New research coming out of George Washington University today provides one of the most exhaustive looks yet at the vast and complex network of self-proclaimed Islamic State (IS) supporters permeating the encrypted messaging platform Telegram.
The collapse of the so-called caliphate has left the jihadist organisation in a state of geographical disarray. Yet while its members continue to carry out violent attacks in the Middle East and North Africa—and most recently, in the Ebola-wracked Democratic Republic of the Congo—its supporters, known as the munasireen, are also amplifying the group’s beliefs online; creating and distributing content throughout a Telegram-based ecosystem comprised of hundreds, if not thousands, of groups and channels.
Founded by the Russian Durov brothers in 2013, Telegram offers these munasireen a unique “digital toolbox” for propagating multimedia content sympathetic to the scattered organisation’s fundamentalist ideology. English-speaking IS supporters are especially drawn to the platform, for among other reasons, the company’s reputation for defying law enforcement requests to help identify its users.
Pavel Durov, the app’s principal founder—also known as “Russia’s Mark Zuckerberg”—hightailed it out of Russia in 2014 and purchased citizenship in the Caribbean island of St. Kitts where he remains largely insusceptible to political and legal pressure. Along with his brother, Nikolai, Durov has cultivated a user-base crowded with online extremists that span the political spectrum, all of whom flourish thanks in part to the self-described libertarian’s aversion to enforcing his company’s own terms of service. (The report finds, however, that Telegram “appears to be increasing its ToS enforcement and potentially changing its tune on cooperation with law enforcement.”)
“Telegram is currently considered the preferred digital communication tool for IS sympathizers,” GWU’s Program on Extremist says in its report. “It serves as a stable online platform for pro-IS content, an ecosystem for building extremist networks, an effective and secure internal communications tool, and a forum for recruiting new IS members.”
The study examines more than 630 English-based channels and groups on Telegram populated by pro-IS supporters. Researchers at GWU collected and examined content from the service for more than a year—between June 1, 2017, and October 24, 2018. “As policymakers and technology companies prepare for the next stage of the fight against IS online, sober assessments of how IS supporters currently use digital communications technologies are of the utmost importance,” say the researchers.
Overwhelmingly, IS supporters prefer the use of Telegram channels to groups, the study finds. The difference between the two is that channels give administrators total control over the conversation. Groups and supergroups, the latter of which offers more administrative control, make up only 12 per cent of the study’s sample. For the munasireen, these features are used in pursuit of five primary functions, as categorized by the researchers: (1) to interact with like-minded users; (2) to share “joinlinks,” or URLs to private groups and channels; (3) to spread instructional material; (4) to share “official” IS propaganda; (5) or to share a combination of pro-IS material, which researchers found is the most commonly observed function.
Around only 15 per cent of GWU’s sample involved groups and channels that strictly propagate “core” IS material—content that’s understood to be produced by the organisation’s central media channels, such as the al-Hayat Media Center, which was established by the Islamic State of Iraq and Syria in 2014. (Al-Hayat produces, for example, the recruitment magazine Dabiq, which has been translated into multiple languages including English.)
While also sharing “core” IS material (see also: Amaq News Agency), distribution channels are used to distribute any material of use or interest to Telegram’s pro-IS community. These groups and channels, which make up roughly 53 per cent of GWU’s sample, help spread not only propaganda, but cybersecurity instructions intended to aid supporters in remaining anonymous online.
“Occasionally, administrators use distribution channels to share original messages, such as musings on IS, commentary on pro-IS content or cybersecurity best practices,” the report states. “The catch-all function of distribution channels contributes to its prominence in the sample.”
The study also highlights three key tactics employed by IS sympathizers to help build upon and maintain their Telegram presence, the first being the propagation of links intended to drive users to join new groups and channels. In some cases, users are directed to join channels without any content and wait for them to become active, the report says. Administrators can also create “joinlinks” that automatically expire, cutting off the gateway to a group after a certain period of time.
During their more than a year of observation, GWU’s researchers captured nearly 17,500 joinlinks, more than 40 per cent of which directed users to groups and channels outside of the study’s sample. This alone demonstrates that while GWU’s sample was indeed massive, it only scratched the surface of IS’s Telegram presence.
The vast majority of content IS sympathizers share on Telegram comes in the form of photos, over 63,000 of which were observed. By comparison, only a minuscule amount of files shared across the platform included voice messages and audio files. Some 10,400 videos and nearly 23,000 documents were also shared within the 636 groups and channels under observation. (File sharing is also one of the key tactics used by the munasireen to grow and maintain its presence on the platform.)
Cybersecurity tactics are also key to this endeavour. Users share detailed instructions on how to utilise virtual private networks, create fake accounts, and adopt privacy software. This, presumably, includes the Tor Browser, which is used to access the anonymity network (oft-referred to as the “darknet”) where the “core” IS publication Dabiq was initially released. Users are also taught how to generate fake phone numbers to register Telegram accounts, according to the study. “Researchers observed periodic comments from pro-IS users who noted that Telegram is generally unsafe and filled with spies, journalists and other adversaries, giving necessity to protective measures.”
“Whereas on Twitter, some pro-IS users would tweet pictures of themselves or openly share their location, IS sympathizers on Telegram safeguard this information,” the report states “Within the sample, IS sympathizers tend to use generic profile images, post minimal information on their profiles, and refer to each other only by username or pseudonym (kunya).” Telegram, of course, hosts its own security-centric features designed to safeguard user information, including end-to-end encrypted chats (though, this particular feature only works in one-on-one conversations.)
Private channels, the study says, made up the majority of the researchers’ sample, and while Telegram’s terms of service does appear to apply to these secret communication dens, the company has been reticent here to enforce its own policies.
“Telegram’s reluctance to take down private content helps demonstrate why English-speaking IS supporters are attracted to the platform, and provides context to their fundamental desire for operational security,” the report says. Although the study finds that IS sympathizers are at least concerned about operational security, these measures can conflict with its ultimate goal: broadcast the group’s beliefs to a broader audience.
Telegram could not be reached for comment.
Additionally, the study examined the top 20 domains that make up external URLs shared within the groups and channels. Along with Google, Twitter, and YouTube, the researchers found the most predominate domain was Archive.org, home of the Wayback Machine. This makes sense, as governments around the world have stepped up efforts in recent years to identify and expunge extremist content from the web.
The concludes that while Telegram does appear to be stepping up its efforts to combat IS presence on its platform, this may ultimately prove counterproductive from a law enforcement and intelligence standpoint. It’s important, the report says, to note that pro-IS have consistently demonstrated “agility in the adoption of new, underexplored platforms during times of pressure.”
“Thus, while attempts to de-platform IS supporters from Telegram may neutralise IS networks on the service, this may come at the expense of the broader fight against IS online, as IS munasireen delve deeper into obscure or opaque digital communications platforms.”
You can read the complete study from GWU’s Program on Extremism here.