Geotagged Terrorist Media

Can you see me now? Using Cellular Service in the Fight Against ISIS

The Invisible Beast

In late 2014 as ISIS swept through parts of Iraq and Syria the group quickly realized that one of its greatest tools in recruiting was also one of its greatest potential threats. As ISIS ratcheted up its propaganda machine online it quickly came to realize that cellular and internet access were providing volumes of intelligence to its enemies.

 

tracking-isis2-copy

Geotagged Twitter posts for American jihadist Aashir al Amriki in Raqqa, Syria

 

Perhaps some of the greatest offenders in these intelligence leaks were the fighters themselves. Jihadists like American Aashir al Amriki (above) and New Zealand’s Mark Taylor mistakenly broadcast hidden geotagged information in their social media posts. The advantage of this kind of information is that it allows analysts to create geographic profiles not only of the individual but also of the group itself. Where they fight, where they live, where they gather, where they train, and even where they hide. As coalition strikes mounted urgent notices went out amongst the fighters to be cognizant of their cell phone use and the images they posted online (below) lest be the target of a missile.

 

grain-silos-captured-by-isis-south-of-kobane2-copy

Tracking ISIS Movement in Kobani via Geolocated Social Media Images

 

Such was the case with Reyaad Khan and Rahul Amin, and even Mohammed Emwazi (Jihadi John), who were tracked at least in part via their cell phones which intelligence agencies used in targeted drone strikes. As more and more activist within the Islamic State used the internet to assist coalition forces with intelligence, ISIS began cutting off access to stop the bleed. This resulted in them limiting internet and cellular network access in late 2014 in Mosul and in the middle part of 2015 in Raqqa.

Access as a Weapon of Change

Early on in November, the Wall Street Journal  noted that as Iraqi and Kurdish forces began their offensive into Mosul they also began to reestablish cellular service (for a small fee). The hope being that the population within Mosul would assist coallition forces in providing intelligence about ISIS and their activity within the city.

There is merit in the idea that expanding cheap and/or free cellular access in the city will reap benefits in the fight against ISIS. As word spreads of availability Mosul’s occupants will no doubt seek to access information on the current fight against the group. Information campaigns by mass text alerts could serve to push information to both inform and protect the population.  Geolocated imagery, such as that provided by activists (below),  could assist in identifying Islamic State controlled locations within the embattled Mosul.

 

Using OSINT to Target ISIS.png

Using Activist Images to Geolocate an ISIS Checkpoint in Mosul, Iraq (Source Withheld)

Encouraging the Surrender of Fighters

It is also possible that this access could provide a tool by which disaffected fighters, looking for a push to leave the group, could be influenced to surrender. With Abu Bakr al-Baghdadi reportedly on the run, it is unlikely that all of the 5000 fighters (ISIS’s own figures) are committed to fighting to the death for the broken organization. As pressure mounts, and ISIS fighters in Eastern Mosul are almost entirely cut off by the Tigris River, more examples of fighters surrendering are likely to be the norm.

For a group that has nearly two and a half years of experience using technology against us in this battle, this is one opportunity to help turn the tide. While it is just one piece in the in struggle to retake the city, hopefully we have demonstrated how something as simple as cellular/internet access can be a weapon of advantage and resistance in this fight.

About the Authors

Dr. Camie Condon is an analyst with the Intelligence Research Group iBRABO and a post-doctoral researcher with the Tactical Decision Making Research Group at the University of Liverpool.

Jeff Weyers is a Senior Analyst with the Intelligence Research Group iBRABO and is recognized expert in OSINT/SOCMINT. He is currently a PhD candidate – ABD, on the topic of Preventing Violent Extremism and Terrorist Use of Social Media.

iBRABO is a Intelligence Research Group based in Waterloo, Canada. Its core research capabilities include: conflict monitoring, terrorist use of social media, identifying persons vulnerable to violent extremism and open source intelligence research and analysis. Its researchers come from a diverse background in counter-terrorism, criminal intelligence analysis, police investigation, open source intelligence, and tactical decision making.

Looking for more information on Geolocating images? Check out one of our favorite pages: https://www.bellingcat.com/category/resources/how-tos/

Sources

 Kesling, B. and Nabhan, A. (2016). Forces Seek Help by Restoring Mosul Cellphone Service. http://www.wsj.com/articles/iraqis-seek-help-in-mosul-by-restoring-cell-phone-service-1478030760

Baker, K. (2015). Two British ISIS jihadis killed by RAF drone ‘gave themselves away when they phoned friends at home in the UK’ http://www.dailymail.co.uk/news/article-3232742/ISIS-jihadis-killed-drone-gave-away-phone-call.html#ixzz4QrAVqNrY

AlJazeera (2015). ISIL bans private internet access in Syria’s Raqqa. http://www.aljazeera.com/news/2015/07/isil-bans-private-internet-access-syria-raqqa-150720094428577.html

New Zealand Jihadist Deletes Tweets after Discovering he left Geotagging On

Author: Jeff R. Weyers and Camie Condon, iBRABO

A SHINY NEW PHONE WITH NO WHERE TO GO

It’s a rookie social media mistake and one that intelligence and law enforcement agencies pray for when tracking criminals. This week one of New Zealand’s well known jihadists, Mark Taylor (Twitter aka: Kiwi Jihadi or @M_Taylor_Kiwi), removed 45 tweets after he discovered that he was broadcasting his twitter location to every intelligence agency (and others) keeping tabs on him. Unfortunately for him we captured all of them prior to him removing the tweets and will discuss the value of the intelligence they contained. Taylor isn’t the first jihadist to broadcast his whereabouts via social media and in fact looking at the battlefield in Syria we see fighters from Canada, France, and other western countries making the same mistake. The benefit of material like this when examining foreign fighters is it allows investigators to establish the extent to which an individual is tied to a terrorist group like Daesh (ISIS). In this manner they can better justify potential criminal charges against the individual and at the very least build grounds for their detention and investigation upon their return.

Kiwi Jihadi Twitter Syria Geocode Tracks from October to December

Kiwi Jihadi Twitter Geocode Tracks from October to December

TRACKING FOREIGN FIGHTERS VIA THEIR OWN SOCIAL MEDIA

Twitter isn’t the only social media provider that can allow for geotag tracking. Facebook, Instagram and Flickr all offer the ability to add this feature and in many cases track geotagged related material regardless of whether you turn on the GPS encoding or not. Pictures also quite often can contain geotag information and have been used to establish the movements of groups and their activities. Examining Taylor’s overall twitter broadcast activities (above)  we see that in October of this year he was fighting with ISIS in Kafar Roma, an area which the Syrian Army confirmed had been occupied by pockets of foreign fighters from ISIS. From his broadcasts during the first two weeks in October (below) we know that his tweets ceased about the same time the Syrian army made a strong push into the area.

Kiwi Jihadi in Kafar Roma, Syria in Early October

Kiwi Jihadi in Kafar Roma, Syria in October

After leaving Kafar Roma and according to Taylor’s own tweets he goes off the grid for several months fighting in the desert before finally retreating to the ISIS strong hold of Al Tabqah, Syria in early December. ISIS’s grip on this part of central Syria is supported by numerous ISIS fighters and supporters that regularly tweet from Al Tabqah and Ar Raqqah.  From our own analysis most twitter activity is centered around larger population areas indicating that cellular service is sporadic at best outside of these areas. Examining the numerous tweets that Taylor put out during his time in Al Tabqah we were able to identify one specific house that Taylor predominantly used from the 3rd to the 10th of December 2014 in the south west part of the city (illustrated below).

Kiwi Jihadi in Al Tabqah in Early December

Kiwi Jihadi in Al Tabqah in Early December

There is no doubt that Taylor is fully aware of his social media failures now given his recent removals from his Twitter account and his most recent tweet claiming he was staying in the Islamic State for good.  Examining his photo update on twitter it would also appear that he is on the move with other foreign fighters (luggage in the background). No doubt this is a better alternative than being targeted by a drone strike or any group with the  operational capabilities to target his short lived home in Al Tabqah.

FAILURE, AFTER FAILURE, AFTER FAILURE…

Taylor eager for the fame of being a violent jihadist took to twitter to get attention for his exploits. His statements and twitter missteps have solidified his involvement with ISIS and will provide the evidence should he ever try to return to New Zealand. His ignorance and the ignorance of others has been an advantage to intelligence agencies around the world looking to protect their nations and track the progress of ISIS. Even examining his most recent twitter photo update, Taylor shows again his lack of understanding of technology and intelligence as he broadcast out the facial image of another fighter captured in the background of his photo (below).

Kiwi Jihadi - Mark Taylor - Twitter Photo Update

Kiwi Jihadi – Mark Taylor – Twitter Photo Update

Taylor’s numerous failures demonstrate the opportunities that can be gained through monitoring and tracking extremists via social media and telecommunications. Given his need for attention I’m sure this will not be the last we hear from Kiwi Jihadi. With luck he will fail to read the manual on his next shiny new phone!