The Shift in Platform Exploitation Over Time

Session 1 of the Progressive Terrorism Studies Webinar Series. “The Persistent Online Presence: The Shift in Platform Exploitation Over Time”

How the Salafi-Jihadi movement has been able to exploit the internet to distribute their message has been a key concern of those seeking to challenge these narratives. The first webinar in the Progressive Terrorism Studies Webinar series provided a data-driven update on how the Arabic speaking core of the Salafi-Jihadi information ecosystem has continued to evolve. This is not a new phenomenon – nor restricted to the pop cultural and pseudo-scientific hype regarding al-Dawlat al-Islamiyya – rather, jihadists have been exploiting all means possible on the Internet for decades.

This research comprises over 6.4 million Telegram updates collected in near real-time since June 2017. These updates were collected from channels and groups confirmed to be part of the Salafi-Jihadi movement, stemming from Jihadist exploitation of the internet for over a decade, but focused here on their operation on Telegram. From within this vast archive of material a collection of 4 million instances of URL sharing were recorded for analysis.

The session emphasised the importance of robust design and data collection in the study of Salafi-Jihadi groups.

The subject of study needs to be identified by someone able to:

recognise the theological references and imagery,

join online groups by passing the vetting conducted by the Salafi-Jihadi movement in Arabic. If a researcher cannot respond to Q&A in Arabic, it is a sure sign they cannot enter the core of the movement.

Similarly, for analysis which examines change over time the data collection needs to occur in near real-time, as downloading weeks, months, or years after the event does not provide a credible dataset for analysis. This is because the attempted disruption from outside, internal purging of some groups, and the activity of bots, all combine to undermine confidence in time-series analysis of Telegram data collected using a retrospective approach.

The large-scale analysis provides a strategic level overview of the way the Salafi-Jihadi movement has operated since Telegram became its primary platform for communicating with supporters and acting as a core platform for their media output – in combination with other platforms since Europol’s claim of they had removed IS from the internet in November 2019. By examining the URL they share, the analysis shows the breadth of the Salafi-Jihadi presence across platforms and provides an overview into whether there are detectable patterns in their use of different online services.

A reduced version of the domain tool used in the time-series analysis shows the engagement profile of various domains in the study.

The tool can be viewed here and more detail on the analysis can be found on github.

The analysis showed:

Some platforms experience persistent engagement profiles, while others experience sudden spikes in use, or short-term exploitation.
Correlations between the use of different platforms could be used to develop a rapid alert system to locate material.
Co-citation style network analysis can be used to detect clusters of platforms which are used collectively. This would allow clusters of platforms which are being exploited in a similar way to be supported or work collectively.

The session built on 2019 the publication by Emily Winterbotham, Dr Ali Fisher and Dr Nico Prucha. This is the largest ever study of traffic between the online platforms that comprise the Jihadi information ecosystem. This study included 24 months of data from the core of the Salafi-Jihadi Telegram network and revealed the inner workings of their multiplatform communication paradigm. The paper demonstrated the different roles that platforms play within the multiplatform information ecosystem, including Telegram, Tamtam, and Matrix.

A more progressive Terrorism Studies

This I have resolved on … to run when I can, to go when I cannot run, and to creep when I cannot go.

Pilgrim’s Progress – Part 2 Chapter 6.

The role of the Feeble-mind character in Bunyan’s religious allegory Pilgrim’s Progress is to highlight the importance of continuing to make progress towards an identified goal.

A more progressive approach to Terrorism Studies could focus on extending the depth at which the Salafi-Jihadi movement is understood. This would be based on robust data science and human expertise, a focus on the primary language of the Salafi-Jihadi movement – Arabic – and the extensive archive of theologically inspired thought which the movement has produced.

It is the archive of theology as expressed and interpreted by the core of the movement which provides the best predictor of the actions of the movement. In contrast, some researchers and commentators within the orthodoxy of Terrorism Studies claim to see artefacts of their western habitus in Salafi-Jihadi material – the focus on crime, rap music, and naïve notions of a Jihadi ‘Utopia’.

Since the 1980s research has shown that the study of terrorism has struggled with availability, handling and analysis of data. Despite the length of time and frequent observations about the problems with data, rather than making progress, these problems within orthodox Terrorism Studies have remained. In addition, “the dispersed nature of much of the more rigorous, ‘critical’ and conceptually innovative research on ‘terrorism’” means that level of rigor in research is conducted outside the orthodoxy.

Over a decade ago Magnus Ranstrop highlighted the ongoing problem, which Alex Schmid and Berto Jongman originally identified back in 1988; that ‘there are probably few areas in the social science literature in which so much is written on the basis of so little research’. As a result, much of the writing in Terrorism Studies is “impressionistic, superficial, and at the same time often also pretentious, venturing far-reaching generalisations on the basis of episodal evidence”.

Rüdiger Lohlker recently recently continued this theme when he highlighted, the tendency for orthodox Terrorism Studies to contain “an empty fog of words without inner content”. Quoting German philosopher G. W. F. Hegel. The section quoted by Rüdiger Lohlker continues:

This sort of chatter, though lacking the idea of philosophy, gains for itself a kind of authority through its very prolixity and arrogance. Partly this is because it seems almost incredible that such a big shell should be without a kernel…

G. W. F. Hegel

Such is the coagulation of mediocrity within a section of orthodox Terrorism Studies that unscientific, methodologically flawed and statistically unsound commentary is talked up as ‘data science’ and ‘groundbreaking research’, while the evidentiary basis goes unquestioned within the mainstream scholarship and peer review. Over the last decade – rather than being addressed – these issues have become systemic.

Making progress

As noted in the development of Critical Terrorism Studies, “it is not enough to simply point out what is lacking in current research; a clear and realistic alternative must be provided”. Sections of the orthodox Terrorism Studies, and offshoots in the CVE industry, have an opportunity to break from the contemporary stagnation and develop a strong data culture and emphasis on evidence-based research. A progressive approach to analyzing the complex, theologically driven, Salafi-Jihadi movement, will move away from the contemporary obsession with finding so-called ‘gaps’ in the largely superficial and stagnant orthodox literature.

Many of the criticisms highlighted at the start of CTS remain within sections of the orthodoxy. CTS itself – with a focus on Western policy and Western academia – has struggled to break free from the Western frames of reference, among other challenges. The framing of Terrorism, with 9/11 as a moment of temporal rupture, still dominates CTS. This inhibits the deeper understanding of the Salafi-Jihadi movement which maintains different temporal reference points to those which dominate CTS and traditional approaches to Terrorism Studies, both in relation to time in the physical world and in relation to this world (Dunya) as an abode through which a soul passes.

To address the superficial, orientalist and neocolonialist tendencies of the orthodoxy, and the temporal framing of CTS, a progressive movement within Terrorism Studies would probe the intended meaning of Salafi-Jihadi content in their understanding of the world, rather than in a Western-centric English language dominated habitus. Critique of the orthodox Terrorism Studies has highlighted “its poor methods and theories, its state centricity, its problem-solving orientation and its institutional and intellectual links to state security projects”. Many of these problems have also concerned scholars within terrorism studies “who have long acknowledged the deficiencies and limitations of current research”.

In addition, a progressive Terrorism Studies approach would uphold standards for the appropriate use of statistical data to produce a clear break from the systemic malaise in data handling which have existed within orthodox Terrorism Studies. With a strong data culture and robust research design, a dynamic approach to Terrorism Studies could utilise the changes in the technological environment for research. This is not dissimilar from the way Salafi-Jihadi groups have adapted to the opportunities which evolving technology has created.

The way the object of study, such as the groups who make up the Salafi-Jihadi movement, choose to operate has evolved:

The evolving concept of the electronic ribat. Since 2011, members of jihadist forums have issued media strategies that encourage the development of a media mujahideen. This encouragement has been accompanied by the release of guides to using social media platforms, which often include lists of recommended accounts to follow.
By 2013, Jihadists had aggressively expanded their use of Twitter, in addition to Facebook and YouTube, especially since the outbreak of violence in Syria. This propagation effort by the “media mujahideen” was approved and sanctioned by movement leaders and contributed to the interconnected jihadist zeitgeist.
Learning from each interaction on the electronic ribat, the media mujahidin rapidly developed to maintain a persistent presence based on the speed, agility, and resilience of the Swarmcast.
In this struggle for survival, the media mujahidin have benefited from collective approaches and emergent behaviors, these have allowed a decentralised network to thrive in the face of increasingly aggressive content removal.
The media mujahidin frequently use widely available software for media production – this software would also be easily accessible to researchers to provide a window into the production methods.

In addition the current technological environment provides many opportunities for research:

Servers are cheap and easy to access – for example if you use Amazon for shopping, then that is enough to access cloud computing through AWS.
Processing power and RAM are cheaper than they have ever been, allowing relatively complex calculations and data analysis to be produced rapidly.
Most modern personal laptops and desktops have hardware sufficient to run the analysis required for many data science projects which would extend current research into the use of the internet by Salafi Jihadi groups, or ‘extremist’ groups more broadly. Of note, most contemporary material published by salafi Jihadi groups is produced on the same widely available hardware / software (more on that in a later post).
While there are many commercially available and hugely powerful ‘data systems’ which integrate a range of data storage and analytical processes within a single platform, there are also many open source programs which can be used to conduct academic research. These open sources software options may not permit all the analysis to be conducted within one platform, requiring the researcher to use a range of approaches to achieve the desired analysis.
There are many ‘how to’ guides for those aspiring to become better at using python, java, or any of the other popular coding languages. Similarly, resources are freely available which researchers can use to learn more about data science or using specific open source software more generally in their work, whether in the form of walkthroughs or articles packed with quick tips and tricks.

To build a stronger data culture will mean;

Acknowledging the problems with evidence and data which have to date beset orthodox Terrorism Studies,
Reviewers and editors robustly enforcing actual standards for statistical analysis, for example,
- if you are going to claim something such as a correlation or a long-term trend – it will need to be backed up by a statistical calculation using data acquired through a scientifically appropriate method.
- if the analysis is based on subjective ‘coding’ of data – is there an appropriate intercoder reliability score. If there is not, there is little reason for readers to be confident that the research presented would be repeatable, that coding remains unchanged over time, and that other researchers would apply the same coding definitions in the same way. Without intercoder reliability there is little reason to have confidence in the resulting ‘analysis’ rendering it largely unpublishable.
Editors and publishers insisting on clear conflict of interest reporting,
The Terrorism Studies community putting methodology above attention grabbing headlines and tweetable pseudo-metrics.
- If the methodology is flawed or the statistical analysis unsound – no matter if the ‘findings’ are appealing or even intuitively correct – the study lacks the necessary basic elements to be considered publishable research.
  - Sample:
    - If research is claiming to have analysed a sample, to what extent can the sample be considered representative of the whole?
    - Was that sample derived from a consistent methodology, or a hodgepodge of pieces cobbled together?
    - How was the sample identified and collected? In effect research design (architecture) and data collection (acquisition) to use two of Jeffrey Stanton’s four A’s of data science.
- If you cannot do the calculation to produce a statistical result, do not use the word related to that calculation e.g. correlation, trend etc.
  - Correlation:
    - When an author claims correlation – a range of questions should spring to mind; do you mean a positive or negative correlation?
    - how strong a correlation?
    - Did you use Pearson, Spearman, or Kendall?
  - Trend:
    - If a trend / trendline is claimed, what is the R-squared value? Is your line a good representation of the data?
    - A trend requires more than two or three data points.
    - Do you mean one point in time has fewer of ‘x’ than another? This is not a trend, upward or downward, one point just has fewer than the other.

Based on what is currently being published within the orthodoxy of Terrorism Studies there are a range of issues, including;

Journals specifically focused on terrorism research, a range of journals in related disciplines which have hurried to do ‘special issues’ on ISIS, and ‘research centers’ self-publishing special reports, which have published articles as if they are either unaware of the basic scientific and statistical standards or are content to publish material that they know falls short of the minimum acceptable scientific standards.
Senior researchers, including Professors, who will cite work that falls short of scientific or statistical standards without commentary or critique, some even talking it up as ‘ground breaking’ or ‘data science’.

The current state of orthodox Terrorism Studies must be judged on the behaviour of those in the discipline. Such is the coagulation of mediocrity in orthodox Terrorism Studies, senior researchers have not questioned unsound methodologies, and journals through their peer reviewers and editors, have not upheld standards. The previously observed problems of data and data analysis within some sections of orthodox Terrorism Studies have now reached systemic levels.

In a scientific discipline,

If the relevant scientific or methodological information is not present in an article submitted to a journal, then that paper is going in the bin because it does not reach minimum standards for undergraduate level work, let alone peer review.
When individuals deliver presentations, which make statistical claims about trends or correlation without any calculations, or use substandard / misleading data visualisation to support their argument, they could expect to be laughed out of the building.

If statistical and data analysis in Terrorism Studies do not adopt the standards adopted by other fields, it cannot take full advantage of the potential offered by increasing integration of data science or forms of statistical analysis into the study of Salafi-Jihadi groups.

The following series of posts examines specific tangible reasons why robust data science and evidence-based analysis is important and offers a critique of contemporary uses of data within orthodox Terrorism Studies.

A progressive focus on what events and material means to Salafi-Jihadi groups – Da’wa As Constant on the Path of Jihad:

The purpose of research is to develop deeper understand the object of study. While Western-centric interpretations of ‘utopia’ and claims the ‘West is Winning‘ or that Salafi-Jihadi groups are defeated may be easier to produce and more comfortable for policymakers to read, they do not capture what the Salafi-Jihadi movement means or believes. The message that ISIS is defeated, may be politically expedient when tweeted by Donald Trump and echoed by researchers including the authors of the ISIS Reader. Yet, while it is possible to produce a definition of ‘defeat’ to back such a claim, that definition is unlikely to be a useful indicator of the current state nor future behaviour of the group. Far from defeated al-Dawlat al-Islamiyya, as a fighting force, “is bigger now than it was nearly six years ago”, according to Kurdish forces – a claim supported by a CIA assessment. UN Under-Secretary General, Vladimir Voronkov, has suggested that the number is even higher, some 27,000 Daesh fighters in Syria and Iraq, with up to a 100,000 civilians having some level of dependency on the group.

In addition to expedient notions of ‘defeat’, the focus on concepts such as ‘Utopia’ are artefacts which result from Western researchers’ tendency to view material through their Western-centric lens. A progressive approach would focus on understanding what the intended audience understands by the material such groups produce, and be able to quote prior Salafi-Jihadi material to back that interpretation. In effect, progressive Terrorism Studies would focus on reading the lips of the Salafi-Jihadi movement, as Reuven Paz suggested over a decade ago.

Progressive commitment to scientific methods to escape the impressionistic and statistically unsound representations of data in orthodox Terrorism Studies:

The failure to uphold statistical methods in orthodox Terrorism Studies has become systemic. Methodologically flawed, statistically unsound, unpublishable garbage is now talked up within the orthodoxy of Terrorism studies as ‘data science’ by professors and published in journals or circulated as ‘special reports’. This section provides a critique of the unscientific approaches to data and statistics considered acceptable within orthodox Terrorism Studies. The adoption of a progressive approach to Terrorism Studies would demand a clear break from this flawed research, putting robust methodology above tweetable headlines.

Orthodoxy claims decline – time for a reality check:

While production of media content by IS has fluctuated, some commentators have sought to coerce the data into a linear direction – a so-called decline. This section examines how the narrative has been constructed and shows that committing to the decline narrative has meant overlooking some serious methodological flaws and fluctuation in content. The decline narrative was built by shifting the goalposts both in terms of definition and time-periods rather than robust statistical analysis. In fact, while some claimed consensus around the decline narrative – a robust statistical analysis reveals average weekly video output increased in both quantity and longevity of production between 2017 and 2019.

Neo-Colonialist tendency to devalue ideas in Arabic:

This section unpacks some of the methods widely accepted within orthodox Terrorism Studies to show how they devalue material in Arabic in favour of English language sources and Western-Centric interpretations. A progressive Terrorism studies would focus on the primary language of the Salafi-Jihadi movement (Arabic).

Decline narrative as strategic communication tool:

The so-called decline has been more than a narrative deployed in commentary; it has also been used as a strategic communication tool. This section highlights the need for genuine scientific methodologies, appropriate statistical analyses, and robust conflict of interest reporting to ensure the field can escape the current coagulation of mediocrity and rebuild confidence in the academic output.

Progressive commitment to robust statistical analysis; the end to Mc_Data:

Scientific methodologies and robust statistical approaches can lift orthodox Terrorism Studies out of the current malaise of mediocrity, and enable the field to embrace the opportunity available through evidence-based research and a stronger data culture.

A progressive Terrorism studies, using robust data science and evidence-based analysis, is important because contrary to the dominant narratives of IS having collapsed or been in terminal decline, al-Dawlat al-Islamiyya (IS) used the time on the open front in Iraq and Syria as an educational opportunity, to build a base of supporters running into the thousands. This is why al-Dawlat al-Islamiyya, as a fighting force, “is bigger now than it was nearly six years ago”.

As such, the theology which groups such as al-Dawlat al-Islamiyya sought to promote, will remain, will endure and, when given the opportunity of fertile soil, it will expand visibly when it suits their strategic cause.

Dawn is coming.

Back to the Nashir – Total Decentralization and Enhanced Resilience

Much has been written – and claimed – about the importance of the “Nashir” setup for the online presence of IS. By its logo, most times despite some variations, Nashir is easy to identify, even for non-Arabic speakers. As outlined before, Nashir is part of the IS ecosystem of online operations, but by no means “the” core spine or the central hub. From the start of jihadist online operations in the pre-9/11 2001 era, they have been resourceful, creative, highly adaptive and keen to adapt to new possibilities showcasing a high degree of innovation of ensuring to fulfilling – in jihadist mindset – the divine command of militant actions in real-life and a coherent flow of content framed as da’wa for the electronic and non-electronic realms.

In short, whatever is possible online, jihadists have been keen and adventurous from start to tamper with and follow a best-practice use that develops from a user perspective to ensure their wide range of violent, pro-violent, non-violent content stays up for as long as possible. The same habitus accounts for jihadist battlefield experiments and making use of scarce resources – as in early of the Iraq war who remembers the handles of shovels re-used as butts for pieced-together Dragunov sniper rifles?

“For the time being, for as far as we know, IS is not present on the internet anymore and we will see how fast, if ever, they will regain service”, according to Belgian Federal Prosecutor Eric Van Der Sypt after a massive takedown of IS accounts and networks on Telegram, IS was quick to kick back into action within about twelve hours. As the Nashir accounts had been culled, a big fuss was being made of the importance of IS having lost its core network.

IS creates content and pushes it out via dispersed networks. While this was centered on Telegram as the main dissemination hub, the Europol-led takedown of IS networks on that platform had the consequence that the networks formerly confined to Telegram are now on over a dozen of platforms and services similar to Telegram. Needles to write, the use of ‘outside’ links to/for the ‘surface’ web continues uninterrupted – but you need to monitor a lot of platforms now to ensure collecting as much as possible IS hubs (from Telegram, yes IS was back quick, to TamTam, Hoop, BCM, etc. etc.).

Cross platform use furthermore has a higher level of resilience as links to respective platforms are exchanged and increasingly a need for a exchange of quick private messages is required to receive ‘trusted’ links, including selected Nashir channels to avoid further takedown (including a Facebook messenger link).

tg-coms

Back to the Nashir

With Nashir alive and kicking on over a dozen of platforms, posting/reposting ‘Amaq content, new videos, new written releases (al-Naba’, collected statement of Abu Bakr etc.), Nashir has regained a presence in the blogging sphere.

bitly-19k

Sharing a bit.ly link, first on December 18 within Tamtam and also within Telegram, this particular link was clicked over 19,000 times since its creation on December 10, 2019.

frontpage

up-to-date content, ‘Amaq statements claming various attacks in MENA, the Sahel, West Africa, the current al-Naba’ edition, martyr poster – screengrab of the Nashir site.

country

Where are consumers most likely located – VPN use distorts yet nobody uses a VPN to switch to a restricted country.

source

and another example of diversification – the problem with the very temporary inconvenience as an “IS user” on Telegram due to the end of November Europol cull has enabled to re-enable the Telegram network and over a dozen other platforms as back/ups / parallel use to decentralized da’wa operations online to ensure a persistent presence of up-to-date and ‘historical’ content of primarily Arabic sources that matter gravely to IS.

Media Mujahidin on Telegram: Overview of 2019

Many column inches of commentary have been dedicated in recent months to the purported shift from Telegram to other platforms. We have shown previously that despite efforts to ‘cull’ jihadi channels on Telegram, disruption did not have a meaningful impact on the core network. This core allowed jihadi groups to maintain a persistent presence. The greatest impact of that attempted disruption appears to have been the much tweeted about inconvenience caused to pundits and commentators who had only been able to access the peripheral Jihadi channels and Nashir News network that were deleted in the disruption effort.

In this post we look at the content sharing network between January and May 2019. This produces a strategic overview of the network, to assess whether the network has been forced to evolve how they use the platform.

The analysis shows that at present the Jihadi network on Telegram is vast and remains functional. The URL sharing in core groups indicates core users are not currently preparing to make the jump to another platform.

Overview:

The primarily Arabic Jihadi Telegram Network is very large, spanning 9,000 channels / groups and has produced over 1.7 million updates.
al-Dawlat al-Islamiyya, AQ, Taliban and pro-Jihadi supporters all connect into a single network which also draws on theological content at the Salafi-Jihadi Nexus.
This network has shared over 31,489 Unique URL from 486 domains / subdomains between January and May 2019. Active content sharing is still occurring on the surface web, despite punditry to the contrary.
By contrast there are very few links to the dark web, highlighting how important remaining on the surface web is for the Jihadi movement.
The most frequently used domains do not offer a serious alternative to Telegram. In the period to May 2019, the behaviour previously seen in the transition between Twitter and Telegram of mass link sharing to the accounts on the new platform is not currently being repeated.
A model of the information flow between platforms which are used within the jihadi information ecosystem continues to exhibit a dispersed network comprised of beacons, content stores and aggregators.
Tech resources, such as apps, disposable phone numbers, encrypted email, and VPN are an important part of both the Telegram network and the entire information ecosystem.

Data

Using the curated feed of human verified jihadi channels and groups archived by BlackLight between January and May. This dataset contains 1.7 million updates of which 878,795 (approximately 50%) were forwarded from other channels and groups.

Analysis of these messages produced a network of over 85,000 connections (content sharing or cross posting). The network is made up of 9,000 accounts and groups. The connections between nodes show that groups of channels form specific clusters, each of which containing some common theme or allegiance to a Jihadi group.

As discussed in previous posts there is a dispersed network with many accounts that have some importance to the network (rather than one or two very important accounts – which would make the network vulnerable to disruption).

As in previous analyses, ISIS, AQ, and Taliban channels all appear in the same interconnected network. This is often because:

they draw on similar other channels (those with a specific historical or theological focus for example) or
pro-Jihadi channels / groups who share the overarching theology and purpose, but do not have specific organizational allegiance, aggregate material from both al-Dawlat al-Islamiyya and AQ.

The network structure and emergent communication architecture of the clusters indicates that they will likely remain resilient to the removal of even a large proportion of the channels and groups. Of the different clusters, those closest to the al-Dawlat al-Islamiyya have the most dispersed network architecture – providing the greatest resilience, while Taliban appear to have adopted the distributed structure to a lesser extent.

External Links.

This section examines over 1 million (1,048,575) URL identified in messages and captions. Within this million URL sample the research found 31,489 Unique URL from 486 domains / subdomains.

Calculating the number of times URL representing content on specific domains had been observed, Telegram links appeared most frequently in posts. It is a common observation that the domain on which data is being collected is also the most frequently linked to domain in the dataset, as users often include the link for a channel or chat in their posts.

Domains as proportion of total observations

Looking at the number of unique URL gives an alternative perspective. It shows that while Telegram links appear frequently, they are a relatively small number of URL appearing frequently. In contrast, there are relatively higher numbers of URL from other domains, each of which appear relatively infrequently. This is logical, as many URL outside Telegram host a specific piece of content, and hence it is shared when it is released and subsequently falls out of use.

Examining the URL from outside Telegram provides an overview of the other locations within the Jihadi information ecosystem. This shows the number of times domains were observed in posts.

Similarly, analysing the domains by the number of different URL shared from that domain, shows how the information ecosystem combines branded content from jihadi groups, located on content stores and aggregators, with a wide range of other material including mainstream news sites.

From this we find:

Despite the claims Jihadi groups have not been driven off the surface web, sites such as archive.org, telegra.ph, and justpaste.it are frequently used as Jihadi content stores and aggregators.
None of the most observed domains offer a serious alternative to Telegram. In the period of adjustment, which occurred in the autumn of 2015 and Spring 2016, Jihadi twitter accounts regularly shared links to Telegram channels to allow sympathisers to maintain access to the Jihadi information ecosystem. In the period to May 2019, the behaviour previously seen in the transition between Twitter and Telegram is not currently being repeated.

Flow across the Ecosystem.

In examining the flow of users across the ecosystem in 2019 we find there are two distinct clusters, one focused on tech and the other on Jihadi content and related news. This uses the same method as was discussed during the GRNTT conference at Brookings.

The tech cluster on the lower portion of the graph fulfils an important role for the movement, as it provides access to services such as VPN, disposable / free phone numbers and a range of communication programmes distributed as .apk files (Andriod Package File).

Overview of network graph showing traffic across Jihadi Information Ecosystem

The content cluster features platforms from the three main roles in the Jihadist information ecosystem:

The signposts including Telegram and Facebook,
Content stores such as Archive.org, Google Drive, imgur, and Files.fm
Aggregators such as Justpaste.it and Telegra.ph

Other findings of note;

Obedient Supporters and Nashir 1440 are content aggregators which provide content downloads on the surface web.
Tgho.st – is a file sharing system native to Telegram. Tgho.st operates by users sending the file to a Telegram Bot, the bot subsequently returns a URL where that file can be downloaded by anyone using the download link in a browser. The service advertises that “These files are not deleted and will always be available for download”.
Videopress – URL to Videopress were frequently extracted from videos posted on the earlier version of Jihadology, although without the full Jihadology page / URL. Such a finding illustrates the importance of focusing on the Jihadi primary language, Arabic, rather than drawing conclusions from fringe languages, particularly English. However, this is likely to fall out of use following the recent update to the site.

Conclusion

The primarily Arabic Jihadi Telegram Network is very large, spanning 9,000 channels / groups and has produced over 1.7 million updates.
al-Dawlat al-Islamiyya, AQ, Taliban and pro-Jihadi supporters all connect into a single network which also draws on theological content at the Salafi-Jihadi Nexus.
This network has shared over 31,489 Unique URL from 486 domains / subdomains between January and May 2019. Active content sharing is still occurring on the surface web, despite punditry to the contrary.
By contrast there are very few links to the dark web, highlighting how important remaining on the surface web is for the Jihadi movement.
None of the most observed domains offer a serious alternative to Telegram. In the period to May 2019, the behaviour previously seen in the transition between Twitter and Telegram is not currently being repeated.
A model of the information flow between platforms which are used within the jihadi information ecosystem highlights a dispersed network comprised of beacons, content stores and aggregators.
Tech resources, such as apps, disposable phone numbers and email, and VPN are an important part of both the Telegram network and the entire information ecosystem.

Theological drivers of online ghazwat and the media mujahidin

Exclusive for the supporters (message on Telegram)

Text reads:

#exclusive for the supporters (munasireen) and companions (ashab) of the raids (al-ghazawat) on #platforms of social media: More than 500 links to electronic releases (isdarat) of the Islamic state that are not eligible for #deletion by the will of god, we ask god to anger the kuffar, the apostates, the hypocrites. These links by the will of god do not get deleted all the while these will help the munasireen in their raids of social media platforms. Share and deem the reward (ajr) and we advise you [to place these links] in the comment section on YouTube. We warn you after placing your trust in god to use a VPN and to ensure to enforce technical security measures for the protection for the raiders on the social media sites. (raiders in Arabic is stated as ashab of the raids). We will continuously renew [this collection of links protected from removal] until we have more than 1000 links, god willing Experiment with the links, share them and reap your reward.

The release of this collection of ‘500 links’ through pastethis.to highlights the theological underpinning of the actions taken by the media mujahidin. This includes:

The nature of rewards in the Jihadist belief system.
- Theological underpinning – reaping your reward, ajr
- Murabitin, Ghazwat and the Ribat.
- Jihad – Media – Activism – Militancy – Documenting the Struggle Online to Influence Target Audiences
- Isdarat – the groundwork of Online Jihad by AQAP, first generation
The different roles platforms play within the ecosystem.
The role of the website jihadology within the jihadist ecosystem.

Rewards in the Jihadist Belief-System

“Conveyed by ‘Ali, may god be pleased with him: “whoever inspires his brother to jihad will be rewarded likewise upon every step of this endeavor of the worship of the Sunna.”

Cited by Abu Mus’ab al-Zarqawi, “Join the Caravane”, January 4, 2004, citing in length ‘Abdallah ‘Azzam’s “Join the Caravane”, referenced furthermore in jihadist literature to historical scholar Ibn Nahhas.

To give readers a deeper nuanced insight into the above statement issued on Telegram, we will decipher a few keywords / concepts that are in most cases absolutely clear and easily understood when issued by Arabic native speakers, born as Sunni Muslims, to their core target audience: Arabic native speakers, born as Sunni Muslims. The message was transmitted across the Jihadi Telegram network. Jihadists are religious people (if we like it or not) who over the past 40 years have been prolific writers to craft a specific theology. The theology of Islamic State (IS), al-Qaeda (AQ) and any other Sunni extremist groups, is based on Arabic-language religious scriptures, not just Qur’an and Sunna, but also references elements of the rich 1,400-year long tradition of Islamic writings. Yet, as penned by Rüdiger Lohlker, there is a lack of willingness to deal with the writings and motivations of jihadist subcultures and their inherent theology. The term theology is provocative, referring to the specific type of rhetoric and thinking regarding the relationship between humans and god. While it may be comforting for some to describe al-Baghdadi as ‘monstrous’, or a female follower as a ‘witch’, academic study can make greater progress if focusing less on the moral outrage and instead focusing on how Sunni extremists actually articulate, pitch, and project their messages.[i] Within the ecosystem of jihadist writings, including historical authors that matter for modern jihadist groups, many theological concepts are identifiable – if you are able, and so inclined, to read the easy findable electronic PDFs. With the apparent inability to read basic Arabic jihadist texts or fully understand videos (which are 99% in Arabic in the case of IS), the majority of keywords and textual content remains behind a veil. Conversely, for any Arabic reader versed in Arabic-language jihadist writings, the speeches, audios, images and videos they produce clearly contain key theological concepts. Similarly, for those with an understanding of the socio-cultural context of the intended audience, even the non-Arabic language products have a clear theological meaning. Unfortunately, these theological concepts have passed largely unnoticed in the pop-science analysis of English-only magazines such as AQ’s Inspire, Dawlat al-Islamiyah’s Dabiq and the multi-lingual Rumiyya dominates the ‘research’ output have created an absolute win-win situation for Jihadist groups. With the neglect to either treat Arabic language extremist sources as primary data[ii] or entering it into evidence to relate the use of language for non-Arabic IS products, Sunni extremist propaganda (including the pro-jihadist ‘salafist’ materials) targeting a non-Arab(ic) audience, attacking open, inclusive societies, continues without much interruption. Hardcore texts of violence include lengthy citations, textual references and include sources of Qur’an and Sunna used by contemporary ‘Salafist’ text books projected via the Internet in respective languages into European societies. The art of the jihadist pen, or “scholars of jihad”, as extremist scholars of this subculture refer to themselves, is to express a coherent theology, referencing historical authors such as Ibn Taymiyya or Muhammad ibn ‘Abd al-Wahhab, and to embed citations or references to Qur’an and Sunna. With the establishment of over 300,000 pages of Arabic text since the 1980s, all available online if you know where to look يا لغوي, jihadists have developed a specific hermeneutical reading of scripture and project their actions as the active application of what is defined in writing as divine law, the will of god, the commandments, absolute rulings that must be enforced to be a ‘pious believer’ – and be eligible for paradise. Texts authored by the “scholars of jihad” include references and citations of linguist dictionaries such as Lisan al-Arab, tafsir works and sometimes ridicule religious curricula taught in MENA schools claiming the references of jihad (for example) are either omitted or taught in a wrongful way. In order to understand groups such as IS, you must be literate in Arabic and be able to comprehend the propaganda that is often well versed in religious references and sources – this is the habitus that extremist groups exploit to address their primary, single most important key target audience: Arab native speakers.

Religious extremists have no easy, cozy relationship with an intervening deity that to them is real, this is not limited of course to this context. For religious extremists in general, the relationship to god is personal and intimately – while socially re-enforced based on human interpreted divine commandments etc. How most of the intended audience orders their reality is that;

an intervening deity is real,
articulated in the jihadist framework, this is a world they pass through, referencing an authentic hadith,
after this world they hope their actions will be deemed such that the intervening deity permits them entrance to paradise, reference – among many – i.e. Qur’an 3:169.

Hence statements of those either passively ‘martyred’ by air strikes, or during combat when not having actively sought it, as well as the istishhadi operatives, suicide or ‘martyrdom’ bombers who deliver their explosives actively to their targets, are often introduced by Qur’an 3:169:

“Think not of those, who are slain in the path of God, as dead. Rather, they are alive with their Lord, they are bestowed with provision.”[iii]

This mind-set is further sanctioned by citing Qur’an 2:154, to back up the above statement:

“Do not say that those who are killed in God’s cause are dead; they are alive, though you do not realize it.”[iv]

The stories of ‘martyrs’ enable the narrator to present the individual as a ‘true’ Muslim who indeed lived, fought, and sacrificed for implantation of the divine definition as set in Qur’an, 3:146 to widen the conviction of “being alive with God” in the afterlife (akhira):

“Many prophets have fought, with large bands of godly men alongside them who, in the face of their suffering for God’s cause, did not lose heart or weaken or surrender: God loves those who are steadfast.”[v]

The jihadist, in his self-perception, is part of “bands of godly men” and as such have remained steadfast, reluctant of their own physical safety or lives – after all, humans are tested by god in this world to decide who will be rewarded in what way in the next world. Furthermore, the jihadist sources emphasize that individual believers are expected to have “spent” their lives and their wealth “on the path of God”. Qur’an 9:111 is cited to provide an alleged theological and judicial framework:

“God has purchased the persons and possessions of the believers in return for the Garden – they fight in God’s way: they kill and are killed – this is a true promise given by Him in the Torah, the Gospel, and the Qur’an. Who could be more faithful to his promise than God? So be happy with the bargain you have made: that is the supreme triumph.”[vi]

Many of the theological distinctions come in deciding which actions will gain ajr – a form of reward – and which will not, i.e. lead to “sin” or tribulations. A shared broad mental construct, and socio-cultural context is laid out in the religious coded, Arabic language corpus of jihad – the distinction comes from how one must behave to obtain reward, which may subsequently cause you to be permitted entrance to paradise. Thus, from a linguist perspective, the jihadist language is clear and easy to comprehend. Osama bin Laden was killed in May 2011, most Sunni jihadist groups had been quick to issue statements ensuring that bin Laden was a human (and not a prophet or the like), having invested his life for the worship of god by his actions and sacrifice. Following a classical jihadi-lingual ductus, he was referred to as “the shaykh, the martyr – as we deem him to be – Osama bin Laden.”[vii] In other releases, i.e. the death of Hamud b. ‘Uqla’ al-Shu’aybi, died in late 2001 and having been cited by bin Laden but also having had an important influence on Saudi jihadists of the 2000s, the full reference of the martyr in this framing is expressed: “we deem him to be a martyr, god is the measure of all things” (al-Jarbu’, 2002, shared in AQ forums as word document at the time). This wording was later used throughout the 1500 page strong The Voice of Jihad AQ magazine to refer to their members who had been ‘martyred’. Steadfastness is another way of earning ajr, and is an integral element of jihadist literature and videos. Steadfastness is the expression of maintaining a sincere intention towards god, as your actions of this world in the service for god will be judged to determine your status, reward, in the afterlife.

Theological underpinning – reaping your reward, ajr

“Reward”, or ajr in Arabic, in the mindset of modern jihadist groups and thinkers, however, is based on the ancient understanding thereof and is two-fold:

The reward must be earned based on one’s deeds and actions for god in this world to be eligible to enter paradise after death. This is one of the main literal elements of the textual corpus of jihad. As for jihadists, jihad means an active form of worshipping and serving god, with a sincere intention, driven to fight for the protection, revenge or for the security of the jama’a ahl al-sunna; reward is earned along this way in this world with death as the new stage of life in mind. Hence popular slogans of this subculture, expressed in writings and placed in active application in many of its audio-visual releases, embody this with further theological reference points. A popular propaganda-slogan thus states that the Mujahid seeks one of the two most precious things (al-husayn): victory (nasr) or attaining the shahada, exiting this world and dwelling in paradise. This is a citation of Qur’an 9:52 and used by al-Zarqawi in the beheading video of Olin “Jack” Armstrong in 2004. The Chechen hostage takers of the musical Nord Ost in Moscow in 2002 also put up a black banner on the wall, reading in Arabic the Islamic shahada complemented by allahu akbar and ihda l-husnayyin, the reference to Qur’an 9:52. IS used this slogan, for example, in the last videos that had emerged from Mosul before the fall, framing the expected reward despite worldly – or physical loss – as a win for what comes after life in the conviction of humans who see themselves as enablers of divinity.

Reward is also a historical reference to the physical world that early Muslims obtained as a result of raiding the caravans of the Quraish. The “spoils” or “booty of war” are filled with Qur’anic references to surat al-Anfal and surat al-Tawba. A physical reward thus is based on receiving a share of the “spoils of war”, often referred to as in Arabic as ghanima. Yet jihadists warn of focusing on the potential to make ghanima through jihad, rather than having a sincere intention.

A 2003 article in “The Voice of Jihad”, the first regular electronic magazine released online by AQ on the Arab Peninsula, warns of prioritizing “taking ghanima as reward of one’s jihad”, thus neglecting a complete understanding of the concept of jihad and the spoils of war by omitting “when raiders take ghanima a third is their reward.” The article continues: “the ahadith provide clear evidence whoever seeks to embark on his jihad solely for the purpose of gaining worldly presentation, will not receive any ajr.”[viii] The reference of ajr in this context is strictly related to what the Mujahid, having a sincere intention, will receive when killed. This hadith is also used by ‘Abdallah ‘Azzam in his “Declaration of Jihad” and further contextualized with another hadith sources: “Conveyed by al-Nisa’i based on a stable isnad[ix] by Abu Usama who said: “a man came to the prophet, peace and blessings upon him, he said: “have you [ever] seen a man raiding looking for ajr, thinking about financial gain?” The messenger of god, peace and blessings upon him said: “god will not acknowledge anyone [as a martyr] except those who are pure and sincere in their desire.”[x]

Ajr: Rewards in the afterlife for deeds and actions in this world, a jihadist Telegram channel member asking for reward for his Jaysh al-‘Izza brethren for having slain mercenaries, for their jihad and to receive their martyrs. The reward is also contingent on the context in which action is taken. Anwar al-Awlaki described in Allah is Preparing Us for Victory, when times are hard, the reward for taking action is increased. If it comes at a time when things are easy then the ajr is reduced. But if the time is one of difficulty, then the ajr is increased. Ajr is in accordance to the difficulty. Comprehending the meaning and importance of ajr within the Jihadi understanding, shows that claims in Western commentary that ISIS seeks to pursue a ‘utopian project’ or present a ‘utopian narrative’ are based on a fundamental misunderstanding of jihad. It is life on the ribat that is the life revered by the jihadist movement. The reward they seek is ajr, which, if sufficient, may permit access to janna.

Murabitin In his chapter on the virtues of life on the ribat, Ibn-Nahas highlights why behavior on the ribat is among the best livelihoods. Abu Hurairah narrated, the messenger of god said: “Among the best livelihoods of people is that of a man holding the rein of his horse in the path of Allah, flying on its back whenever he hears the call. He flies in search of killing or being killed. And a man on top of a mountain peak or on the bottom of a deep valley, establishing prayers, paying his zakah, and worshiping his Lord until death visits him. People see nothing from him but good.” Those who spend the night on the ribat are murabitin. The image of murabit on the classical ribat is important to the understanding of the identity and approach of the media mujihidin today, as it is the self-image of those on the electronic ribat. As noted: Murabita, according to the British Orientalist, translator and lexicographer, Edward Lane, “also signifies a company of warriors; or of men warring against an enemy; or a company of men having their horses tied at the frontier in preparation for the enemy; or keeping post on the frontier; and in like manner”.^[xi] To translate and conceptualise the Arabic term ribat can be very contentious. The term is frequently referred to in both jihadist videos and in print / online literature in the context of religiously permissible warfare; in a modern meaning it could loosely be translated as “front”. Ribat is prominent due to its reference in the 60th verse of the eight chapter of the Qur’an, the Surat al-Anfal (“the Spoils of War”). It is often used to legitimize acts of war and among others found in bomb making handbooks or as part of purported theological justification in relation to suicide operations – for decades. Extremists consider the clause as a divine command stipulating military preparation to wage jihad as part of a broader understanding of “religious service” on the “path of god.” Ribat as it appears in the Qur’an is referenced in the context of “steeds of war” (ribat al-khayl) that must be kept ready at all times for war and hence remain “tied”, mostly in the Islamic world’s historic border regions or contested areas. In order to “strike terror into [the hearts of] the enemies of Allah”, these “steeds of war” are to be unleashed for military purposes and mounted (murabit – also a sense of being garrisoned) by the Mujahidin. The relevant section reads: “Prepare against them whatever forces you [believers] can muster, including warhorses,[xii] to frighten off [these] enemies of God and of your, and warn others unknown to you but known to God. Whatever you give in God’s cause will be repaid to you in full, and you will not be wronged,” Qur’an 8:60. Ribat Ribat has two main aspects in contemporary jihadist thinking. First, the complete 60th verse of the Qur’an is often stated in introductions to various ideological and military handbooks or videos. While some videos issue ribat in connection with various weapons and the alleged divine command in the jihadist reading thereof. As the real-world fighting Mujahidin are considered “strangers” (ghuraba’) in this world fighting at the very edge of worldly perception, thus being ‘mounted’ at the front (ribat) and the borders (thughur), the background networks of the ‘media Mujahidin’ must be accredited likewise. Thus, in the past fifteen years, ribat has migrated and expanded into the virtual “front”, as the murabit who is partaking in the media work has been equated with the actual Mujahid fighting at the frontlines. In a similar understanding, the physical “frontier” or “border” has shifted to the ‘arm-chair jihadists’, the professional media teams embedded with fighting units as well as the global network of media supporters as the value of the media jihad is understood and used on a tactical and strategic level by militants to further their cause.

Ghazwa The advantage exploited by the muribiteen in early Islamic history is the ability to move rapidly, have a heavy impact on the target, and move on. This is encapsulated by the concept of Ghazwa (غزوة), a raid or expedition.^[xiii] Jihadist groups around the world have used the word to describe their physical operations such as “ghazwat al-asir”, a campaign by the Islamic State of Iraq (ISI) to avenge the imprisonment of Muslims.^[xiv] In 2006, IED attacks in Bouzareh near Algiers, was valorised as “Ghazwa Bushawi” by the “the Media Council of the Groupe Salafiste pour la Prédication et le Combat” before the group merged with AQIM.^[xv] Today these raids occur on online, Channels on Telegram act as coordination points through which these raids are organised. In one approach, Jihadi groups post the time and target for the raid that day. They provide supporters with pre-prepared tweets or URL which supporters can copy and post directly onto platforms such as Twitter and Facebook.^[xvi] These raids seek to cause sudden spikes in activity to spread their message broadly, there is no attempt at permanence as they know the accounts they use will be removed. In fact, they plan for it. Just as the self-image of horse backed warrior, the users in the online ghazwa arrive suddenly, have an impact but do not intend to stay around. A longer discussion of these concepts appears in: Ali Fisher, Netwar in Cyberia

Jihad – Media – Activism – Militancy – Documenting the Struggle Online to Influence Target Audiences

Incitement to jihad is well established within the online dominions, where media activism can be achieved from any place, in- or outside of conflict zones. With a ring of decentralized media workers supporting those who are ‘embedded’ with fighting elements, the jihadi media has in the past two decades greatly improved in providing professional made videos and writings from real-life combat zones for computer-, tablet-, smartphone-, and television-screens throughout the world. The ‘media mujahid’ as a role model promotes those ‘embedded’ front-line cameramen in particular, without whom the quality and quantity of jihad groups worldwide would not have a lasting impact or relevance. In the jihadists’ self perception, the;

“media [worker] has become a martyrdom operative without an explosives belt, for they are entitled to these merits [of jihad]. Furthermore, haven’t you seen how the cameramen handle the camera instead of carrying Kalashnikovs, running in front of the soldiers during attacks, defying death by exposing their chests to the hails of bullets!?’[xvii]

Rather, the media worker in the field has turned into a role model of adoration just like any hardcore fighter or martyrdom operative, and is portrayed by the jihadi media likewise and accredited as an istishhadi, as someone who actively has sought out and attained the shahada. The wish to become a martyr, having a “clear intention” (as described above) as proof of their piety and their loyalty to god, being ‘true’ practitioners of Islam expecting compensation in the afterlife. This powerful new role model is backed by the accreditation of the value of the quantitative and qualitative online propaganda:

“Haven’t you seen the cells responsible for expanding the electronic media files (isdarat), how they enter the most dangerous and most fortified areas and how they disseminate the isdarat of the Mujahideen in the heartlands of the hypocrites (munafiqin)!?”[xviii]

Media workers, on the other hand who are not directly embedded with fighting units, are not of lesser importance. For they ensure the process, editing, the layout, translating and subsequent publication.

Isdarat – the groundwork of Online Jihad by AQAP, first generation

Since the early 2000s with the first generation of AQAP being active in Saudi Arabia while ISI used the power vacuum in Iraq, the Internet has become the medium of communication and exchange of information for Jihadis. In that time, the Internet has been increasingly used on a very efficient and professional basis. Countless online Jihad communities had come into existence. Not only have a number of online forums been established, but there had been (and still are to a certain extend) blogs and traditional websites available, which spread and share a broad variety of documents and data in general. Jihadis often refer to the Arabic term isdarat for data, that consists of general publications, videos (suicide bombings and last testimonies, roadside bomb attacks etc.), sermons or general statements and declarations – but also technical information such as bomb-making, weapons guides or chemical crash courses. Since the early 2000s the Internet has become a 24-hour online database, where any user with sufficient knowledge of the Web (and Arabic) is able to access, understand and/or download these isdarat. In an interview with al-Qa’ida’s first online magazine (2003), Sawt al-Jihad (Voice of Jihad), Abu Jandal al-Azdi explains the reasons for these isdarat and states that „these [isdarat] guide the youth of Islam and they [the Mujahidin and their leaders] have published books, statements, audio-files, and videos.”[xix] Today the users exchange useful tips and practical hints, discuss ideological and theological issues and allow an insight into their tactics and strategies within the online forums. The usage of the Web has been systematically funneled by the al-Qa’ida cells on the Arabian Peninsula and provided the framework for extensive online operations as of writing (2019). Isdarat was also the name of one of the most prominent early IS websites. It has been a website and telegram channel where users could access the content. For IS, with the changing circumstances of being able to mainstream “jihad” more due to the acquisition of territory on an unprecedented level, videos are a key element to convey what AQ projected in writings in a more compelling audio-visual format.

The different roles platforms play within the ecosystem.

Websites such as Isdarat, exist within an ecosystem of content stores, aggregators and beacons. Since the emergence of the media mujahidin on social media in 2013, the different elements have formed part of a multi-platform zeitgeist. Likewise, the telegram post (above) shows how the interconnectivity between platforms continues to allow jihadi groups to share information and avoid disruption on social media and the surface web.

The message is shared on Telegram (beacon), directing users to Pastethis.to which functions as the aggregator for the links. The aggregator gives the location of each individual file (or content store). Traffic between platforms can be harder to locate because often all that is visible on the aggregator is the URL rather than the actual content. The PasteThis.to page contained a list of video titles and URL where these are stored. In this case the content store is most often Videopress or WordPress, with many of these originally posted on Jihadology.

Jihadology in the ecosystem of online jihad

Analysis of the URL made available via the Pastethis.to pages, shows a clear tendency toward using particular content stores.

Advertised as unlikely to be removed, the most common links lead to Videopress. Videopress is notable for being used by Jihadology to store material. As discussed previously, the videos are not only accessible via the site but via the underlying videopress URL which opens the video in a browser rather than on the site. Having located the underlying videopress URL jihadi sympathizers are able to share the location of the content via the aggregator, benefiting from the stability of content posted on Jihadology, but without the user having to visit the site.

*Sub-domains in URL shared on Pastethis.to*

Similarly, where subdomains appear in the URL, the most common subdomain is azelin.files, followed by videos.files. This image shows how the videopress link which was shared on pastethis.to can be found in the source code for Jihadology.

This is not a one-off example, another aggregator (still available using Google cache) shows an audio file available via the azelin.files subdomain.

Now deleted aggregator accessed via google cache

While the other links are dead (apart from the archive.org) content posted on Jihadology and hosted on WordPress is still available. The Pastethis.to aggregator, features the video No Respite. The shortcode used in the aggregator is the same as the one available via Jihadology.

This video is also notable as Abdul Hamid was arrested … “after he posted a four-minute-long Isis propaganda video called No Respite”, which was viewed more than 400 times on his Facebook page”. Hamid subsequently “pleaded guilty to disseminating a terrorist publication” according to the Evening Standard.

Conclusion

Analysis of this release has shown,

The theological underpinning of the actions taken by the media mujahidin, and the theological aspects cannot be separated from their strategy. They are integral parts of jihadi thought and cannot be treated as window dressing to be stripped away at the whim of Western researchers.
The persistent presence of the Swarmcast is in part due to the agility of the media mujahidin. They use a diverse range of platforms and share the location of specific content stores via beacons and aggregators.
The Jihadology website, as shown previously, is exploited within the jihadist ecosystem as a content store. URL of the videos are extracted from the site to be shared with jihadi sympathizers. These links are shared in such a way that the video plays in the browser rather than on the site – ensuring the individual accesses the content in a Jihadi context.

Notes:

[i] Rüdiger Lohlker, Theologie der Gewalt. Das Beispiel IS, Facultas: Vienna, 2016. [ii] Baart Schuuhrman, Terrorism studies and the struggle for primary data, November 5, 2018, https://www.sv.uio.no/c-rex/english/news-and-events/right-now/terrorism-studies-and-the-struggle-for-primary-dat.html [iii] All following verses of the Quran are quotations of: Muhammad A. S. Abdel-Haleem, The Qurʾan (Oxford: Oxford University Press, 2004). [iv] See for example Mu’awiyya al-Qahtani, “The Biography of the Hero Abu Talha al-Ansari”, Mu’assasat al-Mas’ada al-I’lamiyya, 2012. [v] Ibid. [vi] For a contextual reading, Nico Prucha, “Abdallah ‘Azzam’s outlook for Jihad in 1988 – “Al-Jihad between Kabul and Jerusalem””, Research Institute for European and American Studies (2010), http://www.rieas.gr/images/nicos2.pdf. [vii] For example in the as-Sahab video release la tukallafu ila nafsak, June 2011. [viii] This part of the sawt al-jihad (no.3, Ramadan 1424), is the exact same as provided here: https://library.islamweb.net/newlibrary/display_book.php?ID=3&startno=0&idfrom=2&idto=8&bookid=81&Hashiya=3#docu and also referenced by, for example, Yusuf al-Qaradawi: https://www.al-qaradawi.net/node/2072 [ix] Chain of transmission. [x] ‘Abdallah ‘Azzam, I’lan al-jihad, electronic version, 1997. [xi] Prucha, Nico, “Jihadists‘ use of Quran’s ribat concept”, in: Janes Islamic Affairs Analyst, August 2009 [xii] Ribat al-khayl [xiii] Ghazwa is also the name of a magazine distributed by Lashkar-e-Taiba in Pakistan. Hanley Jr, John T., et al. The Anatomy of Terrorism and Political Violence in South Asia Proceedings of the First Bi-Annual International Symposium of the Center for Asian Terrorism Research (CATR) October 19-21, 2005, Denpensar, Bali, Indonesia. No. IDA-P-4096. INSTITUTE FOR DEFENSE ANALYSES ALEXANDRIA VA, 2006. [xiv] For discussion of bombings linked to ghazwat al-asir see: https://onlinejihad.net/2010/04/11/isi-embassy-bombings-in-baghdad/ [xv] Nico Prucha, Online territories of terror: how jihadist movements project influence on the Internet and why it matters off-line, PhD Thesis, Universität Wien | Philologisch-Kulturwissenschaftliche Fakultät (2015) (p. 280) [xvi] Prucha, Nico. “IS and the Jihadist Information Highway–Projecting Influence and Religious Identity via Telegram.” Perspectives on Terrorism 10.6 (2016). [xvii] Al-Manhajjiyya fi tahsil al-khibra al-i’lamiyya, first part, 18. This ideological handbook is part of a lengthy series sanctioning the media work in general, published by the media groups Markaz al-Yaqin and al-Furqan in May 2011. [xviii] Ibid. [xix] sawt al-jihad number 11, 17.

How Jihadist Groups exploit Western researchers to promote their theology

And why this exploitation allows Jihadists to maintain a persistent information ecosystem.

This is the second in a series of posts that uses data science to sort the anecdotal observation from evidence-based research. After the hype, what about the data? Part 2.

The recent reports of UK government pressure on Automattic and WordPress to remove content posted on Jihadology, has resulted in plenty of opinionated tweets and longer form commentary.

As the UK government has claimed that Jihadology could be used as a convenient platform by extremists, the first past of the post looks at;

Whether this is a theoretical possibility, or if there is evidence that Jihadology is used by jihadist groups, and if so, how and for what purpose do they use it?

The second part of the post examines whether this is an isolated case;

is there evidence that individual pieces of Jihadist material which pundits and researchers post on social media and the surface web are subsequently exploited by Jihadist groups.

Is there evidence that when the aggregated impact of individual tweets and surface web posts are analysed as a collective behaviour, rather than as isolated events, that this creates a resource which is exploited by Jihadist groups – resulting in pundits unwittingly becoming part of the Jihadist information ecosystem?

The evidence shows that Jihadology:

is used by jihadist groups as a convenient platform through which to share access to videos, and text documents.

is a source of media to feed JihadistContent Aggregators, allowing material to be shared within a Jihadist context while not being subject to removal.

is recommended to fellow Jihadist sympathisers as a good place to find content, emphasizing the content on Jihadology does not get banned or removed.

The data further shows:

More broadly, there is a network of researchers and commentators who are publishing Jihadist material on the surface web. The aggregated result of these individual actions is the unwitting creation of an online resource which has been exploited by Jihadist groups and has become part of the Jihadist information ecosystem.

It is perhaps the greatest irony that Government sessions to discuss how to make it harder for Daesh to spread their message online, are often attended by researchers who frequently publish that same content on the surface web and social media.

Introduction

Jihadology describes itself as a ‘clearinghouse’ for jihadi primary source material, original analysis and translation services. As a result, it allows researchers who lack the expertise or experience to find content themselves to publish research.

For those with genuine access, Dawlah al-Islāmiyah, recently released an archive of over 5,200 Media Foundation and Wilayat produced video files (which included multiple language versions of some videos).

They have also followed the tradition of jihadist media groups of releasing numerous astuwanat [barrels / أسطوانات] of content. Each “barrel” contains a collection of material organised by theme, organisation, or specific media production. While previously astuwanat were made available via CD, DVD or ISO file, they are now more often released via torrent or direct download in Telegram – although the banner images promoting them often still contain an image of a disk.

In combination with the ‘Archive’ channels on Telegram, policy professionals and researchers with requisite knowledge, language skills and experience, should be able to access Jihadist material without using Jihadology as a crutch with which they can limp through what should be basic research tasks for those doing more than an undergraduate research essay.

Afterall, given their inability to master the simple task of finding content, it is perhaps unreasonable to expect those leaning on the Jihadology crutch to provide an authentic interpretation of what they find on the site. Furthermore, basing analysis on what is found on the site, leaves the researcher studying what is posted on Jihadology (which is not exhaustive), rather than the range of material extremist groups actually produce.

European Context

The current discussion of Jihadology and pressure on WordPress, occurs within the context of the UK government position that:

“It is reckless to publish terrorist propaganda online without safeguards to stop those vulnerable to radicalisation from seeing it”.

It should perhaps be needless to state that those who are vulnerable to the message of Jihadist groups must as some point become consumers of jihadist material or messages, if they are to be anything other than theoretically vulnerable.

For Jihadist groups da’wa is given via printed material, images, audio, video, speeches, conversations or communicated through specific behaviours. Through this range of delivery methods, individuals are provided with role models and theological guidance for actions, and in which they can use online platforms to gain unfiltered access to the universe of content that is of great importance to jihadist groups.

It is in this context that a report from the UK Parliament’s Intelligence and Security Committee (ISC) criticised social media companies for not acting fast enough to remove content. Furthermore, the FT reported that UK security officials argue Jihadology:

“could be used as a convenient platform for extremists to access videos and messages from outlawed terror groups such as ISIS and al-Qaeda”. (emphasis added).

However, various European countries take different views on what to do about sharing content from groups they deem illegal or extreme. At the time of writing, in France Jihadology is unavailable.

Germany threatens fines for companies not reacting quickly enough to content posted, and the UK imposes prison time for those sharing this content. For example:

December 2018 – Abdulrahman Alcharbati (diagnosed as bipolar according to the BBC report) was jailed for seven years, for offences including posting ISIS videos on Facebook.

December 2016 – Abdul Hamid, who Judge Peter Rook QC accepted had ‘significant physical and mental health problems’ was sentenced to two years in prison for posting the video ‘No Respite’.

At this point, in the UK while two men with mental health problems have been sentenced to years in prison for posting ISIS videos, another man is lauded by academics for making the same videos freely available.

This raises important and complex issues as global communication networks exist alongside international borders, and the extent to which Jihadist groups and sympathisers use Jihadology as a platform to access content, and furthermore, the role Jihadology plays within the jihadist information ecosystem.

Reusing individual links

In the New Netwar, we observed that Jihadist groups and their supporters locate individual URL of videos posted on Jihadology and reuse those links within the context of their own channels and groups.

Jihadist Telegram channels re-purposing individual URL from Jihadology

A similar theme was picked up in recently in the Twitter discussion, following the story in the Financial Times, noting it is not just the videopress links (which have previously appeared on Jihadology) but references to the site itself. As @Charlie_KDN noted in a tweet;

Each week 100’s of @Jihadology_Net links are published on ISIS TG chans and groups to rebroadcast suspended content on other platforms.
@Charlie_KDN

For example, links to videos including ‘Honor is in Jihad’ and issues of al-Naba that have been posted on Jihadology are shared on pro-ISIS Telegram channels (as are links to a site run by Pieter van Ostaeyen).

Once the videos are neatly archived by Jihadology – the links are then shared as collections. For example, on a single day in October 70 unique Videopress URL were observed being shared a total of 1,125 times via core Telegram channels.

A potential additional advantage to sharing the Videopress links is that it opens a video player in a web browser, providing a seamless experience for the viewer and ensuring the content is shared in a pro-Jihadist context rather than with a research focus.

Feeding Content Aggregators

In addition to using individual links to content, Jihadist supporters use Jihadology to feed material to their content aggregators. For example, a PasteThis.at link shared in a pro-ISIS Telegram channel, provided a single page from which users could access over 100 issues of al-Naba.

PasteThis.at page re-purposing individual URL for al-Naba up to issue #147 posted on Jihadology

The actual files from which this PasteThis.at page link to were stored on azelin.files.wordpress.com. Using this method Jihadist groups and supporters can provide access to content from within the context of their own discussions, Telegram groups, and theological worldview.

In addition, when Jihadist supporters build individual websites to aggregate content, they have been observed using Jihadology as a source of content. In this example the aggregator was built using Cloud9 which operates as part of Amazon AWS.

The al-Ajnad and al-Furqan options both direct uses to the pages on Jihadology for those entities. Those links have been clicked over 350 and 240 times respectively.

Content aggregator directs users to Jihadology

This cloud9 based aggregator also contained a section in which users could select videos by clicking on the banner advertising their chosen video. Many of the links made available in this section were to videopress files, the link for which had previously been shared on Jihadology.

Clickable banners using videopress URL many originally posted on Jihadology

As in the previous example, Jihadology is used to provide a stable source for much of the content. However, the way the site is built a user may be unaware of the actual file location – allowing the aggregator to promote a Jihadist worldview

Why Jihadists use Jihadology:

In addition, to re-using individual links or feeding content aggregators, pro-jihadist or pro-IS Telegram users have been observed posting recommending Jihadology as a source of material. Much of these comments follow a similar theme.

In this example, the Arabic reads.

“and I prefer links to the site jihadology which is specialized in studying jihadists as it states, therefore it neither gets deleted nor any content it hosts gets banned“

Within core IS channels links to the main IS category on jihadology are shared, leading to videos, video series, or the weekly editions of the al-Naba’ magazine:

كامل اعداد صحيفه النبأ من واحد إلى 110 ماعليك الا بالنقر على الرقم وتتحمل. برابط غير قابل للحذف لن يفتح الرابط الا بعد تشغيل ألفي بي ان vpn

#نشر

The text reads:

“All editions of the al-Naba’ magazine, from edition 1 to 110, just change the number in the link and download it. This link will not be deleted and do not open this link without employing a VPN.”

Another message advised:

هنا في هذه الروابط صفحات #لكامل_إصدارات_الدوله_الاسلاميه_من_ولاية_حلب_بروابط_غير_قابله_للحذف

“this site gives you all the links of the releases from wilaya Halab of the Islamic State, the link does not get deleted.”

Conveniently, for the author of this message in a core IS channel, viewers can quickly get the current videos by IS from the province of Aleppo.

It is important to the author of the Telegram message, that while content may be removed elsewhere it is kept in a safe and orderly manner on sites like Jihadology. This allows IS to project their content in an orderly manner, allowing placement of – in this case – geographic located collections to the benefit of ISIS.

This evidence demonstrates it is not that users theoretically “could’ use Jihadology as a convenient platform for extremists to access videos and messages from outlawed terror groups such as ISIS and al-Qaeda” … Jihadists supporters and sympathisers do use it to access individual URL, feed their content aggregators, and recommend it to their peers because the content is not removed. Unfortunately, the recommendation that users adopt VPN to access Jihadology may blunt the efficacy of traffic analysis, a problem which may also be compounded by the many commentators and policy professionals who have recently claimed to be regular users.

This means that while tech and social media companies are pressured, and threatened with fines, the content is still findable and IS supporters and sympathisers know it. As a result, ISIS (and other Jihadist groups) do not have to struggle to maintain a persistent presence for their content online, in addition to using Telegram, they can release the content and then allow sites like Jihadology to archive it for them.

The defence of Jihadology:

In defence of Jihadology, there have been many commentators saying a version of:

“the site is a vital research portal that provides a valuable service for academics, policymakers and journalists researching Islamist extremism”.

There have been numerous researchers who have recently been tweeting that they regularly use Jihadology – effectively announcing they rely on Jihadology as a crutch for their inability to locate or access Jihadist content. Penetrating Jihadist networks (beyond the entry level Nashir type channels) relies on being able to recognise the theologically encoded references and follow the content. As such, one wonders if in future those publicly stating they use Jihadology regularly may reflect on why they consider themselves qualified to conduct the complex task of analysing content when they can’t complete the simple task of locating that content by themselves. The inability to find content, and thereby having to rely on what is posted on Jihadology, may perhaps explain why Arabic language jihadist materials are so rarely referenced or cited in research.

As locating content is a significant part of research production, and given the number of people currently claiming they use Jihadology to find content, it appears Aaron Zelin deservers credit on many more research papers than he is currently recognised as making a significant contribution.

One wonders why commentators on Twitter talk of the valuable contribute made by Aaron and Jihadology, only to reduce that contribution to a reference to jihadology.net in a URL buried in a footnote when that same author publishes their research?

Others steer away from the ‘value’ of the contribution, and instead take the view that the “Content by itself does jack shit”. This follows the rationale that;

“How the message is received and incorporated into a broader worldview and acted upon is one aspect of what we, perhaps too vaguely, call the “process of radicalization”.

This particular researcher visits Jihadology several times a week – one assumes to view content disconnected from “the process of radicalisation” and thereby to study it doing “jack shit” if he follows his own logic, but who knows.

The description of what is broadly an ideational model of behaviour change highlights wider factors in the process. Nobody lives in a vacuum, but ideational models still require an idea to fulfil a fundamental role in this type of behaviour change process. As demonstrated above, links are not shared in a vacuum. Jihadist supporters have become adept at accessing the content posted on Jihadology and sharing it via Telegram channels and through Content Aggregators which project and reinforce their theologically driven worldview. It is in this context that potentially vulnerable people may access Jihadist media production. It is naïve to imagine the content posted on Jihadology can only be accessed by visiting Jihadology.net and searching the site for content.

While Jihadology was never intended to be a platform for jihadist groups, the data shows Jihadology has become a repository for video and written material exploited regularly by ISIS / Jihadist supporters and sympathisers. The links to specific videos or collections of material are shared within the context of aggregators or Jihadist Telegram channels, where the meaning of the content is discussed and Jihadology is recommended as a source that can be relied upon as it is not be deleted.

Just Jihadology?

The data show users in Arabic language Telegram channels recommend Jihadology to their peers as a location for them to view or download content. However, is Jihadology an isolated case or is it unfair for European governments to pick on Jihadology and Aaron Zelin specifically? Is this an example of a wider research sub-culture which actively publishes Jihadist content across social media and the surface web?

Wider Research Sub-culture

Rumiyah

To test whether there is evidence that Jihadology is an isolated case, we turn to the releases of the multilingual magazine Rumiyah using the #Rumiyah hashtag. If Jihadology is an isolated case, we would expect the initial release of each edition of the magazine, to be met with a surge of tweets about it on Twitter from ISIS accounts and supporters. The example below shows that the surge of tweets occurred.

Closer analysis of the data reveals that there are relatively few original tweets, but many retweets. This tends to indicate that there is less emphasis on conversation / interpretation and instead a greater focus on spreading information.

If these spikes were driven by ISIS supporters tweeting until their accounts are suspended one would expect to see many accounts being active for one release and a separate network active for the next release. One would not expect there to be a network infrastructure to span numerous releases. The way this would happen is if accounts were able share news of the release, without being suspended.

To examine nature of the network of retweets (which make up a large proportion of the overall tweets), we used Social Network Analysis (SNA) of the retweets. SNA shows the structure of the network through which news of the magazine release flows. In the case of Rumiyah releases, SNA shows that there was a network of accounts which spans numerous releases.

While Twitter suspends many pro-ISIS accounts, this prominent cluster is able to maintain a persistent presence. A closer examination of this persistent cluster shows it is populated by Academics, Commentators, Reporters and organisations selling monitoring services.

Network of accounts tweeting / retweeted about Rumiyah

However, are these accounts coincidentally engaged in discussion of the meaning of ‘Rome’ and ‘Romans’ within Jihadist theology, lacking deeper Arabic connectivity, or is this announcing the release of the magazine and / or sharing content from it?

Note: the coincidental appearance is not as ludicrous as it first sounds. One of the ‘Lend me your ears’ series of videos featuring John Cantlie was released on the same day as an entirely disconnected toga party. Both just happened to use the hashtag #lendmeyourears at the same time. And both ISIS and toga partiers were surprised by the juxtaposition of content.

In reality a review of the tweets shows that this is not coincidental. The network of academics is publishing announcements about the release of the magazine, including the banners ISIS created to promote the release, and sections of the magazine, such as text and graphics.

Tweets featuring Rumiyah announcement or content

The sharing of content likely provides greater reach for the content than ISIS could have achieved alone. Reaching as many people as possible was after all one of the main purposes of producing and releasing the magazine, and media material more broadly.

The release of Rumiyah issues was not the only times academics and commentators have probably provided greater reach and longevity for Jihadist content than ISIS could have achieved alone. Looking back over data from recent years, across a range of video announcements, audio releases, and claims of attacks a pattern emerges.

Speeches:

al-Zawahiri – April 2017

In April 2017, al-Qaeda leader al-Zawahiri released a new speech. After an initial tweet by Elizabeth Kendall, covering the key points from the speech @marypgkeating responded posting a link to the speech on YouTube with ‘English subtitles’, while others join in retweeting.

Tweets sharing al-Zawahiri speech details

al-Baghdadi

In November 2016, al-Furqan released a speech by al-Baghdadi. The release was greeted by: “Wow – it’s Baghdadi” from Mr Winter, followed by the name of the audio so others could find it and comments on the contents of the speech.

Could this type of tweeting be used to find content? To test this and mimic a ‘naïve searcher’ trying to find content, a search on Google.co.uk in May 2017 (six months later) used the title of the speech as tweeted.

In the results,

an English translation posted by al-Naba on archive.org,
a swath of other related ISIS documents including an English translation of a speech by the Abu Muhammad al-Adnani; Official spokesman for the Islamic State and
an ISIS video from the province of Ṭarabulus which had a similar name. That link lead to the video posted on Jihadology.net.

The test shows that this information could lead uninitiated users to access ISIS content. In addition, the data highlights that individual unwitting actions rapidly combine to provide easy access to a range of genuine ISIS content.

Battle footage and executions

Mosul

In addition to speeches, there were numerous ISIS videos of the fighting in Mosul. For example, the image from this video release from Ninewe province, would have allowed those able to read Arabic or Latin characters to search for the title of the video.

The ‘naïve searcher’ test was conducted in May 2017, using google.co.uk with the English title. This returned both the first and second parts of this series. At the time, ten of the top fifteen results provided a link to the video.

The same test in December 2018 still returned the video via Jihadology.net. This despite the same researcher (who now receives funding from Facebook) giving a bullish claim about the difficulty of finding IS content on social media and surface web.

He recently claimed;

“It isn’t just a case of googling “IS propaganda” and seeing what comes up (any more). This stuff isn’t readily available on the surface web like it used to be. If you’re not on Telegram or in a forum, the options are increasingly limited.”

Beyond the parochialism and evident Western habitus which leads a researcher to imagine the go-to search terms used by Jihadist supporters would include the word ‘Propaganda’, he is also apparently oblivious to the evidence that is available to anyone who bothered to do even the simplest research.

Just putting the content of one of his own tweets into a search engine delivers … IS propaganda. His assurances sound bold, but like many others that circulate within the field, it could not be considered “research-based in any rigorous sense” to use Alex Schmid’s phrase. That is “a very polite, typically academic way of putting it”, Nafeez Ahmed would likely suggest another.

Just like the previous insistence on media ‘decline’, fully fledged collapse, content production correlated to territory, and the ‘naïve notion’ of Utopia, claims about the findability of content have joined the list of claims which have turned out to be, as Rüdiger Lohlker recently highlighted, “an empty fog of words without inner content”. Quoting German philosopher G. W. F. Hegel, the section quoted by Rüdiger Lohlker continues:

This sort of chatter, though lacking the idea of philosophy, gains for itself a kind of authority through its very prolixity and arrogance. Partly this is because it seems almost incredible that such a big shell should be without a kernel…
G. W. F. Hegel

While those at institutions with links to Facebook insist content is hard to find, the actions of ‘experts’ who publish Jihadist content enable even uninitiated individuals to locate the content about the fighting in Iraq and Syria (and elsewhere). In this particular case, the publishing of announcements, pictures, statements and other ISIS material was not an isolated to a couple of examples. The Twitter timeline documented here shows the extent to which publishing of ISIS content made widely available.

Attacks

Responsibility and da’wa

One of the ways in which terrorist groups, of almost all types, have sought to extend their influence, is through claiming responsibility for attacks. Announcing attacks and recognising those responsible for them is important for ISIS and the Jihadist movement. As Abu Mus’ab al-Suri wrote in his Call for a Global Islamic Resistance;

The issue of individual jihad was a great da’wah success. It had great influence on awakening the spirit of jihad and resistance within the ummah, and it transformed unknown individuals such as al Diqamsa, Salman Khatir, Sayyid Nusayr and Ramzi Yusuf into becoming symbols of a nation. The crowds cheer their names, people’s thirst for revenge is satisfied, and a generation of youth dedicated to the Resistance follow their example

Similarly, Anwar al-Awlaki explained (while discussing the seventh meaning of victory);

Prevail here means the prevailing of their da’wah and not always their battles. They could loose (sic) the battle but their da’wah will achieve victory and be available. Nobody can stop their da’wah. The idea is that it will keep this group strong from generation to generation.
Seventh Meaning of Victory, Yusuf al ‘Uyayree Thawaabit ‘ala darb al Jihad (Constants on the Path of Jihad) Lecture series delivered by Imam Anwar al Awlaki (Quoted as transcribed)

For jihadist groups, statements claiming an attack or detailing a battle are not simple information updates, they are part of da’wa; spreading their theology by retelling the actions of the believers. Afterall, as Abdullah Azzam argued, “Jihad is da’wah with a force”.

Following the 2017 attack on the Manchester Arena ISIS issued statements in Arabic and English. A review of data from the time shows a range of researchers, including those based in the UK, either tweeted or retweeted the actual announcement, with collectively 100 retweets of just the four versions identified below.

Tweets sharing announcements of the attack in Manchester

A snapshot from Twitter on the day following the attack at the Manchester Arena, finds the OSCE held the World Counter Terrorism Conference in Vienna. The conference included discussion of how to make it harder for terrorist groups to spread their message, while some of those at the event were also publishing ISIS content on social media.

One of the attendees tweeted;

about the OSCE event,
the OSCE response to the attack in Manchester,
republished the ISIS claim of the attack,
before returning to the content of the OSCE event.

The tweeting of announcements was not a single ephemeral event, claims of responsibility were also shared for the attack on the Champs Elysees.

This has also continued in 2019, the current Director of ICSR published ISIS claims of responsibility for the bombing which killed US personnel in Manbij, Syria

Claims by Islamic State published on Twitter

The tweeting of this material from Rumiyah to speeches, videos and announcements, has the potential to increase the reach of Jihadist messages. In addition, as shown with the reuse of links to content on Jihadology, Jihadist supporters can also reuse that URL for their own purposes. In the example below from January 2019, an account with a username referencing ISIS responds to a story of Troop withdrawal by posting a link to a section of an ISIS video.

Among the numerous notable elements:

this specific clip from an ISIS video has 35,600 views on Twitter, despite claims by researchers this material is difficult to find (for them).
the original video clip was not posted by an ISIS, or Jihadist, account. It was an OSINT focused account, which a supporter subsequently used. This is one of the ways in which Jihadist groups exploit content sharing by commentators and pundits.

What this indicates is an increasingly sophisticated approach in which a user can create a seemingly pro-ISIS account, find a version of an ISIS video posted by an OSINT commentator and subsequently exploit the reticence of Twitter to remove such content from non-jihadist accounts by reposting the URL to the tweet containing the video.

An approach fit for a 21^st Century Sisyphus, Yes Minister or Monty Python

Tech companies are understandably reticent to remove content published by researchers. Yet while European governments pressure social media companies to remove content, and try to create upload filters and image hash databases etc. European governments are also giving things of value (salaries, grants, travel, and hotels) to researchers who publish this same material on social media.

As a result, while CTIRU, EUROPOL, Twitter and social media companies more broadly were making efforts to reduce circulation of ISIS content on social media – academics and for-profit organisations publish and republish jihadist content on the same social media platforms, and to an audience beyond that which ISIS could achieve alone.

It is perhaps the greatest irony that Government sessions to discuss how to make it harder for Daesh to spread their message online, are attended by researchers who frequently publish that same content on the surface web and social media.

It is an approach fit for Yes Minister, Monty Python or a 21^st Century Sisyphus.

Why this matters to Jihadist groups:

First the evidence above shows that jihadist groups recognise the opportunity to give da’wa by aggregating links to content posted by pundits and researchers. Second, when Western organisations and pundits immediately repost jihadist content, this is then re-posted in pro-ISIS Telegram channels and used to galvanize the mujahid vanguard.

Third, part of their theological understanding of da’wa is to spread their message as widely as possible. This goal of broad dissemination is considered successful if others hear the message of their theology. This has been covered in numerous documents written by a range of leaders of the jihadist movement. These documents have emphasized that spreading their theology as widely as possible is an important component of jihadist activity.

For example, Yusuf al-‘Uyairi recorded in his Constants on The Path of Jihad,

Jihad will continue until the Day of Judgment (or as referenced in numerous ISIS videos, ‘Until the final hour’), which also connects it to Sahih Muslim / Book 41 / Hadith 6924
Jihad is not dependent on a particular land, but Jihad must be part of your life,
Seventh meaning of victory: victory of your idea (Anwar al-Awlaki’s translation is quoted above)

Viewed collectively, in the context they are used by Yusuf al-‘Uyairi, these points recognised that there will always be people to reach, both those to fight and those to give da’wa. Therefore, spreading the message is a constant for the Jihadist movement.

The importance of this task was also covered by ibn Nuhaas, who highlighted the The Virtues of Encouraging Jihad. He quotes Surah al Nisa 84,

“So fight, [O Muhammad], in the cause of Allah; you are not held responsible except for yourself. And encourage the believers [to join you] that perhaps Allah will restrain the might of those who disbelieve. And Allah is greater in might and stronger in punishment.”
Surah al Nisa 84

The phrase “you are not held responsible except for yourself” is interpreted by Jihadists within the context of da’wa to mean that they will be individually judged on whether the individual sought to spread the word, not on whether those who heard that message subsequently responded. Therefore, their interpretation of the duty is to find ways to spread their theology. The purpose of the da’wa effort was also noted by Ayman al-Zawahiri. In his General Guidelines for Jihad, (as-Sahab media) there were two elements to the communication or media work.

First: Educating and cultivating the Mujahid vanguard, which shoulders, and will continue to shoulder, with the permission of Allah, the responsibility of confronting the Crusaders and their proxies, until the Caliphate is established.
Second: Creating awareness within the masses, inciting them, and exerting efforts to mobilize them so that they revolt against their rulers and join the side of Islam and those working for its cause

In more specific guidance he wrote:

Focus on spreading awareness amongst the general public so as to mobilize it. Similarly, focus on spreading a greater level of awareness and understanding amongst the Mujahid vanguard to create an organized, united, ideological, and aware Jihadi force that strongly believes in the Islamic faith, adheres to its rulings, shows humbleness to the believers and deals with the disbelievers with firmness. At the same time, full effort should be put in immediately to ensure that people with scholarly and propagational abilities come forth from within the ranks of the Mujahideen so that our message & belief set may be preserved and the call to Jihad may be spread amongst Muslims.

Researchers publishing the announcements are, in the eyes of jihadist groups who produced the original statements, spreading the da’wa which these acts were intended to give.

In the jihadists mindset, these researchers are tools for their divine mission. The reposting of links to Jihadology clearly indicates the Jihadist mindset on the issue – these are not two separate worlds but one interconnected ecosystem, however unwitting some of the participants are within it.

Why Pick on Aaron?

The data on content releases, from magazines to speeches, to videos and announcement of attacks, shows that Jihadology is not alone in publishing Jihadist content.

The data analysis shows a research sub-culture has developed in which posting jihadist content on social media is an acceptable norm; Aaron Zelin is just one part of a much wider network of researchers publishing ISIS and jihadist content on social media and surface web.

Given the extent to which publishing jihadist content on social media and the surface web has become a norm for pundits who make up this research sub-culture, it seems both unfair and entirely ineffective for European governments to target Jihadology and Aaron Zelin as if he and his website are an aberration distinct from the research sub-culture of which he is part.

To what extent can European governments threaten social media companies with fines (or individuals with prison time), when those same governments work with, give things of value to, or employ the researchers and commentators who post that same content on the same social media platforms?

Ethical approaches and leadership.

The kneejerk censorship vs. academic freedom arguments move nothing forward. It merely provides more time for Jihadist groups to distribute their material by exploiting the current way .

Researchers who publish ISIS theologically driven content (and almost invariably without real analysis) often claim to offer these materials to a wider audience for the ‘greater good’. The evidence shows, they are complacently enabling the jihadist movement to remain a coherent online presence – a situation inevitably to the advantage of the movement.

Years ago, when I had the privilege of working on a project with researchers at CEOP, their professionalism, integrity and approach eclipsed that which currently passes as the norm in what might loosely be termed Terrorism Studies.

They had a robust approach to mental health. Upon finding new material or images of child exploitation they did not franticly tweet them. Upon hearing of an attack, they did not reach for their phone to alert journalists to their availability for interview. Finding indecent images of children on a new platform, they did not begin pitching the story of the ‘next big thing’ to whoever would take it. When serious events caused the issue to make the headlines, they did not use it as a reason rush to the TV studios and tweet about being on TV.

These researchers did not spend any time on how many Twitter followers they had, and they certainly didn’t tweet about how many followers they had. From my limited experience of working with researchers from CEOP, they avoided behaviours that could make the situation worse, that could make the content more widely available, or could exacerbate the suffering of victims. From the evidence above, the study of terrorism is generations behind their example.

After the hype, what about the data? Part 1: the Telegram ‘Cull’

After the hype about the removal of ISIS Telegram channels, this post examines the data on the information ecosystem to sort the anecdotal observation from evidence-based research.

Central to the authentic understanding of the Jihadist movement is the ability to locate and understand the content. Unfortunately there is tendency among some researchers to give prominence to and draw conclusions from the limited content they can locate. This is a problem we have highlighted previously including in the New Netwar and in earlier posts:

The difference between the content commentators hype and tweet about because they can find it, and the content that is important to the Jihadist movement, is one of the fundamental and often poorly understood distinctions in contemporary academic study of the Jihadist movement.

Two recent events, the recent purge of Nashir channels on Telegram and the UK government putting pressure on Jihadology, have, individually and collectively, highlighted how important it is for researchers to have a sufficiently nuanced understanding of the movement to be able to locate content themselves. Research should get beyond the easy to find Nashir network, which are there to give entry level access to the movement.

The inability to penetrate beyond a few entry level daily news channels, leads to challenges compounded by the lack of serious data analysis on the extent to which material produced by ISIS, AQ and other Jihadist groups, is actually available online.

In just the last few weeks there have been conflicting accounts.In one a researcher with funding from Facebook claimed that “This stuff isn’t readily available on the surface web like it used to be. If you’re not on Telegram or in a forum, the options are increasingly limited.” While Peter Neumann defended Jihadology by saying “the online nature of this makes it ubiquitous”.

Something being ubiquitous tends to be mutually exclusive with not being readily available. What these comments and other commentary has laid bare is how often commentary is based on opinion and anecdotal observation, at best, rather than evidence-based research.

In the following pair of two posts we look at the data behind these two events.

This first post examines theextent to which the removal of fringe Nashir channels on Telegram impacted the information ecosystem.
The second uses data analysis to test the recent UK government suggestion that Jihadology could be used as a convenient platform for extremists to access videos and messages from outlawed terror groups such as ISIS and al-Qaeda, to answer the question whether Jihadology is used to access content by groups such as ISIS and examine whether some researchers and commentators play an unwitting role in the jihadist information ecosystem.

Part 1: The Telegram Cull.

BBC Monitoring reported that what they term the ‘Telegram cull’ followed attempts by ISIS to “beef up its presence on the platform”. Focusing on Nashir, BBC Monitoring continued …

jihadist group operates a network of multiple channels and groups on Telegram under the “Nashir News Agency” brand.

https://monitoring.bbc.co.uk/product/c200h0s4

The focus on Nashir channels was repeated by others, Pieter VanOstaeyen noted; “Remarkably large take down of ISIS Telegram channels and groups tonight”and in a later Tweet “Of around 60 Nāshir News accounts I was following 4 remained active”.

Shiraz Maher, had similar problems, “It was a rough morning for me. Major take downs of the channels/groups I was in”. These and similar observations fueled the impression that the jihadist network was under significant pressure. “Not only ISIS accounts, everything that even remotely reeks of Jihad is getting hit” tweeted Pieter Van Ostaeyen. He later joked “There was a major disruption in the Dark Side of The Force, but they’re back again”

Jihadist Ecosystem – 10 December 2018

To ascertain the actual impact, a review of 410 human verified Jihadist groups and channels on Telegram, using the same methodology as the previous post, was conducted. It showed that the information ecosystem has remained resilient. The data from the 410 channels and groups shows that many survived the purported cull.

Followers

The followers / members of the groups remain at an average of over two thousand with the largest garnering over 70,000 followers. There are over 200 channels with more than 400 followers. However, it is currently unclear if these are different individuals in the groups – as discussed in an earlier post.

Longevity

The time elapsed since the creation of the channel / group also provides clear evidence that the information ecosystem has remained uninterrupted. The average length of time a channel has been operating is greater than one year (Mean 380.1 and median 380.6 days).

The average length of time a channel has been operating is greater than one year

The longevity of channels shows that recent chatter about losing access to channels has had an impact only on those with limited access to Jihadist channels, and who struggle to locate the content. For the wide range of jihadist sympathisers who can read and understand the meaning of the content, access has continued largely unabated.

Views

Access to content shown by views on individual posts shows that users are accessing the content. Even an overly cautious estimate where all duplicate view counts are removed to avoid double counting, produces a conservative 135,256,000 total views.

The Network

Decoding the Swarm logic of the Media Mujahidin is in part based on understanding the network structure.

Analysing the last 500 posts from each of the channels / groups and extracting the data of posts forwarded from other channels / groups /users, produces the network graph.

The graph has 3410 nodes in total, 2831 (83%) of which are part of an interconnected giant component.

The network perspective confirms what the longevity and availability of accounts had suggested, that the information ecosystem has remained intact.

This is a repeat of much of the analysis on Twitter where an inability to find content was misconstrued as evidence the content did not exist.

Unfortunately, as we demonstrated in the New Netwar, at the same time that researchers were reporting they could find very little content on Twitter, the platform was used to drive a large portion of traffic to Jihadist content. Similarly, today commentary based on the narrow soda straw of Nashir and similar channels is to miss a wide range of the content, communication and meaning which occurs on Telegram.

Despite the chatter about a ‘wave’ of channels and groups becoming inaccessible and commentators losing access to large numbers of Nashir channels the network is still there and remains accessible to those who know how to access it. From the user perspective, the removals would barely rank as an inconvenience.

The findings of this post repeats the findings of the previous analysis of Telegram Channels. Those findings were:

The graph shows that Jihadist Telegram Channels form a series of interconnected clusters.
Despite attracting the greatest attention from Western commentators, the Nashir News cluster is a tiny part of the overall ecosystem.
AQ and ISIS clusters are distantly connected.
There is a cluster of Jihadist sympathizers and supporters which align closely with neither ISIS nor AQ.
The creation of content archives on Telegram ensures users who see themselves as murabiteen (horse backed warriors guarding Muslim territory) are able to access the content needed to conduct ghazawat (raids) onto other platforms.

Major IS cluster

A closer look at the major IS cluster shows 27 statistical interconnected clusters. Each of these clusters has a particular thematic focal point, including a range of specifc theological elements. Within this major cluster there is a further ‘core’ group of channels, as well as channels relating to a range of Wilayat.

Even within just this major IS cluster there is significant range of material which provides a deeper view of the movement than may be realised if one begins from a perspective that nashir are a core part of the ecosystem. The idea of ‘core nashir’ is an oxymoron. Losing access to nashir would barely register if one genuinely has access to the breadth of content at the core which, needless to say, is mainly in Arabic.

Soda Straws

Adopting a soda straw mentality, where a small part of the information ecosystem – in this case the Nashir network – is talked up and given an overblown sense of prominence in the jihadist information ecosystem, inhibits the authentic understanding of ISIS and Jihadist activity online.

The soda straw mentality comes in numerous forms the study of jihadist groups and terrorism more broadly. Some are based on the very limited access to content. The recent commotion and Twitter chatter about a wave of Nashir deletions highlights many of those caught up with this particular issue as genuine access would deter anyone from thinking the nashir represent anything other than a small fraction of the activity.

Other soda straws appear from the way individuals handle data or cherry pick time periods which create impression of decline, strong correlations to territory and ‘full-fledged collapse’. Nafeez Ahmed’s The Astonishingly Crap Science of ‘Counter-Extremism’ should be required reading.

Conclusion

This post replicates the earlier finding that the Nashir network is part of the ISIS Telegram network, and a very small part of the overall information ecosystem. As a result, much of the contemporary commentary suggesting Telegram (and largely Nashir channels) is the place to get content, is based on anecdotal observations derived from gazing down a narrow soda straw at an often fringe group of accounts. There is a largely unobserved network of accounts which meant those with genuine access barely noticed the removal of Nashir channels.

If commentary is based on a level of access to Jihadist content where removal of the Nashir channels is noteworthy, for example for the authors of this report,one has to view claims that the research authentically reflects the breadth of ISIS activity with a degree of skepticism.

Central to the authentic understanding of the Jihadist movement is the ability to locate and understand the content. Otherwise the study of Jihadist groups becomes dislocated from the meaning and purpose of the movement and produces interpretations of the movement using misplaced notions of crime,rap, and the ‘naïve notion’ of Utopia. In contrast, Jihadist groups have produced tens of thousands of documents, outlining their understanding and intended application of theology. For example, Anwar al-Awlaki described;

People like Shaykh Abdullah Azzam and Shaykh Yusuf al ‘Uyayree.They wrote amazing books, and after they died it was as if Allah made theirsoul enter their words to make it alive; it gives their words a new life.

Rasoolullah (sallallahu ‘alayhe wassallam) said the at-Taifah will prevail. Prevail here means the prevailing of their da’wah and not always their battles. They could loose the battle but their da’wah will achieve victory and be available. Nobody can stop their da’wah. The idea is that it will keep this group strong from generation to generation.

Seventh Meaning of Victory, Yusuf al ‘Uyayree Thawaabit ‘ala darb al Jihad (Constants on the Path of Jihad) Lecture series delivered by Imam Anwar al Awlaki (Quoted as transcribed)

Put simply, whether it is a battle or a channel on Telegram, for Jihadists part of the victory they seek stems from ensuring their actions give da’wah. It is the encoded theological aspects such as this, rather than speculation about crime and utopia, that allows users to move beyond the Nashir based fringes. Being able to identify theological elements which allow individuals to access a greater breadth of Arabic content should be a basic requirement for anything above a degree level researcher.

ISIS: Sunset on the ‘decline narrative’

In 2017 the ‘decline narrative’ had become widely accepted by Western researchers focused on the Jihadist movement. In contrast, in November 2017 we predicted that ISIS media would continue to fluctuate in 2018. This was based on an archive of digital and digitized content. The digital Jihadist content which stretches across more than two decades, 300,000 pages of Arabic text, 6,000 videos, hundreds of hours of audio (including 600 hours of ISIS radio programs). The archive of digitized content stretches even further back, given the nature of content of the 1980s, for example, that was later digitalized and is part of what the Sunni extremist movement shares.

During 2017 much was being written about the ‘sharp decline’ of ISIS media and even demise of a physical Caliphate. Our prediction faced opposition from those who were pushing the ‘post-Caliphate’ decline ‘narrative’ and particularly those who seemed to be staking their reputation on the continued decline correlated to territorial loss.

In January 2018 Jade Parker and Charlie Winter announced “a full-fledged collapse” of ISIS media.^[i] Only days later, it became clear January 2018 had also witnessed a 48% month-on-month increase in ISIS content production.^[ii] In addition, rather than a full-fledged collapse, in March 2018 ISIS were still able to drive traffic to their content, with some videos getting over 12,000 views on Twitter.

As we have said before, just because non-Arabic and faux-Arabic speaking researchers cannot find it, does not mean the content does not exist – nor does it mean the target population for the content cannot find it.

It is clear today that rather than moving from media decline to “full-fledged collapse”, ISIS media continued to fluctuate as we predicted. This more complex representation relies on differentiating decline and degradation from a period of reconfiguration – as we have been saying since 2014.

This post shows that the Jihadist movement is much more complex than those pushing the ‘decline narrative’ suggest. It shows why counting the number of videos has little bearing on the amount being communicated – which after all is the purpose of producing the videos.

Recognising the limits of the contemporary ‘metrification’ approaches, along with the cherry-picking of timepoints and the overemphasis of pictures on which the decline narrative relies, we focused on in-depth analysis of strategy, Arabic documents, audio and video to produce an authentic representation of the movement.

So, how did we know?

Based on a genuine collaboration between subject matter expertise and data analysis, we uncovered the answer as a combination of two factors;

The jihadist movement operates on a much longer timeline than appreciated by pundits looking to produce tweet-ready metrics.
While many western commentators were pushing the ‘decline’ narrative, based on the over-representation of pictures, video production which had been low over the summer had already begun to increase again during the autumn.

These elements and in-depth analysis of the movement allowed us to make the prediction before the event, in contrast to the many ad-hoc descriptive responses after the event.

How did we do it?

After building an archive of over 300,000 pages of Arabic text, and 6,000 videos, and hundreds of hours of audio produced since the 1990s, it was clear that long form matters to the core of the Jihadist movement. And this does not even touch on the wealth of magazines created in the 1980s by Sunni extremist groups.

In the thousands of pages of Arabic text, strategy was clearly articulated for those able to read Arabic and willing to invest the time to understand the references, context and encoded meaning. Getting past what Nico Prucha refers to as the “Initiation firewall”, means you need to have read and consumed the content in Arabic to understand the depth of theology which is used as coded communication. Yet, in most research not even transliterated Arabic keywords that matter for the Sunni extremist movement and are used as codes in English-language publications matter and are properly analysed.

Content, especially Arabic language content, is fundamental to the movement, yet the lingual & theological expertise to understand it is almost constantly neglected and lacking in research. This blind spot allows the jihadist movement to reorganize and recuperate out of view of contemporary research and commentary. This allows the movement to develop strategy and tactics by leveraging a wealth of material shared online – and re-organize and develop new outreach strategy. These online spaces provide a safe-haven of coherent theological framework and invites individuals – based on their individual degree of initiation – into more and more clandestine networks, involving layers of online vetting processes.

These clandestine networks are protected by:

Arabic language required to access clandestine networks, the ongoing paucity of these language skills amongst researchers is appalling (lingual firewall),
Knowledge of the coherent use of coded religious language and keywords, which few researchers can demonstrate in their writing (initiation firewall),
With the migration to Telegram, ISIS succeeded in shifting and re-adapting their modus operandi of in-group discussions & designated curated content intended for the public (as part of da’wa).

Passing these firewalls provided access to what ISIS – and the Jihadist movement more broadly – are trying to achieve. [Spoiler alert] What they seek has nothing to do with ‘Utopia’.

Unfortunately, a rigorous understanding of Arabic and deep appreciation for the theological references that Jihadists use simply do not seem to matter to commentators who have become pre-occupied with the few English items and pictures that they have found (though even these are not necessarily understood).

Using the strategic approach adopted by ISIS, and the Jihadist movement, as a point of departure, we examined the amount of video being produced since ISI transitioned to ISIS.

Using the longer timeline and rolling mean of the number of videos produced, it is easy to see that the most likely outcome would be that ISIS media would continue to fluctuate rather than follow the linear ‘direction’ of decline.

Two points provide an important book-ends that further disrupt the decline narrative. First, the highest peak falls before the much talked-up ‘high-point’ in content production. Second, the next highest period of video production fell at the end of 2016 and is much higher than the rest of 2016, exceeding almost the entire history of ISIS video production. This repeats the finding of earlier research which also highlighted the fluctuation in content.

Just as magazine production going back to the 1980s and 1990s fluctuated, so all forms of media production fluctuates.

Equally, as the end of 2017 approached and many western commentators were pushing the ‘decline’ narrative, video production which had been low over the summer had already begun to increase again.

These findings are in sharp contrast to the massive overemphasis on pictures and tweet-ready metrics, by western researchers.

[Another spoiler alert] those who are able and inclined to read the Arabic magazines of the 1980s and 1990s will recognise all the theological themes, articles on mujahidat, defining wilaya etc. currently being passed off as new or unprecedented by Western commentary about ISIS.

Not all content is created equal.

We have written before about the methodological flaw that results from counting pictures, video, newspaper all equally in the attempt to produce a linear metric. To examine the differences in content we looked at the length of videos measured in minutes.

Three hugely important points emerge. First, the direction of the trendline, second that measured in minutes video production peaked at the end of 2016, and third, the volume of video during late 2017 and early 2018 was higher than it had been earlier in the year.

If you take a view of ISIS from 2013 to present the trend in production is up, not sharp decline.

While picture-centric counting was hailed as showing ‘total collapse’ – the longer, more complex, and arguably much more resource intensive / important videos, were not following that pattern.

Video production in minutes during the second half of 2017 was not in decline but had been increasing. This allowed us to predict that overall production would continue to fluctuate in the face of howls of protest and decliners insisting we were ‘wrong on direction’.

Five months into 2018, the band of committed decliners has thinned significantly. Some are now even trying to sweep under the carpet the earlier claims of collapse, single downward direction, linear / steady decline, or a strong correlation with territory.

Furthermore, the assumed correlation with territory is problematic as the publications from the pre-ISIS era highlights. AQ derived great value from curated videos and writings that spanned from Afghanistan, Pakistan, Yemen etc. where little to no territory was held at the time.

Authenticity

We covered before why basing analysis on a cherry picked high point produces a nice narrative, but not an authentic result.

Contrasting the number of videos produced with the average length of production we find further startling results. The high point of video production comes at one of the lowest points for average length. This means that the high point was produced because ISIS published a higher number of shorter videos. While at other points, such as now, they produced fewer longer videos.

This highlights that counting the number of videos has little bearing on the amount being communicated – which after all is the purpose of producing the videos. Here we see one of the flaws in drawing conclusions from counting the amount of content produced. Producing one long video does not communicate half as much as two short videos so cannot support conclusions of ‘decline’ and collapse. Equally worth noting, the linear trend lines both show a rising trend rather than a decline in number and average length over the entire period.[iii]

Metrification:

Tweet-ready punditry has led commentary to focus on finding and tracking a magic metric rather than developing an authentic understanding of the movement (a trend policy has, to an extent, followed). However, there can be no doubt now that magic metrics pushing decline and full-fledged collapse have failed to provide an authentic representation of the movement.

These metrics have been used to justify pronouncements of decline and ‘total collapse’ in ISIS media and claims production is strongly correlated with territory – which, while headline grabbing, have failed to hold up to scrutiny in 2018, just as the passage of time has shown previous claims of decline and degradation to be more wishful thinking than evidence based conclusions.

Three elements, previously highlighted by Richard Jackson, are particularly prescient when reflecting on the recent metrification of research into the Jihadist movement.

Specifically, the tendency toward:

treating the current problem as unprecedented and exceptional
descriptive over-generalisation,
problem solving approaches that risk reducing research to ‘an uncritical mouthpiece of state interests’

Unprecedented and exceptional

Richard Jackson observed that there has been a “persistent tendency to treat the current terrorist threat as unprecedented and exceptional”.^[iv] Representing the current threat as unprecedented and exceptional in nature, is a helpful tool if one were to want to start analysis at a preferred point – rather than account for what came before – or account for any relationship between previous iterations of the movement and the contemporary situation. This is important not least because ISIS draw extensively on content and experiences from previous iterations of the movement.

There have been a rash of studies over recent years focusing on ‘official’ social media accounts or what is often termed ISIS ‘official’ media. They use data which starts in 2014 (or strangely 2015) and occasionally – the totally bizarre approach of drawing conclusions using only a single time point before 2017. This approach enables a simple metrification – but undermines authenticity by separating the analysis of the movement from its historical roots. The cherry picking of time points allows everything to be boiled down to a magic number without reference to what came before thereby providing a policy friendly ‘narrative’.

However, the Media Mujahidin did not appear one day out of nowhere. It evolved over two decades of online activity – tied into the jihadist tradition of producing media since the 1980s during the jihad against the Red Army in Afghanistan.

A previous post demonstrated that once we get away from the narrow discussion of ‘core’ nashir channels we can escape the over-generalisation based on a tiny sample of channels. Taking a wider perspective shows that rather than being a few disconnected channels, the network structure allows Jihadist groups to maintain their resilience and distribute the full range of content. Jihadists groups have been observed using these structures since 2013, and building on these observations, it is clear that this current iteration, like the movement in general, is neither unprecedented nor exceptional.

Descriptive over-generalisation

Reviewing the articles published since 9/11, Richard Jackson observed “the vast majority of this literature can be criticised for its orientalist outlook, its political biases and its descriptive over-generalisations, misconceptions and lack of empirically grounded knowledge”.[v]

Over the years, metrification and over-generalisation have resulted in numerous claims of degradation and decline, culminating in recent pronouncements of ‘total collapse’. In time, all these claims have been shown to be misplaced. This is because, as noted in 2014, “the nature of the mobile-enabled swarmcast means it can appear to be degraded, but it has really only reconfigured”.

The level of over-generalisation from a few limited observations and ongoing metrification have been key parts of the decline ‘narrative’. Unfortunately, it risks peering down a soda straw at a large-scale complex problem , to borrow an analogy from Kill Chain. For example, the VOX-Pol study Disrupting Daesh concluded “IS’s ability to facilitate and maintain strong and influential communities on Twitter was found to be significantly diminished” and that “pro-IS accounts are being significantly disrupted and this has effectively eliminated IS’s once vibrant Twitter community”.[vi]

These findings are an overgeneralisation, just like previous claims, based on extrapolating from the soda straw perspective of researcher’s inability to find twitter accounts. The evidence from beyond the soda straw shows ISIS continued to drive traffic to their content. Twitter represented 40% of known referrals to ISIS content during the time period of the VOX-Pol study.^[vii] If ISIS had been significantly disrupted – where was the traffic coming from?

This type of over-generalisation has been key to the decline narrative. In another example, Peter Neuman claimed:

Instead of populating mainstream social media platforms such as Facebook and Twitter, Islamic State supporters have been pushed into the darker corners of the internet, especially the private messaging app Telegram, where reaching out to new supporters is more difficult.

Directly contradicting that claim, in addition to the 12,000 views on a video in March, shown earlier, a sample from consecutive days in May 2018 shows ISIS videos still being watched thousands of times on Twitter – 7,351 views, 9,192 views and 8,699 views on 12^th, 13^th and 14^th May respectively. A clear indication that outreach is ongoing via Ghazwa, as core members access content via Telegram. The success of this uninterrupted outreach process adds to the coherency that ISIS texts and videos offer to their target audiences.

Risks of being an uncritical mouthpiece

A third observation central to the development of Critical Terrorism Studies equally highlights the limitation of an approach based on problem-solving metrification;

“It is fair to say that the vast majority of terrorism research attempts to provide policy-makers with useful advice for controlling and eradicating terrorism as a threat to Western interests”. This problem-solving approach can “be a real problem when it distorts research priorities, co-opts the field and turns scholars into ‘an uncritical mouthpiece of state interests’”.^[viii]

The narrative of ISIS in decline, in addition to undermining what they claim as a “utopian picture of life under Daesh rule”, or what Rex Tillerson referred to as the “false utopian vision”, have been parts of the strategy adopted by the Global Coalition against Daesh.

That the decline ‘narrative’ has been pushed so hard by some commentators insisting on their being a ‘direction’ – there has been a growing risk of some becoming uncritical mouthpieces.[ix] For example, the idea of ISIS seeking to project a utopian vision is uncritically accepted by many Western commentators. This subsequently distorts the interpretation of ISIS media. For Jihadist groups Utopia is not a concept to which they aspire. This is due to the theology which draws a clear distinction between the worldly concerns or the temporal world (dunya) and paradise (janna). Even so, academic references connecting ISIS to Utopia proliferate, without reference to original jihadist content that discuss ‘Utopia’ as a goal for their activity.

More troubling than the lack of critical thinking about the core concepts of the jihadist movement are the whispers of researchers working with / for Coalition members and their contractors one day, and the next day representing themselves as independent journalists writing about ISIS decline or Coalition success.

Clear disclosures of potential conflicts of interest between journalism, research, and Government interests are fundamental parts of producing credible academic findings.

If these whispers are confirmed, it would realise one of the objectives outlined by Jihadists including Abu Mus’ab as-Suri, to show Western society contradicting the values to which they claim to adhere. It would be a completely ridiculous and entirely avoidable own goal.

It would also be a breach of journalistic ethics akin to Sean Hannity’s less than full disclosure and represent one of the most profound breaches of trust in the publication of research since the CIA was found to be covertly channelling money to Encounter Magazine and the Congress for Cultural Freedom.

Conclusion

Problem-solving punditry, metrification, and the ‘decline narrative’ have become widely accepted by Western researchers focused on the Jihadist movement. However, as this post has shown the Jihadist movement is much more complex than those pushing the ‘decline narrative’ suggest.

Recognising the limits of metrification, the cherry picking of time points and decliner emphasis on pictures rather than in-depth analysis of documents and video, will allow researchers to produce a more authentic understanding of the movement than is possible from simple linear metrics.

As Rüdiger Lohlker wrote in September 2016,

“without deconstructing the theology of violence inherent in jihadi communications and practice, these religious ideas will continue to inspire others to act, long after any given organized force, such as the Islamic State, may be destroyed on the ground;”[x]

ISIS has the upper hand by inhabiting places that are blind spots for outsiders. They use these blind spots to their advantage. Rather than collapse, ISIS continue to produce coherent content in Arabic – content of which hardly seems to matter to most policy makers and researchers. They build resilient, regenerative online networks – that are now completely in the dark for outsiders. They have battle-hardened fighters on the ground, and the intellectual capital— “their weapon designs, the engineering challenges they’ve solved, their industrial processes, blueprints, and schematics” – from what Damien Spleeters calls “the industrial revolution of terrorism“.

With the commitment, knowledge and ongoing access to resilient networks, ISIS continue to publish new content (videos, articles, newspapers, radio programs etc.) from locations across MENA and ‘East Asia’.

Notes

[i] https://www.lawfareblog.com/virtual-caliphate-rebooted-islamic-states-evolving-online-strategy

[ii] Analysis: IS media show signs of recovery after sharp decline, BBC Monitoring, (23^rd February 2018)

https://monitoring.bbc.co.uk/product/c1dov471#top

[iii] Worth note here, the R²values are very low – suggesting polynomial or a longer window rolling mean might give better representations, but as we are discussing linear metrics we show it here.

[iv] Richard Jackson, The Study of Terrorism after 11 September 2001: Problems, Challenges and Future Developments, Political Studies Review, 7, 2, (171-184), (2009)

[v] Jackson, Richard. “The Study of Terrorism 10 Years after 9/11: Successes, Issues, Challenges.” Uluslararası İlişkiler 8.32 (2012): 1-16.

Jackson, R. ‘Constructing Enemies: “Islamic Terrorism” in Political and Academic Discourse’, Government and Opposition, 42, 394–426 (2007)

[vi] Conway, Maura, et al. “Disrupting Daesh: measuring takedown of online terrorist material and it’s impacts.” (2017): 1-45. http://doras.dcu.ie/21961/1/Disrupting_DAESH_FINAL_WEB_VERSION.pdf

[vii] Frampton, Martyn, Ali Fisher, and Dr Nico Prucha. “The New Netwar: Countering Extremism Online (London: Policy Exchange, 2017

[viii] Jackson, Richard, “The Study of Terrorism 10 Years After 9/11: Successes, Issues, Challenges”, Uluslararası İlişkiler, Volume 8, No 32 (Winter 2012), p. 1-16 quoting, Ranstorp, “Mapping Terrorism Studies after 9/11”, p.25

[ix] Here ‘uncritical’ refers to critical thought, rather than being negative.

[x] Rüdiger Lohlker, Why Theology Matters – The Case of ISIS, Strategic Review July –September 2016, http://sr-indonesia.com/in-the-journal/view/europe-s-misunderstanding-of-islam-and-isis

How well established is the Jihadist movement on Telegram?

This post looks at a network of 462 human verified Jihadist channels on Telegram and over 6,000 additional Telegram channels and groups on which they draw. It demonstrates that the network is much bigger and exhibits a greater level of interconnection than indicated by recent references to munasir and supposed Core Nashir Channels Telegram. The post then highlights the ‘veil of silence’ that has been cast over the majority of activity conducted by the Jihadist movement on Telegram – activity which is primarily in Arabic, focuses on applied theology, and references a vast library of earlier writing, audio and video.

The use of Telegram by the Jihadist movement has attracted the attention of politicians, who have called on platform owners to deny the movement ‘safe spaces‘ – with inevitable push-back from others including Telegram CEO Pavel Durov. At the same time, rumors circulate of Silicon Valley VCs looking to invest in Telegram, while many column inches have been filled with the usual punditry and superficial commentary about ISIS and social media.

Nashir / News

The often referenced Nashir and other news related channels are a natural starting point for analysing Jihadist groups. Many of this type of channel allows users to see the other followers who are also members of that channel. Network Analysis shows the real number of users in the network (6,266 users) and the clusters of users (blue dots) who make similar combinations of choices about the channels to follow (orange dots).

Channels on the right of the network focus on the formally branded content distributed via Nashir and Amaq channels. Those channels on the left tend to blend the formally branded content with a greater level of supporter generated and affiliated media foundation content. Far from being less important, due to being ‘unofficial’ as is often presented, this blending of content reflects the shared purpose, rather than shared organisational structure, as had been outlined by Abu Mus’ab as-Suri over a decade ago.

The BlackLight image feed (which updates with newly posted content from Jihadist Channels every 90 seconds) frequently shows a wide variety of content which ranges from branded content to pictures of former ideologues and leaders, to imagery which conveys concepts which will resonate with sympathizers versed in Jihadist theology, that of course is distributed primarily in Arabic.

Wider Telegram Network

This range of content is inline with what we expected to find. Nico Prucha has taken “a closer look at what Telegram is, and how IS uses it for different purposes: not only operationally, but also for identity building“. More than just narrowly defined ISIS branded content, the range of content “conveys a coherent jihadist worldview, based on theological texts written by AQ ideologues and affiliates as far back as the 1980s”.

To break away from the narrow discussion of ISIS content, we analysed the wide ecosystem of Jihadist channels. This ecosystem allows the Jihadist groups to maintain their resilience and distribute the full range of content out of view from those focused on Nashir / News content.

The graph is based on 290,000 posts and shows the content sharing behaviour of 462 human verified Jihadist Telegram channels, and over 6,000 channels from which they share content. Initial observations:

The graph shows that Jihadist Telegram Channels form a series of interconnected clusters.
Despite attracting the greatest attention from Western commentators, the Nashir News cluster is a tiny part of the overall ecosystem.
AQ and ISIS clusters are distantly connected.
There is a cluster of Jihadist sympathisers and supporters which align closely with neither ISIS nor AQ.
The creation of content archives on Telegram ensures users who see themselves as murabiteen (horse backed warriors) are able to access the content needed to conduct Ghazwa (raids) onto other platforms.

While the Nashir gain the attention of commentators and pundits, there is a large number of channels and huge amount of content going undetected. This content is also reaching large numbers of people, given that the content in the 293,000 posts has been viewed over 460 million times. (This is the number once the duplicate views have been removed). Below, for example, has been viewed over 309,000 times.

A subordinating silence

Caron E. Gentry and Katherine E. Brown have both shown how particular approaches, including cultural essentialism and neo-Orientalism, can cause a ‘subordinating silence’ which veils particular groups or perspectives from view.(1) These, like many of insights derived from the work on subordinating gendered narratives about terrorists who are female, provide valuable perspectives and parallels closely the issue of which parts of Jihadist ideational content matter to, or get attention from, Western researchers and policymakers.

As Caron E. Gentry has shown, the women who gain media attention are those “that present threats to the Western ‘us’ and not the Middle Eastern ‘other’.” Specifically highlighting coverage of women who either left the west to fight in Iraq, or with ties to AQ and as such threatened to attack Western interests elsewhere. By contrast, for ‘women who did not (yet) pose a threat to Western interests…, virtually no image exists in the public eye. They almost do not exist’.(2) Similarly one finds many studies of English language sources, with significantly fewer studies of the Arabic sources – despite Arabic being the primary and vastly more heavily used language of the Jihadist movement.

As the late Reuvan Paz noted, the movement is “almost entirely directed in Arabic and its content is intimately tied to the socio-political context of the Arab world”.(3) Yet the vast majority of research focuses on English sources. Perhaps this is the content Western researchers are able to find, or because so few researchers are able to listen to and understand the nuances of spoken Arabic nor read Arabic quickly enough to digest the volume of content which circulates in Arabic each week. It is hard to tell definitively which of these two interrelated problems cause the phenomena, but the result is a vast overexposure of sources in English compared to those texts meaningful to the core of the movement – written in Arabic.

Above, the pdf version of issue 117 of al-Naba has been viewed over 7,000 times. Yet analysis of 12-16 pages of Arabic text by al-Naba’ warrants barely a mention, and is erroneously given the same weight as a single picture. Equally, text and images such as those below are often excluded from ‘analysis’ because they come from Amaq, despite being viewed over 9000 times on Telegram alone.

Both items are from the notorious Nashir channel, which is often cited and referred to in the context of IS’ media decline. One may wonder though, why the number of times for instance the al-Naba’ edition has been downloaded in the Telegram application never gets a mention. Perhaps letting slip that this newspaper usually gets around 7000 – 8000 downloads in just the Nashir channel, Amaq posts can get 10,000 views and some Nashir content has been viewed over 300,000 times, contradicts the drum beat that ISIS media is in decline?

Here the study of rhetoric in gender subordination provides a valuable explanation of how such a process can cause a ‘veil of silence’ to descend over an entire area of study.

As Caron E. Gentry wrote:

Across time and place in global politics, rhetoric has often been used to perpetuate certain social ‘truths’ and norms. A speaker or author uses language to direct an audience toward a manufactured truth, one in which some information is emphasized while other information is concealed. In this way, the speaker designates certain ideas, norms, and events superior to others and ignores actions or events that might challenge them.(4)

With a particular focus on neo-Orientalist Narratives, Gentry highlights:

The othering so intrinsic to neo-Orientalism is deeply troubling because it blinds scholars, researchers, and law enforcers to any deeper realities or nuances in people’s lives.(5)

Whether caused by neo-Orientalist perspectives or other reasons, the veiling of particular aspects of the Jihadist movement through ‘terministic screens’ proposed by Kenneth Burke, means ‘the rhetor uses terminology that leads an audience to a specific figurative location (reflection) rather than to an unwanted place (deflection)’.(6)

Focusing only on a few munasir and supposed Core Nashir Channels is particularly dangerous as these are only the channels most readily findable by those in Western and predominantly English language dominated habitus. While much has been made of alleged access to a few secretive ISIS Telegram Channels, the data presented here highlights that approach risks becoming a terministic screen reflecting only a particular part of the Jihadist movement. See, for example, the announcement of a ‘total collapse’ of ISIS media. A month later, the initial fanfare had become ‘Total Collapse … Postponed‘ as the same commentators struggled to explain why ISIS media was on the rise again.

The narrow focus on ISIS branded content analysed from a Western habitus is, as Katherine E. Brown wrote in her discussion of istishhadiyyat (female martyrdom operatives), further compounded by the security frame in which it is set:

in this mainstream view in which the principal frame of reference is the state, and in particular Western states, female suicide terrorism simply becomes a variant of an already known threat to the state. This security approach consequently leads to homogenization based on method of attack and its security impact rather than a recognition of the politics of those involved…. Research that adopts the security approach is thus blinded by the glare of the explosion: the corporality and immediacy of the violence and state responses are overexposed at the expense of other features of the phenomenon.(7)

There are striking parallels between the subordination of gendered narratives and subordination of Arabic sources, by the prioritization of sources accessible to a Western and English speaking audience. In the study of the current movement, scouring ISIS English language magazines for European locations, repeats the overexposure of Western State responses.

Prioritising the impact on Western countries means the underexposure of the Arabic theologically driven core of the movement. Likewise interpreting the theologically driven, primarily Arabic content using Western terms and solely English language publications risks creating a ‘subordinating silence’ around the intentions and strategy of the Jihadist movement. Particularly if commentators are still fast forwarding through videos showing violence and wondering to whom ISIS might be speaking.

Notes:

Brown, Katherine E. 2011. “Blinded by the Explosion? Security and Resistance in Muslim Women’s Suicide Terrorism,” in Laura Sjoberg and Caron E. Gentry, eds. Women, Gender, and Terrorism. Athens: University of Georgia Press, 194-226.
Gentry, Caron E. 2011. “The Neo-Orientalist Narratives of Women’s Involvement in al-Qaeda.” In Laura Sjoberg and Caron Gentry, eds. Women, Gender, and Terrorism. Athens: University of Georgia Press, 176-193
Paz, Reuven. “Reading Their Lips: The Credibility of Jihadi Web Sites as ‘Soft Power’ in the War of the Minds.” (2007)
Gentry, Caron E. 2011. “The Neo-Orientalist Narratives of Women’s Involvement in al-Qaeda.” In Laura Sjoberg and Caron Gentry, eds. Women, Gender, and Terrorism. Athens: University of Georgia Press, 176-193
ibid.
ibid.
Brown, Katherine E. 2011. “Blinded by the Explosion? Security and Resistance in Muslim Women’s Suicide Terrorism,” in Laura Sjoberg and Caron E. Gentry, eds. Women, Gender, and Terrorism. Athens: University of Georgia Press, 194-226

Session 1 of the Progressive Terrorism Studies Webinar Series. “The Persistent Online Presence: The Shift in Platform Exploitation Over Time”

Back to the Nashir

Overview:

Data

External Links.

Flow across the Ecosystem.

Conclusion

Overview of findings:

The following infographic summerises the analysis of over 1000 documents in this Caliphate Library.

Rewards in the Jihadist Belief-System

Theological underpinning – reaping your reward, ajr

Jihad – Media – Activism – Militancy – Documenting the Struggle Online to Influence Target Audiences

Isdarat – the groundwork of Online Jihad by AQAP, first generation

The different roles platforms play within the ecosystem.

Jihadology in the ecosystem of online jihad

Conclusion

Notes:

And why this exploitation allows Jihadists to maintain a persistent information ecosystem.

Introduction

Wider Research Sub-culture

Speeches:

Battle footage and executions

Attacks

An approach fit for a 21st Century Sisyphus, Yes Minister or Monty Python

Why this matters to Jihadist groups:

Ethical approaches and leadership.

After the hype about the removal of ISIS Telegram channels, this post examines the data on the information ecosystem to sort the anecdotal observation from evidence-based research.

Part 1: The Telegram Cull.

Jihadist Ecosystem – 10 December 2018

So, how did we know?

How did we do it?

Not all content is created equal.

Authenticity

Metrification:

Unprecedented and exceptional

Descriptive over-generalisation

Risks of being an uncritical mouthpiece

Conclusion

Nashir / News

Wider Telegram Network

A subordinating silence

An approach fit for a 21^st Century Sisyphus, Yes Minister or Monty Python