In September 2022, the Wall Street Journal published a report on our discovery of NFTs created by the Islamic State (ISIS). US intelligence officials believe it to be the first widely known instance of ISIS using Non-Fungible Tokens (NFTs) to help spread their message online or possibly using digital marketplaces for fundraising.
Based on our investigation of ISIS content on NFT platforms from August 2022 – May 2023, this Insight examines just how viable NFTs are as a financial lifeline for groups like ISIS. Viewing the NFT landscape from an OPSEC perspective, we analyse whether they can be transacted securely and anonymously, and how permanent and undeletable the content truly is. We begin with an outline of Jihadist groups’ known use of cryptocurrencies before exploring ISIS content on Cent, OpenSea and Rarible. We argue that ISIS is experimenting with NFTs and associated platforms for safe storage and avoiding content moderation, rather than profit.
Fig.1: NFT collection belonging to an ISIS supporter on display on the OpenSea NFT marketplace
Background: ISIS Crowdfunding
For as long as the internet has existed, jihadists have found ways to exploit technology, spread their propaganda, broadcast their ideology, recruit for their cause and, as is the focus of this Insight, fundraise. With the advent of newer technologies such as blockchain, and decentralised and anonymous currencies, jihadist groups have tried to leverage technologies to facilitate additional revenue. Using innocuous-looking appeals, money has been raised with PayPal, transfer services and even crowdfunding sites such as GoFundMe. Some of this has then been converted to cryptocurrency before being sent to a designated recipient overseas for distribution to ISIS-related causes. There’s no vetting of these charities save for an endless stream of photos on social media from these sister accounts showing the money being used to purchase food and basic supplies.
US-led counterterrorism efforts have also yielded breakthroughs in actioning on criminal and terrorism-related activities on cryptocurrency. For example, in December 2022, the US Justice Department arrested a group of fundraisers who procured Bitcoin donations for ISIS Four people in the US and Canada were arrested following an 18-month-long investigation involving phony crowdfunding campaigns which were then cashed out and sent on to alleged ISIS contacts.
Fig.2: ISIS-linked website featuring Monero (a cryptocurrency)donation wallet.
Still, ISIS has doubled down on its Bitcoin fundraising, as well as promoting cryptocurrencies that ‘promise’ even greater levels of anonymity and untraceability. One example is the promotion of Monero, a cryptocurrency that, for now, has proven impossible to track. In addition to utilising cryptocurrencies, we have found evidence of ISIS also investing in Non-Fungible Tokens (NFTs) for the purpose of fundraising.
ISIS’s Non-Fungible Tokens (NFTs)
NFTs are digital assets such as art, images or music stored on a blockchain – a decentralised ledger of all transactions across an online network that is virtually impossible to hack or corrupt. NFTs are mostly stored on the Ethereum blockchain which, like Bitcoin, is a form of cryptocurrency. Digital assets such as NFTs can also be attached to the blockchain and traded on a marketplace – an online retailer that doesn’t store every product they sell. Two of the biggest NFT marketplaces are Opensea and Rarible.
While to outsiders, blockchain transactions are considered to be anonymous, they are, in reality, defined as pseudonymous – meaning transactions are fronted by a pseudonym, namely one’s wallet address. Wallet addresses can most often be traced and most newer accounts or wallets will run through an identification process known as a KYC or ‘Know Your Customer’ process similar to when opening a bank account. Hence, NFTs listed or bought via a digital marketplace such as OpenSea and transacted with an anonymous wallet could essentially result in an untraceable transaction, making them vulnerable to exploitation by bad actors.
NFTs can therefore serve a dual purpose for terrorists; content uploaded by terrorists can serve jihadist objectives by providing a surface web address for online propaganda. At the same time, this content, if minted, or created and stored on blockchain as an NFT, can be sold in transactions that raise money for nefarious purposes.
In the present cycle of terror group proliferation of web and social media, supporters of groups like ISIS employ a relay-like strategy creating multiple accounts on multiple platforms, usually resulting in a staggered rate of deletion. This allows for some accounts to remain on one platform while accounts are replenished on another platform. Our research involves consistently monitoring all major platforms as well as many upcoming and more obscure ones. It is with this approach that we noticed the early experimentation by ISIS supporters with NFTs.
Fig.3: Screenshot showing a claim for an ISIS attack as an element on the Cent platform
In August 2022, we identified ISIS content including a claim for an ISIS attack in Khorasan Province (Afghanistan) on the Cent Platform, an artist and creator network famous for being the place former Twitter CEO and founder Jack Dorsey used to mint and sell his original first tweet as an NFT. Throughout our initial investigation of ISIS NFTs, there did not seem to be any significant drive towards transacting the NFTs. The account promoting ISIS NFTs was preoccupied with creating and modifying existing content to circumvent automatic detection and deletion. It is possible to sell and profit from such creations, though this hardly seems to be the motivation in this case. Rather, it is likely the user was testing newer forms of media in an effort to find a place to store jihadist content for an extended period of time.
While this content was identified and removed from the platform following its discovery, subsequent examples found by our research team show the efforts could be more sinister. Our team observed attempts to use NFTs to fundraise for ransoming ISIS wives and children held in detention camps in al Hol and al Roj, Syria. In a post on social media in late December 2022, the creator of one of the NFTs wrote: “The goal of making NFTs is if someone buys the NFT, the earnings will be donated to brothers and sisters in al Hol camp and others too, by the will of Allah and for the sake of Allah.”
We understand helping “sisters in al Hol camp” to be a reference to the wives of ISIS detainees held at the Syrian detention facility. The claim also references “brothers” and “others” too, possibly made in reference to the support of ISIS members themselves. Although sometimes viewed as a grey area and a humanitarian issue, the US Dept of Treasury sanctioned several individuals fundraising on behalf of such prisoners in March 2022. Of particular note, some of these funds were used to liberate children from detention camps, only to arm them and send them back for deployment as ISIS child soldiers.
Conclusion
As of June 2023, some of ISIS content on NFT platforms has been online for almost 8 months. Although commanding minimal traffic, this content should be flagged and removed in line with mainstream platforms that have employed different strategies across Trust and Safety departments. Although in an exploratory stage, the nature of NFT technology is open to exploitation by not just terrorists but also criminals and scammers and should be noted by both law enforcement and Trust and Safety teams at tech companies. There should be zero tolerance for terrorist content however experimental and exploratory it may be. Failing to act will strengthen the notion that NFTs could provide ISIS with a crucial financial lifeline.
In the examples we’ve discovered so far, ISIS content consists of terrorist propaganda either in original or manipulated form. Further exploitation could include generic tokens that bear no trace of a connection to terror but are minted and traded on NFT exchanges. These tokens could then be promoted and marketed within closed terrorist circles as nondescript NFTs designated internally for terrorist use. Knowledge gleaned by cross-platform communication, as well as greater research and traceability of the blockchain could help Trust and Safety teams attain a greater understanding of these challenges and enable them to counter further abuse of NFT technology by terrorist and violent extremist actors.