Introduction
In the Indian region of Kashmir, the battlefield has shifted. No longer confined to guns and grenades, insurgent groups are now increasingly waging a digital war. Old, banned terror outfits have rebranded themselves to avoid international scrutiny, shifting their operations to new areas while increasing and weaponising their online presence.
Four prominent armed outfits — The Resistance Front (TRF), People’s Anti-Fascist Front (PAFF), Kashmir Tigers, and the Muslim Janbaz Force — are driving the recent surge in violence across the Kashmir Valley. Three of them have been notified as terrorist organisations under the Unlawful Activities Prevention Act (UAPA) in 2023 by the government of India. They are increasingly uploading extremist content online, influencing public discourse and spreading their recruitment and propaganda efforts to the digital space. Their online presence is not limited to a single platform but is rather a variety, ranging from mainstream social media, chat rooms and websites to the darknet. These four outfits have evolved from older, notorious groups like Jaish-e-Mohammad and Lashkar-e-Taiba, and are now intensifying their activities along a volatile border shared with Pakistan.
This Insight will analyse the evolving tactics of insurgent groups in the Jammu and Kashmir region, focusing on how they are increasingly leveraging digital platforms to further their objectives, recruit members, and spread propaganda designed to influence public opinion in favour of the insurgency.
A Brief History of Insurgency in the Region
The Jammu and Kashmir region has been in turmoil since the region was divided between India and Pakistan. Following the accession of Jammu and Kashmir to India in 1947, which Pakistan contested, the two countries fought their first war over Kashmir. The war ended with a UN-brokered ceasefire in 1949, and the region was effectively divided by a ceasefire line (later known as the Line of Control or LoC) between India and Pakistan. This marked the beginning of decades of tension, with Kashmir becoming a flashpoint between India and Pakistan, further complicated by territorial disputes with China.
While the borders have always been tense for India, the Kashmir Valley, in particular, has been simmering since a Pakistan-backed armed conflict broke out in 1989. This insurgency was fueled by a combination of local discontent and external support from Pakistan, which has long laid claim to the Kashmir region. The insurgency initially began with calls for either independence or a merger with Pakistan, but over time, it attracted more radical elements, including terrorist groups. The Indian government responded by deploying military forces to the region and enacting strict security measures and anti-terror operations. According to reports that cite official Indian government figures, between 1990 and 2017, the insurgency has claimed nearly 41,000 lives, primarily civilians. However, Kashmiri separatist organisations and other groups put the figure at over 100,000. As recently as 21 October 2024, terrorist groups opened fire and killed a doctor and six workers of a private company which was working on an infrastructure project in Ganderbal area of Kashmir. The Resistance Front (TRF), an outfit of Lashkar-e-Taiba and one of the organisations discussed later in this article, claimed responsibility for the attack.
Upsurge on the Ground
Since 2019, the geopolitical situation has intensified. This is due to India repealing Article 370, which granted special status to Jammu and Kashmir, splitting it into two centrally-administered “Union Territories” – Ladakh and Jammu and Kashmir. Since 2019, at least 262 soldiers and 171 civilians have been killed in more than 690 incidents, including the February 2019 Pulwama terrorist attack that killed more than 40 Indian soldiers. Overall, according to the Indian government’s official data, terrorist-initiated incidents in Jammu & Kashmir were down to 44 in 2023 (until 15 December) from 228 in 2018. However, in the last two years, armed militants have shifted their focus to Jammu, 170 miles south of the state capital, Srinagar, resulting in fatalities in jungle warfare ambushing the Indian army and retreating into the woods rather than built-up areas where the army would track them easily. While these conflicts have defined Kashmir’s geopolitical struggles, recent developments since 2019 have intensified these challenges both on the ground and in the digital space.
Warfare in the Information Space
A more significant threat, with consequences to the security of the Indian subcontinent, has been emerging in the virtual world since the last decade and this is likely to get worse in the coming years, given the changing nature of the information landscape. Terrorist groups have been leveraging the internet for years, but with an increasing presence across platforms like X, Telegram, Facebook, Signal, and WhatsApp, their online activity has grown more sophisticated, making content moderation increasingly challenging for tech companies. Groups like The Kashmir Tigers and The Resistance Front use online media to spread their ideology and promote their military actions by sharing videos, images, voice or written messages that support their narrative or present themselves as people with a mission. Through a platform like Telegram, groups also disseminate content that romanticises violence, glorifies fallen leaders, issues threats to government and elections, and uses religious indoctrination to attract support and new recruits. This digital presence amplifies their influence and complicates content moderation efforts.
Prominent Actors
Several insurgent groups in Jammu and Kashmir have embraced the digital landscape to further their agenda, using social media and online platforms to recruit, spread propaganda, and issue threats. This section describes some key examples of militant groups and their online strategies that gained high visibility.
The Kashmir Tigers, who are behind the recent spate of attacks in Jammu, have been active in the virtual space. The organisation frequently puts out photos and videos of brutal and bloody ambushes to showcase its military prowess and demoralise the Indian armed forces. Its operatives have been ruthless in threatening Indian citizens and the authorities of “Occupied” Kashmir.
Figure 1: In this post that circulated on X, the Kashmir Tigers’ notification reads, “Occupied Kashmir: Clash between Indian forces and Mujahideen-e-Islam, engaged in a major operation against Mujahideen in Karnag Ahsan forests of Anantnag area of South Kashmir District. Awaiting more details. This war will continue till the independence of Kashmir.”
More recently, the outfit openly claimed responsibility for a deadly terror incident that occurred in Kathua district of Jammu & Kashmir that saw military and militant fatalities through their Telegram channels.
Figure 2: In this notification that circulated on Telegram, the Kashmir Tigers outfit claimed responsibility for the Kathua terror attack that happened in July 2024. The message, written in the regional language Urdu, translates to “Kashmiri mujahideen (warriors) have successfully ambushed an army convoy in Kathua and killed several of India’s infidel soldiers.”
The Resistance Front (TRF) is an offshoot of the proscribed Lashkar-e-Taiba, a banned terrorist organisation that was behind the Mumbai terror attack in 2008. According to an official statement by the Indian government, it has been involved in the killings of security force personnel and innocent civilians of Jammu and Kashmir, co-ordinating and transporting weapons to support proscribed terrorist organisations, recruitment of terrorists, infiltration of terrorists and smuggling of weapons and narcotics from across the border. The outfit also promotes the idea that Indian authorities plan to settle Hindu citizens in the Kashmir valley to alter the region’s religious demography.
Figure 3: TRF notification that spread on social media announcing its opposition to any Indian citizen who comes to settle in Kashmir.
The group had previously threatened to attack local politicians for participating in the Kashmir assembly elections, which were recently held on 18 September. The social media content of the outfit mostly praises its slain operatives, their terror actions, recruitment pleas, and threats to the Indian army and police. The group, opposed to the elections, had labelled them as farcical and warned people against participating. The group was also responsible for the recent attack in Ganderbal that killed a doctor and six workers.
Figure 4: The Resistance Front’s posts regarding the 21 October 2024 attack in Ganderbal circulating on WhatsApp channels and other social media.
The People’s Anti-Fascist Front (PAFF) is a proxy outfit of the terrorist organisation Jaish-E-Mohammed and came into existence in 2019, according to the Ministry of Home Affairs of India. The group has been involved in radicalising youth for recruitment and training in the use of weapons and explosives. It has also issued threats to Indian security forces, political leaders, and civilians from other regions working in Jammu and Kashmir, while actively conspiring both online and offline to carry out violent attacks in Jammu and Kashmir and other major Indian cities. With its bloody but well-edited signature tune and videos, the group is very active on social media. Its cadres, on suicide missions, shoot live encounters using body cams with an aim to sensationalise and grab attention.
Figures 5 and 6: The People’s Anti-Fascist Front (PAFF) outfit frequently puts out graphic videos that depict militant attacks against the Indian defence forces and glorifies the violence on social media.
The use of body-cams helps their operatives to get close to soldiers and confirm injuries or deaths, and goes beyond striking fear among people. The PAFF puts out videos warning the Indian government against hosting meetings portraying “fake” normalcy in Kashmir. Additionally, the PAFF releases videos, posters, and audio messages through private Telegram channels which keep being taken down by the Cyber Police department. Newer ones pop up routinely in the cat-and-mouse game.
There’s a large amount of extremist content available online, and some of it is also produced and uploaded by old proscribed militant outfits – Hizbul Mujahideen, Lashkar-e-Toiba, Jaish-e-Mohammad, Harkat-ul-Mujahideen – as they post mostly remembrance videos of their slain associates. Handles are used on X or Facebook to post content of the militant organisation, and their supporters further amplify these.
Figure 7: “Remembrance” video for a slain associate from an account affiliated with PAFF.
The Crackdown on Cyberspace
The Indian security officials have been actively cracking down on insurgent-related social media channels, probing over 1,000 accounts and blocking many. Several social media accounts impersonating Indian army personnel have sprung up after the Indian government’s move to revoke provisions of Article 370 of the Indian constitution in Jammu and Kashmir. These accounts were used to spread false information about military operations, aiming to create confusion and undermine trust in official communications. X eventually removed about 60 to 70 percent of these handles after the Indian Defence and Home ministries raised the matter with them.
Figure 8: Social media platforms frequently take down accounts and channels associated with outfits for violating guidelines, often upon requests by the Indian authorities. However, new proxy accounts are created, and the propaganda continues to spread.
India’s IT ministry has also blocked a series of channels and social media accounts as they claimed the content was false and or sensitive to the country’s national security. The blocked channels were not associated with terrorist accounts but were observed to be using fake and sensational thumbnails, images of news anchors and logos of certain TV news channels to mislead the viewers into believing that the news was authentic.
Though for their internal communication, the groups are using satellite phones and encrypted messaging apps that allow them to communicate without leaving any digital residue, social media is often used to seek funds, weapons, and orders from handlers across the border. Last year, the Indian government blocked 14 mobile applications, which were, according to central intelligence agencies, being used by terrorists and their supporters in Jammu and Kashmir. The banned apps include Wickrme, Mediafire, Briar, BChat, Nandbox, Conion, IMO, Element, Second line, Crypviser, Enigma, and Safeswiss.
The digital transformation of insurgency in the Kashmir region marks a significant shift in how extremist groups operate and propagate their ideology. The ease of access, anonymity, and wide reach of these platforms make them effective for spreading propaganda, recruiting members, and coordinating activities. There are two main challenges for content moderation when it comes to content intended to promote or aid violent extremism.
The first challenge is the sheer volume of content posted on social media platforms, which makes it difficult to monitor and moderate effectively. When content is removed from one platform or channel, extremist groups migrate to others. Terrorist groups also continuously evolve their tactics to evade content moderation, using coded language, memes, and, at times, obscure references to spread their messages to avoid detection.
The second challenge in monitoring and moderating violent extremism content is balancing effective intervention with the preservation of free speech and privacy. To combat this new digital frontier of insurgency effectively, platforms must navigate varying legal and tech standards and integrate AI and human moderation approaches while effectively implementing violent extremism content moderation policies globally.
The legislative elections in Jammu and Kashmir, held in September 2024, were the first since the revocation of Article 370 in 2019. These historic elections and the results highlighted both a strong desire for local political representation and ongoing tensions surrounding governance. The 21 October attack is a blatant reminder that the groups remain desperate to fuel unrest in the region, and they will continue to exploit social media for their objectives.
Spotlight is a Trust and Safety team at DataLEADS, an Indian media and technology company.