The Islamic State of Iraq and al-Sham (ISIS) would not exist today were it not for its prolific and shrewd use of the internet and social media. Al-Qaeda would have likely died years ago, too, had its appeal not been kept alive by the same means. Without contesting extremist use of the internet, the United States and its allies will fail to defeat the Islamic State and to eliminate al-Qaeda, both of which are, let us remember, the stated goals of U.S. policy. Certainly, bombing ISIS without a broad and complementary political strategy will not work, and may even prove counterproductive in the long run by strengthening evidence for the radical Salafi narrative that all means of defense are justifiable since the West started a war with Islam.

Lacking infrastructure and the resources of a state, Islamist extremists use the web to redress strategic disadvantages in planning attacks, maintaining and financing their organizations, and recruiting and inspiring new affiliates. ISIS leaders and workers will likely rely on the web to maintain a global presence and reach, but also use it in creatively offensive ways that al-Qaeda never did.

There are three types of Salafi websites: official Islamic State and al-Qaeda websites; “wanna-be sites” (by groups that want to be recognized as aligned); and mirror sites (groups or individuals who merely re-post extremist content). Through the internet, these groups also maintain a somewhat organized command-and-control structure.

Given the heavy physical stress the United States and its allies have placed on al-Qaeda in particular since 2001, some argue that al-Qaeda leadership has since devolved into “only” a media organization that now practices terrorism only when it can get its depleted ways and means together. It is a “terrorism studio” today and not much else; it no longer attempts much strategic planning and plotting, or deploys facilitators, logisticians, operators, and execution managers. Once al-Qaeda lost its physical safe havens where it hid from U.S. harassment, it established virtual safe havens.

The Islamic State’s internet presence, however, is not residual and defensive in nature; it is increasingly sophisticated and effective. The Islamic State has established an internet sanctuary, perhaps learning from al-Qaeda’s experience. But it has added much more savvy operational security (OPSEC) to its communications, especially through social media. It has rejected al-Qaeda’s squeamishness about the murder of Muslims (not that al-Qaeda has not murdered a great many Muslims anyway) and made such murder the centerpiece of its online message. It seems to work for recruitment purposes; murder has become a form of performance art by which the Islamic State advances its brand.

Given that al-Qaeda and the Islamic State use cyberspace to attack us in the real world, it follows that cyberspace should constitute no special sanctuary for them. Yet for all practical purposes it does. Their presence in cyberspace is more or less uncontested, enabling the internet to serve well as a “drive-thru” radicalization asset. Anyone from anywhere can read the radical ideology of al-Qaeda and the Islamic State unmolested, getting their fill of pseudo-intellectual ideology and bomb-making instructions. The internet thus serves as a kind of on-ramp for those who then travel abroad for specific training or to make personal connections. Once in theater, the clever use of social media allows the Islamic State to use temporary email accounts, Twitter accounts, and hashtag re-postings to communicate crude operational commands.

The internet has become a key means for the Islamic State leadership to bring the ideological seeker and mentor together, and thus operationalize its forces via an infrastructure that the United States and its Western allies developed, financed, installed, and still maintain. It provides that sense of identity and belonging required for the disaffected and psychologically vulnerable to move to the stage of violence. In other words, the internet has become not just a jihadi mentor—a “virtual spiritual sanctioner” as it has been called—but also a virtual, globe-spanning minbar, the podium from which sermons in the mosque are delivered.¹ The internet provides jihadi support groups with a source of religious justification that characterizes and is required of all jihadi cells.² As a result, given that radicalization via online mentoring can move faster than mentoring in person, the use of the internet shortens the timeframe between the beginning of radicalization and the onset of terrorist activity.³ 

Online and OPSEC Savvy

The leadership of the Islamic State uses the internet, dedicated websites, and social media such as YouTube, Twitter, and Facebook to propagate its ideology, history, impressive recruitment record, and claims of battlefield success. It can do this because there is an audience. There are almost three million Facebook members in Iraq, more than one million in Syria; 10,000 Twitter users in Iraq, 8,000 in Syria. The Islamic State has more than 50,000 Twitter followers.⁴ Many of these consumers knew how to read al-Qaeda online, and now have transferred over to the “strong horse”, the radical organization that now leads the pack. Through social media the Islamic State leadership proclaims to the world explicitly that it is the successor to Osama bin Laden’s legacy and is fulfilling the original goal of establishing a caliphate.⁵ 

According to the cybersecurity company Zerofox, not only has the Islamic State built an online propaganda strategy using many social media networks; it also employs experts in marketing, public relations, and visual-content production with a sophistication far surpassing al-Qaeda.⁶ For example, ISIS activists will use a trending hashtag as a means of infiltrating conversations by adding that hashtag to one of their unrelated tweets. They also mass-tweet using their own designated hashtags, which gets them to trend. In addition, ISIS has created its own app, an Arabic-language Twitter app called “The Dawn of Glad Tidings” (or just “Dawn”). When users sign up, they give ISIS permission to send tweets through their own personal accounts. This allows ISIS tweets to reach hundreds or thousands more accounts, giving the perception that its content is bigger and more popular than it is. The Dawn app is used as an education tool, distributing news and information about ISIS to its users.

ISIS also uses networks of computers it has infiltrated (“bots”) to carry out its campaigns via remote control, rendering the individuals behind the activities unidentifiable. Because these bot armies are so widespread and continually regenerate accounts, the group is always one step ahead of governments and social media networks attempting to thwart its maneuvers. ISIS also distributes propaganda specifically designed to target a Western audience, for instance by using hashtags they know the Western world is searching for—like #worldcup2014 #fifaworldcup—for the purposes of recruitment or inciting fear. In addition to promoting information about itself, ISIS also educates its social media followers on how to access information blocked by governments and social media sites through TOR/anonymizer tutorials.

Quite aside from their technical prowess, those who labor for the Islamic State also produce attractive and effective content. They produce high-quality video, which chronicles the group’s alleged historical success and records its violence, including executions, beheadings, and attacks, to intimidate opponents and the regimes it aspires to topple. It blends recent history, such as its supposed success against U.S. occupation forces in post-Ba‘athi Iraq, with historical allusions to the great apocalyptic Sunni struggles against opponents of Islam, implying to would-be recruits that now is the time to join the great, successful Islamic State struggle. ISIS workers have also reportedly created recruitment propaganda using video game formats.

So much for the internet being an ineffective base of operations for offensive maneuvers. As for defense, the Islamic State leadership practices online operational security to stay anonymous and advises online readers on how to enhance their anonymity as well. It also uses temporary accounts, changes accounts periodically, and uses TOR to mask IPs, making the Islamic State’s communications largely dark, hard to track or target, and resilient.

The State’s self-proclaimed leader, Abu Bakr al-Baghdadi, and his followers have proven exceptionally difficult to track because they reportedly encrypt their communications and take steps to avoid being detected by enemy surveillance. Islamic State leaders also likely use FireChat, a commercially available service that permanently deletes messages sent via the internet, making them nearly impossible to intercept.⁷ Finally in this regard, Islamic State operators study Western media carefully, including the history of successful Western counterterrorism operations against al-Qaeda. They do this to learn how to protect their work and their masters from similar attacks in the future.

By maintaining multiple official and non-official accounts, Islamic State cyber-operators promote the ISIS brand and message, solicit funds, recruit followers, and maintain a crude organizational structure. Although such use is contrary to Twitter policy, the geometric propagation of messages via use of hashtags with links to advance perishable messages and images has allowed the Islamic State to maintain a resilient and disposable communications structure to connect with supporters even if accounts are subsequently shut down by Western or local internet service providers. Through decentralization, it has largely secured its communications from the traditional warfare techniques of jamming or interception. In a sense, it has crowd-sourced its communications.

All Islamic State web media productions fall under the umbrella of Al-Furqan Media, while another media organization associated with ISIS, Fursan Al-Balagh Media, works on video transcriptions, giving viewers the chance to both read and watch all productions.⁸ And whether by accident or design, Islamic State operators have created a new form of operational command and control: C2 via app.

Thousands of Twitter followers have downloaded a Twitter app—the aforementioned Dawn of Glad Tidings—through which users give permission to receive Islamic State messages, images of military success, and video feeds, affording the Islamic State a Hollywood-quality feel.⁹ The application, flagged by Twitter as “potentially harmful”, requests user data and personal information.¹⁰ After downloading it, the app sends news and updates on ISIS operations in Syria and Iraq. Islamic State cadres include selected individuals who are expert at Adobe and video production. Each Islamic State region has its own dedicated social media accounts and supporters worldwide provide further channels through which to get its message to Western media.¹¹

In addition to official Islamic State social media accounts, hundreds of Islamic State sympathizers use private accounts to connect to thousands of internet followers. Islamic State media products are thus tweeted and then its hashtags re-tweeted by “private” supporters, enablers, and voyeurs, using the power of social media to project an image beyond its true capability, creating what is now-known as a “Twitter storm.”¹² Imagery, slogans, and would-be success stories are all crowd-sourced, allowing quality production to rise to the top through the power of social media. It is equivalent to allowing individual experts in Hollywood, Silicon Valley, and beyond to advance a positive image of America independently of any government oversight or direction.

Examples of these tactics illustrate the cleverness of ISIS media operations, which have propelled the Islamic State far beyond al-Qaeda-afffiliated groups in the effectiveness of their information operations:

• One Islamic State supporter tweeted during the 2014 World Cup, ‘This is our ball,’ along with a photo of a decapitated head and the #WorldCup hashtag, which ensured that it would pop up on news feeds on the World Cup.¹³
• On July 4, 2014, Abu Bakr al-Baghdadi appeared unexpectedly on social media to give a sermon that was pre-posted via Twitter (before his video was uploaded onto YouTube) to guarantee its dissemination.¹⁴
• A video series named ‘Mujatweets’ shows the life of Muslims in the Islamic State and testimonials from Western militants reporting their alleged commitment to the new Islamic State.¹⁵
• The ISN (Islamic State News), a new, online Islamic State publication in English, provides news, information, and inspirational stories to readers worldwide (including, of course, the Western media).
• Launched in May 2014, a new Islamic State media branch, Al-Hayat Media, distributes materials in several languages, including video with subtitles, as well as articles, news reports, and translated jihadi materials. Its main Twitter account is in German, but it also publishes in English and French, as well as Turkish, Dutch, Indonesian, and Russian. Al-Hayat Media’s videos and materials are also distributed via Archive.org and other free web-hosting services; they are also regularly listed on justepaste.it, a web service for sharing free user-created contents, as well as on lesser-known social media such as Quitter and diaspora.¹⁶
• On July 8, 2014, The ISR (Islamic State Report), also known as “An Insight Into the Islamic State”, which contains articles on Islamic State events, first began to release its showcase online magazine, Dabiq, consisting of detailed, well-written stories in fluent English. It resembles the well-known but cruder English-language magazine, Inspire, published by al-Qaeda in the Arabian Peninsula, famous for providing bombing-making instructions (in slightly broken English) to aspiring terrorists worldwide.¹⁷ Dabiq is named after the area Halab (Aleppo) in Sham (Syria), mentioned in the hadith as the place for Malahim (“Armageddon”)—an allusion to the site of a major 16^th-century battle where the Ottomans defeated their enemies and established their first caliphate.¹⁸

In short, the Islamic State’s information operations are slick, de-centralized, and resilient, designed to withstand private-sector account cancellations for violations of terms of service. They have propelled the Islamic State to the forefront of terrorist information-operations success. Today, the Islamic State, al-Qaeda, and al-Qaeda affiliates use media services to upload pleas for readers to conduct local and worldwide terrorism, manuals on how to create improvised explosive devices, invitations to join the fight in the Middle East, and claims of success and ideological purity. Someday they may also disseminate cyber weapons via the web, should they acquire or devise them. The odds they will are high unless they are stopped beforehand.

Going on Cyber Offense

At the moment, the web presence of Islamist extremists is a sort of “gateway drug” into the cyber world. If the United States and its allies do not address it now, they may have to accept extremist cyber activity of increasing breadth and sophistication, with greater cyberspace consequences. Terrorist use of cyberspace also works to internationalize the Islamist fight. In a sense, the “cyber jihad” world is flat, connecting individuals worldwide who might not otherwise have been connected.

If Islamist extremists turn their attention to disruption and destruction through the web, they are likely to conduct distributed denial of service (DDOS) attacks and threaten the controls for electric power grids, oil pipelines, and water systems. Should social media accounts become useful for disseminating cyber weapons, Islamists would gain additional capacity.

Threat is a function of expertise and access. Fortunately, the Islamic State’s cyber expertise overall is low, as is its access to high-quality advice or tutelage. But unlike with the development of WMD, both expertise in and access to cyber capabilities can change overnight, particularly should a capable revisionist state or individual decide to assist the Islamic State. With WMD, a research-and-development phase exists during which U.S. and other intelligence services can discern, evaluate, and plan accordingly. With cyber weapons, space, time, and geography offer up no comparable advantages. Delivery methods for cyber weapons are much easier to devise and disseminate, and have little to no lead-time (no lengthy research and development phase). In short, the targets would likely not see it coming.

There is reason for concern. A 2013 edition of Inspire called upon jihadists to burn parked cars, make oil slicks to cause car accidents, and puncture tires with nails hammered into blocks of wood. It used to be that al-Qaeda wanted a spectacular follow-on attack to 9/11 and desired to take on the West as a whole. It did not want just any attack; it wanted a good one. Today, al-Qaeda affiliates seem to be calling for any attack, even those as comparatively minor as an individual picking up an AK-47 or using a private vehicle to run over people. The Islamic State’s online magazine, Dabiq, has called for its supporters living in Western countries to rise up individually and attack law enforcement and government officials. It seems to have abandoned the long-sought “spectacular” follow-up to 9/11. It is reasonable to think al-Qaeda’s attitude toward cyber weapons may change too.

Should just the right expert hacker join the Islamic State or al-Qaeda, whether for money or out of sympathy, either group could move overnight from a cyber nuisance to a serious cyber power. It is not inconceivable that rivals to the United States, Israel, or the cultural West in general such as Iran might provide such cyber weapons to al-Qaeda, or even to its enemy the Islamic State. Tehran might do so as a means to fight the United States asymmetrically, divert U.S. attention from its nuclear weapons program or its support for Shi‘a terrorists worldwide, or simply create a deeply distracting economic drain for the United States.

Further, the forensic attribution problem for the United States and its allies, should a cyber weapon be used against it, would be horrendous. The cyber weapon might appear to be Russian- or Chinese- or Iranian-made if its code were originally written in one of those countries, but that will not mean the weapon was delivered by that state. Regardless of whether al-Qaeda or the Islamic State took credit for the attack, the United States might be confused as to who created such a cyber weapon, who sent it and why, and how to defend against a repeat attack.

So far, the Islamic State has not been too interested in cyber weapons for three probable reasons: cyber weapons are not spectacular enough in their destruction (messing with websites and infrastructure is not as powerful an image as a beheading video); it lacks the technical ability to create such weapons; and “cyber jihad 2.0” has served it well thus far. Despite some setbacks, the Islamic State is currently flushed with success—why change anything?

One of those successes is of a particularly unusual and alarming nature. Most Islamic State supporters today were teenagers when 9/11 occurred and are children of the internet and social media. Their radicalization is very recent; it is a post-bin Laden phenomenon. Their motivation for joining the Islamic State has more to do with the dynamics of a social network that provides direction, identity, and excitement than it does with religious understanding. The Islamic State dangles the opportunity to join something new and exciting in front of bored and disaffected teens.¹⁹ This social media strategy is aimed purposefully at youth worldwide. How does this work?

Islamic State videos take the traditional Western narrative, that Islamist extremists kill Muslims and are wanton, heretical murderers, and stand it on its head. It has made images of murder the centerpiece of its new message. Its production quality is so good that it has spawned the term “jihadi cool.” Whereas al-Qaeda produced rather flat websites that merely posted radical content (“cyber jihad 1.0”), the Islamic State produces videos and online magazines that are on par in quality, editing, and message delivery with current Western media. It practices “cyber jihad 2.0” at the least through its production quality and cutting-edge use of social media. It keeps pace with advances in Western media production, aided, no doubt, by the many Western supporters it has managed to attract. Its video production, in particular, is constantly uploaded, taken down but then uploaded again to numerous video sites so that it ultimately reaches its intended audience.²⁰

Islamic State videos proclaim righteous victory over the Shi‘a and other so-called non-believers, about which there is nothing unusual or unexpected. But it showcases acts of brutality, a new phenomenon that Western analysts ignore at all our peril. ISIS professionals have managed to frame brutality in such a way that it engenders pride and a sense of inclusion, rather than revulsion.

It does not occur to most normal adults in Western countries how this can work. We do not readily understand why a first- or second-generation Muslim living in London, or Amsterdam, or Marseilles, or Toronto would want to leave a typical middle-class life to go wallow in blood in the middle of the Syrian desert. Until we do come to understand this, and understand why some such people are attracted by the opportunity to do unspeakably brutal things to total strangers, we will never defeat the Islamic State.

What to Do

To repeat, the strategic goal of the U.S. government is to defeat al-Qaeda and the Islamic State. To do so, the United States must shut down the insidious messages of its jihadi enemies and contest their presence on the internet. Counter-Islamist efforts, therefore, must make it a priority to shut down its militant websites and social media.

Well-meaning professionals argue that these websites and social media outlets serve as the means to identify, monitor, and assess jihadi groups and their sympathizers. But the argument that the intelligence loss would outweigh the gain of contesting these sites misunderstands the end goal: denying the enemy’s ability to recruit, support operations, pass weapons information and formulae, and promote extremist ideology that encourages terrorism. The point is to end the threat, not write reports about it.

Shutting down these resources is technically feasible for internet service providers, host nations, allies, and all those who oppose al-Qaeda’s and the Islamic State’s message of violence on the internet. The assumption among much of the media, punditry, intelligence, and defense communities that contesting al-Qaeda and the Islamic State online is somehow technically challenging is wrong. Although jihadi web administrators can pop up new sites quickly, the U.S. Department of Defense, other U.S. government, allied, and host-nation elements can just as quickly shut them down. And should the competition between al-Qaeda or the Islamic State on the one side and the United States and its allies on the other devolve into a “Whac-A-Mole” game, such a result would be overwhelmingly to our advantage, given how viewership would drop precipitously if forum members had to try to re-acquire al-Qaeda or Islamic State sites day in and day out. The vast majority of viewers and members would quickly give up.

Further, it is a myth that extremist websites come back quickly, if contested. In the past, when ISPs or host countries contested some websites, many never came back at all. And those that do come back often return in a diminished manner, with far fewer members and more limited exposure. And since most militant sites merely post content from the top extremist sites, should the top sites go down the smaller sites will be starved of content (and non-militant content may enjoy greater readership). Al-Qaeda and the Islamic State are increasingly dependent on a coherent and clear message conveyed through the internet. If they are perceived as weak or inept at delivering that message (or can’t deliver it at all), their appeal will falter.

There are several other secondary, but important, aspects to contesting the extremist message on the internet. Interfering with extremist websites and social media stimulates communications and useful chatter (‘hey, what’s going on?’) for intelligence collection. As suggested above, curtailing the aggregate number of extremist websites allows more moderate Muslim voices to be heard among the discussion groups and above the din of the militant ones. Contesting such websites forces extremist groups to expend valuable time, resources, infrastructure, and technical expertise to compete with these other sources. Challenging the al-Qaeda/Islamic State internet presence is not technically difficult for host nations, allies, and the United States. (We simply choose not to do so for political reasons or because of the myth that such actions would be futile.)

Some will cry “censorship” at the suggestion that Western governments shut down the jihadi web presence, but confronting websites that advocate violence does not undermine internet freedom. We can and do distinguish between speech that advocates violence and protected speech. Furthermore, confronting ISPs that host content that violates their own terms of use does not undermine any right or law.

The Fifth Domain of Warfare, so called by the Department of Defense, is here, like it or not. Cyber attacks can amount in their significance to armed attacks, subject to international humanitarian law and the rules of war, according to the U.S. State Department’s Legal Advisor. What is unique about this domain is the fact that Islamist extremist activity on the web takes place every day. It is a war without timeouts or truces.

What is also unique about this domain is that the private sector more or less owns most of this infrastructure. The Islamic State exists in the cyber domain and specifically in social media. Unless we demand that social media companies cleanse themselves of violent extremist content, we will need to get used to the fact that our own counterterrorism cyber forces will be forced to fight in this media as well. Few of us want to go there, given the hornet’s nest of constitutional issues that will arise from it. But we may have no choice.

No counter-Islamic State strategy that ignores its use of the internet and social media will succeed. No military strategy or comprehensive whole-of-government approach can really be whole without addressing the Islamic State’s use of the internet. All warfare today includes the new Fifth Domain, and the sooner we recognize its importance to our adversaries, the sooner we will begin to address the threat seriously.