ISIS: The State of Terror Part 7

-Na.s.ser Balochi, member of ISIS's social media team1 The World Cup took Twitter by storm in 2014. More than 672 million tweets were posted referencing the global sporting event, peaking at more than 600,000 tweets per minute at the height of the excitement.2 But on June 14, Arabic-speaking fans who turned to Twitter for the latest scores discovered that their party had been crashed by ISIS. Mixed in with the highlight pictures and discussions of scores were shocking images of ISIS fighters executing hundreds of captured and unarmed Iraqi soldiers, and other atrocities.3 The next day, as ISIS consolidated its hold on Mosul (see Chapter 2), worried Iraqis took to Twitter amid rumors that the militants were closing in on the capital city. When they searched in Arabic for "Baghdad," they were greeted by ISIS banners containing the threat "we are coming" and images of a black flag flying over the Iraqi capital.4 ISIS had found a new way to put its message before the public-a Twitter app.

The app was the brainchild of J, a Palestinian living with his family in Gaza (we are withholding his name since he has not been publicly identified by investigators). J was a Web developer, graphic designer, and programmer who claimed to have been educated at Harvard and a "Los Angeles School of Arts" (which could not be confirmed through public records searches).5 J was a.s.sociated with a large number of websites and social media accounts, under a variety of names and aliases, such as Azzam Muhajir and @DawlaNoor (a play on the Islamic State's name in Arabic). He had a day job as a commercial app developer. In his spare time, he split his days between issues related to Gaza and ISIS, but connections within his social network pointed to a heavy-and official-involvement in the latter.

J began experimenting with apps for Twitter and for smartphones that use Google's Android operating system. Some provided inspirational quotes from the Quran that could be read on a phone or pushed out to a user's Twitter account. Others appeared to be work for hire, such as a commercial app selling jewelry.6 In April 2014, J rolled out an app called the Dawn of Glad Tidings, devoted exclusively to ISIS content. It contained two components.

The first was an Android smartphone app that let users read headlines from a series of officially sanctioned ISIS news feeds. It was capable of collecting users' phone numbers and data about what networks the user connected to, which in turn could reveal where they were based and when they accessed the app.7 The app also served advertising, which may have profited J or ISIS or someone else entirely-the ultimate destination of the revenue was unknown. In addition to reading stories on their phones, users could post them to Twitter, and J was working on adding Facebook functionality.8 The second component was a Twitter app, computer code that could take control of a consenting user's account to automatically send out tweets. An ISIS supporter could use their own account, which would function normally otherwise, or set up an empty account that tweeted nothing but content sent out by the person running the code.9 Prominent official ISIS members and supporters signed up for and formally endorsed the app as a trusted and official source of news.10 The Dawn of Glad Tidings automatically sent out links to official ISIS news releases and media, and hashtags that the ISIS social media team wanted to promote.

A hashtag is a word or phrase preceded by the # sign, in order to make it a clickable Twitter search term. So, for instance, if an event in Syria is making news, users might tweet #Syria so that other users can easily find related tweets. Hashtags are also used by Twitter and outside services to identify "trending" topics-what's hot-in order to suggest content to other users. The more a hashtag is tweeted, the more often it shows up on "trending" lists, resulting in more tweets and more people reading tweets that contain the tag.

At its peak, the app was a formidable force, sending groups of hundreds of tweets at periodic intervals carefully timed to avoid raising red flags with Twitter's automatic antispam protocols.

A typical day might feature six or seven major broadcasts highlighting one to three official ISIS propaganda releases, such as video from an occupied area or photos of captured weapons. The app also promoted ISIS releases in advance, further evidence of its connection to the organization's official structure. Virtually every tweet included at least one hashtag and a link for new users to sign up for the app.11 The Dawn of Glad Tidings app was functional from April to June 2014. Although its existence had been reported before in counterterrorism circles,12 the story broke widely in June after ISIS exploded into the news with its capture of Mosul.13 Twitter and Google soon suspended the app. Google removed all other apps by the author, while Twitter flagged the Web page where users could sign up with a warning that the site could be dangerous to their privacy.14 The volume of tweets from a monitored group of more than 2,000 pro-ISIS accounts dropped almost 50 percent overnight when the Twitter app was shut down, with hundreds of accounts falling entirely silent.15 When questioned by the app's users, J promised it would soon return, but heavy fighting broke out between the Israelis and Palestinians soon after the suspension, and he found himself distracted by the explosions rocking his neighborhood (which he tweeted about).16 In September, another supporter took up the slack and began creating accounts that tweeted systematically, controlled by simple sc.r.a.ps of computer code known as bots, usually designed to perform repet.i.tive tasks. Bots have a variety of uses, many of them positive. For instance, there are bots that monitor Wikipedia and tweet any time a page is edited by a congressional staffer, in order to promote accountability.17 Other Twitter bots are primarily spam machines, sometimes set up to look like real users. Hackers use such bots to get unsuspecting Internet users to click on links that can infect their computers with viruses or worse.18 The new ISIS bots fells into the spam category. Most of them tweeted in English, but the content suggested that the developer might be from Indonesia (a region where ISIS enjoyed wide support). By December 2014, thousands of new bots were operational. To help avoid detection, the new bots did not advertise their existence or try to attract new users. They were created in medium-sized cl.u.s.ters with similar names. For instance, some eighty bots were all named some variation of "IS Ghost." Another cl.u.s.ter had Twitter handles with variations on the phrase pagdade (a h.o.m.onym for Baghdad that pointed to the developer's Indonesian origins).19 The bots mostly tweeted links to official ISIS releases, such as the propaganda video "Flames of War" or videos of the beheading of Western hostages, projecting the appearance of broad support for ISIS on Twitter in excess of reality.

But social media tactics and trickery were only part of ISIS's a.r.s.enal. The group has won legitimate support online, while benefiting from intense global interest in the Syrian civil war. The world had a ringside seat to the conflict, although the information flowing over social media was sometimes heavily edited.

THE TWEETED REVOLUTION.

Starting in 2010, the Arab world was rocked by a series of popular protests known as the Arab Spring, beginning in Tunisia and Egypt, where citizens lobbied for an end to longtime dictatorships and the birth of partic.i.p.atory government.

Social media played an important role in publicizing the issues at play in those countries, and in organizing and publicizing the protests. Young activists used Twitter, Facebook, and YouTube to publicize corruption by the leaders of Egypt and Tunisia, according to a study by the Project on Information Technology and Political Islam. The content of social media reflected and amplified conversations from the streets, the study found, and it provided a fast way to mobilize tens of thousands of people for protests.20 For months, the popular uprisings flooded the squares of Cairo and Tunis with protesters demanding an end to decades of ironclad dictatorships, and social media was used to doc.u.ment every stage of the revolutions. When Egyptian president Hosni Mubarak sent the Egyptian Army to roust protesters out of Cairo's Tahrir Square, the event was chronicled on Twitter for a rapt worldwide audience, pushing the international community to condemn the crackdown. And when army officers dramatically defected to join the protesters, the world watched and cheered.21 In these early, heady days, it seemed as if a revolutionary wave of positive change was washing over the region thanks to the emergence of this new technology.22 Fueled by the fall of iron-fisted regimes in those countries (Tunisian president Zine al-Abidine Ben Ali stepped down in January 2011, Mubarak in February), Syrian activists opposed to the brutal regime of President Bashar al a.s.sad adopted some of the same tactics.23 But the Arab Spring froze into winter, and the longtime dictatorships in Tunisia and Egypt were replaced not by progress but by newly imperfect regimes.24 In Syria, a vision of nonviolent regime change gave way to a violent crackdown and then civil war in early 2011. From the start, social media played a crucial role in disseminating and sometimes distorting information about the conflict.25 Syria had been a key way station for jihadists entering Iraq during the U.S. occupation, with the a.s.sad regime turning a blind eye (in the most charitable interpretation) to frequent border crossings by militants a.s.sociated with what was then al Qaeda in Iraq. There was little question that this activity was permitted by the a.s.sad regime as a pa.s.sive-aggressive hindrance to the U.S. occupation, and it may have provided more active support.26 But the networks that had supported these efforts now turned against the regime, and foreign fighters began to flow back into Syria in greater and greater numbers.

Virtually everyone involved in the conflict began working social media to advance their agendas, almost from the start. Anti-regime activists continued to put out information about regime atrocities in very organized ways, while the regime turned to sophisticated disinformation tactics, using hackers to compromise the websites of opponents; professional trolls to unleash a steady stream of abusive tweets and posts, as well as disinformation; and "honeypots," friendly-seeming accounts offering access to valuable information or affection, but actually intended to seduce critics into giving up compromising personal information and computer pa.s.swords.27 In addition to the organized disinformation, which proliferated wildly, rumors and genuine misunderstandings could be found in ample supply.28 The flood of new information created new opportunities and complex challenges for journalists, academics, and intelligence officials. On the one hand, open-source intelligence was being generated at a speed and volume unprecedented in the history of conflict. In Afghanistan during the 1980s, for instance, it might take weeks or months for videotape of a muhajideen battle to travel back to the United States for viewing, where it enjoyed only limited circulation.

In Syria, the turnaround could be hours or days, and the audience was immense. Many sources were inconsistent or unreliable. As compet.i.tion grew into conflict among Syrian rebel factions, activists often produced "evidence" of each other's dirty deeds.29 Supporters of some factions, particularly jihadists, would post images of conflict they had found on the Internet and claim they represented recent events. These images could go viral quickly, before anyone checked their veracity.30 The major fighting factions quickly established official media accounts on a number of platforms for disseminating "authenticated" propaganda and activity reports, and smaller fighting factions (of which there were many) soon followed suit. The major players included the secular Free Syrian Army, the Syrian al Qaeda affiliate Jabhat al Nusra, the independent jihadists of Ahrar al Sham (later folded into the Syrian Islamic Front), and what was then known as the Islamic State in Iraq and Syria.

ISIS set up its first official Twitter account as an official "media foundation" under the name al I'tisaamm, an Arabic reference to maintaining Islamic traditions without deviation. Its first Twitter handle was @e3tasimo, established in October 2013 to little fanfare and scant notice from the media, although it quickly gained more than 24,000 followers.31 The official account tweeted out videos and other propaganda at a steady but slow rate. Individual accounts for members of ISIS were more active and accrued more followers as a result. One of the most prominent accounts, using the handle @reyadiraq, claimed to be unaffiliated with ISIS, a deflection tactic that supporters would try over and over again, with little success.

In late February, after a steady diet of increasingly grisly doc.u.mentation of ISIS activities, including live tweeting of the amputation of an accused thief's hand in Aleppo, Syria, with accompanying photos, Twitter suspended "Reyad," by which time he had acc.u.mulated more than 90,000 followers.32 The account returned in March under the name @dawlh_i_sh, a play on the Islamic State's acronym, but even after months, it never regained its full follower strength. It was suspended again at the end of the summer of 2014, with just under 28,000 followers, and did not return in a clearly identifiable form. Whacking the mole once again seemed to have some lasting effect.33 The @e3tasimo account was also suspended by Twitter in late 2013 or early 2014, for reasons that were not entirely clear. ISIS attempted to re-create the account several times in January, but five or six new accounts in a row were suspended almost immediately. The pattern suggested that a government request was behind the takedown, but (as detailed later in this chapter), Twitter was restricted from disclosing such requests under certain circ.u.mstances.34 After a pause, the account returned on February 20 as @wa3tasimu, and Twitter did not intervene. Through March, the new account accrued more than 18,000 followers. In contrast, its chief rival, Jabhat al Nusra, had more than 50,000.35 But beyond the follower counts, there were oddities in ISIS's social media profile, hidden patterns that betrayed a hidden purpose.

Day after day in the month following ISIS's return to Twitter, a strange effect became visible. Each group used its formal name as a hashtag to identify media releases and supporter content. Despite its huge follower deficit, ISIS's hashtag was consistently tweeted more often than al Nusra's, by about four to one.36 A data-driven a.n.a.lysis of the followers of both accounts helped reveal the hidden dynamics.

Over the years, information scientists had observed a pattern of activity in online communities sometimes known as the 90-9-1 rule. Generally speaking, focused online communities tend to break down in predictable groups. As a rule of thumb, about 90 percent of users will be mostly pa.s.sive, about 9 percent are active, and 1 percent are very active. In social media networks, this dynamic also applies to the distribution of influence, defined as the ability to prompt interaction and partic.i.p.ation by other users.37 The followers of both al Nusra and ISIS roughly broke out into the same pattern, but the devil was in the details. ISIS users in the 9 percent group were measurably more active than their counterparts following al Nusra. ISIS had a few thousand active online supporters who were more enthusiastic-and more organized-than their counterparts in the 9 percent group of al Nusra supporters.38 This was no accident; it was strategy. ISIS had a name for these users-the mujtahidun (industrious).39 The mujtahidun could be observed repeatedly using specific tactics to boost the organization's reach and exposure online.

For instance, media releases followed a predictable pattern. After being posted and authenticated by official ISIS members, a second-tier group of several dozen online activists would retweet the link with a hashtag, then retweet each other's tweets and write new tweets, all using the same hashtag. Other activists would upload the release to multiple platforms, so that it could be found even when Internet providers pulled the content down. After that, a third tier-the ansar muwahideen (general supporters)-would repeat the process on a larger scale.40 Similarly, online hashtag campaigns were designed by activists on jihadist forums, largely out of sight, then implemented on Twitter in the same systematic way, with key users repeatedly tweeting the same hashtag and each other, and the next tier retweeting the previous tier and each other. The technique would routinely result in hundreds of similar tweets with hashtags at coordinated times, sometimes referred by partic.i.p.ants as a "Twitter storm." Using the most inclusive criteria, around 3,000 users were part of this social media battalion (as ISIS called it) at its height, although some of those accounts were automated bots.41 The coordination was designed, in part, to game the systems that identified trending topics on Twitter. By concentrating their tweets in a short period and repeatedly tweeting the same hashtag, the media battalion could cross the threshold that would trigger trending alerts that would be displayed by Twitter on its website, as well as by third-party services such as "Active Hashtags," an automated Twitter account with more than 160,000 followers that highlighted trending topics in the Arabic language.42 A strong performance could also influence search results, as seen during the World Cup and the march on Mosul.

There was a cascading effect to these efforts. Each time a hashtag ranked as trending, it was exposed to more people, generating still more activity. When an ISIS hashtag appeared on the Active Hashtags account, for instance, the tweeted announcement was retweeted an average of 72 times-making the tag trend even higher just on the basis of its appearance in that tweet, without accounting for those who might click the link and take a legitimate interest in the content.43 The jihadis soon developed their own version of the account, @al3r_b, which purported to retweet the most important "Muslim" news, but whose content consistently favored ISIS and its prominent online supporters. Tweets picked up by @al3r_b would be retweeted as many as nine times more than other tweets by the same user. (Twitter suspended the account in September or October 2014).44 It was a cla.s.sic case of "fake it till you make it" marketing-the boost in visibility and exposure created an appearance of momentum that gradually turned into real momentum and a growing base of support, especially within the online jihadist communities where ISIS was now directly competing with al Qaeda for legitimacy and resources (see Chapter 8).

Smart-if deceptive-social media strategies boosted ISIS across the board. In contrast, the al Qaedacontrolled al Nusra had simply replicated the old style of media distribution on the new platform of Twitter, with a focus on relatively simple propaganda videos and fund-raising channels, where it outperformed ISIS significantly.

Ultimately, al Nusra's organically grown social network was no match for ISIS's engineered network features, such as the mujtahidun and the Dawn of Glad Tidings app. When the app rolled out in April, it automated and enhanced the efforts of the mujtahidun, resulting in a huge surge in the group's visibility.

None of this online activity existed in a vacuum, and much of it was strategic. In March, for instance, one highly organized Twitter campaign featured a hashtag demanding that ISIS emir Abu Bakr al Baghdadi "declare the caliphate." It was an unprecedented tactic by an extremist group, essentially providing an online focus group to test its messaging before making it official, allowing ISIS to fine-tune the actual announcement when it arrived months later.

The Dawn app also coordinated to offline activities, reaching new heights just as ISIS rolled into Mosul in June. At its peak, during the attack on Mosul, the app generated about 40,000 tweets in one day (including retweets of the app's content by other users). The termination of the app on June 17-just twelve days before the announcement of the caliphate-struck a blow against ISIS's messaging strategy at a critical moment.45 As a result, supporters had to work harder for lesser gains. At one point, ISIS activists resorted to posting lists of tweets that users could cut and paste in an effort to simulate the app's function, but these efforts could not offset the loss of automation.46 When ISIS announced its caliphate on June 29, it took the major media almost twenty-four hours to discover, authenticate, and report the story. The messaging apparatus was not unstoppable and it was not all-powerful. It was down, but far from out.

BEYOND THE OFFICIAL ACCOUNTS.

Individual foreign fighters with all of the factions in Syria could be found on social media by the hundreds, at first, and soon by the thousands. While they were represented on a number of platforms (the Dutch fighter named Yilmaz, mentioned earlier, accrued a ma.s.sive following on Instagram before being suspended), a significant proportion of activity gravitated toward Twitter.

Due to its simplified interface, Twitter was well suited to situations where users had limited Internet access-tweets could even be posted and read via SMS text, which could be sent over any functional cell phone network and did not require an Internet connection. Additionally, Twitter was still reluctant to suspend accounts for terrorist content, which allowed users to accrue more followers and spend less time rebuilding networks than on other platforms, such as Facebook.

In some ways, the fighters used social media like anyone else, to chat with friends and post the mundane details of their lives, often in their native languages. The tabloid media, particularly in the United Kingdom, had a field day breathlessly reporting on the fighters' selfies with kittens and cravings for Nutella, as well as "terrifying" threats posted by accounts of questionable significance (for instance, claims that ISIS had a "dirty bomb" or that its operatives would infect themselves with Ebola and enter the United States).47 Not everyone who tweeted in support of ISIS was actually linked to the group, and not everyone who looked like a foreign fighter was one in real life. But all of them quickly learned that the global media reliably pounced on whatever they said, and the more outrageous the better.

Google searches for "ISIS" soared in July 2014, after the announcement of impending U.S. air strikes in Iraq ignited a Twitter storm of threats from ISIS supporters. Using the English-language hashtag #AMessagefromIStoUS, at least hundreds of Twitter users directed a barrage of threats both vague and specific at Americans, promising retribution on U.S. soil if the United States attacked ISIS. Activity spiked again in September, after ISIS released videos of the beheading of American journalists.48 Not all of this activity was confined to ISIS. Fiery clerics took to the social "airwaves," exhorting supporters to action and praising their faction of choice. Dozens of prominent Persian Gulf fund-raisers took to Twitter and Facebook, where they posted bank transfer information to "help the Syrians," which in many cases meant funding non-ISIS jihadist fighters, although they avoided explicitly naming the recipient of the funds. Their followers swelled into the hundreds of thousands, with clear signs of covert activity constantly bubbling beneath the surface (for instance, cl.u.s.ters of accounts that all had established links with each other but never tweeted, or accounts with tweets marked as private that had posted thousands of tweets but had no followers).49 Then there were the recruiters. Prior to 9/11, jihadist recruiters had done much of their work in "brick-and-mortar" settings, with former foreign fighters traveling from city to city to tell potential recruits about their experiences and urge them to join the conflict du jour.50 In Syria, a new dynamic emerged. Fighters could do the work of recruitment without ever leaving the front lines, a phenomenon Shaarik Zafar of the U.S. National Counterterrorism Center dubbed "peer-to-peer recruiting."51 Potential fighters could follow actual fighters from their home countries on Twitter, talk to them, ask questions, and eventually receive guidance about how to join the fight. In addition to Twitter and Facebook, many fighters signed up for ask.fm, the question-and-answer website where they entertained queries that ranged from ba.n.a.l to practical.

Recruits might travel on their own initiative to Turkey near the Syrian border, then log on to Twitter and ask for someone to come and pick them up. Incredibly, it seemed to work on a regular basis.52 People specifically tasked with recruitment also stalked the vulnerable online,53 although the old ways did not completely fade. Many groups maintained dedicated recruitment networks on the ground. For instance, ISIS had operatives recruiting in Minneapolis, once a major pipeline for al Shabab fighters.54 Individuals worked the community, promising money and marriage to young men (and women), some of whom belonged to gangs that had adopted street names based on famous jihadist figures.

All of them also followed each other on Twitter, where the recruiters could keep tabs on what was happening and communicate privately with those who seemed willing. One fighter who was closely connected to that online recruiting network was Douglas McAuthur [sic] McCain, a Minnesotan killed fighting for ISIS in late summer of 2014, who maintained multiple Twitter accounts that followed and were followed by members of the recruitment network back home.55 But some professional radicalizers and recruiters simply moved their whole portfolios online, where they could operate more privately, away from the target's friends and family, a practiced tactic.56 The primary work of the recruiter was building relationships, after all, and social media was made for that. Dozens of men and women on Facebook who listed their profession as dawah (an Arabic word for evangelical preaching) could be found working their way through Muslim social circles, seeking the vulnerable and providing them with connections that would lead them to Syria.

Evidence of these networks could be found in the case of Nicholas Teausant, a California native indicted in March 2014 for attempting to join ISIS. Although his social network connected him to legitimate radical communities supporting ISIS in the United Kingdom, Teausant was diverted by the intervention of an FBI informant and arrested. Just days later, two men from North Carolina with connections to the same social network online were arrested for planning to travel to Syria.57 ISIS social media operatives liked Facebook, with its rich media capabilities and multiple network options (such as fan pages and moderated groups that resembled the old forums), and they took a sophisticated approach to establishing its presence.

Fan pages for Abu Bakr al Baghdadi quickly accrued more followers than those of better-known extremists such as Anwar Alwaki. ISIS laid other plans signaling the announcement of its caliphate, creating accounts on Twitter (@islamicstatee) and Facebook two weeks in advance.58 One English-language page, Bilad al Shaam (a reference to Syria under the historical Umayyad caliphate), was created, suspended, and rebuilt dozens of times. Each time it returned, with a number denoting how many iterations it had gone through and sometimes a jab at the "Facebook thugs." Each time it met with a quick end. Another popular campaign using the slogan "We Are All ISIS" launched on Facebook before expanding to other social media. At least forty-eight iterations of the Facebook page were created after repeated terminations, according to Jeff Weyers, an a.n.a.lyst closely tracking extremist use of Facebook.59 Facebook kept whacking the more visible moles, and terminating the accounts of bomb-making instructors and active terrorist plotters, but it was more difficult to intercept the recruiters, who often presented themselves simply as devout Muslims, avoiding obvious indicators of their affiliation and doing most of their work through private interactions.

But Facebook's vigilant policing had still paid benefits. While they had by no means exterminated the infestation, jihadis began to express frustration with the platform. As on Twitter, a core group of mujtahidun helped populate pages with content and likes, but the frequent suspensions limited ISIS's ability to reach an outside audience where fresh recruits could be lured.

Throughout 2014, more and more ISIS supporters moved their main activity to Twitter, where they could reliably expect to operate free from interference. While it was easier for jihadis to operate on Twitter, the social media strategies of ISIS were fueling public and private pressure on the libertarian social media platform. A showdown loomed.

TWITTER VS. ISIS.

As ISIS rose in prominence, Twitter once again came under scrutiny for its practices. Unlike Facebook and YouTube, which allowed users to flag terrorist content for review, Twitter initially offered few reporting options.

"Users are allowed to post content, including potentially inflammatory content, provided they do not violate the Twitter Rules and Terms of Service," its guidelines read.60 At the time, Twitter's abuse reporting form was lengthy and restrictive, asking for substantial information on the user filling out the report and recommending that people just block accounts they didn't like. Blocking is a procedure that prevents other users from "mentioning" the blocker and thus showing up on their Twitter timeline, but it did not, at the time, prevent the blocked user from other activity, including reading the blocker's tweets by going directly to their Twitter profile page.61 There were other ways to get around blocking as well, raising issues that were more problematic in areas other than counterterrorism. For instance, blocking was virtually no impediment to stalkers or s.e.xual hara.s.sers.

The platform's policy on violence was similarly narrow. Only "direct, specific threats of violence" were explicitly banned in the "Twitter rules." That generally meant naming an individual and threatening specific bodily harm against him or her. When al Shabab was first suspended for threatening to execute a hostage, it had crossed that line.

During the Westgate Mall siege (Chapter 6), Twitter took a broader view of its existing policies, with threats against Kenya during an ongoing terrorist attack against Kenyans apparently being specific enough to merit a response. Or perhaps the prospect of headlines such as "Are ma.s.s murderers using Twitter as a tool?" made the difference.62 After Westgate, the operating environment on Twitter slowly began to change. Several hundred al Shabab members maintained accounts on Twitter. Slowly and steadily, many of those accounts began to disappear. Three of the most important accounts in the Shabab network with the largest follower counts were among the first to go. They came back, smaller, but were soon suspended again.63 In addition, a number of tiny accounts began to blink out of existence, one or two at a time, often including new followers of the few prominent Shabab accounts that remained active. These were not noisemakers engaged in highly visible social media campaigns; some had only dozens of followers.64 This pattern suggested the suspensions were the result of government requests, although it was unclear which government. Some government requests came packaged in a form that prohibited Twitter from disclosing whether the requests had taken place and whether it had complied with them.

"The data in these reports is as accurate as possible, but may not be 100% comprehensive," Twitter's "transparency" page noted laconically. Its blog post on transparency was considerably blunter, noting that, within the United States alone, it was prohibited from reporting on suspension requests that were received in the form of official "national security letters" (NSLs) and certain types of Foreign Intelligence Surveillance Act (FISA) warrants.

Twitter's complaints about transparency had significant merit, but its efforts to win the right to even disclose generalities about such requests were rebuffed by the government.65 In October 2014, Twitter filed suit against the government seeking the right to disclose more information. As of this writing, the lawsuit was still in progress.66 Even hobbled by these disclosure restrictions, Twitter made it clear the pace had changed. During the first six months of 2013, Twitter reported receiving 60 requests from governments and other ent.i.ties67 around the world. During the second half of 2013, that number skyrocketed to 377, an increase of more than sixfold, which did not include the exempted requests noted above. The number of doc.u.mented requests increased by another 14 percent in the first six months of 2014.68 Initially, Twitter's suspensions of ISIS accounts were similarly ambiguous. When the official ISIS account was first suspended in February 2014, there was no obvious provocation to which it could be attributed.

The second time the official account was suspended, around the end of May, the reason was clearer. The suspension closely corresponded to the release of Salil al-Sawarim 4, Arabic for The Clanging of the Swords Part 4, the latest installment in a series of increasingly sophisticated and violent propaganda videos (see Chapter 5). The video showed hundreds of executions in graphic detail.

The tactics ISIS used for distribution online were designed to inflate the appearance of its popularity. The Dawn of Glad Tidings app blasted out thousands of tweets promoting the video,69 which quickly racked up large numbers of views on YouTube (likely also fueled by repeated clicks from the mujtahidun and bots that could automatically access the video over and over again without involving a human viewer, although this could not be conclusively proven).70 Regardless, the fake-it-till-you-make-it principle applied and ultimately resulted in the video being widely viewed and discussed, with some Western a.n.a.lysts calling it the "most successful" jihadi video in history. That is almost certainly true, but ISIS's manipulations played a critical and generally underestimated role in inflating its importance. There is no way to know how many people actually viewed the video.71 The second official ISIS account was suspended almost immediately after the release of The Clanging of the Swords 4, with a speed that again suggested a government hand. But many other Twitter accounts remained online, including top influencers with more followers than the official account, such as ISIS media distributor Asawirti (Interpreter) Media, popular Chechen foreign fighter Abu Walid al Qahtani, and a notorious English-speaking tweeter using the name Shami (Syria) Witness (a user based in India who was arrested in December 2014).72 Each had tens of thousands of followers, and the calculated ISIS distribution strategy was in full effect.

The timing of the release, and its focus on the ma.s.s execution of Iraqi soldiers taken prisoner, was significant. ISIS was employing social media as a tool for military and psychological offense. It foreshadowed actions with deliberation and strategic intent. On the surface, The Clanging of the Swords appeared to be just another ISIS video production, albeit a very successful one, but it came into play on the ground just a couple of weeks later.

Starting in early June, ISIS forces stormed through northern Iraq. When they reached Mosul on June 9, Iraqi troops defending the city turned and ran, some stripping their uniforms off as they fled. Some Western a.n.a.lysts and many ISIS supporters credited the video for inspiring the fear that led to this stunning retreat.73 Within a week, several official regional ISIS Twitter accounts had been shut down, including one of the only sources providing information on the attack against Mosul.74 While Twitter refused (or was prohibited) from discussing the reasons for the shutdown, government requests were again suspected. On June 17, Twitter suspended the Dawn app, likely for violating its terms of service and related to news coverage rather than government requests.75 These setbacks came less than two weeks before ISIS's next big move, the declaration it was changing its name to simply the Islamic State and claiming the mantle of the caliphate.

While the losses weakened ISIS's distribution of content on the day of the announcement, June 29, and in the days to follow, the announcement was big news in the jihadi world, and ISIS supporters were fired up. Their burst of hyperactivity helped offset the disadvantages and distribute a string of important media releases, including an unprecedented video of emir Abu Bakr al Baghdadi giving a sermon in conquered Mosul (along with translations in multiple languages) and the first issue of an ambitious English-language magazine named Dabiq, after a town in Iraq featuring prominently in Islamic prophecies (see Chapter 5). After Baghdadi showed his face for the first time, thousands of Twitter and Facebook fans began to use his image in their profiles.

But the announcement still underperformed relative to social media campaigns earlier in the year. ISIS supporters were extremely disappointed in the reaction of Muslims in general and their fellow jihadis in particular.

One mujtahidun complained that no one had showed up for a Twitter storm he announced. "Where are the others? Let's terrorize the kuffar on #Twitter. Is it too much difficult? Kuffar is doing their best to fight us. What about us?" Others complained petulantly that if people didn't want to swear allegiance to ISIS, they could at least refrain from mocking the would-be caliphate.76 The regional accounts-ISIS had one for each of its major geographical holdings-trickled back after a few weeks, with sporadic resuspensions and resp.a.w.ns. As the summer stretched on, whack-a-mole continued at a simmer, as did ISIS's aspirations for global support (see Chapter 8). Some ISIS accounts went down; most remained.

Then, on August 13, things began to ramp up. The official ISIS regional accounts were again suspended, but this time they were knocked down as soon as they came back, sometimes within minutes of returning. This continued for some hours, through dozens of iterations, until the message finally became clear. While some of the big influencers remained online, official ISIS accounts would no longer be tolerated on Twitter.

Some dozens of smaller accounts went down as well, including several prominent foreign fighters tweeting in English. Almost a week later, Twitter suspended the biggest and most influential ISIS accounts, including Abu Walid al Qahtani, Asawirti Media, and "al Khansa'a," a female former al Qaeda supporter who had become a powerful voice supporting ISIS and helping to organize its online recruitment of women (see Chapter 4). Al Qahtani went dark for a time, while the latter two kept popping out of holes to get whacked again periodically.77 Other jihadi accounts, including some a.s.sociated with al Qaeda and Jabhat al Nusra, were also suspended, but sporadically. The main focus was ISIS.

A comedy of errors ensued. While the number of suspensions had climbed to more than one hundred, they still represented only a fraction of the active ISIS supporters on Twitter. Nevertheless, panic began to spread among ISIS tweeters.

Some, like Shami Witness, made their accounts private on the theory that it would help insulate them against suspension. Others changed their screen names and user handles (because surely that would fool Twitter). Many changed their profile pictures from ISIS's characteristic black flag emblem to pictures of flowers and kittens. One changed his screen name to "Syrian Food" and profile pictures to a restaurant. Many users subsequently abandoned these tactics, as their effectiveness was questionable and they made it much more difficult to do the work of social media activism.

Stalemated with Twitter, ISIS began trying to reconst.i.tute its official accounts on alternative social networks. It moved to an obscure Twitter alternative called Quitter, where it was quickly suspended. It went to a pro-privacy social network called Friendica, which killed the accounts quickly and posted a message to anyone who came looking: "Islamic State not welcome on friendica.eu."78 ISIS then moved to Diaspora, an open-source social network specifically designed to let individuals and groups host the service using their own infrastructure, which in principle should have insulated the accounts from suspension on a purely technical basis. But the social network's designers and users found a way to take them down yet again.

Finally, in what must have been desperation, ISIS moved its accounts to VKontakte, a popular Russian equivalent to Facebook. This was, in many ways, an amazing turn of events. VK, as it is popularly known, had some months earlier lost a struggle for independence against pro-Putin forces in the Russian marketplace. There was good reason to suspect that sharing user data with VK was functionally indistinguishable from simply handing it over to the FSB, the Russian intelligence service. Hundreds and hundreds of ISIS followers did just that, until even VK grew weary of them and suspended the official accounts.79 ISIS had not been idle during all this tumult. On August 19, it released the now-infamous video of the beheading of American journalist James Foley.80 ISIS Twitter accounts. .h.i.t the ground running, distributing the video using the English hashtag #AMessagetoAmerica and directing tweets to the accounts of random Americans in an effort to spread them among the American public. ISIS supporters also paid spammers based in the Persian Gulf region to send out tweets that included the hashtag.

Twitter, apparently on its own initiative, began to take down accounts that were spreading the video and graphic images included in it. The sweep of this crackdown was so broad it took down the accounts of some journalists and a.n.a.lysts who had tweeted the content (they were restored later).81 Still, only about fifty ISIS accounts were suspended in the first twenty-four hours after the video released. It was more than Twitter had suspended in one sweep before, but still a tiny fraction of all ISIS-supporting accounts.82 The move may have been empowered by a new policy Twitter announced just hours after the video was released.83 The policy had been in the works for days prior and was prompted by the suicide of actor Robin Williams on August 11. Internet trolls had tweeted Photoshopped images that they claimed showed the actor's corpse.84 "In order to respect the wishes of loved ones, Twitter will remove imagery of deceased individuals in certain circ.u.mstances," Twitter wrote, adding that it "considers public interest factors such as the newsworthiness of the content and may not be able to honor every request."85 Although news reports attributed the policy to the Williams incident, there were hints that Twitter might have known the Foley video was in the works. The crackdown on ISIS had started prior to the video's release. In the thirty days preceding the Foley video, Twitter had suspended at least eighty ISIS accounts, including all of its official outlets. A number of ISIS accounts had foreshadowed the release by tweeting images from the 2004 beheading of Nicholas Berg.

In keeping with its typical silence, Twitter refused to comment on why specific accounts were suspended, but in the wake of the Foley video, it referred curious reporters to the family request policy.86 Some ISIS supporters took the hint and stopped tweeting the video and images. Others persisted and were suspended, often multiple times.

In the weeks following the Foley video, Twitter continued suspending the accounts of ISIS supporters, usually dozens at a time, with periods of inactivity between.

News coverage and Twitter intervention seemed to track uncomfortably with the race of the victims depicted. When ISIS publicized the executions of Iraqis and Syrians, news coverage and organizational responses were minimal, but the beheadings of white Western journalists-which continued throughout the fall-led to more Western media coverage and more suspensions by Twitter.87 ISIS supporters joked about being Twitter shahids (martyrs), and when they created new accounts, they began listing the number of times they had been previously suspended in their profiles. As both the suspensions and the beheadings continued, it became more difficult for ISIS to push its message to the widest possible audience. It turned more heavily to manipulative tactics such as bots and purchased tweets.

The number of suspensions began to climb. More than 400 accounts went down in one seven-hour period in late September. Between September 1 and November 1, at least 1,400 ISIS-supporting accounts were suspended-a very conservative estimate.88 As frustration mounted, many ISIS users took to threatening to kill Twitter executives, sometimes by name. The social media platform had been weaponized against itself.89 In December 2014, Twitter announced it would overhaul the process of reporting abusive or violent behavior, making it easier to report accounts or specific tweets that violated Twitter rules and preventing users from viewing the profile pages of someone who had blocked them. Some online advocates continued to insist more changes were needed, and Twitter said its policies would continue to evolve.90 In the meantime, the suspensions were starting to have an effect on ISIS. The number of retweets that an average ISIS supporter could expect to receive dropped significantly. From August, when the major crackdown began, through the end of October, the average number of retweets for every tweet by a monitored ISIS supporter (excluding bots) plunged 42 percent, from 5.02 to 3.49. The percentage of tweets by ISIS supporters that received no retweets at all climbed from 57 percent to 62 percent.91 Other metrics (such as the number of followers and number of tweets per day) also appeared to drop dramatically.

While these a.n.a.lyses pointed to an impact from the suspensions, it is important to note the difficulty of creating a reasonable comparison set. One especially large challenge stems from the fact that there is no definitive estimate of how many ISIS supporters are active on Twitter.

In late 2014, we attempted to answer the question of how many ISIS supporters were active on Twitter, in a research project commissioned by Google Ideas and coauth.o.r.ed by J. M. Berger and Jonathon Morgan. As of press time, we estimated that at least 45,000 pro-ISIS accounts were online between September and November 2014, along with thousands more pro-ISIS bot and spam accounts.

This represents only an initial finding. The research project will be completed between the writing of this book and its publication, and the complete results will be published by the Brookings Inst.i.tution and will also be available at Intelwire.com by the time this book is published. Once a baseline set of ISIS supporters has been identified, it will be possible to conduct better research on the effect of suspensions.

ISIS STRIKES BACK.

Although a.n.a.lysts continued to debate the merits of whack-a-mole, ISIS supporters delivered their verdict loud and clear.

"As the accounts of the caliphate's supporters become scattered, their effectiveness rises and falls, and the control the supporters have decreases," wrote Shayba al Hamd, an ISIS social media activist, on September 12, calling the campaign "devastating" and a "dirty war."92 "The Crusaders tremble at the media power of Dawla [the Islamic State], which has taken up permanent residence in the depths of Twitter," he wrote.

ISIS strategy doc.u.ments diagnosed the problem as emanating from the top down, with the official accounts targeted first and the industrious mujtahidun second. The ansar supporters were less vulnerable, and a fourth tier, "the silent supporters," was therefore required to step up and become more active. If Twitter closed a tier, he wrote, the next tier would simply rise up to take its place (not addressing the fact that the supply of tiers appeared finite).

"Why must you return to Twitter?" al Hamd asked rhetorically. He compared it to war: If the frontline fighters desert, what hope has the army?

Other ISIS users specifically pointed to the amount of time and energy that they were now wasting on rebuilding the same networks over and over again, and the fact that even the hard-core mujtahidun were growing weary of promoting newly resurrected accounts for days on end.93 Some devised elaborate countermeasures, based on ISIS social media experts' beliefs about how Twitter decided whom to suspend and whom to permit. In addition to a brief bout of camouflaging accounts, some periodically changed their online names. Others blocked anyone following them who "looked suspicious" (these might be anonymous accounts or journalists and terrorism researchers who failed to take steps to hide their own presence online).

Twitter largely remained silent about its ISIS problem, even when the group's supporters began threatening to kill and behead their employees, sometimes by name and photo.94 But it quietly made a change to its terms of service, which allowed it to request a valid phone number to verify the ident.i.ty of any user. A spree of suspensions followed almost immediately. ISIS noted this, and guided users to services that provided false phone numbers that could be used to verify accounts.

Some also made more elaborate plans. ISIS had, for some time, been recruiting and training hackers, some with links to broad international cybernetworks that later repudiated them.95 These activists, including many on the social media team, were part of the "Islamic State Electronic Army" and were active on both Twitter and Facebook.

The army had a "brigade" devoted to media operations, which included many key members of its social media team (known as i'lamiy nasheet, or "the energetic journalists") and a "technical brigade" that worked on hacking and security operations.96 The two sometimes overlapped and collaborated, for instance to design the bots and apps that were so important to ISIS's social media success.

One unsigned technical brigade strategy doc.u.ment suggested supporters should hijack older accounts with significant numbers of followers that had been abandoned by their Western users, providing detailed instructions; examples of success were not abundantly detected in the wild (that is, actually being implemented on Twitter). The doc.u.ment then provided overly complex instructions on how to gain followers.97 All of these strategies were predicated on the incorrect a.s.sumption that such tactics would also provide protection. Most of the proposed countermeasures were stabs in the dark. At best they might slow down the process of suspension. At worst they contributed to a growing sea of confusions.

At first, the technical brigade recommended that someone whose account had been suspended should return with the same name and a number added to the end (a tactic also used on Facebook), to make it easier for supporters to find each other. It was also recommended that users create multiple backup accounts and let their followers know where to find them if they were shut down.

It soon became clear that this was just making it easier for Twitter to suspend them, so they reversed course and told users to come up with entirely different names. The subtleties of this process were lost on some suspended users, who opened each new account by proudly announcing how many times they had been suspended before. Some ran into the dozens.

At the time of this writing, the ultimate outcome of the battle for Twitter supremacy was still a work in progress, but one thing was clear-ISIS was far from ready to concede the online battleground, and it had chosen Twitter as the field on which it would make its stand.

It seems strange that Twitter could lose control of a system it owned and operated in its entirety, even as that tool was being used to threaten the company's own employees and executives. Yet while the suspensions had hurt the organization's efforts and taken away some of the tools that had made ISIS notorious, the electronic brigades were adapting.

New generations of bots emerged weekly, some of them carefully calibrated to avoid Twitter's countermeasures. Out of 85 "ghost" bots detected on September 15, 2014, only 25 had been suspended by early November, despite tweeting links to some of ISIS's most graphic material.98 The ghosts were a calculated affair, with very specific profiles, small follower counts, and an intentionally limited reach; they could easily be missed by anyone scouring the Internet for ISIS, and they were lesser targets for suspension. But their tweets would still help trend hashtags and distribute content. Other similar cl.u.s.ters of bots were set up in the same manner, using different technical specifications. ISIS had learned from its experience with the Dawn app. The new generation of bots were smaller, less visible targets with no single point of failure.

While the effects of these visible ISIS countermeasures set off new rounds of whack-a-mole complaints, ISIS had been forced to spend more energy on smaller returns as a result of pressures and setbacks its own members described as "devastating."99, 100 If the pressure continued, the network would continue to suffer. If the pressure eased, the network would recover, at least in part, its members shuffling back online to rebuild and regroup, and start the whole process again.

They are weeds.

No gardener expects weeds will simply give up after being uprooted once. Gardening is a process; it requires care and maintenance. A constant gardener does not let weeds overrun the plot.

CHAPTER EIGHT.

THE AQ-ISIS WAR.

ISIS was born from the crucible of America's "war on terrorism," and al Qaeda looms over these pages like a shadow. The road from al Qaeda in Iraq to ISIS has, at every step, revealed a clear pattern of deliberate differentiation.

Jihadist groups have a long history of splintering and separation. In some cases, this process involves compet.i.tion among factions that sprang from the same source. In Algeria during the 1990s, this dynamic reached disastrous proportions, from the terrorists' point of view. The ensuing fitna (infighting) resulted in the emasculation of every group involved, and became a widely cited case study in failure for jihadists everywhere.1 The separation of ISIS from al Qaeda, while born out of strife and irreconcilable differences, did not have to result in war. Certainly, al Qaeda did not want such an outcome, and it has repeatedly pleaded with ISIS to submit to an arbitrated reconciliation. ISIS not only rebuffed these overtures, it upped the ante, and with the declaration of the caliphate, it demanded that al Qaeda submit to its authority.

As a result, the global jihadist movement has split into two major factions. Al Qaeda and its declared affiliates continued to operate under the nominal leadership of Ayman al Zawahiri. ISIS and a growing number of global affiliates have staked their loyalties to Abu Bakr al Baghdadi.

The two groups are now locked in a battle for supremacy and for the loyalties of unaffiliated groups and the members of existing organizations.2 It is easy to misunderstand the stakes in this battle. ISIS has adopted the rhetoric of the absolute-al Qaeda must submit and become part of its caliphate-and the two compete, to some extent, for loyalty, funds, and recruits.

But most important, this conflict is about vision. The "winner" of the war between al Qaeda and ISIS will wield tremendous influence over the tactics and goals of the next generation of jihadists. Understanding the contours of the battle will help reveal the shape of things to come. In that respect, the question of who "wins" is incredibly important, not just to the region but to the world. The West has too often found itself fighting the last war, when the next war is taking shape before its eyes. Faced with the expansionist, populist rise of ISIS, we cannot afford to keep making that mistake.

But before we can forecast what lies ahead, we must first understand what is happening now. Who is winning the battle for leadership of the global jihadist movement?

THE BATTLE FOR BAYAH.

Terrorist groups are often amorphously linked to one another, with cooperation and coordination taking place across a spectrum of activities.

For instance, in 1998, Osama bin Laden and the leaders of other jihadist terrorist groups announced the formation of the World Islamic Front, an alliance to fight the United States, but each signatory to the statement had a different relationship to al Qaeda.

Al Qaeda folded the Egyptian Islamic Jihad organization, led by Ayman al Zawahiri, into itself. Islamic Jihad did not become al Qaeda in Egypt, however; it was simply subsumed into al Qaeda.3 On the other hand, the Islamic Group (the Egyptian jihadist group responsible for the World Trade Center bombing with support from AQ) remained somewhat independent and eventually drifted away from al Qaeda in most meaningful respects, even taking part in the political process that emerged after the Arab Spring.4 After September 11, the power dynamics began to shift. Although the amorphous links continued, the leaders of some groups now pledged their loyalty to the emir of al Qaeda, Osama bin Laden, and subsequently to his successor, Ayman al Zawahiri.

The oath of loyalty, known as bayah, is the princ.i.p.al mechanism of control in the al Qaeda network, adding a religious obligation to relationships that historically would rise and fall when the prevailing winds changed. Bayah is extended from leader to leader, not group to group, so when the players change, it must be renewed. A pledge offered must be accepted by the leader of al Qaeda before it is valid.

On paper, at least, al Qaeda itself is subordinate to Mullah Omar, leader of the Taliban, reportedly through a loyalty oath from bin Laden to Omar during the late 1990s, which was affirmed last year by al Qaeda's current leader, Ayman al-Zawahiri, and again in the summer of 2014, in a print publication attributed to al Qaeda.5 But the pledge to Mullah Omar was largely theater. It is difficult to point to any examples of al Qaeda following Omar's commands or directions, and relatively easy to find examples of its disobedience. Jihadi accounts of the relationship between al Qaeda and the Taliban describe a fractious mess entered into under protest.6 Under the emir of al Qaeda are the organization's official affiliates. As noted previously, the list includes al Qaeda in the Arabian Peninsula (AQAP, mostly in Yemen), al Qaeda in the Islamic Maghreb (AQIM, mostly in North Africa), al-Shabab (mainly in Somalia), the al Nusra Front (in Syria), and al Qaeda in the Indian Subcontinent, announced in 2014.

In February of 2014, Zawahiri disavowed ISIS, which was at the time considered an al Qaeda affiliate, although there is some dispute about whether its current emir, Baghdadi, ever swore the loyalty oath.7 The media latched on to the idea that ISIS was disavowed because it was "too extreme for al Qaeda." While it's true that al Qaeda saw ISIS as too extreme, it's more accurate to say Zawahiri fired ISIS for its public defiance of his wishes and commands.8 ISIS shed no tears over the separation. It was already functionally independent from al Qaeda in most respects, and the dismissal played into its long-term plan-the presumptive declaration of a new Islamic caliphate. Cut loose from its parent, ISIS moved forward with the declaration within short months. When the time came, it proclaimed that all previous loyalties were voided by the new development and demanded that jihadi groups around the world swear loyalty to Baghdadi.9 When the world's Muslim militants failed to drop to their knees, the online supporters of ISIS were baffled and disappointed.10 The realist leadership of the group probably knew that the announcement would not produce immediate breakthroughs, but it may have been disappointed at the volume of the first wave of rejection.11 Given how tightly ISIS has synchronized its media strategy, it was telling that the group could not arrange even a single high-profile pledge within the first week after the announcement. The controversial declaration was no fait accompli. And even as of this writing, none of the official al Qaeda affiliates had yet broken with the core.

But over time, the so-called caliphate began to draw concrete support.

Its first new const.i.tuents were small-timers, and most had thrown their support behind ISIS earlier in 2014, after the rift with al Qaeda became overt. Many of these new pledges were from malcontents within the AQ affiliates. Some individual fighters and small groups simply deserted the affiliates and joined ISIS in Iraq and Syria.12 Others declared the formation of breakaway groups. It was difficult to gauge the size of these splinters; most involved a handful of people who signed their names and purported to represent larger groups of followers.