Hayat Tahrir al-Sham (HTS), al-Qaeda’s former affiliate, constitutes one of the most prominent violent extremist organisations (VEOs) that operate in the Levant. Due to this fact, its agenda and activities have been subject to a heated academic debate in recent years. In the abundance of scholarly works on HTS, there is, however, an eye-catching gap related to its propaganda in cyberspace. In contrast to activities of Islamic State, the campaign of Hayat Tahrir al-Sham on the Internet has attracted very little interest from the scientific community. In recent years, the only comprehensible report related to this subject examined its offline propaganda. This is surprising, given that the content produced by HTS and its propaganda cells have been easily accessible on the mainstream social news aggregators.
This Insight summarises some of the most important findings of a research project that aimed to analyse the online propaganda strategy of the Ebaa News Agency (ENA), a Syrian-based group, which was frequently accused of being affiliated with HTS. This project, carried out in 2020, attempted to map communication channels utilised by ENA on the surface web and discover proofs of its cooperation with Hayat Tahrir al-Sham. Moreover, it aimed to measure a three-year propaganda output of this bureau, examine the thematic landscape of its productions and measure their popularity. Detailed results of the project were included in a paper published by Behavioral Sciences of Terrorism and Political Aggression in 2021.
Methodology
This study combined open-source intelligence (OSINT) methods with qualitative and quantitative content analysis. The OSINT investigation aimed to detect and map all elements of the information ecosystem exploited by the Ebaa News Agency and Hayat Tahrir al-Sham on the surface web. It consisted of four phases. Initially, a wide array of advanced operators in the Google search engine was exploited. They were combined with Arabic, Turkish and English keywords associated with ENA/HTs. The second phase consisted of web scraping of the discovered websites that were associated with Ebaa News Agency. A number of OSINT tools, such as Spiderfoot v.3 and Recon NG scanning software, were used to extract data from the ENA’s webpages, including external links leading to other, interconnected domains. The third phase of the investigation aimed to use data discovered in phase two to identify and verify other Web locations affiliated with Ebaa or HTS. The final phase focused on extracting metadata from propaganda productions released by ENA/HTS in order to understand their technical capabilities.
This study also employed a quantitative content analysis, which allowed the propaganda output of ENA between January 2017 and March 2020 to be measured. It was also helpful in understanding the popularity of its releases. Finally, a qualitative content analysis was exploited. It served the purpose of determining the thematic landscape of a sample of Ebaa’s propaganda releases. It consisted of 1186 individual entries – audiovisuals, visuals, standalone articles – published on the Internet by ENA between January 2017 and May 2018. These releases were categorised into 16 different types of content, such as victimhood, combat, martyrdom, religion, gore, or international relations.
Mapping Information Ecosystem of Hayat Tahrir al-Sham
The first phase of the investigation initially detected two webpages maintained by ENA: Ebaa #1 and Ebaa #2. They constituted primary propaganda dissemination channels exploited by this bureau. Ebaa #1 proved to be professionally designed but abandoned as of 2020. It was replaced in mid-2018 by Ebaa #2, which was much more advanced in terms of its visual layout and organisation of content. On top of that, it was more abundant in professional propaganda productions when compared to its predecessor. Both websites maintained a high level of operational security (OPSEC), as the web scraping provided few valuable results. However, a reverse IP lookup analysis of Ebaa #1 and #2 allowed discovering four other domains co-hosted on the same server: Ebaa #3, Ebaa #4, AlBunyan and Tahrersham.
These four newly discovered websites fulfilled a wide array of functions. Ebaa #3 proved to be inactive in 2020. The Internet Archive’s Wayback Machine lacks any records of this webpage, which indicates that it could have never been operational. Ebaa #4 redirected Internet users to one of the subdomains of Ebaa #2. The third webpage – Tahrersham – constituted an official website of HTS. However, its main page redirected users to the dark web location, which was inactive when this investigation was carried out. It also consisted of external links leading to a banned Twitter account of HTS and a Telegram channel. This was a valuable discovery, as it proved that HTS experimented with the anonymity-oriented environment of The Onion Router (TOR). Moreover, the fact that ENA and HTS hosted their websites on the same server constitutes solid proof of organisational or financial links between both entities. In other words, it means that all Ebaa’s claims arguing that it operated as a non-partisan news agency were false.
The last domain discovered at the hosting server was affiliated with al-Bunyan Radio, which is another HTS-linked propaganda bureau. It consisted of a repository of audio recordings of this cell (Figure 1). However, an online streaming option was also available. Interestingly, AlBunyan advertised its active Soundcloud profile, consisting of as many as 571 tracks. Their popularity was, however, limited.
Figure 1. Screen capture of the Al-Bunyan main page
Aside from these six websites, the OSINT investigation also discovered five Telegram channels and one Whatsapp group. Surprisingly, their popularity proved to be quite high, as some of them consisted of up to 57,000 members.
Propaganda Output of Ebaa News Agency
The Ebaa News Agency primarily released content in Arabic. However, in time, the group also started to publish productions in Turkish. This attitude is indicative of the priorities of this bureau, which not only aimed to carry out a campaign targeting the local population in Syria but also attempted to influence public opinion in Turkey.
Both core communication channels – Ebaa #1 and Ebaa #2 – released a variety of text, visual and audiovisual propaganda. The Ebaa #1 attached particular importance to publishing short audiovisuals covering the most recent events in Syria and news articles on the HTS actions. The Ebaa #2 proved to be much more sophisticated in this regard. For instance, it promoted martyrdom or consisted of gore content, which is a traditional element of the Salafi-jihadist propaganda on the Internet. In contrast to its predecessor, it also featured developed opinion articles, infographics or “journalist investigations” (Figure 2). The quality of its productions was also much higher, which was manifested by the fact that ENA started to utilise a professional TV studio. In effect, many of its videos reminded the best releases of the Islamic State from 2014-2015.
Figure 2. Example of the “Written reports” released by Ebaa News Agency
In this context, the quantitative content analysis allowed measuring the output of both websites. Ebaa #1 released more than 188 pieces of propaganda content monthly. Ebaa #2 proved to be much more productive, as its monthly average output was above 422 entries. Overall, between January 2017 and March 2020, ENA has released more than 13,000 individual propaganda releases. This data indicates that, surprisingly, Ebaa manifested comparable productivity to the Islamic State propaganda machine from the apogee of its power.
Understanding the Thematic Composition of the ENA’s Releases
Qualitative content analysis of a sample proved that many sections of the Ebaa #1 were predominantly interested in playing the victimhood card. For instance, they have focused on reporting casualties among civilians due to artillery shelling or chemical attacks (Douma). Moreover, quite frequently, they reported on the ongoing events in Syrian politics. One of the leading topics was related to criticising a local rival of HTS – Harakat Nour al-Din al-Zenki. The benefits from the Hayat Tahrir al-Sham’s rule over Idlib were also highlighted. For instance, ENA promoted HTS’s activities aiming to curb local organised crime. However, some sections were much more interested in covering military activities (Figure 3). For instance, military reports quite frequently discussed clashes between HTS and ‘gangs’ of al-Zenki, al-Baghdadi or Ahrar al-Sham. On top of that, operations of the Syrian Arab Army and the Russian forces were criticised. Interestingly, the group also promoted martyrdom operations (SVBIED attacks), which is common in Salafi-jihadist propaganda campaigns.
Figure 3. Example of ENA’s video focused on military activities in Syria
The viewership analysis allowed learning that ENA’s text propaganda attracted little interest from the Internet audience. For instance, each entry in the ‘News’ section of Ebaa #1 was visited on average only 137.4 times. This contrasted with the much greater popularity – 967.5 views per release on average – of military videos. On the one hand, these findings confirm that dynamic audiovisuals, unlike text propaganda, are much more likely to draw attention from the online audience. However, on the other hand, the popularity of the ENA’s productions proved to be much lower than initially expected, especially considering the number of the group’s followers on Telegram.
Conclusion
This study proved that, despite its claims, Ebaa News Agency was an integral part of the Hayat Tahrir al-Sham’s propaganda machine on the Internet. While numerous scholars hinted at this in the past, it provided definitive evidence of their cooperation in cyberspace. Moreover, it showed that ENA’s propaganda activities constituted a mixture of opposing priorities. On the one hand, it attempted to portray itself as an independent news agency from Syria. Both the thematic landscape of its productions and most popular forms of releases prove this. For instance, it focused almost exclusively on local issues and avoided religion-focused messaging. However, on the other hand, at the same time, ENA visibly supported the extremist agenda of Hayat Tahrir al-Sham. It praised suicide operations carried out by its members, presented gore content, and portrayed this VEO as the only legitimate rebel power in the Levant.
This eye-catching ambiguity in messaging was likely a deliberate act to avoid attracting attention from the CVE community. It seems that this strategy has paid off, which is proven by the scale and specificity of its rather simplistic information ecosystem, composed of only several websites, supported by a few Telegram/Whatsapp channels and a Soundcloud profile. Compared to digital infrastructure maintained by other VEOs, the quantity and character of HTS’s communication channels were not impressive. Nevertheless, this simplicity could have been caused by the fact that law enforcement never forced HTS to develop a more advanced and dynamic means of targeting the Internet audience. This study proved that most detected communication channels affiliated with Ebaa were active for years with little to no interference from the CVE actors. This situation suggests that either ENA was not perceived as a manifestation of Salafi-jihadist propaganda at all, or it was not considered a serious threat. Effectively, this approach proved to be an efficient means of avoiding countering violent extremism mechanisms for years.