Jihadist threats to business can be detected from social media posts

Social media is a valuable tool for businesses to assess jihadist threats and risks to their interests and operations. It can prove invaluable in the intelligence collection process when other sources are scant. But there are pitfalls and limitations to reliance on social media, and intelligence analysis and a wider source base are essential for actionable threat assessments.

Propaganda
Jihadists use a range of social media platforms to spread their message, and these have changed over the past decade with ideologies and technologies. In the 2000s, many terrorist organisations used closed forums such as Shumukh and Fidaa to spread ostensibly vetted communiqués, videos, attack claims and threats, as well as to engage with followers.

In recent years, we have seen a more diffuse mass approach that Islamic State (IS) in particular has embraced. Jihadists have turned to open forums, social media platforms and instant messaging systems that bypass any validation of content by extremist organisations.

Assessing intentions
Extremist content on social media can help businesses assess the intentions of jihadist networks. But terrorist propaganda is also an inherently unreliable source – it is rare that credible groups will signal their specific intentions before an action. Analysis of a larger body of output is required to assess strategy, priorities and intent.

When analysing the social media output of a particular group, businesses need to consider the narrative, the images that accompany that narrative and the target audience. But also, they need to assess how reliable a given social media account or forum user has been in the past.

Social media monitoring of terrorist groups in Egypt enabled Risk Advisory to warn its clients of an emerging shift in the terrorist threat towards tourism and foreign business interests. In 2014, chatter on jihadist forums and social media criticised the Egyptian government’s decision to ‘sell-out’ the country to foreign companies. Salafist activists made a Facebook page called the ‘Losers Conference’ – referring to an economic summit scheduled for March 2015 in Egypt – and listed UK and US companies to be targeted. A spate of attacks occurred shortly after against consumer and retail brands in Cairo and Giza in the first three months of 2015.

Assessing capabilities
Analysis of attack claims, images and videos on social media can also provide information for assessing the capabilities of terrorists. Again, it is important to compare the virtual message with what is actually happening on the ground to make a fuller assessment and judge the credibility of the source.

Continuous monitoring of social media and online jihadist platforms helped Risk Advisory to provide a granular picture of the escalating conflict in Libya in 2014. The media output of prominent salafist groups such as Ansar al-Sharia enabled us to provide clients with the locations of the main areas of fighting and to assess the impact on transport infrastructure such as airports. Over the course of 2015, Risk Advisory was also able to determine what towns IS controlled and were likely to seize next by reviewing videos, images and statements, alongside other intelligence sources.

Limitations
There are pitfalls and limitations to using social media for intelligence. Reliability is a major issue. Extremist messaging is propaganda and has high potential to distort what is really happening. Jihadist communications have also become more decentralised over the years making it hard to discern what the official position of a group actually is.

This means that while social media is a powerful new source of information, its exclusive use is fraught with risks. Big data solutions that hoover up social media posts are useful, but only to a point. It should be one source of intelligence among many streams analysed by experts.