(New York, N.Y.) — The Counter Extremism Project (CEP) reports weekly on the methods used by extremists to exploit the Internet and social media platforms to recruit followers and incite violence. Last week the pro-ISIS tech group Qimam Electronic Foundation recommended using e-mail services from various companies, including those from major tech firms such as Microsoft Outlook, Gmail, and Yahoo, based on several criteria, including encryption, general security, and storage capabilities.
On Facebook, CEP located multiple examples of pro-ISIS propaganda on nine accounts and one page. A pro-ISIS group posted instructions for manufacturing the toxin ricin on JustPaste.It. Two ISIS Amaq News videos were also found on several websites. Finally, a new neo-Nazi news site was launched which is affiliated with a similar website that supports the group National Socialist Order and the American neo-Nazi ideologue James Mason.
Pro-ISIS Tech Group Releases List of Recommendations for E-Mail Services
On August 18, a pro-ISIS tech group, Qimam Electronic Foundation, posted a list of 12 recommended e-mail services based on factors including encryption, general security, and storage capabilities. The order of the listed services is unclear, but the first five services were ProtonMail, Zoho Mail, Outlook, Gmail, and Yahoo. Qimam Electronic Foundation posted the list on the bulletin board website PasteThis.To, and shared the URL in a pro-ISIS tech chat. Qimam Electronic Foundation has previously shared information on encrypted communications and online security.
Instructions for Making Ricin Posted by Pro-ISIS Group Removed From JustPaste.It
On August 17, CEP researchers located instructions for making the toxin ricin on JustPaste.It allegedly posted by the pro-ISIS group Al-Saqri Foundation. The page included instructions for the homemade synthesis of ricin from the seeds of castor beans and offered advice on its use. The Al-Saqri Foundation publishes manuals on the manufacture and use of explosives, poisons, and other weaponry. Previous Al-Saqri pages located by CEP in 2022 have included bomb-making guides, instructions for making explosives with obtainable chemicals, and the development, purification, and use of botulism toxin as a weapon. JustPaste.It removed the page approximately 15 minutes after CEP reported it.
Pro-ISIS Content Located on Facebook
In a sample of pro-ISIS content found on August 17, CEP researchers located nine accounts and one page that posted multiple pieces of the group’s propaganda. Content published by the accounts included a full-length ISIS video originally released in 2016, as well as clips from other previously released ISIS videos, Amaq propaganda videos, Amaq photos and news statements, pages from the al-Naba newsletter, and promotion of the pro-ISIS-K magazine Voice of Khurasan, and links to ISIS propaganda on other websites.
One of the accounts posted an approximately 17-minute-long ISIS propaganda video titled “They Bewitched The Eyes of the People and Struck Terror into Them,” originally released in January 2016. The uploader covered ISIS logos on the top right of the screen with an emoji to prevent it from being detected and removed. The video was uploaded to Facebook four days before CEP located it and had 226 views and 22 reactions.
The ISIS video “They Bewitched The Eyes of the People and Struck Terror into Them,” originally released in January 2016. ISIS logos on the top right of the screen were covered with an emoji in order to evade removal.
Two Facebook accounts used images of the notorious ISIS executioner Mohammed Emwazi as profile photos. One of the accounts, which posted multiple pieces of pro-ISIS content, also posted a video of previously released surveillance footage that showed a Jewish man being stabbed by a colleague in Montreal. The Facebook page for the ISIS al-Naba newsletter had 11 followers and posted photos, text from al-Naba, and other pro-ISIS content. Three of the nine accounts did not have the number of friends or followers listed. The remaining six accounts had between 120 and 1,300 friends or followers, with an average of 529.
CEP reported the nine accounts and one page to Facebook on August 17. Approximately five days later, only three accounts had been removed. The video from 2016 was still on Facebook five days later and had received an additional 80 views.
ISIS Amaq Videos Uploaded to Multiple Websites
During the week of August 14 to August 20, CEP researchers found two ISIS Amaq News videos on several websites. The first video, released on August 15, contained footage of a prison break in Butembo, Congo, where on August 10, approximately 80 ISIS-affiliated fighters attacked the central prison, leading to the escape of roughly 800 prisoners. In addition to Telegram, Hoop, and pro-ISIS propaganda sites, the video was uploaded to at least 16 websites. Two days later, the video was available on three websites: the Internet Archive, Novatics.com, and Zeit-Stiftung.De
The second video, also released on August 15, showed ISIS fighters attacking an alleged Nigerian military convoy with automatic weapons in Karito, Borno province, Nigeria. In addition to Telegram, Hoop, and pro-ISIS propaganda sites, propagandists uploaded the video to at least 16 websites. Two days later, the video was available on seven sites: the Internet Archive, the IPFS distributed web protocol, Novatics.com, Zeit-Stiftung.De, pomf2.lain.la, Antopie.Org, and Thedownload.Store.
The videos on the Internet Archive were only available to logged in users.
Neo-Nazi Website Launches Affiliated News Site
A neo-Nazi website that supports the group National Socialist Order (NSO) and the American neo-Nazi ideologue James Mason launched an affiliated news site on August 16. One of the first articles published on the news site, written by an NSO leader, is the naming of an alleged undercover FBI agent who infiltrated the Atomwaffen Divison (AWD) and is blamed for arresting AWD leader John Cameron Denton. The site includes a photograph of the alleged FBI agent, court documents, and limited biographical data, allegedly to warn other white supremacists on the lookout for infiltrators.
The website uses Cloudflare as its nameserver and registrar. The site also has an affiliated Onion site accessible via Tor, a Telegram channel, and page on the social media site Gab. The site requests donations in the cryptocurrencies BitCoin and Monero.