Could Islamic State’s next digital home be…. Telegram?
Over the past few months a sustained operation led by EU law enforcement agency Europol has resulted in the disruption and fragmentation of Islamic State channels on encrypted messaging app Telegram, once a haven for the terror group’s propaganda content and incitement.
Often dubbed Islamic State’s ‘app of choice’, Telegram became the go-to platform for Islamic State and other terror groups after mainstream social media platforms such as Twitter and Facebook introduced stricter rules and swifter crackdowns on egregious content online. While Telegram did initiate a coordinated takedown of Islamic State channels in the aftermath of the 2015 Paris attacks, further deletions were never sustained or kept up allowing Islamic State along with various other terror groups to set up shop on the messaging platform and spread their propaganda via a series of channels, bots, and groups.
While significant Europol-led operations against such online content have occurred in the past, most notably an operation at the end of April 2018, it wasn’t until November 2019 that the law enforcement agency tackled Telegram content head on. Since then, thousands of channels and bots have been deleted on a daily basis in coordination with Telegram. User accounts belonging to key offenders have also been deleted – giving authorities a 1-2 counterpunch ability to ensure as much of the Islamic State ecosystem is destroyed while preventing its immediate regrowth.
One of the features most invaluable to terrorists is the cloud storage ability that comes with each user account. While channels containing video, photo and news archives can be deleted, simply transferring that content to the user’s ‘saved cloud’ allows deleted channel content to continue existing for an individual user. This can then be used to replenish new channels created by the user following deletion of the old one or transferred peer to peer to other users within the circle of trust. As an example, the infamous ‘lone mujahid’ channel promoting tutorials aimed at inspiring so called ‘lone wolf’ attacks was constantly brought back online following deletion, despite the channel’s curator being arrested and jailed.
How is Islamic State managing to appear online?
Experts have wondered for a while what might happen after Telegram chose to act, and indeed there have been multiple accounts of where the Islamic State caravan has been migrating. From a lesser known messenger app called TamTam to a purported Blockchain based encrypted messenger BCM, Islamic State has branched out to dozens of apps with efforts to counter met with varying levels of success and failure.
Islamic State supporters have made no secret of their distaste for some of the alternative options. A prominent pro ISIS tech group ‘AFAQ’ or Electronic Horizon’s Foundation has repeatedly warned against using TamTam in the same fashion as Telegram, going so far as to suggest the App is a piece of “Russian Malware” and data is collected by Russian spy agencies. Previously AFAQ has also suggested that along with a VPN & a TOR browser TamTam can still be used to spread propaganda. Not quite a Telegram substitute and with limited operational use, TamTam has no offerings on encrypted or secret chat options.
Other apps, notably Hoop Messenger and BCM have emerged as preferred platforms, not because of security, but rather convenience and longevity, with channels rarely disappearing or being removed, in some instances not at all.
Islamic State has always ‘hedged its bets’ with salvos of links to multiple social media platforms, and video sharing websites, repeating the process numerous times during the lifecycle of breaking news and evergreen content. While many of these accounts and links are swiftly removed, some do slip through the cracks with the ones on top-level social media and video sharing accounts (Twitter, Facebook, Instagram, YouTube etc..) most celebrated by Islamic State supporters for discoverability on the surface web, a potential recruitment opportunity for the terror group.
What about Telegram? Can Islamic State live on there?
An assessment of Islamic State presence on Telegram both before and after the Europol operation shows that despite the crackdown, a stubborn remnant of its core presence remains online. And as with its depleted forces on the battlefield and remaining presence on the ground the threat of a comeback remains.
A small example, a full length feature video released by Islamic State in early November 2019 and before the commencement of the Europol operation, showed a view count of 37,000. But a video from its West Africa province released in January 2020, well after the counter propaganda operation began, shows a view count so far in excess 21,000. (Views calculated according to the ‘eye icon’ in Telegram channels, a metric mostly accurate according to Telegram – https://telegram.org/faq_channels#q-what-does-the-eye-icon-mean)
Without question there is quite a decline but at the same time there is a sense of levelling off and stabilizing. Some core disseminator accounts have survived the ongoing cull and via a series of methods have been able to slowly rebuild the Islamic State network on Telegram.
That still-too-high number is not because of the efficiency of the counter campaign or a lack of effort by Telegram, in fact the combination of both have for the first time dealt a huge blow to the online propaganda factory that is Islamic State. But at the same time jihadists have been working harder with their deceptive tactics to remain.
Some of these methods include newly created bots generating links to channels, a previously known Islamic State link request account that is contactable each day anew by adding the current date suffix to the username and the endless links on all social media platforms that draw supporters right back to Telegram.
Islamic State has also in the past made use of safe user lists similar to the Twitter block lists, and has been able to cultivate supporters over time allowing them to exist in ‘virtual safe spaces’ beyond the prying eyes of researchers, journalists and agencies tackling their propaganda. Indeed, some of the more notorious chat groups have returned using such tactics.
Law enforcement agencies can well argue that essentially this operation is about containing Islamic State, much as the previous operation in April 2018 targeted Islamic State on the surface web. But as long as the Islamic State ideology and the ability to attack remain potent, the group’s counterparts in its “Central Media Diwan” remain ready and poised to continue promoting their propaganda on any available platform, including Telegram.
This Insight was co-authored with Laurence Bindner.