Seemingly managed by sympathizers of the Islamic State, the large cache of digital files, here nicknamed the “Cloud. Caliphate,” can offer researchers,
347 KB – 30 Pages
PAGE – 3 ============
˜e Cloud Caliphate: Archiving the Islamic State in Real-Time Moustafa Ayad Amarnath Amarasingam Audrey Alexander Combating Terrorism Center at West Point May 2021 Cover Photo: A cropped screenshot of a 2020 tweet by a pro-Islamic State account promoting access to the largest online archive for the Islamic State United States Military Academy www.ctc.usma.edu The views expressed in this report are the authors™ and do not necessarily re˜ect those of the Combating Terrorism Center, United States Military Academy, Department of Defense, or U.S. Government. Institute for Strategic Dialogue
PAGE – 4 ============
˜˚˛˝˙ˆˇ˘˘˝ The ISD-CTC team would like to thank their colleagues for their support of this project, particularly CTC Executive Director Brian Dodwell. Special thanks also to CTC Research Associate Muhammad al-`Ubaydi and Cadet Amir Udler at the United States Military Academy at West Point for their input on this report. CTC™s Kristina Hummel provided us a fresh set of eyes and copyedits to help us cross the ˚nish line and prepare the piece for publication. About the Authors Moustafa Ayad is the current Executive Director for Africa, the Middle East, and Asia at the Institute for Strategic Dialogue (ISD), overseeing more than 20 programs globally, and has more than a decade™s worth of experience designing, developing, and deploying multi-faceted P/CVE, elections, and gender projects in con˜ict and post-con˜ict environments across the Middle East and Africa. He has experience in Iraq, Afghanistan, Yemen, Syria, Lebanon, Jordan, Kenya, and Senegal, with a range of government and non-governmental partners on violent extremism, con˜ict resolution, and strategic communications. He also has experience working across these regions with community organizations, media outlets, and regional/global production hubs on the creation of multi- platform media content aimed at empowering youth, supporting civil society, and strengthening national and local stakeholder capacity. His research on the use of social media platforms by extremist groups and their supporters has been featured in the BBC, The Times, VICE, CNN, NPR, Wired , and The Daily Beast. Amarnath Amarasingam is an Assistant Professor in the School of Religion, and is cross-appointed to the Department of Political Studies, at Queen™s University in Ontario, Canada. He is also a Senior Research Fellow at the Institute for Strategic Dialogue (ISD), an Associate Fellow at the International Centre for the Study of Radicalisation, and an Associate Fellow at the Global Network on Extremism and Technology. His research interests are in terrorism, radicalization and extremism, diaspora politics, post-war reconstruction, and the sociology of religion. He is the author of Pain, Pride, and Politics: Sri Lankan Tamil Activism in Canada (2015), and the co-editor of Sri Lanka: The Struggle for Peace in the Aftermath of War (2016). He has also written several peer-reviewed articles and book chapters, has presented papers at over 100 national and international conferences, and has written for The New York Times , The Monkey Cage, The Washington Post , CNN, Politico, The Atlantic, and Foreign A˜airs . He has been interviewed on CNN, PBS Newshour, CBC, BBC, and a variety of other media outlets. He tweets at @AmarAmarasingam Audrey Alexander is a researcher and instructor at West Point™s Combating Terrorism Center. In that role, she studies terrorist exploitation of technology and investigates the nexus of gender and violent extremism. Before joining the Center, Alexander served as a senior research fellow at the George Washington University™s Program on Extremism and worked at the International Centre for the Study of Radicalization. She is also an Associate Fellow at the Global Network on Extremism and Technology. Alexander holds a master™s degree in Terrorism, Security & Society from the War Studies Department at King™s College London. Director ˜˚˛˝˙ˆ Executive Director Research Director Distinguished Chair ˜˚ George H. GIlmore Senior Fellow Senior Fellow Senior Fellow †‘ Class of 1971 Senior Fellow •ˆ Class of 1987 Senior Fellow †… ˜˚˛˝˙˜˝˛˚ ˝–˙ƒ ˝⁄‹ ˝−ˆ†‘˝š€˝‰‹„„⁄ ˝fl‚Ł‚™„fi ˝−˝ †˝ˆˆ††ˆ˝ †˝ ˆƒ‘ˆ“˝ ‘˝ –˙Œ COMBATING TERRORISM C ENTER ˆ
PAGE – 6 ============
ˆˆˆThis report o˛ers a preliminary survey and analysis of one of the largest known online repositories of Islamic State materials in order to increase understanding of how violent extremist groups and their supporters manage, preserve, and protect information relevant to their cause. Seemingly managed by sympathizers of the Islamic State, the large cache of digital ˚les, here nicknamed the fiCloud Caliphate,fl can o˛er researchers, policymakers, and counterterrorism practitioners additional insights on how and why groups and their adherents maintain archives of such material. From a sociological standpoint, caches like the fiCloud Caliphatefl serve to curate a shared history of the movement. At the operational and tactical level, digital repositories help the online contingents of the group rally in the face of setbacks, particularly when adherents promote such resources across numerous information and communications platforms. Initially identi˚ed, accessed, and documented by the Institute for Strategic Dialogue (ISD), research partners at the Combating Terrorism Center (CTC) at the United States Military Academy at West Point supported the analysis. Ultimately, given the size of the fiCloud Caliphatefl and the scope of its contents, no single research method is suitable for an initial survey of this resource. Instead, the authors of this report used a mixed-methods approach to explore di˛erent aspects of the cache, highlighting how digital archives like the fiCloud Caliphatefl might inform researchers, practitioners, and policymakers in the future. The core analysis breaks into seven di˛erent parts. After reviewing the likely origins of the repository, the ˚rst section describes its composition, and the second discusses evidence concerning cyber support from other online actors. Then, sections three through six explore speci˚c folders within the archive, which pertain to matters concerning the Islamic State™s organizational predecessors and a range of notable leaders, ideologues, and scholars. Section seven of the report highlights a real-world case involving the use of the fiCloud Caliphatefl archive by an Islamic State supporter. The report concludes with a re˜ective discussion that notes potential policy considerations for those tasked with confronting the Islamic State™s exploitation of information and communications technologies. First, it argues relevant stakeholders must look for opportunities to identify, document, and study accessible repositories and take stock of the methods used to build, promote, and maintain such resources. Second, while respecting human rights and the rule of law, relevant stakeholders should look for opportunities to identify and disrupt individuals creating, administering, supporting, or using the resources for criminal, terrorism-related activities. Third, stakeholders concerned with violent extremist exploitation of website services to develop repositories like the fiCloud Caliphatefl must remember this problem is not new, and it brushes up against big questions involving internet governance. Fourth, relevant stakeholders, including service providers and organizations like the Global Internet Forum to Counter Terrorism and Tech Against Terrorism, should continue exploring ways to marginalize the in˜uence of sources like the fiCloud Caliphatefl by focusing on the networks and tools that enable them to reach new users. Ultimately, the counterterrorism community must recognize the role digital archives play in fostering a shared sense of identity in a global movement. Realizing the potential of repositories like the fiCloud Caliphate,fl for better or worse, should inform the development of mitigation tools. AYAD / AMARASINGAM / ALEXANDER MAY 2021 CLOUD CALIPHATE
PAGE – 8 ============
the archive. Due to its size and scope, researchers decided that a mixed-method approach exploring seven di˛erent aspects of the repository o˛ered value by demonstrating how the counterterrorism community might leverage such resources. Consequently, the core analysis breaks into seven di˛erent parts. After reviewing the repository™s likely origins, the ˚rst section describes its composition, and the second discusses evidence concerning cyber support. Then, sections three through six explore speci˚c folders within the archive. Section seven of the report delves into a real-world case of an Islamic State supporter who appeared to have access to the fiCloud Caliphate.fl This report will conclude with a re˜ective discussion that raises policy considerations for managing online contingents of movements like the Islamic State and explores methods for disrupting the creation and management of resources like the fiCloud Caliphate.fl Over the past few years, research on the Islamic State™s exploitation of information and communications technologies has worked to keep pace with the movement™s ever-changing ecosystem of online adherents.5 To the credit of researchers and analysts around the world, many aspects of the Islamic State™s online behavior are documented and examined. Even so, old and new problems continue to create opportunities for subsequent analysis, like the enduring issue of URL sharing by violent extremists. 6 Some contemporary studies strive to chart the Islamic State™s forays onto emerging platforms, such as text-based applications supplementing the movement™s use of other messengers like Telegram and Kik and broad-based social media like Facebook and Twitter. 7 Other research has focused on the countermeasures Islamic State supporters use to overcome the challenges of online content moderation with tactics such as leveraging link-shorteners, using bots, hijacking hashtags, or using compromised and expendable accounts. 8 Some long-standing e˛orts by violent extremists to keep digital content accessible online, including rudimentary practices like making collections of content accessible with websites, forums, and other ˚le-sharing tools, still warrant attention. 9 Today, there seems to be a modern twist on these old-school techniques as pro-Islamic State sympathizers use new tactics and platforms to seed links to longer-running collections of material. To better understand this phenomenon and its impacts, this report discusses the existence, contents, and promotion of the fiCloud Caliphate,fl the largest known repository aligned with the Islamic State and its predecessors. Before articulating how researchers accessed and studied the cache, it is helpful to highlight the roles of digital archives in fostering a shared sense of identity within an amorphous online community. fi˝ˆŒ˝˝˜ˇ†‘˝ƒ˝ ˛†‘¡˝ Perspectives on Terrorism ˝˚ˆ˝ †‘¡˝−†‘‘˝ž‹‰fi ⁄˝ˇ˝ƒ˝ˆ††˝˚‘¡˝Ÿ˘†˝ Œ‹‰„¦˝˙−ƒˆŠ‘˝˝ ˆ‘¡˝ Studies in Con˜ict and Terrorism ˝ ›˝˝†”˝‡ƒ˚ˆ††‘¡˝ ‡˚˝ž‹ž‹¦˝‘−˝˝ ‡††˚‘¡–˙Ÿ‘ˆ†ˆ˚˚‘˝ ‹‰„¦˝˝ı˚ˆ˘˝‘¡˝…ˆ‘‘˝ž‹‰„¦˝ ‘−‘˝˚†˝¡˙˚‘˝ ‘˝ž‹˝ ‚˝˝ˆ˘Ž‘˝ıƒ†˝˛˚˝ ¡–˙Ÿ‘ˆ†ˆ˚˚‘˝ž¦˝ƒ˝˝ Ÿ˙Ÿ˜ˆ††˝˚˝−Š˝ „˝˝ The Master Plan: ISIS, al-Qaeda, and the Jihadi Strategy for Final Victory Œˆ˘‘˝˛˚”˝€ˆ††‘˝ž‹‰˝ ““˝fi⁄Łfi›˝˙ƒ˝ı†˝…‘¡˝ RUSI Journal •˝˝ ƒ˝©ˆ‘˝©ˆ‘†‘¡˝šˆˇ˝’˝‹‰fl¦˝‘˝ Œƒ‘¡˝ Survival ˝fi‹‰›ˆ‘˝Œ˝ ‹‹flŁž‹‰¡˝Ł˚˛Œ‹‰⁄ AYAD / AMARASINGAM / ALEXANDER MAY 2021 CLOUD CALIPHATE
PAGE – 9 ============
From a sociological standpoint, whether used by extremist groups or non-violent movements, digital archives can help foster real and imagined identities. Wolfgang Ernst, the German media theorist, wrote that fithe Internet extends the classical space of the archive, library, and museum by an extra dimension.fl 10 That extra dimension is where groups often create meaning out of loss. Following the devastating 9/11 attacks, historians designed and developed the September 11 Digital Archive to ficreate a permanent record of the events of September 11, 2001.fl The archive partnered with the Library of Congress a year later, the ˚rst digital acquisition by the Library of Congress, and it now represents one of the largest, most comprehensive digital archives of the terrorist attack to date. It contains some 150,000 pieces of digital content, about 40,000 emails, 40,000 ˚rst-hand stories, and 15,000 images. 11 Archives, in this sense, help preserve the collective sensory memory of the most spectacular terrorist attack of the past two decades and serve to fortify national identity. Arjun Appadurai contends that archiving, in any form, functions as part of a collective project, suggesting fithe archive is itself an aspiration rather than a recollection.fl 12 He suggests the archive represents a ficollective will to rememberfl rather than a benign collection of the extant traces of history. 13 The desire to remember and archive thus reveals the desires of those seeking to record and document the past. For Islamic State supporters, the creation and curation of the online cache is a process of delineating the ideological and territorial parameters of what it means to be a supporter or member of the Islamic State. As this report demonstrates in its analytical discussion of the fiCloud Caliphatefl repository, the ideologues, scholars, and territories they choose to include are not incidental but, like any national archive anywhere, can demarcate what is important to the group. With the birth of digital archives, fithe archive is gradually freed of the orbit of the state and its o˝cial networksfl and fireturns to its more general status of being a deliberate site for the production of anticipated memories by intentional communities.fl 14 This style of imagining a communityŠthe imagined community of the nationŠ˚gures centrally in the aforementioned assessments of the modern archive. For Mike Featherstone, fiarchives along with museums, libraries, public monuments and memorials became instruments for the forging of the nation into the people Š into an imagined community.fl 15 Case studies of particular modern archives have also borne out these claims about the fiwill to archive,fl and its support of emergent imagined communities, from Julie Biando Edwards and Stephen P. Edwards™ analysis of the Iraq National Library and Archive to Sophia Milosevic Bijleveld™s exploration of the Jihad Museum in Herat, Afghanistan. 16 In both case studies, the archive o˛ers a site for the consolidation of what Anderson calls the finational biography,fl a coherent narrative fifor ordering events of the past in light of the nation.fl 17 The fiCloud Caliphatefl arguably serves the same function for Islamic State supporters: it is an ever-evolving repository of cultural productions that communicate what the Islamic State is about and who champions its ideas and narratives, and the ‰‹˝−—ˇ˘—˝‡‘˝ Digital Memory and the Archive †ˆ††‘˝ž‹‰˝“˝‚™˝ ‰‰˝ˆ‘¡˝ˇ˘˝˙‘˝˛ˆˆ††ƒ‹‘˝ž‹ž‹ ‰ž˝ƒ““˝ıƒ¡˝ Information is Alive: Art and Theory on Archiving and Retrieving Data †‘˝ž‹‹˝‰⁄ ‰fl˝˝“˝‰› ‰™˝˝“˝‰› ‰fi˝ˆ˝’ˆ†‘˝ıˆ‘¡˝ Theory, Culture & Society ˝žfl”žŁ˝fi„ ‰⁄˝˙†ˆŒ˝ıƒ‘¡˝ Studies in Ethnicity and Nationalism ˝‰‹fiŁ‰ž™¦˝‘˝ıˇł”˝ˇł˝ ˆ‘˝‘¥¡˝ Libraries & the Cultural Record ˝ ““˝flž›Ł ‰›˝†˝ Imagined Community: Re˜ections on the Origin and Spread of Nationalism €‘˝š€”˝…†‘˝ž˝ ž‹ €AYAD / AMARASINGAM / ALEXANDER MAY 2021 CLOUD CALIPHATE
PAGE – 10 ============
archive separates the group™s enemies from its adherents. In 2006, long before the announcement of the ficaliphatefl and the proliferation of Islamic State accounts and websites across the open web, researchers were already concerned with fithe size and scope of the web resources being developed by jihadist sympathizersfl and the fikey nodesfl and fimother sitesfl of fijihadist groups, and of key jihadist clerics and ideologues.fl 18 At the time, researchers posited that by understanding one website within these online networks of jihadis, they could better understand the functionality, centrality, and importance of others in the same network. Researchers at the University of Wollongong delved into the use of fianonymous sharing platforms and [Islamic State] contentfl in 2018. They aimed to provide ficountermeasures against online propaganda operations,fl and to do that e˛ectively, the research would have to go beyond the Telegram channels and dive into fianonymous sharing portals acting as black boxes for [Islamic State]-related propaganda.fl At the time, the research e˛ort was focused on ˚le-sharing sites like Justpaste.it, Sendvid.com, and Dump.to, speci˚cally because Islamic State finetworks seem to have reacted to the degradation of their capabilities on popular social media networks and rapidly migrated to new anonymous portals.fl 19 Predecessors and competitors of the Islamic State have used ˚le-sharing sites like those mentioned above over the years, but mounting pressures from increasingly stringent content moderation e˛orts online have probably motivated increased use of these tools by Islamic State supporters. 20This dynamic, in which certain platforms force terrorist groups and supporters o˛ and necessitate their expedient migration to others, was also at play when EUROPOL targeted Islamic State Telegram channels and groups in late 2019. 21 Such actions resulted in a ballooning of Islamic State channels and groups on TamTam and Hoop Messenger. 22 This dynamic is not unique to the Islamic State; as countries and service providers leverage the same mechanisms against white supremacist groups on social media platforms, similar shifts among sympathizers occur. 23 Ultimately, as this report argues, repositories containing archived material appear to be one way that the Islamic State (and potentially other groups) shifts between platforms and maintains a constant stream of information. While the research community has studied the production, themes, and dissemination of Islamic State-related content, whether produced by the group or its supporters, it dedicates less attention to the role of contemporary digital archives. 24 This report attempts to address that gap, as the authors believe violent extremists™ e˛orts to build, protect, and maintain caches of information could remain a common practice in the years ahead. Particularly as the Islamic State grapples with its future on the ground, ‰‚˝¢˘ˆ˝†ˆ†”˝ˆ†˝ ˇ†ˆ¡˝ı†ˇ†ˆ‘¡˝ Jane™s Intelligence Review ‘˝‹‹⁄ ‰„˝˚ˆ‘˝¡˝ Perspectives on Terrorism ˝‚‰Ł„„ ž‹˝ƒ˝ı˚ˆ¥†˝¢ˇ—ˆ‘˝−˝ †‘¡Ł˚˛‘˝ž‹‰‚¦˝˝ −ˆ˝˚‘¡˝˚ƒ—˚˝‘˝ž‹‰„ ž‰˝˝ıƒ˝…˚˝’†˝‡ˆ‘¡˝ CTC Sentinel ˝‰‹ž žž˝‘˝ˇ—†˝†˚‘ˇ†‘¡‘˝‘˝ž‹ž‹¦˝ ‘−˝ žfl˝‘˝ı−…¡˚˝ž‹ž‹ ž™˝ˆ†ˆˆ†ˇ˘—˝ †˝ˆ†˝ˇ˝¡˝ ŒŒ˝ ı†‘¡ˆ‘ˆ†˝šˆ˝ˆ‘˝ ˆ†˝šˆ˝ˆ‘‘ ††˝−ıˆ‘¡ˆ˝œŒˆˆ†˝ ˆ†˝’˝ †ˆ‘ˆ†ˆ†ˆıˆ¡ AYAD / AMARASINGAM / ALEXANDER MAY 2021 CLOUD CALIPHATE
PAGE – 11 ============
historical archives like those stored online in the fiCloud Caliphatefl will likely be critical to forging a shared identity for supporters, much like any archive. Focusing on the cache at hand, which is nicknamed the fiCloud Caliphatefl for this project, it is vital to explain how researchers identi˚ed, accessed, documented, and studied this formerly password- protected, digital collection of materials aligned with the Islamic State and its worldviews. First, the choice to use the fiCloud Caliphatefl pseudonym instead of the repository™s domain name stems from reservations about the inadvertent promotion or glori˚cation of terrorist material in pursuit of research. Though views on this decision may vary, the authors sincerely aim to o˛er a productive survey of the cache™s contents without amplifying the site and encourage continued discourse on best practices for researchers studying materials associated with violent extremist groups. On a di˛erent note, although it is the largest cache of this type known to the authors, Islamic State adherents across numerous platforms appear invested in archiving content and amassing libraries of resources, which suggests the existence of other repositories. The cache features more than seven di˛erent languages. The primary languages are Arabic, French, German, and English. The secondary languages, which are less common, include Russian, Turkish, Farsi, Bangla, and Uyghur. Consequently, the analysis provided in this report, which subsequent publications will also explore, assesses the fiCloud Caliphatefl as one part of a broader trend. Before delving into granular details about the fiCloud Caliphate,fl it helps to understand how researchers identi˚ed and accessed the cache in the ˚rst place. In 2019, in the midst of an earlier project tracking Islamic State sympathizers™ online responses to the death of Islamic State leader Abu Bakr al-Baghdadi,25 researchers at ISD noticed some interesting link-sharing patterns on Twitter. Curious about this activity, researchers probed further, assessing the type of accounts and tactics used to disseminate a suite of di˛erent URLs that lead to the same domain. Further analysis of Islamic State support groups and clusters across numerous platforms, motivated by ISD researchers™ initial observations, highlighted an interconnected network of users linked to a continually shifting cache of 1.3 terabytes (now 2.2 terabytes) of Islamic State content. In accessing the site, researchers noted how meticulously someone stored and sorted content using an open-source ˚le hosting service called NextCloud. 26 NextCloud acts as a private ˚le hosting application, with functionalities and user experiences akin to Dropbox and Google Drive. Utilizing a mix of open-source and paid services, NextCloud and Cloud˜areŠthe web server notorious for hosting 8ChanŠsupporters have created a makeshift online warehouse that stores thousands of pieces of content and doubles as a website. Supporters of the Islamic State have adapted adeptly to the rapid development of numerous encrypted platforms and open-source technologies to avoid detection. NextCloud is, in fact, the application of choice for The Electronic Horizons Foundation, dubbed the fiISIS Help Desk,fl to disseminate and store its content to aid supporters in evading authorities and detection online. 27 The tactical tools shared by both the cache™s creator(s) and the Electronic Horizons Foundation to build their respective archives are similar, and sympathizers often tout both sites as means to access information when accounts or websites are taken down. This supporter-to-supporter learning is key to understanding how the Islamic State and its various support arms have evolved online. The two drives even share traits such as links to Telegram bots developed for their speci˚c archives at the bottom of the page when they are accessed. Similar designs and tactical measures suggest that supporters learn from each other™s žfi˝ƒ˝ˆ††˝˚¡ ž⁄˝ˆˆ‹‰„‘Œˆ††˝ ˆ†ˆˆ˝ˇ—†ˆŒŒ˝ ž›˝˛‘˝ıšˆ†‘¡˝’‹‘˝ž‹‰⁄ ⁄AYAD / AMARASINGAM / ALEXANDER MAY 2021 CLOUD CALIPHATE
347 KB – 30 Pages