Jack Bauer on Facebook - terrorism and social media

When I started working in cybersecurity as a SOC analyst, I often looked at job offers in the industry in my spare time. Contrary to malicious comments, it was not caused by the will to change the employer as soon as possible, but rather by learning career paths and planning the direction of development. I remember that one of the ads that caught my attention was a counter-terrorism analyst. However, even more interesting than the position itself was who was hiring - it was Facebook (not Meta at the time). It may seem obvious that terrorist groups use social media. After all, they enable communication, coordination of activities and quick dissemination of materials among a wide audience (especially if the website algorithms help in this). However, I was surprised by two aspects. In the context of the notice that Facebook does indeed have an anti-terrorism team - how serious the problem must be, if let's call it "ordinary" moderation does not cope with the task. And when I bit into the subject a bit, I was surprised to see how terrorist content blatantly appears on social media by uploading propaganda content and creating groups of supporters.

Subject of how terrorism uses social media is of course very extensive and would suffice for many volumes of work. Therefore, in this post, I would like to outline the main reasons why extremist groups use such communication channels, and with examples of the successes and failures that have come with it.

Recruiting new members, spreading propaganda, and communicating are the most common uses for social media by terrorist organizations. According to a 2006-2015 report by the START institute at the University of Maryland on the online activity of American extremists, content consumption, dissemination of content and dialogue with people with similar interests constitute the vast majority of activities. Let's start, however, with Islamic terrorism and two organizations for which the use of traditional and Internet media was an equally engaging element of activity as terrorism itself and preparation for attacks. The first is Al-Qaeda, which, due to the nature of its activities, has to rely on the means of mass communication. Al-Qaeda is characterized by simultaneous centralization and decentralization of the organization. The organization is made up of a network of loosely linked networks of franchisees that recognize headquarters authority for direction and command. We are dealing, therefore, with the centralization of decision-making and the decentralization of the implementation of operations. Decentralization was deepened by the consequences of the 9/11 attacks and the war on terror, which forced a reduction in activities that could reveal the location of the command. For al-Qaeda, however, the use of social media was only an evolution of previous media activity. Due to the goal of creating a world organization of loosely connected cells, communication with the world is a key element of the activity. Already at the time of the decisive intensification of the operations of Western countries in Afghanistan in 2004-2007, she was involved in the production of propaganda video materials and uploading them to the Internet from Internet cafes in Pakistan. These videos were of a rather low quality, with poor lighting and blurry images. However, they were a harbinger of a media offensive and a direction of action.

Soon the organization reached for a well-known tool - YouTube, and began to publish videos of attacks on coalition forces and propaganda messages. Due to its global nature, YouTube has become an effective propaganda tool - 2008 study indicated that most of the commentators and endorsers were in North America and Europe. The most popular content was videos of suicide bombings, funerals and declarations of faith by martyrs.

One of the most interesting and visible manifestations of media activity is the online magazine Inspire prepared by Al-Qaeda of the Arabian Peninsula. The first thing that catches the eye is the modern design and professional composition - if it were to replace the content, it would be difficult to distinguish it from many magazines published in the West.

One of the aims of the publishing house was to promote the idea of "Open Source Jihad", which is the dissemination of information helping people who would like to locally engage in terrorism and conduct jihad. In Inspire, you could find information on how to prepare explosives or set fire to cars. The creators also encouraged contact, leaving at the end of each issue e-mail addresses and PGP key to secure communication. The idea of open source terrorism and the possibility of operating someone else's hands was one of the greatest potential benefits and opportunities for Islamic terrorism. Such attacks have a number of advantages from an operational point of view:

• The attackers are completely organisationally separated from other cells.
• More difficult to stop by the secret services - the problem of monitoring "lone wolves", which previously did not have any conflicts with the law or showed an attraction to extremism.
• Cheap to implement and scalable.
• Allowing to "conduct" operations in every region of the world.

In practice, however, the matter is not that simple. Remote control and the need to learn complicated activities, such as maintaining communication security or the construction of explosives, significantly reduce the effectiveness of such recruits. We will look at the problems with this approach in more detail a little further, analyzing the activities of ISIL.

The second group is ISIL, which formally started its activities in 1999, but its peak of activity and popularity fell in 2014-2015, when the group declared itself a caliphate and took the territories of western Iraq and eastern Syria. It was then, in the times of widespread access to the Internet and social networking sites, the group tried to use these tools to make their terrorism take a global form and inspire attacks around the world without the need to physically organize cells. In this way, ISIL, which was unable to bring candidates to the controlled territory, train them there and send them back to their place of residence, tried to reach beyond the area of physical presence with its operations. In terms of social media, the group made heavy use of Twitter. ISIL approached the issue in a very modern and effective manner and created the mobile application "The Dawn of Glad Tidings", promoted as the official application of the organization, through which the user could follow the latest information related to the activities of ISIL. Dawn, however, had one more functionality. Among the required permissions, the application required consent to Tweet it, which made it possible to create a botnet promoting the content indicated by ISIL. The application was launched in June 2014, and during the peak of its activity, it was able to send over 40,000 tweets a day. This was the case in the days leading up to the storming of Baghdad, when a photo of a fighter with the caption "We're coming Baghdad" was promoted.

In terms of Twitter, the more classic strategies of encouraging users to promote hashtags or trying to create their own memes are also used. When the phrase "YOLO" was gaining popularity, ISIL has created its own motto promoting terrorism "YODO - You Only Die Once, Why Not Make it a Martyrdom". Popular hashtags were also used, encouraging the supporters of the organization to use them to post content consistent with the organization's line. And these supporters were definitely not idle - it is estimated that in 2014, between 46,000 and 90,000 accounts sympathetic to the organization were active on Twitter. On the other hand, Twitter informed that that 2015 removed 125,000 and in 2016 235,000 accounts involved in content promotion.

ISIL has sought to make extensive use of local recruits to engage them in terrorism and conduct operations outside its direct control area. As we said in the case of Al-Qaeda, foreign volunteers acting on their own allow the group to expand its reach. However, this is related to a number of difficulties. Unless we are talking about a volunteer acting completely on his own, trying to lead him through communication involves the risk of a mishap related to the lack of skills in the field of safe communication. The problem of the lack of skills and the possibility of effective training was a big problem for the organization. Preparing explosives and making them into devices such as suicide vests is not a simple endeavor. An example of this were, for example, the attacks in Paris in 2015, when a suicide terrorist detonating a bomb in a restaurant killed only one person - himself. In the case of a person led by an ISIL fighter, there was also an operational security problem related to the fact that a person who is interested in extremism and then contacts the organization is exactly what the special services are looking for, and the period from recruitment to the attack is the time window for the response of the services. Hence, ISIL focused on quick and simple operations, encouraging applicants not to spend too much time planning, as a Bild reporter who made contact with terrorists found out:

However, there is one more method that ISIL supporters used during the course of this the attack carried out in Nice. In this case, a rented truck was used as a weapon, which, unlike bombs or firearms, does not arouse suspicion by the services in itself, and the bomber is de facto a civilian and an ordinary participant of the traffic until he leaves the road. Additionally, the fact that that the perpetrator acted alone and was radicalized very quickly.

Remote control of operations means also the necessity of indoctrination and final conviction to carry out an attack with limited communication possibilities. We should remember that while the fascination with extremist ideology is one thing, the actual terrorism, killing others and de facto giving up your life is quite another. Therefore, the leaders of the bombers tried to give hope that the situation would survive, for example, suggesting: making a fake suicide vest, because then the police will not shoot the attacker. As you can guess, however, this tactic has little to do with reality - the police usually refuse to cooperate and still shoot. It was also common to try to dehumanize the victims by calling them "Kuffar" or infidels.

Now let's move to the USA and see how right-wing extremists deal with media activities.¹Yes, I know, that Jihadism is also right-wing extremism in terms of ideology, however, it has become established to use the term "right-wing extremism" to describe groups embodying the ideology of white nationalism and Nazism, so let's stick with that. This ideology is even more decentralized and dispersed than Al Qaeda. Already in the eighties of the twentieth century, one of the ideologues of white nationalism Loius Beam promoted the concept of "leaderless resistance". Groups such as the Ku Klux Klan factions or Atomwaffen regularly promote the idea of taking matters into their own hands by supporters of ideologies not formally associated with any organizational structures, and perpetrating acts of terror. In the context of Europe, we have unfortunately seen one of the most dramatic effects of how terrorism works under this model. We are talking about the murders committed by Anders Breivik, who, using his own resources, acquired the knowledge and tools necessary to carry out the attack. On the other hand, the good news is that leaderless resistance is a strategy of groups that are unable to organize permanent structures. So even if single attacks are successfully carried out, the long-term success of the organization is unlikely.

Coming back to social media, right-wing terrorism benefited from the concentration of anti-terrorist efforts on Islamist groups which was related to the aftermath of the 9/11 attacks and the activities of ISIL. Therefore, opportunities for promotion in social media unavailable to Jihadists were eagerly used by right-wing extremists. It was especially visible on Facebook, where you could see paid ads encouraging people to join militias and put up armed resistance to the authorities. Groups that called for the murder of Congresswoman Ilhan Omar or kidnapping governor of Michigan. The company noticed the problem and in 2019 commissioned an audit of moderation policies in the field of civil rights protection. As a result, moderation policies were tightened and content promoting white nationalism was banned, even if the ideology was not explicitly indicated, including slogans and emblems related to ideology. Unfortunately, these changes were not implemented with sufficient effectiveness. Analysts pointed out that Facebook has not kept pace with organization renaming or even simple group renamingeven if they kept showing the same extremism-related content.

In addition, white nationalists and supporters of neo-Nazi movements began to adapt to the new conditions of moderation organizing on the Russian equivalent of FB - VKontakte. Due to the much looser moderation standards, they could openly discuss their views there, and agree on content that will not be removed on Facebook, and at the same time will guide people who will reach the ideology of white nationalism. An example is the profile of Daniel Burnside described by Bellingcat's investigators, a famous figure among the American Nazis. On Facebook, he posted content suggesting his ideology, but not directly pointing to Nazi sympathy (description of the "White and Proud" profile, "White Lives Matters" likes, "It's OK to be White"). Meanwhile, his profile on VK left no illusions as to his true views:

Burnside also used quite mainstream political ideas - such as building a wall on the US-Mexico border, an idea very popular with Republican voters. He emphasized, however, that the reason he supports these ideas is to provide a "safe, white future" for his children. In this way, right-wing extremists try to normalize attitudes such as white nationalism, suggesting that these attitudes are not necessarily related to neo-Nazi ideologies. In fact, gradual radicalization is the standard tactic of right-wing extremism. By analyzing the examples of Cesar Sayoc and Robert Bower we see how the content promoted by the profiles and media of the far right promotes anti-Semitic content, and conspiracy theories about the conspiracy of the elite controlling the world, reaching people prone to radicalization. Interestingly, at first glance, Sayoc and Bowers had very different ideologies. Bowers openly declared neo-Nazi sympathies and accused Donald Trump of being part of the Jewish conspiracy. Sayoc, in turn, suggested that all the politicians he disagreed with (like Angela Merkel or Arnold Schwarzenegger) were Nazis. But what he shared with Bowers was his belief in a Jewish conspiracy that controlled the world - in particular, as embodied by George Soras, the hero of many right-wing conspiracy theories.

Although terrorism is a terrible phenomenon, the analysis of the activity and behavior of groups involved in it is a very important source for those interested in security. It is one of the most serious crimes prosecuted with the full power of the state (including military operations), so only the best-adapting groups have a chance for longer survival. If you are interested in the activities of terrorist groups and other non-state organizations, I also invite you to reading publications that I recommend in the Reading Room section.

• 1
  Yes, I know, that Jihadism is also right-wing extremism in terms of ideology, however, it has become established to use the term "right-wing extremism" to describe groups embodying the ideology of white nationalism and Nazism, so let's stick with that.