(New York, N.Y.) – The Counter Extremism Project (CEP) reports weekly on the methods used by extremists to exploit the Internet and social media platforms to recruit followers and incite violence. This week, al-Qaeda in the Arabian Peninsula (AQAP) claimed responsibility for the December 6 shooting at the Pensacola Naval Base. Additionally, a Neo-Nazi web security group affiliated with the Atomwaffen Division (AWD) was located, where they claim to provide hosting services, tech support, and research infrastructure to multiple extremist groups. Neo-Nazi and ISIS content calling for acts of violence were located on Instagram. Following the February 4 stabbing in the Maldives claimed by individuals supporting the Islamic State, legacy Maldivian pro-ISIS content was located on various media platforms. Finally, Neo-Nazi accelerationist channels uploaded homemade firearms instructions to Telegram.
AQAP Claims Responsibility For Shooting At U.S. Naval Facility
On February 2, al-Qaeda in the Arabian Peninsula (AQAP) claimed responsibility for the December 6 shooting at Naval Air Station Pensacola by a member of the Royal Saudi Air Force. Second Lieutenant Mohammed Saeed Al-Shamrani killed three people and injured eight others before he was killed by responding law enforcement officers. All three base casualties were U.S. Navy sailors. On February 2, AQAP released a pre-recorded video by their leader, Qasim al-Raymi, stating that Al-Shamrani was in communication with the group, and that AQAP claimed responsibility. Raymi also called on Muslims in the U.S. and the U.K. to commit attacks against commerce, politicians, and members of the armed forces. The White House announced on February 6 that Raymi was killed in a U.S. airstrike.
Text of the video was uploaded to the Internet Archive and was still available three days later. In addition to a website operated by AQAP, the video was uploaded to at least ten other websites: Megafiles.in, 1fichier.com, Epicdrive.site, files.fm, mystream.to, Amazon Cloud Drive, Dropbox, the Microsoft One Drive, Userscloud, and Zippyshare. Approximately four days later, the video was still available on the AQAP website as well as megafiles.in, and Epicdrive.site. The AQAP website uses Cloudflare as their name server.
Neo-Nazi Web Security Group Located
CEP researchers located a neo-Nazi web services group that claims to provide hosting services, tech support, and “research infrastructure.” The group claims to be providing hosting services to at least three websites affiliated with the Atomwaffen Division (AWD), and James Mason’s neo-Nazi accelerationist book, Siege. The group maintains an “.onion” website and a Secmail email account. One of the websites the group claims to provide hosting for uses the web service Anonymize (owned by Epik), which offers a range of services including domain WHOIS protection. Another website the web services group assists is dedicated to neo-Nazi “armed struggle” in the U.S. A different white supremacist web security group launched their own “.onion” page in December.
“The growth of white supremacist cyber security and infrastructure groups shows the importance of the online ecosystem. Organizations recruit, spread propaganda, seek to spread terror, and seek to fundraise online, it makes sense that they would work to create methods for safeguarding the continuation of those activities.” said CEP researcher Joshua Fisher-Birch. “As more internet infrastructure companies consistently enforce their terms of service against online extremism and calls for violence, alternatives to mainstream providers and social networks will become increasingly more important for uploading their content and keeping it online.”
Neo-Nazi and ISIS Content Located on Instagram
Several neo-Nazi Atomwaffen Division (AWD) and ISIS videos were located on Facebook owned Instagram. One of the AWD videos was uploaded in September by an account that has also posted several additional pieces of neo-Nazi propaganda and prominently features a neo-Nazi flag in the user’s profile photo. Over a dozen accounts posting ISIS propaganda were also located, included clips taken from ISIS videos, propaganda photos including corpses, Amaq news clips and written reports, and calls to commit acts of violence. ISIS video segments were not disguised, and included the terrorist group’s logo, and in some cases the introductory video segments.
An Atomwaffen Division video on Instagram, February 6, 2020.
Legacy Maldivian Pro-ISIS Content Located After February 4 Stabbing Attack
Legacy Maldivian pro-ISIS content was located following the February 4 stabbing claimed by a pro-ISIS group. Three tourists, an Australian and two Chinese nationals, were injured. A pro-ISIS video uploaded over four years ago was located on Vimeo and the Internet Archive in Dhivehi and English, praising a Maldivian man who had joined ISIS. Pro-ISIS Dhivehi nasheeds were located on Soundcloud, originally uploaded between two and three years ago. Two pro-ISIS Maldivian blogs, one last updated in 2016, and another last updated in 2017, were also located, both of them on the WordPress blog platform. Over 170 individuals left the Maldives to join ISIS and other extremist groups in the Middle East, one of the highest per capita recruitment rates.
Neo-Nazi Accelerationist Telegram Channels Post Homemade Firearms Instructions
On February 4 and 5, at least six neo-Nazi accelerationist Telegram channels posted plans, videos, and links to websites that offer instructions for building homemade firearms. Plans include 3-D printed firearms, as well as craft produced firearms. At least one of the plans posted to Telegram was identical to one of the homemade firearms used by Stephan Balliet, who is charged with two counts of murder after an attempted terrorist attack on a synagogue in Halle, Germany on October 9. Balliet stated that he used homemade weapons in order to show that attacks with “improvised guns” were possible. The Telegram post was seen more than 2,500 times.