ISIS Strategy and the Twitter Jihadiscape

Analysis of 3.4 million tweets shows that the media mujahedeen through the Swarmcast are still able to achieve their strategic goals. These goals include maintaining a persistent presence through a multi-platform zeitgeist which is able to disseminate content to large numbers of internet users. This large-scale study contradicts the findings of some smaller studies of ISIS tactics, which relied on proxy metrics to produce the reassuring conclusion that account suspensions are degrading the ability of extremist groups, such as ISIS, to disseminate content.

One of the objectives set out as part of the Netwar in Cyberia Research Project is to produce a strategic-level assessment of the information environment in which extremist groups operate. This will allow an analysis of collective and emergent behaviors within complex information systems and the identification of factors which could influence the success of Public Diplomacy responses to Jihadist online content.

Using the data collection and analysis run by VORTEX, an Austrian government-funded research center at the University of Vienna, the different information environments—or Jihadiscapes—can be analyzed.

This video shows one such Jihadiscape, produced from four months of Twitter data. The dataset contains 3.4 million tweets, each of which contains one or more search terms in Arabic associated with Jihadist groups, including Jabhat al-Nusra, ISIS, their terms for the provinces in Syria, Iraq, Yemen, Saudi Arabia, Egypt, Libya and elsewhere, and their media foundations.

What the big data analysis and dynamic social network analysis show is how these Jihadist networks maintain a persistent presence by rolling with the account suspensions, continually replacing suspended accounts with new ones. This is in line with previous research, which concluded that the challenge is not disrupting the activity of individual members of the media-mujahedeen, but rather strategic approaches to disrupt the system-wide emerging structures and collective behaviors.

Deploying a strategic approach

Some journalists and commentators, for reasons best explained by them, have chosen to interpret the argument for a more strategic response as an argument for giving up, saying, for example: "[the] argument is the equivalent of saying we should not arrest criminals, because crime keeps coming back."  

In reality, resources are finite. A strategic-level response to the Swarmcast should focus those finite resources where they can have the greatest impact on the strategic goals of the adversary, rather than focusing on inconveniencing a small number of Twitter users, who are positioned to let other platforms take up the slack, have adapted to the current tactic of takedowns and are prepared for account suspension, and are in fact proud of their tally of suspensions. 

400,000 views of a single video post on a single platform, all occurring in just a few days, is a strong indication that users were being told through the Swarmcast where to find the video.

Opponents of a strategic approach have been claiming for over 18 months that Twitter suspensions have degraded the ability of ISIS to distribute content, claiming in part that reducing the number of followers an account has is evidence of success. Yet ISIS strategy (frequently overlooked, as it is circulated in Arabic) focuses on disseminating content rather than getting Twitter followers. As such, it is the ability to disseminate content at a strategic level rather than the tactical concerns of follower numbers which should be the focus of counter-measures.

How focusing on tactics rather than strategic-level analysis can lead to confusion

Concentrating on strategy focuses on what the adversary is attempting to achieve. Doing this helps prevent undue weight being given to proxy metrics for tactical activity.  

For example, a recent report claimed to show how suspensions were limiting the English-language ISIS network on Twitter. This claim was based on, in the report’s own terms, a single Twitter list which the report acknowledges “was not especially discriminating about determining if a list member supported ISIS.”  

Even if one were to accept a single, not very discriminating, Twitter list from an unknown user as the basis for research, the conclusions have problems due to the use of tactical-level proxy metrics rather than a strategic focus.  

The report states, for example:

“In a study of metrics for a network of English-language ISIS supporters active from June to October 2015, suspensions held the size and reach of the overall network flat, while devastating the reach of specific users who have been repeatedly targeted.”

If the reach is flat, but some accounts are suffering a devastating loss of followers, as stated, logic dictates that the remaining media mujahedeen accounts are still achieving the same reach as the network had previously. This is the inevitable logic of calculating basic (mean) averages of follower numbers.  In this instance, the report states reach remains flat, so it must be broadly inferred from this statement that the slack has been taken up elsewhere, either by a few other accounts increasing significantly or many other accounts increasingly slightly.

Using social network analysis could demonstrate how takedowns have influenced the strategic nature of the media mujahedeen network. Instead, the use of tactical-level proxy metrics means that ultimately, what is claimed as a tactical ‘success’ for account suspension is in fact a strategic failure.

ISIS dissemination continues despite the level of effort exerted to devastate the following of a few accounts. This elementary analysis using the report’s own terms highlights the dangers of focusing on tactical proxy metrics in an attempt to measure or infer strategic impact, and demonstrates why social networks need to be analyzed as such, rather than treated as a list disconnected individuals.

Successful content dissemination

As argued previously, large numbers of internet users choosing to click on links and view content is an indication of the impact of the ISIS multi-platform strategy.

Strategically, accessibility of content is the main focus. In the aftermath of the Paris 2 attacks, one video titled ‘No Respite’ was posted in multiple languages and was downloaded or viewed approximately half a million times on Archive.org alone. Despite claims of ISIS English-language distribution networks being disrupted, a single posting of the English version of ‘No Respite’ on Archive.org was viewed approximately 400,000 times.  

As the names of ISIS videos are fairly esoteric, just googling random phrases with no idea of the video title is unlikely to deliver the latest videos, and links are often equally obscure. 400,000 views of a single video post on a single platform, all occurring in just a few days, is a strong indication that users were being told through the Swarmcast where to find the video.

While some commentators still claim proxy metrics show that account suspensions are degrading the ability of extremist groups such as ISIS to disseminate content, the strategic-level analysis of 3.4 million tweets highlights one likely conclusion. Through the Swarmcast, the media mujahedeen are still able to achieve their strategic goals; disseminating content to large numbers of users and maintaining a persistent presence through a multi-platform zeitgeist.

Photo by Christiaan Colen I CC 2.0