Jihadist groups’ ability to build and maintain a large online community through social media is well known, as well as their capacity, growing out of a state of necessity or creativity, to be early adopters of new technologies. In this respect, the nexus between AI and jihadist communication strategies is no exception: over time, jihadist groups have proven they can get out the most even with basic notions of AI or lack of financial resources.
Social bots and jihad: different uses serving different purposes
Every day, bots are being used by jihadis, especially on Telegram,[i] for a wide variety of purposes.
The evolution of jihadists’ exploitation of social bots can be analyzed by relating some topic cases with the objectives bots were meant to fulfill in the jihadist landscape.
- Exploit users to expand the organization’s influence
In 2014, long before the stricter policy adoption on terrorist propaganda by social media platforms, Daesh spread its official app “Dawn of the Glad Tidings” also known as “Dawn.” It was an Arabic-language Twitter app, advertised by its top users as a way to keep up on the latest news about the jihadist group.[ii] As a result, thousands of their Twitter followers installed the app on the web or their Android phones through the Google Play store and, after releasing a fair amount of personal data and signing up, they allowed the app to post tweets from their accounts.[iii] Thus, Daesh was able to share, through thousands of accounts, simultaneously, content decided by its social-media operation branches, gaining a far larger online reach than only top users would otherwise allow.
- Instruct and inform a digital community
The “Bot Mujahideen” Telegram Channel[iv] worked as a centralized online interface meant to provide information on a wide range of topics related to jihad fighters in Syria.[v] It was launched in 2016 and, even though it stated it was “not affiliated with any organization and adheres to the path of the Sunnah and jihad,” the correspondence published on the channel indicated its support for Jabhat Fateh al-Sham (formerly Al-Nusra Front, which was identified with Al-Qaeda) and other jihad factions tied to the group.[vi]
The operative functions of the Bot Mujahideen were declined through the management of several other Telegram channels, called “rooms”. Each room was dedicated to a different issue (e.g. military, virtual markets, updates, etc.) and had over 1,000 members.
- Secure and enlarge the recruitment process
As reported by MEMRI, the pro-Al-Qaeda Jaysh Al-Malahim Al-Electronic Telegram channel, in July 2020, announced the beginning of a recruiting process for supporters with expertise in programming, “media raids,” film montage, hacking, translation, and graphic design. Those interested were directed to contact two Telegram bots.
Meanwhile, the pro-ISIS Basa’ir Da’wah Foundation, on Telegram, urged supporters specialized in graphic design, poetry, and religious studies, to join the foundation’s team by contacting its bot (Ghiras11bot) on the platform.[vii]
- Maintain the presence of digital archives widespread and permanent
Jihadist groups are also able to deploy bots designed to ensure access to digital archives of jihadi content produced by groups and media organizations.
In this context, a topical example regards Daesh’s largest digital archives, nicknamed by CTC and ISD the “Cloud Caliphate,”[viii] which held 97,706 folders and files, with more than 90,000 items in more than seven different languages.
This digital repository, which counted almost 10,000 unique visitors a month, curated a shared history of the movement while providing a way to continually replenish extremist content on the net.[ix]
One of the ways to reach the digital library was thorough a cluster of pro-IS accounts that led to the discovery of the “Cloud Caliphate” aided by the ‘TweetItBot’ on Telegram, which also allowed users to share links directly from Telegram to Twitter. Furthermore, researchers believe the cache was tied to a digital support group named Sarh al-Khilafah, which allegedly operated a Telegram bot tasked with disseminating portions of the cache, folder-by-folder, to assure its constant presence online.
- Keep in touch with supporters to encourage and improve terrorist attacks
Following the terrorist attack perpetrated with axes by two Palestinians in the Israeli city of Elad,[x] a Telegram channel, that supports Iran-backed militias, published a statement promising free weapons to residents of the West Bank willing to perpetrate terrorist attacks against Israel. The statement reads, “Do you live in the West Bank and want a rifle or a pistol? Please note, the weapons are free of charge. Contact us via the bot. We speak Arabic and English.”[xi] In this case, even though the statement did not include the address of the bot, there already were several known bots associated with the channel.
From AI basics to more complex jihadist social bots
The common denominator of the above-mentioned cases is the use of bots aimed to prevent setbacks[xii] by facilitating recruitment and propaganda, displaying jihadist groups’ defensive posture towards potential counter-terrorism measures.
But social bots have also the potential to help terrorist groups perpetrate active actions.
In this field, DoS or DDoS attacks,[xiii] already appealing to cybercriminals and other malicious actors, can be launched with very little effort and their performance has a relatively considerable impact. AI is likely to be exploited to make DoS or DDoS simpler, thanks to automating processes. For instance, machine learning algorithms[xiv] can be used to control the botnets behind the attack or enable them to identify vulnerable systems through sophisticated network reconnaissance.
In this respect, in 2016-2017, Daesh launched a series of DDoS attacks using a DDoS tool named “Caliphate Cannon.” These attacks were quite successful and targeted military, economic, and education infrastructures, displaying the seriousness of this threat and encouraging its hacking division to perpetrate similar attacks against online services.[xv]
Soon, jihadist groups could also rely on more sophisticated, open-source, language AI tools to generate new content and engage with users. As some studies highlighted, among others, open-source tools like GPT-2[xvi] could be used to post auto-generated commentary on current events, promote likeminded posts, overwhelm conversations on social media, or re-direct conversations online to match with jihadist ideological views. Using GPT-2, with existing auto-detection technology, is not always possible to distinguish human-generated extremist content from AI-generated extremist content.
Finally, AI could be used to expand one of the major aspects that allow terrorist groups, and their various support arms, to evolve online: supporter-to-supporter learning.[xvii] As jihadist supporters learn from each other’s methods or mistakes, the spread and development of social bots could exponentially increase, in numbers and efficiency, this emulation process from supporter-to-supporter to bot-to-supporter/supporter-to-bot learning.
[i] ISIS watch on Telegram claims that, only on June 22, 2022, 685 terrorist bots and channels has been banned and, since the beginning of June 2022, a total of 11387 terrorist bots and channels has been banned. https://t.me/ISISwatch/1049
[ii] Berger J.M. (June 16, 2014) How ISIS Games Twitter. The Atlantic. https://www.theatlantic.com/international/archive/2014/06/isis-iraq-twitter-social-media-strategy/372856/
[iii] Kingsley P. (June 23, 2014) Who is behind Isis’s terrifying online propaganda operation? The Guardian. https://www.theguardian.com/world/2014/jun/23/who-behind-isis-propaganda-operation-iraq
[iv] Antinori A. (April 10, 2017) The “Jihadi Wolf” Threat. Europol. https://www.europol.europa.eu/sites/default/files/documents/antinoria_thejihadiwolfthreat.pdf
[v] “On the profile of the channel it states that the channel expressed a “unique military jihadist collective program on the Telegram social network, as it is not affiliated with any organization and adheres to the path of the Sunnah and jihad”. In addition, it states that “the Bot is a complete jihadist library. Its membership is composed of unique groups that are supervised by mujahideen and experts in their fields”. @bot_mojahed2016_bot” ICT Cyber Desk (December 2016) Cyber-Terrorism Activities Report No. 19. International Institute for Counter-Terrorism (ICT).
[vi] Barak M. (February 12, 2017) The “Bot Mujahideen” Telegram Channel. International Institute for Counter-Terrorism (ICT). https://ict.org.il/the-bot-mujahideen-telegram-channel/
[vii] Stalinsky S., Sosnow R. (August 5, 2020) Jihadi Use Of Bots On The Encrypted Messaging Platform Telegram. MEMRI. https://www.memri.org/reports/jihadi-use-bots-encrypted-messaging-platform-telegram#_ednref13
[viii] Ayad M., Amarasingam A., Alexander A. (May 2021) The Cloud Caliphate: Archiving the Islamic State in Real-Time. Institute for Strategic Dialogue and Combating Terrorism Center at West Point. https://www.isdglobal.org/isd-publications/the-cloud-caliphate-archiving-the-islamic-state-in-real-time/
[ix] Silva S. (September 4, 2020) Islamic State: Giant library of group’s online propaganda discovered. BBC News. https://www.bbc.com/news/technology-54011034
[x] BBC (May 5, 2022) Elad attack: Three dead in central Israeli city. https://www.bbc.com/news/world-middle-east-61339751
[xi] MEMRI (May 8, 2022) Telegram Channel That Supports Iran-Backed Militias Offers Free Weapons To West Bank Residents To Perpetrate Terrorist Attacks. https://www.memri.org/jttm/telegram-channel-supports-iran-backed-militias-offers-free-weapons-west-bank-residents
[xii] Cox K., Marcellino W., Bellasio J., Ward A., Galai K., Meranto S., Persi Paoli G. (November 2018) Social Media in Africa – A Double-Edged Sword for Security and Development. United Nations Development Programme (UNDP) Regional Centre for Africa. https://www.rand.org/pubs/external_publications/EP67728.html
[xiii] Denial-of-service (DoS) attack is a denial of service attack. Distributed denial-of-service (DDoS) attack is where multiple systems target a single system with a DoS attack.
[xiv] Machine learning is a branch of AI and computer science which focuses on the use of data and algorithms to imitate the way that humans learn, gradually improving its accuracy. IBM https://www.ibm.com/cloud/learn/machine-learning
[xv] United Nations Interregional Crime and Justice Research Institute (UNICRI) and the United Nations Office of Counter-Terrorism (UNCCT) (2022) Algorithms And Terrorism: The Malicious Use Of Artificial Intelligence For Terrorist Purposes. https://unicri.it/News/Algorithms-Terrorism-Malicious-Use-Artificial-Intelligence-Terrorist-Purposes
[xvi]“GPT-2, an open-source unsupervised language model developed by Open AI that generates coherent paragraphs of text, performs reading comprehension, machine translation, question answering, and summarization without task-specific training.” Zeiger S., Gyte J. (November 2020) Prevention of Radicalization on Social Media and the Internet. HANDBOOK OF TERRORISM PREVENTION – Chapter 12. https://icct.nl/handbook-of-terrorism-prevention-and-preparedness/
[xvii] Ayad M., Amarasingam A., Alexander A. (May 2021) The Cloud Caliphate: Archiving the Islamic State in Real-Time. Institute for Strategic Dialogue and Combating Terrorism Center at West Point. https://www.isdglobal.org/isd-publications/the-cloud-caliphate-archiving-the-islamic-state-in-real-time/