Analysis: Massive cull of Islamic State accounts on Telegram disrupts propaganda
BBC MONITORING
Date; November 23, 2019
A massive purge of pro-Islamic State (IS) accounts, channels and groups on the messaging app Telegram has resulted in serious disruption to the group's propaganda distribution.
Europol claimed credit for the action in a press release on 22 November which said "a significant portion of key actors within the IS network on Telegram" had been "pushed away from the platform" as a result of a concentrated day of action during which terrorist content had been referred to Telegram and other online platforms.
The statement gave no statistics for the action, but Telegram itself said 2,096 "terrorist accounts and bots" had been taken down on 22 November, accounting for almost a quarter of the takedowns to date this month.
That number was lower than a similar spike in takedowns around a year ago when 3,276 accounts and bots were disabled in a single day on 6 December 2018, according to Telegram's statistics. (Europol did not claim to have been involved in that action.)
Europol previously claimed to have compromised IS's propaganda distribution capability during another coordinated day of action in April 2018.
But the impact of the disruption appeared to be far greater this time than either the April or December 2018 events, heavily targeting the distribution network of the IS-affiliated Nashir News Agency which publishes the group's official propaganda.
Propaganda disrupted
Dozens of mirror channels and groups operated by Nashir News Agency which were available to BBC Monitoring stopped distributing IS content overnight 21-22 November as their administrators' accounts had been deleted.
A small number of distribution channels survived the cull. They quickly advertised a series of accounts which people were invited to contact to obtain links to new Nashir News Agency channels.
New channels then continued posting official IS propaganda on 22 and 23 November, although several were later observed to have been deleted.
Caliphate News 24, another outlet for official propaganda, has also been rebuilding its network after suffering significant disruption.
While the flow of media output had not been significantly interrupted at the time of writing, the disruption has severely restricted its accessibility and left IS supporters scrambling to try to rebuild their networks.
Europol's press release said its "referral action day" had been focused on 21-22 November. But IS supporters voiced concern that the action was continuing on 23 November and it was unclear at the time of writing whether the intensity of the action would be kept up.
When Telegram ramped up its action against IS accounts in December 2018, the intensity was not sustained and the disruption quickly returned to relatively manageable levels for IS supporters and media operatives.
There has been relatively little talk of abandoning Telegram in favour of other platforms in the wake of the disruption, with most of the discussion focusing on how IS supporters could prolong their presence on Telegram.
However, one security-focused pro-IS media group, Qimam Electronic Foundation, advised administrators of IS support groups to set up accounts on the decentralised communication tool RocketChat where IS supporters launched their own server in the wake of the 2018 Telegram disruption.
Another pro-IS support group also advertised its RocketChat presence, but Nashir News Agency and other distributors of official IS propaganda have not promoted the platform recently. Nashir News Agency has not posted anything on RocketChat since 5 November.
Administrators behind the pro-IS instance of RocketChat produced a graphic on 23 November warning against using Telegram.
It accused Telegram of "partnering" with Europol, highlighting an excerpt from the Europol statement which said that over the past 18 months Telegram had "put forth considerable effort to root out the abusers of the platform by both bolstering its technical capacity in countering malicious content and by establishing a close partnership with Europol".
The RocketChat graphic said Telegram had "probably just provided Europol with data on every account they deleted" and asked "why does anyone still use Telegram?". It also took the opportunity to advertise the registration link to sign up to the pro-IS instance of RocketChat.
While there has been some discussion of the Telegram disruption on RocketChat, activity there remains very low.
Other IS supporters were also observed to promote the decentralised social network Riot, which jihadists have experimented with in the past, arguing that an alternative to Telegram was now required.
Heading underground
In a more cryptic message, the pro-IS media group Quraysh warned Telegram that its takedown campaign would backfire. It said it would "complicate the situation, the 'Ansar' [supporters] will spread everywhere, the goal will become hidden, and it will spread the thought secretly".
Qimam Electronic Foundation also advised the administrators of pro-IS media groups to use alternative communication methods, advocating the privacy-focused messaging app Conversations, which has previously been recommended by IS itself and other security-focused pro-IS groups.
Conversations is based on the XMPP messaging protocol which enables users to set up accounts on their own XMPP server in order to safeguard their data or choose from a range of third-party servers, all of which are interoperable.
IS support groups respond
In addition to the disruption to IS propaganda distribution networks, IS support groups on Telegram were also affected.
They responded by attempting to regenerate their networks, setting up multiple new groups and channels on the platform on 22 and 23 November. Many of these were quickly disabled.
Some offered advice on how to avoid accounts being shut down. Common recommendations included using new phone numbers to set up accounts, avoiding using pro-IS usernames and avatars and using different Telegram accounts for setting up channels, for communication and for distributing propaganda.
A pro-IS media group calling itself the Centre for Emerging Strategic Research concluded that Telegram was now using automated processes for identifying IS content and advised supporters to temporarily stop posting content that could be easily identified in order to allow them to regroup.
It suggested a new strategy for propaganda distribution would be worked out in the coming days, but gave no details.
Others suggested that the disruption was being exploited to entrap IS supporters.
Longstanding security-focused pro-IS group Electronic Horizons Foundation specifically warned that a fake Telegram account had been set up in its name with the aim of luring IS supporters into downloading malware.
It also warned against using the pastethis.to file sharing website, alleging that the site administrator was conspiring against the group.
Comments
Post a Comment