Twitter Has Been Flooded With ISIS Propaganda Since al Baghdadi's Death

Moustafa Ayad is the Deputy Director of International Technology, Communications and Education at the ISD, an international group fighting terrorism, extremism, and fascism.

In the moments on Twitter following the breaking news of ISIS leader Abu Bakr al-Baghdadi’s death, hashtags sprung up in al-Baghdadi’s name and that of the Islamic State. Under the cover of these threads, a network of ISIS accounts showing signs of automated and semi-automated behavior went to work. Tagging terrorist content such as al-Baghdadi’s final video address, and other videos highlighting the "blessed mujhadeen of the State,” the accounts hashtagged their content with the trending topics of the day across the Middle East and North Africa, including Saudi football clubs, a luxury rental car company in Dubai, and even a hashtag for finding a Sudanese wife.

Institute for Strategic Dialogue (ISD) researchers monitored this Arabic ISIS-Twitter account network for a full week, and tracked the tactics and content of these account showing strong signs of automation and semi-automation following the death announcement of the “Caliphate’s” first charlatan-in-chief of a leader, al-Baghdadi. As of Friday, the accounts were tweeting out audio content produced by al Furqan media heralding the ascension of the new ISIS leader Abu Ibrahim al Hashimi al Qurashi.

About 145 accounts—many of which were repurposed marketing accounts that seemed to have been bought and sold for advertising purposes in the years prior to al-Baghdadi’s seminal speech in 2014 from the heart of Mosul establishing a Caliphate—spring-boarded to life, tweeting ISIS content in some instances every second.

The tweets contained the very same content, the same language, and the exact same series of hashtags. While Twitter did much to take them down within the first 24-hours after the announcement of al-Baghdadi’s death, the accounts continued to generate and activate well into the week following his death. Researchers were tracking the accounts late into Friday. One of the accounts @carlasoosa, tweeted out the latest audio recording—as a video that accumulated 43,800 views—of the new ISIS-spokesperson highlighting the achievements of the state and heralding in its new leader, al Qurashi.

The ‘Baghdadi Net’ identified by ISD illustrated just how groups and other users could maneuver and exploit gaps in the detection of automated and semi-automated accounts, which have been revisited by tech companies in the wake of events like the Christchurch massacre. Overall, the tactics used by accounts showing strong signs of automated and semi-automated behavior were not new or innovative, but their abilities to continue to push out branded-terrorist content, and in Arabic, the lingua franca of Salafi-jihadists, proved they could get past moderation systems. Twitter previously reported that it has suspended 1.2 million accounts spreading terrorist content over a period spanning 2015 to 2018.

The accounts over the course of the week seemed to keep posting more and more diverse ISIS-branded content under an array of hashtags. They seemed, in many ways, to be adapting to take down strategies, and in some instances instructing other accounts how to get around censors and monitors reporting them.

Networks of automated and semi-automated accounts have received increased public attention over the past four years as they have been leveraged to spread disinformation, denial-of-service attacks, and generally cause chaos. While most of the attention has been focused on Russian-backed botnet interference in the 2016 US elections and the 2016 Brexit vote, ISIS was one of the first terrorist groups to pioneer swarming social media with posts from automated and semi-automated accounts. This recent surge signals the ability of ISIS to control accounts across Twitter and amplify its narratives in ways which still demonstrate its effectiveness as Salafi-jihadist propagandists.

As one account was reported by the community or identified by Twitter and deleted, another would go up with the exact same content and hashtags within moments. Researchers witnessed this on several occasions and documented it through screenshots. The account @Report_ISIS, an Arabic group reporting ISIS accounts across Twitter and claiming to be part of a program of the United States Central Command, said it reported 590 accounts over the first four days of the week, starting on Sunday. Many of those accounts were reactivated within minutes, and sometimes seconds through proxies that were followers of the originally-reported accounts. Researchers were following 145 of these as of publishing, with more being generated at the time of this article’s publishing.

Many of the accounts shared al-Baghdadi’s last recorded video, and focused on the military successes of ISIS, as well as the atrocities committed against Syrians during the nine-year conflict. Several of the accounts shared ideologue-specific content that was celebratory of the legacy of Usama bin Laden, Abu Mus’ab al Zaraqawi, Abu Mohammad al Adnani, the now deceased spokesperson for ISIS, and al-Baghdadi.

The primary hashtags the accounts were focused on were very specific to the Arab World, including the Saudi football league, as well as the popular protests in Iraq and Lebanon. #Erdogan_Created_alBaghdadi—a trending hashtag in Saudi Arabia and Jordan—was flooded by accounts that had Western-style names such as “Karen,” or the “SaxonYouth,” which was an account that was linking itself to the Peterborough Youth club in the United Kingdom and sharing the ISIS-affiliated news blasts from al Amaq news agency. The accounts had scant followers, and were primarily being followed by other marketing accounts, or what seemed to be automated personalities. However, in some instances they were being followed by verified, Twitter accounts. The certified England Rugby Twitter account, with more than 1 million followers, was following @Lollipo57778519, affiliated with a user dubbed “Ahmad al Nahdi,” who was tweeting out ISIS-branded videos that included a wheelchair-bound fighter kissing his children goodbye before going on a “martyrdom mission against the Nusayri [Crusaders].”

These accounts present a challenge to social media companies. While on the one hand they run predictable posting patterns, which should make for easy targeting, on the other they are spreading ISIS ideology and content at a time when the group is reeling from both the loss of its leader and his deputy. By deploying a phalanx of automated and semi-automated accounts, the group can flood popular trending topics and attract new audiences with a click of a button.

Many of the accounts were formerly used for marketing. Many of them had previous tweets from 2012, and 2009, that were in marketing jargon, like “I made $574 today working a few hour [sic] from home!” followed by a link. One account retweeted “#NobodyLikes Muggles” by a Lord Voldemort account—the villain from the Harry Potter book and movie series. Overall, the accounts exhibited a mixture of Arabic and English, and the written Arabic content was in and of itself a strange amalgamation of oddly-phrased vernacular and misspellings in some instances.

As Twitter began taking down the accounts within the initial 72-hours after the news, researchers witnessed new accounts with the same hashtags and new video content get reposted. Repository video accounts also began to regenerate, and continue to repost more content for other accounts to use in their tweets. It was clear to researchers that Twitter was not prepared for the announcement of the death, and the potential for ISIS supporters online to exploit gaps in the platform’s identification techniques.

The use of automated and semi-automated accounts is not new for ISIS, and similarly a key component of current misinformation, disinformation and propaganda campaigns. The network seemed to be continuing to thrive, and is posting and regenerating content across Twitter. It is in itself a new era for a post-al-Baghdadi ISIS. During this period, without the charismatic leadership of al-Baghdadi, ISIS will rely on these tactics, mass diffusion of content, on popular platforms, through automated accounts, as an easy workaround to remind audiences of their importance and significance until a suitable, charismatic leader is in place. In the words of ISIS supporters, fighters and leaders, the group is qadimoon, advancing, and its bakiya, staying.

Twitter did not provide comment for this article.