Trends in Islamic State's Online Propaganda: Shorter Longevity, Wider Dissemination of Content

With the collapse of the so-called caliphate and the morphing of the proto-state back into an insurgency, the virtual presence of Islamic State is now one the ways for the group to maintain a link with its international audience and supporters. Nevertheless, after a peak in the years 2014-2015, IS’ media production has also sharply declined, reflecting military setbacks that have included the targeting of high-profile media figures within the organisation. The group has also faced online pushback due to increased monitoring of jihadist content by social media and web companies.

Notwithstanding these setbacks, IS has shown itself able to maintain an enduring online presence, with its propaganda still reaching sizeable audiences. In addition to its attempts to circumvent the removal of posts, accounts, groups or pages on social media, IS has diversified its outlets exploiting alternative platforms as safe havens for its material. In order to assess the efficacy of IS’ sustained effort to spread its content, this perspective presents a brief quantification of the longevity and dissemination of IS propaganda. What types of platforms are being exploited besides social media? How long does the tracked content linger before deletion? Is this content disseminated on a concentrated number of platforms or is it widely shared? To answer these questions, two typical pieces of IS-produced media material were tracked in the days following their release. The results are presented below, but in order to provide some necessary context, these are preceded by a brief review of how IS has exploited the digital space since 2013.

The mutations of IS’ online modus operandi

Over the past years, a parallel may be drawn between the evolution of IS’ online activities and its political and military activities on the ground. In 2013-2014, at the height of its power as a proto-state, IS controlled territory approximately the size of Britain. Mirroring this visible manifestation, a young generation of jihadists openly used thousands of accounts on mainstream social media platforms to generate an unprecedented reach for the militant group’s propaganda.

In 2015-2017, following IS’ military setbacks, the group began morphing back into an insurgency, increasingly operating underground. A similar development appears to have taken place online: as the fight against online IS propaganda centred around key platforms and mainstream social media, IS opted for more operational security by partially migrating to the deep web, despite the associated difficulties in reaching less tech savvy audiences. Telegram, which functions as a social network, a hosting platform, and an encrypted messenger-service, has become the platform of choice for the group’s (media) activists, providing decent operational security and stability. Yet it comes at the cost of decreased overall visibility, as the IS channels on Telegram are not as easily accessible as the organisation’s former presence on platforms like Twitter.

Since the liberation of Mosul and Raqqa almost a year ago, IS continues to carry out hit-and-run style attacks against forces on the ground, seizing every opportunity to showcase its sustained capacity for military action, including in areas ostensibly liberated from its rule. Similarly, IS displays a particular resilience in its online media presence. Material is often disseminated with a multitude of URLs linking to a number of platforms, to anticipate the takedown of some of these URLs and to ensure its material lingers online. Due to web companies’ increased monitoring, a certain percentage of this content is deleted within a few hours, a few days, or a few weeks. Because these URLs are expected to have a short life expectancy, and because they are utilised ‘en masse’ in diverse types of platforms, they are sometimes called ‘inghimasi links’, in reference to inghimasi fighters.[1]

Lately, a certain distrust towards Telegram has grown among IS media activists, disseminators and supporters. Recurrent warnings are issued about certain channels or groups that are thought to have been infiltrated by journalists, researchers, and intelligence agencies. These warnings can be understood in relation to reports that data obtained from such channels may have contributed to foiling attacks. IS also posts regular warnings against fake channels or publications. Moreover, Telegram announced on 28 August that it would cooperate in terrorism-related investigations with relevant authorities on the basis of court orders, disclosing user data. This commitment seriously undermines use of Telegram’s services as a digital safe-haven for jihadists.

Nonetheless, Telegram remains – at least for now – the platform of choice for propaganda dissemination by IS, and for aggregating content for redistribution to other platforms. Thus, it constitutes a genuine jihadi library of both new and old (archived) material. The contents of this material can be ideological, declaratory (claims of attacks in particular), as well as operational (tutorials, fundraising, anonymity awareness, etc.).

The evolving ecosystem of platforms exploited for the spread of jihadist content

IS media activists have continued to disseminate new material with steadfastness, uploading it to multiple platforms before sharing caches of multiple URLs with waiting supporters in various Telegram channels and groups. It can be observed that file-sharing platforms and cloud storage drives are more abundantly exploited than a few years ago, where previously platforms such as Archive, YouTube and Dailymotion were more commonly used. Jihadist media is now shared on a broader range of platforms, including notable ones such as Amazon Drive, UStream (an IBM service), and Google Photo, as well as less established storage portals that do not require any user registration, such as Gulfupload. The latter kind of portals are therefore particularly exploitable for such data dumps.

Indeed, facing an increase in censorship by mainstream social media (through AI and machine learning in particular), IS has been diversifying its output, in part by spreading content through lesser known portals. Since, the more obscure portals will often have no internal resources that can be allocated for monitoring. The links pointing to these platforms are often ‘dead ends’, insofar as, contrary to mainstream social media, they do not provide the functionality to ‘like’, ‘share’ or ‘retweet’ that make content shared on social media extremely ‘viral’. On the contrary, those links have to be shared as plain URLs. We therefore witness a fragmentation of jihadist propaganda, which admittedly becomes more isolated from the general audience, but more dispersed and thus harder to control.

Background on the tests

The authors studied the dissemination and longevity of IS propaganda in order to assess the potential target audience’s ability to access and re-share it. The tracked and investigated pieces of IS propaganda are issue 139 of IS weekly magazine al-Naba, released on 13 July 2018, and a video produced by Amaq, IS’ ‘news agency’, which was posted on 19 July 2018 and featured the murder of a purported member of Somalia’s intelligence services.

Al-Naba was chosen for the test as it is a recurring and predictable publication.[2] Except for the Eid celebration, its weekly publication has not ceased for three years. While not as high-profile as Rumiyah, IS’ monthly multilingual glossy magazine, or Dabiq in English, or Dar al-Islam in French, it remains a stable element of IS propaganda in Arabic and a source for other language translations. Al-Naba’s infographics are systematically translated into English, French, Italian, Russian and other languages a few hours after the release in Arabic, either by foreign language media outlets or by supporters themselves. Following similar considerations, the choice was made to use a simple 19-second ‘news’ video, representative of the Amaq videos that at the height of IS’ power were released almost daily and which still carry the group’s logo.

The propaganda selected for this analysis is therefore arguably representative of the regular, daily publications that IS still produces. Moreover, contrary to the group’s flagship releases or speeches, the selected materials are not for the most part publicised by Western media. Thus, they do not benefit from external media publicity, making them particularly interesting for analysis. Additionally, the Amaq video and the al-Naba newspaper are two different categories of materials: the video is a fleeting ‘news’ item, and the al-Naba publication is a written newspaper containing more longer-lasting infographics with religious, ideological or practical content that are systematically translated to other languages.

The two selected pieces of propaganda have been uploaded to a certain number of platforms by IS followers. Links pointing to these platforms have been massively shared through Telegram. The test that the authors conducted consisted of checking the validity of all links found on these platforms that directed to the selected propaganda. For this purpose, several Telegram groups and channels that are dedicated to spread and expand IS propaganda were monitored, including the Fursan Upload channel.[3] Other links have been found through regular search engines with keywords in Arabic and English.

The validity of these links, namely whether they were still functional, was tested on a daily basis during 10 days following the publication of the al-Naba magazine and for 3 days following the publication of the Amaq video. These different test-durations reflect the differing typical life cycles of the tracked propaganda materials. In particular, the al-Naba ‘life cycle’ appears to be at least one week, which is the time until the next issue is published, much like a typical weekly newspaper. The al-Naba edition selected for this test was superseded on 20 July by a new issue. By contrast, an Amaq video’s life cycle appears to be much shorter, being similar to regular ephemeral news. This type of news is generally in rotation less than 48 hours before other similar ‘news’ items take its place. In this particular case, the next Amaq video was released 3 days after the publication of the one being tested, namely on 22 July.

Al-Naba issue 139

Tests were conducted on 88 URLs that linked to the al-Naba publication, involving 19 platforms and websites, providing an average of 4,9 links per platform. 4 platforms provided between 8 and 12 links, 5 platforms provided a single link.

Some 95% of the links found already returned errors only a few hours after al-Naba’s release. Nevertheless, additional links emerged a few days later in Telegram channels, particularly after some of the initial links were deleted.  Of these new links, 65 out of 88 links (74%) were still active 10 days after al-Naba’s release, more than 3 days after the publication of the next issue. Figure 1 provides an overview of the ratio between valid and invalid links across the platforms surveyed after a 10-day period.

Figure 1: Snapshot of the 88 links pointing to al-Naba #139, 10 days after release

Amaq video (Somalia)

Tests were also conducted on 60 URLs that linked to the Amaq video mentioned above, involving 20 platforms and websites with an average of 3 links per platform. 6 platforms provided between 5 and 11 links, 10 platforms provided a single link. The links were tested on a daily basis during the 3 days following the video’s release to see if they remained active. Most of these links were removed in the hours following the video release, as they were in clear violation of those platforms’ terms of service. However, some 17 links out of 60 (28%) were still working 3 days after the video’s release (see also Figure 2). The lower survival-rate of links to the video may be related to current trends in online-content policing, as social media companies appear to be giving the removal of such materials a higher priority. The shared industry hash database with digital fingerprints for images and videos set up by the Global Internet Forum to Counter Terrorism (GIFCT) also facilitates companies to find and remove such content on their platforms.

Figure 2: Snapshot of the 60 links pointing to an Amaq video, 3 days after release

A fragmentation of propaganda

Both examples of IS propaganda analysed in this Perspective highlight the fragmentation and the atomisation of IS propaganda. Some ten days after the release of al-Naba’s 139th issue, 74% of the scoped links were still accessible, including some on high-profile file-sharing services. The Amaq video on the other hand appeared to be taken down faster, with only 28% of links being active three days after its release. However, despite eventual deletion, the video has, with a few exceptions, remained available on most of the platforms for a sufficient period of time to facilitate distribution and access. Interestingly, on certain platforms that hosted several uploads of IS content, only a few were suppressed. This partial survival raises the question of a possible different signature (‘hash’) that is added to these items by their uploaders. This might play a role in making these files harder to detect either manually or through AI-based techniques, allowing them to avoid removal.

The fragmentation of IS propaganda has two important implications. On the one hand, the group’s withdrawal from mainstream social media platforms in favour of lesser-known ones has significantly hampered IS’ ability to ‘go viral’ and reach a large audience. File-sharing platforms, cloud storage drives or other websites are often ‘dead ends’ or located in relatively obscure parts of the web. These URLs do not benefit from the snowballing effect of mainstream social media and such materials are therefore much more isolated from the general public. Nevertheless, this atomisation does make these materials less trackable by authorities. The cost of entry to find those links (from Telegram in particular) is certainly higher, but if people are successful in finding them this results in access to a relatively closed and stable digital propaganda ecosystem. This observed evolution of IS’ dissemination pattern would require a greater awareness from each platform being used for the purpose of spreading IS propaganda, which given the nature of some of these platforms is unlikely to occur at short notice if at all.

Political pressure exerted on tech giants to prevent the spread of extremist materials on their platforms has led to a situation where most online platforms have now implemented programs to fight online extremism. As a result, groups like IS are broadening their propaganda efforts to include new and alternative online platforms that have fewer resources to control content. This fragmentation of propaganda highlights that the fight against online extremism should not be the sole responsibility of large platforms and services operating online. It raises the issue of the liability of all platforms, as well as their positioning between the role of content editors and simple hosts. It also questions the prerogative of each actor to define what is illicit and what is not, or the need for state-orchestrated harmonisation. The magnitude of the phenomenon should foster a systemic and methodical approach that yields regular feedback and allows iterative, experience-based improvements: what type of content managed to emerge, from where (or uploaded by whom), on which platforms, for how long, and, why? A permanent reassessment of vulnerabilities needs to become standard practice if the potential for extremists to use the web as a channel for their propaganda is to be minimised.

[1] An inghimasi refers to a jihadist who penetrates enemy lines and triggers an explosive belt if he cannot escape alive. The metaphor ‘inghimasi link’suggests that such links aim to penetrate censorship that at least one of them will endure. The expression ‘inghimasi accounts’, referencing ephemeral twitter accounts (so called by IS for their lifetime of approximately 10 days) is mentioned by: Conway, M., Khawaja, M., Lakhani, S., Reffin, J., Robertson, A. & Weir, D., Disrupting Daesh : Measuring takedown of online Terrorist Material and its Impact, VOX Pol, 2017.

[2] Generally released between Thursday and Friday afternoon, al-Naba is a weekly newspaper composed of approximately twelve pages, essentially focused on IS military victories or attacks in its various provinces, and includes at least one op-ed, two infographics, and several articles on theology or dogma.

[3] Fursan upload is an IS-linked media group dedicated to the sharing and dissemination of IS propaganda.

This Perspective originally appeared in a different form, published in French with Ultima Ratio, IFRI’s Center for Security Studies’ blog, on 26 July, 2018.