Digital Participation Roles of the Global Jihad: Social Media’s Role in Bringing Together Vulnerable Individuals and VEO Content

Abstract

The advent of the internet broadly changed the way society communicates. This is well-known and well-researched across standard populations. Niche or subpopulations, such as terrorist groups or other violent extremist organizations, are less well-understood and researched. However, as strategic outreach such as recruiting and advertising is more and more web-based, research’s limited understanding of such groups is a detriment to effective management strategies. This work is a foundational attempt to ground violent extremist organization’s internet usage into the theoretical lens of and discussion around digital participation and online communities. We analyze the spectrum of participation in violent extremist organizations’ online communities and elucidate existing behaviors of individuals involved with terrorism in a series of mini case studies. This work’s contribution is the expansion of the theoretical framework of digital participation in online violent extremist communities.

1 Introduction: The Internet’s Facilitation of Violent Extremism

Violent Extremist Organizations (VEOs) have posed security challenges for decades. However, in the modern era, with the advent of more lethal weapons, global mobility, and improved communication methods (e.g., open social media), the span and impact of these groups grows from regional to worldwide via their online brand [1]. Thus, these cyber technologies have increased VEO lethality and messaging reach [2] and are becoming an ever-increasing part of the portfolios of VEOs [3]. Historically, access to resources allows wealthier nation-states and other large organizations to build and maintain infrastructures in comparison to their smaller, less prosperous counterparts. With the advent of participatory internet technologies and the promulgation of open and free internet architectures, however, less technical infrastructure is required for smaller or resource-poor organizations to communicate and conduct operations. While digitalization initially acted as a supply driver of this phenomenon, the advent of ‘digital natives’ (generally speaking, those born after 1980) reversed the equation and the move to ubiquitous online presence and content has become a demand-led necessity for groups communicating online [4]. This new paradigm of highly connected, low-cost communication technologies has simultaneously offered such organizations access to resources that further benevolent or malicious goals [2]. Terrorist groups use these technologies in a variety of ways, such as group decision-making, cyber facilitated financing, recruitment, enabled (remote-control) attacks, and propaganda dissemination [5].

VEO content sharing is neatly formatted for digital natives in a way that makes vulnerable youth feel like stars of their own action movies [6]. Yet despite its prominent place in public discourse, a basic understanding of how digital media content influences individuals to participate in propagating VEO content is lacking. Emerging qualitative approaches identify which digital media content influences individuals to adopt extremist beliefs and behaviors [2, 7]. This chapter proposes investigating the pathway to extremist beliefs and behaviors from the perspective of the digital participation lifecycle [8], considering the transition from viewing to actively participation in content dissemination. To illustrate the variety of roles users can play in digital communities, we highlight how a variety of individuals associated with Salafist-inspired Jihad have manifested roles spanning Lurkers to Creators.

2 Participation in Digital Communities

Broadly speaking, participation on the Internet and social media has a looped dependency. Individuals rely on connected technologies to receive content, where connected technologies rely on individuals to create the content that is propagated [9, 10]. Conceptually, content is created, then consumed. One issue in the current discourse scenario in social media as well as VEO research is that social media content is simultaneously treated as both an input and an output variable for measuring user behavior. A more mature theoretical lens investigates VEO social media from the perspective of how users engage or participate with the content. This allows practitioners and researchers to classify user behavior given their engagement with social media content. While the figure below (Fig. 1) may connote movement between the levels based on increasing commitment, individual differences (e.g., backgrounds in graphic design, degree of leadership) could drive individuals to move more quickly through the levels. The key consideration is that there are far more lurkers than there are creators in online digital communities [8]:

Fig. 1.

Digital participation roles

In the following discussion, we connect the literature on digital participation roles with the social media activities of violent extremists. In this discussion, we highlight notable individuals who manifest attributes described by Li and Bernoff [8].¹ This schema has alternatively been described as a ladder or a pyramid. There are progressively less active individuals the higher the level of participation is required; it should be noted that an individual can be differentially engaged in different communities and may find themselves in one of many roles simultaneously in different communities. By linking content, behaviors, and users, it is possible to estimate escalating behaviors by mapping types of activities by individuals. Network science is a useful approach for mapping the escalation of individual behaviors.

3 Connecting the Digital Participation Lifecycle and VEO Social Media Content

Social media and content sharing technologies are ideal for groups with unknown followings, as it enables producers of content to have a one-to-many reach with potential followers [8]. VEOs (ISIL in particular) have capitalized on this by disseminating varying content types which are potentially relevant to an unknown, international, vulnerable audience. Derrick and colleagues classified 37 different content types produced and disseminated by ISIL in their advertising and recruitment campaigns (Table 1). The variety and frequency of the content types speaks to the sophistication of VEO content producers in disseminating enticing content for an unknown audience.

Table 1. Manually coded results of VEO content scraped from open architectures and English-based social media [1]. Words displayed on created social media content are listed in order of frequency.

User-specific tailoring has become more important with the rise of social media outreach, as ‘brands’ that do not excite their audiences risk losing network traction. Followers who take an interest in social media content more thoroughly consume the presented information [11]. Content engagement is critical for growing support and recruitment through the internet.

3.1 Lurkers

The diversity of content types also indicates the variety of ways that groups can move passive content consumers (lurkers or spectators) into joiners. Lurkers are generally the largest of any online community. They are classified as content consumers who are otherwise inactive in radical behaviors. While an argument has been made that participation is dichotomous (thus any viewing of content should be considered active participation [10]), this is an oversimplification of the problem. Both in theory and practically, there is difference between an impact of seeing materials and using or propagating materials. Lurking and all forms of general exposure are tantamount to the material’s reach and impressions count, and not clicks other return on investment metrics [11].

Due to their lack of engagement with the content (e.g., sharing, downloading, commenting), it is not possible to estimate the extent to which lurkers are consuming content for interest, values alignment, research or other motivations. Due to the nature of VEO content, it is also possible that lurkers are not stakeholders but may actually be intelligence agencies or competing groups. This fact drives the need for VEO content on the open social web to be attractive enough to further entice users’ joining but not so specific to ongoing operations such that they may be disrupted. For this reason, much of the online planning and coaching that happens is done with encrypted services and not on the open social web [12]. In our technical report in 2017 to the Studies of Terrorism and Responses to Terrorism (START, University of Maryland), we identified that the majority of VEOs required some type of log-in to view content, which indicates that most members of Jihad digital communities quickly move to the Joiner stage [12].

3.2 Joiners

Joiners may either transition from lurking, or join the digital community directly. This is generally understood to be driven by user motivation and network structure. Motivation can be linked to interests or values. Specifically, the focus on religious content and community reflects values activation (see Table 1), whereas interests may be any combination of the content available or even driven by desire to digitally belong to a specific group affiliation [13]. Group affiliation is in this case an umbrella function which addresses both interests of the user and the network structure they belong in.

Network structures are highly pertinent to Joiners’ transformation into active users. While the likelihood an individual will share increases monotonically with exposure, explicit feedback about how many friends have previously shared the same content increases the likelihood of an active response. Friends and ‘influencers’ (very active nodes in the social graph) activate other users, and have the highest impact on network ties and their behavior. The positioning of content on a user’s interface strongly affects social contagion [11]. Estimating the propensity of one node in a graph to transition into an active node is feasible using Granovetter’s theory of the strength of weak ties [14]. His theory has been used to track peer-based diffusion by identifying constrictions and contractions across nodes and edges [14]. These data reasonably can be, but have not been, extrapolated for online radicalization. Network models trace the spread individual influence. As such, network structures are useful to consider for discerning activation (as compared to lurking) along the participation spectrum.

One exemplar of a Joiner is Saddam Mohamed Raishani (aka Adam Raishani), who was arrested after attempting to flee the United States (Bucher 2017). Most of evidence related to this case involves audio recordings of Raishani discussing his allegiance to ISIS, his desire to travel overseas, and information about how he had helped another flee abroad as a foreign fighter. According to the criminal complaint related to Raishani’s case², he had downloaded and used a web browser that allows the user to conceal online activities. During one of the recorded conversations with FBI agents, Raishani stated that he used the browser to view Jihadi videos. In a March meeting with undercover agents, Raishani was provided with a laptop where he covered the camera and microphone, wore gloves, and deleted all Jihadi content after viewing it. Beyond utilizing the web browser and downloading videos, Raishani’s online footprint was minimal, indicating he fit the profile of a Joiner in his digital community.

3.3 Collectors

As opposed to seeing digital media content or joining a digital Jihad community, collecting, storing, owning and/or disseminating extremist materials is a direct violation of criminal statutes. This represents (knowingly or not) an escalation in radical behavior. Collectors transition from joiners: they are already activated by VEO content and now are actively working to further organize and disseminate it. Collectors are not creators. They do not generate new or original materials. Collectors are those who clone and fork digital repositories. They also collate collections of interest for the broader community to access. This is a particularly critical group for maintaining the pipeline of non-indexed websites (i.e., justpaste.it) [12], as well as for maintaining clear and open pathways to said content. Figure 1 contains a sample screenshot of how Collectors accomplish this pathway maintenance. Collectors are second only to creators in terms of maintaining the visibility of VEO content on the social web (Fig. 2).

Fig. 2.

An example of disseminating VEO content on the platform YouTube. Image taken from: “Upload Knights”: How Terrorists Slip Beheading Videos Past YouTube’s Censors. https://motherboard.vice.com/en_us/article/xyepmw/how-terrorists-slip-beheading-videos-past-youtubes-censors

The value of individual collectors (nodes) in the social network is contingent upon their betweeness and closeness with other high value individuals (nodes) in the social graph. Betweenness is the likelihood of a person to serve as the most direct route between two others. Closeness of nodes is a measurement of the speed by which information is disseminated in a network. Collectors with high betweenness and/or closeness scores are especially well-poised to broadly disseminate content. This propensity increases when they are connected to Creators with a high eigenvector score. Eigenvector scores measure how well connected an individual is to other well-connected individuals in a network. Those with high eigenvector scores will be well connected with suspects of terrorism investigations (Brooks 2011).

Collectors are critical for the forming of ‘small world’ networks. These are networks that appear almost random but exhibit significantly high clustering coefficients (i.e., nodes that tend to cluster locally) and a relatively short average path length (i.e., nodes that can be reached in a few steps). Such a network will have many sub-clusters but be joined by many bridges between clusters which shorten the average distances between individuals and other sub-networks. For these reasons, Collectors are strategically relevant targets for shutting down the pipeline of VEO content on the social web.

Khalid Ali-M Aldawsar exemplifies a Collector role (Bernstein 2011). During the time of his radicalization, Saudi immigrant Aldawsar was 20 years old and failing out of his chemical engineering program at Texas Tech. When he was arrested, he was a business student at South Plains College in Lubbock, TX. His Facebook posts progressed from being positive about his life, the United States, and liking girls to critically discussing U.S. and Israel foreign policy. One personal blog post explained how he excelled academically in high school, earned a scholarship that allowed him to be sent to America where he intended to learn English, learn to build explosives, and target U.S. citizens. Collecting behaviors ranged from accumulating guides and materials for making bombs and to acquiring information about selecting targets. Using three email addresses, he sent himself summaries and stored them in a common location before writing about them in his personal journal.

3.4 Critics

‘Critics’ as a stage in the participation lifecycle is a slight misnomer. While Critics may criticize, they are known for content evaluation or reviewing. Critics are also the ‘experts’ in mature social systems that set the standards of engagement and behaviors [15]. They are tantamount to moderators of subreddits or verified purchasers on e-Commerce sites. Critics take on the roles of discourse management in forums and posts. Discourse management or norm setting is a factor in establishing likeness (or homophily) within the group and for new entrants (lurkers and joiners). A strong established identity can lead to the formation of homogeneous groups (clusters) where facilitating direct relationships is easier. It must be remembered that Critics respond to content, rather than create content themselves. Critics shape and refine the messages and consequently influence its meaning.

They are the commenters on YouTube and the active retweeters of VEO ‘influencers’ on twitter. At this stage of activation Critics validate the organizations by interacting with VEO as it were any social media content. Critics comment, discuss, and evaluate VEO content in the same vein as the twitterati or redditors comment, discuss, and evaluate on their respective platforms. Content engagement at this level serves to make the social network denser. Density is a measure of the connections between nodes in a social network and serves as an indicator of popularity or influence. Density is a critical metric as information in dense networks can flow more quickly. In the case of non-indexed websites or content that is in violation of the Terms and Conditions of a platform, a swift flow of information can more quickly support Collectors in their dissemination of VEO content.

An example of a Critic is Nicholas Michael Teausant, who actively engaged across several social media platforms³. Teausant had accounts on several social media platforms, including Ask.fm, Google+, Facebook, Tumbler, and Instagram. During the time of his arrest, he was 20 years old and was a community college student in Stockton, CA. A National Guard dropout, Teausant communicated with an undercover FBI agent, stating he planned to bomb the Los Angeles subway system. His social media accounts were plagued with anti-Western messages, calling for violent action. He was arrested for attempting to flee to Canada in the hopes of making it abroad as a foreign fighter. Below are some of his Instagram comments:

May 31, 2013: user Assad Teausant bigolsmurfposted: @don-quad lol “don’t get me wrong I despise america and want its down fall but yeah haha. Lol I been part of the army for two years now and I would love to join Allah’s army but I don’t even know how to start.”

August 5, 2013: user Assad Teausant bigolsmurf posted: Anyone know where I can get the “lone Mujahid pocket book” #alqaeda #jihadis t#jihad #islamicpridetimuslim#mashallah#islam#allah#AllahuAkbar#thelonemujahid

3.5 Creators

There are far fewer content creators than consumers [8]. Social media’s one-to-many content provision is built upon this model. Creators are the least common individuals in the digital participation lifecycle but are lynchpins to thriving content-based networks. Content creation entry points can include blogging, online fundraising, ideological campaigns, active recruitment, video or other media creation, or active participation in organizational decision-making. There is not a linear progression through the digital participation ladder or a known entry point for content creators, other than identity validation by the organization. Once validated, Creators directly engage in content creation. The more mature social network or digital communities are, the more they allow for this immediate progression. In other words, their skills may allow them to start at the top of the digital community pyramid.

Jose Pimentel exemplifies a Creator role (Goldstein and Rashbaum 2011). Pimentel maintained his own website (www.trueislam1.com) with bomb-making instructions from Inspire Magazine, and he also posted his own recipes. His personal website communicated anti-Western propaganda, ultimately calling for violent action against the United States. “Pimentel talked about killing U.S. military personnel returning home from Iraq and Afghanistan, particularly Marines and Army personnel,” Mr. Kelly said. “He talked about bombing post offices in and around Washington Heights and police cars in New York City, as well as a police station in Bayonne, N.J. Once his bombing campaign began, Mr. Pimentel said the public would know that there were mujahideen in the city to fight Jihad here” (Goldstein and Rashbaum 2011).

4 Summary and Future Directions

Standard analytical models are built on the assumption that engagement with social media content is binary – content is created, and content is received [10]. Empirical and theoretical models increasingly show that participation in digital communities is actually a spectrum [8, 9]. This more nuanced view allows practitioners and researchers to better diagnose where individuals are in their engagement within communities by measuring their types of engagement, rather than the output of content created. It also corrects the current analytical issue in social media analysis, which is the use of social media content as an input and output factor of analysis. Analyzing the person in terms of which stage of participation they are currently in is more pertinent in terms of stopping the progression of extremist beliefs and behaviors. Whereas traditional analyses would suggest Creators should be the focus of disruption activities, this analysis suggests that there is an entire pathway of participation with VEO content. At each stage of participation there are entry (and exit) points which can effectively stop the flow of content and information dissemination. Escalating behaviors along with their qualifying activities help practitioners and researchers more accurately classify the differences between Lurkers and those who more actively create malevolent content.

Future work for scholars should address at least three critical issues. First, how robust are these roles in the context of violent extremism? As this taxonomy was originally developed to explain non-violent digital participation, it is critical that we further examine a sample of individuals participating in digital communities that are violent or prescribe violence to understand how these roles operate. Related, the second line of research should examine their online behaviors as they relate to these offline behaviors. While some assume that online recruitment is rampant in violent extremist groups, most extremism research indicates that offline relationships and roles are more important than online communications. However, this relationship has been investigated to date with small n sizes and scant data on online participation. Third, future scholarship in this area should examine how this participation is related to different types of outcomes. For example, given that creators and critics may have more of their personal identities invested in the generation of material in support of violent groups, it is may be that they also act in identity-congruent ways offline (e.g., higher levels of group participation and mobilization). However, it may also be that these individuals lack the skillset for greater levels of online participation, and thus lurkers and joiners have greater participation offline to compensate for these deficits. Without a large sample, it is impossible to understand how digital participation roles escalate coherently online and offline, or if they co-vary at all.

4.1 Limitations

While novel in its application of how online behavior relates to offline radicalization and engagement in violence, the present effort is not without limitations. First, the case examples from which we drew our exemplar behaviors were all individuals from the United States who endorsed a Jihadist ideology. Evidence suggests that online propaganda from the Far Right is much more prevalent online as of 2016, and thus, may yield different cases. Given that the focus of this effort was on the unique phenomenon of how Foreign Terrorist Organizations influence acts of terrorism in the United States, however, it should be noted that these findings only apply to that particularly unique domain. Extremist online behavior from the Far Right or Far Left may contribute different aspects to our understanding of online behaviors. Second, other digital narratives could be used to explain the online influence of this demographic as well. For example, the work on online communities in health care, branding, and knowledge-sharing could also be relevant to understanding how Jihadi-inspired individuals relate to virtual content. Specifically, word of mouth approaches to understanding network narratives in marketing can have significant value for understanding how the individuals described in the present effort related to each other and the narrative espoused by Foreign Terrorist Organizations. Despite these limitations, however, the present effort is at least a first attempt to apply an accepted framework for digital roles to actual offenders of Jihadist-inspired crimes in the United States, which holds promise for unpacking at least some drivers of violent ideological cyber influences.