United States Congress, Prepared testimony of Michael S. Smith II Terrorism Analyst Before the United States Senate Judiciary Committee Subcommittee on Crime and Terrorism Hearing titled "Extremist Content and Russian Disinformation Online: Working with Tech to Find Solutions" , October 31, 2017. Unclassified.

Prepared testimony of Michael S. Smith II Terrorism Analyst

Before the United States Senate Judiciary Committee Subcommittee on Crime and Terrorism

October 31, 2017

Hearing titled Extremist Content and Russian Disinformation Online: Working with Tech to Find Solutions

Chairman Graham, Ranking Member Whitehouse, Distinguished Subcommittee Members and Staff,

I am honored by the opportunity to participate in this hearing concerning one of the most pressing challenges for America's national security: The global influence operations being waged in the cyber domain by United States-designated Foreign Terrorist Organizations whose members have converted social media and file-sharing websites into tools used to incite violence against Americans and our allies. As Islamic State members and supporters have issued threats against me on social media platforms like Twitter, this issue is of both professional and personal interest to me.

Michael S. Smith II

Michael S. Smith II is a terrorism analyst who specializes in the influence operations of Salafi-Jihadist groups like al-Qa'ida and Islamic State. He is currently serving as an International Security Program Fellow at New America, where his research is focused on terrorists' exploitations of social media platforms to recruit and incite violence far beyond their primary areas of operation. In addition, he is pursuing a doctorate in Communication at Georgia State University, where his research foci include persuasion and terrorist propaganda produced to incite violence in the West. Mr. Smith received both his M.A. in Intelligence and Security Studies, with distinction and honors, and G.C. in Intelligence Analysis from The Citadel.

This testimony leverages both a report its author prepared for a closed briefing organized by Senator Lindsey Graham's office on September 13, 2017 that was attended by Senator Graham, Senator Sheldon Whitehouse and Senator Dianne Feinstein, and a chapter on Islamic State prepared by the author for publication in The Routledge Handbook on the International Relations of the Middle East (forthcoming).

OPINIONS EXPRESSED HEREIN DO NOT REFLECT THE VIEWS OF EITHER NEW AMERICA OR GEORGIA STATE UNIVERSITY.

# UNDETERRRED

Islamic State's Global
Online Recruitment *and*
Incitement Campaign

Prepared Testimony of Michael S. Smith II

For three years, Islamic State has used popular social media and file-sharing sites to wage the most aggressive and effective global recruitment and incitement campaign of any terrorist group in history. Since the group declared its so-called "caliphate," Islamic State "supporters" have executed more than a dozen attacks in the United States, Europe, Canada and Australia, with the damage, in aggregate, dwarfing that of the single attack in the West claimed by al-Qa'ida during this period. The surge of attacks executed in the West by individuals *not* trained in Islamic State's primary areas of operation indicates this terrorist group has achieved a power of persuasion sufficient to remotely accelerate the radicalization process culminating in a resort to violence. Meanwhile, American companies whose technologies have been used by Islamic State and other terrorist groups to expand their capabilities to recruit and incite violence have yet to develop countermeasures which effectively deter terrorists from continually exploiting their technologies. This situation highlights there is a need to do more to disrupt foreign terrorist groups' reach into our homeland through the cyber domain—a largely ungoverned space from which terrorists have mobilized attacks against Americans.

2 of 12

A View to Terrorists' Persistent Global Reach in the Cyber Domain

While Islamic State's online recruitment and incitement program has generated a surge of counterterrorism casework in the United States, it is important for policymakers to consider Islamic State is not the only terrorist group harnessing technologies made available by American companies like Twitter, Facebook and Alphabet to build and reinforce support while calling for attacks targeting Americans and our allies. Since 2014, al-Qa'ida has persisted with its exploitations of these companies' technologies to promote publications like Inspire and addresses by senior al-Qa'ida figures, which have included appeals for the group's sympathizers to execute attacks in the United States and elsewhere in the West. It is also important for policymakers to consider this phenomenon is not new—nor was it unforeseen.

Since 2014, Islamic State has taken the global engagement program in the cyber domain developed years earlier by American-born al-Qa'ida cleric Anwar al-Awlaki (d. 2011) to new heights. That program emphasized enhancing the ease of access to propaganda tailored to persuade would-be terrorists to execute attacks far beyond al-Qa'ida's primary areas of operation. Concurrently, for al-Qa'ida's sympathizers here in the West, that program enhanced the ease of access to actual group members like al-Awlaki, who could then engage in more direct efforts to persuade sympathizers to execute attacks targeting Americans and our allies.

Years before al-Awlaki converted a blog and increasingly popular social media and file-sharing technologies offered by Facebook and YouTube into tools used to help persuade sympathizers to execute attacks like the one at Fort Hood in 2009, policymakers and the public were warned this type of activity could emerge in the cyber domain. For example, during a 2004 House Armed Services Committee hearing focused on the important work of denying terrorists sanctuaries from which they may plan and manage attacks against the United States and our allies, Assistant Secretary of Defense Paul Wolfowitz warned about the potential of terrorist groups developing so-called "cyber sanctuaries."¹

Indeed, the emergence of large pro-Islamic State networks on American companies' social media platforms in the months following the declaration of the group's so-called "caliphate" in mid-2014 highlighted persistent deficiencies in strategic analysis against terrorist elements calling for attacks in the United States on the parts of American social media companies. By this time, the exploitation of these companies' technologies by terrorist groups calling for attacks targeting Americans and our allies was a years-old problem. Further, when Islamic State simultaneously declared its so-called "caliphate" and demanded members of all other groups like al-Qa'ida that have been striving to revive a caliphal model of governance pledge bayat (allegiance) to Abu Bakr al-Baghdadi, Twitter was a logical place for Islamic State to compete with al-Qa'ida for influence.² In the fall of 2014, the primary Twitter account used to promote addresses by al-Qa'ida's senior-most figures had a following

1. H.A.S.C. No. 108-36: Denying Terrorist Sanctuaries: Policy and Operational Implications for the U.S. Military: Hearing before the Committee on Armed Services, House of Representatives, 108th Cong, Testimony of Paul Wolfowitz, 2004. Retrieved July 12, 2017, http://commdocs.house.gov/committees/security/has223002.000/has223002_0.HTM
2. Public declaration of the "caliphate" in Abu Mohamed al-Adnani, This Is the Promise of Allah, Al-Furqan (Islamic State), Trans. Al-Hayat (Islamic State), June 29, 2014.

3 of 12

of more than 20,000 accounts.3 In addition, the account used by one of al-Qa'ida's senior-most figures active in the Syrian Jihad, Sanafi al-Nasr (d. 2015), a member of the so-called "Khorasan Group," had a following of more than 19,000 accounts.4 Since then, social media and file-sharing companies' increasingly-aggressive accounts suspension and content removal campaigns have failed to deter continued use of their technologies to encourage support for Islamic State.

In 2016, analysts at the National Counterterrorism Center reported Islamic State members and supporters demonstrated "particular affinity" for Twitter.5 The massive presence of Islamic State supporters on Twitter was highlighted in a February 2016 blog post by the company, in which Twitter reported more than 125,000 accounts had been suspended since mid-2015 "for threatening or promoting terrorist acts, primarily related to ISIS."6 Yet, as highlighted two months later in a Wall Street Journal report that covered some of my work tracking Islamic State's influence operation on Twitter, Islamic State members and supporters were not deterred by this suspension campaign.7 Instead, they were touting as credentials the number of times their accounts had been suspended, including the number in the handle for each successive account. As was also highlighted in this report, an Islamic State propagandist who had achieved prominence in the community of Islamic State supporters active on Twitter advised me the suspension campaign had the effect of increasing his determination to exploit Twitter's technologies in furtherance of Islamic State's agenda.

Whereas managers of popular pro-Islamic State Twitter accounts could attract more than 10,000 followers in 2015, during the past year, Twitter's expanded efforts identifying and suspending clusters of accounts used to promote Islamic State propaganda and amplify incitement-focused narratives therein has substantially reduced the lifespans of most accounts used for such purposes. Since then, officials like Michael Lumpkin, who served as director of the State Department's Global Engagement Center, have painted dubitable pictures of a reduction in Islamic State's online influence capacity.8 Indeed, it is unlikely managers of most accounts used to identify and initiate contact with prospective recruits who may eventually be mobilized to execute attacks in the West will tweet hashtags used to advertise Islamic State propaganda, or amplify the group's calls for attacks here. Engaging in these activities that may easily be tracked on social media sites could expose their pursuits of more important objectives than merely promoting Islamic State propaganda on Twitter, such as identifying prospective recruits who can help operationalize attack plots in the West.

3. Screenshots in Michael S. Smith II, Social Media Jihad, Presentation delivered during the National Sheriffs' Association's NC-SC Counterterrorism Conference, North Charleston, SC, February 15-17, 2016, Slide 22, http://kronosadvisory.com/nc.sc.ct.conf.socialmediajihadpresentationremarks.pdf
4. Ibid.
5. NCTC, Counterterrorism Calendar, 2016, p. 8.
6. Twitter Inc., "Combating Violent Extremism," February 5, 2016, Retrieved July 7, 2017, https://blog.twitter.com/official/en_us/a/2016/combating-violent-extremism.html
7. Christopher S. Stewart & Mark Maremont, "Twitter and ISIS Deadlock on Social Media Battlefield," The Wall Street Journal, April 13, 2016.
8. For example, See Lumpkin in Bradley Klapper, "AP: Islamic State's Twitter traffic drops amid US Efforts," The Associated Press, July 9, 2016, Retrieved July 12, 2017, http://www.bigstory.ap.org/article/21c9eb68e6294bdfa0a099a0632b8056/ap-exclusive-islamic-states-twitter-traffic-plunges

4 of 12

Other notable deficiencies are evinced by policies of Alphabet. Despite events of recent years highlighting an increase in threats to global security posed by Salafi-Jihadist groups like al-Qa'ida and Islamic State, Alphabet has permitted publication and distribution of videos containing guidance provided by Salafi-Jihadist clerics like Anwar al-Awlaki via YouTube and Google Drive. While al-Awlaki is a name many Americans are familiar with, they are less familiar with the name Turki al-Bin'ali, a senior-most Islamic State cleric who was killed earlier this year. Like videos featuring guidance from al-Awlaki, videos featuring guidance from al-Bin'ali also remain easy to find on YouTube. A basic search on YouTube for al-Bin'ali (in Arabic) will direct interested parties to this content.

Whether focused on such seemingly banal topics as appropriate attire for female Muslims,9 or important topics in Islamic history like the jihad waged by the Salaf (first three generations of Muslims) as they rapidly transformed the original Islamic state established by the Prophet Mohamed and his companions into one of the largest empires in world history,10 or the blessings in the afterlife bestowed upon Muslims who die while fighting to "defend" their faith,11 these videos help generate buy-in for Salafiyya Jihadiyya. Salafiyya Jihadiyya is the ideology which informs the agendas of al-Qa'ida, Islamic State and other terrorist groups comprising the Global Jihad movement. Participants in this movement self-identify as Sunni Muslims and claim to be striving to revive the "pure" faith vis-à-vis restoration of the caliphate, which has throughout Sunni Islam's history been viewed as a symbol of the faith's practice par excellence. For adherents of this intensely orthopraxic ideology, faith is demonstrated by actions. Chief among the actions prescribed by proponents of Salafiyya Jihadiyya is jihad, or what we call terrorism.

According to the director of Alphabet's think tank, Jigsaw, if videos featuring guidance from Salafi-Jihadist clerics like al-Awlaki do not contain explicit threats of violence or hate speech, they do not violate Alphabet's policies. Clearly, experts in "countering violent extremism" employed by Alphabet have failed to consider the following: The ideology these materials are used to generate buy-in for imbues adherents with a sense of urgency to "defend" their faith vis-à-vis support for

9. Anwar al-Awlaki, Why is Hijab only for women?, Published by manager(s) of YouTube channel titled MuslimPreachers on May 8, 2012, Viewed more than 40,000 times when retrieved on July 8, 2017, https://www.youtube.com/watch?v=gv0_wMIA9Fk Screenshot archived by Michael S. Smith II at DOWNRANGE, https://insidethejihad.com/wp-content/uploads/2017/10/Screen-Shot-2017-07-08-at-9.48.35-AM.png See also clip of al-Awlaki's guidance for women (2:05-2:39) in Women In Islam—A Message To All Women, Published by manager(s) of YouTube channel titled The Daily Reminder on February 4, 2013, Viewed more than 170,000 times when retrieved on July 8, 2017, https://www.youtube.com/watch?v=UOqRHYCMozg
10. Anwar al-Awlaki, Was Islam Spread By The Sword?, Published by manager(s) of YouTube channel titled MABaig1989 on October 12, 2011, Viewed more than 47,000 times when retrieved on July 8, 2017, https://www.youtube.com/watch?v=xitklrUvyZ8 Screenshot archived by Michael S. Smith II at DOWNRANGE, https://insidethejihad.com/wp-content/uploads/2017/10/Screen-Shot-2017-07-08-at-9.46.38-AM.png
11. Anwar al-Awlaki, One of the Prophet's Scariest Dreams, Published by manager(s) of YouTube channel titled Companions Of Prophets on October 22, 2014. Viewed more than 427,000 times when retrieved on July 8, 2017, https://www.youtube.com/watch?v=4r_scr14SLU Screenshot archived by Michael S. Smith II at DOWNRANGE, https://insidethejihad.com/wp-content/uploads/2017/10/Screen-Shot-2017-07-08-at-9.24.32-AM.png

5 of 12 terrorism campaigns waged against Americans and our allies. Presently, YouTube and other popular American file-sharing sites like Google Drive, as well as Internet Archive (Archive.org), a United States-based nonprofit organizations that hosts one of the Internet's largest digital libraries, remain preferred tools for distribution of Islamic State propaganda. From Google Drive and Archive.org, Islamic State supporters can do more than just consume this propaganda; they may also download copies, and then help to further proliferate Islamic State videos by posting additional copies at popular sites like YouTube once other copies are removed.

Islamic State's Propaganda Machine: Shaping Perceptions to Influence Behaviors

Islamic State has more aggressively utilized social media platforms and file-sharing websites to achieve global broadcasting capabilities for its propaganda than any other terrorist groups active today. All of this material is carefully produced to engineer a variety of perceptions of Islamic State within three key segments of its global audience whose members' behaviors the group seeks to influence: Acquired supporters, prospective recruits, and enemies whom Islamic State seeks to terrorize. For acquired and prospective supporters, Islamic State propaganda is tailored to build perceptions of the group as being worthy of support by emphasizing such themes as strength and durability. Often by way of omission of information concerning setbacks encountered by the group, this propaganda is used to portray Islamic State as a group that is successfully combatting its better-equipped and technologically-superior enemies. For acquired and prospective supporters, this enhances the perceptibility of Islamic State's bold effort to revive the caliphate as being a manifestation of divine providence. Ultimately, such perceptions enable Islamic State to persuade certain consumers of its propaganda to engage in a variety of actions in furtherance of its agenda, such as executing attacks here in the West. Each day, the torrent of newly-produced Islamic State propaganda distributed online typically consists of more than a dozen spot reports—including claims for attacks in the Levant and beyond—sitreps from battle zones, photo packets, and videos of varying lengths. These materials are produced by not only Islamic State's Amaq Agency "news service," but also media offices belonging to the group's 35 wilayat (provinces), 16 of which, according to an Islamic State video highlighting the structure of the "caliphate," are located beyond Iraq and Syria.12 In addition to the group's daily distribution of propaganda pieces documenting Islamic State members' activities in jihad theaters spanning from West Africa to the Philippines, along with pleasantries of daily life in the "caliphate," other official propaganda continues to be produced at a higher frequency than the group's lengthy videos featuring staged executions and calls for attacks in the West. An important example being Islamic State's weekly Arabic-language newspaper, al-Naba. Given that Islamic State has claimed responsibility for more attacks than any other terrorist group since 2014—with its Amaq Agency news service reporting Islamic State members executed more than 1,100 suicide bombings in Iraq and Syria alone during 201613—the group's propaganda is

12. The Structure of the Khilafah, Al-Furqan (Islamic State), July 2016.
13. Amaq Agency infographic, archived by Michael S. Smith II at DOWNRANGE, https://insidethejihad.com/wp-content/uploads/2017/04/Screen-Shot-2017-01-16-at-10.24.47-PM-copy.png

6 of 12

also used to portray Islamic State as the most dedicated and competent threat to the United States and its allies of all Salafi-Jihadist groups who share the goal of reviving a caliphal model of governance, including al-Qa'ida under its current leadership. Another aspect of Islamic State's efforts to outbid al-Qa'ida and other Salafi-Jihadist groups for support entails portraying al-Qa'ida's current leaders and al-Qa'ida-affiliated clerics like Abu Mohamed al-Maqdisi (based in Jordan) as hypocrites who have deviated from Usama bin Ladin's manhaj (methodology).14 Also in its official propaganda, Islamic State has claimed it is stewarding the jihad charted by bin Ladin, in which attacks targeting Americans were important tools used to endear al-Qa'ida to some residents of the Muslim world whose worldviews have been shaped by longstanding grievances concerning "unslamic" Western influence in so-called "historically Muslim lands."15 In relation to Islamic State's efforts engineering and then leveraging perceptions of its leadership status within the Global Jihad movement to persuade a resort to violence among supporters here in the West, it is also important to consider that, in claiming to have achieved al-Qa'ida's chief goal of reviving the caliphate, Islamic State has literally been peddling utopia—not just opportunities to support terrorism campaigns intended to establish conditions which, according to al-Qa'ida's leaders, will eventually make it possible for the caliphate to be restored.

Meanwhile, unlike members of many entities which have been designated as terrorist organizations by the United States and our allies, Islamic State members have explicitly defined themselves as terrorists within the group's official propaganda. For example, in the video titled "Kill Them Wherever You Find Them" that features missives from several participants in the November 2015 Paris attacks, Abdelhamid Abaaoud (d. 2015), who helped guide this and earlier plots in Europe advises (emphasis added): "So if you have sent your 'Hunter' fighter jets to bomb the Muslims, then know that the Islamic State has sent to you 'hunters' who thirst for the blood of the disbelievers, hunters who will not hesitate to slaughter you. For we are terrorists."16 Islamic State has also explicitly embraced its status as a terrorist group in other ways. Notably, in the fourteenth issue of Islamic State's flagship online English-language publication, Dabiq, the group asserted such expressions as "Terrorism is not Islam" and "Terrorism has no religion" should be viewed as "slogans of apostasy."17 In other words, according to the group's takfirist logic, Muslims who deny Islamic State's terrorism campaigns reflect adherence to their professed faith and early traditions of the "faithful" are themselves legitimate targets for attacks.18

14. In an April 2014 address, then ISIS spokesman Abu Mohamed al-Adnani, who rebranded the group as Islamic State when he declared its "caliphate" in June 2014, argued al-Qa'ida's leadership had deviated from bin Ladin's manhaj, and al-Qa'ida is no longer the "base of jihad" (This Is Not Our Manhaj, Nor Will It Ever Be, Al-Furqan (Islamic State), April 17, 2014). This address was later cited in an article published in Dabiq 7, Al-Hayat (Islamic State), February 2015, p. 25. More recently, in Islamic State's publication Rumiyah, which has replaced Dabiq in the group's propaganda products mix, the vociferously anti-Semitic group referred to al-Qa'ida's current leader, Ayman al-Zawahiri, and his friend al-Maqdisi as "Jews of Jihad" (Rumiyah 8, Al-Hayat (Islamic State), April 2017, pp. 42-43).
15. Dabiq 7, February 2015, p. 25.
16. Kill Them Wherever You Find Them, Al-Hayat (Islamic State), January 2016.
17. Dabiq 14, April 2016, p. 14.
18. Takfir is the contentious practice that entails accusations of apostasy, which may warrant capital punishment.

7 of 12

Indeed, it is important for policymakers to consider that, by fashioning theirs as a terrorist group, even if denied capabilities to govern, Islamic State's leaders could preserve the perceptibility of the group as a legitimate enterprise that is worthy of continued support. If, that is, group members continue executing attacks in the Muslim world, while persuading individuals not trained by the group to do the same here in the West.

Furthermore, while increased pressure on the group in Iraq, Syria and other areas appears to be degrading its capabilities to produce the volume of propaganda distributed in previous years, it is a risk to public safety for counterterrorism practitioners to equate a slowdown in production of Islamic State propaganda with a reduction in the group's influence capacity here in the West.

The Push for Attacks in the United States, Europe, Canada and Australia

Since 2014, the following has been among the most prominent sets of narratives echoed throughout the torrent of propaganda materials distributed online by Islamic State that have been tailored for audiences here in the West: According to religious texts and traditions, all Sunni Muslims are obligated to pledge allegiance to the so-called "caliph," Abu Bakr al-Baghdadi. Yet one's allegiance is not affirmed by mere words. Instead, allegiance to al-Baghdadi is demonstrated with actions: Either emigrating into the so-called "caliphate" to help the group defend and expand its territorial holdings, or executing attacks at home. In May 2015, al-Baghdadi converted this narratives set already echoed throughout Islamic State propaganda into an official set of directives issued by the group's so-called Emir al-Muminin (Commander of the Faithful, a title historically reserved for caliphs that reflects their superior rank over all Muslims): "And we call upon every Muslim in every place to perform hijrah [emigrate] to the Islamic State or fight in his land wherever that may be."19

That Islamic State's original spokesman, Abu Mohamed al-Adnani (d. 2016), was simultaneously managing the group's "external operations" when he publicly declared Islamic State had established a "caliphate" in June 2014 indicated terrorism campaigns beyond Iraq and Syria would factor importantly in the group's work shaping perceptions of it. So too did the contents of an address by al-Adnani that was distributed online in September 2014, in which he called for attacks in Europe, the United States, Canada and Australia—targeting police, intelligence and security personnel, as well as civilians.20 Weeks later, in the issue of Dabiq published in October 2014, the group advised, "it is very important that attacks take place in every country that has entered into the alliance against the Islamic State, especially the US, UK, France, Australia, and Germany. ... the citizens of crusader nations should be targeted wherever they can be found."21 The contents of this article also indicated spilling the blood of Westerners is viewed by Islamic State leaders as a credential that can help the group outbid al-Qa'ida for support. Therein, the group advised it is imperative that such attacks be firmly attributed to Islamic State: "Every Muslim should get out of his house, find a crusader, and kill him. It is important that the

19. Abu Bakr al-Baghdadi, March Forth Whether Light or Heavy, Al-Furqan (Islamic State), Trans. Al-Hayat (Islamic State), May 14, 2015.
20. Abu Mohamed al-Adnani, Indeed Your Lord Is Ever Watchful, Al-Furqan (Islamic State), Trans. Al-Hayat (Islamic State), September 21, 2014.
21. Dabiq 4, October 2014, p. 44.

8 of 12

killing becomes attributed to patrons of the Islamic State who have obeyed its leadership. ... Otherwise, crusader media makes such attacks appear to be random killings."22 During the past two years, in propaganda tailored to support Islamic State's courtship of would-be terrorists in the West, the group has emphasized the importance of executing attacks at home versus attempting to emigrate into the "caliphate." While calling on Islamic State supporters in the United States and Europe to execute attacks at home in his 2016 Ramadan address, al-Adnani advised the smallest acts against so-called "disbelievers" in Europe and the United States are "more beloved" to the group's leadership than the work underway in the "caliphate." Posted to popular file-sharing sites like YouTube and aggressively promoted on Twitter with a hashtag campaign,23 this address preceded a spate of attacks perpetrated by Islamic State supporters in the West during Ramadan—beginning with the attack at Pulse nightclub in Orlando, Florida. In addition to petitioning for attacks in the West, Islamic State propaganda has been used to devolve directions concerning ideal targets for attacks here, along with guidance concerning weaponry for use in these attacks, such as cars, large trucks and knives.24 Like al-Qa'ida, Islamic State has also used its propaganda to transfer to would-be terrorists in the West knowledge of how to produce explosives for use in mass-casualty attacks. For example, in a video produced by the Raqqaq wilayah media office that was distributed online in November 2016—a single copy of which containing English subtitles was viewed on YouTube more than 1,100 times before it was removed25—Islamic State provided a demonstration of how to produce an explosive known as "white ice."26 Various major news organizations have reported British authorities believe the Islamic State supporter responsible for the May 2017 attack in Manchester targeting attendees of a pop music concert may have gathered information about how to develop the bomb he detonated by watching a video posted to YouTube. As children were targeted in this second Islamic State attack in Europe targeting attendees of a concert performed by American musicians (the first being the concert targeted during the November 2015 Paris attacks), it is useful to consider, in the months prior to the Manchester attack, Islamic State had increasingly incorporated images of children injured and killed in strikes targeting the group within its propaganda to encourage supporters to execute retributive attacks.27 More

22. Ibid.
23. Screenshots and discussion in Michael S. Smith II, Social Media Jihad 2.0: Inside ISIS' Global Recruitment and Incitement Campaign, New America, January 18, 2017, 20:10. Footage viewable at https://www.newamerica.org/international-security/events/social-media-jihad-20/
24. See Abu Mohamed al-Adnani, Indeed Your Lord Is Ever Watchful, Al-Furqan (Islamic State), Trans. Al-Hayat (Islamic State), September 21, 2014. See also Rumiyah 3, November 2016, pp. 10-12. See also the truck attack instructions provided in Rumiyah repurposed in the video We Will Surely Guide Them To Our Ways, Ninawah Wilayah Media Office (Islamic State), May 2017, Screenshot of video posted to YouTube on date of release archived by Michael S. Smith II at DOWNRANGE, https://insidethejihad.com/wp-content/uploads/2017/09/Screen-Shot-2017-05-17-at-11.51.46-AM-copy.png
25. Screenshot archived by Michael S. Smith II at DOWNRANGE, https://insidethejihad.com/wp-content/uploads/2017/09/Screen-Shot-2016-11-26-at-2.01.45-PM-copy.png
26. You Must Fight Them O Muwahid, Ar-Raqqah Wilayah Media Office (Islamic State), November 26, 2016.
27. Screenshots and discussion in Michael S. Smith II, Social Media Jihad 2.0: Inside ISIS' Global Recruitment and Incitement Campaign, New America, January 18, 2017, 35:35.

9 of 12

recently, children injured and killed in strikes targeting Islamic State members in the group's "capital" of Raqqa were used as props in a video distributed on July 3, 2017 that featured an Australian Islamic State physician encouraging the group's sympathizers in the United States to execute attacks.28 A single copy of this video produced to incite retributive attacks in the United States was viewed more than 900 times on YouTube within hours of its release.29

Functionally, Islamic State propaganda is used for other important purposes. Notably, gruesome spectacles in high-production quality videos documenting executions of Islamic State's prisoners can be used as tools to psychologically condition would-be terrorists who may require repeated exposure to graphic scenes of violence to develop comfort levels sufficient to prepare them to perpetrate similar violent crimes. An important example being the aforementioned video containing a demonstration of how to produce an explosive, which also contained both calls for attacks in the West and a gruesome, lengthy demonstration of how to kill using knives.30 This video was distributed using popular file-sharing sites two days before the sixth attack in the United States explicitly claimed by Islamic State, which occurred on The Ohio State University's campus and entailed use of a car and a knife as weapons. As noted, within hours of its release, a single copy of this video published at YouTube was viewed more than 1,100 times.31

I assess Islamic State continues incorporating scenes of children executing the group's prisoners in its propaganda to highlight for "fence sitters"—in other words, those who have yet to demonstrate their allegiance to Islamic State's leader by either emigrating into the "caliphate," or executing attacks at home—how easy it is to execute the simple attacks in the West called for by the group. A notable example being a video distributed using popular file-sharing sites like YouTube and Google Drive in January 2017 that contains scenes of a toddler executing a prisoner by shooting him in the head.32 More recently, in July 2017, the group distributed a video using these same file-sharing websites that featured more graphic scenes of prepubescent boys beheading Islamic State prisoners.33 Much like the omission of setbacks encountered by the group in most of its propaganda, use of children in propaganda may dually help engineer the perceptibility of Islamic State as a durable enterprise—one capable of challenging so-called "apostate" governments of the Middle East and their allies in the West for generations to come.

Social Media: A Tool Used to Expand Terrorists' Capabilities to Threaten Americans and Our Allies

In addition to being used as broadcast tools for links to propaganda published at sites like YouTube, social media sites like the one managed by Twitter have been used by Islamic State members

28. Fertile Nation, 2, Ar-Raqqah Wilayah Media Office (Islamic State), July 2017.
29. Screenshot archived by Michael S. Smith II at DOWNRANGE, https://insidethejihad.com/wp-content/uploads/2017/09/Screen-Shot-2017-07-03-at-8.11.37-PM-copy.png
30. You Must Fight Them O Muwahid, Ar-Raqqah Wilayah Media Office (Islamic State), November 2016.
31. Screenshots and discussion in Michael S. Smith II, Social Media Jihad 2.0: Inside ISIS' Global Recruitment and Incitement Campaign, New America, January 18, 2017, 31:30.
32. Ibid, 34:40.
33. They Left Their Beds Empty, Jazirah Wilayah Media Office (Islamic State), July 2017.

10 of 12

to network with people who may be remotely groomed to execute attacks here in the West, or help promote hit lists containing targets for attacks. This can easily be accomplished on social media platforms when prospective recruits retweet, like, favorite, as well as make favorable comments about postings containing both links to and excerpts of not only Islamic State propaganda, but also materials produced by other Salafi-Jihadist elements which express similar aspirations and grievances concerning Western influence in the Muslim world. For example, Islamic State recruiters like Sally Jones, a British national designated a specially-designated global terrorist by the United States, have used Twitter accounts to promote materials by Anwar al-Awlaki,³⁴ whose mantle, much like that of Usama bin Ladin, has been appropriated by Islamic State in official propaganda.³⁵ Here, it is important to consider it has likely been easy for Islamic State recruiters to draw enthusiasts of al-Awlaki's guidance residing in the West into Islamic State's sphere of influence. Because, unlike al-Qa'ida, which has historically been selective about who may join its ranks, Islamic State is calling for all Sunni Muslims to join it. Islamic State recruiters like Jones' late husband, Junaid Hussain (d. 2015), have also used social media accounts to advertise their contact information on user-friendly, end-to-end encrypted texting apps, such as Telegram Messenger.³⁶ Hussain was an infamous British hacker turned terrorist whose hand was evident in several successful and failed attacks in the United States. Among these was the second attack in the homeland claimed by Islamic State, which targeted participants in a Prophet Mohamed cartoon drawing contest hosted in Garland, Texas in May 2015.³⁷ Following this attack, Islamic State provided further encouragement for its supporters to use social media to demonstrate their support for the group by publishing in Dabiq a screenshot of a tweet by one of the terrorists responsible for the Garland attack.³⁸ In this tweet posted just before the attack, Nadir Soofi advised both he and the other terrorist responsible for this attack had pledged allegiance to al-Baghdadi. As FBI officials have suggested it is problematic for Islamic State supporters to have expressed affinity for deceased al-Qa'ida figures like al-Awlaki, it is useful to consider the profile image Soofi used for this Twitter account was an image of al-Awlaki. In 2015, Twitter was used by Junaid Hussain, Sally Jones and other Islamic State members comprising the Islamic State Hacking Division, along with group supporters in the United States, to promote hit lists containing information which could be used to locate more than 1,000 American

34. Screenshots and discussion in Michael S. Smith II, Social Media Jihad 2.0: Inside ISIS' Global Recruitment and Incitement Campaign, New America, January 18, 2017, 9:07.
35. For example of Islamic State appropriating al-Awlaki's mantle in official propaganda, See Dabiq 4, October 2014, p. 43. For example of Islamic State appropriating bin Ladin's mantle, See Dabiq 4, pp. 43-44. See also Dabiq 7, February 2015, p. 25. Note: In this article published in the seventh issue of Dabiq, Islamic State is referencing al-Adnani's assertion that al-Qa'ida under its current leadership is no longer the "base of jihad" in Abu Mohamed al-Adnani, This Is Not Our Manhaj, Nor Will It Ever Be, Al-Furqan (Islamic State), April 17, 2014.
36. Screenshots and discussion in Michael S. Smith II, Social Media Jihad 2.0: Inside ISIS' Global Recruitment and Incitement Campaign, New America, January 18, 2017, 11:04.
37. The first attack in the United States claimed by Islamic State was executed in New York in October 2014 by Zale Thompson, who targeted police officers with a hatchet. See claim in Dabiq 5, November 2014, p. 37.
38. Dabiq 9, May 2015, p. 4.

11 of 12

national security personnel.39 Also in 2015, Islamic State members and supporters rigorously tweeted home addresses of current and former senior officials from America's national security enterprise, including then Director of National Intelligence James Clapper and then CIA Director John Brennan.40 In addition, Islamic State members and supporters have crowd sourced threat campaigns on social media platforms like Twitter against American terrorism analysts and journalists who cover the group's activities. The day before the attack at Pulse nightclub in Orlando, I was the target of one such campaign organized on an invitation-only Telegram Messenger channel that I had infiltrated.41 Therein, members were instructed to issue threats against me on Twitter. During the past year, similar threats against me have been made on Telegram channels and chatrooms, as well as on Twitter. Although Twitter, Facebook, YouTube and other sites have increased their efforts suspending pro-Islamic State accounts and removing Islamic State propaganda, Islamic State propagandists managing Telegram channels that have become primary initial points of distribution for official Islamic State propaganda continue encouraging group supporters to help with proliferating these materials on easier-to-access spaces of the cyber domain. During 2017, managers of Islamic State-linked Nashir News Telegram channels have repeatedly encouraged individuals with access to these "dark" spaces of the cyber domain to help the group reach a larger audience by posting copies of newly-released propaganda on sites like YouTube, and then promoting links to the material on Twitter and Facebook.42 In June 2017, managers of these channels also encouraged use of popular social media platforms to support an information operation aiming to counter news reports suggesting the "caliphate" is collapsing. Further, during 2017, managers of these channels continued advertising links to Nashir News Twitter accounts used to promote Islamic State propaganda. In persisting with their use of Twitter, Islamic State propagandists are providing an example of activities they intend for Islamic State enthusiasts here in the West to emulate. Thereby, making it easier for recruiters to identify them and initiate efforts to persuade them to do more to demonstrate their support for Islamic State than simply augmenting its propaganda distribution program.

A More Effective Approach to Disrupting Threats Emanating from American Companies' Popular Social Media and File-Sharing Websites

In addition to global broadcasting capabilities and worldwide connectivity with acquired and prospective supporters, there are other factors which make most popular social media and file-sharing sites attractive tools for terrorists. Notably, most popular social media and file-sharing companies allow account managers whose identities are unknown to them to simultaneously use various technologies, such as virtual private networks (VPNs) and specialized browsers like Tor, to mask their physical locations when active on their popular sites. This translates to an absence of risks encountered by

39. Screenshots and discussion in Michael S. Smith II, Social Media Jihad 2.0: Inside ISIS' Global Recruitment and Incitement Campaign, New America, January 18, 2017, 14:17.
40. Ibid, 15:54.
41. Ibid, 17:59.
42. Screenshot of example from April 2017 archived by Michael S. Smith II at DOWNRANGE, https://insidethejihad.com/wp-content/uploads/2017/10/Screen-Shot-2017-04-25-at-1.35.18-PM-copy-2.png

12 of 12

Islamic State propagandists, recruiters and supporters sufficient to deter them from continuing to exploit these companies' technologies.⁴³

Since 2015, Islamic State propagandists and supporters have promoted the uses of tools like VPNs to achieve a form of operational security when active online. Just after the March 2016 attacks in Brussels, managers of a pro-Islamic State technical support team Telegram channel reminded the "brothers in Belgium" of the group's online security protocols.⁴⁴ More recently, an example of the promotion of these tools in official Islamic State propaganda emerged in the tenth issue of the group's flagship French-language publication, Dar al-Islam.⁵

When recruiters, propagandists and prospective recruits are using the right VPNs while active on social media sites, or posting propaganda on file-sharing sites, it may be impossible for investigators to identify their physical locations after suspicious, or illegal activity is detected. The same applies to a long list of other illicit actors, ranging from parties engaging in forms of cyber bullying of interest to First Lady Melania Trump to agents of Russia's influence operations tasked with encouraging American voters to consume "fake news" designed to shape their perceptions of presidential candidates.

To deter violations of its policies, such as defacing pages about high-profile public figures and issuing terroristic threats, the popular online encyclopedia Wikipedia has blocked editorial controls for parties seeking to alter or add content to its popular site when using most VPNs to mask their physical locations. As Wikipedia is hardly a technology innovator when compared to American giants of social media and file-sharing industries like Twitter, Facebook and Alphabet, it stands to reason these companies could develop similar policies to deter an array of illicit activities on popular spaces of the Internet managed by them.

Indeed, deficiencies evinced by the policies of such American companies as Twitter, Facebook and Alphabet have effectively enabled terrorist groups like Islamic State to expand their capabilities to recruit and incite violence against Americans and our allies. As United States-based companies are not doing all they possibly can to mitigate threats emanating from spaces of the Internet managed by them, prudence welcomes policymakers and regulatory bodies like the Federal Communications Commission examining policies which could be imposed on largely self-regulated American giants of social media and file-sharing industries. Yet it is meanwhile important for policymakers to be aware that, according to the National Security Council staffer tasked with drafting the forthcoming United States National Security Strategy, legislative efforts aiming to impose new regulations on these companies are likely to be viewed within the executive branch as being anathema to the Trump administration's agenda, despite problems for national security which may arise from lax oversight of social media and online file-sharing industries.⁶

43. Michael S. Smith II, "Containing ISIS' Online Campaigns After Manchester: The Simple Tools We Can Use But Choose Not To," Foreign Affairs, May 27, 2017. See also Michael S. Smith II, "How to beat ISIS on Twitter," The Christian Science Monitor, May 27, 2016, https://www.csmonitor.com/World/Passcode/Passcode-Voices/2016/0527/Opinion-How-to-beat-ISIS-on-Twitter
44. Screenshots and discussion in Michael S. Smith II, Social Media Jihad 2.0: Inside ISIS' Global Recruitment and Incitement Campaign, New America, January 18, 2017, 13:10.
45. Dar al-Islam 10, Al-Hayat (Islamic State), August 2016, pp. 38-46.
46. Referencing comments made by this NSC staffer during a conference call with the author on September 18, 2017.

NATIONAL SECURITY ARCHIVE

National Security Archive, Suite 701, Gelman Library, The George Washington University, 2130 H Street, NW, Washington, D.C., 20037, Phone: 202/994-7000, Fax: 202/994-7005, nsarchiv@gwu.edu