Foreign Fighters

Can you see me now? Using Cellular Service in the Fight Against ISIS

The Invisible Beast

In late 2014 as ISIS swept through parts of Iraq and Syria the group quickly realized that one of its greatest tools in recruiting was also one of its greatest potential threats. As ISIS ratcheted up its propaganda machine online it quickly came to realize that cellular and internet access were providing volumes of intelligence to its enemies.

 

tracking-isis2-copy

Geotagged Twitter posts for American jihadist Aashir al Amriki in Raqqa, Syria

 

Perhaps some of the greatest offenders in these intelligence leaks were the fighters themselves. Jihadists like American Aashir al Amriki (above) and New Zealand’s Mark Taylor mistakenly broadcast hidden geotagged information in their social media posts. The advantage of this kind of information is that it allows analysts to create geographic profiles not only of the individual but also of the group itself. Where they fight, where they live, where they gather, where they train, and even where they hide. As coalition strikes mounted urgent notices went out amongst the fighters to be cognizant of their cell phone use and the images they posted online (below) lest be the target of a missile.

 

grain-silos-captured-by-isis-south-of-kobane2-copy

Tracking ISIS Movement in Kobani via Geolocated Social Media Images

 

Such was the case with Reyaad Khan and Rahul Amin, and even Mohammed Emwazi (Jihadi John), who were tracked at least in part via their cell phones which intelligence agencies used in targeted drone strikes. As more and more activist within the Islamic State used the internet to assist coalition forces with intelligence, ISIS began cutting off access to stop the bleed. This resulted in them limiting internet and cellular network access in late 2014 in Mosul and in the middle part of 2015 in Raqqa.

Access as a Weapon of Change

Early on in November, the Wall Street Journal  noted that as Iraqi and Kurdish forces began their offensive into Mosul they also began to reestablish cellular service (for a small fee). The hope being that the population within Mosul would assist coallition forces in providing intelligence about ISIS and their activity within the city.

There is merit in the idea that expanding cheap and/or free cellular access in the city will reap benefits in the fight against ISIS. As word spreads of availability Mosul’s occupants will no doubt seek to access information on the current fight against the group. Information campaigns by mass text alerts could serve to push information to both inform and protect the population.  Geolocated imagery, such as that provided by activists (below),  could assist in identifying Islamic State controlled locations within the embattled Mosul.

 

Using OSINT to Target ISIS.png

Using Activist Images to Geolocate an ISIS Checkpoint in Mosul, Iraq (Source Withheld)

Encouraging the Surrender of Fighters

It is also possible that this access could provide a tool by which disaffected fighters, looking for a push to leave the group, could be influenced to surrender. With Abu Bakr al-Baghdadi reportedly on the run, it is unlikely that all of the 5000 fighters (ISIS’s own figures) are committed to fighting to the death for the broken organization. As pressure mounts, and ISIS fighters in Eastern Mosul are almost entirely cut off by the Tigris River, more examples of fighters surrendering are likely to be the norm.

For a group that has nearly two and a half years of experience using technology against us in this battle, this is one opportunity to help turn the tide. While it is just one piece in the in struggle to retake the city, hopefully we have demonstrated how something as simple as cellular/internet access can be a weapon of advantage and resistance in this fight.

About the Authors

Dr. Camie Condon is an analyst with the Intelligence Research Group iBRABO and a post-doctoral researcher with the Tactical Decision Making Research Group at the University of Liverpool.

Jeff Weyers is a Senior Analyst with the Intelligence Research Group iBRABO and is recognized expert in OSINT/SOCMINT. He is currently a PhD candidate – ABD, on the topic of Preventing Violent Extremism and Terrorist Use of Social Media.

iBRABO is a Intelligence Research Group based in Waterloo, Canada. Its core research capabilities include: conflict monitoring, terrorist use of social media, identifying persons vulnerable to violent extremism and open source intelligence research and analysis. Its researchers come from a diverse background in counter-terrorism, criminal intelligence analysis, police investigation, open source intelligence, and tactical decision making.

Looking for more information on Geolocating images? Check out one of our favorite pages: https://www.bellingcat.com/category/resources/how-tos/

Sources

 Kesling, B. and Nabhan, A. (2016). Forces Seek Help by Restoring Mosul Cellphone Service. http://www.wsj.com/articles/iraqis-seek-help-in-mosul-by-restoring-cell-phone-service-1478030760

Baker, K. (2015). Two British ISIS jihadis killed by RAF drone ‘gave themselves away when they phoned friends at home in the UK’ http://www.dailymail.co.uk/news/article-3232742/ISIS-jihadis-killed-drone-gave-away-phone-call.html#ixzz4QrAVqNrY

AlJazeera (2015). ISIL bans private internet access in Syria’s Raqqa. http://www.aljazeera.com/news/2015/07/isil-bans-private-internet-access-syria-raqqa-150720094428577.html

Analysis Reveals Australian and Canadian ISIS Members Died Fighting Together

By Jeff R. Weyers and Camie Condon

In June of this year Canadian authorities laid terrorism charges in absentia against Canadian extremist Ahmad Waseem. A native of Windsor Ontario, Waseem had travelled to Syria not once but twice only returning to Canada for treatment of injuries for a short period in 2014.

In September of 2014 and over 15000 kms away, Suhan Rahman, an extremist from Australia had departed on a similar path to join the Islamic state. Like Waseem, Rahman called for others to make the journey to join the Islamic State and was being investigated for his terror ties by Australian investigators. Both men were very overt in their social media presence and their affiliation with the Islamic State.

Fast forward to March of this year and simultaneously reports of Rahman and Waseem’s deaths emerged on social media. From ISIS controlled territory friends of Waseem and Rahman (including Rahman’s own ISIS bride) publicly acknowledged their deaths separately.

In a follow up examination by iBRABO looking at images released by the YPG and notifications of each fighters death it turns out that both of these foreign fighters met their end on the same battlefield in Tal Hamis, Syria. In the image below both Waseem and Rahman are photographed having been killed together by the YPG offensive.

So why should we believe that Waseem and Rahman are dead?
– Both Rahman’s wife and other foreign fighters have openly claimed the deaths of both individuals. While there have been some examples of ISIS fighters faking their deaths generally there has never been a third party confirming it with photographs.

– Case in point, the YPG have been particularly good at documenting war dead in their battles and in this case the faces of both Rahman and Waseem appear intact for identification. The full photos (GRAPHIC CONTENT) can be seen here.

– The newly examined YPG photo (below) would indicate that both individuals were fighting together. It is common for ISIS units to be formed and operate in a common language (Arabic, English, German) for the purpose of communication in the field. Thus it would make sense that Waseem and Rahman (and likely other English speaking members) were in the same unit attacking the YPG.

– Drawing on the separate reports in each country we see that notifications of Waseem and Rahman’s deaths came out at the same time as the YPG documentation of ISIS war dead in Tal Hamis.

– Finally examining the YPG photos against the social media photos of Waseem and Rahman it would appear incontrovertible (see below) that they are in fact the deceased parties.

YPG of Waseem and Rahman killed in Tal Hamis.

YPG Photos of Waseem and Rahman killed in Tal Hamis.

Without the ability to put investigators on the ground in Syria and Iraq, Open Source Intelligence (OSINT) will remain critical for investigators tracking foreign fighters and trying to come to some kind of conclusion on their cases. To date OSINT has been used to geotrack fighters, document their involvement in fighting and provide clues to their associations within ISIS. All of which are valuable in proving terrorism charges against individuals seeking to join ISIS and other designated terror groups. No doubt in this case there will be a need to examine the links between Waseem and Rahman and their associated links to Canada and Australia. The secondary benefit of this data however is that it will potentially allow both the police and the public to put to rest the notion that Waseem and Rahman could ever return to commit further terrorist acts at home.

New Zealand Jihadist Deletes Tweets after Discovering he left Geotagging On

Author: Jeff R. Weyers and Camie Condon, iBRABO

A SHINY NEW PHONE WITH NO WHERE TO GO

It’s a rookie social media mistake and one that intelligence and law enforcement agencies pray for when tracking criminals. This week one of New Zealand’s well known jihadists, Mark Taylor (Twitter aka: Kiwi Jihadi or @M_Taylor_Kiwi), removed 45 tweets after he discovered that he was broadcasting his twitter location to every intelligence agency (and others) keeping tabs on him. Unfortunately for him we captured all of them prior to him removing the tweets and will discuss the value of the intelligence they contained. Taylor isn’t the first jihadist to broadcast his whereabouts via social media and in fact looking at the battlefield in Syria we see fighters from Canada, France, and other western countries making the same mistake. The benefit of material like this when examining foreign fighters is it allows investigators to establish the extent to which an individual is tied to a terrorist group like Daesh (ISIS). In this manner they can better justify potential criminal charges against the individual and at the very least build grounds for their detention and investigation upon their return.

Kiwi Jihadi Twitter Syria Geocode Tracks from October to December

Kiwi Jihadi Twitter Geocode Tracks from October to December

TRACKING FOREIGN FIGHTERS VIA THEIR OWN SOCIAL MEDIA

Twitter isn’t the only social media provider that can allow for geotag tracking. Facebook, Instagram and Flickr all offer the ability to add this feature and in many cases track geotagged related material regardless of whether you turn on the GPS encoding or not. Pictures also quite often can contain geotag information and have been used to establish the movements of groups and their activities. Examining Taylor’s overall twitter broadcast activities (above)  we see that in October of this year he was fighting with ISIS in Kafar Roma, an area which the Syrian Army confirmed had been occupied by pockets of foreign fighters from ISIS. From his broadcasts during the first two weeks in October (below) we know that his tweets ceased about the same time the Syrian army made a strong push into the area.

Kiwi Jihadi in Kafar Roma, Syria in Early October

Kiwi Jihadi in Kafar Roma, Syria in October

After leaving Kafar Roma and according to Taylor’s own tweets he goes off the grid for several months fighting in the desert before finally retreating to the ISIS strong hold of Al Tabqah, Syria in early December. ISIS’s grip on this part of central Syria is supported by numerous ISIS fighters and supporters that regularly tweet from Al Tabqah and Ar Raqqah.  From our own analysis most twitter activity is centered around larger population areas indicating that cellular service is sporadic at best outside of these areas. Examining the numerous tweets that Taylor put out during his time in Al Tabqah we were able to identify one specific house that Taylor predominantly used from the 3rd to the 10th of December 2014 in the south west part of the city (illustrated below).

Kiwi Jihadi in Al Tabqah in Early December

Kiwi Jihadi in Al Tabqah in Early December

There is no doubt that Taylor is fully aware of his social media failures now given his recent removals from his Twitter account and his most recent tweet claiming he was staying in the Islamic State for good.  Examining his photo update on twitter it would also appear that he is on the move with other foreign fighters (luggage in the background). No doubt this is a better alternative than being targeted by a drone strike or any group with the  operational capabilities to target his short lived home in Al Tabqah.

FAILURE, AFTER FAILURE, AFTER FAILURE…

Taylor eager for the fame of being a violent jihadist took to twitter to get attention for his exploits. His statements and twitter missteps have solidified his involvement with ISIS and will provide the evidence should he ever try to return to New Zealand. His ignorance and the ignorance of others has been an advantage to intelligence agencies around the world looking to protect their nations and track the progress of ISIS. Even examining his most recent twitter photo update, Taylor shows again his lack of understanding of technology and intelligence as he broadcast out the facial image of another fighter captured in the background of his photo (below).

Kiwi Jihadi - Mark Taylor - Twitter Photo Update

Kiwi Jihadi – Mark Taylor – Twitter Photo Update

Taylor’s numerous failures demonstrate the opportunities that can be gained through monitoring and tracking extremists via social media and telecommunications. Given his need for attention I’m sure this will not be the last we hear from Kiwi Jihadi. With luck he will fail to read the manual on his next shiny new phone!

Canadian Used as Poster Child for Jihad in the New Release of Dabiq Magazine by ISIS

Author: Jeff R. Weyers, IBRABO.com

Dabiq Issue 2

Dabiq Issue 2 Spread

The July 28th release of Dabiq Magazine by the Islamic State (formerly ISIS) features a number of foreign fighters killed in battle including Canadian Andre Poulin. Where as the first issue of Dabiq appeared to focus on the establishment of the Islamic State and its legitimacy, this issue appears to focus on its accomplishments and next steps. The magazine issued by ALHAYAT media center is just the latest in a well organized advertising campaign by the Islamic State.

Dabiq Issue 2 Andre Poulin

Andre Poulin a native of Timmins, Ontario, Canada, has been used in numerous promotional materials by ISIS in their recruitment efforts. The group has placed him on their social media platforms, recruitment videos and now their flagship magazine. For ISIS Poulin represents a key target audience that they have been slowly building throughout western countries.