Terrorist and extremist groups like ISIS, al-Qaeda, Hamas, Hezbollah, and others use the encrypted application Telegram for purposes that may include recruiting new members, fundraising, inciting violence, and even coordinating terrorist activity. Telegram’s messaging application has both public-facing and private components. This flexible interface enables extremists to do everything from self-promotion, brand development, and propaganda dissemination, to in limited cases, secret plotting of attacks outside detection or interference from law enforcement.

Telegram’s public-facing “channels” and private messaging “chats” make it a dual-use weapon for extremist groups like ISIS, al-Qaeda, and Hamas. Telegram is easy to use and can be accessed via a desktop or mobile device. The platform can be used to directly share propaganda, or as a directory to share links to propaganda websites and archives. As extremists have been pushed off of mainstream social media websites, they have often come to less moderated online spaces such as Telegram.

Along with extremist Islamist groups, other violent extremists have shifted their communications onto the social platform. In early 2019, Telegram saw a surge of activity from right-wing extremists who used the platform to call for violence against government officials, advocate for white supremacist terrorism, and distribute written materials such as instructional manuals on how to make and conceal weapons. (Sources: Vice, NBC News, CNBC)  

Download Full Report

Brief History of Telegram and Terrorism

For years, ISIS has used a variety of online platforms—including Twitter and WhatsApp among others—to communicate with recruits and operatives, issue claims of responsibility for attacks, and disseminate news updates and propaganda materials. In January 2015, the group even circulated a list of recommended private messaging applications, ranking them from least to most “secure.” At the time, ISIS considered Telegram to be a ‘safe’ or secure communications application and accordingly recommended its use. (Source: Wall Street Journal)

ISIS has previously encouraged its followers on Twitter and other social media sites to connect with ISIS coordinators and recruiters on Telegram to discuss sensitive matters such as travel to ISIS-held territory. This behavior has declined since 2019. ISIS also created public channels on Telegram to broadcast pro-ISIS news updates and disseminate other propaganda materials.

The ISIS presence online has caused considerable concern among authorities. However, at a TechCrunch conference in September 2015, Telegram founder Pavel Durov dismissed these concerns, asserting that “[t]he right for privacy is more important [to Telegram] than our fear of bad things happening, like terrorism.” Two months later, ISIS carried out the deadliest terrorist attack on French soil since World War II, killing 130 people and wounding 350 more. According to French investigators, the group had relied in part on Telegram and WhatsApp to coordinate and plan the attacks. (Sources: YouTube, International Business Times)

Since the Paris attacks, Telegram has revised its formal position, pledging to remove ISIS accounts, bots, and chats, from public channels. Since 2018, Telegram and Europol have coordinated a large-scale effort to remove ISIS content from the platform. The result of the moderation initiative has delivered effective and sustainable results. While ISIS propaganda remains on Telegram as of February 2024, its presence is often minimal, less stable, and ISIS supporters often have a hard time keeping accounts and posting content. (Source: Europol)

Telegram’s action against ISIS and al-Qaeda only came after several years of allowing these groups to operate on the platform with relative impunity. Telegram was one of the main platforms previously used by ISIS to claim credit through their Amaq Agency for terrorist attacks and to disseminate propaganda materials. On March 23, 2017, for example, ISIS used the platform to claim responsibility for the lone-actor terrorist attack the day before in London, which left four people dead and more than a dozen wounded. On May 23, 2017, ISIS again claimed responsibility for the Manchester Arena attack, releasing responsibility claims and other propaganda materials on Telegram.

Other extremist and terrorist groups continue to operate freely on Telegram without comment from the platform. Telegram continues to host channels operating on behalf of internationally sanctioned terrorist organizations, including Hamas, Hezbollah, and the Taliban. Al-Qaeda previously operated on the platform, but the group’s public and semi-public channels are routinely removed. In one instance, between September and December of 2022, Telegram worked in conjunction with the Riyadh-based Global Center for Combating Extremist Ideology to review and remove online content posted in Arabic. The three-month period saw the removal of 625,337 al-Qaeda related items through 259 channels. (Source: Arab News)

Telegram has remained noticeably silent on the presence of these and other terrorist groups on its platform. In some instances, the aforementioned channels have remained operational for well over a year without takedown. Despite international calls for increased monitoring and removal of content endorsing hate speech and violent activity across social platforms, Telegram has reportedly chosen to restrict rather than ban or delete channels connected to violent extremists. According to a November 2023 WIRED analysis of more than 100 restricted channels, most of the channels remained active despite being hidden. Additionally, content from the restricted channels was instead forwarded onto more publicly accessible channels. (Source: WIRED)

How Terrorists Use Telegram: Channels, Chats, Direct Messages

The Telegram platform consists of public channels, private chats, and direct messaging. Terrorists have co-opted all three forms of communication to distribute propaganda, incite to violence, coordinate travel to foreign conflicts, and claim responsibility for terrorist attacks.

Channels

Telegram channels allow ISIS, al-Qaeda, Hamas, the Taliban, and other extremist and terrorist groups to broadcast messages to groups of followers at once. CEP has collected examples demonstrating how terrorist-affiliated channels on Telegram publish propaganda materials to subscribers, claim responsibility for attacks, issue calls to action, and solicit donations.

Groups like ISIS have also issued calls to violence on Telegram channels in advance of major attacks. On December 6, 2016, one such message read, “Christmas, Hanukah, And New Years [sic] Day is very soon Insha Allah[.] So let’s prepare a gift for the filthy pigs/apes.” Less than two weeks later, Tunisian suspect Anis Amri plowed a truck into a crowd of people at a Christmas market in Berlin, killing 12 people and injuring 48 others. ISIS also claimed responsibility on Telegram for the New Year’s Eve shooting attack at an Istanbul nightclub. The attack left 39 people dead and dozens wounded. (Sources: MEMRI, Telegraph, New York Times, Newsweek)

By 2019, the extreme right, including white supremacists and neo-Nazis, had also established a presence on Telegram. Channels affiliated with extreme-right groups and movements have used the platform to spread propaganda, recruit, fundraise, and call for violence. A collection of channels, termed Terrorgram, routinely made posts calling for acts of violence and glorified various white supremacist attacks, including the 2011 Norway attacks, the 2018 Pittsburgh synagogue shooting, the 2019 Christchurch attack, and many others. Terrorgram eventually published three text guides in 2021 and 2022 that advocated for acts of terrorism, spreading neo-Nazi accelerationist concepts and tactics, and in some cases, instructions for constructing explosive devices and selecting targets to attack. In October 2022, the online collective released a 24-minute video celebrating dozens of individuals who had committed acts of murder and terrorism to promote white supremacist ideology. In January 2021, Telegram removed some extreme right channels promoting violence. However, this effort has been inconsistent and opaque. (Sources: Vice, CNN, Huffington Post, NBC News)

January 2021 saw a significant shift of far-right content—especially Qanon and 2020 election denial material—onto Telegram as the shutdown of Parler, a social network popular with the far-right, left members turning to alternative communication platforms. In the weekend after Parler went offline, hundreds of thousands downloaded Telegram, a pattern that repeated following Twitter and Facebook’s ban on former U.S. President Donald Trump in 2021. (Sources: CNN, New York Times)

ISIS Chats

ISIS previously encouraged supporters using platforms like Twitter, YouTube, and WordPress—as well as Telegram’s public channels—to contact the group privately on secure messaging platforms like WhatsApp, Threema, Viber, or Telegram’s secure chat platform. Although YouTube was previously a top recruitment and propaganda medium for ISIS, ongoing monitoring and removal efforts by the social media platform drastically reduced, and in some cases halted, ISIS’s footprint on the platform by 2018. (Sources: WIRED, Homeland Security Today, Institute for Strategic Dialogue)

After migrating their outreach onto Telegram’s secure chat platform, ISIS operatives were able to engage with followers one-on-one or in small groups to plan attacks or encourage travel to and from ISIS strongholds. As Telegram’s chats can accommodate up to 200,000 members, ISIS-related content has far-reaching potential. In the past, ISIS’s supporters used the chat platform to share pro-ISIS content amongst themselves, chatting and sharing links on new, as well as archived, ISIS videos, magazines, and attacks claims. ISIS supporters on Telegram have also tried to vet journalists, analysts, and others—whom they refer to as “spies”—so they can share pro-ISIS content amongst themselves. The expansive messaging network remains resilient, and despite increased moderation of ISIS and other terror-related content on social media platforms in 2019 and the early 2020s, the terror group remains abreast of alternative communication channels such as Rocket chat, Tam Tam, Nandbox, and Hoop Messenger to continue their outreach. (Sources: Telegram, Institute for Strategic Dialogue, Institute for Strategic Dialogue)

Telegram continues to facilitate terrorist communication despite the platform taking actions to ban these groups and their respective channels. In the past, ISIS would typically coordinate its PR campaigns on Twitter and other social media platforms, sharing the relevant materials—posters, statements, hashtags, and links to ISIS videos hosted on other sites like JustPaste.it, SendVid, and Internet Archive—amongst themselves before pushing the materials out en masse. This process  now takes place on Telegram and similar platforms, where ISIS operatives often first coordinate ISIS PR campaigns in secret, before sharing links on other social media platforms. Additionally, following the start of the Hamas-Israel War in October 2023, Telegram banned a few, but not all channels dedicated to or affiliated with Hamas’s military wing. Those channels that evaded removal collectively boasted 1 million subscribers. (Sources: Washington Post, MEMRI, NPR)

According to an April 2023 study published by the Global Network on Extremism & Technology, ISIS has reportedly incorporated the use of Telegram bots to automate the sharing of content and manage online chats. On average, the bots reportedly post 176 messages a day across ISIS channels. The bots serve three functions: promoting ISIS propaganda, moderating discussions within Telegram channels and groups, and administering groups such as overseeing the admission of new members or blocking violators of the channel. (Sources: Global Network on Extremism & Technology, New York Times)

Secret Chats

Telegram also has a “secret chat” function, where the sender and recipient use end-to-end encryption. Chats in this function are not stored on the Telegram cloud but instead stored on local devices. Telegram cannot read messages sent as secret chats. (Source: Telegram)

From Telegram to Terrorism

Terrorists have used Telegram in the lead-up to a number of successful and thwarted terrorist attacks worldwide:

Conclusion: End Terrorists' Access to Telegram

As of February 2024, Telegram has been reluctant to respond seriously to the threat of terrorist activity on its platform. Despite action taken to make Telegram more inhospitable to ISIS and al-Qaeda, further steps need to be made to curtail ISIS’s access to Telegram’s private chats given evidence that the platform has been used to plan and coordinate attacks. ISIS propaganda also continues to appear regularly on Telegram to issue attack claims, videos, and threats of violence. As ISIS’s propaganda output has decreased since late 2019, Telegram has been used to share links to ISIS online propaganda depositories. Notably, CEO Pavel Durov has refused to publicly address concerns about other terrorist groups operating on his platform, including the Taliban. Despite pressure to remove Hamas channels after the start of the Israel-Hamas war in October 2023, Durov has removed only a select number of the channels, with content still being disseminated across affiliate groups on the platform. (Source: WIRED)

It is clear that more can and should be done. Terrorists continue to use Telegram to plan attacks and recruit followers in North America, Europe, the Middle East, and Southeast Asia. And despite efforts by Durov to present Telegram as a refuge for privacy and encryption, the company has previously been a safe haven for groups like ISIS and the violent extreme right, and continues to be used for propaganda purposes by ISIS, Hamas, al-Qaeda, and the Taliban. Until we take serious efforts to reduce terrorists’ access to Telegram and other platforms, these groups will continue to inflict violence on civilians around the world, destabilizing the countries where attacks occur, and reducing global security and safety.