ISIS Is Now Harder to Track Online—but That’s Good News

Over the last month, Telegram messenger launched an account-removal campaign against its most notorious user base: ISIS. The company’s newly found initiative was profoundly wide-reaching and effective, shaking a long-settled snow globe and scattering ISIS users across scores of different platforms.

At first glance, ISIS’ chaotic dispersal across the internet might seem like a dangerous development: If they’re no longer in one place, how will we track them? It’s an understandable supposition, especially as ISIS’ uninterrupted refuge on Telegram became sadly normalized over the years. But the effects of ISIS’ Telegram years were far from normal, and even farther from inconsequential.

Europol announced that it played a hand in the removals on November 21 and 22, though we at SITE noticed accounts being removed as early as November 15. It’s unclear how Telegram’s removal algorithm worked, specifically, but it was far more targeted than anything the company had employed before. Telegrams’ past removal campaigns focused on the channels and chat groups ISIS users are on, which ISIS recovered from countless times. But now the platform took a scorched-earth approach. In addition to ISIS channels, Telegram was deleting the accounts of the channels’ creators and users, from supporters to top media workers. Their many backup accounts were also removed, and when they created new ones, those were quickly removed as well. Many journalists, academics, and terrorism researchers were even booted from the platform and unable to make new accounts, several from SITE’s staff among them.

The campaign caught ISIS off guard, to put it lightly. ISIS members were losing contact with each other while the entire media infrastructure built around groups like Nashir News, Fursan al-Rafa, and Invasion Brigades—each of which are specifically purposed to handle media distribution, uploading, URL-proliferation, and other tasks—rapidly disintegrated. ISIS’ Telegram presence had become a pile of blocks that couldn’t be stacked back together, and the group was scrambling across the internet to find a new home.

Lost, ISIS media outlets and its supporters made their first stop on Riot, an open source messenger client it had already been kicked off after a brief stint in the fall of 2017. Of all the messenger platforms in ISIS’ toolkit, Riot is the easiest to join. All a user needs to join is a username and password—no email, no phone number. So if you’re ISIS, why not try camping out again on such an easygoing platform that allows you to create an unlimited number of channels? Users can even join chat groups without a URL or invite, making it far more accessible than Telegram in that regard. In no time, every piece of the ISIS network—from official ISIS media groups and operatives to supporters from around the world—were flooding Riot with chat rooms.

ISIS’ Riot accounts were deleted in the days after Telegram started its purge. And as ISIS-linked groups continued to advertise their Riot rooms for weeks after, the removals kept coming. In the first signs of panic, ISIS-linked media groups and supporters voiced confusion and frustration, with one ISIS-linked graphic sounding the alarm of a “massive campaign by Riot to delete the accounts of the supporters.”

Though you can still find many lingering rooms on Riot, the ISIS network as a whole looked elsewhere for a new home and quickly found one in TamTam, a messenger platform similar to Telegram (including a required phone number upon registering). The platform is slightly less accommodating to ISIS than Telegram, though, in that it doesn’t allow channel/group archiving and is much harder to save videos on.

Like Riot, ISIS tried leveraging TamTam in the spring of 2018 but to no avail. But this latest investment in the platform was especially obvious when ISIS issued its claim for the November 29 London Bridge stabbing on the platform first. By December 1, hundreds of public and private ISIS channels, groups, and accounts populated TamTam, including those of major ISIS-linked media entities like Halummu and Mutarjim.

But just like on other platforms, ISIS was soon booted. By the next morning, it seemed half of ISIS’ TamTam accounts were gone, prompting the ISIS outlet Quraysh Media to issue to same panicked warning seen on Riot: “Deletions on TamTam have affected a number of the supporters’ accounts.”

From here, ISIS would receive the same treatment across different platforms, including little-heard-of ones like the Canada-based Hoop Messenger, which began taking accounts and channels down immediately (though ISIS appears to be creating new ones there). ISIS also tried setting up camp on lesser-known social media platforms like MeWe, based in the US, and Mastadon, founded in Germany as an open source alternative to Twitter, without much success.

Though ISIS still manages to slip its media through the few cracks left on Telegram (using tricks like unbranded channels and low-key sounding usernames), it remains spread across a double-digit range of platforms. This chaotic scramble between evidently prepared platforms seems likely to continue, and that is no small deal. Centralized online havens on widely used platforms have been one of the most critical variables in ISIS’ growth and sustenance. Having such a hub gives a group like ISIS stability, whether it be in providing a reliable stream of propaganda to supporters, flagging fake propaganda made in its name, or giving prospective recruits a designated venue to reach out.

In its earlier days, the group relied on a platforms like Twitter to recruit in broad daylight. As Twitter finally cracked down harder, ISIS switched to Telegram in 2015, where it capitalized on a wealth of new tools and capabilities: channels, chat groups, media archiving, end-to-end encryption. While Twitter served as a place to fish for recruits and pull them into discussions on other platforms, Telegram gave ISIS a one-stop-shop for everything.

And while technologies like the Dark Web are often thought of as fitting to the group’s security demands, they are largely useless to its outreach goals. ISIS needs to be where more users already are; otherwise, it’s just talking to itself alone in an empty room.

Sure, mine and other terrorism researchers’ jobs just got a lot harder as ISIS bounces between platforms, but it is in many ways proportionate: The harder it is for us to find terrorist hangouts, the harder it is for prospective recruits.

For the first time since ISIS embraced social media in the early 2010s, there seem to be strong signs of the government-tech sector collaboration myself and others have been calling for. ISIS is not gone and will not be for a long time, but a critical pillar of its life force has been cracked. It’s something to not only embrace, but also demand continue.

Phil Cole, a senior SITE analyst, contributed to this article.

WIRED Opinion publishes articles by outside contributors representing a wide range of viewpoints. Read more opinions here. Submit an op-ed at opinion@wired.com.

More Great WIRED Stories

• Why the “queen of shitty robots” renounced her crown
• Amazon, Google, Microsoft—who has the greenest cloud?
• Instagram, my daughter, and me
• Ewoks are the most tactically advanced fighting force in Star Wars
• Everything you need to know about influencers
• 👁 Will AI as a field “hit the wall” soon? Plus, the latest news on artificial intelligence
• 🏃🏽‍♀️ Want the best tools to get healthy? Check out our Gear team’s picks for the best fitness trackers, running gear (including shoes and socks), and best headphones.