OSINT

Can you see me now? Using Cellular Service in the Fight Against ISIS

The Invisible Beast

In late 2014 as ISIS swept through parts of Iraq and Syria the group quickly realized that one of its greatest tools in recruiting was also one of its greatest potential threats. As ISIS ratcheted up its propaganda machine online it quickly came to realize that cellular and internet access were providing volumes of intelligence to its enemies.

 

tracking-isis2-copy

Geotagged Twitter posts for American jihadist Aashir al Amriki in Raqqa, Syria

 

Perhaps some of the greatest offenders in these intelligence leaks were the fighters themselves. Jihadists like American Aashir al Amriki (above) and New Zealand’s Mark Taylor mistakenly broadcast hidden geotagged information in their social media posts. The advantage of this kind of information is that it allows analysts to create geographic profiles not only of the individual but also of the group itself. Where they fight, where they live, where they gather, where they train, and even where they hide. As coalition strikes mounted urgent notices went out amongst the fighters to be cognizant of their cell phone use and the images they posted online (below) lest be the target of a missile.

 

grain-silos-captured-by-isis-south-of-kobane2-copy

Tracking ISIS Movement in Kobani via Geolocated Social Media Images

 

Such was the case with Reyaad Khan and Rahul Amin, and even Mohammed Emwazi (Jihadi John), who were tracked at least in part via their cell phones which intelligence agencies used in targeted drone strikes. As more and more activist within the Islamic State used the internet to assist coalition forces with intelligence, ISIS began cutting off access to stop the bleed. This resulted in them limiting internet and cellular network access in late 2014 in Mosul and in the middle part of 2015 in Raqqa.

Access as a Weapon of Change

Early on in November, the Wall Street Journal  noted that as Iraqi and Kurdish forces began their offensive into Mosul they also began to reestablish cellular service (for a small fee). The hope being that the population within Mosul would assist coallition forces in providing intelligence about ISIS and their activity within the city.

There is merit in the idea that expanding cheap and/or free cellular access in the city will reap benefits in the fight against ISIS. As word spreads of availability Mosul’s occupants will no doubt seek to access information on the current fight against the group. Information campaigns by mass text alerts could serve to push information to both inform and protect the population.  Geolocated imagery, such as that provided by activists (below),  could assist in identifying Islamic State controlled locations within the embattled Mosul.

 

Using OSINT to Target ISIS.png

Using Activist Images to Geolocate an ISIS Checkpoint in Mosul, Iraq (Source Withheld)

Encouraging the Surrender of Fighters

It is also possible that this access could provide a tool by which disaffected fighters, looking for a push to leave the group, could be influenced to surrender. With Abu Bakr al-Baghdadi reportedly on the run, it is unlikely that all of the 5000 fighters (ISIS’s own figures) are committed to fighting to the death for the broken organization. As pressure mounts, and ISIS fighters in Eastern Mosul are almost entirely cut off by the Tigris River, more examples of fighters surrendering are likely to be the norm.

For a group that has nearly two and a half years of experience using technology against us in this battle, this is one opportunity to help turn the tide. While it is just one piece in the in struggle to retake the city, hopefully we have demonstrated how something as simple as cellular/internet access can be a weapon of advantage and resistance in this fight.

About the Authors

Dr. Camie Condon is an analyst with the Intelligence Research Group iBRABO and a post-doctoral researcher with the Tactical Decision Making Research Group at the University of Liverpool.

Jeff Weyers is a Senior Analyst with the Intelligence Research Group iBRABO and is recognized expert in OSINT/SOCMINT. He is currently a PhD candidate – ABD, on the topic of Preventing Violent Extremism and Terrorist Use of Social Media.

iBRABO is a Intelligence Research Group based in Waterloo, Canada. Its core research capabilities include: conflict monitoring, terrorist use of social media, identifying persons vulnerable to violent extremism and open source intelligence research and analysis. Its researchers come from a diverse background in counter-terrorism, criminal intelligence analysis, police investigation, open source intelligence, and tactical decision making.

Looking for more information on Geolocating images? Check out one of our favorite pages: https://www.bellingcat.com/category/resources/how-tos/

Sources

 Kesling, B. and Nabhan, A. (2016). Forces Seek Help by Restoring Mosul Cellphone Service. http://www.wsj.com/articles/iraqis-seek-help-in-mosul-by-restoring-cell-phone-service-1478030760

Baker, K. (2015). Two British ISIS jihadis killed by RAF drone ‘gave themselves away when they phoned friends at home in the UK’ http://www.dailymail.co.uk/news/article-3232742/ISIS-jihadis-killed-drone-gave-away-phone-call.html#ixzz4QrAVqNrY

AlJazeera (2015). ISIL bans private internet access in Syria’s Raqqa. http://www.aljazeera.com/news/2015/07/isil-bans-private-internet-access-syria-raqqa-150720094428577.html

Analysis Reveals Australian and Canadian ISIS Members Died Fighting Together

By Jeff R. Weyers and Camie Condon

In June of this year Canadian authorities laid terrorism charges in absentia against Canadian extremist Ahmad Waseem. A native of Windsor Ontario, Waseem had travelled to Syria not once but twice only returning to Canada for treatment of injuries for a short period in 2014.

In September of 2014 and over 15000 kms away, Suhan Rahman, an extremist from Australia had departed on a similar path to join the Islamic state. Like Waseem, Rahman called for others to make the journey to join the Islamic State and was being investigated for his terror ties by Australian investigators. Both men were very overt in their social media presence and their affiliation with the Islamic State.

Fast forward to March of this year and simultaneously reports of Rahman and Waseem’s deaths emerged on social media. From ISIS controlled territory friends of Waseem and Rahman (including Rahman’s own ISIS bride) publicly acknowledged their deaths separately.

In a follow up examination by iBRABO looking at images released by the YPG and notifications of each fighters death it turns out that both of these foreign fighters met their end on the same battlefield in Tal Hamis, Syria. In the image below both Waseem and Rahman are photographed having been killed together by the YPG offensive.

So why should we believe that Waseem and Rahman are dead?
– Both Rahman’s wife and other foreign fighters have openly claimed the deaths of both individuals. While there have been some examples of ISIS fighters faking their deaths generally there has never been a third party confirming it with photographs.

– Case in point, the YPG have been particularly good at documenting war dead in their battles and in this case the faces of both Rahman and Waseem appear intact for identification. The full photos (GRAPHIC CONTENT) can be seen here.

– The newly examined YPG photo (below) would indicate that both individuals were fighting together. It is common for ISIS units to be formed and operate in a common language (Arabic, English, German) for the purpose of communication in the field. Thus it would make sense that Waseem and Rahman (and likely other English speaking members) were in the same unit attacking the YPG.

– Drawing on the separate reports in each country we see that notifications of Waseem and Rahman’s deaths came out at the same time as the YPG documentation of ISIS war dead in Tal Hamis.

– Finally examining the YPG photos against the social media photos of Waseem and Rahman it would appear incontrovertible (see below) that they are in fact the deceased parties.

YPG of Waseem and Rahman killed in Tal Hamis.

YPG Photos of Waseem and Rahman killed in Tal Hamis.

Without the ability to put investigators on the ground in Syria and Iraq, Open Source Intelligence (OSINT) will remain critical for investigators tracking foreign fighters and trying to come to some kind of conclusion on their cases. To date OSINT has been used to geotrack fighters, document their involvement in fighting and provide clues to their associations within ISIS. All of which are valuable in proving terrorism charges against individuals seeking to join ISIS and other designated terror groups. No doubt in this case there will be a need to examine the links between Waseem and Rahman and their associated links to Canada and Australia. The secondary benefit of this data however is that it will potentially allow both the police and the public to put to rest the notion that Waseem and Rahman could ever return to commit further terrorist acts at home.

Dutch and Belgian Mujahideen Social Media Sites Relaunch

Author: Jeff R. Weyers,  IBRABO

Nederlandse Mujahideen in Syrie Facebook and WordPress Pages

Abu Talha Al-Maghribi

Abu Talha Al-Maghribi Post on Nederlandse Mujahideen in Syrie Facebook Site

In a follow up to our examination of De Basis – De Base in the Netherlands and Belgium featured on TRAC, this week iBRABO examines the relaunch of two Dutch/Belgian Mujahideen social media sites. The first, Nederlandse Mujahideen in Syrië (Dutch Mujahideen in Syria), was originally created on Facebook in may 2013 and featured in a report on Dutch foreign fighters by Samar Batrawi (2014), but was subsequently torn down by Facebook.

NMIS link to As-Shaam Media

Nederlandse Mujahideen in Syrie WordPress Site

De BanierSince then the site has relaunched on facebook on August 4th, 2014, and has cross-links to its wordpress site Al-Shaam Media which launched September 12th, 2013 (see image above). It claims to be the “Official Page of the Dutch Mujahideen in Syria”. Both sites feature stories of Dutch Mujahideen that have died fighting in the Syrian conflict, all of whom are believed to have been fighting with the Al-Qaeda affiliate Jabhat al-Nusra. On its wordpress site it also hosts a copy of De Banier (The Banner), a book written by Dutch mujahideen used as a recruiting tool to entice new fighters.

 

Nederlandse/Belgische Mujahideen In Shaam – Minbar Tawheed, Dawah & Jihad Facebook Page

Another site that has relaunched this past week is the  Nederlandse/Belgische Mujahideen In Shaam – Minbar Tawheed, Dawah & Jihad (see image below).

NBMIS Header

As with De Basis the primary point of interest for both these sites are in The Hague, Netherlands and Antwerp, Belgium. The primary demographic of interest being males 18-24 years of age (as obtained from Facebooks own analytics on both sites.

The Issue of Extremist Social Media Sites Re-Launching

One issue that all of the social media sites have been struggling with is the relaunch of extremist and terrorist sites on their platforms. The nature of their design leaves them open to abuse by terrorist and extremist groups. ISIS in fact has learned methods for hiding their sites from the traditional markers that may lead to them being removed. They have done this to some extent through pseudo naming conventions and abbreviated wordings that would be missed by the typical searches. One example of this is Is_IraQ and Levant which actually has its largest following in Jakarta, Indonesia by males aged 25-34. On this site we also see the use of foreign martyrs like Andre Poulin from Canada to assist in the recruiting message (see below).

abu muslim

Post Featuring Abu Muslim (Andre Poulin) on IS_Iraq and Levant Facebook Site

This is an area that will no doubt require further research and co-operation by corporations, academics and practitioners in order to reduce the use of social media by extremist groups.