Terrorists use the Internet. This shouldn’t surprise anybody, but it also forms the basis of an important selection bias that may cause a misunderstanding as to the role of the Internet in contemporary pathways. Presently, the state of research heavily emphasises the online environment in which terrorists find themselves. This includes a vast range of studies on particular platforms, content, or even whole ecosystems. This research is high-quality and tells an important part of the story, but a persistent focus on online activity may cause researchers, policymakers, and the media to overrate the importance of the Internet at the expense of offline factors, believing phenomena like “online radicalisation” are present and persistent problems. Below, we offer an insight into ongoing case-study research in which we seek to understand how 231 IS terrorists in America use the Internet, but in the wider context of a range of online and offline behaviours. The data have been collected via open sources, including court documents, academic and grey literature, and journalistic sources to build a case file for each actor.
Looking firstly just at online behaviours, we can see that the Internet is near ubiquitous in trajectories towards terrorism. Over nine in ten used the Internet as part of their antecedent activities. The vast majority accessed propaganda – including magazines, execution videos, and lectures – with many sharing it to other co-ideologues. Many used the Internet to provide support and assistance to others, like playing “travel agent” by hooking up would-be travellers with individuals that could smuggle them from Turkey into Syria, while a majority went online to prepare for their event, for example, by acquiring bomb-making instructions or booking travel tickets. Twenty-eight different social media platforms were utilised, including the largest platforms such as Facebook, Twitter, and YouTube, as well as ones that offer a degree of operational security like Telegram and WhatsApp. If one were to leave the analysis there, observing a high prevalence of Internet usage across a range of different behaviours, it would be tempting to diagnose the Internet as a driving hub of extremism, and perhaps assume that individuals are radicalising online.
However, it is important to consider how online activities interact with their comparable offline behaviour; the two domains should not be understood as mutually exclusive. Our analysis paints an interesting, yet complex, picture. For the most part their behaviours largely occur across the two domains. In the sample, 82% of actors who were in online contact with a network of co-ideologues also made contact with a network offline. Likewise, 65% of actors who planned their event online also planned their event offline.
David Wright is a prime example of this. In June 2015, Wright was arrested for his connection to Usaamah Rahim, the perpetrator of a failed knife attack on a Boston Police officer. Alongside Rahim, Wright belonged to an IS-inspired cell that maintained an online connection to both Junaid Hussain, a prominent IS propagandist and Zulfi Hoxha, a US born foreign fighter who later became a commander among IS’ ranks. Wright’s use of social media was extensive; he met his other co-conspirator, Nicolas Rovinski, through Facebook and frequently used Skype and Paltalk to communicate with others. Yet, at the same time, he was also active offline. Less than a month before his arrest, Wright, Rahim and Rovinski met at a beach in Rhode Island to discuss a plan to attack right-wing activist Pamela Geller. A cursory look at Wright’s case could lead to the conclusion that his online activity was driving his activities, yet his offline behaviours remained an important part of both his networking and attack-planning.
Almost half of the actors who engaged ideologically also did so offline. Take the case of Garland, TX attacker Elton Simpson. Although he openly shared his ideology on Twitter by retweeting violent footage and execution videos from Syria, he also shared an apartment with his co-conspirator, Nadir Soofi. Alongside another co-conspirator, Abdul Malk Abdul Kareem, Simpson and Soofi mutually reinforced their beliefs by watching IS propaganda and listening to CDs of Anwar Al-Awlaki’s lectures, often discussing them together at length. Moreover, the three of them avidly watched the news reports of the attack on Charlie Hebdo and it is possible that the subsequent global media attention was a driving influence for Simpson and Soofi’s own attack just five months later.
We’ve shown that our sample as a whole tends to act within the online and offline domain, but it is also important to look at the fringes. An oft-posited phenomenon is the “online-only radicalisation”, yet little support has been found within case studies to date. We identify only 5 in which this is likely the case. Although there are cases like Mohamed Khweis and Keonna Thomas which seem more likely than not to have minimal non-digital footprints, these cases are the outliers; the vast majority are either active in offline networks of co-ideologues or take steps to plan their activity offline.
Moreover, the “online-only” trajectories are outweighed by ones that had little network activity altogether. In November 2017, Mahad Abdiaziz Abdiraham entered a Mall of America and stabbed two brothers in what seemed to be a random attack on civilians. Abdiraham had no connection to a wider network either online or offline: seemingly no ideological discussions, no evidence of sending or receiving propaganda, or attending any virtual or non virtual meetings. In fact, it was only after the event that he admitted that the attack was in response to a “call for Jihad by the Chief of Believers, Abu-bakr al-Baghdadi.” Although rare, there are a number of actors that seemed to act on the spur of the moment with little-to-no network activity, online or off.
Part of the problem we face is unequal data; many of the case files substantially privilege online activities at the expense of offline ones. Take the case of Ashraf al Safoo, whose 60 page criminal complaint lays out a range of different online behaviours but does not mention activities in the offline domain. Again, reading this, it may be tempting to conclude that he used the Internet exclusively, which is possible, although our findings suggest this is unlikely. Unequal data may lead to the selection bias mentioned above; if we concentrate solely on online behaviours, we may overrate the importance of the Internet. This is partially because it is unreasonable to expect open-sources to contain data on what a terrorist did not do, so in cases where the actor’s crime was committed online – as al Safoo’s is alleged – there is little reason to include his offline activities. However this too is unequal. An online interaction has a far greater chance of reaching law enforcement hands than an offline one.
This insight has shown that if one looks for evidence that individuals are radicalising online, a cursory look at the data may falsely confirm this; there is a vast literature which details terror groups’ and sympathisers’ use of the Internet, and in studies like ours, terrorist actors display a range of different online behaviours. Moreover, even if one delves into the empirical sources, the data may be systematically biased and inflate online usage in a number of cases. Despite this, we show that when one factors in online and offline behaviours and studies the dynamics between the two, terrorist behaviours are split between the two domains. Terrorists are using the Internet heavily, but offline interactions should still be seen as an important part of contemporary trajectories.
Joe Whittaker is a tutor in Cyber Threats at Swansea University and a research fellow at the International Centre for Counter-Terrorism.
Charmin Herath is studying for an MA in Cyber Crime and Terrorism at Swansea University.