Criminal evidence is the key to prosecution. Yet, a UN report found that the collection of “sufficient and admissible” (p. 3) evidence has been a central challenge in prosecuting ISIS returnees.
In a conflict zone, such as the ISIS ’Caliphate’, evidence collection can be severely limited. Opportunities to retrieve relevant evidence from the battlefield may be restricted, judicial cooperation agreements may not exist between countries, and legitimate governing bodies may have little control over conflict zones containing relevant evidence. While utilising battlefield evidence to prosecute remains challenging, social media evidence — such as participation in propaganda videos — has been used to prosecute some ISIS affiliates.
However, when it comes to female affiliates, challenges associated with battlefield evidence are compounded by gendered structures upheld by ISIS. Though women occupied roles across the spectrum of terrorism offending, from active, violent roles to community-building positions, they were often less ‘visible’. It was less common for female recruits to appear in social media campaigns, and full-face veils made identification difficult in publicised imagery.
Despite women often being active participants, without proof of taking part in specific activities — such as fighting or sharing propaganda — conclusively demonstrating engagement with ISIS is difficult. Where strong admissible evidence is lacking, the only provable act may be physical records of time spent in ISIS territory.
However, in some states, such as Germany, evidence of time spent in Islamic State territory was insufficient to convict individuals of certain terrorism offences. Prosecuting crimes, such as membership in a terrorist group, required specific evidence demonstrating support of the organisation’s goals. In response to these challenges, and to hold ISIS-affiliated women accountable for their actions, evidentiary tactics have evolved, increasingly drawing upon digital evidence to demonstrate engagement in terrorist activities.
Digital evidence, also known as digital forensics, can play an important role in prosecution by documenting interactions which may otherwise have gone unrecorded. Digital evidence can encompass data which is not publicly available, such as banking transactions, messages sent and received, deleted materials, and other metadata.
Utilising digital evidence used in court, this Insight draws attention to women’s engagement in terrorist activities and argues that digital evidence can contribute to a better understanding of these roles. Where obtaining sufficient admissible evidence from other sources is challenging, digital evidence can supplement available data, documenting the broader ecology of women’s lives and — in some cases — offering timestamped evidence depicting intentions to fund, directly engage with, or otherwise support terrorism.
The nuances which are brought to the fore by digital evidence, as shown in this Insight, can contribute to a fuller understanding of the intentions and mindsets of female ISIS affiliates.
Methods
This Insight draws on sentencing remark transcripts relating to 16 different female defendants, sentenced between January 2018 and July 2024. Notes were taken during attendance at three trials held in London between November 2023 and March 2025. Each case involves women, as single defendants or co-defendants, charged with terrorism offences in England and Wales. This Insight uses digital evidence utilised in these cases to develop a greater understanding of the offending behaviours of women in terrorism.¹
Across the cases analysed, evidence showed the types of material women engaged with and sought out, the positions some women held in online groups, and how they attempted to evade detection. These digital traces also illuminated how pressure was exerted on women to commit offences, and the subtle ways some women pushed back against coercion.
Sharing Material
One way that digital evidence provides insight into women’s engagement with, and support of, Islamist terrorism is through their online engagements. While Salafi-jihadism can limit women’s opportunities for in-person engagement, the online environment can act as a “comparative site of liberation”, free from usual gender roles.
Existing academic literature draws on some social media posts, such as Tumblr blogs, Twitter networks, and Telegram forums. Beyond these public profiles, digital data used in the trials revealed the private communications of female defendants, their search histories, and materials they had sought out and shared.
Materials located on several defendants’ phones demonstrated engagement with extreme imagery and sources depicting “the most savage and barbaric videos of people being murdered by having their heads hacked off, explosives detonated about their neck and being shot” (Defendant 1). Data offered insight into how such materials were stored on phones in some cases and sent to other affiliates in other cases. Through private messaging on Telegram, Defendant 7 shared videos of “battle scenes, destruction and dead bodies, including children”, and a link to a video which depicted a series of terrorist events around the world.
Evidence found on these devices reveals the depth of the commitment female defendants held to Islamist ideology, and their intentions to share extreme materials with other like-minded women. It sheds light on the mindset of female supporters, demonstrating their active engagement in amplifying this material, while also highlighting dedication to extreme Islamist ideology.
Beyond sharing depictions of attacks of the past, some evidence highlighted female defendants planning and sharing their intentions to commit attacks of their own. Messages on the phone of Defendant 3 outlined how online engagements had played a role in facilitating her attack planning and research, putting her in touch with ISIS fighters, and other individuals who were part of the plan.
As the planned attack grew closer, she unknowingly declared her intentions to a police officer, whom she believed to be an ISIS operative. During the online exchange, Defendant 3 told the undercover officer of her plans, the location and the weapons she planned to use. She explained that “that all it takes [is] a car and a knife to get what I want to achieve”, and that her “heart has been set on this [attack] for months”. With documented proof of her intentions, Defendant 3 was arrested the following day.
Beyond preventing the attack, digital evidence clearly demonstrated her plans and mindset. Having intercepted the plot, online communications reconstructed the timeline of events and, in her own words, provided evidence of her extreme views, criminal intent, and planning. When sentenced, these factors informed the judge’s view that the defendant posed “significant risk to members of the public”. Evidence of her extreme and entrenched views, as apparent from the digital evidence provided, informed the judge’s decision to sentence her as a ‘dangerous offender’, for a minimum term of 13 years’ imprisonment.
Digital evidence used in these cases supplements our understanding of women’s engagement in Islamist terrorism across the spectrum of offending. By giving insight into the communications which are intended to remain private, mobile phone data contributes to a greater knowledge of the intentions, mindset, and depth of commitment of female offenders.
Encryption and Deception
Terrorist groups have become increasingly reliant on encryption to communicate and store material without detection. Various platforms and corners of the internet can be used for different purposes, such as fundraising, money transfers, cryptocurrency transactions, and purchasing illegal weapons.
The secretive nature of encryption means that, without physical seizure of the encrypted device, extracting relevant evidence is particularly challenging. In the cases analysed in this Insight, investigators commonly extracted digital evidence by physically seizing mobile phones and laptops, which effectively rendered the encryption useless. As such, digital evidence helps us understand how female defendants attempt to hide their support of and engagement in terrorism.
In the cases assessed, women utilised a range of measures to disguise their online activities. Some defendants used encrypted communications, VPNs, codewords, and usernames to prevent identification. For example, Defendant 3 downloaded messaging tools “variously designed to anonymise calls and texts, encrypt messages, protect data held on the phone, hide IP addresses, provide fake GPS locations, anti-spy/surveillance protection and block microphone surveillance”.
In one case, the judge noted that Defendants 13 and 14 sought to hide their online interactions because “[they] both realised that many of the ideas [they] were expressing […] put [them] at very considerable risk of investigation by the police or security services”.
However, these measures are not only used to hide from the authorities. As demonstrated by Defendant 5, methods may be used to hide one’s identity from their own group. Defendant 5 adopted a range of measures to hide her identity while becoming a “leading operator” of media channels, where she disseminated large quantities of ISIS propaganda and instructions on how and where to carry out terrorist attacks. These Telegram channels were run:
“… With a high degree of secrecy and technical application, including storing the content in back-ups; recreating the channels under different names whenever Telegram shut them down; keeping a banned list of those suspected of being spies; […] using fake emails, and being acutely aware that the police might intervene, regularly deleting online chat”.
Defendant 5 even adopted a male persona to avoid detection. Despite increased opportunities to engage with other women, female ISIS supporters still faced restrictions. Overtly female accounts were limited to engaging only in specific channels and groups, which tended to orient around discussions of “being a good wife”. It is likely that Defendant 5 adopted a male persona to overcome this barrier.
Steps taken by defendants to hide their communications and online engagements are not everyday ‘digital hygiene’ procedures. They are often deliberate and considered attempts to withhold and hide information, demonstrating both a commitment to conceal offending and awareness of the unlawfulness of their behaviours. Moreover, in some cases, digital evidence demonstrates how technological affordances have lowered the threshold for women’s engagement with Islamist terrorism — at times, enabling women to overcome the “segregated online ecosystem” (p. 4) by concealing their identity altogether.
Demonstrating Coercion
So far, digital evidence has provided greater context into the ways that women may seek to engage in terrorism, and their commitment and mindset in doing so. However, one of the key debates surrounding female terrorism offenders is the question of how much agency they possess. While the instances above challenge arguments that women are “naïve” in their offending, digital evidence from other cases demonstrates how women may be coerced into committing terrorism offences.
Extensive digital evidence extracted from phones, laptops, hard drives, computers, and comprehensive financial transaction information illustrated a complicated arrangement in which Defendants 15 and 16 sent money to a relative in Syria over a 7-month period. Despite sending money to a relative who was likely fighting for ISIS, the judge presiding over the case noted that the defendants were placed under “considerable and persistent pressure” to do so. In a message exchange extracted from her phone, Defendant 15 explained the stress the arrangement was putting on her and her family:
ISIS affiliate: Things are getting bad here. Food prices are high.
Defendant 15: Honestly, I’m upset with you. You made your own decision. You continue to pressure.
ISIS affiliate: yeah, well its bad. Getting money not easy.
Defendant 15: […] Do you know how much stress and pressure this cause? Do you know this is what gives people heart attacks and anxiety attacks?
ISIS affiliate: I know. It’s hard. It’s just that things here are getting tougher than usual.
These messages help to paint a more complete picture of the offending. Without this context, the financial transactions to Syria may be viewed as a commitment to ISIS from overseas. The broader context provided by digital evidence contextualises the offence as an arrangement the defendant did not wish to be a part of, and a cause that they were not ideologically supportive of.
Digital evidence can show how women may seek to extricate themselves from such arrangements in ways that may not otherwise be evidenced. These attempts may be direct — such as Defendant 15 declaring “stop messaging now” — or they may be more subtle, such as in the case of Defendant 9. Too scared to report to the police, Defendant 9 created a fake online account and a false story about being in hospital to extricate herself from a relationship with a “well-known drill rap artist” who “identified himself as a soldier of Allah”.
Data demonstrating coercive behaviours to which female defendants may be exposed are the result of accessing encrypted communications on seized devices. Without digital evidence, insights into these exchanges from the defendants are limited, and claims of coercion or pressure may rest solely on the defendant’s testimony, without evidence to support them. Digital evidence helps us to understand the varied roles that women engage in supporting terrorism, and the nuanced degrees of agency which they hold across different points in time.
Conclusion
Women’s engagement in the ISIS ‘Caliphate’ highlighted important weaknesses in evidential thresholds when prosecuting terrorism offenders. Supporting or engaging with a terrorist organisation can take many different forms, but not all actions create equal amounts of admissible evidence. Laptop- or mobile phone-based activity can supplement available data and enable a greater understanding of how women engage in and support Islamist terrorism by acting as a window into their personal communications and interactions.
Broadly, the UK government has adopted a policy of non-repatriation of citizens that travelled to join ISIS. Should this approach change, robust evidence will be required to begin criminal proceedings, where necessary. If challenges with battlefield evidence persist, digital evidence may become the strongest evidence of terrorism offending within the ‘Caliphate’.
Digital evidence may provide valuable insight into returnees’ criminal behaviours. This will not only support convictions where required but also provide greater context of the potential risk female offenders may pose. As such, digital evidence can directly support appropriate sentencing provisions and rehabilitative measures by providing a clearer understanding of the risk some female offenders may pose, and the coercion experienced by others.
- It does not constitute a comparison between male and female defendants and is not generalisable, due to the small sample size. Themes discussed are indicative and require further analysis. Notes taken from the courtroom are subject to human error.
–
Chloe L. Squires is a Doctoral Fellow at NABS+, Lancaster University. She completed her PhD at the University of St Andrews, where her research examined the prosecution of female terrorism offenders in England and Wales. She is a member of the IN-COURT network, and her interests include the courtroom as a setting for empirical and interdisciplinary research. Chloe’s wider research spans a range of interdisciplinary areas relating to terrorism and extremism, including interventions for terrorism offenders and the online harms experienced by young people.
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.
The views and opinions expressed in this Insight are the authors’ own and do not necessarily reflect those of GNET or any of its partners.