Abstract: The Islamic State has devoted significant resources to implementing a distinct online recruitment strategy, which follows targets from their introduction to the organization’s message, through a careful pruning of their social networks, before culminating in a call to action. The strategy relies on scores of users who maintain a high level of availability online, allowing them to lavish attention on potential recruits, and who provide a drumbeat of incitement to action, such as social media activism, migration to Islamic State territories, or the commission of terrorist attacks.
Thousands of foreign fighters and non-combatant immigrants have traveled to join the Islamic State, including unprecedented numbers of Westerners. Western supporters who cannot travel are urged to carry out attacks in their homelands. So far in 2015, at least 60 people have been arrested in the United States for criminal acts in support of the Islamic State.
In almost every American case, social media played some part in recruitment and/or radicalization, as it has in many other examples. A study of Islamic State Twitter use published by the author in early 2015 found at least 46,000 Twitter accounts that supported the organization that were in use in and around October 2014.[1] Since then, Twitter has suspended the accounts of Islamic State supporters in large numbers, but many users create new accounts and return. Ongoing monitoring suggests there are currently a minimum of around 40,000 accounts that actively support the Islamic State,[2] with perhaps 2,000 tweeting[a] primarily in English.[b]
Observers have focused, rightly, on the quality and quantity of Islamic State propaganda as a factor in its success, but passive material can only take the typical radicalization so far. Therefore, the organization deploys a wide variety of tailored online interventions to bring their targets into the fold.
Sometimes referred to as “grooming,” these interventions are conducted by small teams of prolific social media users who lavish attention on potential recruits in order to shape their worldview and encourage direct action in support of the Islamic State, ranging from lone wolf–style terrorist attacks to migration to Islamic State territories. Some interveners are more formally affiliated with the Islamic State while others appear to be informal volunteers.[c]
Online interventions are more prevalent in countries where the social climate offers few opportunities to safely discuss an interest in the Islamic State in a face-to-face setting, but even in such environments, many cases incorporate activity that crosses over from online to real-world interactions. There are several distinct elements present in these interventions, from which recruiters can select when tailoring an approach. The most common are:
- First contact
- Islamic State seeks out target
- Recruiters respond to targets who seek out Islamic State
- Create micro-community
- Maintain constant contact
- Encourage target to insulate against outside influences
- Shift to private communications
- Identify and encourage pro-Islamic State action suitable for target
- Social media activism
- Travel to Islamic State territories
- Terrorism
At least dozens of Islamic State supporters use these tactics to target Americans as potential recruits, with considerably more activity focused on France, the United Kingdom, Belgium, and other European countries. Similar activity is found around the world, with the scope of the problem varying widely from one region to the next. In each arena the tactics differ, sometimes substantially, and in areas geographically proximate to Islamic State–controlled territory, the mix can be weighted to offline recruitment. This article will specifically examine the Islamic State’s online approach to recruiting Americans and Europeans.
First Contact
Before the Islamic State can groom a potential recruit, it must first make contact. Contact can be initiated by the recruiter or the potential recruit. Recruiters monitor online communities where they believe they can find receptive individuals, but they also make themselves highly available to curiosity seekers.
Islamic State supporters follow both radical and mainstream Muslim networks online, seeking receptive targets. A July 2015 analysis of 1,600 Twitter accounts linked to English-language Islamic State supporters showed that many accounts followed and interacted with Muslim-oriented social media accounts that were radical but not overtly violent, and in some cases, not obviously connected to radicalism at all.[d]
Among the most significant of these were accounts associated with the U.K.-based CAGE organization (formerly Cageprisoners), an advocacy group founded by a former Guantanamo detainee Moazzam Begg and focused on Muslim prisoners. CAGE has advocated various controversial views and has been linked to such radicals-turned-terrorists as American al-Qa`ida figure Anwar al-Awlaki and the notorious British national and Islamic State jihadi Mohammed Emwazi, better known as “Jihadi John.”[3] Users also followed British accounts associated with the former al-Muhajiroun network[4] and even more radical variants on the theme of Muslim prisoners (a trend also seen in Arabic language accounts).[e]
Overtly radical organizations with specific regional presence or an English-language focus were an important part of the mix. They include Authentic Tauheed, led by prominent English-speaking radical cleric Abdullah Faisal, who has transitioned from supporting al-Qa`ida to an overtly pro-Islamic State orientation;[5] the Islamic Thinkers Society, a New York–based organization formerly linked to American al-Qa`ida recruits,[6] now also increasingly sympathetic to Islamic State;[7] and the Islamic Awakening message board, a forum for a wider range of users with views ranging from conservative to radical, although moderators generally police any talk of violence.
By monitoring activity in these communities, as well as by searching content, Islamic State supporters look for potential recruits, such as individuals expressing anti-Western sentiments. Specifics vary depending on the individuals involved. For instance, Islamic State supporters frequently ask individuals expressing religious sentiments if they have considered hijra (emigration) to the Islamic State.[f] In other cases, they may respond to more general content posted by targets, such as tweets about pets, meals, or politics.
Through the first half of 2014, it was possible to encounter Islamic State propaganda online without seeking it, thanks to the group’s aggressive use of broadcasting techniques such as bots (automated, high-volume tweeting of content) and hashtag spamming (tweeting content at high volume on unrelated hashtags). However, the suspension of Islamic State social media accounts—by Facebook, YouTube, and, most recently, Twitter—has significantly reduced the reach of such tactics. An estimated half of Islamic State-related arrests in the United States from January to July involved the use of Facebook, despite the platform’s more aggressive suppression tactics.[g]
Initial interest in the Islamic State is often prompted by mainstream media coverage rather than its own social media output.[8] Media coverage and popular interest spiked dramatically with the Islamic State’s seizure of Mosul in June 2014 and its subsequent claim to have reconstituted the caliphate. While suspensions have limited the ability of Islamic State supporters to broadcast propaganda, it is still relatively easy to find its supporters online.[9]
Once contact is made, the response varies according to the target. Islamic State supporters, including foreign fighters, will often simply answer questions in a friendly manner, patiently awaiting a more substantial opening to proselytize.
Islamic State supporters and recruiters also seek to communicate with potentially disenfranchised or disaffected people by tweeting, retweeting, and using popular hashtags or hashtags relating to divisive current events, such as the unrest in Ferguson, Missouri and Baltimore, Maryland, or the Dylann Roof white supremacist terrorist attack in Charleston, South Carolina.[10] While Islamic State supporters have employed this tactic aggressively, there is little evidence that it is particularly effective.
Create Micro-Community
Once first contact is established, Islamic State recruiters and supporters quickly seek to create a small community surrounding the target. The recruiters are available in high volume bursts to interact with targets, often publishing 50 or 60 tweets per day, with some prolific users clocking over 250 on given days. Some maintain a presence very similar to ordinary social media addicts, tweeting many links to news stories or images and videos they find amusing.
The hyperactive pace of Islamic State supporter posting ensures that it is easy for a target to find conversation at any hour of the day and night, allowing virtually constant contact as a relationship progresses.
At some point after first contact, Islamic State supporters begin to encourage targets to isolate themselves from non-supporters. This can take the form of general exhortation not to befriend non-Muslims, based on the claim they cannot be trusted. Recruiters sometimes invoke a religious doctrine known as al walaa wal-baraa (loyalty to Muslims and the disavowal of non-Muslims). “Where is your Al Walaa wal Baraa?” one Twitter user asked a conservative Muslim target, in response to a tweet about mainstream issues. The target, who did not visibly support Islamic State, appears to have ignored the recruiter. Another tweet, directed at a cleric, asked “ya sheikh you want to talk about aqeedah [belief] and ignore al wala wal baraa?”[11]
Anti-Muslim activists on social media can also play into this dynamic and reinforce the recruiters’ message of alienation. These users often engage directly with people showing an interest in the Islamic State. A particularly noteworthy example occurred in relation to the May 2015 Garland, Texas, in a “Draw Mohammed” contest. Just days before the attack, “troll” tweets (including some apparently specific to the contest) were directed at an account belonging to Elton Simpson, one of the two gunmen, who had expressed unhappiness over the contest.[h] [12]
Possible recruits are also encouraged by Islamic State supporters to distrust other Muslims who have mainstream beliefs, arguing they are at best misguided or at worst apostates. Among the English-speaking users monitored for this study, mainstream Muslims are often derided as “coconuts,” a racially connoted term meaning “brown on the outside, white on the inside.”[i] Targets may be specifically discouraged from attending mosques where they could be exposed to moderating influences.[j] [13]
Finally, the suspension of targeted users who have only started to overtly support the Islamic State may accelerate the process of isolation. Users who are suspended and come back with a new account often follow fewer accounts than they did previously, and they often stop following mainstream accounts unrelated to the Islamic State. Since suspensions ramped up about one year ago, the ratio of Islamic State supporters to non-supporters in monitored social networks has increased.[k]
Shift to Private Communications
Once a relationship begins to develop, some interactions are typically moved to private communication channels where the actual work of recruitment or instigation of a terrorist attack can take place away from prying eyes.
Conversations may take place within the private messaging function on an existing social media platform, such as Twitter or Facebook.
Islamic State recruiters often favor messaging applications with strong encryption. Among the most popular are WhatsApp, Kik, Surespot, and Telegram. Some Islamic State supporters listed their user information for such applications in their Twitter bios, although others discouraged this for security reasons.[l] Secure messaging information was more commonly shared in tweets or private messaging.
Islamic State users specifically encouraged targets to send queries regarding hijra to Islamic State territories through encrypted channels[m] The shift to such applications has been described by FBI Director James Comey as “going dark”—the point at which continued monitoring by law enforcement becomes problematic.[14] When the shift can be observed in open-source postings, however, the transition itself can be read as an indication of deepening radicalization.
Some recruiters employed Skype for voice or video conversation, although this was infrequently discussed in public tweets. In at least one documented case, recruiters made contact via postal mail.[15]
Recruiters have combined social media with offline physical outreach in exchanges observed online and in cases documented in criminal prosecutions. In the United States, online recruiting has eclipsed real-world recruiting, broadly speaking, but the old-school physical approach remains in play with evidence of on-the-ground recruitment activity in the United States, and even more in Europe.[16] In general, the role of offline recruitment becomes more significant the closer one gets to an Islamic State-contested territory.
Encourage Action
At some point in the relationship, an Islamic State recruiter or supporter will attempt to identify the most likely action a target is willing to undertake and encourage it.
This can happen earlier or later in the process, depending on how radical the target may already be around the time of first contact. Some targets appear with relatively new accounts and immediately request private contact with Islamic State recruiters and supporters, often generating suspicion from the latter, although they frequently agree to make contact anyway. Circumstantial evidence suggests that if a recruiter has doubts about the target’s sincerity, he or she may recommend solitary action such as a lone wolf attack, which is less likely to expose the Islamic State’s support network to risk.[n] [17]
At the most basic level, Islamic State users draw their targets into social media activism as a natural result of the target’s increasing engagement with the Islamic State. If a target becomes sufficiently engaged that his or her account is suspended, he or she may create a new account using tools provided by Islamic State supporters. One account, known as Baqiya Shoutout, is particularly important in reuniting English-speaking Islamic State supporters on Twitter. It announces English-language accounts that return from suspension and maintains a list of follow recommendations. The account itself is routinely suspended and reincorporated. Once targeted users start to employ such tools, retweeting and dissemination of Islamic State content become routine.
Beyond social media activism, there are a number of ways users can be drawn into concrete actions in support of the Islamic State, the most important being hijra, or emigration to Islamic State territories, and terrorism.
While recruiters allow their targets’ expressed preferences to steer the direction of action, to a significant extent the exhortations generally favor hijra. The Islamic State sees itself as a generational state-building project with a need not just for fighters, but also for professionals, whether emigrating as a family unit or singles being matched for matrimony on arrival in Islamic State territory. As a millenarian project, the Islamic State offers a carefully manipulated image of what its propagandists consider to be a utopian society, which is an important part of its sales pitch.[18]
Some targets determine that hijra is not an option, either stymied by government restrictions on their travel or financial obstacles.[o] In such cases, Islamic State recruiters and supporters promote the option of terrorism at home. The most visible and frequent manifestation of this is found in undirected tweets either urging or threatening attacks, such as “Ok so they’re talkin so mch abt 7/7. Bidhnillah we’ll cont. to hit ‘em til every day becomes an event to remeber 1/1,2/2 etc. :) #sevenseven” and “To those who can not make #Hijrah Strike from within, it doesn’t matter how you do it. Use a bomb. A gun. A knife. A Car or a big rock #Islamic State” (all tweets are reproduced verbatim, including grammatical and spelling errors).[19]
Specific guidance is sometimes available. In the case of Garland shooter Elton Simpson, a number of direct influences were observed, although they were directed at a Twitter account that had been suspended prior to the attack. Tweets from the period leading up to the attack could not be fully retrieved, but tweets directed to the account remained available after the attack, originating from accounts monitored by the author.
Media reports have highlighted the alleged role of Junaid Hussain, a British hacker who joined the Islamic State some time in or after 2013, and who was very active on social media.[20] Unnamed government sources have described Hussain as an important recruiter and instigator of attacks.[21] But while Hussain did interact with Simpson, possibly including via private communications, he was only one of many Islamic State supporters who did so. Among those was a British foreign fighter in Raqqa named Tariq Hamayun, aka Abu Muslim al Britani, under the Twitter handle @Muslim_Sniper_D, an associate of Junaid Hussain.[22]
Other users in Simpson’s social network had been tweeting about the Garland event for weeks in advance of the attack, and many provided links to its time and location. On April 23, for instance, one user tweeted, “Brothers & Sisters. the kuffar [unbelievers] are exercising their free speech ‘hate speech’ by drawing Rasulallah [the Prophet],” with a link to more information. On April 26, 2015, a little more than a week before the attack, an Islamic State supporter responding to an unknown comment by Simpson tweeted, “You really have to do it!” On May 1, two days before the attack, a user tweeted, “Kuffar gone crazier, they are making draw Muhammad SAW event !!!!!!” and another tweeted, “Brothers in Texas Pls go to there with your weapons, bombs or with knifes Defend your prophet, It is your chance now !!”[23] (Interestingly, the user who posted the last tweet was an imposter, an American who convincingly posed as an Islamic State supporter and has since been arrested.[24])
Other manipulations may have been more subtle and powerful. Simpson reportedly had a dream about a woman in a hijab looking at him from down the road, which online associates said he interpreted as being associated with martyrdom. At least once prior to the attack, Simpson consulted with an Islamic State supporter known on Twitter as “End of Time Dreams,” who professed to link English-speaking users with Arabic-speaking experts in dream interpretation. According to information posted after the attack by that user, Simpson had at least one other vision involving another man and “the sword.” Simpson consulted “End of Time Dreams” about the vision around April 28.[25]
However, such direct intervention appears to be relatively rare, based on the information currently available in both open sources and court documentation. Generalized guidance appears to be the rule, specific guidance the exception.
Conclusion
The social media ecosystem created by the Islamic State for use in radicalization offers a number of potential warning signs and intervention points along the road that leads a targeted user to take concrete action on behalf of the group. Yet there are significant practical obstacles to tackling the problem programmatically. The majority of those who post messages in support of the Islamic State to social media will never act out. There is no consensus on when radical rhetoric signals a move to violence, at what point intervention is appropriate, or what type of intervention is most appropriate. [26]
One crucial transition point is the move to private communication channels. Once that shift takes place, additional information is protected by the channel’s privacy and/or encryption functions. Not all users who make the jump to private communication will eventually act, but many Islamic State supporters who act will have made the transition.
In addition, the data examined for this article indicates that users who appear to seek and receive extraordinary guidance, such as dream interpretation or physical or financial assistance, may be closer to action than other potential recruits and may be appropriate targets for law enforcement intervention.
To some extent, it is possible to reverse engineer cases of visible radicalization, particularly when it leads to violence or hijra, and identify key recruiters and inciters. Monitoring of existing online recruitment networks can also reveal which individuals are more likely to be involved in providing such extraordinary guidance, or otherwise moving a target toward concrete action.
J.M. Berger is a non-resident fellow with the Brookings Project on U.S. Relations with the Islamic World. He is author of Jihad Joe: Americans Who Go to War in the Name of Islam, and co-author of ISIS: The State of Terror, and The ISIS Twitter Census. Follow @intelwire.
Substantive Notes
[a] Despite the Islamic State’s success recruiting online, the problem remains an outlier in most meaningful respects. Even the most generous estimate of Islamic State supporters online is still a fraction of one percent of Twitter’s overall users, and the number of users actively seeking to radicalize in any region is even smaller. While this issue merits attention from both researchers and policymakers, the problem should be kept in context.
[b] Except where otherwise stipulated, data in this article was derived from a monitored set of around 1,600 accounts, including known Islamic State supporters, recruiters, and non-supporters who they followed and interacted with. The starting set was defined in July 2015 and updated subsequently due to the suspension of at least 500 accounts in August, with many being recreated by the users.
[c] The ratio of formal to informal participation is unclear, but over time the interactions observed on social media that progress past the point of initial contact typically seem to include at least one person formally aligned with the Islamic State, and often as many as four or five.
[d] Data collected and analyzed by J.M. Berger using metrics described in Berger and Morgan, “The ISIS Twitter Census.”
[e] Significant accounts included relatively mainstream Muslim dawah (evangelical preaching) operations with no overtly radical components, inspirational religious quotes and stories, and accounts discussing Muslim marriage.
[f] Nearly 90 percent of tweets found using a Twitter search for the phrase “make hijra” in English were from Islamic State supporters, including several who were previously being monitored. The remaining tweets were sarcastic comments directed at Islamic State supporters. Excluded were retweets and the activity of one bot. Retrieved August 1, 2015. In monitored tweets, for example, “How many will it take that leaves & makes hijrah in front of ur eyes before you realise it’s time to leave too? Preserve ur emaan leave asap” and “All you Somali sisters residing in the west must make hijrah now to your homeland and marry those mujahideen ASAP!!”
[g] Estimate based on a review of criminal complaints in 25 out of 49 recorded cases.
[h] The troll tweets cited here were directed at a previous account used by Simpson that was subsequently suspended, as a result of which most of Simpson’s original tweets from that period could not be retrieved. Among the troll tweets were the following, posted by three different users on April 24, 2015; April 26, 2015; and May 1, 2015: “you pathetic scumslims talk all that shit and block me,” “Shariah is the darkness of the 7th Century. NO THANK YOU,” “hahaha you idiots get angry over cartoons,” and “We will keep drawing Muhammad.”
[i] In monitored tweets, for example, “Ppl said “Indonesia is a majority muslims” .. nah ,, they lie ,, most of indonesian ppl are COCONUT !!” and “Coconuts working overtime right now to prove they’re not Muslims. lol”
[j] In monitored tweets, for example, “Important information for all you coco’s [coconuts] out there – A place that calls to shirk and cursing of the Sahaba is not a masjid,” and “Would the Prophet have police recruitment days in his Masjid for the sake of the Qureyshi government? How then is this a masjid today?!”
[k] The ratio increased by about 60 percent. Significant caveats attend to this estimate, due to the difficulty of creating a comparable dataset in an environment of massive and frequent suspensions.
[l] From monitored tweets, for example, “I wish the ukhtis would take their kik & surespot & telegram & whatever else out of their bio, it’s asking 4 trouble.”
[m] From monitored tweets, “asalamu aleikum wr wb anyone who wants help in making hijrah this my surespot: [account information removed]” and “[To specific user:] delete ur tweets regarding hijrah and use surespots to contacts brothers.”
[n] For instance, reporters posing as jihadis.
[o] Some monitored tweets since August have discouraged hijra to Iraq and Syria, indicating that the border crossing had become more difficult in light of recent events in Turkey. Other users continued to encourage hijra either generally or specifically, shifting the destination to Libya in some cases.
Citations
[1] J.M. Berger and Jonathon Morgan, The ISIS Twitter Census (Washington, D.C.: The Brookings Institution, 2015), p. 2.
[2] J.M. Berger, unpublished draft paper.
[3] Henrietta McMicking, “Cage: Important human rights group or apologists for terror?” BBC News, February 27, 2015.
[4] Richard Spillett, “Al-Muhajiroun network linked to half of attacks by Britons over past 20 years,” Daily Mail, March 23, 2015.
[5] “Former Revolution Muslim Imam Encourages Support for ISIS,” ADL.org, September 10, 2014; Abdullah Faisal, “Debunking The Letter Of The Wicked Scholars To Amirul Muhmineen – Part 1,” audio lecture, AuthenticTauheed.com, February 14, 2015.
[6] Paul Cruickshank, “U.S. citizen believed to be writing for al Qaeda website, source says,” CNN.com, July 18, 2010; Paul Cruickshank, Nic Robertson, and Ken Shiffman, “The radicalization of an all-American kid,” CNN.com, May 15, 2010.
[7] https://twitter.com/IslamicThinkers/status/624599167290048512, https://twitter.com/IslamicThinkers/status/624256955234684930, https://twitter.com/IslamicThinkers/status/617804836315099136, retrieved August 1, 2015.
[8] For example: Rukmini Callimachi, “ISIS and the Lonely Young American,” New York Times, June 27, 2015. The young woman profiled was first prompted to seek information on ISIS by a CNN story.
[9] Berger and Morgan, “The ISIS Twitter Census;” J.M. Berger, “Taming ISIS on Twitter: More than a game of whack-a-mole,” CNN.com, April 2, 2015.
[10] Souad Mekhennet, “Even the Islamists of ISIS are obsessing over Ferguson,” Washington Post, August 21, 2014. Dylann Roof tweets and retweets collected from monitored accounts
[11] From monitored tweets. Simpson’s ownership of the account, via USA v. Nader Elhuzayel and Muhand Badawi, Criminal Complaint, filed May 22, 2015, Case SA14-275M.
[12] Rukmini Callimachi, “Clues on Twitter Show Ties Between Texas Gunman and ISIS Network,” New York Times, May 11, 2015.
[13] Callimachi, “ISIS and the Lonely Young American.”
[14] Theodore Schleifer, “FBI director: We can’t yet restrain ISIS on social media,” CNN.com, June 18, 2015.
[15] Callimachi, “ISIS and the Lonely Young American.”
[16] USA v. Arafat M. Nagi, Criminal Complaint, filed 7/28/2015, Case 1:15-mj-02122-HBS; USA v. Abdullah Yusuf and Abdi Nur, Criminal Complaint, filed 11/24/2014, Case 0:14-mj-01024-MJD-2; Laura Yuen, Mukhtar Ibrahim, and Sasha Aslanian, “Called to fight: Minnesota’s ISIS recruits,” Minnesota Public Radio, March 25, 2015; Paul Cruickshank, “An Interview With: Usman Raja,” CTC Sentinel, (8:7) 2015, West Point, New York.
[17] Stuart Ramsay, “Exclusive: IS Bombers In UK Ready To Attack,” Sky News, August 11, 2015.
[18] Kevin Sullivan and Karla Adam, “Hoping to create a new society, the Islamic State recruits entire families,” Washington Post, December 24, 2014; J.M. Berger, “The Metronome of Apocalyptic Time: Social Media as Carrier Wave for Millenarian Contagion,” Perspectives on Terrorism (9:4), p. 61.
[19] From tweets monitored by the author.
[20] Kimiko De Freytas-Tamura, “Junaid Hussain, ISIS Recruiter, Reported Killed in Airstrike,” New York Times, August 27, 2015.
[21] Greg Miller, “U.S. launches secret drone campaign to hunt Islamic State leaders in Syria,” Washington Post, September 1, 2015.
[22] USA vs. Ardit Ferizi, Criminal Complaint, October 6, 2015, Case No. 1:14-MJ-515, http://www.justice.gov/opa/file/784501/download.
[23] From monitored tweets of users who followed or were followed by Simpson.
[24] Elise Potaka and Luke McMahon, “FBI says ‘Australian IS jihadist’ is actually a Jewish American troll named Joshua Ryne Goldberg,” Sydney Morning Herald, September 12, 2015.
[25] Multiple monitored tweets before and after the attack; the tweet specifying a vision of the sword was posted May 4, 2015, just hours after the attack.
[26] Seamus Hughes, “Domestic Counterterrorism: Material Support or Bust,” Markaz, The Brookings Institution, August 31, 2015,
