The Washington PostDemocracy Dies in Darkness

In fight against ISIS’s propaganda machine, raids and online trench warfare

August 19, 2018 at 6:37 p.m. EDT
A pedestrian passes outside Europol headquarters in The Hague in March. Europol coordinated a campaign earlier this year to take down Islamic State online propaganda outlets. (Yuriko Nakao/Bloomberg News)

THE HAGUE – The campaign started with the cyber equivalent of a massive airstrike: law-enforcement agencies from eight countries, moving in unison to smash two of the main propaganda organs of the Islamic State.

In the two-day operation in April, police seized computers and network servers across Europe and North America and blocked Internet portals used by the terrorist group’s radio broadcaster, al-Bayan, and its official news agency, Amaq. Yet, less than a week later, Amaq suddenly reappeared at a different Web address, forcing the governments to pounce again. Then it surfaced a third time. And a fourth.

Today, more than four months after the European police agency Europol began the initiative, the struggle to silence the Islamic State’s communications flagships has shifted from shock-and-awe to something resembling trench warfare. The extremist group finds new ways to put its messages and videos on the Internet, and counterterrorism teams try again to knock them down, occasionally winning battles but never, it seems, the war.

“The footprint of Amaq is definitely less than it was before,” said a European law-enforcement official who, like others, spoke on the condition of anonymity to discuss an ongoing operation, “but the golden objective — no Amaq, anywhere on the Web — has not yet been reached.”

The mixed success of the Amaq takedown effort reflects the challenges and frustrations faced by governments worldwide as they try to stop violent extremist groups from using the Internet to recruit and radicalize. While the Islamic State has been defeated militarily in Iraq and Syria, the group’s online empire — its “virtual caliphate” — has shown remarkable resilience, producing, with few interruptions, a steady barrage of propaganda videos and communiques, despite cyberattacks, territorial losses and the deaths of dozens of top officials and technicians in its media division.

“We are in your home: Besieged ISIS uses Web to project power

The Islamic State is hardly the only extremist group to make extensive use of the Internet to spread propaganda and connect with followers. A new analysis of online behavior shows that Americans seek out information about neo-Nazis and other far-right organizations 10 times as frequently as they search for jihadist-related content. The research, conducted by Moonshot CVE and Gen Next Foundation, identified more than 35,000 Islamist-related Internet searches over a three-month period last year, with a majority of the queries seeking information about joining the Islamic State. During the same period, Americans conducted more than 312,000 searches for information on joining or supporting neo-Nazi organizations, the Ku Klux Klan and other far-right organizations.

The decision by Europol to target Amaq was an acknowledgment that the Islamic State is still regarded as a particularly dangerous presence online — and one that often uses the West’s own computer networks to reach its followers, officials and counterterrorism experts said.

“They are persistent and forward-thinking,” said Steven Stalinsky, executive director of the Middle East Media Research Institute, a Washington nonprofit that tracks Islamic State propaganda online, “more so than many Western agencies.”

Shifting to encrypted apps

The Europol operation, which received scant attention in the United States, was among the most aggressive attempts in recent years to target the Islamic State’s communication networks. European officials, in interviews, said they were under no illusions about what the initiative could, and couldn’t, accomplish.

“The aim was to understand how their infrastructure works, and to gain more information — to see how they set up their services, and how we can get to them,” the European counterterrorism official said. Moreover, he said, by seizing actual computer servers, investigators could also gain insight into the consumers of the Islamic State’s propaganda, perhaps leading to the discovery of hidden cells and plots.

But Europol officials also intended to seriously damage the Islamic State’s official propaganda organs by denying them safe haven anywhere on the Web, officials said in interviews. Employing techniques similar to those used to track child-pornography rings and other kinds of cybercrimes, Europol’s Internet Referral Unit identified key networks used by Amaq and al-Bayan — many of them based in Western countries — and then coordinated the raids to take them down. Computer equipment and data were seized in Belgium, France, the Netherlands, Romania, Bulgaria, Britain, Canada and the United States.

By the time the raids concluded late on April 26, Amaq and al-Bayan had essentially vanished from the Internet. Europol issued a statement the following day declaring that “the [Islamic State’s] capability to broadcast and publicize terrorist material has been compromised.”

As prisons fill with ISIS returnees, fears of a ‘human bomb’

Private organizations that routinely monitor jihadist websites describe a more nuanced outcome. Days after going dark, Amaq attempted a comeback, publishing again under a Russian-registered Web address, analysts said. When that site was shut down, the news service switched to still another address, in a cat-and-mouse contest that lasted for weeks.

“They were taken down every few days, for a month,” said Raphael Gluck, a web designer and co-founder of Jihadoscope, a nonprofit that tracks Islamist extremists on social media. “They went down and went down fast. Then they came back again and went down again.”

According to Gluck and other experts, the pressure eventually forced Islamic State officials to change tactics, moving more of their content to Telegram, an encrypted messaging service popular with Islamist groups, to post articles and videos under the Amaq banner. Shifting from a website to an encrypted app arguably makes it harder for the Islamic State to connect with its followers, especially newcomers who might normally look for Amaq’s latest offerings by visiting a website or using a search engine. But among the group’s core supporters, Amaq postings on Telegram are often shared hundreds or even thousands of times, ensuring wide circulation.

European counterterrorism officials say the privately owned Telegram app recently improved its efforts to remove extremist content, but independent analysts say the messaging service still hosts hundreds of chat rooms used daily by Islamic State members and supporters. Within weeks of the Europol operation, more Amaq videos started turning up on Telegram, and then were reposted on other social media platforms, including YouTube and Facebook.

On those heavily policed sites, extremist material is often taken down within minutes, but in some cases the links remained active for much longer, Gluck said. A study released last month by the Counter Extremism Project, a New York-based nonprofit, found that a quarter of Islamic State videos uploaded onto YouTube remained accessible for at least two hours before being discovered and taken down, according to the study, which analyzed content over three months last spring. On other platforms, the links remained active for days or even weeks, potentially allowing new videos to be downloaded and shared thousands of times.

“In the life cycle of news — normal, breaking news — things tend to disappear quickly anyway,” Gluck said. “If the Islamic State can extend the news cycle to 30 hours before being shut down, they’ve succeeded. ”

Empty threats

As the Europol’s raids confirmed, the “Virtual Caliphate” survives because it is highly dispersed, operating from dozens of hidden platforms scattered across multiple continents. But its decentralized nature also could be the key to its eventual unraveling, counterterrorism officials and analysts say.

In recent months, web channels used by the Islamic State have posted job openings for a variety of Internet specialists and technicians, stipulating that the applicants should be able to work from their homes, in secret, for little or no money. One posting on Aug. 7 asked for a volunteer video editor to help prepare clips of an English-speaking Palestinian cleric for dissemination on Telegram.

In Iraq, officials see signs of an ISIS comeback

“It is an opportunity for easy ajr [divine reward],” the ad read, according to a transcript provided by the Middle East Media Research Institute. “All we may need to do is post around one video a day in Telegram and YouTube, so, if anybody wants to volunteer please [send a] private message.”

A scattered workforce of volunteers has allowed the Islamic State’s propaganda machine to survive the loss of the physical caliphate, analysts say. But at the same time, the group now clearly exercises far less control over who speaks in its name.

The lack of message discipline has at times exacted a heavy price on the Islamic State’s reputation within the jihadist community. During the weeks leading up the World Cup, pro-Islamic State websites posted multiple messages — many of them accompanied by gory illustrations — warning of impending attacks on the games, including bombings, mass knifings and vehicular assaults on pedestrians.

When the tournament ended in Moscow without serious incident, some counterterrorism analysts quipped that the games’ biggest loser had been the Islamic State. In jihadist chat rooms, supporters complained for days afterward about the terrorist group’s empty promises and tarnished credibility, prompting terrorist leaders to issue a statement disavowing the pre-game warnings and denying that they had ever intended to carry out attacks at the World Cup.

“On the caliphate side, there is now an insistence: ‘Only believe what you read, officially. There are a lot of well-meaning people and opportunists who don’t speak for the caliphate,’ ” Gluck said. “Of course, if there had been an attack, I am sure they would have claimed it.”

ISIS’s toxic farewell: Environmental sabotage in former caliphate

Clues bolster belief that ISIS leader is still alive