ISIS/ISIL/Daesh – The Islamic State’s Social Media Network & How to Defeat it

This report was funded by the United States Department of State and the Administrator of the project was NATO STRATCOM Center of Excellence. The full report was originally published by NATO STRATCOM. The paper is available on Researchgate here:  https://www.researchgate.net/publication/349393983_Network_of_Terror_How_DAESH_Uses_Adaptive_Social_Networks_to_Spread_its_Message

Project Background

In 2015, I was asked to work with NATO STRATCOM COE in Riga, Latvia on behalf of the US and the State Department to build a foundation for understanding the Islamic State of Iraq and Syria’s (ISIS, but they’re also known as ISIL which is the Islamic State of Iraq and the Levant, and also known as DAASH/DAESH which is a derogatory Arabic acronym for ISIS – Al-Dawla Al-Islami’ya Fe Al-Iraq Wal Sham) methods of sharing propaganda and recruiting online.

My colleagues at NATO and the center were very gracious to allow me intellectual and creative freedom on where to go within the research effort, and how to frame the project itself. I shine best when I have a little bit more freedom to pursue the more interesting questions using the most interesting methods.

The result of the project was a 25-60 page report (depending in which version you had), a large amount of data released to the public, and the dissemination of my findings at the Perception Matters NATO conference last August. The conference was attended by a number of senior cabinet members of all the Baltic states, hundreds of military officers from across the US and Europe, representatives from civilian agencies such as the US State Department and media organizations, and Senator John McCain (R-Arizona).

I resisted, to the largest extent possible, any classification of my research to ensure delivery to the hundreds of organizations across the world who are actively combating extremism, terrorism, and propaganda online. I felt that an unclassified project could be published and shared openly and any entity that seeks that knowledge would therefore use it for their own purposes. There are risks however.  Also, as a civilian I enjoy feedback and discussions about my research and work projects because it helps me improve the quality of future projects.

Part of this process was to publish this blog/article which would try to simplify the methods and results of my research for those without data analysis and technical experience. This would make a quick reading and then you can either download the full report from the Knowledge Store, or you can also watch the presentation on my YouTube channel to get a better understanding of it.

As always you are more than welcome to email me, comment below, and or contact me on social media for questions, comments or general feedback – or to suggest similar research that I can leverage in the future.

Project Summary

The project’s focus was gather data, analyze, and deliver insights into the methodologies adopted by ISIS to broadcast, radicalize and ultimately recruit on social media. It was also to suggest some effective process by which their efforts can be thwarted and their message debunked.

I began by identifying where their influence online (on public access channels) seems to be dominant – and to understand their impact. Unfortunately, the ultimate measure for understanding their impact would be to have final recruitment data from all countries where ISIS hash successfully recruited followers, but that information is usually classified and is rarely shared with the public. That kind of information is also not readily available at the strategic level of organizations such as the UN and NATO unless there was an imminent need for it – even then that information would likely be constricted as well. So, my only option was to make the assumption that ISIS’s impact online has some linear relationship with their ability to disseminate information and propaganda widely. In other words, the more they put out their message, the more followers they would be able to attract. It’s generally a reasonable assumption, but depending on the rate and form of radicalization the assumption could potentially be very weak – because the core part of that assumption is that their message is or can be accepted by a wide mainstream audience – which there is little if no evidence to support.

I determined that it would be safe to conclude that their impact on social media had significance from looking at the volume of activity where public access to data was not restricted, as well as used anecdotal evidence to support that claim. I also then found that ISIS uses Twitter as a kind of umbrella medium for information dissemination. The medium gives them access to a wide audience, and Twitter is itself very flexible with account mechanics (creation, deletion, modification). Also, the hashtag system allows a group like ISIS to share information to an audience who would otherwise never have sought it themselves.

Once it was clear that Twitter was the place to focus on studying the terror network, I planned to conduct some surface/preliminary analysis, combined with some in-depth network analysis of the network. I began by conducting a simple keyword frequency analysis of ISIS-produced content, but forgoed a full semantic and/or sentiment analysis primarily because my interest was not in the content itself per se, but in the structure and method of dissemination. I then identified a number of high frequency high activity ISIS propaganda accounts, and studies the links that were shared in their tweets and messages. I finalized my analysis through the collection of a number of traffic (tweet) network samples sized somewhere between 500-2000 tweets each, and then collected 3 friend/follow network of about 150,000 – 175,000 using seed accounts from the previous traffic network analysis.

Below I’ll take you through the analysis step by step in as a simple way as I can make it. But, as always, if you have questions, you are more than welcome to comment below, or to contact me.

Executive Summary of Results

• Popular social media platforms such as, and especially, Twitter, forms the core of ISIS’s propaganda and information dissemination efforts. They use these mediums as the core of a web of content that is spread in many parts of the ungoverned internet.
• ISIS (perhaps unknowingly) uses and an adaptive network structure on Twitter to combat outside influences and to react to external operations seeking to curb their operations. This network adapts at high speed and with limited central organization.
• ISIS makes innovative use of platform vulnerabilities that allows them to evade detection, suspension and deletion by state and non-state actors through both automated and manual methods of detection.
• ISIS has amassed a strong following supported by an internal dedicated human infrastructure allowing them to affect a substantial impact on the information environment.
• Through the use of a core-periphery network structure and a high number of network-central actors ISIS created a redundancy factor that can withstand repeated efforts to disrupt their information supply chain.
• Through the use of account inflation, signaling, and closure methods, ISIS has been able to successfully create friend/follow networks that feed into their ability to build sustainable adaptive networks, evade detection, and maintain their level of online activity.
• ISIS has built a network structure that utilizes the flexibility of small communal networks while allowing for the large scale interactions commonly associated with large diverse-use networks. This adds to the challenge of combating them in the traditional information warfare environment.
• I create an explanatory process to simplify the reader’s understanding of the group’s usage of social media. I call it the DEER Process. The DEER process begins with dissemination and ends with replenishment. We recommend this model as a way to build more effective strategies in combating the group.

The Centrality of Twitter to the Islamic State’s Operations

As I briefly mentioned, my analysis focused on ISIS’s use of Twitter for several reasons. Primarily, ISIS uses Twitter to disseminate information to those who would not have otherwise sought it. Twitter is a medium that is diverse in its demographics, global in its reach, easy to use, and is much more suited for anonymous and yet open-while-encrypted communications that any subversive entity requires in order to conduct detrimental propaganda operations.

Additionally, because Twitter allows for the posting of unrestricted content as long as it is linked to an outside source, it makes for an effective tool of information warfare, and a uniquely supportive tool for hybrid operations.

Therefore, I was not surprised to find that in our analysis ISIS tended to prefer Twitter as a connecting medium for all of its distributed content all over the web.

“Influence on social media today equals recruits tomorrow.”

To illustrate further, consider that ISIS utilizes a number of uncontrolled, unsupervised sites to post videos, photos, messages, and press releases all of which reaches supporters who had pre-existing knowledge of the locations of those messages, but that for recruitment and media efforts to be successful ISIS had to share these content suppositories on public domains and information stream such as Twitter. Failing to do so means that they would generate high volumes of high production value content which no one ever sees.

And although they somewhat diversify by integrating the use of Twitter, Facebook, Snapchat and other mediums, Twitter is preferred because it allows for faster recovery from suspended accounts, possesses stronger encryption for private messaging (point-to-point communication) and a much broader audience. That way they can keep operations active in spite of counter-operations.

Amplification, Replenishment, Inflation

Additionally, and as you will see in subsequent sections, ISIS engages in replenishment of its deleted and suspended accounts as a matter of due course. Twitter is a platform which allows for recreation of a user’s pre-existing network much more effectively than other social media services.

ISIS’s choice of Twitter as a medium represents strategic insight into the operational environment for information warfare. It is not by accident.

Through the use of Twitter, ISIS is able to amplify both its own perceived size and potency as well as its message across time and geographic space. This is apparent in its ability to recruit much more successfully than their competitors and counterparts who may follow similar ideologies, claim to have as many operatives on the ground, but do not come close to achieving the level of success that ISIS has in recruiting native westerners to their cause.

This is perhaps the most important factor anyone should consider—influence on social media today equals recruits tomorrow. This fact alone is unavoidable, and will change the dynamics of every battle fought this century. ISIS is simply the first to truly capitalize on this dangerous dynamic, and Twitter is simply the world’s most open and useful platform for their messages right now.

In fact, given enough and the right kind of data we could infer the total number of future recruits ISIS gathers from platforms such as Twitter, and from that, combined with force projection estimates, we could estimate the total number of fighters on the ground, some of their attributes (age, gender, level of education etc.), and thus provide limited predictions on potential tactics and strategies employed.

Moreover, ISIS’s use of Twitter also means that it can conduct recruitment and propaganda operations from any location in the world, and without having to make any investments in infrastructure, technology, or a dedicated workforce. And since Twitter provides more complexity to communication analysis than any other medium, discerning grand strategy from their behaviors is a task currently too demanding for any single agency or entity—be it governmental or non-state—to undertake alone.

Environmental Scan – Impact & Structure

The report published by NATO STRATCOM COE or in the Knowledge Store contains a lot more information about the environmental scan I conducted, as well as very specific information about impact and structure. Here I summarize that section since I’m not sure I want this piece to be super long.

The Islamic State of Iraq and the Levant (ISIL) releases content on a daily basis in several languages including English, Arabic, German, Farsi, Hindi, and French. They use professional press release style imagery and graphics. They also release professionally created and edited videos for which they have become notorious since their inception (which is much earlier than most people believe but that’s a whole other topic).

There are many important features to consider when it comes to ISIL/ISIS propaganda but I would argue that one of the most important to date is the inclusion of ingredients aimed at attracting a young demographic who are more likely be technology savvy and more likely to respond to Hollywood-style imagery and concepts. New recruits can then be brought into ongoing information operations bringing with them lessons learned and suggestions from previous media cycles. Think about the economic concepts of creative destruction to understand ISIL’s media and recruitment cycle to get a good sense of it.

In summary, the structure of the content follows familiar patterns commonly associated with corporate social media marketing programs.

• Relevant to current news and thematic public discourse
• Short in length (in contrast with Al Qaeda propaganda which typically tends to be long tirades by Al Qaeda leaders)
• Makes strong use of Islamic music/chants (where appropriate) and sound effects
• Makes strong use of high quality and high-definition video editing and recording
• Tends to follow some larger narrative thus makes for engaging consumption by target audience
• Simple and easy to digest.
• Diverse in its content types (action/battles, normal life, political, and religious).

I also spent some time analyzing the volume of content shared on Twitter expecting to gain a fundamental understanding of the dominating trends of ISIS’s activities.

During a 30 day period I studied and subsequently identified, measured keywords (hashtags) used on Twitter which were commonly associated with ISIS members, operatives and supporters, and keywords that were almost always being used by their opponents. All analysis for this mode were conducted in the Arabic language.

I discovered that during this 30-day period there were a total of 147,412 tweets using the hashtag “The Islamic State”, and 443,336 using the hashtag “The (State of) Caliphate” for a total of almost 700,000 tweets.

Now those are keywords which are typically used to

I also discovered that in that same 30-day period “Daesh” was used in almost 1.4 Million tweets roughly double the tweet activity of ISIS supporters and members who used the keywords above. A qualitative sampling of the tweets supports my assumption that generally, ISIS opponents preferred the used of the word “Daesh” rather than describing them as Islamic State or any variation thereof.

Check the report for my analysis on keywords and geo-tagging, and for a section on semantic analysis as well as the daily volumes of tweets measures..

Twitter Traffic Networks

I then spent some time collecting a number of tweet populations, their accounts and an extensive amount of their meta-data or network attributes to be more specific. The data collecting was also conducted  during a 30-day study and included data points such as account name, account URL, number of tweets, location (if available), the description (bio) provided by the user on the account, time zone, the date the account was created, the number of followers and the number of people followed, with the number of times each account tweeted or designated a favorite tweet.

The most important data point we collected from the populations in questions was whether each tweet was retweeted or replied to and by whom. That way I can put the traffic network together. Remember, the goal was to understand the structure of propaganda dissemination – how the information spreads.

Network Structure (Topology)

I also diluted this section so download the report if you want more information but once again let me summarize:

The ISIS Twitter traffic network takes the position of a Core-Periphery structure, with some groups forming where 76% of traffic network members belonging to the core group. This means that though message dissemination may become decentralized as it propagates through social media networks, around Hashtag communication hubs, messages are centrally driven by a core group of accounts. This result contrasts the generally accepted assumption that ISIS social media networks are entirely decentralized but rather supports a hypothesis that there is some decentralization/centralization mix at the account level. But I think it’s important to know that decentralization of message and message propagation are two entirely different concepts.

It is true that due to the current structure of ISIS’s organization, each regional theater of war (e.g. Libya, Sinai, Syria, Iraq, Somalia etc.) manages their own media efforts, and with it, content and method of broadcasting. This may provide for the argument that ISIS propaganda is decentralized regionally, but in terms of levels of activity on Twitter and general social media, regional media centers pale in comparison with ISIS-core. This means that we can conclude that although decentralization in content and broadcasting methods does exist because of regional differences in goals and capabilities, differences in language, or perhaps even regional strategic goals, media messages are essentially almost completely dominated by a small group of ISIS-core accounts. Many of those accounts could very well belong to an even smaller group of ISIS operative if you assume account inflation—a reactionary measure ISIS has continued to engage in to inflate their online presence and counter account suspension activities.

This is indicative of the difficulty of countering the information supply chain through suspending or removing accounts that appear to be part of the core of the traffic network.  If one or more core accounts is removed, there may exist a number of other core accounts (sometimes simply additional accounts created by the same user) which can continue to drive the message to its intended audience. Meanwhile, ISIS operatives incrementally develop countermeasures, as well as widely share lessons learned to improve standard operating procedures for evading detection by governmental and Twitter authorities.

Traffic Network Centrality

Centrality measures the extent to which an account is central to the functioning of a network and thus critical to a network’s infrastructure and overall performance. In the domain of traffic networks, centrality represents a proxy measure for influence and driving the message to its intended audience.

In looking at the centrality scores I discovered that for each traffic network sample there were a high number of accounts with low centrality measures (peripheral), and only a few accounts with high centrality scores (core group). Central actors typically had their distributed content retweeted more often than others, and they also retweeted content more frequently and from more diverse sources in the network thereby becoming more central to information propagation.

Typically, centrality scores of the network provided emphasis on a small group of accounts ranging from 2 to 25 accounts in any daily sample (daily samples typically included 1500-3000 tweets with a few hundred accounts engaged). And though centrality scores can be seen as arbitrary without proper and universal ranking (which went beyond time and technical resources available for this research,) I found typical network behavior in that a small group of accounts were almost always much more central than the entire traffic network combined.

We also found that on a regular basis, as accounts became more visible by holding a central position in the network that they were, within a short period of time, suspended by Twitter authorities.

In the report I discuss centrality of the accounts at length.

Friend/Follow Networks (Backcloth Networks)

In order to gain a better understanding of the full life-cycle of Twitter accounts used for propaganda dissemination, I also conducted a friend/follow network analysis. Friend/follow networks are the networks formed through users of Twitter following other users. This allows followers to receive public and private messages even if the followed account did not use any specific hashtags.

The structure formed by these networks shows patterns very important to understanding influence and public messages sent and received by and to individuals who do not engage in public hashtag discussions. In my 30-day period of analysis I collected two separate sample networks. The first included 167,000 accounts covering 336,000 follow relations, and the second contains 159,000 accounts covering roughly half a million follow relations.

In order to manage time and resources and avoid scope creep my intended target was to focus only on understanding community, clustering, and clique development/ progression.

I analyzed a number of standard community network measures. I used known ISIS Twitter accounts as seeds and collected their followed and follower accounts and several other iterations of followed and follower accounts yielding the aforementioned networks. I found friend/follow networks developing in clear and distinct communities, the majority of which I categorized as small communities and the rest of which were categorized as super communities.

On average, there were roughly 10-15 small communities in the network and only one or two super communities. Small communities ranged in size from 500 to 2000 accounts, and super communities were mammoth organizations ranging from 20,000 to 30,000 accounts. I studied the collective nature of those communities and although my hypothesis must undergo further studying, I surmise that smaller communities tend to be dominated by small isolated groups of accounts/actors with loyal followers typically engaged around a specific topic and a specific language, and that the majority of these small community accounts belong to ISIS operatives. Finally, because of subtleties in behavior we concluded that these communities tend to be larger than expected due to account inflation.

On the other hand, super communities tend to contain a larger mix of accounts and actors. For super community friend/follow networks, a larger more complex influence sphere is generated. Major influencers of these communities tend to be renowned news organizations such as Al Jazeera Arabic, Al Arabiya and others. Additionally, famous (though not always recognized or legitimate) news anchors, political and military figures, activists, notorious propaganda accounts, and some of what may appear as intelligence community accounts are generally found in these communities. Super communities tend to gather a larger cross-section of users coming from different political, social and religious points of views, therefore additional analysis to fully understand them is necessary.

However, it is clear from my analysis that smaller communities tend to develop based on personal communication patterns while larger communities are built when information exchange is more widespread allowing users holding different views to follow other influential users. This culminates in a range of opinions and ideologies. Because I used highly visible and active accounts to collect both of my large follow networks, the collected network was dominated by ISIS operatives and ISIS agenda but it is worthy of note that some smaller communities developed around active accounts that clearly opposed ISIS propaganda. This included some near east governmental institutions, official Kurdish military accounts, and accounts belonging to the Free Syrian Army.

Methods of Combat

For authorities seeking to dismember the community structure, they are presented with two challenges: The first is identifying these small communities accurately before being active to begin with. This has to be carried out with precision but it is exceedingly difficult to do so. Typically, inactive accounts rarely identify themselves as ISIS accounts before they become active.

The second challenge is that once these accounts are activated they follow a large number of accounts and receive a large following as well, blending them into the larger (super) communities and presenting challenges with identification if they maintain a conservative level of activity.

This analysis suggests that traditional methods of discovery and suspension of accounts may not be sufficient, and although my analysis did not include analysis of classified methods and materials at this time, I do not believe that community targeting is utilized in the overall counter-strategy of ISIS propaganda.

The Leader Network

Once the full friend/follow network was fully analyzed, I isolated the top 100 nodes (in terms of number of follows) and categorized them into a number of qualitative tracks. In doing so I hoped to understand how the most followed actors behaved and what their traits were. There’s more in the paper on this but in summary:

1. The top 100 accounts had a total follower count of more than 14 Million

2. 72% of the top 100 accounts were categorized as “clearly” ISIS accounts with an additional 10% who we categorized as supporters.

3. 5% of accounts we categorized as “News” accounts but held more than 3 Million followers of the original 14 Million accounts.

4. 49% of all network leader accounts were deleted or suspended within 3 weeks of the beginning of our study.

5. We estimate the total number of accounts from the total number of follow relations (5M) to be roughly 338,000 accounts. This agrees with previous conclusions that accounts and online presence is inflated as most official ISIS counts estimate the organization to be no more than 30,000 members.

6. We estimated that 16% of leader accounts were “corporate” while 69% were personal operatives account*.
7. 95% of accounts used the Arabic language with a minority using other regional languages such as Urdu, Farsi, and Pashto. Though, this trend is very likely due to our method of data collection which uses Arabic language accounts as seed accounts to collect the larger network.

*I defined corporate accounts as accounts that were simply retweeting other users’ messages without engaging individual accounts personally or creating new content.

Thematic Behaviors

To tie in network structure to individual user’s behaviors, I also conducted a brief investigation of users’ micro-behaviors.

I found important patterns that contribute to our understanding of the level of sophistication and planning that ISIS operations undergo, as well as the adaptive nature of their organization even when no previous planning existed.

I categorized those behaviors into distinct themes. I summarize them as follows:

• Continuous building of adaptive cognitive networks
• Signaling to avoid discovery
• Speedy and adaptive closure
• Continuous Identification of system vulnerabilities.

Not to sound repetitive but I discuss these themes at length in the report. Below is a few examples/screenshots of each thematic behavior.

The DEER Process

Part of my goal during my time with NATO STRATCOM and STATE (USDOS) was to help to build a model of the information warfare environment which would contain all the elements of the analysis and which professionals in the field would be able to easily reference in order to communicate the various stages of propaganda dissemination. To that end I was able to develop the DEER Process tool, which takes into consideration all the aspects of my quantitative and qualitative analysis of the ISIS/ISIL propaganda network.

The DEER Process is the method by which ISIS and potentially other organizations use social media to propagate their message in a hostile environment and with attention paid to applied counter-strategies. It involves:

1. Dissemination of public propaganda
2. Deletion or suspension by adversary
3. Evolution of (network) structure or methods
4. Expansion of influence or methods
5. Replenishment of accounts and resources.

DEER represents the process by which ISIS has built an infrastructure that can sustain damage on social media.

It begins with the same techniques used by any active social media group—that is—the continuous sharing of agreeable, targeted information and propaganda. Over time and as they engage an audience, adaptation ensues. As propaganda accounts are deleted or suspended in step two of the process, ISIS or other terrorist networks, through their individual level behaviors, evolve the network structure, much of the time creating a sparser network in terms of number of accounts but a more tightly knit network in terms of density of relationships. This also includes moving accounts from an inactive state to an active state and allowing previously unimportant accounts to become much more central to propaganda dissemination.

The Evolution phase of the process also includes using more sophisticated signaling and closure techniques to avoid detection, and the methods that we have seen evolve include both the techniques used in sharing propaganda and the methods of evasion themselves.

Expansion is a natural probable outcome of evolution. As an enemy gains time and space between adopting a new, evolved process and their adversaries’ ability to detect the features of that evolution, they can expand. Since 2013, I believe that on Twitter and other social media platforms, tens if not hundreds of thousands of ISIS accounts have been suspended or deleted. How then have they been able to maintain roughly the same level of activity as they did when there was no battle infrastructure in place to combat them? I believe the answer to that question is expansion post-evolution.

The final stage of the DEER Process is replenishment. As ISIS creates new accounts, uses them for propaganda sharing, loses them to suspension or deletion, evolves new network structures and methods of evasion and dissemination, and then expands operations and number of active sources of information, they simply replenish accounts and content sources that were previously suspended or deleted by their adversaries.

Recommendations – Cyber Cluster Bombs

It’s the internet, and it’s social media – so it’s not as if you could permanently delete an account or remove a user, but even if you could there is “Intelligence” value to the accounts you delete. After all, we already know ISIS uses social media to coordinate operational activities.

Information warfare is about transaction costs and about reducing your transaction cost of sharing truth and burdening your adversary with high transaction costs – forcing them to spend more time, effort, and capital on achieving that which was previously inexpensive to achieve.

From a network perspective that means not randomly targeting active accounts as was being done during the period of my analysis and what seems to still take place now. My core recommendation is for the targeting of clusters of accounts using clustering and community algorithms that identify accounts before they become active. The core paradigm at the moment is to target active accounts that become active in the traffic (tweet) networks, but not make any real effort to identify accounts created as part of a backcloth network (friend/follow). Clustering and community algorithms work by looking at common connections between accounts, their connected accounts, and their connected accounts once more. Part of my analysis identified 2 major themes illustrated by the DEER process which makes this method more effective: The first is that ISIS engages in account inflation tactics – that is the creation of many accounts to inflate one’s size and appearance on social media. The second is that once they create these new accounts they connect them back into a known propaganda network by following friendly users and asking to be followed by them. The accounts then remain dormant until such a time arises when they need to be used.

Identifying and preemptively suspending those accounts early forces ISIS operatives to spend more time on account creation rather than on disseminating propaganda. That is what I mean by transaction costs. Increasing their transaction costs of each propaganda package dissemination. Do that enough and in scale and you could effectively achieve the same result as permanently deleting all their account and eliminating their online presence. Of course their actual content will remain somewhere else on the web, but who cares? As long as the mainstream doesn’t see it, the probability of radicalization from their content is much smaller.