Abstract: Online supporters of the Islamic State use messaging and file-sharing platforms to communicate internally and share media releases, but also disseminate published operational instructions. A study of 98 pro-Islamic State Telegram channels containing instructional material collected between June and December 2017 finds that while officially produced Islamic State materials in English are relatively scarce, administrators of these channels are undiscerning about the ideological source of the instructional material that they distribute. Thus, they frequently utilize material from outside of the Islamic State’s narrow ideological literature base. Moreover, the use of Telegram as a dissemination platform fundamentally changed the form and content of pro-Islamic State English-language instructional material by broadening the scope of available media (photos, images, videos, audio, etc.). While materials that direct followers toward committing attacks remain a great concern for counterterrorism agencies, dissemination of instructions on cybersecurity and operational security may be equally dangerous.
The messaging application Telegram is now the preferred platform of online Islamic State supporters, after replacing mainstream social media applications on the surface web (e.g., Twitter, Facebook, Instagram). This demographic utilizes Telegram toward several ends, including as an “information highway” for the distribution of official Islamic State media releases, coordination of supporters’ efforts on the surface web, and facilitation of internal communications between supporters.1
The bulk of scholarly work to date on Telegram’s role in Islamic State recruitment and radicalization focuses on the activities mentioned above rather than the platform’s operational aspects.2 The use of Telegram as a communications interface between networks or cells of Islamic State-inspired or -directed attack plotters in the West, or between these plotters and ‘virtual planners’ in Islamic State-held territory, elicits a great deal of journalistic focus. These reports intensified following news that the perpetrators of the 2015 Paris and 2016 Brussels attacks had used the application to communicate with each other.3 In addition to this cell, attackers in several plots in Francophone countries, the 2016 Christmas market attack in Berlin, and the 2017 Istanbul Reina Nightclub attack all used Telegram to receive instructions from Islamic State external operations officials in Syria and Iraq.4
However, other aspects of Islamic State supporters’ operations on Telegram remain under-analyzed in both academic sources and journalistic reporting. In addition to direct communications, supporters utilize Telegram’s channel and file-sharing features to disseminate instructional material. Defined loosely, instructional material refers to compiled, published, and disseminated information on how to assist terrorist groups successfully and inconspicuously. Through undertaking a preliminary analysis of what sorts of English-language instructional material are published on pro-Islamic State Telegram channels, this article aims to document the diversity of available material and its potential implications for Islamic State supporters’ operations in the West.
Background: Online Jihadi Instructional Material
A large proportion of English-language instructional manuals distributed by Islamic State supporters on Telegram are replicas of instructions developed by al-Qa`ida, other jihadi groups, or sources external to the broader jihadi movement. These results show that for channel administrators, pragmatism outweighs ideology in deciding which sources are useful for directing and inspiring English-speaking supporters to commit attacks.
Three interlinked factors shape this preference. First, the Islamic State’s central media and external operations divisions do not frequently release official, English-language attack-planning material; what is available focuses on low-tech attacks (stabbings, vehicular assaults, arson, etc.).5 This is partially a result of the group’s priorities in its messaging strategy to English-speaking supporters, which initially focused on foreign fighter recruitment.6 It was only after foreign fighter travel to Islamic State-held territory became significantly more difficult that Islamic State media releases, propaganda, and instructional material in English shifted away from encouraging supporters to travel, and instead directed them to “stay in place” and commit attacks in their native countries.7 The harbinger for this shift was a series of speeches by Islamic State spokesman Abu Muhammad al-Adnani from 2014 to 2016, culminating in a 2016 speech in which he argued to Western Islamic State supporters that “the smallest bit of work that you can carry out in [your] countries is far better and beloved to us than any major [operations] here.”8
As a result of this relatively late-breaking change in its priorities, the Islamic State produced a smaller number of official, English-language instructional manuals than many of its predecessors.9 The Islamic State did not offer step-by-step attack instructions in its original flagship magazine, Dabiq, which published 15 issues between July 2014 and July 2016.10 Out of the 13 issues of its successor magazine Rumiyyah, first released in September 2016 and last published in September 2017, only five contained any instructional material.11 Therefore, despite the Islamic State’s encouragement of attacks in the West, officially released Islamic State instructional guides in English remain a shallow resource for aspiring attack plotters.
Additionally, while Rumiyyah contains information about several low-tech attack methods, it eschews instructions for firearm and explosive attacks.12 This may be due to a perception within the Islamic State’s attack planning authorities that the strategic impact of a series of low-tech attacks in the West with minimal planning outweigh single, large-scale attacks which require extensive planning.13 Organizationally, the Islamic State stands to lose very little in terms of resources and personnel if a low-tech plotter is either disrupted or unsuccessful.14
While the Islamic State has produced relatively little original instructional material for terrorist attacks in the West, there is an extensive corpus of instructional material produced by other jihadi groups, which largely maintains its relevance for Islamic State supporters years after initial production. Contemporary jihadis still actively draw from Jihad Recollections (four online magazines produced by the American jihadi propagandist Samir Khan from April to September 2009),15 al-Qa`ida in the Arabian Peninsula (AQAP)’s Inspire (2010-2016, edited by Khan until his death in 2011),16 and al-Shabaab’s Gaidi M’Taani (2012-2015).17 For jihadis in English-speaking countries, the first two, and particularly AQAP’s Inspire, are the most-referenced sources.18
Within these publications, the most notorious manual series is “Open Source Jihad,” a series of articles released in Inspire.19 The multi-part installation contains operational instructions for a diverse array of attack methods, including car bombings, political assassinations, and vehicular attacks.20 It also highlighted rudimentary cybersecurity protocols, including the use of the Asrar al-Mujahideen encrypted messaging platforms.21
The Open Source Jihad series is also infamous for one article, “Make a bomb in the kitchen of your mom,” which contained recipes for the low-budget construction of an improvised explosive device (IED).22 Nearly a decade after its initial publication in 2010, this manual maintains its relevance among Western jihadis. The 2013 Boston Marathon bombers are among the most notorious users of the Open Source Jihad series, but attackers in various jihadi plots in the United States and Europe since 2010 have also utilized these specific instructions.23 In December 2017, more than seven years after the release of the first issue of Inspire, Akayed Ullah allegedly attempted to detonate a pipe bomb in a Port Authority terminal in New York City on behalf of the Islamic State, resulting in no deaths.24 Ullah reportedly told investigators that he constructed the IED based on instructions from an online copy of Inspire; the pipe bomb he built matched the recipe from “Make a bomb in the kitchen of your mom.”25
Ullah’s alleged plot also highlights a third reason that unabashedly pro-Islamic State, English-language Telegram channels may be so keen to distribute manuals produced by other groups. English-speaking, lone-actor jihadi attackers—the designated audience of these channels—are generally less observant of the subtle differences between competing jihadi groups and their ideologies.a English-speaking jihadi plotters frequently adopt “a la carte” approaches to the broader jihadi movement in terms of ideological matters, selecting what they see as personally relevant details from a variety of influences that are intrinsically competitive, unbeknownst to them.26 In this light, attack-planning instructions may be even more easily extractable from the groups that produce them; attackers who seek to maximize damage will utilize any material that helps them achieve this aim, regardless of its author.
These three factors—a relative lack of Islamic State official instructional material, the surfeit of material produced by other groups, and English-speaking jihadis’ seeming inability to discern between sources—all encourage English-language, pro-Islamic State Telegram channel administrators to post a wide array of instructional material from inside and outside the jihadi movement. As the following section explains, the choice of Telegram as a distribution network also filters and diversifies jihadi instructional material, or as the Canadian academic Marshall McLuhan put it, “the medium is the message.”27
Telegram, a free cloud-based instant messaging service, running on a smartphone. (Sergei Konkov/TASS via Getty Images)
Telegram’s Role in Distribution of Islamic State Instructional Material
Telegram’s internal file-sharing features and the company’s approach to its terms of service (ToS) have dramatically altered the methods that Islamic State supporters use to distribute instructional material. Previous academic studies on jihadis’ use of Telegram suggest a range of explanations for why it became their preferred platform for media distribution. These studies focus on networks within Telegram, the behavior of Telegram channel users, and the security features within Telegram available for its users.28 There is no doubt that these factors all have a substantial impact on why jihadis prefer Telegram, and in combination, they explain a great deal about the concentration of online jihadi activity on Telegram. To complement these works, it is important to also consider other critical functionalities available on Telegram and how use of specific digital communications tools drives users toward a specific platform and structure their use.
Telegram boasts file-sharing capabilities (within a channel, users can share an unlimited number of photos, videos, documents, audio messages, up to 1.5GB per file) that few other online messengers provide.29 By comparison, the previous preferred platform of Islamic State supporters, Twitter, only allows file-sharing up to 512MB and can only support image and video uploads.30 On other platforms, supporters interested in sharing jihadi material must share files externally using URLs. Some of these file-sharing platforms do not offer encryption, and external file-sharing increases the risk that outside parties can identify a user—not to mention that many external services are far less cavalier about enforcing takedowns and suspensions than Telegram.
Islamic State supporters who seek to distribute instructional material benefit from Telegram’s extensive file-sharing services in two substantial ways. First, unlike other sites, they can publish material in a variety of media formats, from .pdf files to photos, videos, documents, audio messages, and download links for computer and mobile phone applications.31 Supporters continue to share files through external URL links, however, these files can also be housed internally on Telegram. Strategically, supporters can use Telegram simply to send files to large groups of people, but Telegram also allows them to operate “clearinghouses” of material by storing the files on Telegram channels.
Compounding these factors, Telegram has been much slower than other companies to develop and implement ToS that target jihadi exploitation of file-sharing services. Telegram is generally reluctant to regulate extremist content on its platform, citing concerns about free speech and claiming that governments are inflating the threat of online extremist content.32 A 2016 joint proposal from the French Interior Ministry and German Federal Ministry of the Interior singled out Telegram for criticism due to the company’s lack of regulation and failure to cooperate with governments on counterterrorism investigations.33 Nevertheless, Telegram’s general orientation toward preserving user privacy and free speech has not completely precluded the company from suspending channels that they view as inciting violence. In October 2017, Telegram’s founder Pavel Durov wrote in a blog post regarding ToS enforcement, “the line is pretty straightforward … promoting violence and calling for actions that harm innocent people are not OK.”34 To this end, Telegram also maintains an “ISIS Watch” channel, in which it lists the number of channels it purportedly deletes for violating ToS in each day, week, and month.35
However, Telegram’s methodologies for determining which channels to delete are opaque. The research team observed that channels containing attack-planning guides tend to be removed or deleted at a faster rate than others. To account for this seemingly higher rate, channel administrators frequently create new channels, in some cases multiple at a time. For instance, during the six-month timeframe of this study, researchers collected at least 25 separate iterations of a channel that routinely distributed instructional material and incited violence.b Each channel appears to have started from a ‘seed’ of various .pdf manuals, photos, and videos that were re-posted from a master channel. From there, the administrator(s) updated content by posting on the master channel and re-posting to each channel.
Telegram has changed the landscape of instructional material distribution by developing a platform that combines extensive file-sharing capabilities in multiple file formats with lax regulation. Administrators of pro-Islamic State Telegram channels take advantage of the platform’s array of file compatibilities to distribute video, audio, document, and photo versions of instructional manuals. Not only does this media diversity optimize use for Islamic State supporters seeking to implement the instructions, but it also partially inoculates the material from detection by algorithms that are trained to only analyze one type of file for malicious content. As long as the company continues its approach to ToS development, supporters can easily store instructional material within Telegram channels with limited fear of takedowns or suspensions. In sum, these two medium-specific features have revolutionized the way that the Islamic State shares instructions with English-speaking supporters by diversifying the format and method of distribution.
Results: Instructional Material on Pro-Islamic State Telegram Channels
During a six-month timeframe between June and December 2017, researchers collected 98 channels36 whose primary purpose was the dissemination of instructional material in English.c These channels represent 16.2% of the Telegram channels collected by the Program on Extremism during the same timeframe.37 Analytical limitations include available resources and staff, the focus on English-language channels (which comprise only a small percentage of jihadi material released on Telegram), and coding during business hours (Monday-Friday, 0900-1700 EST).
For the 98 channels analyzed in this study, there was an average of 98.7 members per channel. Membership numbers ranged widely, with the most-followed channel boasting over 350 members. Across these channels, supporters shared over 7,560 photos, 536 videos, 300 audio messages, 8,243 files, and 689 URL links. Within these channels, three types of material were most prominent:d
Explosives construction: information and step-by-step instructions to synthesize explosive material, improvised explosive devices, and instructions for carrying out an attack using explosive devices
Low-tech attacks: information and guidance about conducting attacks that do not require explosive devices (knife attacks, vehicular assaults and rammings, arsons, train derailments, etc.)
Operational security and cybersecurity: information about avoiding detection while implementing a plot and reducing the risk of apprehension; instructions to avoid monitoring of online activity, including the installation of privacy-maximizing applications and services (virtual private networks, anonymous browsers, ‘self-destruct’ features, encrypted messaging and e-mail services, etc.)
Explosive construction
Of this material, the category that arguably poses the most immediate, high-impact threat is instructions for constructing explosive devices. Approximately half (45.9%) of the channels analyzed for this article contained this type of information. Many were different versions of similarly named channels, and two “brand names” were especially frequent. One series of channels contained instructional manuals for conducting terrorist attacks, using a variety of methods including stabbings, poisonings, and bombings.38 On December 6, 2017, an alleged administrator of this channel series, 31-year-old Husnain Rashid, was charged with terrorism offenses in the United Kingdom after allegedly inciting via Telegram supporters of the Islamic State to commit attacks there.39 In addition, there were several versions of a channel called that depicted itself as an information portal on “science projects” for children, perhaps to avoid detection and suspension for its concerning material. Its first post claims “the friendly lion wants to share knowledge to protect you and your ashbal [cubs] … in our first lesson [we] will show you how to prepare primary explosives. Use proper safety gear. Safety first!”40
Across the channels, there are instructions for synthesizing a variety of explosive compounds, including acetone peroxide (TATP), lead azide, potassium chlorate, C-4, TNT, xylitol petanitrate, nitroglycerin, picric acid, and pentaerythritol tetranitrate (PETN). On several channels, jihadis argue that TATP is the easiest for supporters to create—potentially explaining why recipes for TATP appear most frequently and why it is the compound of choice for dozens of militant groups.41 One recipe for TATP published by “Dr. Khateer” in one issue of Inspire magazine is frequently rebroadcast on pro-Islamic State Telegram channels in full.42 Channel administrators supplement this recipe, and others, with written instructions, photos, and videos from unnamed sources. In practice, however, Islamic State-inspired plotters with no offline training have found it difficult and dangerous to synthesize TATP—which many militants refer to as the ‘Mother of Satan’ because of its sensitivity—and even those who produce the explosive compound may not have been able to construct a device that actually works.e For example, an Islamic State-inspired jihadi failed to detonate a TATP-based explosive in the Gare Centrale in Brussels in June 2017 because of the shoddy preparation of the explosive.43 In September of the same year, the Parson’s Green Tube bomber in London was also unsuccessful in detonating a homemade TATP “bucket bomb,” possibly, according to authorities, because either the device had been improperly assembled or the TATP had been poorly made.44 While the cell responsible for the August 2017 attacks in Barcelona purchased precursor materials necessary to produce over 200 kilograms of TATP, during the synthetization process they blew up their own bomb factory, forcing them to abandon their bomb plot and launch vehicular attacks instead.45
Due to the lack of officially published bomb-making instructions in Islamic State propaganda, these channels usually compile instructions from various sources to add on to information available in previously released jihadi instructional materials. Administrators augment manuals from Inspire with multimedia content depicting user attempts to create explosive devices, as well as instructions from other sources. One channel, for example, re-posted a 1950s U.S. Army manual demonstrating the construction of a booby-trap using a grenade and tripwire. Another utilized a recipe for TNT, which it attained from a “disaster prepper” guide.
Low-tech attacks
Many of these same channels also contain instructions for more straightforward, lower-budget attacks that do not require the construction of an explosive device. They encourage would-be attackers to utilize any means at their disposal or, as one channel puts it in its description, “Trucks. Knives. Bombs. Whatever. It’s time for revenge.”46 In this context, it is far easier for channel administrators to remain within the boundaries of officially produced Islamic State material. The series “Just Terror Tactics,” which first appeared early in the publication run of Rumiyyah magazine, gives advice on several low-budget attacks, including knife attacks, hostage-taking, vehicular attacks, and arson.47
Supporters add to the instructions contained in the Just Terror Tactics series by crowd-sourcing advice and integrating other information, such as human body diagrams for melee attacks, tips on which vehicles to use for rammings, and comparing damage caused by various knives. Additionally, sympathizers distribute open-source instructions for the operation of various types of firearms, and marksmanship manuals to complement them. One channel provided instructions on setting up a home-made gun range for the purposes of training with firearms, claiming that going to a public range may elicit unwanted attention from authorities.
Some channels also distribute “operational playbooks,” based on successful low-tech attacks carried out by Islamic State supporters in the past. Intended to be learning guides for would-be attackers, these playbooks detail the training, planning, and attack strategies of now-infamous perpetrators like Omar Mateen, the 2016 Orlando Pulse Nightclub shooter, and Mohamed Lahouaiej-Bouhlel, who drove a cargo truck into a crowd in Nice, France, in 2016, killing 86 and wounding over 400.48 These playbooks represent a novel attempt to not only lionize the attackers and encourage similar plots, but also assist potential perpetrators in learning from the successes and failures of previous operatives.
Operational security and cybersecurity
While attack planning guides may be the most immediately concerning content shared by Islamic State supporters on Telegram channels, a separate category of material regarding operational security (OPSEC) is more common and can act as a force multiplier. OPSEC information is especially concerning as it assists a wide variety of supporters and operatives across the jihadi spectrum—not only would-be attackers, but also travelers, financiers, and others who provide material support. Additionally, OPSEC guides are more frequent on Telegram channels than attack manuals. In fact, over 70 percent of the surveyed channels had some information directing users in OPSEC measures. These guides include tips on how to avoid spies and government informants, conduct counter-surveillance, and acquire ingredients for attack plots without raising suspicion of law enforcement.
However, a large percentage of these channels also focus entirely on maximizing privacy and security while operating online. For example, a series of channels operates as an application portal, providing the user with a series of download links for various computer programs and mobile device applications. At first glance, there would appear to be nothing explicitly pro-Islamic State about the channel, except for its name and an initial declaration that states the allegiances of the channel administrator. On these channels, a variety of downloads are available, including anonymous browsers, virtual private networks (VPNs), encrypted email services, applications for mobile device security, and built-in account self-destruct features.
Cybersecurity instructions released by Islamic State supporters also include manuals for avoiding ToS enforcement on mainstream social media platforms, including Twitter and Facebook. By using these instructions, acolytes can create dozens of accounts, allowing them to quickly rebound from account suspensions and takedowns. They can use Telegram’s file-sharing services as a repository for videos and photos that major social media and file-sharing sites frequently remove for violating ToS, and re-upload videos to these sites ad infinitum as they are deleted. Recently, in the wake of efforts by social media providers to detect algorithmically the profiles and content of violent extremists, a new round of instructions focusing on how to avoid detection by these algorithms was distributed.49
Cybersecurity measures, which are additionally available on Telegram channels that do not contain English-language instructional material point to online supporters of jihadi movements operationalizing methods for avoiding content and account deletion from one platform to the next. Previous research by others on jihadi activity on Twitter and Facebook has observed homologous methodologies for the creation of dozens of accounts under a similar brand.50 Now, supporters use unique file-sharing features within Telegram to distribute material internally. Many of the Telegram channels that feature attack-planning guides, for example, encourage their followers to immediately download every file from the channel as soon as they join in the chance that the channel is taken down.
If adopted correctly by supporters, these guides may decrease the risk of detection for any English-speaking jihadi operative, regardless of whether they are planning an attack, attempting a financial transaction to support an organization, facilitating travel, or engaging in other illegal behavior. It is an ongoing demonstration of how jihadis adapt in the digital space, acting and reacting to efforts to disrupt their plots and networks.51 OPSEC and cybersecurity manuals, while not as potentially explosive as their attack-planning counterparts, may be more critical in understanding how Islamic State supporters worldwide conduct their operations.
Analysis: Impacts of Instructional Material on Countering the Islamic State in the West
Mass-casualty attack planning guides that are available online understandably perturb counterterrorism authorities in the West.52 However, access to instructional material does not always correlate with successful plots. Previous studies of online terrorist instructional material distinguish between techne, or having general information or knowledge about how to conduct an attack, and metis, having the hands-on training and expertise necessary to do so successfully.53 Online instructional material certainly made the techne of terrorist attacks more accessible, but there is no guarantee that readers will successfully fulfill the instructions. Nor is an online manual a substitute for direct, one-on-one training.54 Adding to strategic complications, security services worldwide are already aware of information contained in manuals and make significant efforts to detect and apprehend their potential benefactors.55
Due to this gap between techne and metis, the more unsettling instructional manuals distributed by Islamic State sympathizers on Telegram may not be attack-planning guides, but the scores of OPSEC and cybersecurity instructions that are frequently shared. These guides, which are more easily accessible, implementable, and create numerous barriers for law enforcement in tracking violent extremists online, communicate to supporters how to side-step attempts to monitor and detect their activities.56 While following their instructions may not directly result in casualties, the guides make it easier for attackers to plot attacks without having their plans disrupted, thus potentially increasing the risk of successful mass-casualty attacks. Operational security and cybersecurity instructions remain wide-spread and easier for supporters to carry out.
In addition, the availability of cybersecurity material on Telegram also hampers the fight against the Islamic State and other violent extremist groups online. Internal file-sharing allows Islamic State sympathizers relatively uninterrupted access to multimedia versions of instructional guides, which they can use to re-upload onto the surface web as tech companies attempt to regulate extremist content. The array of media (files, photos, videos, etc.) also decreases the chances that algorithmic indicators utilized by several social media providers can detect their content. Channel administrators frequently post information and application downloads that assist users in the proliferation of Facebook, Twitter, Google, and other accounts. By using these tools to create multiple accounts at once, Islamic State supporters can maintain a presence on mainstream websites and wither the impact of social media providers’ account suspension efforts. Even if one account is suspended, they have access to several more.
Conclusion
As the Islamic State continues to hemorrhage territory in Syria and Iraq, there is little optimism among law enforcement, security services, and analysts in the United States and Europe that the group will cease efforts to direct and inspire attacks in the West.57 Instructional material in English officially produced by the Islamic State is scant. Nevertheless, English-speaking Islamic State supporters on Telegram seemingly post whichever material aids the efforts of would-be attackers in English-speaking countries with little regard for its ideological sourcing. Telegram’s features make it possible for this demographic to diversify the formatting of instructional material by disseminating various media types and establishing a virtual “safe haven” from content removal policies on the surface web.
Therefore, the lack of officially produced, English-language Islamic State instructional material is not an indication that the group’s supporters will be uninterested in committing attacks in their home countries. Official and unofficial instructional materials distributed via Telegram directing followers toward low-tech attacks, cybersecurity, and operational security will likely have broad implications for Western counterterrorism authorities for years to come. CTC
Bennett Clifford is a research fellow at the Program on Extremism at George Washington University. Follow @_bCliff
Substantive Notes
[a] As a pertinent example, Omar Mateen, the perpetrator of the 2016 Pulse Nightclub shooting in Orlando, Florida, infamously pledged allegiances at various points in time to the Islamic State, then-al-Qa`ida affiliate Jabhat al-Nusra, and Hezbollah. See more broadly Thomas Hegghammer and Petter Nesser, “Assessing the Islamic State’s Commitment to Attacking the West,” Perspectives on Terrorism 9:4 (2015); Lorenzo Vidino, Francesco Marone, and Eva Entenmann, “Fear Thy Neighbor: Radicalization and Jihadist Attacks in the West,” Joint Program on Extremism, ICCT-The Hague, ISPI Report (2017); Paige Pascarelli, “Ideology À La Carte: Why Lone Actor Terrorists Choose and Fuse Ideologies,” Lawfare, October 2, 2016.
[b] According to this project’s methodology, multiple versions of a channel are considered separate channels, as they have different content and different background information (date created, number of followers, etc.).
[c] Some studies on jihadi use of Telegram distinguish between channels (with one poster/administrator) and chatrooms (with multiple posters). Using this delineation, the sample would still include 98 channels and zero chatrooms.
[d] For legal and ethical reasons, the author chooses not to re-post images, visual logs, links, or the exact names of currently active Telegram channels.
[e] By contrast, Islamic State-directed or trained operatives have successfully constructed and deployed TATP-based explosives, including the Paris, Brussels, and Manchester attackers. Rukmini Callimachi, “How ISIS Built the Machinery of Terror Under Europe’s Gaze,” New York Times, March 29, 2016; Rukmini Callimachi and Eric Schmitt, “Manchester Bomber Met With ISIS Unit in Libya, Officials Say,” New York Times, June 3, 2017.
[4] See, for example, Paula Cohen, “Encrypted Messaging App Telegram Says It’s Blocked ISIS-Related Channels,” CBS News, November 18, 2015; Joby Warrick, “The ‘app of choice’ for jihadists: ISIS seizes on internet tool to promote terror,” Washington Post, December 23, 2016; Rukmini Callimachi, “Not ‘Lone Wolves’ After All: How ISIS Guides World’s Terror Plots From Afar,” New York Times, February 4, 2017; Rebecca Tan, “Russia Wants to Stop Terrorists by Banning Their App of Choice. Good Luck,” Vox, June 30, 2017.
[6] Haroro J. Ingram, “Learning from ISIS’s Virtual Propaganda War for Western Muslims: A Comparison of Inspire and Dabiq,” in Maura Conway, Lee Jarvis, Orla Lehane, Stuart Macdonald, and Lella Nouri eds., Terrorists’ Use of the Internet: Assessment and Response (Amsterdam: IOS Press, 2017).
[8] Ibid.
[9] Reed and Ingram.
[10] Ibid.
[11] Ibid. The Islamic State has not published a new issue of Rumiyyah since its 13th issue, published in September 2017.
[13] Ibid.
[14] Bruce Hoffman, “Low-Tech Terrorism,” National Interest 130 (2014); Peter Neumann, “Don’t Follow the Money,” Foreign Affairs, June 13, 2017.
[16] Ibid.
[17] Maura Conway, Jodie Parker, and Sean Looney, “Online Jihadi Instructional Content: The Role of Magazines,” in Maura Conway, Lee Jarvis, Orla Lehane, Stuart Macdonald, and Lella Nouri eds., Terrorists’ Use of the Internet: Assessment and Response 136 (Amsterdam: IOS Press, 2017), pp. 182-193.
[18] Ibid.
[20] Reed and Ingram.
[21] Aaron Brantly, “Innovation and Adaptation in Jihadist Digital Security,” Survival 59:1 (2017).
[23] United States v. Dzhokhar Tsarnaev, Indictment, 2013, p. 7; “A Homegrown Threat: Islamist Extremist Plots in the United States,” Anti-Defamation League, 2018.
[25] Ibid.
[26] Ibid.
[27] Marshall McLuhan, Understanding Media: The Extensions of Man (New York: New American Library, 1964).
[28] See, for example, Prucha; Martyn Frampton, Nico Prucha, and Ali Fisher, “The New Netwar: Countering Extremism Online,” Policy Exchange, 2017; Mia Bloom, Hicham Tiflati, and John Horgan, “Navigating ISIS’s Preferred Platform: Telegram,” Terrorism and Political Violence (forthcoming); Laith Alkhouri and Alex Kassirer, “Tech for Jihad: Dissecting Jihadists Digital Toolbox,” Flashpoint, 2016; Anne Speckhard and Ahmet S. Yayla, “Telegram: The Mighty Application that ISIS Loves,” ICSVE Brief Report, May 9, 2017.
[29] “Shared Files and Fast Mute,” Telegram, February 1, 2015.
[30] “Upload Media,” Twitter Developer.
[31] “Shared Files and Fast Mute.”
[32] Markus Ra, “Don’t Shoot the Messenger,” Telegraph, March 27, 2017; Celestine Bohlen, “Does the Messaging Service Telegram Take Privacy Too Far?” New York Times, September 5, 2016.
[34] Pavel Durov, “Telegram and the Freedom of Speech,” Telegraph, October 29, 2017.
[35] “ISIS Watch,” Telegram channel.
[36] For more on the methodology used by the Program on Extremism to collect pro-Islamic State, English-language Telegram channels, see “About the PoE Telegram Tracker,” Program on Extremism, George Washington University.
[37] “Telegram Tracker-Fall 2017,” Program on Extremism, George Washington University.
[38] “Man accused of sharing Prince George photo ‘in terror guide,’” BBC, December 6, 2017.
[39] Ibid.
[40] Posts on Telegram channel collected by the research team and reviewed by the author, May 4, 2017.
[44] “Parsons Green attack: Iraqi teenager convicted over Tube bomb,” BBC, March 16, 2018; Ian Cobain, “Parsons Green bomb trial: teenager ‘trained to kill by Isis,’” Guardian, March 7, 2018.
[46] Posts on Telegram channel collected by the research team and reviewed by the author, August 4, 2017.
[47] Reed and Ingram.
[48] Posts on Telegram channel collected by the research team and reviewed by the author, July 18, 2017.
[49] See, for example, Sheera Frenkel, “Facebook Will Use Artificial Intelligence to Find Extremist Posts,” New York Times, June 15, 2017; Dave Lee, “UK Unveils Extremism Blocking Tool,” BBC, February 13, 2018.
[50] Audrey Alexander, “Digital Decay: Tracing Change Over Time Among English-Language Islamic State Sympathizers on Twitter,” Program on Extremism, George Washington University, 2017; J.M. Berger and Heather Perez, “The Islamic State’s Diminishing Returns on Twitter: How Suspensions Are Limiting the Social Networks of English-Speaking ISIS Supporters,” Program on Extremism, George Washington University, 2016; J.M. Berger and Jonathon Morgan, “The ISIS Twitter census: Defining and describing the population of ISIS supporters on Twitter,” Analysis Paper 20, The Brookings Project on U.S. Relations with the Islamic World, 2015.
[51] Brantly; Alkhouri and Alex Kassirer.
[52] Ibid.
[53] Michael Kenney, “Beyond the Internet: Metis, Techne, and the Limitations of Online Artifacts for Islamist Terrorists,” Terrorism and Political Violence 22:2 (2010); “The ISIS Tailspin of Terrorism,” The Grugq, November 16, 2017.
[54] Ibid.
[55] Ibid.
[57] Paul Cruickshank, “A View from the CT Foxhole: Nicholas Rasmussen, Former Director, National Counterterrorism Center,” CTC Sentinel 11:1 (2018); Peter Neumann, “ISIS and Terrorism in Europe- What Next?” ICSR, February 16, 2018.
