Understanding ISIS

Summary of ISIS

• WHILE NOT AS LARGE as in many other Western countries, ISIS-related mobilization in the United States has been unprecedented. As of the fall of 2015,
• U.S. authorities speak of some 250 Americans who have traveled or attempted to travel to Syria/Iraq to join the Islamic State in Iraq and Syria (ISIS) and 900 active investigations against ISIS sympathizers in all 50 states.
• Seventy-one individuals have been charged with ISIS-related activities since March 2014. Fifty-six have been arrested in 2015 alone, a record number of terrorism-related arrests for any year since 9/11.

Of those charged:
o The average age is 26.
o 86% are male.
o Their activities were located in 21 states.
o 51% traveled or attempted to travel abroad.
o 27% were involved in plots to carry out attacks on U.S. soil.
o 55% were arrested in an operation involving an informant and/or an undercover agent.

• A small number of Americans have been killed in ISIS-related activities: three inside the U.S., at least a dozen abroad.
• The profiles of individuals involved in ISIS-related activities in the U.S. differ widely in race, age, social class, education, and family background. Their motivations are equally diverse and defy easy analysis.
• Social media plays a crucial role in the radicalization and, at times, mobilization of U.S.-based ISIS sympathizers. The Program on Extremism has identified some 300 American and/or U.S.-based ISIS sympathizers active on social media, spreading
• propaganda, and interacting with like-minded individuals. Some members of this online echo chamber eventually make the leap from keyboard warriors to actual militancy.
• American ISIS sympathizers are particularly active on Twitter, where they spasmodically create accounts that often get suspended in a never-ending cat-and-mouse game. Some accounts (the “nodes”) are the generators of primary content, some (the “amplifiers”) just retweet material, others (the “shout-outs”) promote
• newly created accounts of suspended users.
• ISIS-related radicalization is by no means limited to social media. While instances of purely web-driven, individual radicalization are numerous, in several cases U.S.- based individuals initially cultivated and later strengthened their interest in ISIS’s narrative through face-to-face relationships. In most cases online and offline dynamics complement one another.
• The spectrum of U.S.-based sympathizers’ actual involvement with ISIS varies significantly, ranging from those who are merely inspired by its message to those few who reached

Statistics on ISIS Recruits in the U.S. Legal System

Over the course of six months, our researchers reviewed more than 7,000 pages of legal documents detailing ISIS-related legal proceedings, including criminal complaints, indictments, affidavits, and courtroom transcripts. Supplemented by original research and

interviews with prosecutors, reporters, and, in some select cases, families of the charged individuals, the Program developed a snapshot of the 71 individuals who have been charged for various ISIS-related activities.

Defying any cookie-cutter profile of the American ISIS supporter, these 71 individuals constitute an incredibly heterogeneous group. In fact, they come from an array of ethnic groups and a range of socio-economic and educational statuses. A deeper analysis of some of these individuals and their radicalization and/or mobilization trajectories is provided below.

To better understand this group, researchers developed nine data points, each corresponding to a distinct demographic factor or arrest characteristic.

Age

The youngest U.S. person arrested for ISIS-related activities was an unnamed 15-year-old boy. Two others were minors, ages 16 and 17 at the time of their arrests. The oldest was Tairod Pugh, a former Air Force officer who was 47 at the time of his arrest. The average age of the American ISIS supporter at the time of charges is 26.

Mirroring a pattern witnessed in most Western countries, the age of those arrested in connection with ISIS is on average lower than that of individuals arrested on terror-related charges in the past. As U.S. Assistant Attorney General John Carlin has noted, “In over 50 percent of the cases the defendants are 25 years or younger, and in over a third of the cases they are 21 years or younger. . . That is different than the demographic we saw who went to support core al Qaida in the Afghanistan FATA (Federally Administrated Tribal Areas) region.”

Gender

Sixty-one of the seventy-one individuals (86%) are male. Nonetheless, women are taking an increasingly prominent role in the jihadist world. A handful of studies have attempted to identify the reasons why ISIS’s ideology attracts a growing number of Western women.22 While some of these motivations are identical to that of their male counterparts (i.e. the search for a personal identity and the desire to build a strict Islamic society), others are specific to women. The role of women in ISIS varies from propaganda disseminators and recruiters to those as the “wife of jihadist husband” and “mother to the next generation.”23

Time Frame

The tempo of ISIS-related arrests has increased markedly in 2015. An overwhelming majority (56 individuals) were arrested for ISIS-related activities this year. This represents the largest number of terrorism arrests in a single year since September 2001.

Location

While the FBI has stated that there are active ISIS-related investigations in all 50 states, to date only 21 states have had at least one arrest within their borders. New York saw the highest number of cases (13), followed closely by Minnesota (11).

Legal Status

The vast majority of individuals charged are U.S. citizens (58) or permanent residents (6), underscoring the homegrown nature of the threat. Researchers were unable to determine the legal status of seven individuals.

Converts

Approximately 40% of those arrested converts to Islam. Given that an estimated 23% of the American Muslim population are converts, it is evident that converts are overrepresented among American ISIS supporters.24

Use of Informants/Stings

Over half (39) of the individuals were arrested after an investigation involving an informant or undercover law enforcement officer. Since 9/11, the FBI has regularly employed this tactic in terrorism investigations, with a remarkable conviction success rate. At the same time, the use of this tool has caused friction with segments of the American Muslim community.

Travel Abroad

Fifty-one percent of those charged with ISIS-related activities attempted to travel abroad or successfully departed from the U.S. In October 2015, FBI Director Comey revealed that the Bureau had noted a decline in the number of Americans seeking to travel overseas, although he did not elaborate on what elements triggered this shift.25

Domestic Terror Plot

An overwhelming majority of those charged (73%) were not involved in plotting terrorist attacks in the U.S. Most U.S.-based ISIS supporters were arrested for intent to do harm overseas or for providing material support—namely personnel and funds—to fighters in Syria and Iraq.

An Exploration into ISIS Extremism

The so called information revolution, with the unexpected rise of the internet since the 1990s, has clearly been of growing societal significance. The internet offers terrorists and extremists the same opportunity and capability that it does for the rest of society: to communicate, collaborate and convince. There are already significant quantities of radical materials available online, and this volume is growing daily. The following table 1 illustrates today’s wide-spread availability of material pertinent to extremism and terrorism on-line:

Table 1: Google search for examples of critical keywords

Search Term	Number of Results
“how to make a bomb”	1,830,000
“Salafi publications”	46,200
“beheading video”	257,000

Source: RAND Europe’s own observations (based on web results for selected search terms)

Whilst terrorists and extremists can indeed use the internet for a myriad of purposes (disseminating propaganda and information to radicalize individuals, operational planning and fundraising) – to what extent does activity online influence offline behavior and vice versa? We examine this question in order to understand the importance (or lack thereof) of the internet for radicalization. What role does the internet play with regard to the apparent phenomenon of online radicalization? Is the internet merely a source of inspiration? Does it accelerate the radicalization process? Does it translate into action? These questions are explored in subsequent chapters through the 15 cases that form the primary research for this study.

The following five hypotheses identified are as followed:

1. The internet creates more opportunities to become radicalized.
2. The internet acts as an ‘echo chamber’: a place where individuals find their ideas supported and echoed by other like-minded individuals
3. The internet accelerates the process of radicalization.
4. The internet allows radicalization to occur without physical contact.
5. The internet increases opportunities for self-radicalization.
   

Findings

Evidence from the primary research conducted confirmed that the internet played a role in the radicalization process of the violent extremists and terrorists whose cases we studied. The evidence enabled the research team to explore the extent to which the five main hypotheses that emerged from the literature in relation to the alleged role of the internet in radicalization held in these case examinations. The summary findings are briefly presented here and discussed in greater detail in the full report that follows:

The internet creates more opportunities to become radicalized

Firstly, the research supports the suggestion that the internet may enhance opportunities to become radicalized, as a result of being available to many people, and enabling connection with like-minded individuals from across the world 24/7. For all 15 individuals that we researched, the internet had been a key source of information, communication and of propaganda for their extremist beliefs.

The internet acts as an ‘echo chamber’

Secondly, the research supports the suggestion that the internet may act as an ‘echo chamber’ for extremist beliefs; in other words, the internet may provide a greater opportunity than offline interactions to confirm existing beliefs.

The internet accelerates the process of radicalization

This evidence does not necessarily support the suggestion that the internet accelerates radicalization. Instead, the internet appears to facilitate this process, which, in turn, may or may not accelerate it.

The internet allows radicalization to occur without physical contact

The evidence does not support the claim that the internet is replacing the need for individuals to meet in person during their radicalization process. Instead, the evidence suggests that the internet is not a substitute for in-person meetings but, rather, complements in-person communication.

The internet increases opportunities for self-radicalization

The evidence from this research does not support the suggestion that the internet has contributed to the development of self-radicalization. In all the cases that we reviewed during our research, subjects had contact with other individuals, whether virtually or physically.

Case Studies

This chapter explores the role of the internet in 15 cases of radicalization through the data we were able to access. The chapter draws on information provided by interviews with the police and individuals, and maps these against the five hypotheses from the literature review. In a separate Annex we provide an overview of the individual cases as well as presenting data (such as computer registries) from trials where available. The aim is to provide the reader with a sense of what these individuals, the police and a review of trial documents suggested was relevant to the radicalization processes in each case.

The 15 cases examined are broken down as follows:

• Nine of the cases are offenders convicted under the Terrorism Act 2000 or Terrorism Act 2006. These nine cases touch on both Islamist terrorism and the extreme right-wing.
• One case study is of a former member of Al Qaida who was active in Bosnia, Afghanistan and South-East Asia before disengaging from terrorist activities.
• Five of the cases were referred to the PREVENT intervention program which tackles vulnerability (the Channel Program).
  

Interview Process and Objectives

In order to structure the interview process, we set out specific lines of inquiry, while remaining open to the possibility of finding new information that was not expected. In designing the interview questions, we hoped to develop a picture of:

• The individual’s background and the context in which they used the internet;
• The approximate age at which the individual began using the internet;
• The social arena preferred by the individual when spending time online;
• The purpose of the individual’s time spent on the internet and whether they received guidance offline as to what this should be; and
• Whether the individual took substantial breaks from browsing online.

Following from this, we sought to begin understanding:

• The relationship between the internet and offline factors in the individual’s radicalization;
• The role of the internet at different stages of the individual’s radicalization process;
• The strengthening / reinforcing mechanism of the internet, if any; and
• The role the internet played in the individual’s journey if any.

In all 15 cases discussed in this manual, the internet acted as a key source of information, a means of communication, and/or a platform for extremist propaganda. The internet appears, from these cases, to facilitate radicalization. A1 and A2 used the internet to learn how bombs are made; A4 sought instructions on how to build suicide vests; B2 checked when and where EDL demonstrations would take place. For someone like A7, who grew up in a socially conservative household which did not allow television, the internet became a viable medium for accessing knowledge and contacting people and positively fed into his radicalization journey.

The internet enables connection with people who, due to potentially greater anonymity, may have lower thresholds for engaging in conversations that could be perceived as security risks. For A5, the perceived anonymity of the internet was a key factor and created the following opportunity:

“the internet…( as a medium) allows those that would otherwise be scared of being seen with the wrong people to get engaged, and one which makes the whole process more invisible to the authorities. ”

Even if some terrorists and/or extremists are skeptical of the internet’s security they may, like A1 and A2, invest in encryption and deletion software to erase incriminating data instead of choosing not to use the internet at all.

The internet also opens opportunities for those seeking influence to radicalize a broader group of people. The lack of internet in the 1970s and 1980s meant that information on terrorism and extremism was found in books and/or VHS videos and cassette tapes. These needed to be identified, bought and circulated. The reach of the messages contained in these books or cassettes was limited. Contrast that limitation with the new reality illustrated in our cases: members of terrorist groups in Pakistan reached out to A10 to discuss military training whilst A7, A8 and A9 spread the word of the ‘al Qa’ida cell’ in the UK across the internet.

As described by A3, who grew up when VHS and cassettes were used to spread radicalized messages, the internet enables you to take your audience from “retail to wholesale levels”. For B2, the dissemination capacity of the internet is very appealing:

“The net was the best way of getting our messages further afield I think. It’s better than all the leaflet runs the BNP used to do. Look how fast it is and how far it can get your stuff out – literally all over the world and no trudging around council estates putting leaflets through letterboxes and having dogs chasing after you!”

A3 shared with us an approximation of the widening pool for recruiters:

“The internet is like a fishing net, catching surface fish, not bottom fish. We used to catch one at a time, now we catch 100-200 in a year.”

Network Mapping of ISIS

One of the most interesting studies to date has come from incredible individuals and researcher by the name of Valdis E. Krebs, he published a paper entitles Mapping Networks of Terrorist Cells which was very thought-provoking. Krebs examined network ties of terrorist that have been identified during the Sept 11, attacks on the Unites States. Let’s see what he was able to identify.

Within one week of the attack, information from the investigation started to become public. We soon knew there were 19 hijackers, which planes they were on, and which nation’s passports they had used to get into the country. As more information about the hijackers’ past was uncovered I decided to map links of three strengths (and corresponding thicknesses). The tie strength would largely be governed by the amount of time together by a pair of terrorists.

Those living together or attending the same school or the same classes/training would have the strongest ties. Those traveling together and participating in meetings together would have ties of moderate strength and medium thickness. Finally, those who were recorded as having a financial transaction together, or an occasional meeting, and no other ties, I sorted into the dormant tie category – they would rarely interact. These relationships were shown with the thinnest links in the network.

I started my mapping project upon seeing the matrix in Figure1 on the website of the Sydney Morning Herald (AU) (Sydney Morning Herald, 2001). This was the first attempt I had seen to visually organize the data that was gradually becoming available two weeks after the tragedy.

Soon after the matrix in Figure 1 was published, the Washington Post released a more detailed matrix of how the hijackers had spent their time in the USA and with whom (Washington Post, 2001). The most detailed document of the hijacker’s relationships and activity was released in December 2001 in the Indictment of Zacarias Moussaoui (Department of Justice, 2001).

FIGURE 1

Once the names of the 19 hijackers were public, discovery about their background and ties seemed to accelerate. From two to six weeks after the event, it appeared that a new relationship or node was added to the network on a daily basis. In addition to tracking the newspapers mentioned, I started to search for the terrorists’ names using the Google search engine 1.

Although I would find information about each of the 19 hijackers, rarely would I find information from the search engine that was not reported by the major newspapers I was tracking. Finding information that was not duplicated in one of the prominent newspapers made me suspicious. Several false stories appeared about a cell in Detroit. These stories,

originally reported with great fanfare, were proven false within one week. This made me even more cautious about which sources I used to add a link or a node to the network.

By the middle of October, enough data was available to start seeing patterns in the hijacker network. Initially, I examined the prior trusted contacts (Erickson, 1981) – those ties formed through living and learning together. The network appeared in the shape of a serpent (Figure2)– how appropriate, I thought. I was amazed at how sparse the network was and how distant many of the hijackers on the same team were from each other. Many pairs of team members where beyond the horizon of observability (Friedkin, 1983) from each other – many on the same flight were more than 2 steps away from each other.

Keeping cell members distant from each other, and from other cells, minimizes damage to the network if a cell member is captured or otherwise compromised. Usama bin Laden even described this strategy on his infamous videotape which was found in a hastily deserted house in Afghanistan. In the transcript (Department of Defense, 2001) bin Laden mentions:

Those who were trained to fly didn’t know the others. One group of people did not know the other group.

Yet, work has to be done, plans have to be executed. How does a covert network accomplish its goals? Through the judicious use of transitory short-cuts (Watts, 1999) in the network. Meetings are held that connect distant parts of the network to coordinate tasks and report progress. After the coordination is accomplished, the cross-ties go dormant until the need for their activity arises again. One well-documented meeting of the hijacker network took place in Las Vegas. The ties from this and other documented meetings are shown in gold in Figure 3.

• suspected to have false identification
  

Six (6) shortcuts were added to the network temporarily in order to collaborate and coordinate. These shortcuts dropped the mean path length in the network by over 40% thus improving the information flow in the network. There is a constant struggle between keeping the network hidden and actively using it to accomplish objectives (Baker and Faulkner, 1993). The 19 hijackers did not work alone. They had accomplices who did not get on the planes. These co-conspirators were conduits for money and also provided needed skills and knowledge.

After one month of the investigation, it was ‘common knowledge’ that Mohamed Atta was the ringleader of this conspiracy. Again, bin Laden verified this in the videotape (Department of Defense, 2001). Looking at the diagram he has the most connections. A discovery of a new conspirator along with new ties or the uncovering of a tie amongst existing nodes can alter who comes out on top in the Freeman centralities. Recent converts to social network analysis are thrilled about what these metrics may show (Stewart 2001), experienced players urge caution.

Prevention or Prosecution?

Currently, social network analysis is applied more to the prosecution, not the prevention, of criminal activities. SNA has a long history of application to evidence mapping in both fraud and criminal conspiracy cases. Once investigators have a suspect they can start to build an ego network by looking at various sources of relational information. These sources are many and provide a quickly focusing picture of illegal activity. These sources include (DIA, 2000):

• Credit files, bank accounts, and the related transactions
• Telephone calling records
• Electronic mail, instant messaging, chat rooms, and website visits
• Court records
• Business, payroll and tax records
• Real estate and rental records
• Vehicle sale and registration records
  

As was evident with the September 11th hijackers, once the investigators knew who to look at, they quickly found the connections amongst the hijackers and also discovered several of the hijackers’ alters. We must be careful of ‘guilt by association’. Being an altar of a terrorist does not prove guilt – but it does invite investigation.

The big question remains – why wasn’t this attack predicted and prevented? Everyone expects the intelligence community to uncover these covert plots and stop them before they are executed. Occasionally plots are uncovered and criminal networks are disrupted. But this is very difficult to do. How do you discover a network that focuses on secrecy and stealth?

Covert networks often don’t behave like normal social networks (Baker and Faulkner, 1993). Conspirators don’t form many new ties outside of the network and often minimize the activation of existing ties inside the network. Strong ties, which were frequently formed years ago in school and training camps, keep the cells interconnected. Yet, unlike normal social networks, these strong ties remain mostly dormant and therefore hidden. They are only activated when absolutely necessary. Weak ties were almost non-existent between members of the hijacker network and outside contacts. It was often reported that the hijackers kept to themselves. They would rarely interact with outsiders, and then often one of them would

speak for the whole group. A minimum of weak ties reduces the visibility into the network, and chance of leaks out of the network. In a normal social network, strong ties reveal the cluster of network players – it is easy to see who is in the group and who is not. In a covert network, because of their low frequency of activation, strong ties may appear to be weak ties. The less active the network, the more difficult it is to discover. Yet, the covert network has a goal to accomplish. Network members must balance the need for secrecy and stealth with the need for frequent and intense task-based communication (Baker and Faulkner 1993). The covert network must be active at times. It is during these periods of activity that they may be most vulnerable to discovery.

The hijacker’s network had a hidden strength – massive redundancy through trusted prior contacts. The ties forged in school, through kinship, and training/fighting in Afghanistan made this network very resilient. These ties were solidly in place as the hijackers made their way to America. While in America, these strong ties were rarely active – used only for planning and coordination. In effect, these underlying strong ties were mostly invisible during their stay in America. It was only after the tragic event, that intelligence from Germany and other countries, revealed this dense under-layer of this violent network.

This dense under-layer of prior trusted relationships made the hijacker network both stealth and resilient. Although we don’t know all of the internal ties of the hijackers’ network it appears that many of the ties were concentrated around the pilots. This is a risky move for a covert network. Concentrating both unique skills and connectivity in the same nodes makes the network easier to disrupt –once it is discovered. Peter Klerks (Klerks 2001) makes an excellent argument for targeting those nodes in the network that have unique skills. By removing those necessary skills from the project, we can inflict maximum damage to the project mission and goals. It is possible that those with unique skills would also have unique ties to the network. Because of their unique human capital and their high social capital, the pilots were the richest targets for removal from the network. Unfortunately, they were not discovered in time.

To draw an accurate picture of a covert network, we need to identify task and trust ties between the conspirators. The same four relationships we map in business organizations would tell us much about illegal organizations. This data is occasionally difficult to unearth with cooperating clients. With covert criminals, the task is enormous and may be impossible to complete. Table 4 below lists multiple project networks and possible data sources about covert collaborators.

Of course, the common network researcher will not have access to many of these sources. The researcher’s best sources may be public court proceedings which contain much of this data (Baker and Faulkner, 1993), (Department of Justice, 2001).

The best solution for network disruption may be to discover possible suspects and then, via snowball sampling, map their ego networks – see whom else they lead to, and where they overlap. To find these suspects it appears that the best method is for diverse intelligence agencies to aggregate their information – their individual pieces to the puzzle – into a larger emergent map. By sharing information and knowledge, a complete picture of possible danger can be drawn. In my data search, I came across many news accounts where one agency, or country, had data that another would have found very useful. To win this fight against terrorism it appears that the good guys have to build a better information and knowledge sharing network than the bad guys (Ronfeldt and Arquilla, 2001).

Copyright © 2011-2023, McAfee Institute, LLC and Respective Authors contained herein.