On November 21-22, 2019, the EU Internet Referral Unit (EU IRU)—a team inside the European Union’s law enforcement agency, Europol—and Telegram engaged in a serious disruption campaign against the Islamic State’s channels and groups on the platform.1 While there had been similar ‘days of action’ in the past, the campaign of November 2019 was far greater in scope and impact.2 Hundreds of channels associated with the Islamic State-affiliated Nashir News Agency disappeared and have yet to recover.3 In this interview, which was conducted on December 11, 2019, via Skype, CTC talks with a member of the EU IRU about this campaign, about the ongoing relationship with social media companies, and the continued challenge of combating terrorist content online. The official requested anonymity. Europol has reviewed this interview and approved its publication.
CTC: What exactly is Europol’s EU Internet Referral Unit? When was it founded? Was there an immediate cause that led to its founding?
Europol EU IRU Official: We set up the unit in July 2015. Within Europol, within the European Counter-Terrorism Centre (ECTC) of Europol, there was a capacity to monitor and analyze terrorist propaganda, meaning jihadist propaganda, since 2007. The scope was major jihadist groups, designated terrorist organizations. The reason for that was to have a better understanding of the threat picture, especially when it comes to the threat posed to Europe and European interests outside of Europe from these designated terrorist organizations. This was the case for some years, but then it became increasingly evident that we needed to build this capacity and also have a mandate for supporting member states with online investigations in the context of counterterrorism, plus engaging with online service providers in order to help them build their resilience against the dissemination of terrorist propaganda. So, this was the reason that the IRU was set up in 2015. And since day one, we started engaging with online service providers to flag terrorist content to them and find solutions on how to disrupt the dissemination of terrorist content online.
CTC: Were there certain social media platforms or companies that were more open to working with you from the beginning, and why do you think that was?
Europol EU IRU Official: Yeah, at that time, I recall that the bulk of the propaganda was on mainstream social media such as Twitter or Facebook. We prioritized these types of platforms to work together, and their response was very positive. We based this on a voluntary approach. So basically, we started our operations for monitoring terrorist content—meaning content that is branded, that is produced and disseminated by designated terrorist organizations—and by tracing this content across the internet, we were in a position to also flag [it] to online service providers. So, we started flagging this type of content to the social media companies, and we engaged in a discussion with them on how we can help them improve their internal operations so they can build some measures internally to prevent the exploitation of their platforms by terrorist organizations.
CTC: Were you asking them for anything in terms of help from their side, or was it mostly you providing information to them?
Europol EU IRU Official: Our starting point is a particular media file. We don’t look into particular accounts; we don’t look into profiles on Facebook or Twitter accounts. We start by detecting a new media file that is put on the internet by a designated terrorist organization, and whenever we are in a position to detect and collect this content, we collect the URLs and flag the URLs to the specific post to the social media companies. Another way we help them is to share some of our experiences in, let’s say, collecting visuals, logos, or markers that are used by designated terrorist organizations. We share these types of packages with them to help them understand how terrorist organizations use branding to become visible and spread their message to wider audiences.
CTC: Can you describe what a typical day looks like at the EU IRU?
Europol EU IRU Official: We are a team with people of many different backgrounds. We have the counterterrorism investigators; we have IT experts, communication experts, researchers with expertise in Islamic jurisprudence, and also in area studies. We also have linguists; we cover most of the European languages plus Arabic, Russian, and Turkish. So, we try to combine this set of skills in order to understand both the content of the message and the dissemination of the propaganda. We collect and analyze this information. There are then two lines of work. First, we support member states in their online investigations, so it’s like police work, it’s law enforcement work. Second, we also flag the content to the online service providers, with a request not to take down content but to review the content against their own terms of reference. Then it’s up to them to make the decision whether they act upon it or not.
CTC: A number of these companies weren’t always so open to acting. Why do you think there has been such a shift in culture in these social media companies more recently?4
Europol EU IRU Official: It was not just a shift in the understanding of social media companies, but it was a shift in the understanding of the whole international community looking at this specific issue that we cannot allow terrorist organizations to exploit publicly accessible social media and online service providers in order to promote their message, to plan their operations, to reach out to people for recruiting and financing purposes. This was crucial because we really tried to engage with the whole of the international community, not just the social media companies in doing our job. We did that in the framework of the EU Internet Forum, which was set up by the European Commission in late 2015 to facilitate this type of engagement. If I go back to this period that you mention, I can say that we have achieved at least the primary objective of restricting public access to this type of content. It’s increasingly more difficult for the average user to stumble upon terrorist content as they go [about] their day-to-day browsing of the internet. Back then, a Twitter user might have been following a popular hashtag and in his Twitter feed terrorist content popped up. We thought that this was problematic, and in our discussions with social media companies, everyone agreed.
Moving forward to today, terrorist content is, of course, still accessible on the internet. We never claimed that our job is to clean the internet of terrorist content, but our job is to try to identify who is behind that, to attribute the terrorist offenses to those who are behind the screens, and also to protect the general public.
CTC: So, on the social media side you’re concerned with limiting visibility. On the law enforcement side, do you only help with cases that member states come to you with, or do you proactively point them toward citizens or somebody who’s in their country that they should be looking at?
Europol EU IRU Official: When it comes to investigations, we support member states with publicly available information. We don’t have access to closed information. Member states need to use their legal instruments in order to request access to this type of information from the social media companies. So basically, if there’s an open investigation by member states and they get access to this type of content, they can come to us for further analysis. But we don’t have the legal basis to request social media companies to disclose any non-publicly available data to us.
CTC: So you’re collecting data, and if law enforcement of a member state comes to you through legitimate channels, you then have the ability to help.
Europol EU IRU Official: Exactly.
CTC: How do you deal with the support network or the ‘fanboys’ who are very much online? Do you see official releases and supporter releases as kind of the same thing as long as they’re branded, or do you deal with them differently?
Europol EU IRU Official: As long as it is branded, it is part of our concern, but of course we make a clear distinction because you cannot weigh an official statement or piece of propaganda the same way with a banner or something that is produced by a fanboy, which is not connected to jihadist media outlets. But we see this as a joint effort that has to be done by other stakeholders, by other participants in this work against terrorist content. So, we engage also with researchers; we have set up an advisor network. We try to share our experience but also to integrate the results of their research, and these discussions about how we deal with supporter-generated content is a critical issue because we see that sometimes content that is produced by just fanboys might hit the headlines, might be reproduced, and this distorts the terrorist threat assessment. It might be reproduced by people who inadvertently want to report on this content, but at the same time, they help in amplifying this content.
So, we work together with institutions, researchers, in order to raise awareness about these issues. For example, when we see that some journalists or researchers use the same hashtags [created by jihadi media outlets to promote their content] or part of a terrorist video clip to report on the terrorist content, we can see this as problematic because at the same time, you reproduce or you further spread this message. The point here is that unedited content or content that re-mediatizes the brand of the terrorist organization should not be circulated. Most professionals take a nuanced approach, but this is not always the case. So again, we have an extended network of stakeholders; we work with European institutions, with European Strategic Communication Network (ESCN), with the Radicalization Awareness Network (RAN), with the global research network that was set up by the Global Internet Forum to Counter Terrorism (GIFCT).
CTC: What surprised you most about how the Islamic State has used the internet as compared to other terrorist groups?
Europol EU IRU Official: The first thing that comes to my mind is their branding, how they were able to promote and maintain their branding. From a researcher’s point of view, from someone who is engaging with terrorist content, you see that IS had to put up with changes many times in the past. They had to change their narrative from the apocalyptic discourse, Dabiq and the end of days battle, and “remaining and expanding.” Then they lose territory, but still they remain relevant by continuously changing their narrative. They ask their supporters to remain steadfast and so on. For me, there were many missed opportunities. I would have expected the impact of them having to change the discourse so many times to have been more negative than it was. Because they were able to maintain the branding and basically create an online environment that took on its own life and was somehow disconnected from the reality on the ground, this was something that in my view was problematic and this is where we need to focus more.
CTC: When the Islamic State started to move to Telegram in late 2015, how did that impact your work?5
Europol EU IRU Official: As I said, we start our observations from tracing content. So, when they moved to Telegram, we tried to reach out to Telegram and explain the situation. We started flagging terrorist content to Telegram, and gradually we established a channel of communication and cooperation with Telegram. For tech companies, when they set up their own business, they don’t think about the exploitation of their platform by terrorists. So for many companies, not just for Telegram, the first step is to raise awareness about what’s happening on their platform and then start building trust with them. This is important, and that’s why we highlight the importance of voluntary cooperation, the importance of the public/private partnership. If I’m being honest, some of the online service providers that we try to engage with, their first reaction is why is a law enforcement agency asking me to review this type of content? What is behind that? Do you come with a legal mandate? Are you going to ask for more information? We [Europol] don’t have any enforcement powers there. Our legal mandate is to flag the content and then work together with them [social media companies] to raise awareness. Then it’s their own decision. This is also how it worked with Telegram.
CTC: There is a perception that Telegram was slow in the beginning to come to the table. What do you think the reason for that was?6
Europol EU IRU Official: I cannot say whether it was slow or fast, but it takes time until tech companies understand what the problem is. What is important is for us to maintain this type of communication, to establish regular communication, and try to engage and give the right answers to these companies. Not everyone wants to engage; in some cases, they’re not interested and then they don’t engage.
CTC: Why do you think that kind of shift happened for Telegram?
Europol EU IRU Official: I think it’s partly that they realized that they don’t need to put up anymore with this type of activity. No online service provider would have ever liked to put up with this type of activity. And if you see the joint press release that we have published on our website, in the aftermath of the Europol campaign, there’s also a quote from Telegram saying basically that enough is enough.7 They see this as their responsibility, to have a platform that is free of terrorist abuse.
CTC: Can you describe the November 2019 operation Europol coordinated with online communication platforms such as Telegram to take down Islamic State content?8
Europol EU IRU Official: This was part of our standard procedure in engaging with online service providers. We had already done a couple of, let’s say, actions together with Telegram in the past. We cover a large number of online service providers, not just Telegram. But at some point last year, we took some time to specifically look at Telegram. We did a joint action, and then we started building from that point on into trying to work closer together to map the network of core disseminators, so to speak, propagandists whose main business it is to disseminate this type of content. And this cooperation culminated with this type of action, but at the same time, we have been working together with law enforcement in member states in order to disrupt the internet operations of the Islamic state. In the past, we did some investigative work, and together with the prosecutors, we managed to cease some of the web assets (e.g., servers) that the Islamic State propagandists were using to store content [and] to communicate.
And these actions we saw as opportune [in their] timing. We did not merge the two actions, but wanted to have an impact by using the time factor there. So the prosecutors, member state investigators working on the investigative part, and then also content specialists, referral specialists, working with Telegram and other platforms to refer this type of content. This was a planned action, and we knew that if this went well, it would shake up the community of jihadist propagandists on Telegram.
And by disrupting their operations on Telegram, you create new opportunities [for those working on counterterrorism]. I mean, it was not that difficult to guess what they would try next. Of course, we don’t know everything, but there were already some indications from 2018 that they were willing to experiment with certain platforms. It was not a big surprise that they tried to go back and use some of these platforms. They, of course, experimented with some new platforms, but this creates a lot of opportunities [for those working on counterterrorism]. First of all, this creates a lot of disruption. Then it has an impact on the branding, because nobody’s sure who is creating the new channels, the new Nashir channels, the new Amaq channels, on each new platform. What is the message? We see now many messages that caution protagonists or sympathizers from using this or the other platform or using or following this or the other media outlet. So, there’s a clear impact on brand, and there’s also an opportunity to create new investigative leads.
So, what I’m saying here is that in the past, we worked on both the investigation/attribution and the referral aspects. But now we try to bridge the gap there. So, this is not the end of the story. This is the beginning of the story, and that’s why we really want to engage with the international community to put all of our efforts together to work both on prevention and attribution. By disrupting the jihadist networks on the internet, you contribute to prevention. This is what we’re trying to do here by doing referrals; by flagging this content in a timely manner to online service providers and by helping member states to investigate these networks, we try to bridge the gap that we’ve seen in the past between prevention and investigative work.
CTC: That part of it is especially interesting. Are you seeing social media companies being open to working with member states, and are you trying to serve as the bridge between those two?
Europol EU IRU Official: Yes, absolutely. And as I already mentioned, there’s now an understanding among social media companies that they shouldn’t put up with this type of exploitation. Again, this depends on the platform and on their relationship with investigators and prosecutors in member states. We see that some platforms are more willing than others to share additional information. This has nothing to do with freedom of speech. We are, of course, for the protection of freedom of speech and fundamental rights and the digital rights of citizens, but our focus is very targeted. And we see that companies start seeing this as another type of crime around which they have already been working with law enforcement, like banking fraud or child sexual exploitation. They’re willing to share more data because they see a benefit from disrupting these networks and bringing these people to justice.
CTC: The Europol press release mentioned that the November 2019 operation “was led by the Belgian Investigating Counter Terrorism Judge and the Belgian Federal Prosecutor’s Office, together with the Belgian Federal Judicial Police of East-Flanders.” And there is mention of “an arrest in Spain of an individual suspected of being part of the core disseminators of IS terrorist propaganda online.”9 What is the significance of mentioning these law enforcement agencies in the press release?
Europol EU IRU Official: This is related to the operational work. Member states were working together with us to seize some of the assets and create some investigative leads. This phase of the operation—I’m talking about the investigative part, not the referral part—was led by the Belgian prosecuting authorities, and the Belgian and the Spanish colleagues wanted to present a strong message that this is the way forward. All of us getting together, working together in order to attribute terrorist offenses to the perpetrators.
CTC: Some people say that what you and others are doing is basically just a game of cat and mouse—just chasing terrorists around the internet. They say that this is not a good use of law enforcement time and energy. How do you respond to that?
Europol EU IRU Official: I would like to go a few years back and compare the situation today with the situation back in 2014, 2015. I think it’s unfair to say that there’s no progress made in this respect. Now, I see that the focus is on this whack-a-mole game, but we’re talking about a steep decrease in terrorist propaganda output, especially high-profile items coming from the officially endorsed media outlets. Today, we’re talking about some networks of people who really want to exploit small- and medium-sized enterprises online to disseminate terrorist content and especially supporter-generated content. But this is limited. This is more limited than it used to be back in 2015, 2016. So, if we want to be fair, I think we have to give some credit to this effort, to the public/private partnership that has been put forward since that time and recognize that now we’re dealing with a different kind of problem. Of course, some people are dedicated disseminators and supporters of these organizations. The internet is an enabler; it’s not the root cause of terrorism. But we need to take some action because otherwise you just leave it open to whoever wants to exploit the situation.
CTC: Can you talk a little bit about the Islamic State media structure, what you noticed with their presence in Syria and Iraq versus Europe or North America? Were there core individuals everywhere, or was it centered in Syria and Iraq? And relatedly, how did the destruction of the physical caliphate impact the media environment and structure?
Europol EU IRU Official: This is a very difficult question. What I can say is that we think that there are different layers of the structure they have put forward to produce and disseminate content. At the peak of their activity, they have styled Amaq as like an independent news agency to report on the evolution on the ground in real time. At the same time, they had the officially endorsed media outlets. Then there was another layer of supporting media outlets; some of them pre-dated the advent of the Islamic state, and they pledged allegiance to the Islamic State. Some others were created to support the work of the Islamic State, but they, at the same time, produced their own content and disseminated their own content. And then in the third layer, there were sympathizers who were willing to create the supporter-generated content and disseminate it. So, we give different weights to these layers.
Also, at the peak of their activity, they used to have a very sophisticated campaign on the internet starting from sending out teasers about new releases, like about the magazines they were going to put out. This was what we thought of as the “seeding phase.” Then there was the “launch phase,” and then they had the “echo phase” in which they re-mediatized content in large volumes. This was a sophisticated campaign on their side when it comes to strategic communications, and this has also been the target of our operations. By doing that, and working together with member states and law enforcement, you come across valuable information, and I think that over the past years, member states, law enforcement, and judicial services have managed to disrupt part of this network and bring these people to justice. This is a continuous effort, a work in progress.
CTC: I’ve observed in my research how university students have helped translate material for the Islamic State and build banners and so on. To what degree are younger people joining the media apparatus post 2018/2019?10
Europol EU IRU Official: I’m afraid I cannot talk about the demographics because we don’t have any specific analysis on that. But, for us, it’s important to continue working with law enforcement and member states. They’re responsible for the investigations, and they’re responsible for dealing with those joining the terrorist organization in their effort to propagate their narratives. We also want to share our experience with other institutions. I mentioned, for example, the Radicalization Awareness Network because prevention is equally important. We are a counterterrorism center and we deal with counterterrorism, but I think that our experience is valuable for others who work on the prevention side. So, we try to engage, we try to share our experience and our knowledge, and we hope that the root causes of terrorism are addressed and that preventive work is done to stop people from resorting to this type of activity.
CTC: Is your team involved on the far-right side of things as well? There’s a lot of far-right activity on Telegram and other platforms. Are you also looking at that and other kind of ideologically inspired terrorist violence, or is it mostly focused on jihadi material?
Europol EU IRU Official: So far it has been mostly focused on jihadi terrorist propaganda. In some cases, we also supported member states in far-right terrorist cases. This is basically under discussion currently to see how Europol can further support this effort in other fields. Of course, there’s some similarities but also some differences when we talk about right-wing terrorist groups. So, we’re currently looking into that, to assess how we can better contribute to this effort. CTC
Citations
[1] “Europol and Telegram Take on Terrorist Propaganda Online,” Europol, November 25, 2019.
[2] “Europol disrupts Islamic State propaganda machine,” BBC Monitoring, November 25, 2019.
[3] Ibid. See also “Jihadists Presence Online Decentralizes After Telegram Ban,” Flashpoint, January 17, 2020; tracking of Islamic State-associated online content by the author (Amarnath Amarasingam).
[4] Jessica Stern and J.M. Berger, ISIS: The State of Terror (New York: Harper Collins, 2015), p. 134.
[6] For analysis of the Islamic State’s previous presence on Telegram, see Bennett Clifford, “‘Trucks, Knives, Bombs, Whatever’: Exploring Pro-Islamic State Instructional Material on Telegram,” CTC Sentinel 11:5 (2018); Bennett Clifford and Helen Powell, “Encrypted Extremism: Inside the English-Speaking Islamic State Ecosystem on Telegram,” George Washington University’s Program on Extremism, June 2019; Laurence Binder, “Wilayat Internet: ISIS’s Resilience Across the Internet and Social Media,” Bellingcat, September 1, 2017.
[7] Editor’s note: “Europol and Telegram Take on Terrorist Propaganda Online.”
[8] Ibid.; Paolo Zialcita, “Islamic State’s ‘Not Present on the Internet Anymore’ Following European Operation,” NPR, November 25, 2019.
