Fighting ISIS on social media won’t stop them from using it

Fighting ISIS on social media won’t stop them from using it

A new generation of tech savvy terrorists, born and raised in the era of social media and smartphones are challenging public and private sector counter-terrorism efforts. Despite measures that shut down social media accounts which share terrorist content, ISIS and other nefarious actors have been adaptive and able to maintain their social media presence. Renewed efforts by Facebook, Twitter, and YouTube in 2017 are certainly welcomed, but removing such content from social media platforms is expected to be a daunting task.

Social media the logical choice for terrorists

From a terrorist perspective, the use of social media platforms makes sense, even if the use of such modern technology contradicts the worldview and belief system of global Salafi jihadists, who strongly opposes globalization and modernization. Platforms such as Twitter, Facebook, Instagram, and YouTube are inexpensive, easy to use, have global reach, and messages can be posted in real time. Along with smartphones and other mobile technology, social media allows immediate dissemination of information from almost anywhere, at any time.

In the event of terrorist attacks, social media postings can serve as a force multiplier and accelerator that can amplify the carnage and spread anxiety and fear beyond the immediate victims of a terrorist attack. These platforms can also penetrate deep “behind enemy lines” in the West, and provide strategic guidance and instructions to supporters that are willing to perpetrate terrorism locally in support of overseas terrorist networks.

On November 11th, 2016, a month before a Tunisian man drove a truck into a Christmas Market in Berlin, Germany, Twitter and Facebook accounts associated with ISIS shared links to the November 2016 issue of ISIS’ new propaganda magazine, Rumiyah. A section in the magazine entitled, “Just Terror Tactics,” called for individual terrorism in Europe and the United States using trucks as weapons to target low-security public events, such as outdoor markets, festivals, parades, and political rallies.


Image from ISIS’ Rumiyah magazine

On June 13, 2016, Larossi Abballa used Facebook Live to broadcast the aftermath of the slaying of a French police captain and his partner in Magnanville, France. Abballa streamed a 12-minute long video on Facebook while holding their traumatized three-year old toddler as a hostage. The video contained a pledge of allegiance to ISIS and threats against the 2016 Euro Cup. The video clip was up on Facebook long enough to be redistributed by pro-ISIS websites.

Persistence challenges remain for countering terrorism on social media

Twitter has suspended more than 360,000 suspected terrorist accounts since mid-2015.  The suspensions of accounts, particularly accounts with a large number of followers, have likely disrupted terrorists’ ability to disseminate propaganda, radicalize, and recruit new supporters. Despite efforts by Twitter, Facebook, and Google to monitor and shut down social media accounts used for terrorist purposes, ISIS has continued to maintain a social media presence.

In light of criticism against social media companies from western governments in 2016, Facebook, Twitter, YouTube, and Microsoft have now joined forces to renew their efforts against the use of social media for terrorist purposes. Limited information is available, but a central component of these efforts include the creation of a database of unique digital fingerprints to automatically identify videos or images uploaded by terrorists that are then shared between the companies in an effort to remove material faster.

Despite efforts to counter radicalization and recruitment on social media platforms, a range of challenges persist. Perhaps the greatest challenge to these efforts is the ability by threat actors to upload commentaries and videos in real-time. Terrorists can utilize live streaming functions, such as Twitter Periscope, Facebook Live, and YouTube 360 Degrees. There are currently no reliable machine learning technology, sentiment analysis software or artificial intelligence programs that can monitor and vet all content in real time. The probability of false positives is high when utilizing said technology. As a result time-consuming human analysis will be necessary to filter out false positives.

The European Commission (EC) has also found that social media platforms such as Facebook, Twitter and Google are very slow to remove flagged content. The EC estimated in a December 2016 report that only 43% of flagged material on these social media platforms are reviewed within 48 hours. In essence, the major social media platforms are slow to respond and remove flagged content. Slow reaction times allow terrorist material to remain online and increases the chances of the content being shared with a larger audience.

Threat actors are aware of a social media platform’s terms and policies and can avoid crackdowns by providing links to third party websites with more radical content. These pages and links can be difficult to detect and remove, but serve as gateways to more radical content on the Internet. In theory, a threat actor could create an account in solidarity with Palestinian children and then offer links to more radical third party pages for individuals that are susceptible to more radical content. Additionally, the commentaries left on these social media pages can also be monitored for users that express more radical views and could be instructed to participate in private and encrypted communications.

Terrorist groups have a communication model that makes them more resilient and adaptive in times of social media crackdowns. ISIS has an interconnected network that frequently reconfigures and reorganizes. ISIS has shifted from hierarchical and broadcast models of communication to more disperse and smaller units that can quickly deploy in response to social media account take downs. ISIS’ dispersed networks can respond to account suspensions to guarantee a near persistent presence of their messages across social media platforms.

Once an account is suspended, a team of ISIS activists swiftly rebuilds the account by sending out invites to followers with information on the name of backup accounts.  Shutting down a Twitter account can take up to 48 hours, while creating a new account takes less than a minute. ISIS activists have also maintained a persistent presence in social media by hijacking trending hashtags. For example, in the aftermath of the July 16, 2016 Bastille Day Nice attack, terrorists hijacked the trending hashtags #Nice06 and #PrayForNice to threaten more attacks.

Short-term outlook 

Attempts by tech companies to clear social media platforms and message applications of terrorist content can temporarily inhibit the ability of such group to radicalize, recruit, and inspire terrorist attacks. However, removing such content will likely be an uphill battle for all the reasons previously mentioned, but also because ISIS, at this point in time, will likely ramp up its use of social media and the Internet to compensate for its battlefield and territorial losses in Syria and Iraq. As ISIS is under pressure in Syria and Iraq and its ability to plan and direct international attacks is inhibited, social media and the Internet can, in a Clausewitzian sense, become a continuation of war (in this case terrorism) by other means.

In the past two years, ISIS has demonstrated that it has been particularly effective at using social media to recruit and inspire supporters to attack Western targets, including attacks in Orlando, FL, San Bernardino, CA, and possibly Forth Lauderdale, FL. ISIS now appears to have shifted its online propaganda to incite individual acts of terrorism against soft targets in the West. This is evident in the most recent issues of ISIS’ electronic magazine Rumiyah (formerly Dabique) that appears to show an altered focus from calls to capture and defend territory in Syria and Iraq and theological discussions, to more practical guidance on how to carry out do-it-yourself jihadist attacks, including using trucks and knives as weapons.

ISIS will likely not give up using social media and online message applications because these tools help ISIS demonstrate resolve and continued relevance in times of setbacks. It is more likely that the Internet and social media will play a more significant role as ISIS loses ground and morphs itself into a more decentralized and borderless terrorist organization.

Terrorism is a form of communication, and the IT revolution and accompanying social media innovations have now reached a critical point in the modern history of terrorism. Major terrorist networks like ISIS, and smaller operating cells and individuals, can use these mediums to maximize the propaganda value of terrorist activity to an extent never seen before. Terrorists’ use of social media and the Internet will not go away anytime soon, but will remain a cost effective and favored form of communication medium for the foreseeable future.

About Author

Hans Mathias Moeller

Hans Mathias Moeller is a Senior Analyst with a cyber intelligence company in Washington, DC. He specializes in supporting multinational corporations and executives with security risk management solutions and investigations. He earned two Master's Degrees in International Security Studies and Terrorism Studies from the University of St Andrews. His areas of expertise are security and technology-related topics, with a focus on North America, Europe, and North Africa.