Inside the app that's become ISIS' biggest propaganda machine
When one ISIS-affiliated channel was shut down by the Telegram app on Wednesday, another would pop up.
The channels that hadn't yet been suspended started linking to other ISIS-affiliated channels that were still active. This way, followers of blocked channels could easily find new channels to subscribe to.
Western officials and counterterrorism experts are becoming increasingly worried about the encrypted communications the terrorist group ISIS (also known as the Islamic State) uses to evade authorities and disseminate its propaganda, including through apps like Telegram.
"Terrorists are using encrypted communications and … very solid cryptography standards that haven't been broken yet," said David Kennedy, the CEO of TrustedSec, who has worked with the Marine Corps' cyber-warfare unit and the National Security Agency.
"The terrorists are getting very smart on their mode of communications."
CIA Director John Brennan told an audience at the Center for Strategic and International Studies on Monday that terrorists "have gone to school on what they need to do in order to keep their activities concealed from the authorities."
"I do think this is a time for particularly Europe as well as the US for us to take a look and see whether or not there have been some inadvertent or intentional gaps that have been created in the ability of intelligence services to protect the people that they are asked to serve," Brennan said.
US officials are now trying to figure out where those gaps are in light of the terror attacks on Paris, for which ISIS has claimed responsibility.
"It is too early to know for sure, but plainly ISIS took steps to conceal this plot from our detection and successfully so," Rep. Adam Schiff (D-California), the ranking member of the House Intelligence Committee, told Business Insider in a statement. "We may learn that the use of encrypted platforms was one part of their operational security, but I don't believe it alone can explain missing such a large and complex coordinated attack."
It's not clear how exactly the Paris terrorists communicated, but encrypted messaging has created difficulties for intelligence agencies more broadly when dealing with terrorism.
Some experts have cast doubt on the characterization of Telegram's encryption as nearly impenetrable. But nevertheless, it's not easy to crack.
ISIS terrorists are known to use encrypted communications to recruit people, disseminate propaganda, and message its members privately.
In an October report for the Combatting Terrorism Center at West Point, ISIS expert J.M. Berger wrote that "Islamic State recruiters often favor messaging applications with strong encryption."
"Among the most popular are WhatsApp, Kik, Surespot, and Telegram," Berger wrote. "... The shift to such applications has been described by FBI Director James Comey as 'going dark' - the point at which continued monitoring by law enforcement becomes problematic."
ISIS doesn't appear to rely on any one platform to communicate publicly and privately. But experts have noted a troubling shift, in particular, to Telegram.
Russian origins
Telegram was created by Nikolai and Pavel Durov, the brothers who launched Russia's biggest social networking site, VKontakte. The app launched in 2013.
Pavel fled Russia after VKontakte caught the Kremlin's attention and allies of Russian President Vladimir Putin took control of the social network, according to The New York Times. Pavel said he came up with the idea for Telegram when he called his brother during a SWAT standoff at his home in St. Petersburg. The standoff followed 2011 demonstrations over parliamentary elections.
"I realized I don't have a safe means of communications" with my brother, Durov told The Times. "That's how Telegram started."
Pavel claimed in May that Telegram has 62 million monthly active users, according to TechCrunch. He said at a TechCrunch conference in September that Telegram sees about 12 billion messages sent per day. Though these numbers are high, other messaging apps like WhatsApp (which was founded in 2009) have several hundred million monthly active users.
Still, Telegram has reached millions of people without outside investors, ads, and marketing, Pavel told The Times last year. The app is available to download for free, and a phone number is the only requirement that goes along with signing up.
The company, which is based in Berlin, operates as a non-profit to avoid commercial and legal pressure, according to TechCrunch.
Pavel did not respond to a request for comment from Business Insider.
Channels and private chats
Users can also share their contact information easily via usernames and links - if you don't want a person to know your phone number, for example, you can create a username and send the person a link to the app.
Once the person clicks, it launches the app and opens a chat (or channel) with the username on the link.
The usernames and links make it easy for ISIS recruiters to share their Telegram contact information on larger platforms like Twitter without exposing the phone numbers attached to the usernames.
Hassan Hassan, an associate fellow at the Chatham House and an expert on ISIS and Syria, told Business Insider that it's also easier to fake your phone number on Telegram than on other messaging platforms like WhatsApp.
ISIS members "don't want to be tracked so they use fake numbers," Hassan said in an email. "... They use these apps so they can send out their messages and communicate securely and without their identities being known."
"They don't want to be legally tied to a phone number and a pro-jihad Telegram account."
Hassan explained that ISIS members are typically told use a strong virtual private network (or VPN), which can obscure a user's Internet Protocol address and protect his or her data, enable the two-step verification feature on Telegram, and then link it to an encrypted secure mailbox.
ISIS Telegram channels have sent out instructions on how to enable two-step verification:
Telegram's special secret chats use end-to-end encryption, leave no trace on our servers, support self-destructing messages and don't allow forwarding. About the only thing secret chats don't have is cloud storage - they can only be accessed on their devices of origin.
Kennedy explained this encryption method: "The actual communications won't flow through servers, they'll flow directly to individuals, so there's no middle person to intercept the communications."
And Telegram's self-destruct feature allows users to set a time limit on the messages - they'll automatically delete once a certain amount of time has passed after the recipient opens the message. Users can set messages to delete anywhere from one second to one week after it's opened.
"They are using military-grade encryption," Kennedy, the TrustedSec CEO, told Business Insider. "Most of the keys are actually stored on each individual system so that makes it very difficult to get any information in the middle. Think of it as an encrypted tunnel."
Combined with Telegram's prior unwillingness to suspend users who appear to be affiliated with terrorist groups, the app has become a convenient platform for jihadis who want to disseminate their message easily to a large audience and communicate one-on-one without worrying about their messages being easily intercepted by intelligence agencies.
"Privacy is ultimately more important than our fear of bad things happening, like terrorism," Pavel said, according to VentureBeat. "If you look at ISIS, yes, there's a war going on in the Middle East. Ultimately, ISIS will find a way to communicate with its cells, and if any means doesn't feel secure to them, they'll [find something else]. We shouldn't feel guilty about it. We're still doing the right thing, protecting our users' privacy."
Pavel's comments illustrate the central struggle of stopping terrorism in the internet age - it's difficult to give governments enough access to intercept terrorist communications without potentially sacrificing everyone else's privacy.
"Unfortunately today you can't have it both ways: a government that can eavesdrop on communications … and privacy for personal cryptography," Kennedy said. "... [These terrorists understand communications, they understand technology. … This is the next generation of terrorism."
Since Pavel's comments at the TechCrunch conference, however, Telegram seems to have changed its stance. On Wednesday, the company suspended dozens of ISIS-affiliated channels and announced in a statement that it would block terrorist channels.
ISIS propaganda channels
ISIS' Telegram users are very active, sending out hundreds of updates per day - including video, audio, photos, and text statements.
Channel subscribers can't post anything in the channels, but subscribing gives users quick and easy access to all of ISIS' latest releases.
"In the aftermath of Paris, propaganda was released on Telegram and on Twitter," Rachel Bryson, a researcher at the Quilliam Foundation who studies ISIS propaganda, told Business Insider. "... They'll have a Twitter account where they announce on Twitter to follow them on Telegram, so you can subscribe to the account on Telegram."
Media released on Telegram in the wake of the terror attacks then showed up on Twitter and other online platforms.
"The top tier of disseminates have Telegram accounts, but Twitter is still a mass-audience platform," Charlie Winter, a researcher on jihadism and expert on ISIS propaganda, told Business Insider last month.
The propaganda oscillates from bucolic to brutal - photos of sunsets and shops are mixed in with photos of amputations and airstrikes. Though ISIS certainly uses violence to recruit, it also markets its "caliphate" as an Islamic utopia, emphasizing the government services, food, and other goods that it says are available in its territory in Iraq and Syria.
This method of marketing might especially resonate with those living in war zones who don't have regular access to basic necessities.
"There's so much more focus on civilian life than anything else," Winter said. "It's justifying [ISIS'] existence and reason for being."
Here's a look at the wide variety of images that pop up:
Recently, ISIS propaganda channels on Telegram posted photos showing ISIS militants learning martial arts and engaging in various military exercises.
The photos and statements in ISIS' official channels come from its media shops around ISIS territory. ISIS has put a lot of effort into its media strategy, which is highly sophisticated for a terrorist group. The group regularly produces slick videos and a glossy English-language magazine, along with maintaining an active presence on social media for indoctrinating, recruiting, and disseminating its messages.
One account gets shut down, and a new one pops up in its place. When an ISIS-affiliated Twitter account gets suspended, the user will often create a new account with a similar handle, noting in their new Twitter bio how many times they've been suspended, and then notify a "shoutout" account (which are also often suspended) to mention the new handle and ask other ISIS-supporters on Twitter to follow it.
Meanwhile, some of the new Telegram channels that have popped up this week are distributing what looks to be official ISIS propaganda in light of the official ISIS Telegram channels (all bearing the name "Nashir") being shut down.
For its part, ISIS declared "war" on Telegram after the company started shutting down its channels. ISIS-affiliated channels that hadn't yet been blocked released this statement:
they started their war on the #islamicState
be very careful and from now on nothing is save to use
they can give away our info
so keep using VPN and
be carefull may Allah protect you