Telegram: the Mighty Application that ISIS Loves

By Ahmet S. Yayla & Anne Speckhard

Download the PDF

ISIS has been the most successful terrorist organization in history using social media and the Internet for distributing its propaganda, dissemination of its news and more importantly to communicate. There is no doubt that the frequency and quality of ISIS posts on the Internet, including their videos, memes and online journals are of a quality to make many professional editors and producers envious and they also receive much attention[1].

ISIS usually does not host its posts on dedicated servers but uses several free and open mediums including Google drive, Cloud.mail.ru, Yandesk, YouTube, Sendvid.com, Dailymotion.com, Drive.ms, Archive.org, Justpaste.it, Bitly.com and some other recent platforms. Of course, hosting is not enough; hosted posts need to be distributed to followers, the target audience and the public. At this point, several social media platforms including Facebook, Twitter, Telegram, WhatsApp, Google+, Instagram, Pinterest, Tumblr, Viber, and WeChat are utilized by ISIS to circulate their posts so that the target audience and public are made aware and can watch or read them by clicking on the web addresses posted to those mediums.

Among these social media platforms Twitter, YouTube, Facebook, Tumblr and Instagram were previously heavily utilized by ISIS, but since takedowns on these sites, ISIS currently favors Telegram where ISIS users maintain a presence in several different languages. ISIS has assigned administrators in several languages who are in charge of ISIS social media accounts including Telegram. When interviewing ISIS defectors[2], we also learned that female foreign fighters are specifically tasked for the administration of social media accounts, and they have special offices in Raqqa to carry out their tasks under the control of their emirs. A Belgian female defector recently recounted being recruited upon her arrival to ISIS to serve as an Internet seductress, a role she declined[3]. Indian police also told us that most of their ISIS recruitment occurs via the Internet and consists of female seducing males into the group[4].  Indeed, American Mohamad Khweis appears to have been seduced in this way, marrying his ISIS bride when he arrived to Istanbul and then traveling into ISIS territory with her[5].

At ICSVE, our researchers closely follow ISIS’s Telegram posts on a daily basis and download any relevant videos, journals, memes, pictures or anything else useful for our research. While the terrorist organization utilizes several different platforms to distribute their posts, the most reliable medium of late for their purposes has been the Telegram social media application. This is because other platforms usually quickly take down posts or shut down the accounts posting the links to these hosts. Hosting mediums also delete posts as soon as they realize they are ISIS content. As a result, Telegram has become the main social media platform for ISIS members and followers primarily because, so far, Telegram administrators do not usually shut down ISIS accounts, and when they do, the frequency is far less when compared to other social media accounts. For example, Twitter or Facebook take down ISIS accounts in a day or most two in many cases, and when the same account owners open new accounts, they block them even sooner. However, there are Telegram accounts opened or used by ISIS members that stay active for months or basically never get closed.

Telegram was launched in 2013 by two brothers, Nikolai and Pavel Durov, who also founded Russia’s largest social network Russian VK. The Telegram Messenger LLP is registered as an independent nonprofit company in Berlin, Germany. The founders claim that Telegram is “faster and safer” than other apps and more importantly the “messages sent through Telegram cannot be bugged by third parties.” [6] Indeed, Telegram is an encrypted social media application that is very difficult for law enforcement to penetrate or eavesdrop.
Apart from accounts not being closed as often as other ISIS social media accounts, there are two other advantages to ISIS for using Telegram. The first is that while in most cases the links to hosts are distributed in Telegram groups where there are several members or directly sent to individual accounts, they become useless as soon as the hosting companies realize they are ISIS posts and take them down, making them dead links. However, Telegram’s large file-hosting feature becomes very handy in this case because almost all files pushed through Telegram with links are also uploaded to the Telegram channels, and those files remain as long as the channels are open or the user who posts does not delete them. Therefore, even if a file is not available as a link, if it is uploaded to Telegram, it will exist there unless it is deleted or the channel is closed. Furthermore, Telegram allows uploading large files simultaneously consequently allowing the ISIS social media accounts to simultaneously upload videos with four or five different resolutions and sizes beginning from the largest to the smallest, such as a video in full HD from which would be 1.5 gigabytes to smaller resolution versions such as 800 megabytes, 500 megabytes, 200 megabytes and 50 megabytes. The smallest size versions would be for mobile devices.
The other advantage of Telegram is providing users a forum to be able to communicate in a secure way through a secure algorithm. While Telegram chat rooms are usually open to all members, one-to-one communications are secret and cannot be seen by others. There have been several attacks where it was later established that ISIS members communicated internationally about the attacks before they took place. For example, the Istanbul Reina club attacker got his orders from his Emir in Raqqa, Syria through Telegram and communicated over Telegram with his Emir both before and after the attack[7]. The same was true of the Paris attacks[8]. Telegram has thus become one of the main communication apparatus of ISIS, particularly with foreign fighters deployed outside of ISIS territories.

In addition to all these advantages, like all other applications, Telegram is convenient and mobile as it can be installed on cell phones, Windows PCs, and IOS computers, therefore, making it available on many different devices.

Joining Telegram is easy. The only requirement on the side of Telegram, to sign up, is having a cell phone number and verifying that number after the registration through a text message verification step. In some cases, some Internet proxy phones (phone accounts created over the Internet) work as well, omitting the requirement of a cell phone number as long as the Telegram system does not recognize the number provided as a proxy Internet number. Telegram, therefore, only requires a cell phone number to verify the user and once a user is verified, the user does not need to maintain the phone number, enabling users to use a number once to verify an account without the necessity to keep that number. In fact, the one of the cell phones ICSVE staff use to track ISIS telegram accounts was registered through a cell phone number and that number has been inactive since 2015, but the account has still been in use without any problems. This feature becomes a great tool for ISIS terrorists as they do not need to reveal their real identities or provide anything to be traced other than a phone number which they don’t need to maintain.

On the side of ISIS, in most cases, there is no vetting to join their public channels or groups, but private ones do vet potential members with a range of questions, sometimes having to do with the basics of Islam such as cleansing before prayer (wudu) etc. If ISIS members need to connect over the Telegram without physically being in touch, they either use other known members to reach and connect to the desired members or for their foreign fighters, they pre-arrange known passwords and indicators to vet the people they are communicating with to ensure the authenticity of the parties.

As a user interface, Telegram is no different than many other similar mediums such as WhatsApp and Twitter. When it comes to peer-to-peer communication, it is more like WhatsApp where users can message each other, share documents, links, videos and voice messages similar to the chat features of many social media platforms. There are even time stamps indicating when the messages were sent and if they were read or not. Telegram channels are a different from common social media groups as followers are not allowed to interact with the others in the channel openly unless authorized by the administrator. Members are only able to read and download posts shared in the channel unless they have permission for greater access. Posts flow on the timeline chronologically and with time stamps and an indicator “eye” acting as a counter showing how many times a post was downloaded by the channel members. Telegram groups, as opposed to channels, are just like other social media groups where members can interact with each other and their individual posts, therefore, making it possible to communicate with sometimes thousands of people at once. Based on our experience at ICSVE, several channels and individual accounts in the same languages are usually run by the same administrators, or there are a handful of administrators who appear to share the same posts simultaneously.

Reaching out on to ISIS members via Telegram channels is a significant challenge for beginners. First of all, as the Telegram application is installed, the application copies all the contact numbers on one’s cell phone and connects the users with any of his contacts who are already registered with Telegram. However, to connect with ISIS members, channels, or groups, the key is knowing what channels are ISIS channels and what their names or addresses are. ISIS usually does not require verification for its public channels, therefore if one knows the name or address of an ISIS channel, joining those channels is simple—locate the channel and click the join button. As soon as one joins a channel all that channel’s posts are available to the new user. For peer-to-peer communication, however, the users must know each other’s registered phone numbers or user names. If a user is not originally recorded in one’s downloaded phone connections, in order to connect with that user over Telegram, one of the users has to provide the other his registered cell phone number. This process is useful for ISIS foreign fighters operating abroad as they often switch phones and need to reconnect with their emirs or middlemen and can easily do so even with a new burner phone,  using their original login credentials. ISIS members may also open accounts before traveling and exchange those accounts beforehand so when they need to use them they can easily install Telegram on whatever device they are currently using and log into Telegram with their credentials to communicate with their ISIS peers.

ISIS frequently posts on new and backup channels with different names for different purposes including: media and video sharing, book and journal sharing, news and daily updates, hisbah (morality police) office, accounts of personal well-known ISIS members, pamphlets and meme accounts, ISIS Amaq News Agency and several other channels or groups with different names. These lists are frequently shared on different social media platforms alerting users to subscribe to new or backup accounts in the case an account is closed or expected to be closed. While being banned and dropped in other social media mediums occurs to ISIS endorsers, supporters and distributors quite often, Telegram, as mentioned previously, does not frequently close ISIS accounts. However, the backup or spare ISIS channels usually function as a mirror of the original channel or simply are ready to be facilitated if an original channel is closed. ISIS cross shares the lists of their Telegram channels as they appear and reappear via different social media accounts. For example, they post their new or existing Telegram channel addresses on Twitter or Facebook, and then in their Telegram channels, they provide their Twitter, Facebook or Instagram account names and encourage their members to follow those accounts as well to be updated of any changes when channels are taken down. In that manner, they efficiently migrate their followers from Telegram channel to channel. ISIS social media administrators also often share bulk ISIS Telegram account lists both in regular social media and also in their Telegram channels, by which users are alerted to join channels or follow individuals simply clicking the links of those accounts. If someone starts to follow an ISIS Telegram account, it is thus very easy to update and enrich their ISIS network of account collections and lists by simply subscribing to the post lists or by following the users who post to the groups and simply by looking at the forwarded posts and reaching to the original post owners with a few clicks. Therefore, following or communicating with ISIS Telegram accounts is an easy task as long as one understands how they work and basically keeps following the posts to update their related contact lists. Even if one completely loses ISIS Telegram channels on Telegram, it is still easy to reach out to those channels again by simply following ISIS related Twitter and Facebook accounts.

ISIS users or administrators are not shy about their posts, and they are usually aware of the fact that many of their followers in the channels are not ISIS members, but are intelligence members or researchers. In fact, it happened several times with our ICSVE Twitter posts sharing some important incidents or updates from the ISIS Telegram channels we follow, that they would then openly post into the same channels saying “We know you are here and you are sharing our posts on your Twitter account. You are an infidel, and we don’t care if you are following us.” Strangely enough, ISIS administrators have never banned or blocked us from their channels thus far, perhaps enjoying the attention and being a threatening presence. Of course, there are strategies behind that as well. Simply put, the terrorist organization is using its Telegram channels to disseminate its propaganda and the narratives they would like to share, and they are aware of the fact that outsiders may be the ones who also become conduits for their shares to the outer world.

There are countless channels and groups on Telegram, not only related to ISIS but also to other Salafist-jihadi terrorist organizations as well. If one does not know the specifics of different terrorist organizations, one would very easily confuse other Salafist terrorist organization’s channels with ISIS channels as they promote very similar thinking. While ISIS dominates the Telegram terrorism cyber-space, other groups use the same medium as well and just like ISIS, maintain groups and channels in different languages, probably more than twenty.

One may witness a variety of things in ISIS channels. First of all, regular known ISIS channels or groups maintained by well-known recognized ISIS members such as Khilafah News, the Strangers, Mr. State, al-Firdaws English or Mr. Killer, share ISIS related breaking news, videos, memes, propaganda campaigns, brochures, new ISIS journals including Rumiyah and others, nasheeds, pictures or stories, or anything they would like to push. However, theme specific channels or groups only share related posts. For example, ISIS video channels would periodically post new or old ISIS videos in different resolutions or sizes, book channels would only post books or booklets mostly in pdf forms, news channels would only post news or news articles and so on. Therefore, based on the type of the channel or group, it is possible to reach and follow groups in different categories.
Another important feature of Telegram is being able to search the channels posts, group messages, individual messages or any kind of communications or posts in one’s account. This feature is available for both cell phone applications and the Web-based Telegram interface making it possible to reach any content by simply searching. This basically makes Telegram one of the largest free ISIS databases available to the public especially considering the fact that many other mediums including  Google, YouTube, Twitter and Facebook are continuously taking down ISIS posts.
Telegram has enabled ISIS to create, without much effort, its grand propaganda machine to further its reach beyond it’s so-called “Caliphate” to the whole world with only the click of a button, pushing its new media content constantly and reaching to its targets momentarily, and most importantly communicating with its fighters abroad to direct them for new attacks or facilitate their operations in different countries[9]. The nature of the Telegram application with a secure algorithm providing protection from the outside world and making it almost impossible, or very difficult, for law enforcement to trace back to the original users, also has become a magnificent advantage for the terrorist organization in terms of the anonymity of its users and for carrying out terrorist operations via secure communications. These two qualities are the most valuable qualifications, or gifts, for a terrorist organization like ISIS. Thanks to Telegram, ISIS has now been using their application very heavily almost without any interruptions with great success when compared to other social media applications.

 

While other social media platforms have since 2014 taken strong stances to institute takedown policies when it comes to ISIS, the stand of the Telegram application when it comes to allowing ISIS to use its platform without interference is quite different and difficult to understand. Recently, Rob Wainwright, the director of Europol, European Union’s policing body, condemned Telegram owners for failing to join the fight against terrorism. Wainwright said that Telegram’s reluctance to work with anti-terrorist authorities was causing major problems[10] considering the fact that the application is in widespread use among the target population of ISIS.

 

Telegram has become the choice of the ISIS due to its specifications—providing secure encrypted communications and allowing users to share large files and act with their accounts operating with impunity. While Telegram administrators claim, they favor speech free of interference; it is time for the owners of Telegram to thoroughly consider the existence of ISIS presence and activities on their digital platform. Telegram has become the ultimate tool for the bloodiest terrorist organization in history, carrying and spreading its terrorist ideology around the world, recruiting and even directing cadres to carry out attacks globally. Recently, the families of the San Bernardino shooting sued Facebook, Google, and Twitter, claiming that these social media companies permitted ISIS to flourish on these social media platforms[11]. It may soon happen that Telegram will also have to deal with several legal actions as ISIS cadres continue to utilize their application for their terror operations and communications.

Reference for this Article: Yayla, Ahmet S. & Speckhard, Anne (May 5, 2017) Telegram: the Mighty Application that ISIS Loves, ICSVE Research Reports, https://www.icsve.org/brief-reports/telegram-the-mighty-application-that-isis-loves/

Ahmet S. Yayla, Ph.D. is co‐author of the just-released book, ISIS Defectors: Inside Stories of the Terrorist Caliphate. He is a Senior Research Fellow of the International Center for the Study of Violent Extremism (ICSVE) and is also Adjunct Professor of Criminology, Law and Society at George Mason University. He formerly served as Professor and the Chair of the Sociology Department at Harran University in Turkey. He is the former Chief of Counterterrorism and Operations Division for the Turkish National Police with a 20‐year career interviewing terrorists. Follow: @ahmetsyayla

Anne Speckhard, Ph.D. is Adjunct Associate Professor of Psychiatry at Georgetown University in the School of Medicine and Director of the International Center for the Study of Violent Extremism (ICSVE) where she heads the Breaking the ISIS Brand—ISIS Defectors Counter-Narrative Project. She is also the author of Talking to Terrorists, Bride of ISIS and coauthor of ISIS Defectors: Inside Stories of the Terrorist Caliphate; Undercover Jihadi; and Warrior Princess. Dr. Speckhard has interviewed nearly 500 terrorists, their family members and supporters in various parts of the world including Gaza, West Bank, Chechnya, Iraq, Jordan, Turkey and many countries in Europe. In 2007, she was responsible for designing the psychological and Islamic challenge aspects of the Detainee Rehabilitation Program in Iraq to be applied to 20,000 + detainees and 800 juveniles. She is a sought after counterterrorism expert and has consulted to NATO, OSCE, foreign governments and to the U.S. Senate & House, Departments of State, Defense, Justice, Homeland Security, Health &Human Services, CIA and FBI and CNN, BBC, NPR, Fox News, MSNBC, CTV, and in Time, etc. Her publications are found here: https://georgetown.academia.edu/AnneSpeckhardWebsite:

https://www.icsve.org Follow: @AnneSpeckhard

References

[1] Speckhard, Ph.D., Anne; Shajkovci, Ph.D., Ardian; and Yayla, Ph.D., Ahmet S.. “Defeating ISIS on the Battle Ground as well as in the Online Battle Space: Considerations of the “New Normal” and Available Online Weapons in the Struggle Ahead.” Journal of Strategic Security 9, no. 4 (2016): 1-10.

[2] Speckhard, A., & Yayla, A. S. (2016). ISIS Defectors: Inside Stories of the Terrorist Caliphate: Advances Press, LLC.

[3] Speckhard, Anne research interview Brussels, Belgium January 2017

[4] Speckhard, Anne research interview New Delhi, India March 8th, 2017

[5] Speckhard, Anne & Yayla, Ahmet S. (March 20, 2016) American ISIS Defector – Mohamad Jamal Khweis & the Threat Posed by “Clean-Skin” Terrorists: Unanswered Questions and Confirmations. ICSVE Brief Report https://www.icsve.org/american-isis-defector—mohamad-jamal-khweis-and-the-threat-of-clean-skin-terrorists-.html

[6] Editorial, “Russia’s Zuckerberg launches Telegram, a new instant messenger service,” Reuters, August 30, 2013, http://www.reuters.com/article/idUS74722569420130830

[7] Yayla, A.S., “The Reina Nightclub Attack and the Islamic State Threat to Turkey” CTC Sentinel, Combating Terrorism Center at West Point, Vol 10, Issue 3, pp. 9-16, March 2017.

[8] Evan Perez & Shimon Prokupecz, “First on CNN: Paris attackers likely used encrypted apps, officials say,” December 17, 2015, http://www.cnn.com/2015/12/17/politics/paris-attacks-terrorists-encryption/

[9] Speckhard, A., & Yayla, A. S. (2017). The ISIS Emni: The Origins and Inner Workings of ISIS’s Intelligence Apparatus. Perspectives on Terrorism, 11(1). Retrieved from http://www.terrorismanalysts.com/pt/index.php/pot/article/view/573

[10] Dominic Kennedy, “Message app used by Isis refuses to fight jihadists,” May 4, 2017, https://www.thetimes.co.uk/article/message-app-used-by-isis-refuses-to-fight-jihadists-jrddv7c93?utm_content=buffer2b755&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer

[11] Dan Whitcomb, “Families of San Bernardino shooting sue Facebook, Google, Twitter,” May 4, 2017, http://www.reuters.com/article/us-sanbernardino-attack-lawsuit-idUSKBN1802SL