ISIS: The State of Terror Part 6

"I died that day, John; when your colleagues dropped that bomb on those people, they signed my death certificate."

Foley said he wished he had more time.

"I guess, all in all, I wish I wasn't an American."

The ISIS fighter then took over. He spoke in a British accent, accusing the United States of aggression against ISIS.

"You are no longer fighting an insurgency," he said. "We are an Islamic army."

The fighter bent to Foley and put a knife to his throat and began to saw. The video cut away before blood began to flow. When the picture resumed, the camera panned over Foley's dead body, his head severed and placed on the small of his back.

In the final scene, the fighter reappeared, gripping another hostage, an American journalist named Steven Sotloff, by the collar of his orange jumpsuit.

"The life of this American citizen, Obama, depends on your next decision," the fighter said as the video concluded, an excruciating cliffhanger that promised more agony to come. ISIS had learned from the Salil as-Sawarim series, the power of telling a spare, minimal story, framed by horrific violence.

The video exploded onto the Internet, as ISIS supporters took to social media to make sure their message was delivered not just to American policy makers, but to anyone whose attention they could reach (see Chapter 7).

In the weeks that followed, the short script would repeat itself over and over again, one hostage after another executed as the world watched in horror, again following the blueprint in The Management of Savagery, whose author specifically advised the taking of hostages to send a lesson about "paying the price" to anyone who would oppose the jihadis' campaigns. "The hostages should be liquidated in a terrifying manner, which will send fear into the hearts of the enemy and his supporters," the author wrote.41 By October, ISIS had beheaded three more Westerners, each installment concluding with a new hostage whose life was placed on the line. The target audience expanded past the United States with the execution of British aid workers Alan Henning and David Haines. Many ISIS Twitter users crashed hashtags for British television shows and directed hara.s.sing tweets and videos at British prime minister David Cameron's official Twitter account.42 The fifth video broke out of the format, dropping the "Message to America" t.i.tle. The hostage was Abdul-Rahman Ka.s.sig, an American military veteran and a convert to Islam who had been working with aid organizations to a.s.sist suffering Syrians.

The fifteen-minute video included revoltingly graphic footage of a ma.s.s beheading of captured Syrian soldiers, a sharp contrast to the previous videos that had cut away at the start of the act of violence. The killings were carried out by a number of unmasked European foreign fighters, including from the United Kingdom, France, and Germany, ensuring ma.s.sive news coverage in multiple countries. It ended with a message from the British executioner and an image of Ka.s.sig's severed head.43 Ka.s.sig's execution was not shown, and he did not deliver a statement. It's possible he refused to cooperate with the script, or that he was killed through some other happenstance (such as a rescue attempt or an air strike) before he could be executed. In another break from the previous installments, the video did not end with a new threat against a new hostage. The series had concluded, at least temporarily.

If these victims shared any common quality other than the English language and their white faces, it was their uncommon goodness. Each victim had been carrying out work that ultimately helped Syrians suffering in the civil war. The American journalists, James Foley and Steven Sotloff, were among the few who braved the terrible risks of reporting on the ground during the conflict. David Haines and Alan Henning were aid workers selflessly helping Syrians in dire need. Abdul-Rahman Ka.s.sig was a former U.S. soldier who had converted to Islam and trained as a medic so that he could minister to gravely injured Syrians. It seemed that no one was safe against the knives of ISIS, no matter how kind or how much they had done for Muslims, no matter if they were Muslims themselves.44 Another Western hostage, British journalist John Cantlie, surfaced in a separate series of video episodes t.i.tled "Lend Me Your Ears." Seated in a room in an orange jumpsuit, Cantlie recited scripted ISIS talking points at length.

The series took an unsettling turn in November, when Cantlie appeared in the role of a "reporter," in an ISIS video shot on location in Kobane, near the border between Syria and Turkey, where ISIS was battling Kurdish fighters for control of the city.45 The orange jumpsuit had been traded for a black b.u.t.ton-down s.h.i.+rt, as Cantlie provided an account of the battles there, which was considerably more favorable to ISIS than the mainstream media's version of events, which Cantlie derided. The video was considerably more natural than "Lend Me Your Ears" episodes, leading to dark speculation that Cantlie was suffering from brainwas.h.i.+ng or Stockholm syndrome-or worse, that he had simply gone over to ISIS.46 The propaganda tsunami continued unabated in other areas as well, as b.l.o.o.d.y weeks turned into b.l.o.o.d.y months. It was not unusual to see five or six distinct pieces of ISIS propaganda uploaded to the Internet in a single day. The quality and sheer volume of ISIS messaging dwarfed that of al Qaeda and its affiliates. Releases issued regularly from its regional hubs. Longer videos of varying quality were released, with t.i.tles such as "The Flames of War" and "The Resolve of the Defiant," in a growing number of languages.

New speeches from Adnani and Baghdadi emerged sporadically. Like Ayman al Zawahiri and Osama bin Laden before them, the top leaders of ISIS had operational security concerns that equated visibility with risk. Unlike al Qaeda, however, ISIS had compensated with a stream of content celebrating the lower ranks. Because ISIS operated in the open, compared to its secretive progenitor, it perceived little risk in allowing the rank and file to show their faces and tell their stories.

With so many fighters, it could pick and choose. Adnani was a talented speaker, Baghdadi much less so, but among their soldiers were many charismatic individuals. They might not be qualified to lead, but they could certainly sell.

A constant stream of communication resulted. ISIS was constantly seen to be active and vital, while al Qaeda lurked in silence. The latter's works, whatever they might be, were carried out in darkness, at a snail's pace. And some jihadis began to wonder openly on social media if those works even mattered.

Even the content of its infrequent releases paled in comparison to ISIS. An al Qaeda Central effort to create an English-language magazine, Resurgence, had taken months to produce a single issue, and when it arrived, it was 117 pages of dull. "Resurgence is a humble effort to revive the spirit of Jihad in the Muslim Ummah," an editor's note read. But the revival had decided months ago that it couldn't wait for al Qaeda.

As 2014 continued its b.l.o.o.d.y march, new realities took hold. The United States was committed to a gradually expanding campaign against both ISIS and al Qaeda cells in Syria. And the first wave of shock and horror created by the b.l.o.o.d.y video beheadings of the summer had slowly hardened into something like resolve, alongside a terrible resignation, a recognition that the ISIS rampage would not shrivel under the first Western a.s.sault.

The Islamic State would-for now-remain, and it had placed its unedited and unfiltered message in front of exponentially more people than al Qaeda ever dared dream. Jihadist propaganda had had a history measured in decades, but it had long been obscure and limited to an audience of mostly true believers.

Suddenly, the stuff was everywhere, intruding on the phones, tablets, and computers of ordinary people who were just trying to go about their daily business online.

Although ISIS's skillful storytelling was an important factor in this process, it was not the entire story. As part of its quest to terrorize the world, ISIS had mastered an arena no terrorist group had conquered before-the burgeoning world of social media.

CHAPTER SIX.

JIHAD GOES SOCIAL.

How extremists use technology is no great mystery. Any high-tech tool that you use-from a desktop PC to a smartphone-is fair game for extremists, too.1 Unless a terrorist group is ideologically opposed to technology itself, it will generally use every available tool to do its work. Jihadists are no exception. Their morality may be centuries behind the times, but their technical skills expand to fit their available resources.

During the 1980s, jihadists produced propaganda films on videotape and printed sophisticated four-color magazines that were reasonable facsimiles of Time or Newsweek.2 They didn't distribute them on the Internet. Instead, they went out via mail, or were handed out inside or outside a mosque. In dedicated centers around the world, including in the United States, those who were interested could go to find out more about the movement.

They discussed all this content, not over Facebook, but in person, after viewing a video together in a darkened room; not in YouTube comments, but after listening to an incendiary cleric speak before a roomful of people, everywhere from Cairo, Egypt, to Tucson, Arizona, and most points between.

And as media technology s.h.i.+fted, so did the extremists. Expensive magazines and newsletters with their a.s.sociated postal costs, such as the Al Hussam (The Sword) newsletter published out of Boston, moved to email (like the Islam Report, out of Florida). These were pragmatic decisions. It cost about $1,000 a month to publish Al Hussam on paper. It cost virtually nothing to email Islam Report.3 Jihadis switched to digital video, around the same time early-adopting consumers did, and for similar reasons. It was cheaper and easier to distribute the same content in a downloadable file than on a videotape or DVD.

Social media wasn't much different. By 1990, white supremacists were using dial-up bulletin boards to communicate. As chat rooms became popular on services such as Yahoo! and AOL, radical recruiters signed up in droves, making friends and influencing people from a distance. As it became cheaper and easier to set up and maintain topic-centered message boards using software like vBulletin, jihadis and other extremists s.h.i.+fted again, with thousands of users taking to the new format.

After September 11, the message boards became the preferred social networking tool for jihadists. These message boards, more commonly referred to as online forums or just "the forums," are Web pages where a user can register, under a real or a.s.sumed name, to discuss topics of mutual interest.4 The forums are generally very structured environments, which suited jihadists in the post-9/11 era of justified paranoia about spies and security. Each forum features several major themes for discussion, under which users can start a "thread" on a specific topic of interest. For example, a major theme might be Syria, and a thread might be focused on the latest military action by a specific group.

After a thread starts, other users chime in to post their opinions. Users can reply to specific posts or simply type into the thread directly. Popular or controversial threads can grow to include hundreds of posts, but most peter out after a couple dozen.

The forums also have clear hierarchies. At the top is the person who owns the forum-the person or group that registered the forum's Internet domain name and has de facto control over the technical aspects of the site. The owner generally has the power to delete the entire message board, delete individual threads and content, accept new users, and ban or a.s.sign authority to existing users.

Beneath the owners are the administrators, also called moderators. Administrators have most of the powers of the owner, except for the ability to completely delete the forum, but they can be overruled by the owner. Administrators usually have their own hierarchy as well, with a small number in charge of the big picture, and a larger number of deputies to keep up with all the activity.

The general members.h.i.+p of the forum also has tiers of members.h.i.+p, which are indicated in users' profiles and also usually displayed next to their usernames when they post. Tiers can be based on different factors. Some forums allow users to score points based on popularity. Others allow advancement based on the number of posts by a user, or how long they have been on the board. Some accord special status to users who financially contribute to the forum's upkeep.

Most of the perks for advancing up the ladder are purely ornamental-social status and bragging rights, as well as adding a compet.i.tive element that motivates members to be active rather than pa.s.sive.5 But extremist forums also have inner circles. Some topic areas are restricted to trusted members, who are involved in the offline work of terrorist groups, whether planning attacks or coordinating media releases. The forum's owners and administrators can designate users for special access, or they can restrict sets of ordinary users from routine access if they have concerns about security.6 At the highest levels, the forums have reportedly been used for direct communication among important offline jihadi leaders. In 2013, a virtual "conference call" among jihadi leaders around the world took place within a closed section of an al Qaedalinked forum to discuss an allegedly impending terrorist attack, although s.h.i.+fting language in media reports about the event left many questions about exactly what transpired.7 It never became clear exactly what the plan was and how close it ever came to execution.

In a letter captured during the raid that killed Osama bin Laden, American al Qaeda spokesman Adam Gadahn complained bitterly about the content of the forums, suggesting the terror group's control of the forums was considerably less than perfect.8 The highly regimented forum system allows for a great deal of control, if not from al Qaeda itself then from its partisan moderators, but it can also stifle dissent and create resentment for those who feel excluded from the ranks of the elite. In addition to these internal social pressures (see Chapter 3), the forums were highly vulnerable to attack by hostile intelligence services, which could penetrate them for surveillance, or knock them offline entirely when it was convenient.9 In part because of these pressures, but mostly because terrorists follow the same technological trends that everyone else does, jihadist supporters began in recent years to filter out of the forums and start accounts on open social media platforms like YouTube, Facebook, and Twitter.

An early adopter on the open social media side was Yemeni-American jihadist cleric Anwar Awlaki. Born in New Mexico and raised largely in Yemen, Awlaki had returned to the United States to study engineering, but soon felt a call to Islamic ministry. His English was perfect, but more important, he was an eloquent, pa.s.sionate, masterful storyteller.10 Through a combination of communication savvy and his careful cultivation of an ambiguous relations.h.i.+p to terrorism over the course of many years, Awlaki established himself on social media years before the broader jihadist community made the transition.11 He maintained a Facebook page and an active blog, where he communicated with readers in the comments section. Any given posting could prompt hundreds of responses.12 But YouTube was the social platform where Awlaki's videos achieved notoriety and elevated the issue of terrorist social media to the attention of the public and policy makers.

During his early career, Awlaki was a rising star in the world of mainstream American Muslims, keeping his dark side carefully hidden. While he successfully presented himself as a voice of moderate Islam, he secretly met with al Qaeda operatives and other radicals. Prior to September 11, he had been investigated for possible links to terrorism, and in the months preceding the attacks, he met with some of the hijackers in both San Diego and Falls Church, Virginia. His dark side was not confined to terrorism. San Diego police and later the FBI Was.h.i.+ngton Field Office investigated his patronage of prost.i.tutes, including minors.13 But to the outside world, for a long time, he was simply an inspiring speaker. He had recorded dozens of lectures, some hours long, on a variety of religious topics. Few of his talks openly discussed radical Islamic concepts, but many contained elements that could be leveraged in that direction. Initially, his lectures were distributed on more than fifty CDs, but as more and more media moved online, they migrated to YouTube.14 Although YouTube has many social features, it is at heart a content delivery system. A wide variety of terrorist groups had been using YouTube to post and distribute propaganda. The conversation focused on reach-how easy it was to find and share terrorist videos and how many people were watching.

After years of pressure from politicians, particularly U.S. senator Joe Lieberman,15 YouTube added an option for users to flag terrorist content.16 If a review by the company found that a video "depicted gratuitous violence, advocated violence, or used hate speech" it would be removed. If not, YouTube would continue to defend "everyone's right to express unpopular points of view" and "allow our users to view all acceptable content and make up their own minds."17 But Awlaki's lectures didn't easily fit into the box. His material was wildly popular, and not just with terrorists. His spoken lectures routinely racked up hundreds of thousands of hits. By 2010, his content could be divided into three general content categories: early period, not especially radical; early to middle period, not unambiguously radical; and late period, very radical to openly terrorist.

As the cleric became more overtly a.s.sociated with terrorism, the staggering amount of his content on YouTube presented a dilemma. Should the service remove lectures that were not obviously radical just because the lecturer had graduated to the most-wanted list? What if the lecture was overtly radical and anti-American, but did not openly advocate violence? What if they advocated generally for military jihad but not for specific acts of violence?

YouTube-with its roots as a fun-loving amateur video-sharing service-was ill-equipped to deal with this question. Its parent company, Google, ran a search engine that was arguably the single most powerful tool on the planet for driving Internet traffic, and the technology giant also owned a popular service to publish and host blogs, which was used by all manner of extremists. To take on the role of "values police" opened many cans of wriggling worms.18 Awlaki was not a static target. Increasingly, his name was a.s.sociated with more than words. The cleric had exchanged emails with Fort Hood army psychiatrist Nidal Hasan, who killed thirteen people in a 2009 shooting spree on the base.19 Later that year, al Qaeda in the Arabian Peninsula (AQAP) unsuccessfully attempted to bomb a Detroit-bound airliner on Christmas Day. Awlaki had not only inspired the would-be bomber but had met with him at a terrorist training camp.20 In 2010, AQAP tried to detonate two cleverly disguised bombs, again unsuccessfully, on a UPS cargo plane. Awlaki's involvement was broadly telegraphed in the pages of the terrorist group's English-language magazine, Inspire.21 At last, YouTube gave in and announced it would more robustly remove Awlaki's content from its website, although his earlier nonviolent material was allowed to remain. It also announced it would ban accounts owned by government-designated foreign terrorist organizations, or used to support them.22 It was the dawn of a new age in which global corporations would imagine themselves as platforms for the ideal of free speech, only to be dragged kicking and screaming into a role brokering which values would be acceptable and which would not.

The problem was not unique to terrorism. For instance, YouTube had quickly devised algorithms to block p.o.r.nography and then implemented even more stringent digital fingerprinting techniques to not only block child p.o.r.nography but report those who posted it to the police, a practice soon adopted by other online providers.23 And an army of lawyers convinced it to swiftly and aggressively address copyright violations.

Terrorism presented a particularly sticky dilemma. Terrorism was not only an inherently political activity, but it was one for which no consensus definition existed. Countries like Bahrain or Egypt might define terrorism very broadly, for instance, to include some legitimate political dissenters (as well as undisputed terrorists), and sometimes even experts on regional politics couldn't say for certain which was which. Angry activists, on the other hand, accused countries from Israel to the United States to Russia of perpetrating terrorism themselves through military actions and policies.

But regardless of the big-think debate, public outrage fueled scrutiny, and scrutiny led to changes, at least if a company was big enough and its terrorist users active enough to make headlines.

Literally every social media platform of meaningful size hosted some number of violent extremists. But most scrutiny was directed at the top. The easy availability of white supremacist "hatecore" music on the once-popular social media service Mys.p.a.ce, for instance, generated little public interest, in part because the platform was seen as fading into obsolescence and in part because newspaper reporters were far less interested in covering white nationalists than jihadists.24 San Franciscobased file-sharing service Archive.org was often the very first place where jihadi media releases appeared, but few outside of counterterrorism circles paid the clunky-looking website much heed, and even jihadis wasted no time transferring their videos from Archive to YouTube once they were published.25 Headline-friendly services such as Facebook and Twitter took the brunt of the criticism, in part because they were becoming extremely popular venues where terrorist recruiters and supporters could operate, and in part simply because they were popular. Everyone knew about Facebook and Twitter; fewer knew or cared about Tumblr, the blogging service that hosted its fair share of jihadi outlets.

Facebook and Google, while generally favoring free speech, were also publicly traded companies with concerns about liability and a desire to create safe s.p.a.ces for users, especially the young, who were vulnerable to a range of online predators of which violent extremists and recruiters were only one part.

Twitter stood apart. A privately held company until late 2013, Twitter's founders and executives were perceived as libertarian-leaning advocates for free speech. Twitter more aggressively resisted broad government requests for information than most, and its rules for users contained few restrictions on speech.26 The company refused to discuss its criteria for suspensions, brus.h.i.+ng aside queries with a boilerplate response.27 With the exception of spam and direct personal threats against individuals, users could get away with a lot. And Twitter's "who to follow" recommendations for new users made it easy for would-be radicals to jump right in and start making connections with hardened terrorists, a process that was much more difficult in the 1980s and 1990s.28 The Taliban was one of the first jihadist-oriented organizations to embrace Twitter. In January 2011, its official media outlet created a Twitter account,29 soon followed by its spokesman, Abdulqahar Balkhi.30 Balkhi quickly became part of a sensation when NATO's International Security a.s.sistance Force (ISAF) account began publicly sparring with him.31 Toward the end of 2011, the Somali jihadist insurgent group al Shabab followed suit, and it soon racked up tens of thousands of followers.32 As highly visible insurgencies, rather than shadowy terrorist cabals, Shabab and the Taliban needed to manage public relations. They used their accounts to brag about military victories, hara.s.s their enemies, and rally supporters from their respective regions and around the world.

It wasn't all upside. In 2012, as described earlier, American al Shabab member Omar Hammami broke with the group over differences in methodology and accusations of corruption in Shabab's upper ranks. He took to social media to publicize the charges, airing Shabab's dirty laundry and launching an extended conversation with Western counterterrorism a.n.a.lysts, including a long series of public and private exchanges with coauthor J. M. Berger.33 While journalists and academics had, over the years, cultivated sources within terrorist groups, the advent of social media had opened the door to different types of interactions, exchanges that could involve daily or weekly conversation over the course of months. Social media also brought with it new risks, the danger of becoming too publicly or privately friendly with sources, at the risk of giving them a higher profile or being perceived as validating their views.

The more inherently secretive al Qaeda also established a presence on Twitter, along with some of its affiliates, but more covertly, resulting in a more limited reach. This lack of connectivity helped fuel the beginnings of dissent, as Hammami and other internal al Qaeda dissidents took to social media to air their grievances, only to be met by conspicuous silence (see Chapter 3).

After a slow beginning, Facebook took an aggressive stance against violent jihadists starting in 2009, actively monitoring, seeking out, and terminating pages and groups devoted to terrorist content, even when they were hidden from public view by privacy settings. It also terminated the accounts of key users who partic.i.p.ated in such activities.34 Many of those suspended users simply sat down at their computers the very next day, created new accounts, and started all over again. So what was the point?

WHACK-A-MOLE.

The phrase "whack-a-mole" had been used since the early 1990s to describe one of the major challenges of counterterrorism writ large.35 A children's arcade game, Whac-A-Mole (sans k) features a table-sized playing field covered with holes. Toy moles pop out of the holes at random, first one at a time, then more and more, coming faster and faster.

The self-evident object of the game is to whack the moles with an included mallet as soon as they pop up. Inevitably, the moles begin to come faster than the player can whack them, and the player loses.

The dynamics of fighting terrorist groups are similar. Cracking down on a successful terrorist organization rarely led to the end of its a.s.sociated movement. Take one cell out and new ones sprouted from the remains of the first. The CIA more elegantly described the problem in a secret 1985 internal a.n.a.lysis t.i.tled "The Predicament of the Terrorism a.n.a.lyst," which compared the splintering of violent extremist groups under government pressure to the many-headed Hydra of legend-cut one head off and two more grow to take its place.36 While the Hydra metaphor continues to have its fans, "whack-a-mole" made for more colorful sound bites. With the dawn of the twenty-first century, it quickly became ubiquitous as a phrase to casually dismiss the value of efforts to counter or suppress terrorist and extremist use of the Internet.

The debate started with the Internet service providers that al Qaeda used to host the forums. While the forums were operationally important, they were specialized. A terrorist forum didn't come to you, you had to seek it out, sometimes armed with personal references. Some forums had lower barriers to entry, but a would-be al Qaeda member had to work his way through a series of such communities, earning trust and establis.h.i.+ng credibility each time, which took time.

The social impact of the forums was relatively limited, while the counterterrorism benefits of allowing the forums to operate with only sporadic interference were clear. Although the forum administrators were usually based overseas, the United States offered the cheapest, easiest, and most reliable servers to host the content.

The fact that al Qaeda message boards were hosted by American companies incensed many people for reasons both political and patriotic, and some mounted public shaming campaigns in an effort to get those Internet service providers (ISPs) to take the forums down.37 But if a forum was hosted on a server based in the United States, it was fairly simple for the government to get a subpoena and start collecting highly sensitive data. None of this was visible to Internet users in general, and so the debate remained relatively low-key.38 Both the ecosystem and the calculus changed dramatically with the rise of a new generation of social media platforms. The forums were gated communities; open social media services like Facebook and Twitter were town squares, where people wandered around meeting each other and seeking out those with similar interests.

Compelling evidence suggests social media taken as a whole tends to discourage extremism in the wider population,39 but for those already vulnerable to radicalization, it creates dark pools of social connections that can be found by terrorist recruiters and influencers. On Twitter or Facebook, it was easy to seek out or stumble onto a radical or extremist account or community, and even easier for terrorist recruiters to seek prey within mainstream society.

"I see the cyber jihad as very, very important, because Al Qaeda, the organization, became mostly an ideology," wrote Abu Suleiman al Na.s.ser, a prominent forum member who s.h.i.+fted to Twitter, in a 2011 email interview. "So we try through the media and Web sites to get more Muslims joining us and supporting the jihad, whether by the real jihad on the ground, or by media and writing, or by spreading the idea of jihad and self-defense, and so on."40 BIG BUSINESS.

Virtually all extremist and terrorist groups have staked out ground on social media, from al Qaeda to Hamas, Hezbollah, the Tamil Tigers, the Irish Republican Army, and Babbar Khalsa (a Sikh militant group).41 In a 2012 study commissioned by Google Ideas, coauthor J. M. Berger doc.u.mented thousands of accounts related to white nationalist and anarchist movements on Twitter, and partic.i.p.ation in those networks has soared in the intervening years.

As terrorists made the transition to social media, public pressure mounted. Twitter stoically sat out the debate, rarely commenting but making its libertarian views on speech well known. "One man's terrorist is another man's freedom fighter," an unnamed Twitter official told Mother Jones magazine.

"We take a lot of heat on both sides of the debate," said Twitter CEO d.i.c.k Costolo, in one of the company's extremely rare public statements on the matter.42 YouTube and Facebook, on the other hand, quickly learned the frustrations of whack-a-mole. Although the debate over terrorist suspensions frequently revolved around the intelligence question, terrorist content on social media was a business issue first and a cultural issue second. Intelligence concerns were, at best, a distant third.

The reason: Social media is run by for-profit companies, which are neither government services nor philanthropic endeavors (even if technology evangelists sometimes lost sight of the latter fact). The owners and operators of the platforms made the vast majority of decisions about which accounts would be suspended. Government intervention represented a tiny fraction of overall activity.

Each social media service had its own rules about abusive and hostile behavior that every user was obligated to follow or else risk being banned. The companies had no motivation to carve out exceptions for terrorist users who violated the rules, nor were they much inclined to treat their users as a resource for the intelligence community.

They did, however, have reason to worry about news headlines like "Despite Ban, YouTube Is Still a Hotbed of Terrorist Group Video Propaganda" and "Facebook Used by Al Qaeda to Recruit Terrorists and Swap Bomb Recipes, Says U.S. Homeland Security Report."43 After uneven beginnings, YouTube began to enforce its ban on terrorist incitement in a steady but less than robust manner. It responded quickly to user reports about terrorist videos, but it didn't deploy its full technological a.r.s.enal against them.

For example, Google could have written software to recognize the logos of terrorist groups and flag them for review. It did not. More significant, Google had developed the technological capability to prevent multiple uploads of a video that had already been flagged as a violation of its terms of service. The technology was invented to deal with copyright violations, but as of November 2014, it had not been deployed for use against terrorist videos.44 Facebook became proactive and began knocking down pages, groups, and users as a matter of routine, sometimes before ordinary users had a chance to complain about them. In an attempt to get around this, jihadis set up private, members-only Facebook groups to discuss bomb-making formulas and potential terrorist targets, but blatant plotting soon became a sure ticket to swift and repeated suspensions.45 As companies formulated policies for dealing with the influx of terrorist content, a cottage industry of open-source terrorism a.n.a.lysts blossomed almost overnight. Some a.n.a.lysts outside government preferred the one-stop shopping offered by the jihadist forums, which helped weed out noise and authenticate terrorist releases, but others found the insular environment difficult to crack, often requiring the creation of secret ident.i.ties and undercover profiles to gain access to the juiciest and earliest content.

In contrast, social media seemed to offer ripe fruits for easy picking, especially on Twitter, where many jihadist organizations were now routinely distributing new releases describing their battles and claiming credit for attacks.46 Many among this new breed of social media a.n.a.lysts had a high opinion of the intelligence provided by low-hanging terrorist accounts. The new a.n.a.lysts broke down into several subcategories-academics, government contractors, government officials, journalists, and a burgeoning contingent of semiprofessional aficionados.

Some outside government confused terrorist press releases-by definition, the message the group wanted to promulgate-with verified information or operational intelligence. The easiest terrorist sources to find presented stage-managed messages, including outright lies. Many highly visible accounts belonged to stay-at-home jihadists far from the front lines.

Among global government officials and intelligence workers responsible for counterterrorism and countering violent extremism-the people fighting terrorism as opposed to those who study it-att.i.tudes were different, especially as the months turned into years. Agencies were quick to recognize the power of so-called Big Data a.n.a.lytics in relation to the ma.s.sive social networks that were forming in front of their eyes, but few had the capabilities to exploit the new pool of information on a large scale. In a majority of cases, social media was most useful to law enforcement and intelligence agencies not as a vast hunting ground but as a resource for discovering more information about suspects they had already identified.

In the United States, the government sometimes asked companies to suspend accounts. Some of the time, at least, the social media provider had some discretion in responding to such requests. Some European countries applied existing hate speech laws to social media platforms.47 Other countries, in the Middle East and South Asia, took a more aggressive stance against speech they considered objectionable (terrorist or not).48 At times, government agencies asked to keep social media accounts active, when they were part of an ongoing investigation or when their intelligence value clearly outweighed their utility to terrorism. While shrouded in secrecy, these cases appeared to be rare and highly targeted.

Two fairly direct a.n.a.logues cut to the heart of the intelligence argument for allowing terrorists to operate entirely unimpeded on social media.

The first is to subst.i.tute "terrorism" for virtually any other kind of crime or flagrant violation of the social contract. To pick an extreme example, allowing child p.o.r.nographers to operate online without impediment would undoubtedly yield tremendous intelligence about child p.o.r.nographers. Yet no one ever argues this is a reasonable trade-off.

In less emotionally loaded terms, the same could be said about the online operators of Nigerian oil scams, Ponzi schemes, and phis.h.i.+ng attacks, or online purveyors of drugs, contraband, or prost.i.tution. None of these problems are solved by online interdiction; the moles keep popping up. But no one ever argues that these social media accounts should be immune to suspension.

The second a.n.a.logue is to real-life activity. Anyone who studies intelligence and law enforcement knows it is sometimes valuable to allow criminals and terrorists to remain at large for a period of time, under close surveillance, in order to gain information about their activities. But when the system is working properly, such surveillance culminates in concrete actions to prevent violence and disrupt the criminal network's function.

Of course, the very best intelligence on terrorism is produced by investigations that follow a successful terrorist attack, but no one would argue that the intelligence gained outweighs the cost. Online, the costs and gains are degrees of magnitude smaller and considerably more ambiguous. But it is wrong to a.s.sume they do not exist or matter, and that the equation is always, or even usually, weighted toward intelligence.

Although reasonable people can disagree about where to draw the lines, there is no reasonable argument for allowing terrorists complete freedom of action when alternatives are available.

WHACKED.

The whack-a-mole metaphor was also flawed on its face, for two reasons: It a.s.sumes zero benefit to removing the moles temporarily, and it a.s.sumes the moles will never stop popping up.

Suspensions diminished the reach of a terrorist social media presence, degrading the group's ability to recruit and disseminate propaganda and forcing terrorist users to waste time reconstructing their networks. The suspensions didn't eliminate the problem, but they created obstacles for terrorists.

Killing civilians and destroying infrastructure are not typically a terrorist organization's end goals. Rather, they are a means to provoke a political reaction. Although people understandably forget sometimes, terrorism is ultimately intended to send a message to the body politic of the target, rather than being a pragmatic effort to destroy an enemy, although there are exceptions.

Therefore depriving terrorists of media platforms at key moments-such as the release of a beheading video-disrupts their core mission.

Suspending the accounts that distribute such content requires mole whackers to keep whacking, but it also requires the moles to keep finding new holes from which to emerge, making it more difficult to land a message with the desired audience (see Chapter 7).

At the start of 2013, the debate reached a watershed. Al Qaeda's affiliate in Somalia, al Shabab, had grown fat and complacent on Twitter, where it maintained an official account (@HSMPress) that tweeted in English and had ama.s.sed 21,000 followers.

In addition to reporting its alleged military activities, in tweets that ranged from spin-laden to fantasy, the account frequently posted taunts and threats directed at Western and Somali governments.49 In January 2013, al Shabab tweeted a threat to execute a French prisoner it had captured. This was a rare example of a threat direct and specific enough to violate Twitter's extremely permissive rules, and the account was suspended after users reported the violation.50 The mole soon popped up under a new name.

"For what it's worth, shooting the messenger and suppressing the truth by silencing your opponents isn't quite the way to win the war of ideas," the account tweeted on its return, a deeply ironic statement coming from an insurgent group notorious for executing and imprisoning its internal dissenters.51 On the surface level, the suspension had cost nothing in intelligence value-for a.n.a.lysts who had the foresight to save copies of Shabab's original Twitter account. The old information was still accessible, albeit no longer conveniently online, and the new account continued the stream of press releases.

And in this case, the suspension improved the intelligence outlook. All Twitter accounts naturally accrue followers over time, not all of whom are especially interested in the account's content. The suspension wiped out a tremendous amount of a.n.a.lytical noise, and the low-hanging fruit of al Shabab's official tweets meant little compared to the value of the social network that had sprouted up around the HSMPress account.

a.n.a.lysts who delved deeper could look at who followed the new account and deduce with some accuracy who was a member of al Shabab, by examining the relations.h.i.+ps and interactions among the accounts, as well as their content. Similar capabilities were also being developed by a.n.a.lysts using Facebook and other social networks.

Such social network a.n.a.lysis required a critical ma.s.s of data, but the list of users following the original al Shabab Twitter account had grown large, and the data had become noisy. Some of the followers were curiosity-seekers, drawn in by headlines. Some were Somalis not a.s.sociated with Shabab. Others had only a casual interest. Many were journalists and terrorism a.n.a.lysts.

After the new account surfaced, several hundred users rushed to follow within the first several hours. a.n.a.lysts had previously been forced to sift through 21,000 accounts to pan for gold, but the new account had far fewer followers in its earliest hours, and the first ones to show up were among the most motivated. It was relatively simple to a.n.a.lyze the new accounts, removing the journalists and a.n.a.lysts. Most of what remained were hard-core al Shabab supporters and members on the ground. The suspension of the account had made it easier to glean real intelligence, not harder.52 Although it was nearly impossible to keep extremists from returning again and again to social platforms, it now became clear that suspensions were not an exercise in futility. A suspension cost the terrorists time. It deprived them of an easy archive of material. They had to reconstruct their social networks and reestablish trust, often exposing themselves to scrutiny in the process. Other users in their social networks were suspended and came back under new names and using different kinds of camouflage. It was not always obvious who your friends were.

There were also clear numeric costs. It might take a Facebook page weeks or months to build up a following of thousands of users, work that could be erased in an instant. An a.n.a.lysis of the pace at which al Shabab's second Twitter account accrued followers suggested it would take months, if not years, to regain all the followers it had lost.53 In September 2013, al Shabab commandos seized control of the Westgate Mall in Nairobi, Kenya, in an attack that lasted almost four days and left sixty-seven victims dead.54 Its resuscitated Twitter account began live-tweeting details of the attack in progress. Although the account had previously tweeted terrorist attacks within Somalia, the media latched on to the activities of the high-profile account as the siege dragged on.55 After users complained about the account using Twitter's abuse-reporting forms, the mole was whacked, and a new account popped up.56 Because it was breaking news, users flocked to the new account, which was whacked again in short order. Another popped up, and was whacked. The process continued for days. Each time, al Shabab was online for shorter and shorter periods.57 Finally, something remarkable happened. The mole stayed down.

It was unclear whether Twitter had permanently banned it using technical tools it normally reserved for spammers, or the terrorists had simply surrendered. What was clear was that it was over. Al Shabab had been denied the use of Twitter. The moles had definitively lost.

But that wouldn't stop the argument from reviving yet again in 2014, as ISIS burst onto the scene.

CHAPTER SEVEN.

THE ELECTRONIC BRIGADES.

"This is a war of ideologies as much as it is a physical war. And just as the physical war must be fought on the battlefield, so too must the ideological war be fought in the media."