The Islamic State (IS) uses the internet as an essential tool to help achieve its goals. It is a platform where IS can disseminate propaganda, actively recruit agents, and direct attacks on a global scale. On the “surface internet”, i.e. mainstream sites accessible to everyone, IS used to reach a broad audience. However, following increasing clampdowns by social media companies, they shifted to harder to reach platforms such as the Telegram messaging app.1.https://www.bellingcat.com/news/mena/2017/09/01/wilayat-internet-isis-resilience-across-internet-social-media/ Despite this shift, IS and it’s supporters remain active on the surface web and its prominent social media sites. Some estimates suggest that IS is still using over 400 social media sites, with Facebook itself removing 1.9 million pieces of al-Qaida and IS content in the first quarter of 2018.2.https://www.wired.co.uk/article/isis-propaganda-home-office-algorithm-asi3.https://newsroom.fb.com/news/2018/04/keeping-terrorists-off-facebook/
It is important for Facebook to remove IS supporting accounts quickly, before they gain large followings and spread significant amounts of propaganda. More sinister is their role as an entry point for potential recruits into more covert IS networks online. A fairly typical IS-supporting Facebook account created on 4 April 2018 is a good representation of the dangers such accounts pose. The only information on the profile was the owner’s sex, which was male. The language posted in was Pashto and, considering the users affinity for IS news from Afghanistan, that is likely the user’s birthplace and location. The account exclusively spread IS propaganda, rather than being for personal use and sharing IS content, which is also a common phenomenon.
The profile picture chosen was of an unknown man holding a rifle, and the cover photo was a picture of several militants. The account made its first post two days after setting the profile picture and cover photo, a section from IS’ weekly Al-Naba magazine discussing an attack in Tunisia. The profile would make five other posts by the end of the day. An Amaq infographic was posted, showing recent IS operations in Kabul, as well as a statement claiming that IS had killed some Afghan security forces. Three Amaq photos were also posted showing food being given to children IS claimed were orphans in Kunar province of Afghanistan. This propaganda showing off non-violent, positive, aspects of IS such as their governance abilities is called “utopian propaganda” and is an important part of the IS propaganda playbook.4.http://www.quilliaminternational.com/wp-content/uploads/2015/10/FINAL-documenting-the-virtual-caliphate.pdf
The 45 minute long Wilayat Ninawa video “We Will Surely Guide Them to Our Ways” posted by another IS supporter was also shared. This video detailed fighting during the Battle of Mosul in 2017, which showed the typical graphic combat footage as well as footage of the construction of IEDs, rocket launchers, car bombs, and various other weapons. While this was shared on 6 April 2018, the post was originally made on 18 May 2017. Despite being repeatedly shared by IS supporters for almost a year Facebook had failed to remove the video.
The following day the account made seven posts. These posts included multiple statements released by Amaq, a graphic released by the groups Al-Naba magazine, a picture released by IS’ Wilayat Kirkuk commemorating a dead fighter, and several official IS statements he had copied and posted. The latter is a common occurrence among IS-supporting accounts on Facebook. This is believed to be a way to try and avoid Facebook’s automated efforts to remove IS propaganda. By typing out the statement rather than posting the image, tools such as image matching cannot be used to identify it. Other attempts to avoid detection by automated tools include distorting and censoring images before posting them.
On 8 April, eleven more posts were made, featuring Amaq statements as well as statements released by various IS Wilayat accounts. A set of eight pictures released by IS showing the group’s fighters preparing defensive positions in Syria’s capital Damascus was also posted. Finally, a link was posted to a pro-IS Telegram channel, based on the language and similarity of posts this is believed to have been run by the same person who ran the Facebook account. Telegram is infamous for its IS content, as it has previously been a haven where propaganda can be shared, supporters can build connections, and attacks can be encouraged and planned. Links to Telegram are regularly shared on Facebook by IS supporters, showing the cross-platform nature of supporters and how major social media sites like Facebook can be a gateway to deeper IS networks. Links to this Telegram channel would be shared several more times.
9 April saw an increase to 12 total posts. Alongside several official statements, one post created by the account owner contained pictures of several dead IS fighters. Pictures were taken from the group’s own propaganda but also taken from other groups’ propaganda releases. It was intended as a memorial and celebration of those specific IS militants as well as IS militants in general. Three posts were also made about the death of a key IS emir in Afghanistan, Qari Hekmatullah, a former Taliban commander who defected to IS and controlled the group’s activities in the parts of Jowzjan, Sar-i-Pul, and Faryab provinces they controlled. He was a significant emir and his death was a major blow for IS in Afghanistan.5.https://www.nytimes.com/2018/04/09/world/asia/afghanistan-isis-leader.html
Only 6 posts were made in total over the next two days, including photosets, individual photos, statements and text posts. 12 April then saw a jump to 16 posts. As well as the typical propaganda statements and pictures, the account twice shared posts containing the full propaganda video just released by Wilayat Dimashq. The last post for the day, and the last post ever made by the account, was a text post copying a statement released by IS saying how three Syrian soldiers had been killed near Abu Kamul in eastern Syria.
Facebook then removed the account, despite failing to remove the other pro-IS accounts whose content he reposted and the thousands of pro-IS accounts he was friends with or who followed him. Even the posts themselves he had shared containing explicit pro-IS content would not be taken down. Despite removing the account, it is entirely possible the owner will create a new one. Creating a new account is easy, with many IS supporters known to have gone through large numbers of accounts, something they wear as a mark of pride. The possibility of him having a backup account already prepared to switch over to cannot be ruled out, as IS supporters have been known to operate several backups in case one of their accounts is removed.
There are other possibilities outside of creating a new account, as a pro-IS social media group called Al-Ansar Bank is known to provide fresh accounts for any IS supporters who ask. They are mainly active on Telegram but have been seen setting up official pages on Facebook, which have interacted with supporters and given out accounts. Another option is for an account to be hacked, which an IS supporter can use to continue spreading propaganda. This is an ongoing issue, with large numbers of Facebook accounts being hacked by IS.
In the worst case the account owner could message Facebook moderators and ask them to reinstate his account, which has been known to work before. An IS supporter in the UK had his account reinstated nine times by Facebook using this method.6.https://www.telegraph.co.uk/news/2018/01/26/facebook-reinstated-account-terror-suspect-nine-times-complained While doing research for the “Spiders of the Caliphate” analysis paper, the author identified three pro-IS accounts that had been reinstated after getting removed by Facebook.
In one week of active posting the account’s owner had posted over fifty times, sharing large amounts of official IS propaganda covering the group’s activities in Iraq, Syria, Afghanistan, Pakistan, Yemen and Tunisia. In such a short period of time he was still able to gain over 2,500 friends and followers. More concerningly, Facebook had functioned as an advertising tool, allowing him to plug his more active Telegram account to new people which introduced them to another, more dangerous, layer of IS activity online. While a week may not seem like a long period of time for an account to be active this shows that a lot can be achieved in this time frame. It demonstrates the importance of companies like Facebook to continue to improve their response to IS on their platforms as well as cross-platform coordination.