This entry is part of a series of monthly blogs dedicated to TCAP expansion, explaining the reasons for the inclusion of each new TCAP entity. You can find Tech Against Terrorism’s full Inclusion Policy, which explains the process and legal grounding they use for deciding which terrorist content they alert here.
This Insight was originally posted as a blog by Tech Against Terrorism on the Terrorist Content Analytics Platform (TCAP) website. The blog is part of the expansion of the TCAP’s Inclusion Policy and analyses Tehreek-e-Taliban Pakistan (TTP) and why the TCAP will now be alerting official TTP content to tech companies when we find it on their platforms.
Introduction
On 30 January 2023, a suicide bomber attacked a crowded mosque in Peshawar, northwest Pakistan, which caused the building to collapse, killing 101 people and injuring many more. The mosque was located in the increasingly insecure Khyber Pakhtunkhwa province and was frequented by the city’s police and security forces, who made up a vast majority of the victims of the attack. Hours later, a low-level commander from a faction of the widely designated terrorist organisation, Tehreek-e-Taliban (TTP), claimed responsibility for the attack through a post online. An official TTP spokesperson later denied involvement in the attack in a statement on the group’s official website, stating it is not their policy to target mosques. This sparked a debate amongst experts and a wider question about how TTP uses the internet to spread propaganda, communicate internally, and claim attacks. This Insight will go towards answering these debates by analysing how TTP uses the internet and what Tech Against Terrorism’s Terrorist Content Analytics Platform (TCAP) is doing to counter it.
Background
Tehrik-e-Taliban Pakistan (TTP) was founded in December 2007 as an umbrella organisation for pro-Taliban groups operating mostly in the Federally Administered Tribal Areas (FATA) and Khyber Pakhtunkhwa, Pakistan. Formed under the leadership of militant commander Baitullah Mehsud, who has since died, TTP (also known as the Pakistani Taliban) is rooted along the Afghanistan-Pakistan border. TTP’s primary objective is the overthrow of the government of Pakistan in order to establish an Islamic Emirate under Sharia Law, beginning in Pakistan’s tribal areas.
TTP utilises terrorism to destabilise Pakistan by directly attacking the Pakistani army and assassinating politicians. The group also periodically supported the Afghan Taliban in their campaign against NATO forces and the western-backed Government of Afghanistan and now backs their rule in Kabul. The group is now led by Mufti Noor Wali Mehsud following the death of the former leader, Maulana Fazlullah, in 2018, and maintains links to Al-Qaida (AQ), Lashka-e-Jahngvi (LJ) and Jaish-e-Mohammed (JeM).
TTP has been responsible for numerous bomb and suicide attacks since its inception, mainly conducted against Pakistan defence forces, law enforcement personnel, and civilians. TTP is responsible for a suicide attack on the World Food Programme headquarters in Islamabad in October 2009, and for killing more than 50 people in Mohmand Tribal Agency in July 2010. Additionally, the group has been involved in attacks against Western targets, including a coordinated assault against the United States Consulate in Peshawar in April 2010 and an attempted Times Square car-bomb attack in May 2010. Amid an escalation of violence claimed by TTP in early 2023, a faction of the group claimed responsibility for a suicide bomb attack in a mosque in Peshawar which killed over 100 people, including many police officers.
Fig. 1: Number of TTP-linked attacks per year per region in Pakistan. Source: United States Institute of Peace.
Since 2014, Pakistani counterterrorism operations, internal splits, and the death of TTP’s long-term leader in 2018 have weakened the organisation. However, since the February 2020 peace deal between the Afghan Taliban and the US, TTP has undergone a strong resurgence. This has been the result of multiple factors including the TTP merging with ten militant groups in July 2020, the Afghan Taliban’s takeover of Kabul and the subsequent release of hundreds of TTP prisoners, as well as the full operational freedom granted by the Taliban government. A 2022 estimate by the Congressional Research Service suggests the TTP now has around 3,000-6,000 members, although estimates have ranged widely.
TTP claimed responsibility for many attacks in the months following the Afghan government’s collapse, generating the highest average monthly frequency in the last five to six years. In June 2022, a ceasefire–facilitated by the Afghan Taliban–was agreed upon between the TTP and the Pakistani Government amid negotiations for a sustainable peace settlement. However, tensions between the two parties have since escalated following the TTP unilaterally ending the ceasefire in November and ordering attacks across Pakistan.
Online Activity Assessment
TTP has established an extensive and resilient online presence across a range of different platforms, from messaging apps to social media. TTP’s online presence has been growing since it launched its official media outlet in late 2010. Since then, the group has developed a centralised ‘media commission’ and spokesperson under the fictitious name ‘Muhammad Khorasani’. The media arm has significantly enhanced its operations, both in terms of volume and quality of its propaganda output, since the Taliban takeover of Afghanistan in 2021, playing an important role in the group’s resurgence.
TTP’s official media outlet regularly reports on attacks, glorifies its militants, and propagates the Deobandi Islamist ideology. It produces audio, video, and text materials originally in Urdu and Pashto, which are mostly reproduced in English, Dari/Persian, and Arabic. These include several video series, a daily radio broadcast, a bi-weekly current affairs podcast, an Urdu magazine, and statements on TTP-claimed attacks and political issues.
TTP maintains an official Urdu language website which acts as a centralised location for all its propaganda content, including magazines, videos, poems, and books. This site has undergone periodic domain changes, likely due to suspensions by the tech industry. The site averages 11,000 monthly visits, with 65% of website traffic coming from Pakistan.
The group publishes its official propaganda on its website and a niche social media platform popular among Al-Qaeda and its affiliates, as well as dedicated messaging app channels. This propaganda content is then re-circulated by supporter networks on social media platforms, including mainstream ones, as well as archiving and file-sharing platforms.
Online dissemination of TTP propaganda content is sophisticated and well-established, making it easily accessible across a variety of platforms and in multiple languages. According to BBC Monitoring, TTP propaganda officials are actively trying to establish contacts with Afghan and Pakistani journalists to allow even wider dissemination of TTP material. With its official media outlet now operating under the TTP’s ‘Information and Broadcasting Ministry’, it has become an organised body with considerable human resources. This is evident in its accelerated propaganda output, including five new video series in the last few months of 2022, a new bi-weekly podcast, and the announcement in January 2023 of a more regular release of its flagship magazine (now monthly).
Alerting TTP Content:
This Insight analyses the online activity of TTP, revealing the need to support tech companies to recognise and tackle this threat more effectively. In line with the TCAP’s Inclusion Policy, we will only be alerting official content produced by TTP. This will include any content produced by TTP’s official media outlet, and branded as such including videos, magazines, and statements. We will alert all official content whether it is in Urdu, Pashtu, English, Dari or Arabic. Supporter-generated content, accounts, and channels will not be in scope.
Tech Against Terrorism supports the global tech sector in tackling TVE use of the internet, with a specific focus on smaller platforms that may lack the knowledge, capacity, or technical ability to identify, moderate, and respond to TVE exploitation of their services. Smaller platforms are consistently exploited by TVE actors to ensure content remains online for longer. With this mission statement in mind, we developed the Terrorist Content Analytics Platform (TCAP) in 2020 with support from Public Safety Canada. The TCAP alerts platforms in real-time to terrorist content hosted on their services, basing its alerts on the designation lists of democratic nations and supranational institutions. While the TCAP supports platforms of all sizes, our priority is on smaller platforms with limited capacity to detect and counter terrorist exploitation effectively. Since the launch of the TCAP in November 2020, we have identified over 40,000 URLs containing terrorist content and alerted over 90 platforms. More than 90% of the alerted content was removed following our alerts.
Archie Macfarlane is a Research Analyst at Tech Against Terrorism and Policy Lead of the Terrorist Content Analytics Platform (TCAP). In this role, he focuses on understanding and contextualising terrorist and violent extremist behaviour online using open-source intelligence. His research interests include terrorist designation, the language of political violence, and ‘jihadi humour.’