Month: December 2014

New Zealand Jihadist Deletes Tweets after Discovering he left Geotagging On

Author: Jeff R. Weyers and Camie Condon, iBRABO

A SHINY NEW PHONE WITH NO WHERE TO GO

It’s a rookie social media mistake and one that intelligence and law enforcement agencies pray for when tracking criminals. This week one of New Zealand’s well known jihadists, Mark Taylor (Twitter aka: Kiwi Jihadi or @M_Taylor_Kiwi), removed 45 tweets after he discovered that he was broadcasting his twitter location to every intelligence agency (and others) keeping tabs on him. Unfortunately for him we captured all of them prior to him removing the tweets and will discuss the value of the intelligence they contained. Taylor isn’t the first jihadist to broadcast his whereabouts via social media and in fact looking at the battlefield in Syria we see fighters from Canada, France, and other western countries making the same mistake. The benefit of material like this when examining foreign fighters is it allows investigators to establish the extent to which an individual is tied to a terrorist group like Daesh (ISIS). In this manner they can better justify potential criminal charges against the individual and at the very least build grounds for their detention and investigation upon their return.

Kiwi Jihadi Twitter Syria Geocode Tracks from October to December

Kiwi Jihadi Twitter Geocode Tracks from October to December

TRACKING FOREIGN FIGHTERS VIA THEIR OWN SOCIAL MEDIA

Twitter isn’t the only social media provider that can allow for geotag tracking. Facebook, Instagram and Flickr all offer the ability to add this feature and in many cases track geotagged related material regardless of whether you turn on the GPS encoding or not. Pictures also quite often can contain geotag information and have been used to establish the movements of groups and their activities. Examining Taylor’s overall twitter broadcast activities (above)  we see that in October of this year he was fighting with ISIS in Kafar Roma, an area which the Syrian Army confirmed had been occupied by pockets of foreign fighters from ISIS. From his broadcasts during the first two weeks in October (below) we know that his tweets ceased about the same time the Syrian army made a strong push into the area.

Kiwi Jihadi in Kafar Roma, Syria in Early October

Kiwi Jihadi in Kafar Roma, Syria in October

After leaving Kafar Roma and according to Taylor’s own tweets he goes off the grid for several months fighting in the desert before finally retreating to the ISIS strong hold of Al Tabqah, Syria in early December. ISIS’s grip on this part of central Syria is supported by numerous ISIS fighters and supporters that regularly tweet from Al Tabqah and Ar Raqqah.  From our own analysis most twitter activity is centered around larger population areas indicating that cellular service is sporadic at best outside of these areas. Examining the numerous tweets that Taylor put out during his time in Al Tabqah we were able to identify one specific house that Taylor predominantly used from the 3rd to the 10th of December 2014 in the south west part of the city (illustrated below).

Kiwi Jihadi in Al Tabqah in Early December

Kiwi Jihadi in Al Tabqah in Early December

There is no doubt that Taylor is fully aware of his social media failures now given his recent removals from his Twitter account and his most recent tweet claiming he was staying in the Islamic State for good.  Examining his photo update on twitter it would also appear that he is on the move with other foreign fighters (luggage in the background). No doubt this is a better alternative than being targeted by a drone strike or any group with the  operational capabilities to target his short lived home in Al Tabqah.

FAILURE, AFTER FAILURE, AFTER FAILURE…

Taylor eager for the fame of being a violent jihadist took to twitter to get attention for his exploits. His statements and twitter missteps have solidified his involvement with ISIS and will provide the evidence should he ever try to return to New Zealand. His ignorance and the ignorance of others has been an advantage to intelligence agencies around the world looking to protect their nations and track the progress of ISIS. Even examining his most recent twitter photo update, Taylor shows again his lack of understanding of technology and intelligence as he broadcast out the facial image of another fighter captured in the background of his photo (below).

Kiwi Jihadi - Mark Taylor - Twitter Photo Update

Kiwi Jihadi – Mark Taylor – Twitter Photo Update

Taylor’s numerous failures demonstrate the opportunities that can be gained through monitoring and tracking extremists via social media and telecommunications. Given his need for attention I’m sure this will not be the last we hear from Kiwi Jihadi. With luck he will fail to read the manual on his next shiny new phone!

Radicalization: There’s an App for That!

Authors: Jeff R. Weyers and Camie Condon, iBRABO

In the wake of the most recent attacks in Australia, Canada and the United States the questions surrounding sources of the radicalization is often a topic of concern. With most self starters a good portion of that radicalization is more and more being attributed to material consumed on the internet. As the world watches Daesh (ISIS, ISIL) flood social media with content one thing is very clear about the online battle with the group, we are losing!

The War on Social Media

For corporations that are being used in the proxy online war it will require a shift in how they do business. For Google, Youtube, Facebook and Twitter they simply cannot afford to have their brands associated with the extremist messages that ISIS, Jabhat al Nusra (JN) and Al Qaeda (AQ) foster. They will need to increase their ability to deal with extremist content in a much more effective method. The notion that “we rely on our users to notify us of inappropriate content” is not going to cut it moving forward. Extremist groups are deploying content to social media at a faster and faster pace, one only needs to look at the number of ISIS videos currently on YouTube, Facebook and Twitter to see that. For the vast amounts of money that each company takes in in any given year they will need to consider hiring extremism experts to proactively monitor content. ISIS, AQ and JN actively use branding in their online videos and pictures, and these companies will need to use those branding symbols to more readily identify terrorist content as they have done with child pornography and copy right infringement. From an ethical and social/corporate responsibility perspective these companies will need to do better.

Bilad al Shaam's 100th Facebook Page

Bilad al Shaam’s 100th Facebook Page

This is not to say that some companies like Facebook haven’t been trying to keep up. Perhaps one of the largest battles between Facebook and ISIS has been in their attempts to crush the “Bilad al Shaam Media” pages that have had a continual presence since before the announcement of the Islamic State. The day after the Australia hostage siege Facebook removed the 100th iteration of the popular ISIS page with well over 3000 users (above) . In the same breath ISIS launched three new Bilad al Shaam sites to continue their operations on Facebook. This is a battle of persistence that will require vigilance and continuous monitoring to start to push the groups away from the larger social media companies. To some extent we have already seen this happening with groups like ISIS moving to platforms like justpaste.it and manbar.me (the Arabic version of Justpaste.it). Both sites are anonymous media hosting sites that terrorist groups have been using to host and direct users to content. Another curious trend noticed by several experts is the return to webpage based sites and chat forums like ISIS’s webpage http://www.alplatformmedia.com (below).

As has been realized by Al-Shabaab (www.al-qimmah.net) and the Taliban (www.shahamat-english.com) , if you can persist through Denial of Service (DNS) attacks by hackers and governments the worst that will happen is they will have to move servers from time to time. In fact while Canadian troops were in the process of preparing to pull out of Afghanistan in late 2012, the Taliban’s webmaster Adil Watanmal had moved all seven of the Talibans websites to a server in Vancouver, Canada (below). The site which primarily is used for propaganda was also engaged in fund raising activities, thus creating a situation where the Taliban were using Canadian servers to assist in fighting against Canadian troops. These types of blatant abuses have resulted in greater calls for internet service providers (ISP) to track and be aware of the content that is being put up on their servers.

Taliban Websites on Canadian Server in 2012 - iBRABO

Taliban Websites on Canadian Server in 2012

 

Apps in the New Age of Terror

The creation of apps for radicalization is not new. J.M. Berger has previously pointed out how ISIS used the Dawn of Glad Tidings app on Google Play to build the fire storm of twitter support for ISIS. In his forthcoming book, ISIS: The State of Terror he outlines in detail the sophisticated social media strategy of the terror group. Other groups like the Sikh extremist group Babbar Khalsa,  have also used the Google play store in the past with their launch of Babbar Khalsa Radio on Google play.

When we speak about radicalizing potential a group that seems to have gone untouched by Facebook, Twitter and Google Play with a string of social media pages and apps are those under the banner “Generation Awlaki”. Anwar al-Awlaki a highly influential al-Qaeda propagandist and recruiter who was most notoriously linked to the Fort Hood attack was killed in a US drone attack in 2011. His radical preachings however persist as both AQ and ISIS groups have sourced Awlaki in their justification for terror attacks and recruitment to violent jihad. More concerning is that his preachings have reached a cult status amongst extremists and terrorists the world over, having more followers in death than he ever did in life due to the continued growth of social media. In our analysis we were able to locate several instance of the “Generation Awlaki” brand being used on FacebookTwitter and Google play.

Generation Awlaki on Google play

Generation Awlaki on Google play

 

Generation Awlaki on Twitter

Generation Awlaki on Twitter

 

Generation Awlaki Facebook

Generation Awlaki on Facebook

Examining the users of this content you see a spectrum of individuals along all parts of the path to violent extremism, from the casually interested to the hardcore foreign fighters and terrorist members. The concern of course with these apps and sites is they put recruiters and propagandists in touch with individuals that may be vulnerable to recruitment to the group or adopting the ideological cause. This is one explanation behind the meteoric rise in foreign fighters that has been seen with ISIS coinciding with their unprecedented social media campaign.

Prevention: A Role for Everyone

Radicalization and prevention is a community issue that will more and more involve social media and the need for users and responsible corporate partners to do their part. As we are seeing the police simply do not have the resources to do it all. If we had endless budgets and resources we could follow and monitor individuals around the clock but that isn’t realistic nor sustainable. If we tackle the issue from a medical model it will mean delivering prevention techniques to those individuals at risk earlier in order to prevent the scenes that we saw recently in Ottawa and Sydney. Everyone has a role in prevention and governments at all levels will need to do more to empower the community, religious organizations and parents to recognize what radicalization looks like and methods for preventing it. At a corporate level, with respect to terrorist’s use of social media, with corporations boasting record profits and share prices the argument that they are ill equipped to deal with the problem seems like a weak one to me. It’s time they start engaging with the experts and thinking out of the box on tackling the issues and doing their part.