. As outlined before, Nashir is part of the IS ecosystem of online operations, but by no means “the” core spine or the central hub. From the start of jihadist online operations in the pre-9/11 2001 era, they have been resourceful, creative, highly adaptive and keen to adapt to new possibilities showcasing a high degree of innovation of ensuring to fulfilling – in jihadist mindset – the divine command of militant actions in real-life and a coherent flow of content framed as da’wa for the electronic and non-electronic realms.
In short, whatever is possible online, jihadists have been keen and adventurous from start to tamper with and follow a best-practice use that develops from a user perspective to ensure their wide range of violent, pro-violent, non-violent content stays up for as long as possible. The same habitus accounts for jihadist battlefield experiments and making use of scarce resources – as in early of the Iraq war who remembers the handles of shovels re-used as butts for pieced-together Dragunov sniper rifles?
“For the time being, for as far as we know, IS is not present on the internet anymore and we will see how fast, if ever, they will regain service”, according to Belgian Federal Prosecutor Eric Van Der Sypt after a massive takedown of IS accounts and networks on Telegram, IS was quick to kick back into action within about twelve hours. As the Nashir accounts had been culled, a big fuss was being made of the importance of IS having lost its core network.
IS creates content and pushes it out via dispersed networks. While this was centered on Telegram as the main dissemination hub, the Europol-led takedown of IS networks on that platform had the consequence that the networks formerly confined to Telegram are now on over a dozen of platforms and services similar to Telegram. Needles to write, the use of ‘outside’ links to/for the ‘surface’ web continues uninterrupted – but you need to monitor a lot of platforms now to ensure collecting as much as possible IS hubs (from Telegram, yes IS was back quick, to TamTam, Hoop, BCM, etc. etc.).
Cross platform use furthermore has a higher level of resilience as links to respective platforms are exchanged and increasingly a need for a exchange of quick private messages is required to receive ‘trusted’ links, including selected Nashir channels to avoid further takedown (including a Facebook messenger link).
Back to the Nashir
With Nashir alive and kicking on over a dozen of platforms, posting/reposting ‘Amaq content, new videos, new written releases (al-Naba’, collected statement of Abu Bakr etc.), Nashir has regained a presence in the blogging sphere.
Sharing a bit.ly link, first on December 18 within Tamtam and also within Telegram, this particular link was clicked over 19,000 times since its creation on December 10, 2019.
up-to-date content, ‘Amaq statements claming various attacks in MENA, the Sahel, West Africa, the current al-Naba’ edition, martyr poster – screengrab of the Nashir site.
Where are consumers most likely located – VPN use distorts yet nobody uses a VPN to switch to a restricted country.
and another example of diversification – the problem with the very temporary inconvenience as an “IS user” on Telegram due to the end of November Europol cull has enabled to re-enable the Telegram network and over a dozen other platforms as back/ups / parallel use to decentralized da’wa operations online to ensure a persistent presence of up-to-date and ‘historical’ content of primarily Arabic sources that matter gravely to IS.
Many column inches of commentary have been dedicated in recent months to the purported shift from Telegram to other platforms. We have shown previously that despite efforts to ‘cull’ jihadi channels on Telegram, disruption did not have a meaningful impact on the core network. This core allowed jihadi groups to maintain a persistent presence. The greatest impact of that attempted disruption appears to have been the much tweeted about inconvenience caused to pundits and commentators who had only been able to access the peripheral Jihadi channels and Nashir News network that were deleted in the disruption effort.
In this post we look at the content sharing network between January and May 2019. This produces a strategic overview of the network, to assess whether the network has been forced to evolve how they use the platform.
The analysis shows that at present the Jihadi network on Telegram is vast and remains functional. The URL sharing in core groups indicates core users are not currently preparing to make the jump to another platform.
Overview:
The primarily Arabic Jihadi
Telegram Network is very large, spanning 9,000 channels / groups and has
produced over 1.7 million updates.
al-Dawlat al-Islamiyya, AQ,
Taliban and pro-Jihadi supporters all connect into a single network
which also draws on theological content at the Salafi-Jihadi Nexus.
This network has shared
over 31,489 Unique URL from 486 domains / subdomains between
January and May 2019. Active content sharing is still occurring on the surface
web, despite punditry to the contrary.
By contrast there are very
few links to the dark web, highlighting how important remaining on the
surface web is for the Jihadi movement.
The most frequently used domains
do not offer a serious alternative to Telegram. In the period to May 2019, the
behaviour previously seen in the transition between Twitter and Telegram of
mass link sharing to the accounts on the new platform is not currently being
repeated.
A model of the information
flow between platforms which are used within the jihadi information ecosystem continues
to exhibit a dispersed network comprised of beacons, content stores and
aggregators.
Tech resources, such as apps,
disposable phone numbers, encrypted email, and VPN are an important part of
both the Telegram network and the entire information ecosystem.
Data
Using the curated feed of human verified jihadi channels and groups archived by BlackLight between January and May. This dataset contains 1.7 million updates of which 878,795 (approximately 50%) were forwarded from other channels and groups.
Analysis of these messages
produced a network of over 85,000 connections (content sharing or cross
posting). The network is made up of 9,000 accounts and groups. The connections
between nodes show that groups of channels form specific clusters, each of
which containing some common theme or allegiance to a Jihadi group.
As discussed in previous posts
there is a dispersed network with many accounts that have some importance to
the network (rather than one or two very important accounts – which would make
the network vulnerable to disruption).
As in previous analyses, ISIS,
AQ, and Taliban channels all appear in the same interconnected network. This is
often because:
they draw on similar other
channels (those with a specific historical or theological focus for example) or
pro-Jihadi channels /
groups who share the overarching theology and purpose, but do not have specific
organizational allegiance, aggregate material from both al-Dawlat al-Islamiyya
and AQ.
The network structure and
emergent communication architecture of the clusters indicates that they will
likely remain resilient to the removal of even a large proportion of the
channels and groups. Of the different clusters, those closest to the al-Dawlat
al-Islamiyya have the most dispersed network architecture – providing the
greatest resilience, while Taliban appear to have adopted the distributed
structure to a lesser extent.
External Links.
This section examines over 1 million
(1,048,575) URL identified in messages and captions. Within this million URL
sample the research found 31,489 Unique URL from 486 domains / subdomains.
Calculating the number of times
URL representing content on specific domains had been observed, Telegram links
appeared most frequently in posts. It is
a common observation that the domain on which data is being collected is also
the most frequently linked to domain in the dataset, as users often include the
link for a channel or chat in their posts.
Domains as proportion of total observations
Looking at the number of unique
URL gives an alternative perspective. It shows that while Telegram links appear
frequently, they are a relatively small number of URL appearing frequently. In
contrast, there are relatively higher numbers of URL from other domains, each
of which appear relatively infrequently. This is logical, as many URL outside
Telegram host a specific piece of content, and hence it is shared when it is
released and subsequently falls out of use.
Number of different URL per domain
Examining the URL from outside
Telegram provides an overview of the other locations within the Jihadi
information ecosystem. This shows the number of times domains were observed in
posts.
Similarly, analysing the domains
by the number of different URL shared from that domain, shows how the
information ecosystem combines branded content from jihadi groups, located on
content stores and aggregators, with a wide range of other material including
mainstream news sites.
From this we find:
Despite the claims Jihadi
groups have not been driven off the surface web, sites such as archive.org,
telegra.ph, and justpaste.it are frequently used as Jihadi content stores and
aggregators.
None of the most observed
domains offer a serious alternative to Telegram. In the period of adjustment,
which occurred in the autumn of 2015 and Spring 2016, Jihadi twitter accounts
regularly shared links to Telegram channels to allow sympathisers to maintain
access to the Jihadi information ecosystem. In the period to May 2019, the
behaviour previously seen in the transition between Twitter and Telegram is not
currently being repeated.
Flow across the Ecosystem.
In examining the flow of users across the ecosystem in 2019 we
find there are two distinct clusters, one focused on tech and the other on
Jihadi content and related news. This uses the same method as was discussed
during the GRNTT
conference at Brookings.
The tech cluster on the lower portion of the graph fulfils
an important role for the movement, as it provides access to services such as VPN,
disposable / free phone numbers and a range of communication programmes
distributed as .apk files (Andriod Package File).
Overview of network graph showing traffic across Jihadi Information Ecosystem
The content cluster features platforms from the three main
roles in the Jihadist information ecosystem:
The signposts including
Telegram and Facebook,
Content stores such as
Archive.org, Google Drive, imgur, and Files.fm
Aggregators such as
Justpaste.it and Telegra.ph
Annotated network image
Other findings of note;
Obedient Supporters and Nashir 1440 are content aggregators which provide content downloads on the surface web.
Tgho.st – is a file sharing system native to Telegram. Tgho.st operates by users sending the file to a Telegram Bot, the bot subsequently returns a URL where that file can be downloaded by anyone using the download link in a browser. The service advertises that “These files are not deleted and will always be available for download”.
Videopress – URL to Videopress were frequently extracted from videos posted on the earlier version of Jihadology, although without the full Jihadology page / URL. Such a finding illustrates the importance of focusing on the Jihadi primary language, Arabic, rather than drawing conclusions from fringe languages, particularly English. However, this is likely to fall out of use following the recent update to the site.
Conclusion
The primarily Arabic Jihadi
Telegram Network is very large, spanning 9,000 channels / groups and has
produced over 1.7 million updates.
al-Dawlat al-Islamiyya, AQ,
Taliban and pro-Jihadi supporters all connect into a single network which also
draws on theological content at the Salafi-Jihadi Nexus.
This network has shared
over 31,489 Unique URL from 486 domains / subdomains between January and May
2019. Active content sharing is still occurring on the surface web, despite
punditry to the contrary.
By contrast there are very
few links to the dark web, highlighting how important remaining on the surface
web is for the Jihadi movement.
None of the most observed
domains offer a serious alternative to Telegram. In the period to May 2019, the
behaviour previously seen in the transition between Twitter and Telegram is not
currently being repeated.
A model of the information
flow between platforms which are used within the jihadi information ecosystem
highlights a dispersed network comprised of beacons, content stores and
aggregators.
Tech resources, such as
apps, disposable phone numbers and email, and VPN are an important part of both
the Telegram network and the entire information ecosystem.
Many Telegram channels and groups operated by Jihadi groups, distribute lengthy Arabic documents.
An analysis of the content shared by one such channel, ‘The Caliphate Library’ Telegram Channel shows how the Jihadi movement thrives on lengthy documents that sets out their theology, beliefs, and strategy.*
Overview of findings:
This individual library contained 908 pdf documents, which collectively contain over 111,000 pages. This is far from what one might expect from a movement which thinks in 140 characters, as some Western commentators suggest.
In addition to the material produced by Dawlat al-Islamiyya, the channel;
republished earlier writing through Maktabat al-Himma, a theological driven publication house of Dawlat al-Islamiyya.
shared earlier work produced by al-Qaeda
distributed historical and contemporary Salafi writing which intersects with their theology.
ISI era is an important part the identity for Dawlat al-Islamiyya – over 15% of the pages in ‘IS media products’ category originate from that period.
While 10% of PDF were encrypted, most documents were produced using tools easily available on most modern laptops.
Not one of the texts envisages a ‘Jihadist Utopia’ nor proposes a ‘Utopian narrative’. The idea of a ‘Utopian Narrative’ is an artefact of Western misinterpretation. It is not rooted in the texts of of Dawlat al-Islamiyya nor their predecessors.
The following infographic summerises the analysis of over 1000 documents in this Caliphate Library.
*The Caliphate Library is a loose translation of its actual name, as at time of writing the Channel is still live.
Exclusive for the supporters (message on Telegram)
Text reads:
#exclusive for the supporters (munasireen) and companions (ashab) of the raids (al-ghazawat) on #platforms of social media:
More than 500 links to electronic releases (isdarat) of the Islamic state that are not eligible for #deletion by the will of god, we ask god to anger the kuffar, the apostates, the hypocrites.
These links by the will of god do not get deleted all the while these will help the munasireen in their raids of social media platforms.
Share and deem the reward (ajr) and we advise you [to place these links] in the comment section on YouTube.
We warn you after placing your trust in god to use a VPN and to ensure to enforce technical security measures for the protection for the raiders on the social media sites. (raiders in Arabic is stated as ashab of the raids).
We will continuously renew [this collection of links protected from removal] until we have more than 1000 links, god willing
Experiment with the links, share them and reap your reward.
The release of this collection of ‘500 links’ through pastethis.to highlights the theological underpinning of the actions taken by the media mujahidin.
This
includes:
The nature of
rewards in the Jihadist belief system.
Theological
underpinning – reaping your reward, ajr
Murabitin,
Ghazwat and the Ribat.
Jihad – Media
– Activism – Militancy – Documenting the Struggle Online to Influence Target
Audiences
Isdarat – the
groundwork of Online Jihad by AQAP, first generation
The different
roles platforms play within the ecosystem.
The role of
the website jihadology within the jihadist ecosystem.
Rewards
in the Jihadist Belief-System
“Conveyed by ‘Ali, may god be pleased with him: “whoever inspires his brother to jihad will be rewarded likewise upon every step of this endeavor of the worship of the Sunna.”
Cited by Abu Mus’ab al-Zarqawi, “Join the Caravane”, January 4, 2004, citing in length ‘Abdallah ‘Azzam’s “Join the Caravane”, referenced furthermore in jihadist literature to historical scholar Ibn Nahhas.
To give readers a deeper nuanced insight
into the above statement issued on Telegram, we will decipher a few keywords / concepts
that are in most cases absolutely clear and easily understood when issued by
Arabic native speakers, born as Sunni Muslims, to their core target audience:
Arabic native speakers, born as Sunni Muslims. The message was transmitted across
the Jihadi
Telegram network.
Jihadists are religious people (if we like
it or not) who over the past 40 years have been prolific writers to craft a
specific theology. The
theology of Islamic State (IS), al-Qaeda (AQ) and any other Sunni extremist
groups, is based on Arabic-language religious scriptures, not just Qur’an and Sunna, but also references elements of
the rich 1,400-year long tradition of Islamic writings. Yet, as penned by
Rüdiger Lohlker, there is a lack of willingness to deal with the writings and
motivations of jihadist subcultures and their inherent theology. The term theology
is provocative, referring to the specific type of rhetoric and thinking
regarding the relationship between humans and god. While it may be comforting for
some to describe al-Baghdadi as ‘monstrous’, or a female follower as a ‘witch’,
academic study can make greater progress if focusing less on the moral outrage
and instead focusing on how Sunni extremists actually articulate, pitch, and
project their messages.[i]
Within
the ecosystem of jihadist writings, including historical authors that matter
for modern jihadist groups, many theological concepts are identifiable – if you
are able, and so inclined, to read the easy findable electronic PDFs. With
the apparent inability to read basic Arabic jihadist texts or fully understand
videos (which are 99% in Arabic in the case of IS), the majority of keywords
and textual content remains behind a veil.
Conversely,
for any Arabic reader versed in Arabic-language jihadist writings, the speeches,
audios, images and videos they produce clearly contain key theological
concepts. Similarly, for those with an understanding of the socio-cultural
context of the intended audience, even the non-Arabic language products have a
clear theological meaning. Unfortunately, these theological concepts have passed
largely unnoticed in the pop-science analysis of English-only magazines such as
AQ’s Inspire, Dawlat al-Islamiyah’s Dabiq and the multi-lingual Rumiyya
dominates the ‘research’ output have created an absolute win-win situation for
Jihadist groups.
With
the neglect to either treat Arabic language extremist sources as primary data[ii]
or entering it into evidence to relate the use of language for non-Arabic IS
products, Sunni extremist propaganda (including the pro-jihadist ‘salafist’
materials) targeting a non-Arab(ic) audience, attacking open, inclusive
societies, continues without much interruption. Hardcore texts of violence
include lengthy citations, textual references and include sources of Qur’an and
Sunna used by contemporary ‘Salafist’ text books projected via the Internet in
respective languages into European societies.
The
art of the jihadist pen, or “scholars of jihad”, as extremist scholars of this
subculture refer to themselves, is to express a coherent theology, referencing
historical authors such as Ibn Taymiyya or Muhammad ibn ‘Abd al-Wahhab, and to
embed citations or references to Qur’an and Sunna. With the establishment of
over 300,000 pages of Arabic text since the 1980s, all available online if you
know where to look يا لغوي, jihadists have developed a specific
hermeneutical reading of scripture and project their actions as the active
application of what is defined in writing as divine law, the will of god, the
commandments, absolute rulings that must be enforced to be a ‘pious believer’ –
and be eligible for paradise.
Texts authored by the “scholars of jihad” include
references and citations of linguist dictionaries such as Lisan al-Arab, tafsir
works and sometimes ridicule religious curricula taught in MENA schools
claiming the references of jihad (for example) are either omitted or taught in
a wrongful way. In order to understand groups such as IS, you must be literate
in Arabic and be able to comprehend the propaganda that is often well versed in
religious references and sources – this is the habitus that extremist groups
exploit to address their primary, single most important key target audience:
Arab native speakers.
Religious extremists have no easy, cozy relationship with an intervening
deity that to them is real, this is not limited of course to this context. For
religious extremists in general, the relationship to god is personal and
intimately – while socially re-enforced based on human interpreted divine
commandments etc.
How most of
the intended audience orders their reality is that;
an intervening deity is real,
articulated in the jihadist framework, this is a world they pass through, referencing an authentic hadith,
after this world they hope their actions will be deemed such that the intervening deity permits them entrance to paradise, reference – among many – i.e. Qur’an 3:169.
Hence statements of those either passively ‘martyred’ by air
strikes, or during combat when not having actively sought it, as well as the
istishhadi operatives, suicide or ‘martyrdom’ bombers who deliver their
explosives actively to their targets, are often introduced by Qur’an 3:169:
“Think not of those, who are slain in the path of God, as dead. Rather, they are alive with their Lord, they are bestowed with provision.”[iii]
This mind-set is further sanctioned by citing Qur’an 2:154, to
back up the above statement:
“Do not say that those who are killed in God’s cause are dead; they are alive, though you do not realize it.”[iv]
The stories of ‘martyrs’ enable the narrator to present the
individual as a ‘true’ Muslim who indeed lived, fought, and sacrificed for
implantation of the divine definition as set in Qur’an, 3:146 to widen the
conviction of “being alive with God” in the afterlife (akhira):
“Many prophets have fought, with large bands of godly men alongside them who, in the face of their suffering for God’s cause, did not lose heart or weaken or surrender: God loves those who are steadfast.”[v]
The jihadist, in his self-perception, is part of “bands of godly
men” and as such have remained steadfast, reluctant of their own physical safety
or lives – after all, humans are tested by god in this world to decide who will
be rewarded in what way in the next world. Furthermore, the jihadist sources
emphasize that individual believers are expected to have “spent” their lives
and their wealth “on the path of God”. Qur’an 9:111 is cited to provide an
alleged theological and judicial framework:
“God has purchased the persons and possessions of the believers in return for the Garden – they fight in God’s way: they kill and are killed – this is a true promise given by Him in the Torah, the Gospel, and the Qur’an. Who could be more faithful to his promise than God? So be happy with the bargain you have made: that is the supreme triumph.”[vi]
Many
of the theological distinctions come in deciding which actions will gain ajr –
a form of reward – and which will not, i.e. lead to “sin” or tribulations.
A shared broad mental construct, and socio-cultural context is laid out in the religious coded, Arabic language corpus of jihad – the distinction comes from how one must behave to obtain reward, which may subsequently cause you to be permitted entrance to paradise. Thus, from a linguist perspective, the jihadist language is clear and easy to comprehend. Osama bin Laden was killed in May 2011, most Sunni jihadist groups had been quick to issue statements ensuring that bin Laden was a human (and not a prophet or the like), having invested his life for the worship of god by his actions and sacrifice. Following a classical jihadi-lingual ductus, he was referred to as “the shaykh, the martyr – as we deem him to be – Osama bin Laden.”[vii]
In other releases, i.e. the death of Hamud b. ‘Uqla’ al-Shu’aybi, died in late 2001 and having been cited by bin Laden but also having had an important influence on Saudi jihadists of the 2000s, the full reference of the martyr in this framing is expressed: “we deem him to be a martyr, god is the measure of all things” (al-Jarbu’, 2002, shared in AQ forums as word document at the time). This wording was later used throughout the 1500 page strong The Voice of Jihad AQ magazine to refer to their members who had been ‘martyred’.
Steadfastness is another way of earning ajr,
and is an integral element of jihadist literature and videos. Steadfastness is
the expression of maintaining a sincere intention towards god, as your actions
of this world in the service for god will be judged to determine your status, reward,
in the afterlife.
Theological underpinning – reaping your reward, ajr
“Reward”, or ajr in Arabic, in the mindset
of modern jihadist groups and thinkers, however, is based on the ancient
understanding thereof and is two-fold:
The reward must be earned based on one’s deeds and actions for god in this world to be eligible to enter paradise after death. This is one of the main literal elements of the textual corpus of jihad. As for jihadists, jihad means an active form of worshipping and serving god, with a sincere intention, driven to fight for the protection, revenge or for the security of the jama’a ahl al-sunna; reward is earned along this way in this world with death as the new stage of life in mind. Hence popular slogans of this subculture, expressed in writings and placed in active application in many of its audio-visual releases, embody this with further theological reference points. A popular propaganda-slogan thus states that the Mujahid seeks one of the two most precious things (al-husayn): victory (nasr) or attaining the shahada, exiting this world and dwelling in paradise. This is a citation of Qur’an 9:52 and used by al-Zarqawi in the beheading video of Olin “Jack” Armstrong in 2004. The Chechen hostage takers of the musical Nord Ost in Moscow in 2002 also put up a black banner on the wall, reading in Arabic the Islamic shahada complemented by allahu akbar and ihda l-husnayyin, the reference to Qur’an 9:52. IS used this slogan, for example, in the last videos that had emerged from Mosul before the fall, framing the expected reward despite worldly – or physical loss – as a win for what comes after life in the conviction of humans who see themselves as enablers of divinity.
Reward is also a historical reference to
the physical world that early Muslims obtained as a result of raiding the
caravans of the Quraish. The “spoils” or “booty of war” are filled with
Qur’anic references to surat al-Anfal and surat al-Tawba. A physical reward
thus is based on receiving a share of the “spoils of war”, often referred to as
in Arabic as ghanima. Yet jihadists warn of focusing on the potential to make ghanima
through jihad, rather than having a sincere intention.
A 2003 article in “The Voice of Jihad”,
the first regular electronic magazine released online by AQ on the Arab
Peninsula, warns of prioritizing “taking ghanima as reward of one’s jihad”,
thus neglecting a complete understanding of the concept of jihad and the spoils
of war by omitting “when raiders take ghanima a third is their reward.” The
article continues: “the ahadith provide clear evidence whoever seeks to embark
on his jihad solely for the purpose of gaining worldly presentation, will not
receive any ajr.”[viii]
The reference of ajr in this context is
strictly related to what the Mujahid, having a sincere intention, will receive
when killed. This hadith is also used by ‘Abdallah ‘Azzam in his “Declaration
of Jihad” and further contextualized with another hadith sources: “Conveyed by
al-Nisa’i based on a stable isnad[ix] by
Abu Usama who said: “a man came to the prophet, peace and blessings upon him,
he said: “have you [ever] seen a man raiding looking for ajr, thinking about
financial gain?” The messenger of god, peace and blessings upon him said: “god
will not acknowledge anyone [as a martyr] except those who are pure and sincere
in their desire.”[x]
Ajr: Rewards in the afterlife for deeds
and actions in this world, a jihadist Telegram channel member asking for reward
for his Jaysh al-‘Izza brethren for having slain mercenaries, for their jihad
and to receive their martyrs.
The reward is also contingent on the
context in which action is taken. Anwar al-Awlaki described in Allah is
Preparing Us for Victory, when times are hard, the reward for taking action
is increased.
If it comes at a
time when things are easy then the ajr is reduced. But if the time is
one of difficulty, then the ajr is increased.
Ajr is in accordance
to the difficulty.
Comprehending the meaning and importance of ajr within the Jihadi understanding,
shows that claims in Western commentary that ISIS seeks to pursue a ‘utopian
project’ or present a ‘utopian narrative’ are based on a fundamental misunderstanding
of jihad. It is life on the ribat that is the life revered by the jihadist
movement. The reward they seek is ajr, which, if sufficient, may permit access
to janna.
Murabitin
In his
chapter on the virtues of life on the ribat, Ibn-Nahas highlights why behavior
on the ribat is among the best livelihoods.
Abu Hurairah
narrated, the messenger of god said:
“Among the best livelihoods of people is that of a man holding the
rein of his horse in the path of Allah, flying on its back whenever he hears
the call. He flies in search of killing or being killed. And a man on top of a
mountain peak or on the bottom of a deep valley, establishing prayers, paying
his zakah, and worshiping his Lord until death visits him. People see nothing
from him but good.”
Those who spend the night on the ribat are murabitin. The image of murabit on the classical ribat is important to the
understanding of the identity and approach of the media mujihidin today, as it
is the self-image of those on the electronic ribat. As noted:
Murabita, according to the British Orientalist, translator and
lexicographer, Edward Lane, “also signifies a company of warriors; or of men
warring against an enemy; or a company of men having their horses tied at the
frontier in preparation for the enemy; or keeping post on the frontier; and in
like manner”.[xi]
To translate and conceptualise the Arabic term ribat can be very contentious. The term
is frequently referred to in both jihadist videos and in print / online
literature in the context of religiously permissible warfare; in a modern
meaning it could loosely be translated as “front”.
Ribat is prominent due to its reference in the 60th verse of the eight
chapter of the Qur’an, the Surat al-Anfal
(“the Spoils of War”). It is often used to legitimize acts of war and among
others found in bomb making handbooks or as part of purported theological
justification in relation to suicide operations – for decades. Extremists consider
the clause as a divine command stipulating military preparation to wage jihad
as part of a broader understanding of “religious service” on the “path of god.”
Ribat as it appears in the Qur’an is referenced in the context of
“steeds of war” (ribat al-khayl) that
must be kept ready at all times for war and hence remain “tied”, mostly in the
Islamic world’s historic border regions or contested areas. In order to “strike
terror into [the hearts of] the enemies of Allah”, these “steeds of war” are to
be unleashed for military purposes and mounted (murabit – also a sense of being garrisoned) by the Mujahidin.
The relevant section reads:
“Prepare against them whatever
forces you [believers] can muster, including warhorses,[xii] to
frighten off [these] enemies of God and of your, and warn others unknown to you
but known to God. Whatever you give in God’s cause will be repaid to you in
full, and you will not be wronged,” Qur’an 8:60.
RibatRibat
has two main aspects in contemporary jihadist thinking. First, the complete
60th verse of the Qur’an is often stated in introductions to various
ideological and military handbooks or videos. While some videos issue ribat in connection with various weapons
and the alleged divine command in the jihadist reading thereof. As the real-world fighting Mujahidin are considered “strangers” (ghuraba’) in this world fighting at the
very edge of worldly perception, thus being ‘mounted’ at the front (ribat) and the borders (thughur), the background networks of the
‘media Mujahidin’ must be accredited
likewise. Thus, in the past fifteen years, ribat
has migrated and expanded into the virtual “front”, as the murabit who is partaking in the media work has been equated with
the actual Mujahid fighting at the
frontlines. In a similar understanding, the physical “frontier” or “border” has
shifted to the ‘arm-chair jihadists’, the professional media teams embedded
with fighting units as well as the global network of media supporters as the
value of the media jihad is
understood and used on a tactical and strategic level by militants to further
their cause.
Ghazwa
The advantage exploited by the muribiteen in early Islamic history is
the ability to move rapidly, have a heavy impact on the target, and move on.
This is encapsulated by the concept of Ghazwa (غزوة), a raid or expedition.[xiii]
Jihadist groups around the world have used the word to describe their physical
operations such as “ghazwat al-asir”, a campaign by the Islamic State of Iraq
(ISI) to avenge the imprisonment of Muslims.[xiv] In
2006, IED attacks in Bouzareh near Algiers, was valorised as “Ghazwa Bushawi”
by the “the Media Council of the Groupe Salafiste pour la Prédication et le
Combat” before the group merged with AQIM.[xv]
Today these raids occur on online, Channels on Telegram act as
coordination points through which these raids are organised. In one approach,
Jihadi groups post the time and target for the raid that day. They provide
supporters with pre-prepared tweets or URL which supporters can copy and post
directly onto platforms such as Twitter and Facebook.[xvi]
These raids seek to cause sudden spikes in activity to spread their message
broadly, there is no attempt at permanence as they know the accounts they use
will be removed. In fact, they plan for it. Just as the self-image of horse
backed warrior, the users in the online ghazwa arrive suddenly, have an impact
but do not intend to stay around.
A longer discussion of these concepts appears in: Ali Fisher, Netwar
in Cyberia
Jihad – Media – Activism – Militancy – Documenting the Struggle Online to Influence Target Audiences
Incitement to jihad is well established within the online dominions, where media activism can be achieved from any place, in- or outside of conflict zones. With a ring of decentralized media workers supporting those who are ‘embedded’ with fighting elements, the jihadi media has in the past two decades greatly improved in providing professional made videos and writings from real-life combat zones for computer-, tablet-, smartphone-, and television-screens throughout the world. The ‘media mujahid’ as a role model promotes those ‘embedded’ front-line cameramen in particular, without whom the quality and quantity of jihad groups worldwide would not have a lasting impact or relevance. In the jihadists’ self perception, the;
“media [worker] has become a martyrdom operative without an explosives belt, for they are entitled to these merits [of jihad]. Furthermore, haven’t you seen how the cameramen handle the camera instead of carrying Kalashnikovs, running in front of the soldiers during attacks, defying death by exposing their chests to the hails of bullets!?’[xvii]
Rather, the
media worker in the field has turned into a role model of adoration just like
any hardcore fighter or martyrdom operative, and is portrayed by the jihadi
media likewise and accredited as an istishhadi,
as someone who actively has sought out and attained the shahada. The wish to become a martyr, having a “clear intention” (as
described above) as proof of their piety and their loyalty to god, being ‘true’
practitioners of Islam expecting compensation in the afterlife.
This powerful
new role model is backed by the accreditation of the value of the quantitative
and qualitative online propaganda:
“Haven’t you seen the cells responsible for expanding the electronic media files (isdarat), how they enter the most dangerous and most fortified areas and how they disseminate the isdarat of the Mujahideen in the heartlands of the hypocrites (munafiqin)!?”[xviii]
Media
workers, on the other hand who are not directly embedded with fighting units,
are not of lesser importance. For they ensure the process, editing, the layout,
translating and subsequent publication.
Isdarat – the groundwork of Online Jihad by AQAP, first generation
Since the early 2000s with the first
generation of AQAP being active in Saudi Arabia while ISI used the power vacuum
in Iraq, the Internet has become the medium of communication and
exchange of information for Jihadis. In that time, the Internet has been
increasingly used on a very efficient and professional basis. Countless online
Jihad communities had come into existence. Not only have a number of online
forums been established, but there had been (and still are to a certain extend)
blogs and traditional websites available, which spread and share a broad
variety of documents and data in general. Jihadis often refer to the Arabic term
isdarat for data, that consists of general publications, videos (suicide
bombings and last testimonies, roadside bomb attacks etc.), sermons or general
statements and declarations – but also technical information such as
bomb-making, weapons guides or chemical crash courses. Since the early 2000s
the Internet has become a 24-hour online database, where any user with
sufficient knowledge of the Web (and Arabic) is able to access, understand
and/or download these isdarat. In an interview with al-Qa’ida’s first
online magazine (2003), Sawt al-Jihad (Voice of Jihad), Abu Jandal
al-Azdi explains the reasons for these isdarat and states that „these [isdarat]
guide the youth of Islam and they [the Mujahidin and their leaders] have
published books, statements, audio-files, and videos.”[xix] Today
the users exchange useful tips and practical hints, discuss ideological and
theological issues and allow an insight into their tactics and strategies
within the online forums. The usage of the Web has been systematically funneled
by the al-Qa’ida cells on the Arabian Peninsula and provided the framework for
extensive online operations as of writing (2019).
Isdarat was also the name
of one of the most prominent early IS websites. It has been a website and
telegram channel where users could access the content. For IS, with the
changing circumstances of being able to mainstream “jihad” more due to the
acquisition of territory on an unprecedented level, videos are a key element to
convey what AQ projected in writings in a more compelling audio-visual format.
The different roles
platforms play within the ecosystem.
Websites such as Isdarat, exist within an ecosystem of content stores, aggregators
and beacons. Since the emergence of the media mujahidin on social media in 2013,
the different elements have formed part of a multi-platform
zeitgeist.
Likewise, the telegram post (above) shows how the interconnectivity
between platforms continues to allow jihadi groups to share information and
avoid disruption on social media and the surface web.
The message is shared on Telegram (beacon), directing users to
Pastethis.to which functions as the aggregator for the links. The aggregator gives
the location of each individual file (or content store). Traffic between
platforms can be harder to locate because often all that is visible on the
aggregator is the URL rather than the actual content.
The PasteThis.to page contained a list of video titles and URL where these
are stored. In this case the content store is most often Videopress or WordPress,
with many of these originally posted on Jihadology.
Jihadology in the ecosystem of online jihad
Analysis of the URL made available via the Pastethis.to pages, shows
a clear tendency toward using particular content stores.
Domains in URL shared on Pastethis.to
Advertised as unlikely to be removed, the most common links lead
to Videopress. Videopress is notable for being used by Jihadology to store
material. As discussed previously,
the videos are not only accessible via the site but via the underlying
videopress URL which opens the video in a browser rather than on the site.
Having located the underlying videopress URL jihadi sympathizers are able to
share the location of the content via the aggregator, benefiting from the stability
of content posted on Jihadology, but without the user having to visit the site.
Sub-domains in URL shared on Pastethis.to
Similarly, where subdomains appear in the URL, the most common
subdomain is azelin.files, followed by videos.files. This image shows how the
videopress link which was shared on pastethis.to can be found in the source
code for Jihadology.
URL in Jihadology source code
This is not a
one-off example, another aggregator (still available using Google cache) shows
an audio file available via the azelin.files subdomain.
Now deleted aggregator accessed via google cache
While the
other links are dead (apart from the archive.org) content posted on Jihadology
and hosted on WordPress is still available.
The
Pastethis.to aggregator, features the video No Respite. The shortcode used in
the aggregator is the same as the one available via Jihadology.
This video is
also notable as Abdul Hamid was arrested
… “after he posted a four-minute-long Isis propaganda video called No Respite”,
which was viewed more than 400 times on his Facebook page”. Hamid subsequently
“pleaded guilty to disseminating a terrorist publication” according to the Evening
Standard.
Conclusion
Analysis of
this release has shown,
The theological underpinning of the actions taken by the media mujahidin, and the theological aspects cannot be separated from their strategy. They are integral parts of jihadi thought and cannot be treated as window dressing to be stripped away at the whim of Western researchers.
The persistent presence of the Swarmcast is in part due to the agility of the media mujahidin. They use a diverse range of platforms and share the location of specific content stores via beacons and aggregators.
The Jihadology website, as shown previously, is exploited within the jihadist ecosystem as a content store. URL of the videos are extracted from the site to be shared with jihadi sympathizers. These links are shared in such a way that the video plays in the browser rather than on the site – ensuring the individual accesses the content in a Jihadi context.
Notes:
[i] Rüdiger Lohlker, Theologie der Gewalt. Das
Beispiel IS, Facultas: Vienna, 2016.
[ii] Baart
Schuuhrman, Terrorism studies and the struggle for primary data, November 5,
2018, https://www.sv.uio.no/c-rex/english/news-and-events/right-now/terrorism-studies-and-the-struggle-for-primary-dat.html[iii]
All following verses of the Quran are quotations of: Muhammad A. S.
Abdel-Haleem, The Qurʾan (Oxford:
Oxford University Press, 2004).
[iv]
See for example Mu’awiyya al-Qahtani, “The Biography of the Hero Abu Talha
al-Ansari”, Mu’assasat al-Mas’ada
al-I’lamiyya, 2012.
[v]
Ibid.
[vi]
For a contextual reading, Nico Prucha, “Abdallah ‘Azzam’s outlook for Jihad in
1988 – “Al-Jihad between Kabul and Jerusalem””, Research Institute for European
and American Studies (2010), http://www.rieas.gr/images/nicos2.pdf.
[vii]
For example in the as-Sahab video release la tukallafu ila nafsak, June 2011.
[viii]
This part of the sawt al-jihad (no.3, Ramadan 1424), is the exact same as
provided here: https://library.islamweb.net/newlibrary/display_book.php?ID=3&startno=0&idfrom=2&idto=8&bookid=81&Hashiya=3#docu
and also referenced by, for example, Yusuf al-Qaradawi: https://www.al-qaradawi.net/node/2072[ix] Chain
of transmission.
[x]
‘Abdallah ‘Azzam, I’lan al-jihad, electronic version, 1997.
[xi]
Prucha, Nico, “Jihadists‘ use of Quran’s ribat concept”, in: Janes Islamic
Affairs Analyst, August 2009
[xii]Ribat al-khayl[xiii]
Ghazwa is also the name of a magazine distributed by Lashkar-e-Taiba in
Pakistan.
Hanley Jr, John T., et al. The Anatomy of Terrorism and Political Violence
in South Asia Proceedings of the First Bi-Annual International Symposium of the
Center for Asian Terrorism Research (CATR) October 19-21, 2005, Denpensar,
Bali, Indonesia. No. IDA-P-4096. INSTITUTE FOR DEFENSE ANALYSES ALEXANDRIA VA,
2006.
[xiv]
For discussion of bombings linked to ghazwat al-asir
see:
https://onlinejihad.net/2010/04/11/isi-embassy-bombings-in-baghdad/[xv] Nico
Prucha, Online territories of terror: how jihadist movements project influence
on the Internet and why it matters off-line, PhD Thesis, Universität Wien |
Philologisch-Kulturwissenschaftliche Fakultät (2015) (p. 280)
[xvi]
Prucha, Nico. “IS and the Jihadist Information Highway–Projecting
Influence and Religious Identity via Telegram.” Perspectives on Terrorism
10.6 (2016).
[xvii]
Al-Manhajjiyya fi tahsil al-khibra al-i’lamiyya, first part, 18. This
ideological handbook is part of a lengthy series sanctioning the media work in
general, published by the media groups Markaz al-Yaqin and al-Furqan in May
2011.
[xviii]
Ibid.
[xix]
sawt al-jihad number 11, 17.
And why this exploitation allows Jihadists to maintain a persistent information ecosystem.
This is the second in a series of posts that uses data science to sort the anecdotal observation from evidence-based research. After the hype, what about the data? Part 2.
The recent reports
of UK government pressure on Automattic and WordPress to remove content posted
on Jihadology, has resulted in plenty of opinionated tweets and longer form commentary.
As the UK government has claimed that Jihadology could
be used as a convenient platform by extremists, the first past of the post
looks at;
Whether this is a theoretical
possibility, or if there is evidence that Jihadology is used by jihadist
groups, and if so, how and for what purpose do they use it?
The second part of the post examines whether this is an isolated
case;
is there evidence that individual
pieces of Jihadist material which pundits and researchers post on social media
and the surface web are subsequently exploited by Jihadist groups.
Is there evidence that when the aggregated
impact of individual tweets and surface web posts are analysed as a collective
behaviour, rather than as isolated events, that this creates a resource
which is exploited by Jihadist groups – resulting in pundits unwittingly becoming
part of the Jihadist information ecosystem?
The evidence shows that Jihadology:
is used by jihadist
groups as a convenient platform through which to share access to videos, and
text documents.
is a source of media to
feed JihadistContent Aggregators, allowing material to be shared within a
Jihadist context while not being subject to removal.
is
recommended to fellow Jihadist sympathisers as a good place to find content,
emphasizing the content on Jihadology does not get banned or removed.
The data further shows:
More broadly, there is a network of researchers and commentators who are publishing Jihadist material on the surface web. The aggregated result of these individual actions is the unwitting creation of an online resource which hasbeen exploited by Jihadist groups and hasbecomepart of the Jihadist information ecosystem.
It is perhaps the greatest irony that Government sessions to discuss how to make it harder for Daesh to spread their message online, are often attended by researchers who frequently publish that same content on the surface web and social media.
Introduction
Jihadology describes itself as a ‘clearinghouse’ for jihadi
primary source material, original analysis and translation services. As a
result, it allows researchers who lack the expertise or experience to find content
themselves to publish research.
For those with genuine access, Dawlah al-Islāmiyah, recently
released an archive of over 5,200 Media Foundation and Wilayat produced video
files (which included multiple language versions of some videos).
They have also followed the tradition of jihadist media groups of
releasing numerous astuwanat [barrels / أسطوانات] of content. Each “barrel” contains a
collection of material organised by theme, organisation, or specific media
production. While previously astuwanat were made available via CD, DVD or ISO
file, they are now more often released via torrent or direct download in Telegram
– although the banner images promoting them often still contain an image of a
disk.
In combination with the ‘Archive’ channels on Telegram, policy
professionals and researchers with requisite knowledge, language skills and
experience, should be able to access Jihadist material without using Jihadology
as a crutch with which they can limp through what should be basic research
tasks for those doing more than an undergraduate research essay.
Afterall, given their inability to master the simple task of finding content, it is perhaps unreasonable to expect those leaning on the Jihadology crutch to provide an authentic interpretation of what they find on the site. Furthermore, basing analysis on what is found on the site, leaves the researcher studying what is posted on Jihadology (which is not exhaustive), rather than the range of material extremist groups actually produce.
European
Context
The current discussion of Jihadology and pressure on WordPress, occurs within the context of the UK government position that:
“It is reckless to publish terrorist propaganda online without safeguards to stop those vulnerable to radicalisation from seeing it”.
It should perhaps be needless to state that those who are
vulnerable to the message of Jihadist groups must as some point become
consumers of jihadist material or messages, if they are to be anything other
than theoretically vulnerable.
For Jihadist groups da’wa is given via printed material, images,
audio, video, speeches, conversations or communicated through specific
behaviours. Through this range of delivery methods, individuals are provided
with role models and theological guidance for actions, and in which they can
use online platforms to gain unfiltered access to the universe of content that
is of great importance to jihadist groups.
It is in this context that a report
from the UK Parliament’s Intelligence and Security Committee (ISC)
criticised social media companies for not acting fast enough to remove content.
Furthermore, the FT reported
that UK security officials argue Jihadology:
“could
be used as a convenient platform for extremists to access videos and messages
from outlawed terror groups such as ISIS and al-Qaeda”. (emphasis added).
However, various European countries take different views on what to do about sharing content from groups they deem illegal or extreme. At the time of writing, in France Jihadology is unavailable.
Germany threatens fines for companies not reacting quickly enough to content posted, and the UK imposes prison time for those sharing this content. For example:
December 2018 – Abdulrahman Alcharbati (diagnosed as bipolar according to the BBC report) was jailed for seven years, for offences including posting ISIS videos on Facebook.
December 2016 – Abdul Hamid, who Judge Peter Rook QC accepted had ‘significant physical and mental health problems’ was sentenced to two years in prison for posting the video ‘No Respite’.
At this point, in the UK while two men with mental health problems have been sentenced to years in prison for posting ISIS videos, another man is lauded by academics for making the same videos freely available.
This raises important and complex issues as global communication networks exist alongside international borders, and the extent to which Jihadist groups and sympathisers use Jihadology as a platform to access content, and furthermore, the role Jihadology plays within the jihadist information ecosystem.
Reusing individual links
In the New Netwar, we observed that Jihadist groups and their supporters locate individual URL of videos posted on Jihadology and reuse those links within the context of their own channels and groups.
Jihadist Telegram channels re-purposing individual URL from Jihadology
A similar theme was picked up in recently in the Twitter discussion,
following the story in the Financial Times, noting it is not just the
videopress links (which have previously appeared on Jihadology) but references
to the site itself. As @Charlie_KDN
noted in a tweet;
Each week 100’s of @Jihadology_Net links are published on ISIS TG chans and groups to rebroadcast suspended content on other platforms.
For example, links to videos including ‘Honor is in Jihad’ and
issues of al-Naba that have been posted on Jihadology are shared on pro-ISIS
Telegram channels (as are links to a site run by Pieter van Ostaeyen).
Jihadist Telegram channels re-purposing individual URL from Jihadology
Once the videos are neatly archived by Jihadology – the links are then shared as collections. For example, on a single day in October 70 unique Videopress URL were observed being shared a total of 1,125 times via core Telegram channels.
Jihadist Telegram channels re-purposing individual URL from Jihadology
A potential additional advantage to sharing the Videopress links is that it opens a video player in a web browser, providing a seamless experience for the viewer and ensuring the content is shared in a pro-Jihadist context rather than with a research focus.
Feeding
Content Aggregators
In addition to using individual links to content, Jihadist supporters use Jihadology to feed material to their content aggregators. For example, a PasteThis.at link shared in a pro-ISIS Telegram channel, provided a single page from which users could access over 100 issues of al-Naba.
PasteThis.at page re-purposing individual URL for al-Naba up to issue #147 posted on Jihadology
The actual files from which this PasteThis.at
page link to were stored on azelin.files.wordpress.com. Using this method
Jihadist groups and supporters can provide access to content from within the
context of their own discussions, Telegram groups, and theological worldview.
In addition, when Jihadist supporters build individual websites to aggregate content, they have been observed using Jihadology as a source of content. In this example the aggregator was built using Cloud9 which operates as part of Amazon AWS.
The al-Ajnad and al-Furqan options both direct uses to the pages on Jihadology for those entities. Those links have been clicked over 350 and 240 times respectively.
Content aggregator directs users to Jihadology
This cloud9 based aggregator also
contained a section in which users could select videos by clicking on the banner
advertising their chosen video. Many of the links made available in this
section were to videopress files, the link for which had previously been shared
on Jihadology.
Clickable banners using videopress URL many originally posted on Jihadology
As in the previous
example, Jihadology is used to provide a stable source for much of the content.
However, the way the site is built a user may be unaware of the actual file
location – allowing the aggregator to promote a Jihadist worldview
Why Jihadists
use Jihadology:
In addition, to
re-using individual links or feeding content aggregators, pro-jihadist or
pro-IS Telegram users have been observed posting recommending Jihadology as a
source of material. Much of these comments follow a similar theme.
In this example, the Arabic reads.
“and I prefer links to the
site jihadology which is specialized in studying jihadists as it states,
therefore it neither gets deleted nor
any content it hosts gets banned“
Within core IS channels links to
the main IS category on jihadology are shared, leading to videos, video series,
or the weekly editions of the al-Naba’ magazine:
كامل اعداد صحيفه النبأ من واحد إلى 110 ماعليك الا بالنقر على الرقم
وتتحمل. برابط غير قابل للحذف لن يفتح الرابط الا بعد تشغيل ألفي بي ان vpn
#نشر
The text reads:
“All editions of the al-Naba’ magazine, from edition 1 to 110,
just change the number in the link and download it. This link will not be
deleted and do not open this link without employing a VPN.”
Another message advised:
هنا في هذه الروابط صفحات
#لكامل_إصدارات_الدوله_الاسلاميه_من_ولاية_حلب_بروابط_غير_قابله_للحذف
“this site gives you all the links of the releases from wilaya
Halab of the Islamic State, the link does not get deleted.”
Conveniently, for the author of this message in a core IS channel,
viewers can quickly get the current videos by IS from the province of Aleppo.
It is important to the author of the Telegram message, that while
content may be removed elsewhere it is kept in a safe and orderly manner on
sites like Jihadology. This allows IS to project their content in an orderly
manner, allowing placement of – in this case – geographic located collections
to the benefit of ISIS.
This evidence demonstrates it is
not that users theoretically “could’ use Jihadology as a
convenient platform for extremists to access videos and messages from outlawed
terror groups such as ISIS and al-Qaeda” … Jihadists
supporters and sympathisers do use it to access individual URL,
feed their content aggregators, and recommend
it to their peers because the content is not removed. Unfortunately, the
recommendation that users adopt VPN to access Jihadology may blunt the efficacy
of traffic analysis, a problem which may also be compounded by the many
commentators and policy professionals who have recently claimed to be regular
users.
This means that while tech and
social media companies are pressured, and threatened with fines, the content is
still findable and IS supporters and sympathisers know it. As a result, ISIS (and other Jihadist groups) do not
have to struggle to maintain a persistent presence for their content online, in
addition to using Telegram, they can release the content and then allow sites like
Jihadology to archive it for them.
The defence of Jihadology:
In defence of Jihadology, there have been many commentators saying
a version of:
“the site is a vital research portal that provides a valuable service for academics, policymakers and journalists researching Islamist extremism”.
There have been numerous researchers who have recently been tweeting
that they regularly use Jihadology – effectively announcing they rely on
Jihadology as a crutch for their inability to locate or access Jihadist content.
Penetrating Jihadist networks (beyond the entry level Nashir type channels)
relies on being able to recognise the theologically encoded references and
follow the content. As such, one wonders if in future those publicly stating
they use Jihadology regularly may reflect on why they consider themselves qualified
to conduct the complex task of analysing content when they can’t complete the
simple task of locating that content by themselves. The inability to find
content, and thereby having to rely on what is posted on Jihadology, may
perhaps explain why Arabic language jihadist materials are so rarely referenced
or cited in research.
As locating content is a significant part of research production,
and given the number of people currently claiming they use Jihadology to find
content, it appears Aaron Zelin deservers credit on many more research papers
than he is currently recognised as making a significant contribution.
One wonders why commentators on Twitter talk of the valuable
contribute made by Aaron and Jihadology, only to reduce that contribution to a
reference to jihadology.net in a URL buried in a footnote when that same author
publishes their research?
Others steer away from the ‘value’ of the contribution, and
instead take the view that the “Content by itself does jack shit”.
This follows the rationale that;
“How the message is received and incorporated into a broader worldview and acted upon is one aspect of what we, perhaps too vaguely, call the “process of radicalization”.
This particular researcher visits Jihadology several times a
week – one assumes to view content disconnected from “the
process of radicalisation” and thereby to study it doing “jack shit”
if he follows his own logic, but who knows.
The description of what is broadly an ideational model of
behaviour change highlights wider factors in the process. Nobody lives in a
vacuum, but ideational models still require an idea to fulfil a fundamental
role in this type of behaviour change process. As demonstrated above, links are not shared in
a vacuum. Jihadist supporters have become adept at accessing the content posted
on Jihadology and sharing it via Telegram channels and through Content Aggregators
which project and reinforce their theologically driven worldview. It is in this
context that potentially vulnerable people may access Jihadist media production.
It is naïve to imagine the content posted on Jihadology can only be
accessed by visiting Jihadology.net and searching the site for content.
While Jihadology was never intended to be a platform for jihadist groups, the data shows Jihadology has become a repository for video and written material exploited regularly by ISIS / Jihadist supporters and sympathisers. The links to specific videos or collections of material are shared within the context of aggregators or Jihadist Telegram channels, where the meaning of the content is discussed and Jihadology is recommended as a source that can be relied upon as it is not be deleted.
Just
Jihadology?
The data show users in Arabic language Telegram channels recommend Jihadology to their peers as a location for them to view or download content. However, is Jihadology an isolated case or is it unfair for European governments to pick on Jihadology and Aaron Zelin specifically? Is this an example of a wider research sub-culture which actively publishes Jihadist content across social media and the surface web?
Wider Research Sub-culture
Rumiyah
To test whether there is evidence that Jihadology is an isolated case, we turn to the releases of the multilingual magazine Rumiyah using the #Rumiyah hashtag. If Jihadology is an isolated case, we would expect the initial release of each edition of the magazine, to be met with a surge of tweets about it on Twitter from ISIS accounts and supporters. The example below shows that the surge of tweets occurred.
Spikes in traffic around releases
Closer analysis of the data reveals that there are relatively few
original tweets, but many retweets. This tends to indicate that there is less
emphasis on conversation / interpretation and instead a greater focus on spreading
information.
If these spikes were driven by ISIS supporters tweeting until their
accounts are suspended one would expect to see many accounts being active for
one release and a separate network active for the next release. One would not
expect there to be a network infrastructure to span numerous releases. The way
this would happen is if accounts were able share news of the release, without
being suspended.
To examine nature of the network of retweets (which make up a large proportion of the overall tweets), we used Social Network Analysis (SNA) of the retweets. SNA shows the structure of the network through which news of the magazine release flows. In the case of Rumiyah releases, SNA shows that there was a network of accounts which spans numerous releases.
While Twitter suspends many pro-ISIS accounts, this prominent cluster is able to maintain a persistent presence. A closer examination of this persistent cluster shows it is populated by Academics, Commentators, Reporters and organisations selling monitoring services.
Network of accounts tweeting / retweeted about Rumiyah
However, are these accounts coincidentally engaged in discussion of the
meaning of ‘Rome’ and ‘Romans’ within Jihadist theology, lacking deeper Arabic
connectivity, or is this announcing the release of the magazine and / or
sharing content from it?
Note: the coincidental appearance is not as ludicrous as it first sounds. One of the ‘Lend me your ears’ series of videos featuring John Cantlie was released on the same day as an entirely disconnected toga party. Both just happened to use the hashtag #lendmeyourears at the same time. And both ISIS and toga partiers were surprised by the juxtaposition of content.
In reality a review of the tweets shows that this is not coincidental. The network of academics is publishing announcements about the release of the magazine, including the banners ISIS created to promote the release, and sections of the magazine, such as text and graphics.
Tweets featuring Rumiyah announcement or content
The sharing of content
likely provides greater reach for the content than ISIS could have achieved
alone. Reaching as many people as possible was after all one of the main
purposes of producing and releasing the magazine, and media material more
broadly.
The release of Rumiyah
issues was not the only times academics and commentators have probably provided
greater reach and longevity for Jihadist content than ISIS could have achieved
alone. Looking back over data from recent years, across a range of video announcements,
audio releases, and claims of attacks a pattern emerges.
Speeches:
al-Zawahiri – April 2017
In April 2017, al-Qaeda leader al-Zawahiri released a new speech. After an initial tweet by Elizabeth Kendall, covering the key points from the speech @marypgkeating responded posting a link to the speech on YouTube with ‘English subtitles’, while others join in retweeting.
Tweets sharing al-Zawahiri speech details
al-Baghdadi
In November 2016, al-Furqan released a speech by al-Baghdadi. The release was greeted by: “Wow – it’s Baghdadi” from Mr Winter, followed by the name of the audio so others could find it and comments on the contents of the speech.
Could this type of tweeting
be used to find content? To test this and mimic a ‘naïve searcher’ trying to
find content, a search on Google.co.uk in May 2017 (six months later) used the
title of the speech as tweeted.
In the results,
an
English translation posted by al-Naba on archive.org,
a
swath of other related ISIS documents including an English translation of a
speech by the Abu Muhammad al-Adnani; Official spokesman for the Islamic State
and
an
ISIS video from the province of Ṭarabulus which had a similar name. That link
lead to the video posted on Jihadology.net.
The test shows that this information could lead uninitiated users to access ISIS content. In addition, the data highlights that individual unwitting actions rapidly combine to provide easy access to a range of genuine ISIS content.
Battle footage and executions
Mosul
In addition to speeches, there
were numerous ISIS videos of the fighting in Mosul. For example, the image from
this video release from Ninewe province, would have allowed those able to read Arabic
or Latin characters to search for the title of the video.
Tweet announcing video release
The ‘naïve searcher’ test
was conducted in May 2017, using google.co.uk with the English title. This returned
both the first and second parts of this series. At the time, ten of the top
fifteen results provided a link to the video.
The same test in December 2018 still returned the video via
Jihadology.net. This despite the same researcher (who
now receives funding from Facebook) giving a bullish claim about the difficulty
of finding IS content on social media and surface web.
He recently claimed;
“It isn’t just a case of googling “IS propaganda” and seeing what comes up (any more). This stuff isn’t readily available on the surface web like it used to be. If you’re not on Telegram or in a forum, the options are increasingly limited.”
Beyond the parochialism and evident Western habitus which leads a researcher to imagine the go-to search terms used by Jihadist supporters would include the word ‘Propaganda’, he is also apparently oblivious to the evidence that is available to anyone who bothered to do even the simplest research.
Just putting the content of one of his own tweets into a search engine delivers … IS propaganda. His assurances sound bold, but like many others that circulate within the field, it could not be considered “research-based in any rigorous sense” to use Alex Schmid’s phrase. That is “a very polite, typically academic way of putting it”, Nafeez Ahmed would likely suggest another.
Just like the previous insistence on media ‘decline’, fully
fledged collapse, content production correlated to territory, and the ‘naïve
notion’ of Utopia, claims about the findability of content have joined the list
of claims which have turned out to be, as Rüdiger Lohlker recently highlighted,
“an empty fog of words without inner content”. Quoting German philosopher G. W.
F. Hegel, the section quoted by Rüdiger Lohlker continues:
This sort of chatter, though lacking the idea of philosophy, gains for itself a kind of authority through its very prolixity and arrogance. Partly this is because it seems almost incredible that such a big shell should be without a kernel…
G. W. F. Hegel
While those at institutions with links to Facebook insist content is hard to find, the actions of ‘experts’ who publish Jihadist content enable even uninitiated individuals to locate the content about the fighting in Iraq and Syria (and elsewhere). In this particular case, the publishing of announcements, pictures, statements and other ISIS material was not an isolated to a couple of examples. The Twitter timeline documented here shows the extent to which publishing of ISIS content made widely available.
Attacks
Responsibility and da’wa
One of the ways in which
terrorist groups, of almost all types, have sought to extend their influence,
is through claiming responsibility for attacks. Announcing attacks and
recognising those responsible for them is important for ISIS and the Jihadist
movement. As Abu Mus’ab al-Suri wrote in his Call for a Global Islamic
Resistance;
The issue of individual jihad was a great da’wah success. It had great influence on awakening the spirit of jihad and resistance within the ummah, and it transformed unknown individuals such as al Diqamsa, Salman Khatir, Sayyid Nusayr and Ramzi Yusuf into becoming symbols of a nation. The crowds cheer their names, people’s thirst for revenge is satisfied, and a generation of youth dedicated to the Resistance follow their example
Similarly, Anwar al-Awlaki explained (while discussing the
seventh meaning of victory);
Prevail here means the prevailing of their da’wah and not always their battles. They could loose (sic) the battle but their da’wah will achieve victory and be available. Nobody can stop their da’wah. The idea is that it will keep this group strong from generation to generation.
Seventh Meaning of Victory, Yusuf al ‘Uyayree Thawaabit ‘ala darb al Jihad (Constants on the Path of Jihad) Lecture series delivered by Imam Anwar al Awlaki (Quoted as transcribed)
For jihadist groups,
statements claiming an attack or detailing a battle are not simple information
updates, they are part of da’wa; spreading their theology by retelling the
actions of the believers. Afterall, as Abdullah
Azzam argued, “Jihad is da’wah with a force”.
Following the 2017 attack
on the Manchester Arena ISIS issued statements in Arabic and English. A review
of data from the time shows a range of researchers, including those based in
the UK, either tweeted or retweeted the actual announcement, with collectively
100 retweets of just the four versions identified below.
Tweets sharing announcements of the attack in Manchester
A snapshot from Twitter on the day following the attack at the Manchester Arena, finds the OSCE held the World Counter Terrorism Conference in Vienna. The conference included discussion of how to make it harder for terrorist groups to spread their message, while some of those at the event were also publishing ISIS content on social media.
One of the attendees tweeted;
about the OSCE event,
the OSCE response to the attack in Manchester,
republished the ISIS claim of the attack,
before returning to the content of the OSCE event.
The
tweeting of announcements was not a single ephemeral event, claims of
responsibility were also shared for the attack on the Champs Elysees.
This has also continued in 2019, the current Director of ICSR published ISIS claims of responsibility for the bombing which killed US personnel in Manbij, Syria
Claims by Islamic State published on Twitter
The tweeting of this material from Rumiyah to speeches, videos and announcements, has the potential to increase the reach of Jihadist messages. In addition, as shown with the reuse of links to content on Jihadology, Jihadist supporters can also reuse that URL for their own purposes. In the example below from January 2019, an account with a username referencing ISIS responds to a story of Troop withdrawal by posting a link to a section of an ISIS video.
ISIS video with 35k views
Among
the numerous notable elements:
this specific clip from an ISIS video has 35,600 views on Twitter, despite claims by researchers this material is difficult to find (for them).
the original video clip was not posted by an ISIS, or Jihadist, account. It was an OSINT focused account, which a supporter subsequently used. This is one of the ways in which Jihadist groups exploit content sharing by commentators and pundits.
What
this indicates is an increasingly sophisticated approach in which a user can
create a seemingly pro-ISIS account, find a version of an ISIS video posted by
an OSINT commentator and subsequently exploit the reticence of Twitter to
remove such content from non-jihadist accounts by reposting the URL to the
tweet containing the video.
An approach fit for a 21st Century Sisyphus, Yes Minister or Monty Python
Tech companies are understandably reticent to remove content published by researchers. Yet while European governments pressure social media companies to remove content, and try to create upload filters and image hash databases etc. European governments are also giving things of value (salaries, grants, travel, and hotels) to researchers who publish this same material on social media.
As a result, while CTIRU, EUROPOL, Twitter and social media companies more broadly were making efforts to reduce circulation of ISIS content on social media – academics and for-profit organisations publish and republish jihadist content on the same social media platforms, and to an audience beyond that which ISIS could achieve alone.
It is perhaps the greatest irony that Government sessions to discuss how to make it harder for Daesh to spread their message online, are attended by researchers who frequently publish that same content on the surface web and social media.
It is an approach fit for Yes Minister, Monty Python or a 21st Century Sisyphus.
Why this matters to Jihadist groups:
First the evidence above
shows that jihadist groups recognise the opportunity to give da’wa by aggregating
links to content posted by pundits and researchers. Second, when Western
organisations and pundits immediately repost jihadist content, this is then
re-posted in pro-ISIS Telegram channels and used to galvanize the mujahid
vanguard.
Third, part of their
theological understanding of da’wa is to spread their message as widely as
possible. This goal of broad dissemination is considered successful if others
hear the message of their theology. This has been
covered in numerous documents written by a range of leaders of the jihadist
movement. These documents have emphasized that spreading their theology as
widely as possible is an important component of jihadist activity.
For example, Yusuf al-‘Uyairi recorded in his Constants on The Path of Jihad,
Jihad will continue until the Day of Judgment (or as referenced in numerous ISIS videos, ‘Until the final hour’), which also connects it to Sahih Muslim / Book 41 / Hadith 6924
Jihad is not dependent on a particular land, but Jihad must be part of your life,
Seventh meaning of victory: victory of your idea (Anwar al-Awlaki’s translation is quoted above)
Viewed collectively, in the context they are used by Yusuf al-‘Uyairi, these points recognised that there will always be people to reach, both those to fight and those to give da’wa. Therefore, spreading the message is a constant for the Jihadist movement.
The importance of this task was also covered by ibn Nuhaas, who highlighted the The Virtues of Encouraging Jihad. He quotes Surah al Nisa 84,
“So fight, [O Muhammad], in the cause of Allah; you are not held responsible except for yourself. And encourage the believers [to join you] that perhaps Allah will restrain the might of those who disbelieve. And Allah is greater in might and stronger in punishment.”
The phrase “you are not held responsible except for yourself” is
interpreted by Jihadists within the context of da’wa to mean that they will be individually
judged on whether the individual sought to spread the word, not on whether
those who heard that message subsequently responded. Therefore, their
interpretation of the duty is to find ways to spread their theology.
The
purpose of the da’wa effort was also noted by Ayman al-Zawahiri. In his General
Guidelines for Jihad, (as-Sahab media) there were two elements to the
communication or media work.
First: Educating and cultivating the Mujahid vanguard, which shoulders, and will continue to shoulder, with the permission of Allah, the responsibility of confronting the Crusaders and their proxies, until the Caliphate is established.
Second: Creating awareness within the masses, inciting them, and exerting efforts to mobilize them so that they revolt against their rulers and join the side of Islam and those working for its cause
In more specific guidance he wrote:
Focus on spreading awareness amongst the general public so as to mobilize it. Similarly, focus on spreading a greater level of awareness and understanding amongst the Mujahid vanguard to create an organized, united, ideological, and aware Jihadi force that strongly believes in the Islamic faith, adheres to its rulings, shows humbleness to the believers and deals with the disbelievers with firmness. At the same time, full effort should be put in immediately to ensure that people with scholarly and propagational abilities come forth from within the ranks of the Mujahideen so that our message & belief set may be preserved and the call to Jihad may be spread amongst Muslims.
Researchers publishing the announcements are, in the eyes of jihadist groups who produced the original statements, spreading the da’wa which these acts were intended to give.
In the jihadists mindset, these researchers are tools for their divine mission. The reposting of links to Jihadology clearly indicates the Jihadist mindset on the issue – these are not two separate worlds but one interconnected ecosystem, however unwitting some of the participants are within it.
Why
Pick on Aaron?
The data on content releases, from magazines to speeches, to videos and announcement of attacks, shows that Jihadology is not alone in publishing Jihadist content.
The data analysis shows a research sub-culture has developed in which posting jihadist content on social media is an acceptable norm; Aaron Zelin is just one part of a much wider network of researchers publishing ISIS and jihadist content on social media and surface web.
Given the extent to which publishing jihadist content on social media and the surface web has become a norm for pundits who make up this research sub-culture, it seems both unfair and entirely ineffective for European governments to target Jihadology and Aaron Zelin as if he and his website are an aberration distinct from the research sub-culture of which he is part.
To what extent can European governments threaten social media companies with fines (or individuals with prison time), when those same governments work with, give things of value to, or employ the researchers and commentators who post that same content on the same social media platforms?
Ethical approaches and leadership.
The kneejerk censorship vs. academic freedom arguments move nothing forward. It merely provides more time for Jihadist groups to distribute their material by exploiting the current way .
Researchers who publish ISIS theologically driven content (and
almost invariably without real analysis) often claim to offer these materials
to a wider audience for the ‘greater good’. The evidence shows, they are
complacently enabling the jihadist movement to remain a coherent online
presence – a situation inevitably to the advantage of the movement.
Years ago, when I had the privilege of working on a project with researchers at CEOP, their professionalism, integrity and approach eclipsed that which currently passes as the norm in what might loosely be termed Terrorism Studies.
They had a robust approach to mental health. Upon finding new material or images of child exploitation they did not franticly tweet them. Upon hearing of an attack, they did not reach for their phone to alert journalists to their availability for interview. Finding indecent images of children on a new platform, they did not begin pitching the story of the ‘next big thing’ to whoever would take it. When serious events caused the issue to make the headlines, they did not use it as a reason rush to the TV studios and tweet about being on TV.
These researchers did not spend any time on how many Twitter followers they had, and they certainly didn’t tweet about how many followers they had. From my limited experience of working with researchers from CEOP, they avoided behaviours that could make the situation worse, that could make the content more widely available, or could exacerbate the suffering of victims. From the evidence above, the study of terrorism is generations behind their example.
After the hype about the removal of ISIS Telegram channels, this post examines the data on the information ecosystem to sort the anecdotal observation from evidence-based research.
Central to the authentic understanding of the Jihadist movement is the ability to locate and understand the content. Unfortunately there is tendency among some researchers to give prominence to and draw conclusions from the limited content they can locate. This is a problem we have highlighted previously including in the New Netwar and in earlier posts:
Content, especially Arabic language content, is fundamental to the movement, yet the lingual & theological expertise to understand it is almost constantly neglected and lacking in research. This blind spot allows the jihadist movement to reorganize and recuperate out of view of contemporary research and commentary.
Notes on the ecosystem
The
difference between the content commentators hype and tweet about because they
can find it, and the content that is important to the Jihadist movement, is one
of the fundamental and often poorly understood distinctions in contemporary
academic study of the Jihadist movement.
Two recent events, the recent purge of Nashir channels on Telegram and the UK government putting pressure on Jihadology, have, individually and collectively, highlighted how important it is for researchers to have a sufficiently nuanced understanding of the movement to be able to locate content themselves. Research should get beyond the easy to find Nashir network, which are there to give entry level access to the movement.
The inability to penetrate beyond a few entry level daily news
channels, leads to challenges compounded by the lack of serious data analysis
on the extent to which material produced by ISIS, AQ and other Jihadist groups,
is actually available online.
In just the last few weeks there have been conflicting accounts.In one a researcher with funding from Facebook claimed that “This stuff isn’t readily available on the surface web like it used to be. If you’re not on Telegram or in a forum, the options are increasingly limited.” While Peter Neumann defended Jihadology by saying “the online nature of this makes it ubiquitous”.
Something being ubiquitous tends to be mutually exclusive with not being readily available. What these comments and other commentary has laid bare is how often commentary is based on opinion and anecdotal observation, at best, rather than evidence-based research.
In the following pair of two posts we look at the data behind these two events.
This first post examines theextent to which the removal of fringe Nashir channels on Telegram impacted the information ecosystem.
The second uses data analysis to test the recent UK government suggestion that Jihadology could be used as a convenient platform for extremists to access videos and messages from outlawed terror groups such as ISIS and al-Qaeda, to answer the question whether Jihadology is used to access content by groups such as ISIS and examine whether some researchers and commentators play an unwitting role in the jihadist information ecosystem.
Part 1: The Telegram Cull.
BBC Monitoring reported that what they term the ‘Telegram cull’ followed attempts by ISIS to “beef up its presence on the platform”. Focusing on Nashir, BBC Monitoring continued …
jihadist group operates a network of multiple channels and groups on Telegram under the “Nashir News Agency” brand.
The focus on Nashir channels was repeated by others, Pieter VanOstaeyen noted; “Remarkably large take down of ISIS Telegram channels and groups tonight”and in a later Tweet “Of around 60 Nāshir News accounts I was following 4 remained active”.
Shiraz Maher, had similar problems, “It was a rough morning for me. Major take downs of the channels/groups I was in”. These and similar observations fueled the impression that the jihadist network was under significant pressure. “Not only ISIS accounts, everything that even remotely reeks of Jihad is getting hit” tweeted Pieter Van Ostaeyen. He later joked “There was a major disruption in the Dark Side of The Force, but they’re back again”
Jihadist Ecosystem – 10 December 2018
To ascertain the actual impact, a review of 410 human verified Jihadist groups and channels on Telegram, using the same methodology as the previous post, was conducted. It showed that the information ecosystem has remained resilient. The data from the 410 channels and groups shows that many survived the purported cull.
Followers
The followers / members of the groups remain at an average of over two thousand with the largest garnering over 70,000 followers. There are over 200 channels with more than 400 followers. However, it is currently unclear if these are different individuals in the groups – as discussed in an earlier post.
Mean 2,870: Median 452: Maximum 71,807
Longevity
The time elapsed since the creation of the channel / group also provides clear evidence that the information ecosystem has remained uninterrupted. The average length of time a channel has been operating is greater than one year (Mean 380.1 and median 380.6 days).
The average length of time a channel has been operating is greater than one year
The longevity of channels shows that recent chatter about losing access to channels has had an impact only on those with limited access to Jihadist channels, and who struggle to locate the content. For the wide range of jihadist sympathisers who can read and understand the meaning of the content, access has continued largely unabated.
Views
Access to content shown by views on individual posts shows that users are accessing the content. Even an overly cautious estimate where all duplicate view counts are removed to avoid double counting, produces a conservative 135,256,000 total views.
The Network
Decoding the Swarm logic of the Media Mujahidin is in part based on understanding the network structure.
Analysing the last 500 posts from each of the channels / groups and extracting the data of posts forwarded from other channels / groups /users, produces the network graph.
The graph has 3410 nodes in total, 2831 (83%) of which are part of an interconnected giant component.
The network perspective confirms what the longevity and availability of accounts had suggested, that the information ecosystem has remained intact.
This is a repeat of much of the analysis on Twitter where an inability to find content was misconstrued as evidence the content did not exist.
Unfortunately, as we demonstrated in the New Netwar, at the same time that researchers were reporting they could find very little content on Twitter, the platform was used to drive a large portion of traffic to Jihadist content. Similarly, today commentary based on the narrow soda straw of Nashir and similar channels is to miss a wide range of the content, communication and meaning which occurs on Telegram.
Information Ecosystem on Telegram
Despite the chatter about a ‘wave’ of channels and groups becoming inaccessible and commentators losing access to large numbers of Nashir channels the network is still there and remains accessible to those who know how to access it. From the user perspective, the removals would barely rank as an inconvenience.
The findings of this post repeats the findings of the previous analysis of Telegram Channels. Those findings were:
The graph shows that Jihadist Telegram Channels form a series of interconnected clusters.
Despite attracting the greatest attention from Western commentators, the Nashir News cluster is a tiny part of the overall ecosystem.
AQ and ISIS clusters are distantly connected.
There is a cluster of Jihadist sympathizers and supporters which align closely with neither ISIS nor AQ.
The creation of content archives on Telegram ensures users who see themselves as murabiteen (horse backed warriors guarding Muslim territory) are able to access the content needed to conduct ghazawat (raids) onto other platforms.
Major IS cluster
A closer look at the major IS cluster shows 27 statistical interconnected clusters. Each of these clusters has a particular thematic focal point, including a range of specifc theological elements. Within this major cluster there is a further ‘core’ group of channels, as well as channels relating to a range of Wilayat.
Even within just this major IS cluster there is significant range of material which provides a deeper view of the movement than may be realised if one begins from a perspective that nashir are a core part of the ecosystem. The idea of ‘core nashir’ is an oxymoron. Losing access to nashir would barely register if one genuinely has access to the breadth of content at the core which, needless to say, is mainly in Arabic.
Soda Straws
Adopting a soda straw mentality, where a small part of the information ecosystem – in this case the Nashir network – is talked up and given an overblown sense of prominence in the jihadist information ecosystem, inhibits the authentic understanding of ISIS and Jihadist activity online.
The soda straw mentality comes in numerous forms the study of jihadist groups and terrorism more broadly. Some are based on the very limited access to content. The recent commotion and Twitter chatter about a wave of Nashir deletions highlights many of those caught up with this particular issue as genuine access would deter anyone from thinking the nashir represent anything other than a small fraction of the activity.
Other soda straws appear from the way individuals handle data or cherry pick time periods which create impression of decline, strong correlations to territory and ‘full-fledged collapse’. Nafeez Ahmed’s The Astonishingly Crap Science of ‘Counter-Extremism’ should be required reading.
Conclusion
This post replicates the earlier finding that the Nashir network is part of the ISIS Telegram network, and a very small part of the overall information ecosystem. As a result, much of the contemporary commentary suggesting Telegram (and largely Nashir channels) is the place to get content, is based on anecdotal observations derived from gazing down a narrow soda straw at an often fringe group of accounts. There is a largely unobserved network of accounts which meant those with genuine access barely noticed the removal of Nashir channels.
If commentary is based on a level of access to Jihadist content where removal of the Nashir channels is noteworthy, for example for the authors of this report,one has to view claims that the research authentically reflects the breadth of ISIS activity with a degree of skepticism.
Central to the authentic understanding of the Jihadist movement is the ability to locate and understand the content. Otherwise the study of Jihadist groups becomes dislocated from the meaning and purpose of the movement and produces interpretations of the movement using misplaced notions of crime,rap, and the ‘naïve notion’ of Utopia. In contrast, Jihadist groups have produced tens of thousands of documents, outlining their understanding and intended application of theology. For example, Anwar al-Awlaki described;
People like Shaykh Abdullah Azzam and Shaykh Yusuf al ‘Uyayree.They wrote amazing books, and after they died it was as if Allah made theirsoul enter their words to make it alive; it gives their words a new life.
Rasoolullah (sallallahu ‘alayhe wassallam) said the at-Taifah will prevail. Prevail here means the prevailing of their da’wah and not always their battles. They could loose the battle but their da’wah will achieve victory and be available. Nobody can stop their da’wah. The idea is that it will keep this group strong from generation to generation.
Seventh Meaning of Victory, Yusuf al ‘Uyayree Thawaabit ‘ala darb al Jihad (Constants on the Path of Jihad) Lecture series delivered by Imam Anwar al Awlaki (Quoted as transcribed)
Put simply, whether it is a battle or a channel on Telegram, for Jihadists part of the victory they seek stems from ensuring their actions give da’wah. It is the encoded theological aspects such as this, rather than speculation about crime and utopia, that allows users to move beyond the Nashir based fringes. Being able to identify theological elements which allow individuals to access a greater breadth of Arabic content should be a basic requirement for anything above a degree level researcher.
Online Jihad: Monitoring Jihadist Online Communities 
