Where the Bodies are Buried: Geolocating the Execution Site Linked to a Canadian ISIS Commander

PDF Copy of report here: Where the Bodies are Buried: Geolocating the Mass Execution Site Linked to a Canadian ISIS Commander


In September of 2014 as the Islamic States power and influence surged throughout Syria and Iraq it released one of its first videos via al-Hayat media center call the “Flames of War”.

The 55 minute video attempted to demonstrate the victories of the Islamic State in its push across the region. The video ended with a clip of an IS fighter narrating and admonishing the west from interfering in the Islamic State gains. In the background Syrian military personnel can be seen digging their own graves. The video drew a great deal of attention from western intelligence agencies for the fact that one of the narrators in the video had a western English accent.

While many analysts speculated the origin of narrator may possibly be Canadian, several recent pieces of information now seem to confirm that theory. In early of October of 2018, Global news journalist Stewart Bell and terrorism researcher Dr. Amar Amarasingam ventured into YPG controlled northern Syria to interview another infamous IS fighter; Mohammed Ali (Abu Turab). Ali admitted that the narrator of the Flames of War video was Abu Ridwan al-Kanadi.

On the 16th of January 2019, Dr. Amar Amarasingam reported that the voice of Abu Ridwan al-Kanadi, heard in the IS Flames of War videos, was Mohammed Abdullah Mohammed. This was, in part, confirmed by a childhood friend who stated Mohammed was “the voice behind all ISIS releases in English”.

Finally on the 18th of January 2019 Hugo Kaaman, published a voice comparison of Mohammed Abdullah Mohammed against the narrator of several IS videos. The comparison would appear to be a close match to that of Mohammed.

In October of 2018, we were asked by Stewart Bell to determine the likelihood of geolocating the Syrian soldier’s execution site that appeared in the Flames of War video. Geolocation is just one of many open source intelligence (OSINT) tools that allow analysts to determine the location where images and video were taken. This is done by comparing physical landmarks, structures, terrain and vegetation within the image against known constants such as satellite imagery.

abu rudwan mass execution geolocated to division 17 base1 - angle 1

In this instance analysts were able to use the 2014 video to reconstruct the exact location where Mohammed is believed to have killed at least one prisoner. “Where it happened” is one of the most critical elements in any homicide/war crime investigation and, in this instance, analysis positively identified the crime scene of this notorious foreign fighter.

You can read the full report here —–> Where the Bodies are Buried: Geolocating the Mass Execution Site Linked to a Canadian ISIS Commander

Operation Multo: On the Trail of the Executioner of John Ridsdel and Robert Hall


Years of work gathering information on #AbuSayyaf, monitoring social media, checking, re-checking, verifying with outside researchers, and hours and hours of writing and fretting to get to this point.

Here is our report on the executioner of Canadians John Ridsdel and Robert Hall and the OSINT that we were able to gather on him and the Sulu Abu Sayyaf cell that supported him ———-> iBRABO Operation Multo

We would like to thank Paweł Wojcik for his assistance in understanding the group dynamics relating to #ISEA and #AbuSayyaf and Calibre Obscura for his assistance in weapons identification which ultimately identified one of the cell members.

Lastly we would ask that YOU consider donating to the John Ridsdel Intelligence Analysis Scholarship via GoFundMe which has been set up to inspire a new generation of intelligence analysts to develop the field.

Thank you for your interest in our work!

Dr. Camie Condon, Senior Analyst @iBRABO_com

Can you see me now? Using Cellular Service in the Fight Against ISIS

The Invisible Beast

In late 2014 as ISIS swept through parts of Iraq and Syria the group quickly realized that one of its greatest tools in recruiting was also one of its greatest potential threats. As ISIS ratcheted up its propaganda machine online it quickly came to realize that cellular and internet access were providing volumes of intelligence to its enemies.



Geotagged Twitter posts for American jihadist Aashir al Amriki in Raqqa, Syria


Perhaps some of the greatest offenders in these intelligence leaks were the fighters themselves. Jihadists like American Aashir al Amriki (above) and New Zealand’s Mark Taylor mistakenly broadcast hidden geotagged information in their social media posts. The advantage of this kind of information is that it allows analysts to create geographic profiles not only of the individual but also of the group itself. Where they fight, where they live, where they gather, where they train, and even where they hide. As coalition strikes mounted urgent notices went out amongst the fighters to be cognizant of their cell phone use and the images they posted online (below) lest be the target of a missile.



Tracking ISIS Movement in Kobani via Geolocated Social Media Images


Such was the case with Reyaad Khan and Rahul Amin, and even Mohammed Emwazi (Jihadi John), who were tracked at least in part via their cell phones which intelligence agencies used in targeted drone strikes. As more and more activist within the Islamic State used the internet to assist coalition forces with intelligence, ISIS began cutting off access to stop the bleed. This resulted in them limiting internet and cellular network access in late 2014 in Mosul and in the middle part of 2015 in Raqqa.

Access as a Weapon of Change

Early on in November, the Wall Street Journal  noted that as Iraqi and Kurdish forces began their offensive into Mosul they also began to reestablish cellular service (for a small fee). The hope being that the population within Mosul would assist coallition forces in providing intelligence about ISIS and their activity within the city.

There is merit in the idea that expanding cheap and/or free cellular access in the city will reap benefits in the fight against ISIS. As word spreads of availability Mosul’s occupants will no doubt seek to access information on the current fight against the group. Information campaigns by mass text alerts could serve to push information to both inform and protect the population.  Geolocated imagery, such as that provided by activists (below),  could assist in identifying Islamic State controlled locations within the embattled Mosul.


Using OSINT to Target ISIS.png

Using Activist Images to Geolocate an ISIS Checkpoint in Mosul, Iraq (Source Withheld)

Encouraging the Surrender of Fighters

It is also possible that this access could provide a tool by which disaffected fighters, looking for a push to leave the group, could be influenced to surrender. With Abu Bakr al-Baghdadi reportedly on the run, it is unlikely that all of the 5000 fighters (ISIS’s own figures) are committed to fighting to the death for the broken organization. As pressure mounts, and ISIS fighters in Eastern Mosul are almost entirely cut off by the Tigris River, more examples of fighters surrendering are likely to be the norm.

For a group that has nearly two and a half years of experience using technology against us in this battle, this is one opportunity to help turn the tide. While it is just one piece in the in struggle to retake the city, hopefully we have demonstrated how something as simple as cellular/internet access can be a weapon of advantage and resistance in this fight.

About the Authors

Dr. Camie Condon is an analyst with the Intelligence Research Group iBRABO and a post-doctoral researcher with the Tactical Decision Making Research Group at the University of Liverpool.

Jeff Weyers is a Senior Analyst with the Intelligence Research Group iBRABO and is recognized expert in OSINT/SOCMINT. He is currently a PhD candidate – ABD, on the topic of Preventing Violent Extremism and Terrorist Use of Social Media.

iBRABO is a Intelligence Research Group based in Waterloo, Canada. Its core research capabilities include: conflict monitoring, terrorist use of social media, identifying persons vulnerable to violent extremism and open source intelligence research and analysis. Its researchers come from a diverse background in counter-terrorism, criminal intelligence analysis, police investigation, open source intelligence, and tactical decision making.

Looking for more information on Geolocating images? Check out one of our favorite pages: https://www.bellingcat.com/category/resources/how-tos/


 Kesling, B. and Nabhan, A. (2016). Forces Seek Help by Restoring Mosul Cellphone Service. http://www.wsj.com/articles/iraqis-seek-help-in-mosul-by-restoring-cell-phone-service-1478030760

Baker, K. (2015). Two British ISIS jihadis killed by RAF drone ‘gave themselves away when they phoned friends at home in the UK’ http://www.dailymail.co.uk/news/article-3232742/ISIS-jihadis-killed-drone-gave-away-phone-call.html#ixzz4QrAVqNrY

AlJazeera (2015). ISIL bans private internet access in Syria’s Raqqa. http://www.aljazeera.com/news/2015/07/isil-bans-private-internet-access-syria-raqqa-150720094428577.html


Authors: Camie Condon and Jeff Weyers, iBRABO.com


Sometimes irony is the product of complacency. So perhaps it isn’t surprising that political leaders using their secure Blackberrys in plans to battle ISIS are just two clicks away from a steady stream of ISIS propaganda, recruitment and radicalization efforts. For several months iBRABO has been screening Blackberry’s little known social media platform called “Channels”. Unlike many social media platforms the only way to access Blackberry Channels is to be a Blackberry messenger user as it is not available via the web. With over 1 million channels the private platform offers the ability for individuals and corporations to create channels on any topic with dynamic content directed at their audience. Unless you join a channel you have limited access to the content and the users interacting with the channel. In much the same way as is done on other platforms users can like and comment on the content being posted by the Channel provider.

ISIS on Blackberry Channels

ISIS on Blackberry Channels

In examining Blackberry’s echo system we found over 6 channels (example above) specifically dedicated to providing ISIS content, some of which could be found with a simple search for the term “Islamic State”. In one particular post the group outlined the use of Blackberry Channels and several other platforms in its dissemination strategy. An analysis of the ISIS Channels revealed that several had been in operation since the start of 2015 coinciding with ISIS’s ongoing surge in social media implementation.

ISIS on BB Channels

Islamic State Blackberry Channel


Five of the sites linked to the ISIS media campaign on Blackberry targeted Indonesians specifically. Indonesia has recently heightened concerns around the groups attempts to get a foot hold there. The use of Blackberry devices in Indonesia is also very popular thus explaining why ISIS was using the platform to gain influence with users. Three of the sites directly linked to ISIS WordPress sites including Daulah Islam Baqiyyah (below), Daulah Khilafah Islamiyah, and Daulah Islam Baqiyyah (caution graphic content). WordPress too has been a favorite of ISIS in developing its online presence and has repeatedly been used by the group in multiple languages.

The ISIS Media Campaign in Indonesia

The ISIS Media Campaign in Indonesia

The Al-Hayat Media wing of ISIS was also found to be on Blackberry Channels. Al-Hayat has been cited as being a steady source of ISIS propaganda over the last year and a half and is the publisher of the infamous Dabiq magazine covering all aspects of the Islamic State’s rise to power. As with the channels highlighted above the Al-Hayat Channel was specifically targeting an Indonesian audience with their content (see below).

Al-Hayat Post on Blackberry Channels

Al-Hayat Post on Blackberry Channels


The last site found on the channels platform (targeting English speaking audiences) is known as Generation Awlaki. This ideological campaign has been previously identified as a recruiting tool to violent extremism. The content features lectures, images, quotes and newly created media representing the late Al-Qaeda propagandist Anwar al-Awlaki. Despite his death at the hands of a US drone in 2011 his content continues to have a mass following and has played a crucial role in the ideological narrative of both Al-Qaeda and ISIS. A recent example of this can be seen in how al-Awlaki’s lectures were found to be an influencing factor for Chattanooga Shooter, Mohammad Abdulazeez. Generation Awlaki has been hosted on multiple social media sites including Google Play store, Facebook, and Twitter. Recently the Generation Awlaki channel on Blackberry was directly linked to it’s mirror site on Telegram. Generation Awlaki continues to have a following of thousands on its Facebook page which is regularly rebuilt each time Facebook takes it down. (Further Reading: The Ghost of Anwar Awlaki – The Virtual Martyr)


That ISIS found a way to utilize Blackberry Channels is really not surprising given their reputation as early adopters of social media and technology. Virtually every platform that has been explored by the group in one way or another. The days of creating a social media platform and not allocating resources towards terrorism prevention/disruption have long past us. Blackberry is not the first or the last company to experience this and in fact a long list of social media companies have been taken to task in their efforts (or lack thereof) against terror networks. In this regard there have been mixed results in their attempts to stem the tide of terrorist content. Less than a week after iBRABO notified Blackberry of ISIS channels on their network (and they removed the Islamic State site above), ISIS affiliates recreated three new channels to resume operations.

The debate around continually tearing down terrorist content essentially has two main opposing sides. On one side are the advocates that claim vulnerable individuals to recruitment will be negatively influenced by the propaganda and recruiting message of groups like ISIS. It is a scorched earth approach trying to eliminate every trace of violent extremist ideological from the internet. This approach has essentially received mixed results for many reasons not withstanding the immense media attention that terrorist groups like ISIS attract by their deeds. There are indications however that the progress of ISIS has been slowed and redirected by mass suspensions as in the case of Twitter according to J.M. Berger. The opposing side would argue that social networks allow an immense opportunity for BOTH intelligence gathering and prevention / interdiction applications. However the social media companies themselves are reluctant to take an offensive posture in this regard. They also do not want to appear to be handing over the private data of their customers for fear of hurting their bottom line.


Much like the war on terror the war on terrorist social media shows no clear evidence of slowing terrorist group efforts. We are losing, we are two steps behind, and absent of a clear strategy and new approach we will continue to be shocked by the progress that ISIS continues to make. Enter a new breed of academics, analysts, companies and tools that have become comfortable working in the grey area of terrorist social networks. By its sheer nature the “social” aspect of social media means that individuals are giving away information about themselves that can be collected and analyzed through open source intelligence techniques. Even in a secure social network such as Blackberry’s Channels, individuals using their personal phones, images and in some cases real names provides us with valuable information. It is the use of this information that has allowed for a new approach to examining terrorist social networks. An approach that focuses on exploring both prevention and interdiction with individuals. An approach that recognizes that the community will have the largest role in targeting both the extremist message and intervening with individuals at risk. It is time to rethink our next move with respect terror social networks, as there is little doubt ISIS has already planned theirs.


Dr Camie Condon is a post-doctoral researcher with the Tactical Decision Making Research Group at the University of Liverpool. She is also an Analyst with the Intelligence Research Group iBRABO.

Jeff Weyers is a Senior Analyst with the Intelligence Research Group iBRABO and is currently completing his PhD on the topic of Preventing Violent Extremism and Terrorist Use of Social Media.

iBRABO is a Intelligence Research Group based in Waterloo, Canada and Manchester, United Kingdom. Its core research capabilities include: conflict monitoring, terrorist use of social media, identifying persons vulnerable to violent extremism and open source intelligence research and analysis. Its researchers come from a diverse background in counter-terrorism, criminal intelligence analysis, police investigation, open source intelligence, CBRNE, and tactical decision making.




Mission Improbable: The Failure of the US Train and Equip Program Appears to be in the Ability to Evaluate Risk

Camie Condon, Ph.D.  and Jeff R. Weyers, Ph.D. Candidate. iBRABO.com

For the second time in less than two months an American trained Rebel unit has been intercepted in Northern Aleppo according to multiple sources within Aleppo. This appears to be just the latest failure in a series of problems plaguing the troubled US “train and equip” mission.

Division 30 and the “Atareb Rebels”

This past weekend several reports claimed that a US trained group going by the name of “Atareb rebels” had crossed into Syria. The group comprised of 75 fighters was quickly intercepted and detained by the Turkish supported Shamiya Front. On the 21st of September several sources including Jabhat al Nusra (Nusra) members indicated on twitter that the group had handed over their weapons, ammunition and vehicles to Nusra to “atone for the sins” of training with the US. Today Jabhat al Nusra members began posting images on Twitter of weapons it claims to have taken from the unit.

Jabhat al-Nusra Weapons Seizure

Jabhat al-Nusra Weapons Seizure

JN announce seizure

Interestingly Twitter shut down many of the accounts initially announcing the seizure of weapons from the US trained rebels (like the one above). It is unknown if this was at the request of the government or due to the fact they were accounts directly linked to Nusra.

The leader of the US trained group, Anas Obaid, reportedly told Nusra he had deceived the US in order to obtain the weapons and pledged to issue a statement declaring his abandonment of the US project. It is impossible to know if these are simply the words of an individual staring down the barrel of a gun or if this was his true intent from the start.

Last month Pentagon officials were reportedly “shocked” when the AQ affiliate in Syria, Jabhat al Nusra, attacked the US trained and equipped Division 30 in Aleppo; kidnapping many of its members. The spokesperson argued the attack had been “unprovoked” by the group.  This is a bit of a stretch given the US and coalition forces have been bombing Nusra targets throughout Syria for nearly a year.

Aftermath of Coalition Airstrike on Jabhat al-Nusra HQ

Aftermath of Coalition Airstrike on Jabhat al-Nusra HQ

From Nusra’s perspective they likely feel highly “provoked” and thus the targeting of newly US trained rebels last month, and again on Monday, is a predictable consequence. Ironically a chorus of analysts have called into question the logic of putting US trained troops of such small number into Syria. Nusra has thousands of fighters in Idlib and Aleppo and have repeatedly demonstrated a strong intelligence network. Conversely the operational security around the US trained rebels has been porous and the groups could be tracked entering Syria by anyone with a twitter account.

High Ranking Departure

Division 30 Chief of Staff Statement

Division 30 Chief of Staff Statement

In a statement released this past week the chief of staff of Division 30, Colonel Muhammad al-Daher, quit the Train and Equip program citing a number of program failures. It is hard to envision how the impact of his departure along with several critical failures (noted below), will not cause the demise of the program.

  1. Slow implementation of the Division 30 training program and failure to process sufficient numbers of trainees
  2. Failure to secure the basic needs required for the Division’s work
  3. Lack of seriousness in carrying out the project to establish Division 30
  4. Poor censoring of Division 30 supporters present on the ground
  5. Imprecise and haphazard selection of Division 30’s cadres
  6. Ideological disunity among trainees regarding the realization of Division 30’s founding purpose


The Nusra Conundrum

While targeting Nusra is justified as long as it continues to affiliate with al-Qaeda, this will continue to complicate any attempts to put small poorly supported groups on the ground. As US policy drifts towards engagement with Russia and refuses engagement with groups like Ahrar al Sham (seeking dialog) it is likely to diminish the potential of any US Train and Equip mission moving forward. This will also result in further engagement with extremist elements by moderate groups in order to advance movement in the region. Nusra’s role in the capture of Idlib province and the stability of the northern Aleppo corridor with Turkey is well documented. It is ironic that without Nusra, the Islamic State would have captured much more of Syria than it currently holds. However Nusra’s hold on the territory is entirely dependent on cooperation with groups that may moderate their extremist nature. There are numerous examples of moderate rebel units cooperating with and pushing back against Nusra when appropriate.  It is these moderating elements that pose the greatest potential for stabilizing the conflict in the region and ensuring the Nusra and ISIS’ hold is contained.

Unsustainable Direction

Given all the recent failures and the newly disclosed loss of yet another US trained rebel unit there are few conceivable scenarios by which US trained rebels will be allowed to operate effectively in Syria. Continuing to do so would not only put rebel trainee lives at risk but could also embarrass the US Government were another misstep to occur resulting in the further loss of military equipment to extremist actors.

About the Authors:

Dr Camie Condon is an Intelligence Analyst and a post-doctoral researcher with the Tactical Decision Making Research Group at the University of Liverpool. She is also an Analyst with the Intelligence Research Group iBRABO.

Jeff Weyers is a Senior Analyst with iBRABO and a researcher with the Tactical Decision Making Research Group at the University of Liverpool.

Analysis Reveals Australian and Canadian ISIS Members Died Fighting Together

By Jeff R. Weyers and Camie Condon

In June of this year Canadian authorities laid terrorism charges in absentia against Canadian extremist Ahmad Waseem. A native of Windsor Ontario, Waseem had travelled to Syria not once but twice only returning to Canada for treatment of injuries for a short period in 2014.

In September of 2014 and over 15000 kms away, Suhan Rahman, an extremist from Australia had departed on a similar path to join the Islamic state. Like Waseem, Rahman called for others to make the journey to join the Islamic State and was being investigated for his terror ties by Australian investigators. Both men were very overt in their social media presence and their affiliation with the Islamic State.

Fast forward to March of this year and simultaneously reports of Rahman and Waseem’s deaths emerged on social media. From ISIS controlled territory friends of Waseem and Rahman (including Rahman’s own ISIS bride) publicly acknowledged their deaths separately.

In a follow up examination by iBRABO looking at images released by the YPG and notifications of each fighters death it turns out that both of these foreign fighters met their end on the same battlefield in Tal Hamis, Syria. In the image below both Waseem and Rahman are photographed having been killed together by the YPG offensive.

So why should we believe that Waseem and Rahman are dead?
– Both Rahman’s wife and other foreign fighters have openly claimed the deaths of both individuals. While there have been some examples of ISIS fighters faking their deaths generally there has never been a third party confirming it with photographs.

– Case in point, the YPG have been particularly good at documenting war dead in their battles and in this case the faces of both Rahman and Waseem appear intact for identification. The full photos (GRAPHIC CONTENT) can be seen here.

– The newly examined YPG photo (below) would indicate that both individuals were fighting together. It is common for ISIS units to be formed and operate in a common language (Arabic, English, German) for the purpose of communication in the field. Thus it would make sense that Waseem and Rahman (and likely other English speaking members) were in the same unit attacking the YPG.

– Drawing on the separate reports in each country we see that notifications of Waseem and Rahman’s deaths came out at the same time as the YPG documentation of ISIS war dead in Tal Hamis.

– Finally examining the YPG photos against the social media photos of Waseem and Rahman it would appear incontrovertible (see below) that they are in fact the deceased parties.

YPG of Waseem and Rahman killed in Tal Hamis.

YPG Photos of Waseem and Rahman killed in Tal Hamis.

Without the ability to put investigators on the ground in Syria and Iraq, Open Source Intelligence (OSINT) will remain critical for investigators tracking foreign fighters and trying to come to some kind of conclusion on their cases. To date OSINT has been used to geotrack fighters, document their involvement in fighting and provide clues to their associations within ISIS. All of which are valuable in proving terrorism charges against individuals seeking to join ISIS and other designated terror groups. No doubt in this case there will be a need to examine the links between Waseem and Rahman and their associated links to Canada and Australia. The secondary benefit of this data however is that it will potentially allow both the police and the public to put to rest the notion that Waseem and Rahman could ever return to commit further terrorist acts at home.

Toronto Jane: The First Woman to be Documented on the Front Lines with ISIS

Authors Jeff R. Weyers and Mubin Shaikh

The first case of a female on the Islamic State (ISIS) front lines has been documented. A Canadian woman has been tracked through every ISIS stronghold in Syria and Iraq over the past month via her cell phone location services and corresponding tweets.  Western women traveling to the Islamic State is nothing new, but up until this development, females have only taken a supportive role to the cadre. It appears on the surface that the role of women in the Islamic State battlefield may be evolving. There is evidence from the locations of this woman that coincide with local Islamic State gains, which suggests that she may be involved in reconnaissance on behalf of the Caliphate.

While surveilling ISIS strongholds in Syria and Iraq, TRAC analyst Jeff R. Weyers observed another social media account of a Western ISIS supporter that led directly to a female operative in Toronto. Dubbed “L.A.,” based on her Twitter handle, she was actively moving about in Toronto and broadcasting her location until the 23rd of November 2014. At that point, she disappeared and was not seen again until her Android phone began broadcasting on the 8th of December from Ar Raqqah, Syria.

Unlike the typical “domestic” role that is described by many females who have traveled to that ash Sham to become a Mujihida, “L.A.” appears to take a very active role within ISIS. Examining her Twitter geo-location track, “L.A.” has traveled on numerous occasions to virtually every major city that ISIS controls. To put this into perspective, L.A. has traveled across more ISIS controlled territory than any other ISIS operative we have monitored; which brings up the following intriguing questions:

  • Why is ISIS breaking protocol by allowing a woman on the battlefront?
  • Why is ISIS so interested in an Canadian, female operative?
  • And finally, who is escorting her through her travels?

A New Trend in Canadian Female Recruitment to ISIS, exclusive, free content has been unlocked for a limited time as a courtesy to our TRAC Briefings subscribers.  To obtain more information on the Islamic State and the increasing number of females who are aligning themselves with this organization, please contact Hylda Fenton today.

Identifying ISIL Support Populations and Persons Vulnerable to Recruitment

iBRABO is proud to announce the acceptance and publication of Jeff Weyers’ article, “Identifying ISIL Support Populations and Persons Vulnerable to Recruitment” in todays white paper release by the Special Operations Command Central (SOCCENT). The “Multi-Method Assessment of ISIL” involved 80  internationally recognized experts in assisting the SOCCENT in its understanding of ISIL (ISIS).

In response to a request by MG Michael Nagata (US Army, Commander, SOCCENT, Director CJIATF), SMA conducted a short term effort from July-October 2014 to address the question: “What makes ISIL so magnetic, inspirational, and deeply resonant with a specific, but large, portion of the Islamic population allowing it to draw recruitment of foreign fighters, money and weapons, advocacy, general popularity, and finally support from other groups such as Boko Haram, several North African Extremist Groups, and other members of the Regional and International Sunni Extremist organizations?” The articles in this paper summarize work performed by numerous government agencies, academics, think tanks, and industry to understand ISIL’s appeal. These studies collectively attempted to understand the psychological, ideological, narrative, organizational, leadership, emotional, cultural and inspirational
(“intangible”) nature of ISIL.

The project included the development of an overall (Evolution & Longevity) framework to synthesize the qualitative and quantitative analytical approaches for discerning the appeal of ISIL. In the process, interviews were conducted with over 50 SMEs from across the globe to gain insights into the core questions being asked. The effort brought together different perspectives, disciplines, methodologies, and analytic approaches and sources to uncover real and apparent consistencies and inconsistencies among them and to identify how the individual pieces combine to provide a clearer picture of ISIL’s appeal.

A copy of the Multi-Methods Assessment of ISIL can be found here: U_SMA SOCCENT White Paper Final Dec2014

The effort by SOCCENT was recently featured in the New York Times (http://www.nytimes.com/2014/12/29/us/politics/in-battle-to-defang-isis-us-targets-its-psychology-.html)

iBRABO is a Intelligence Research Group located in Waterloo, Ontario specializing in terrorist’s use of social media.

Any inquiries may be made to ibrabo.contact@gmail.com


New Zealand Jihadist Deletes Tweets after Discovering he left Geotagging On

Author: Jeff R. Weyers and Camie Condon, iBRABO


It’s a rookie social media mistake and one that intelligence and law enforcement agencies pray for when tracking criminals. This week one of New Zealand’s well known jihadists, Mark Taylor (Twitter aka: Kiwi Jihadi or @M_Taylor_Kiwi), removed 45 tweets after he discovered that he was broadcasting his twitter location to every intelligence agency (and others) keeping tabs on him. Unfortunately for him we captured all of them prior to him removing the tweets and will discuss the value of the intelligence they contained. Taylor isn’t the first jihadist to broadcast his whereabouts via social media and in fact looking at the battlefield in Syria we see fighters from Canada, France, and other western countries making the same mistake. The benefit of material like this when examining foreign fighters is it allows investigators to establish the extent to which an individual is tied to a terrorist group like Daesh (ISIS). In this manner they can better justify potential criminal charges against the individual and at the very least build grounds for their detention and investigation upon their return.

Kiwi Jihadi Twitter Syria Geocode Tracks from October to December

Kiwi Jihadi Twitter Geocode Tracks from October to December


Twitter isn’t the only social media provider that can allow for geotag tracking. Facebook, Instagram and Flickr all offer the ability to add this feature and in many cases track geotagged related material regardless of whether you turn on the GPS encoding or not. Pictures also quite often can contain geotag information and have been used to establish the movements of groups and their activities. Examining Taylor’s overall twitter broadcast activities (above)  we see that in October of this year he was fighting with ISIS in Kafar Roma, an area which the Syrian Army confirmed had been occupied by pockets of foreign fighters from ISIS. From his broadcasts during the first two weeks in October (below) we know that his tweets ceased about the same time the Syrian army made a strong push into the area.

Kiwi Jihadi in Kafar Roma, Syria in Early October

Kiwi Jihadi in Kafar Roma, Syria in October

After leaving Kafar Roma and according to Taylor’s own tweets he goes off the grid for several months fighting in the desert before finally retreating to the ISIS strong hold of Al Tabqah, Syria in early December. ISIS’s grip on this part of central Syria is supported by numerous ISIS fighters and supporters that regularly tweet from Al Tabqah and Ar Raqqah.  From our own analysis most twitter activity is centered around larger population areas indicating that cellular service is sporadic at best outside of these areas. Examining the numerous tweets that Taylor put out during his time in Al Tabqah we were able to identify one specific house that Taylor predominantly used from the 3rd to the 10th of December 2014 in the south west part of the city (illustrated below).

Kiwi Jihadi in Al Tabqah in Early December

Kiwi Jihadi in Al Tabqah in Early December

There is no doubt that Taylor is fully aware of his social media failures now given his recent removals from his Twitter account and his most recent tweet claiming he was staying in the Islamic State for good.  Examining his photo update on twitter it would also appear that he is on the move with other foreign fighters (luggage in the background). No doubt this is a better alternative than being targeted by a drone strike or any group with the  operational capabilities to target his short lived home in Al Tabqah.


Taylor eager for the fame of being a violent jihadist took to twitter to get attention for his exploits. His statements and twitter missteps have solidified his involvement with ISIS and will provide the evidence should he ever try to return to New Zealand. His ignorance and the ignorance of others has been an advantage to intelligence agencies around the world looking to protect their nations and track the progress of ISIS. Even examining his most recent twitter photo update, Taylor shows again his lack of understanding of technology and intelligence as he broadcast out the facial image of another fighter captured in the background of his photo (below).

Kiwi Jihadi - Mark Taylor - Twitter Photo Update

Kiwi Jihadi – Mark Taylor – Twitter Photo Update

Taylor’s numerous failures demonstrate the opportunities that can be gained through monitoring and tracking extremists via social media and telecommunications. Given his need for attention I’m sure this will not be the last we hear from Kiwi Jihadi. With luck he will fail to read the manual on his next shiny new phone!

Radicalization: There’s an App for That!

Authors: Jeff R. Weyers and Camie Condon, iBRABO

In the wake of the most recent attacks in Australia, Canada and the United States the questions surrounding sources of the radicalization is often a topic of concern. With most self starters a good portion of that radicalization is more and more being attributed to material consumed on the internet. As the world watches Daesh (ISIS, ISIL) flood social media with content one thing is very clear about the online battle with the group, we are losing!

The War on Social Media

For corporations that are being used in the proxy online war it will require a shift in how they do business. For Google, Youtube, Facebook and Twitter they simply cannot afford to have their brands associated with the extremist messages that ISIS, Jabhat al Nusra (JN) and Al Qaeda (AQ) foster. They will need to increase their ability to deal with extremist content in a much more effective method. The notion that “we rely on our users to notify us of inappropriate content” is not going to cut it moving forward. Extremist groups are deploying content to social media at a faster and faster pace, one only needs to look at the number of ISIS videos currently on YouTube, Facebook and Twitter to see that. For the vast amounts of money that each company takes in in any given year they will need to consider hiring extremism experts to proactively monitor content. ISIS, AQ and JN actively use branding in their online videos and pictures, and these companies will need to use those branding symbols to more readily identify terrorist content as they have done with child pornography and copy right infringement. From an ethical and social/corporate responsibility perspective these companies will need to do better.

Bilad al Shaam's 100th Facebook Page

Bilad al Shaam’s 100th Facebook Page

This is not to say that some companies like Facebook haven’t been trying to keep up. Perhaps one of the largest battles between Facebook and ISIS has been in their attempts to crush the “Bilad al Shaam Media” pages that have had a continual presence since before the announcement of the Islamic State. The day after the Australia hostage siege Facebook removed the 100th iteration of the popular ISIS page with well over 3000 users (above) . In the same breath ISIS launched three new Bilad al Shaam sites to continue their operations on Facebook. This is a battle of persistence that will require vigilance and continuous monitoring to start to push the groups away from the larger social media companies. To some extent we have already seen this happening with groups like ISIS moving to platforms like justpaste.it and manbar.me (the Arabic version of Justpaste.it). Both sites are anonymous media hosting sites that terrorist groups have been using to host and direct users to content. Another curious trend noticed by several experts is the return to webpage based sites and chat forums like ISIS’s webpage http://www.alplatformmedia.com (below).

As has been realized by Al-Shabaab (www.al-qimmah.net) and the Taliban (www.shahamat-english.com) , if you can persist through Denial of Service (DNS) attacks by hackers and governments the worst that will happen is they will have to move servers from time to time. In fact while Canadian troops were in the process of preparing to pull out of Afghanistan in late 2012, the Taliban’s webmaster Adil Watanmal had moved all seven of the Talibans websites to a server in Vancouver, Canada (below). The site which primarily is used for propaganda was also engaged in fund raising activities, thus creating a situation where the Taliban were using Canadian servers to assist in fighting against Canadian troops. These types of blatant abuses have resulted in greater calls for internet service providers (ISP) to track and be aware of the content that is being put up on their servers.

Taliban Websites on Canadian Server in 2012 - iBRABO

Taliban Websites on Canadian Server in 2012


Apps in the New Age of Terror

The creation of apps for radicalization is not new. J.M. Berger has previously pointed out how ISIS used the Dawn of Glad Tidings app on Google Play to build the fire storm of twitter support for ISIS. In his forthcoming book, ISIS: The State of Terror he outlines in detail the sophisticated social media strategy of the terror group. Other groups like the Sikh extremist group Babbar Khalsa,  have also used the Google play store in the past with their launch of Babbar Khalsa Radio on Google play.

When we speak about radicalizing potential a group that seems to have gone untouched by Facebook, Twitter and Google Play with a string of social media pages and apps are those under the banner “Generation Awlaki”. Anwar al-Awlaki a highly influential al-Qaeda propagandist and recruiter who was most notoriously linked to the Fort Hood attack was killed in a US drone attack in 2011. His radical preachings however persist as both AQ and ISIS groups have sourced Awlaki in their justification for terror attacks and recruitment to violent jihad. More concerning is that his preachings have reached a cult status amongst extremists and terrorists the world over, having more followers in death than he ever did in life due to the continued growth of social media. In our analysis we were able to locate several instance of the “Generation Awlaki” brand being used on FacebookTwitter and Google play.

Generation Awlaki on Google play

Generation Awlaki on Google play


Generation Awlaki on Twitter

Generation Awlaki on Twitter


Generation Awlaki Facebook

Generation Awlaki on Facebook

Examining the users of this content you see a spectrum of individuals along all parts of the path to violent extremism, from the casually interested to the hardcore foreign fighters and terrorist members. The concern of course with these apps and sites is they put recruiters and propagandists in touch with individuals that may be vulnerable to recruitment to the group or adopting the ideological cause. This is one explanation behind the meteoric rise in foreign fighters that has been seen with ISIS coinciding with their unprecedented social media campaign.

Prevention: A Role for Everyone

Radicalization and prevention is a community issue that will more and more involve social media and the need for users and responsible corporate partners to do their part. As we are seeing the police simply do not have the resources to do it all. If we had endless budgets and resources we could follow and monitor individuals around the clock but that isn’t realistic nor sustainable. If we tackle the issue from a medical model it will mean delivering prevention techniques to those individuals at risk earlier in order to prevent the scenes that we saw recently in Ottawa and Sydney. Everyone has a role in prevention and governments at all levels will need to do more to empower the community, religious organizations and parents to recognize what radicalization looks like and methods for preventing it. At a corporate level, with respect to terrorist’s use of social media, with corporations boasting record profits and share prices the argument that they are ill equipped to deal with the problem seems like a weak one to me. It’s time they start engaging with the experts and thinking out of the box on tackling the issues and doing their part.