Following the 2019 Battle of Baghouz, which marked the Islamic State’s territorial collapse, IS-affiliated individuals flooded into camps run by the Syrian Democratic Forces (SDF). Although there are continued efforts to repatriate foreign nationals, the UN has described the camps as an “urgent humanitarian and security situation [that] threatens stability in the region and beyond…with more than 30,000 people, including suspected foreign terrorist fighters and their family members” being held across various sites.
IS-affiliated residents in the camps continue to run fundraising campaigns on social media in a wide variety of languages, offering donation options through cryptocurrency, money transfer services, and crowdfunding apps. These campaigns are designed to target IS supporters and sympathisers, providing detailed instructions on how to send funds. In addition, these posts also frequently include messaging narratives designed to emotionally connect with target audiences. The donations may be used to fund a range of initiatives, including efforts to smuggle IS-affiliated individuals out of the camps, directly support IS, and support actual charitable activities. Notably, some campaigns operating under the guise of being run by an individual in the camps are scams, and it is an ongoing concern that IS supporters warn one another about online.
Due to the “dynamic and multifaceted” (p.14) nature of these networks (including the presence of counterfeit currencies and other scams), it can be difficult to trace money flows. Nonetheless, monitoring how these fundraising initiatives are organised on social media offers opportunities to disrupt transnational funding to IS-affiliated individuals and members.
Although these campaigns are present on a myriad of platforms, this Insight focuses on Instagram in particular. This is because it became evident through long-term observation that some Instagram accounts posting content soliciting funds for IS-affiliated individuals remained active for considerably longer periods than their corresponding Telegram channels, which frequently encountered bans. In other words, Instagram appeared to be, in certain cases, more stable than Telegram for both fundraising efforts and content about daily life in the camps.
In efforts to examine these activities, this Insight delves into the solicitation of donations on Instagram by IS affiliates. The first section describes the process behind identifying fundraising accounts, followed by a presentation of the findings. The conclusion highlights the importance of ongoing monitoring of these fundraising efforts and offers policy recommendations for trust and safety teams and P/CVE practitioners.
Methods
I first conducted keyword searches to locate Instagram accounts that focused on providing daily updates from the camps and fundraising efforts. After identifying three initial accounts, I reviewed the “followers” and “following” lists and used snowball sampling to find similar profiles, ultimately reaching a total sample of 25 accounts.
For each account, I recorded the following information:
- Profile link.
- The date it originally joined Instagram.
- Number of followers.
- The date when it made its first post.
- Whether or not the profile included a link to another platform in its bio section. When another platform was listed, it was always Telegram.
- When possible, I noted the date its parallel Telegram channel was created to compare the longevity of the Instagram and Telegram accounts.
- Whether or not it overtly posted pro-IS propaganda (some accounts avoid displaying any pro-IS stance and will only post about life in the camps).
Findings
Total followers: The data sample of 25 accounts collectively totalled 26,584 followers, with an average of 1,063 per account. 24% of these profiles had 1K+ followers.
Account Age: 84% of the accounts joined Instagram more than a year ago. The complete breakdown is as follows:
- 2017: 1
- 2018: 0
- 2019: 1
- 2020: 2
- 2021: 1
- 2022: 4
- 2023: 8
- 2024: 5
- 2025: 3
Most of the accounts made their first post shortly after joining Instagram (meaning that they posted within four months of the account’s creation), while four accounts showed an over seven-month gap between account creation and their first post. Two possible explanations for this behaviour involving delayed posting patterns include 1. The profile was designated as a back-up account and began posting after the main account was banned; and 2. The poster regularly deletes older posts to lower the risk of being banned.
Listing Telegram in Bio: 80% of the accounts did not list a corresponding Telegram link in their bio. This could indicate that they do not perceive a need to maintain a cross-platform presence, as they feel sufficiently stable on Instagram for content sharing. The 20% that did include Telegram information shared links leading to a parallel channel or a Telegram username as the direct point of contact for inquiries about how to donate. Individuals who provided this information may believe that Telegram is a more secure platform for communications, but view Instagram as a means to reach a larger audience initially.
Figure 1: An account with a Telegram link in the bio.
Three accounts appeared to have corresponding Telegram channels, and in all cases, the Telegram channels were shorter-lived than the Instagram accounts.
Overt Pro-IS Content: 44% of the accounts posted overtly pro-IS content, such as IS flags or image stills from IS propaganda. Although displaying this type of content may heighten the risk of being banned, it clearly communicates to target audiences that it undoubtedly supports the Islamic State. It also signals to donors that the money will benefit individuals who are affiliated with the group. These types of posts exceed “awful but lawful” policies often implemented by social media companies and, more specifically, they violate Instagram’s community guidelines concerning illegal content: “We don’t allow support or praise of terrorism, organised crime or hate groups…” The fact that 44% of the accounts posted overtly pro-IS content suggests that content moderation efforts are not catching a significant portion of this type of content.
However, as Vera Mironova notes in a 2020 article, “those in the camps told me that the pro-Islamic State women still do not share money with women who are no longer supporters…so, many women actively show their support.” In other words, it must be considered that some of the individuals behind these fundraising campaigns may believe it is necessary to ‘prove’ their support for IS in order to receive financial aid.
Figure 2: A post showing explicit IS propaganda.
Figure 3: A post including an Islamic State flag.
Conclusion and Recommendations
The image-centred nature of Instagram provides fundraising organisers with opportunities to connect with target audiences visually. Posting on a mainstream platform also increases the potential to reach wider audiences while still leaving opportunities to move discussions about where and how to donate to platforms with encryption capabilities. Although a minority of Instagram accounts provided Telegram information in their bios, it is likely that a pro-IS supporter would know to directly message the account for more details on how to donate, given the proscribed nature of these online ecosystems, which may lead to an exchange of Telegram usernames and/or donation instructions via direct messages. In the past, fundraisers provided donation addresses directly in posts and account bios, but this has become much less common due to concerns that campaigns may be removed or tracked by law enforcement. After someone who wishes to donate messages a specific point of contact, the account soliciting donations will likely provide numerous options for sending funds, which may include various cryptocurrencies or money transfer apps. Individuals linked to Eastern Europe tend to prefer Qiwi, direct bank transfers, and TRC20-USDT (this was also observed by Mona Thakkar).
Online fundraising originating from the camps will be an ongoing issue for social media companies. While it is not possible to disrupt every initiative, the following recommendations include steps that might help stem this type of activity:
- Coordinating with other social media platforms to track fundraising activities that rely on a cross-platform presence.
- Noting hashtags that are frequently used by these types of accounts and monitoring them to identify individuals who are using them to promote pro-IS content.
- Watching suspected pro-IS fundraising accounts that post on private mode over a period of time, since they will sometimes temporarily switch to a public setting to gain more views before going private again.
- Using human content moderators who are familiar with IS propaganda to identify accounts that try to obscure IS content by, for example, blurring the image or adding an IS nashid as the accompanying sound.
IS supporters are adept at circumventing content moderation efforts, and one of the many methods they use is to avoid posting overtly pro-IS content that could result in a ban. Currently, it seems that human moderators are more likely to catch these nuances than artificial intelligence systems.
Following an internal investigation, Meta has since removed a majority of the flagged accounts after determining that they met the threshold for violating platform policies. Meta has indicated that the remaining accounts do not presently show confirmed violations under their standards. Their policies distinguish between assumed harmful activity and conduct that demonstrably breaches their rules.
—
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.