The Dynamics of the Creation, Evolution, and Disappearance of

The Dynamics of the Creation, Evolution, and Disappearance of

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums Early View 1 The Dynamics of the Creatio...

222KB Sizes 0 Downloads 0 Views

Recommend Documents

A Theology of Purpose: Creation, Evolution and the Understanding of
biological reality. Recently, however, Simon Conway Morris has countered ...... Graham O'Brien (PhD Cellular and Molecul

Chaotic population dynamics and the evolution of - The Math Forum
Chaotic population dynamics and the evolution of ageing. Joshua Mitteldorf*. Department of Ecology and Evolutionary Biol

"Functioning and Evolution of the "Functioning and Evolution of the
We would like to thank The John S. Latsis Public Benefit Foundation and its. Executive ...... and Meteorology from the U

Opinion Dynamics and the Evolution of Social Power in Influence
set of relative interpersonal weights, the DeGroot-Friedkin model predicts the evolution of the influence network govern

The Dynamics and Evolution of Industries - IIASA PURE
This point was greatly emphasized also by Schumpeter in "Business Cycles" which ..... the industry cycle started with th

The Transformation of Work, the Disappearance of 'Workers', and the
The Transformation of Work, the Disappearance of. 'Workers', and the Future of Workplace Regulation. Harry W. Arthurs. O

the dynamics of platform business value creation - Competition Policy
or complementary providers) and the large opportunities for demand and supply complementarities that are technologically

The Disappearance and Regeneration of -
DISAPPEARANCE AND REGENERATION OF LANGERHANS CELLS. 173 a striking phenomenon. It contained a large number of adenosine

The Disappearance of Cyberspace and the Rise of Code
The Disappearance of Cyberspace and the Rise of Code -- Page 1. September 1998, Draft 3. Andrew L. Shapiro*. The Disappe

Darwin's Compass: How Evolution Discovers the Song of Creation
SIMON CONWAY MORRIS. The Boyle Lecture 2005: Darwin's. Compass: How Evolution Discovers the Song of Creation. Key Words:

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

Early View


The Dynamics of the Creation, Evolution, and Disappearance of Terrorist Internet Forums Manuel Ricardo Torres-Soriano, Public Law Department (Political Science Section), Pablo de Olavide University, Seville, Spain

An examination of the organizational nature of the threat posed by jihadi terrorism, supplying quantitative and qualitative data on the dynamics behind the creation, evolution, and disappearance of the main jihadi Internet forums during the period 2008–2012. An analysis of the origins and functions of the forums, their links with terrorist organizations, their internal structures, and the processes accounting for their stability in cyberspace shows that far from representing a horizontal structure where the main actors are a network of followers, the terrorist presence on the Internet is in fact a hierarchical organization in which intervention by formal terrorist organizations plays a crucial role.

Recent years have witnessed a very interesting theoretical debate on the organizational nature of jihadi terrorism and its evolution over the past decade. Center stage in the discussion has been occupied by two American academics: Marc Sageman (2004, 2008) and Bruce Hoffman (2008). Whereas the former argues that the post-9/11 counterterrorism response has resulted in effective control of terrorist actions passing to the grass-roots level, giving rise to a leaderless jihad in which terrorist groups play a secondary role, the latter argues that formal organizations, particularly Al Qaeda Central, continue to exercise a substantial degree of strategic and operational control. Supporters of both arguments have analyzed terrorist plots executed or foiled in recent years and arrived at contradictory conclusions with respect to how terrorist cells are formed, their links to organizations, and the main profile of the terrorist threat in the West, namely, whether it comes from independent cells and imitators (bunch of guys and wannabes, to borrow Sageman’s terms) or from the actions of formal global organizations.1 This article is part of a Research Project financed by the Spanish Ministry of Science and Innovation „The Organizational Structure of International Terrorism: Implications for European Security (CSO2010–17849)”, directed by Professor Javier Jordán.

This article contributes to the academic debate by providing quantitative and qualitative data on jihadist Internet forums, offering new elements for consideration in the debate on the organizational nature of the jihadi threat. Few monographs have examined the functioning of jihadi forums by measuring their main data (Kimmage and Ridolfo 2007; Kimmage 2008; Zelin and Borow 2013). The present contribution also seeks to fill some of the gaps by undertaking a descriptive analysis of the dynamics explaining the creation, evolution, and disappearance of these sites. The internet has become the main resource in jihadi communication strategies (Kohlmann 2006). Terrorists make extensive use of technology for communication purposes, as well as for recruitment, propaganda, fund-raising, and training (Weimann 2006a). Jihadist activity on the internet has evolved over the years. Initially, the web activities of terrorist organizations took the form of top-down websites (Zelin 2011): a series of platforms created to disseminate doctrinal materials and propaganda. Participation by internet users was restricted to consumption of said content and assistance

1 Many authors have since underlined the mixed or multifaceted nature of global terrorism (Reinares 2008, 2010), the complementarity of the views of Sageman and Hoffman (Neumann, Evans, and Pan-

tucci 2011; Jordán 2012), and – after detailed study of its organizational evolution – Al Qaeda Central’s capacity for survival and self-regeneration (Gunaratna and Oreg 2010).

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

in its dissemination through distribution in different formats. Following the September 11 attacks, the websites created and administered by these groups were no longer allowed to operate with impunity and they began to disappear due to continuous harassment by security forces, intelligence services, and hackers. Jihadi organizations abandoned their aspiration to maintain “official” websites as a point of contact between the group and its followers. By way of alternative strategy, they switched their attention to an apparently more horizontal and diffuse internet presence. Internet forums drawing their inspiration from the “Web 2.0” philosophy are the main manifestation of this new erainternet: a new generation of web portals based on virtual social communities and a range of services that encourage collaboration and flexible exchange of information among users. Internet users leave behind their previous status as passive consumers of online materials (Web 1.0) and participate in a virtual community, also producing content themselves. In appearance at least, the jihadist presence on the internet has moved away from a structure of “official” websites controlled by the propaganda apparatuses of hierarchical organizations (Torres, Jordán, and Horsburgh 2006) towards a network in which the lead role is played by a mass of radical supporters with only tenuous ties to formal groups. However, as I will argue, the current structure of jihadi internet forums is only viable on the basis of their active links with “formal” terrorist organizations, which make them interesting and attractive to a broad community of followers. In order to reach this conclusion we will examine the origins and functions of such forums, the manner in which they forge links with terrorist organizations, their internal structure, and the processes accounting for their stability in cyberspace. 1. Methodology and Information Sources The data used in the article were obtained through detailed monitoring of the main jihadi internet forums between January 2011 and June 2012 (inclusive). The qualitative data are derived from a content analysis of the materials available on the forums and a quantification of the development of the number of users, discussion topics, and 2

Early View


posts. In order to offer a perspective over a longer timeframe, information was drawn from Internet Archive,2 the comprehensive virtual library of all websites that have been available at some stage on the internet. However, it should be noted that the information offered by the Archive is derived from random, unsystematic captures that preclude quantification of certain dynamics. Accordingly, only data from the aforementioned eighteen-month period of direct observation was used to measure these aspects. In selecting sites for analysis, attention focused on forums (mostly in Arabic) constituting the “inner circle” or core of the jihadist internet presence (see Table 1). This elite group is formed by websites with the largest followings and greatest influence among the jihadi cyber-community. Forums that host radical content but can be considered secondary because they tend merely to re-post content from other sites (as opposed received directly from producers) were therefore excluded from our detailed examination. Nonetheless, by way of additional input to the study, occasional reference will be made to data from these “concentric rings.” Table 1: Forums analyzed (January 2011 – June 2012)


Description forum in Arabic. Also features Atahadi: General subdirectories in various European vb/index.php/ languages. General forum in Arabic. Focuses parAl Jahafal: ticularly on issues concerning the jihad in the Maghreb. Al Amanh:

Forum in Arabic focused on the jihad in Palestine/Israel.

Al Qimmah:

Forum mainly in Somali and, to a lesser extent, Arabic. Largely focused on the jihad in Somalia.

Al Jahad:

General forum in Arabic. The youngest forum in the selection.

Al Shamukh:

General forum in Arabic. Considered the most influential.

Ansar Al Mujahidin Arabic Forum: General forum. Also has English ver sion.

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

Additional data were obtained from forums such as Al Faloja,3 Al Hesbah,4 and Al Ekhlaas,5 which were no longer operational at the time of the research but played a leading role in the jihadi internet community for many years. 2. Origin and Functions of Jihadi Internet Forums According to Anne Stenersen (2009): “the early history of jihadi websites remains very poorly understood. Most of us started studying them too late.” By the time these spaces began to attract the attention of security agencies and the specialist community, they were already a key component of the terrorist presence on the internet.

Stenersen cites an article by an influential jihadist ideologue briefly outlining the history of jihadi forums, the origins of which can be traced back to a series of Islamist-inspired websites from the late 1990s.6 Although the topics covered were not exclusively jihadist, the sites included information and user comments on violent conflicts involving Muslims. The 9/11 attacks spawned a group of forums whose content clearly supported Al Qaeda terrorism. The most prominent was Al Tawhid, which featured contributions from leading terrorist jihad ideologists and preachers, including the London-based Jordanian Abu Qatada and Egyptian Abu Hamza, and is still active today.7 Despite being a “traditional” website full of doctrinal materials for downloading, it also contained a forum allowing interaction among readers. The first jihadi forum used by a terrorist organization as a primary propaganda channel was Muntada Al Ansar Al Islami (Islam Supporters Forum),8 which appeared at the end of 2003. The site achieved considerable public impact due to the contributions of one particular user, Abu Maysara Al Iraqi, the official spokesman of Al Qaeda in Iraq. The organization, founded and led by Jordanian terrorist Abu Musab Al Zarqawi, gave up its efforts to maintain an official propaganda website after constant cyber-attacks. Dis3 (defunct).

4 (defunct).

5 (defunct).

6 Mihdar, “Jihadist forums, pros and cons. Historical analysis” (in Arabic), Medad Al Soyoof Net-

Early View


tributing materials to a website not formally affiliated to the organization ensured it a continuing presence in cyberspace. Thus began a symbiotic relationship between a terrorist group and a radical website, which saw the former greatly enhance its communications capabilities and the latter earn prestige and influence on account of its privileged ties with the mujahideen. This model was subsequently emulated by other groups and terrorist networks that had encountered similar problems in seeking to maintain an effective internet presence. In May 2004 the forum was knocked offline by a cyber-attack after it posted a gruesome video of Zarqawi’s beheading of American contractor Nicholas Berg. It quickly returned, although as a security measure no longer offering open access to all internet users and instead requiring registration to view content. The forum had, however, become the de facto official website for Al Qaeda in Iraq, which made it a prime target for actors seeking to neutralize the group’s presence on the internet. It disappeared soon thereafter, although its work was to be carried on by other leading forums such as Al Ekhlas (“Sincerity”).9 Jihadi groups concluded that if they sent their materials exclusively to a single forum, it would eventually disappear since it would become identified as an extension of the group and would fall foul of the same pressure suffered by official sites. Accordingly, they opted to send materials simultaneously to several trusted sites, thus blurring the links between the mujahideen and internet platforms. Redundancy of content meant that distribution was maintained even if certain sites disappeared. The decision by jihadi groups to focus on internet forums was driven by the aim of ensuring a more stable cyberspace presence (Torres-Soriano 2009), but also brought with it a range of additional advantages, including: a) Ease of use. It is considerably easier to design and administer a forum than a conventional website. Most

work, (accessed 03/03/2009, now defunct). 7 Pulpit of Monotheism and Jihad (in Arabic):

8 (defunct).

9 (defunct).

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

are based on commercial applications that require no programming skills.10 Users merely fill in blank fields to input content into a structure whose design and basic functions are pre-established. The software does allow certain customization options, particularly graphics, but the platform architecture is rigid. This explains the great similarities in the organization, functioning, and even visual appearance of the various forums. b) Reinforcing global jihad rhetoric. On a single site, forum users can access materials supplied by groups operating in very different regions such as the Philippines, Chechnya, Pakistan, Indonesia, Algeria, etc. Bringing all such propaganda under one roof gives followers the impression that the actions of the different jihadi groups form part of a single conflict in defense of Islam that has no national borders or divides. c) Encouraging a sense of belonging to a single community. Forums have become a virtual meeting and interaction space for people who share the same radical beliefs. Such individuals may find that their ideas and attitudes are a minority position or rejected in their immediate social circles, and this might weaken their convictions (Jordán 2009). internet forums allow them to counter that isolation by connecting them to thousands of web users worldwide who share the same set of beliefs and attitudes. This virtual socialization function has acquired increasing importance as jihadi networks have seen their visibility in the physical world diminish as a result of repression by police and the courts (Vidino 2011). d) Facilitating communication and creating networks. Forums facilitate the creation of links between isolated individuals who do not know each other personally, and provide them with instruments for 10 The most widely used forum software is VBulletin, which is also used by many jihadi forums. 11 A principle coined by Bob Metcalfe, the inventor of the Ethernet protocol used to network computers.

Early View


private communication via chat rooms, restricted-access posts, and IP telephony. These interactions may lead to real-world contact between the individuals concerned. e) Strengthening virtual recruitment. Virtual activities cultivate users’ reputations as supporters of the jihad. The volume and quality of their contributions constitute an important indicator for recruitment by terrorist groups and individuals seeking to set up operational networks. Recruitment can be more effective if targeted to individuals whose track record as users of jihadi internet forums demonstrates their receptiveness. 3. Forum Creation and Operational Dynamics The jihadi forum universe is a clearly hierarchical one. At the top of the pyramid are a small number that stand apart from the rest, receiving materials directly from organizations that perpetrate acts of terrorism and from renowned ideologists. This privileged status makes such forums a point of reference for others, which merely replicate content that originally appeared in these toplevel websites.

Cooperative ties with terrorist organizations are in themselves sufficient reason to explain the success or failure of the platforms. Forums benefiting from “patronage” can attract considerably more internet users than others. Supporters of the jihadi message on the internet generally choose to participate in virtual communities that can demonstrate that they are trusted by the mujahideen. Admission and growth dynamics can be explained by Metcalfe’s law,11 according to which the usefulness of a network increases at an accelerating rate as each new user is added. Endorsement by a formal organization allows swift and sustained growth in the number of registered users (see Figure 1).

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

Early View


Figure 1: Membership of main jihadi internet forums (annual average, 2008–June 2012) 30,000 25,000 20,000 15,000 10,000 5,000




























1,889 17,064









Forums that replicate propaganda from other websites find it extremely difficult to offer a differentiated “product” that is attractive to radical internet users. Despite replicating considerable volumes of material from other sites, some websites are unable to attain the minimum threshold of users required to establish a virtuous circle.12 Ties with terrorist organizations are essential to generate the critical mass of committed users needed to guarantee future viability. Links between formal terrorist organizations and internet forums are based on relationships of mutual trust. Due to the risk that a virtual community may have been infiltrated by intelligence agencies or other actors with hostile intentions, jihadi groups are constantly suspicious and few forums succeed in forging collaborative ties. The links 12 One example of the difficulties involved is provided by the Arabic forum Shabaka Al Haqiqa Al Ikhbaria (Truth Information Network) ( The site was run from Spain by Moroccan Abdellatif Oulad Chiba,

between forums and organizations tend to arise in three different ways. First, the administrator or administrators may have formal links with the terrorist group and operate the forum as part of those activities. The forum is not the group’s official website, however. Rather it is a self-appointed initiative in support of all mujahideen. One such case is the Saudi citizen Walid bin Muhammad Al-Sama’ani who, prior to his death in 2005, combined membership of Al Qaeda in the Arabian Peninsula with his activities as the founder and administrator of the Al Ekhlaas forum (SITE 2007). Secondly, forum members may be individuals who, although not formally part of a terrorist organization, pos-

until his arrest in August 2011. During its threemonth existence, it managed to attract only thirteen registered users despite having more than 7,800 discussion threads and 10,000 posts from other sites, which were uploaded daily by the site administrator.

See Audiencia Nacional (Juzgado Central de Instrucción nº 3), “Diligencias previas 126/2011,” August 20, 2011. ultimahora/media/201108/20/espana/20110820elpepunac_1_Pes_PDF.pdf

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

sess a network of social relations that facilitate contact. Such cases include individuals who travel to areas where jihadi groups operate openly and visibly (for example Chechnya, Iraq, Afghanistan, etc.) but fail in their attempts to join the armed struggle. Nonetheless, their credibility and network of contacts mean that their online activism is endorsed by their collaboration with formal groups. Examples include the members of the Global Islamic Media Front propaganda platform who were arrested in Canada, Austria, and Germany (Torres-Soriano 2012a). Finally, a forum may initially operate without collaboration from terrorist groups, yet over time acquire credibility that attracts interest from formal groups, which take the initiative in proposing collaboration. By way of example, the technical expertise demonstrated in various forums by UK-based cyberjihadist Younis Tsouli brought him to the attention of the media spokesman of Al Qaeda in Iraq. The organization initiated close cooperation with the young Moroccan, whose internet pseudonym was Irhabi 007 (Terrorist 007). Even though no face-to-face contact ever took place between Tsouli and the Iraqi group, his internet credibility made him a key link in the group’s online propaganda (Labi 2006; O’Neill 2007). The relationships described above have been affected by the emergence of a new player acting as an intermediary between jihadi forums and terrorist groups: jihadist media distributor networks (Rogan 2007). The mission of these organizations is to assist with the dissemination of propaganda prepared by the mujahideen and their ideologists. Their roles include editing raw material sent by terrorist organizations, subtitling and translation, and designing website infographics. However, their most important role is to authenticate the propaganda of the terrorist groups and act as intermediaries between the organizations and internet forums. Administrators therefore need to develop relations of trust with the media organizations that monopolize the dissemination of “official” propaganda. The role of these organizations has become increasingly important in the aftermath of the damage caused to the credibility of the jihadi message by the appearance of fake communiqués. The most important of the aforementioned media organizations is the Al Fajr Media Center, an unofficial distributor

Early View


of Al Qaeda propaganda. When Al Fajr chooses to cooperate with a forum, radical users understand that the website in question has the seal of approval of the mujahideen and its content is therefore to be trusted 4. Content Jihadi forum content is divided into sections and subsections, the most frequent being “Statement section” and “General section.” The first contains communiqués released by terrorist groups. Users are not normally able to post contributions in this section, which is reserved for the authorized spokespersons of the various jihadi organizations. The “General section” tends to be the most active since participation is open to all users to share news, opinions, and links regarding any jihad-related issue.

Other typical sections include history, Muslim family, translations into other languages, and “members only” training sections supplying information on bomb-making and weapons. Administrators often give prominence to particular content by inserting banners, large-font texts, and animations at the top of the forum site. Only administrators can insert these elements, which are designed to draw attention to content of special importance, such as that messages from jihadi leaders or ideologists, images of major terrorist actions, or urgent statements. The banners are usually standardized and disseminated to a number of forums on which the statement or media release is posted (Musawi 2010). Occasionally, they are placed before the material itself is even uploaded in order to generate expectations ahead of the release of a video, audio recording, or written statement. Each directory or sub-directory in turn comprises a group of discussion threads (Figure 2) allowing users to post comments within a thread (Figure 3). However, not all the topics generate a truly collective debate. Data from the studied forums show that a topic attracts an average of 4.3 posts, with considerable differences between subjects. As with “conventional” internet forums, only certain posts will generate up to one hundred responses, (here usually those from terrorist organizations or ideologists) while other topics (for instance, those started by low-profile users) may fail to attract even a single response.

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

Early View

Figure 2: Jihadist forums – average number of threads per year 160,000 140,000 120,000 100,000 80,000 60,000 40,000 20,000




























11,588 149,215









Note: 2012 based on data up to and including June.

Although the internet forums allow users to upload photographs and text, jihadi propaganda increasingly takes the form of sophisticated video and audio statements. This requires significant data storage and transfer capabilities that the forums are often unable to supply. To evade data restrictions, jihadists resort to the same websites used to illegally download movies, music, software, and child pornography: document-sharing and file hosting websites (Torres-Soriano 2009). To attract clients, these web services offer free limited use, but to upload larger files, users have to pay for a premium version. Jihadists have simply used stolen credit cards to pay for these services, or hacking software to evade the limitations imposed on free use (Krebs 2009). Among the contributions most appreciated by virtual communities is the ability to download jihadist videos and communiqués and rehost them on cloud computing services, thus ensuring the files are always available (via new download links if necessary).


IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

Early View


Figure 3: Jihadist forums – average number of posts per year

1,600,000 1,400,000 1,200,000 1,000,000 800,000 600,000 400,000 200,000




























25,850 1,350,304









Note: 2012 based on data up to and including June.

5. Population and Internal Structure Dutch intelligence estimates the number of regular followers of jihadist websites to be approximately 25,000 individuals in around one hundred countries (AIVD 2010). These individuals usually participate in several forums at the same time, using different aliases for security and anonymity.

The population of the forums comprises a three-tiered hierarchy, each with clearly demarcated functions: a) Administrators: Administrator status is held by a small number of activists situated at the pinnacle of the platform. Only the administrators know the forum management passwords. Administrator privileges give access to all the functions offered by virtual platforms: overall forum design, content management, admission or rejection of members, access to user profiles and navigation habits, etc. Control over these functions accords administrators an advantageous position with respect to online recruitment.

b) Moderators: This is also a small group, albeit larger than that of the administrators. The moderators’ job is to monitor compliance with forum rules, ensuring ideological coherence of the texts and materials posted on the websites. They have the power to delete content considered counter-productive or hostile to the jihadist message. Moderator status is granted by administrators to the most active users and therefore represents a promotion within the forum structure. c) Users: This group represents the overwhelming bulk of forum participants. Once they have registered and been admitted by the administrators, users are entitled to view content and post messages, responding publicly to other users or even contacting them directly by private message, on-line chat, or IP telephone calls. By keeping track of member activity and interaction, the platform is able to establish a numerical system of promotion and distinction based on level of activity and quality

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

of participation. Profile information on each user is accompanied by a series of indicators relating to the number of topics and posts published, the frequency with which the individuals thank other authors for their posts, or the thanks they receive from others for their own contributions. This system seeks what some have called “gamification” (Brachman and Levine 2011), a term used to describe game-like attributes applied to non-game activities. The website creators factor in a strong element of competition to encourage greater participant involvement. By being more active, users earn “rewards” that impact positively on their self-esteem or on scope of accessible forum functions. For example, attaining a given level allows the user’s name to be associated with “ranks” or “labels” such as senior correspondent, warrior, martyr, emir, sheikh, etc. that publicly attest to their reputation and commitment. Other types of reward include entitlement to use an exclusive avatar or animation that draws attention to that particular user’s contributionsahead of those of others. Promotion also gives access to forum content reserved for members with proven credibility and commitment. The most usual reward takes the form of access to restricted subdirectories containing sensitive information such as bomb-making instructions, use of weapons, cyber-crime manuals and software, etc. This automatic system of promotion, which is also used in other types of forum, does also have counter-productive effects, however. The majority of posts on these websites are designed to achieve rapid and effortless promotion on the forum ladder and hence take the form of useless or insignificant comments such as brief thanks expressed to other users, or expressions of joy, support, or piety. In other cases, comments are plagiarized from other jihadi forums and do not contribute in any way to enriching the jihadist discourse (JWMG 2012). As a result, the main forum “rewards,” such as designation as a moderator or adminis13 A prime example of a committed user is the Saudi national Muhdar Hussein Almalki, who was arrested in Valencia (Spain) in March 2012. He was dubbed “Al Qaeda’s librarian” by Spanish police due to the massive amounts of jihadi propaganda he stored and shared with others on the Internet. Investigators discovered that he had achieved moderator status on some of the main jihadi forums, to which he devoted eight to fifteen hours daily. His exceptional level of activity is attested by two thou-

Early View


trator, cannot be earned automatically. Only the individuals responsible for the forum have the power to recruit users to roles crucial to its proper functioning. Although forums do allow members to be upgraded to content-producer status, in reality the vast majority of members are best described as “passive consumers” or “silent observers” (Kohlmann 2010), who merely browse available content but do not contribute to the site. As with other internet forums, only a small group of registered users play an active and continuous part in jihadi forums (Ducol 2012; Awan 2007). In the case of the forums studied here, active users represent on average just 11 percent of the total user population, reflecting the 90-9-1 rule of participation inequality in online communities (Kimmage 2009). Said rule holds that 1 percent of users (active members) are responsible for 90 percent of postings, 9 percent (members) are responsible for 10 percent of postings, and 90 percent (visitors) are “lurkers” who read available content but post nothing themselves. Although the number of users who play a very active part in these forums is small,13 not all can be classed as true “producers” (AIVD 2012), in the sense of individuals whose knowledge and experience equip them to contribute relevant posts on matters of doctrine or strategy, technical information, or operational guidelines. This elite group would also include users who act as “correspondents,” writing from a conflict zone in which jihadist organizations operate openly. Their contributions are particularly appreciated by users since they describe the life and experiences of the mujahideen fighting the enemy directly. Some of these authors subsequently join a terrorist organization after building themselves a solid track-record as cyber-activists that affords them iconic status in these virtual communities.14 A prime example is the Jordanian physician

sand posts on the Shamukh forum and seven thousand on Al Faloja. See Audiencia Nacional (Juzgado Central de Instrucción nº 5), “Diligencias Previas 26/2011,” March 30, 2012. 2012/03/30/d61bac3fc1fa90da6d87e2edd6e1fbe4.pdf. See also Internet Haganah, “In search of al-Qaida’s naughty librarian [Muhdar Hussein Almalki],” Internet Haganah, April 2, 2012.

14 As is the case for the Jordanian cyber-jihadist known on the Internet as Abu Kandahar Al Zarqawi. After serving as administrator and moderator of the Al Ekhlaas and Al Fallujah forums, he joined Al Qaeda in the border region between Afghanistan and Pakistan, from where he continued to participate in the sites, posting stories about and eulogies for his fallen colleagues. The forums in which he participated later publicized details of his own death in December 2010 (Flade 2010).

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

and suicide bomber Hammam Khalil Abu Malal al-Balawi who blew himself up inside a CIA base at Khost, Afghanistan, on December 30, 2009, killing seven CIA employees and contractors and a Jordanian intelligence officer (Warrick 2011). He was a prolific blogger and, for a time, a moderator on the jihadi Al Hesbah internet forum. Jihadi internet forums operate in a hostile environment. In recent times, various intelligence services and hackers have engaged in actions designed to infiltrate and block these spaces (Hegghammer 2010) and have succeeded in provoking mutual accusations among the different radical websites (Weimann 2006b). Administrators are suspicious of new users who quickly appear highly aggressive or express a clear interest in contacting forum members in person. Some platforms have implemented stricter self-protection measures such as making their entire content available only to registered users, stopping admission of new members, or accepting only new users who have been endorsed by a current member. However, these steps have triggered controversy within the jihadi internet community between those favoring greater security and ideological homogeneity, even at the risk of becoming increasingly closed and opaque groups, and others who fear the jihadi movement will turn so inward it will eventually become irrelevant (Torres-Soriano 2012b). 6. Stability and Disappearance of Jihadi Forums Jihadi forums adopt different strategies to guarantee their continuity in cyberspace, including hosting content simultaneously on over a dozen synchronized mirrors (Prucha 2008). Thanks to the interconnection between these sites, when one goes offline its traffic is redirected automatically to others offering identical content.

Despite achieving greater stability, the forums have been nonetheless affected by numerous temporary disruptions and definitive disappearances. During the eighteen-month period examined in detail here, each forum suffered an 15 Flashpoint Global Partners, “Major Jihadi Web Forum Service Outages – 2006–2012,” April 2, 2012. ments/pdf/0307/flashpoint_forumoutages.pdf

Early View


average of 3.1 “outages,” after which they were inaccessible for an average of 24.6 days per incident. Forums may be hit by specific disruptions that do not affect other sites, or by a common cause triggering a simultaneous outage. By depriving it of trustworthy propaganda dissemination mechanisms, these general disruptions silence the terrorist message on the internet. The period between 2006 and 2012 saw five major simultaneous outages, each averaging one week.15 It is extremely difficult to identify the causes of these incidents. Forums tend not to openly disclose the reasons for disruption, nor do government actors that launch covert offensives without claiming responsibility (Nakashima and Warwick 2012). However, information obtained from various open sources helps us identify the following as the main causes of interruptions to service: a) Maintenance: Administrators suspend website access temporarily in order to undertake a thorough review of membership and content. This activity tends to be triggered by a suspicion that the site has been infiltrated. Administrators expel members suspected of being hostile and delete their contributions. “Cleaning” tasks have become increasingly necessary as a result of public and private initiatives aimed at undermining the jihadi discourse (Pantucci 2011; Ashour 2009). One of the most famous examples is the Saudi Sakinah deradicalization campaign (Boucek 2008), which saw volunteers register on the sites concerned in a bid to engage in dialogue with members to persuade them that their beliefs were misguided from the Islamic point of view. b) Cyber-attacks: The forum is rendered inoperative through hostile action perpetrated via cyberspace. Administrators cannot restore the site until they manage to neutralize the cause of the technical failure. Paradoxically, cyber-attacks bolster a site’s popularity in the community of supporters of jihadi terrorism, whereas stability is perceived as a proof of its connection with members of intelligence services (Musawi 2010).

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

c) Arrest or disappearance of key members: A temporary “switch-off” is often ordered to prevent enemy access and identify the security breaches that led to arrests. An example of this scenario is the shutting down of the Ansar al Mujahadin Arabic Forum in August 2010, immediately after the arrest of one of its main administrators, the Moroccan Faical Errai, in a small town in Alicante (Spain).16 This police operation was a serious blow to the website, which remained out of action for the next seven months. It has also been speculated that the general outage that occurred in April 2012 was triggered by the arrest of a prominent member of the main forums (also in Spain) (Levine 2010; Abend 2012). d) Preventive shutdown: Websites voluntarily decide to suspend access temporarily to prevent cyber-attacks or other hostile actions anticipated after a particular incident or on the anniversary of important dates. Examples include the suspension of activities by the Ansar Al-Mujahideen and Al-Faluja forums a few days before September 11, 2009, in order to avoid attacks similar to those that silenced jihadi forums in previous years, including in September 2008 when Al Qaeda was unable to disseminate its 9/11 commemorative video on time (JWMG 2012). Following a cyber-attack, the websites reappear having been purged of all users and content considered hostile. During the period studied here, administrators expelled an average of 0.6 percent of users after an outage. While the figure is not particularly high, it is very revealing that an average of 7 percent of topics and 9.5 percent of posts were removed, which would indicate that the expelled users were far from “silent observers” but rather had been extremely active on the sites, initiating and participating in discussions. There is a primary cause that explains the definitive disappearance of such sites: a loss of trust on the part of the terrorist organizations that supply the website with propaganda materials. The real attraction of these sites is their 16 Audiencia Nacional (Juzgado Central de Instrucción número 2), “Diligencias Previas 120/09-F. Faical Errai,” August 31, 2010.

Early View


ability to serve as an authentic source of mujahideen material. Radical users are drawn to the prestige of sites that have earned the approval and trust of jihadi organizations. The loss of these ties sparks a mass exodus by followers, who seek out alternatives not suspected of enemy infiltration or sabotage. One example of the aforementioned dynamics can be seen in the events that triggered the demise of the influential Al Faloja forum (Torres-Soriano 2012b). In the summer of 2010, the website posted the first issue of Inspire, the English-language jihadist magazine published by Al Qaeda in the Arabian Peninsula. However, the pdf file was corrupted and only the first few pages of the magazine were viewable. The forum rapidly filled with panicked comments by users speculating that the website may have been compromised. Moderators warned users to take precautions such as deleting private messages and changing their passwords. The panic dominated the discussions and a short time later the website crashed. Although it returned again after a few days, the Al Fajr media platform, which distributed statements from Al Qaeda and its affiliates, stopped supplying it with materials. The questionable handling of the crisis and sudden disappearance had damaged terrorist organizations’ trust in the forum. After a month during which Al Faloja displayed no original materials, it put up a message announcing its permanent closure without any further explanation. A year later, it was disclosed in the media (Gardham 2011) that the panic in the jihadi internet infrastructure had been caused by a cyber-attack by Britain’s MI6 intelligence service, which had replaced some of the pages of the original magazine with garbled computer code prior to its release on the web. 7. Conclusions Internet forums play a crucial part in jihadi terrorism’s communications strategy. The reasons for the keen interest shown by terrorist groups in these platforms include the growing obstacles to their attempts to operate in the

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

Early View


“physical sphere.” Increased persecution of jihadists and their support networks in the wake of September 11, 2001, has seriously undermined their capacity to attract, radicalize, and train new members (Filiu 2010). However, the new opportunities afforded to terrorism by Web 2.0 are accompanied by new vulnerabilities. Far from enjoying a cyberspace sanctuary from which they can operate unhindered, the terrorists are subject to constant harassment.

structures. Its instability is a good indicator of the existence of a marked pyramid structure, which means that the site becomes compromised every time a central operative is captured. The lack of equal relations among forum members and constant suspicion concerning attempted infiltration mean that replacement of said key figures does not occur naturally among the members of these virtual communities.

Although the forums were initially seen as exemplifying the transformation of terrorist organizations into horizontal structures lacking a clear hierarchy and connected only by a common ideological discourse and plan of action, the fact of the matter is that these websites could not exist without the intervention of formal organizations. A lack of ties to a formal organization is in itself sufficient reason for a forum to fail. In reality, the websites do not conform to the Web 2.0 philosophy on which they are allegedly based. Radical forums have not operated as collaborative spaces in which internet users participate and contribute content spontaneously. Quite the contrary: they are extremely hierarchical and governed by numerous mechanisms designed to control the actions of users and prevent ideological heterodoxy.

Secondly, networks are open to the incorporation of new members, provided they share common identity traits or interests. However, jihadi forums are increasingly reluctant to admit new participants due to the constant threat of infiltration. The actions of some sites may even be in open contradiction to their proselytizing goals, in that they restrict registration of new members or seek to survive solely on contributions from users with proven credibility. Thus, the communities end up becoming very inward-looking and are unable to reproduce and perpetuate themselves by reaching out to their target audience.

The three core characteristics that distinguish a network from other forms of organization (Eilstrup-Sangiovanni and Jones 2008) are noticeably absent in the case of jihadi internet forums. Firstly, what distinguishes networks from other forms of hierarchical organization is the capacity of low-level units to have multiple relationships with higher-level centers, as well as lateral links with units at the same organizational level. The redundant design of a network allows its functions to be performed by multiple members and thus the disappearance of the most important units does not compromise overall functioning. In jihadi forums, however, a small number of nodes exclusively centralize the vast majority of relations between the members of the community, and the forums are therefore strongly hierarchical. This type of organization is extremely resilient to random attacks but vulnerable to targeted ones. This explains why a jihadi forum is less resilient than other illicit networked

Lastly, relations within networks tend to be informal and loosely structured, unlike in hierarchical organizations, which rely on rule-governed impersonal relations. The lack of a central authority and rule-guided functioning means that decision-making and coordination in networks tend to be based on consensus and mutual adjustment. In jihadi forums, however, a clear system of rules regulates members’ capacities and contacts. A higher-level authority oversees all interaction and has the power to reward or punish members, while decision-making is the preserve of a restricted group of members, who neither inform nor consult other users. In fact, jihadi forums are based on the same software applications used by other internet forums, which helps explain the considerable similarities between all of them as regards administrator powers, forum rules, type of interaction between users, etc. However, in adopting this format the aim of the terrorists was not to widen the opportunities for interaction with followers but simply to increase the audience for the propaganda generated by the leaderships of their organizations. The jihadists’ presence on the internet exhibits few similarities with the characteristics normally associated with a

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

network. However, despite sharing features with hierarchies, the jihadi forums have been unable to exploit the primary benefits of such structures. The lack of direct personal contact between members of the communities, coupled with the constant threat of enemy infiltration, generates what can turn into incapacitating mistrust within the group. Despite having thousands of members with different profiles located in dozens of countries worldwide, the forums are unable to fully exploit the possibilities of this vast human potential. Cyber-jihadists are aware that their contributions are closely monitored by an unknown number of intelligence services, journalists, and public and private analysts. This uncomfortable reality impacts negatively on the spontaneity of user participations and lessens the attractiveness of forums as platforms through which terrorist operations can be planned and coordinated securely. However, the main blow to the forums’ credibility is the permanent suspicion that some of the sites may have been infiltrated or indeed are controlled directly by the enemy. Recent years have seen emerging confirmation, as

References Abend, Lisa. 2012. Who is Waging Cyberwar Against the Jihadi Networks? Time, April 5.,8599,2111293,00.html Ashour, Omar. 2009. The De-Radicalization of Jihadists: Transforming Armed Islamist Movements. London: Routledge. Awan, Akil N. 2007. Radicalization on the Internet? The Virtual Propagation of Jihadist Media and Its Effects. RUSI Journal 152 (3): 76–81. Boucek, Christopher. 2008. The Sakinah Campaign and Internet Counter-Radicalization in Saudi Arabia. CTC Sentinel 11 (9): 1–4. Brachman, Jarret, and Alix Levine. 2011. The World of Holy Warcraft. How Al Qaeda Is Using Online Game Theory to Recruit the Masses. Foreign Policy, April 13. 2011/04/13/the_world_of_holy_warcraft Ducol, Benjamin. 2012. Uncovering the French-speaking Jihadisphere: An Exploratory Analysis. Media, War & Conflict 5 (1): 51–70. Eilstrup-Sangiovanni, Mette, and Calvert Jones. 2008. Assessing the Dangers of Illicit Networks: Why al-Qaida May Be Less Threatening Than Many Think. International Security 33 (2): 7–44. Filiu, Jean Pierre. 2010. Al-Qaeda, entre la dinámica paquistaní y la tentación virtual. Real Instituto Elcano-Análisis, 4/2010. http://www.realinstitutoelcano. org/wps/wcm/connect/ 9a8a0100410c6f44ac31ec6d616c2160/ARI4-2010_Filiu_al-Qaeda_dinamica_paquistani_tentacion_virtual.pdf?MOD=AJPERES&CACHEID=9a8a0100410c6f44ac31ec6d616c2160 Flade, Florian. 2010. Death of an Online-Jihadi – From Cyberspace to Battlefield. [email protected]: News Of Terrorism, Jihadism, and International Politics (blog), December, 21. Gardham, Duncan. 2011. MI6 Attacks al-Qaeda in “Operation Cupcake.” Telegraph, June 2.

Early View


opposed to mere suspicion, that some virtual platforms are part of “information operations” launched to undermine the jihadi message. Furthermore, radical web users are conscious that the internet is responsible for many recent arrests of jihadists, which reinforces their belief that cyberspace – and the internet forums in particular – have become dangerous territory. Although in recent times terrorists have turned to other types of internet-based platform for content dissemination and other interaction purposes, including YouTube, Daily Motion, Facebook, and – increasingly – Twitter, these continue to pose many of the same problems encountered in internet forums (Meleagrou-Hitchens, Maher and Sheehan 2012). But in the absence of a viable alternative, for the moment at least, jihad supporters have little choice but to continue to use forums. In conclusion, the analysis of the functioning of jihadi internet forums provided here adds weight to the argument that formal terrorist organizations continue to play an important role in coordinating and encouraging terrorism.

General Intelligence and Security Service (AIVD). 2012. Jihadism on the Web: A Breeding Ground for Jihad in the Modern Age. Den Haag: Ministry of the Interior and Kingdom Relations. 2402/het_jihadistisch_internet_eng.pdf Gunaratna, Rohan, and Aviv Oreg. 2010. Al Qaeda’s Organizational Structure and Its Evolution. Studies in Conflict and Terrorism 33:1043–78. Hegghammer, Thomas. 2010. Spy Forums. Jihadica (blog), March 19. Hoffman, Bruce. 2008. The Myth of Grass-Roots Terrorism. Foreign Affairs 87 (3): 133–38. Jihadi Websites Monitoring Group (JWMG). 2012. In the Depths of Jihadist Web Forums: Understanding a Key Component of the Propaganda of Jihad. Herzliya: International Institute for Counter-Terrorism (ICT). http://www. Jordán, Javier. 2009. Procesos de radicalización yihadista en España: Análisis sociopolítico en tres niveles. Revista de Psicología Social 24(2): 197–216. Jordán, Javier. 2012. Una aportación empírica al debate teórico sobre la naturaleza organizativa del terrorismo yihadista en Europa Occidental. Revista Española de Ciencia Política 28:87–106. Kimmage, Daniel, and Kathleen Ridolfo. 2007. Iraqi Insurgent Media: The War of Images and Ideas. Washington, D.C.: Radio Free Europe/Radio Liberty. Kimmage, Daniel. 2008. The Al-Qaeda Media Nexus: The Virtual Network Behind the Global Message. Washington, D.C.: Radio Free Europe/Radio Liberty. Kimmage, Daniel. 2009. Al-Qaeda Central and the Internet. Counterterrorism Strategy Initiative Policy Paper. Kohlmann, Evan. 2006. The Real Online Terrorist Threat. Foreign Affairs 85 (5): 115–24.

IJCV : Vol. 7 (1) 2012 Torres-Soriano: Creation, Evolution, and Disappearance of Terrorist Internet Forums

Kohlmann, Evan. 2010. A Beacon for Extremists: The Ansar al-Mujahideen Web Forum. CTC Sentinel 13 (2): 1–4. uploads/2010/08/CTCSentinel-Vol3Iss2-art1.pdf Krebs, Brian. 2009. Hacked File-Upload Accounts Prized by E-Jihadis. Washington Post, March 25. Labi, Nadya. 2006. Jihad 2.0. Atlantic Monthly. July/August. http://www.theatlan Levine, Adam. 2012. Mystery Surrounds Silencing of Key Al Qaeda Websites. Security Clearance Blog, April 3. Meleagrou-Hitchens, Alexander, Shiraz Maher, and James Sheehan. 2012. Lights, Camera, Jihad: Al-Shabaab’s Western Media Strategy, London: ICSR. Musawi, Mohammed Ali. 2010. Cheering for Osama: How Jihadists Use Internet Discussion Forums. London: Quilliam Foundation. http://www.quilliamfoun Nakashima, Ellen, and Joby Warrick. 2012. Al-Qaeda’s Online Forums Go Dark for Extended Period. Washington Post, April 2. Neumann, Peter, Ryan Evans, and Raffaello Pantucci. 2011. Locating Al Qaeda’s Center of Gravity: The Role of Middle Managers. Studies in Conflict and Terrorism 34: 825–42. O’Neill, Sean. 2007. Terrorist 007 “Was Internet Propagandist for al-Qaeda.” Times. April 26. Pantucci, Raffaello. 2011. The UK’s Efforts to Disrupt Jihadist Activity Online, CTC Sentinel 4 (9): 15–17. uploads/2011/09/CTCSentinel-Vol4Iss96.pdf Prucha, Nico. 2008. The Rise of Al-Ekhlaas. Jane’s Terrorism and Security Monitor, May, 14–15. Reinares, Fernando. 2008. El terrorismo global: un fenómeno polimorfo. Real Instituto Elcano – Análisis, 84/2008. portal/rielcano/contenido?WCM_GLOBAL_CONTEXT=/elcano/elcano_es/ programas/terrorismo+global/publicaciones/publ-actores+escenarios+y++tendencias/ari84-2008 Reinares, Fernando. 2010. A New Composite Global Terrorism Threat to Western Societies from Pakistan? Making Sense of the January 2008 Suicide Bomb Plot in Barcelona, Real Instituto Elcano – Working Paper 28/2010. tent?WCM_GLOBAL_CONTEXT=/elcano/elcano_in/zonas_in/dt28-2010

Manuel Ricardo Torres-Soriano [email protected]

Early View


Rogan, Hanna. 2007. Al-Qaeda’s Online Media Strategies: From Abu Reuter to Irhabi 007. Norwegian Defence Research Establishment FFI-rapport 02729. Sageman, Marc. 2004. Understanding Terror Networks. Philadelpia: University of Pennsylvania Press. Sageman, Marc. 2008. Leaderless Jihad: Terror Networks in the Twenty-first Century. Philadelphia: University of Pennsylvania Press. SITE Institute. 2007. Background of Online Jihadists Arrested in Saudi Arabia. SITE Institute Intelligence Brief, June 12. Stenersen, Anne. 2009. The History of the Jihadi Forums., March 4. Torres-Soriano, Manuel R. 2009. Maintaining the Message: How Jihadists Have Adapted to Web Disruptions. CTC Sentinel 2 (11): 22–24. http://www.ctc. Torres-Soriano, Manuel R. 2012a. Between the Pen and the Sword: The Global Islamic Media Front in the West. Terrorism and Political Violence 24 (5): 769–86. Torres-Soriano, Manuel R. 2012b. The Vulnerabilities of Online Terrorism. Studies in Conflict and Terrorism 35 (4): 263–77. Torres-Soriano, Manuel R., Javier Jordán, and Nicola Horsburgh. 2006. Analysis and Evolution of the Global Jihadist Movement Propaganda. Terrorism and Political Violence 18 (3): 399–421. Vidino, Lorenzo. 2011. Radicalization, Linkage, and Diversity: Current Trends in Terrorism in Europe. Santa Monica: RAND. Warrick, Joby. 2011. The Triple Agent: The al-Qaeda Mole Who Infiltrated the CIA. New York: Doubleday. Weimann, Gabriel. 2006a. Terror on the Internet. The New Arena, the New Challenges. Washington D.C: United States Institute of Peace Press. Weimann, Gabriel. 2006b. Virtual Disputes: The Use of the Internet for Terrorist Debates. Studies in Conflict and Terrorism 29 (7): 623–39. Zelin, Aaron Y. 2011. Inchoate Conceptualization of Jihadi Online Media. alWasat (blog), May 31. Zelin, Aaron Y., and Richard Borow. 2013. The State of Global Jihad Online: A Qualitative, Quantitative, and Cross-Lingual Analysis, New America Foundation, January. licydocs/Zelin_Global%20Jihad%20Online_NAF.pdf