The ISIS Cyber Hierarchy
We must spread our principles, not with words but with deeds, for this is the most popular, the most potent, and the most irresistible form of propaganda.
—Mikhail Bakunin, 1870.1
Propaganda by deed would be the byword for all of al-Qaeda in Iraq’s (AQI) operations. The image of the fighters in the field presented as fearless and fighting under the protection of Allah was critical to sustaining the incoming flow of recruits that was crucial to breaking the American will to fight in Iraq. AQI would extend its entire range of jihad across the world by harnessing the power of media and the Internet. Videos showing training, planning, attacking, and ending the attack by slitting throats of all captives were going to play well across the media-hungry world. The more brutal the better.
Everyone in the world was familiar with al-Qaeda—primarily because of the 9/11 attacks and the media repeatedly showing two or three old photos of Bin Laden from the late 1990s or his deputy Dr. Ayman al-Zawahiri. However, al-Qaeda operations would only reach their pinnacle when al-Baghdadi took command.
In 2011, Abu Bakr al-Baghdadi was transitioning AQI’s name and activities into the far more brutal and Iraqi-led Islamic State of Iraq and al-Sham (the Levant), or ISIS. His chief of intelligence, Haji Bakr, a former Iraqi Air Force counterintelligence officer, was also fully aware of the importance of mounting a digital offensive. In order for the future caliphate, the homeland of all Muslims without borders or class distinctions, to be established, the world must see what commitment and depth of heart must truly be like. Everything would be recorded, edited, made into the most rapturous propaganda, and then released via the Internet. Well before the caliphate was up and running, al-Qaeda and AQI’s cyber communications and recruitment was well on its way.
The terrorist organizations in Iraq knew well how to conduct media operations, but it was imperative to use the fighters to create a media revolution. ISIS would stun the world by demonstrating its persistence and international presence through its media and Internet offensive. In order to do this, it had to substantially improve the professionalism of its preproduction, filming, and editing and ensure that distribution of its message would be effective well before it could go onto the web.
ISIS created Internet media teams compromised of imported news media and online developer talent. Many were experienced TV and radio news station technicians who likely had no choice but to assist in helping ISIS when their hometowns in Iraq or Syria, especially the cities of Raqqa and Mosul, were taken by force. Most were Sunni Muslims who fought or supported the ex-Saddamist insurgents who outfought the US Army, but when ISIS came along it offered the opportunity to join something bigger, in which their value as professional production staffs were honored and necessary.
The online media teams established their different identities by using names like al-Furqan, al-Hayat, or the various Wilayat Media Centers. But the cyber warriors, they were a different breed. They were shadowy groups of individuals who were hard to distinguish from the professionals. When hackers posted about the latest victims of their DDoS attacks, the problem for western intelligence services was to determine to which jihad entity they belonged. Were they even members of ISIS? The picture would remain muddied for a long time until they started to consolidate and form bands of hackers intent on rivaling the operations of the fighters in the field.
Figure 3: The ISIS Cyber Matrix.
ISIS power came from heeding lessons learned, exploiting the history, and acquired the manpower of both AQI and the ex-Saddam loyalists and forged them into five distinct operational units:
1. THE MEDIA PROPAGATION TEAMS included video and audio production, print/graphic, and propagating systems. They would disseminate the global message of the caliphate.
2. THE CYBER COMMUNICATIONS SQUAD. Those in a global network of activists and supporters outside of the caliphate and trusted members within would help set up both overt and secret communication channels on programs such as Telegram and WhatsApp. They would inform and educate the other members not in the caliphate on how to conduct operational security (OpSec) and work as the “Help Desk” to let trusted people gain access to the Caliphates databases.
3. THE FUNCTIONARIES. Routine operations of running a nation state would require computing power to conduct fund raising, using money provided by Islamic charities and through taxation, imposing licensing fees, bribes and extortion, as well as tracking combat operations and paying the fighters and those in logistical support units. The Adara or “administration” would account for everyone in the ISIS organization or under its thumb—this is the most valuable information in the organization because all of the real name data would be found within its databases. For those engaged in counterterrorism, this information was the keys to the kingdom.
4. THE RECRUITER BROTHERS AND SISTERS. They would reach out across the web and inspire tens of thousands of men and women to abandon their former lives and come to the caliphate to help establish the paradise that God himself commanded. Though hidden from view, the “sisters” of the cyber jihad had a profound role in enticing both women and men to come to the caliphate.
5. THE HACKERS. The smallest unit and the one with the broadest range. A small band of “E-Jihadist” volunteers would be tasked to bring about their own “Cyber Jihad” by attacking the West on all electronic media. These would be the most technically savvy members within the caliphate; they would also handle the volunteers in cyberspace.
THE MEDIA PROPAGATION TEAMS
Terrorism by media has long required an effective stream from the production level to the user level to get the most shock for your efforts. From the days of cassettes and pamphlets passed among believers to the videos dropped off to Al Jazeera in hopes of immediately hitting the airwaves, jihadists of the past knew they had to use a range of available media conduits to disseminate their message whether internal or external. If you are going to hide your message and restrict access to members only, you still need an effective network to spread the word without being detected by an adversary. If detected, vital information could fall into the hands of adversaries. ISIS engages in both internal and external messaging.
The standard consumer gadget-to-media technology curve has led to a tremendous jump in access to powerful creation, editing, and production tools for media that puts professional level results into the hands of the owners of computers, smartphones, and tablets. In addition, sophisticated encryption methods were not at the forefront of public conversation but were in play well before the Edward Snowden case. The ability to make a professional-looking video today is in the hands of amateurs, and ISIS has a distinct ambition to use these tools for low-to no-cost campaigns.
Over the years, jihadist production houses have sought to simultaneously disseminate materials and maintain message control. There has long been a tendency in jihadist groups to attempt to maintain both secrecy and brand quality and recognition at the same time. Before ISIS, there were media groups that maintained an official outlet for their related terrorist groups via websites or forums. After two years of ISIS presence in the jihadist media world, there have been increased demands to remove all content associated with ISIS from the Internet. This has had a direct effect on the recycling nature of ISIS media websites where domain names have begun to cease resembling their media center because of the risk of being detected.
THE ISIS MEDIA COUNCIL
From the beginning of ISIS’s days as al-Qaeda in Iraq (AQI), there has been a leader of the media wing who helped call the shots and support the leadership with a controlled messaging campaign directed at unbelievers that projected strength and prophetic destiny. This role was as critical to the organization as any military operation in the field. To bolster that role, they established a wide range of media councils and regional media centers. The cabinet member position for the ISIS media is led by an “Emir” or prince.
From AQI to ISI to ISIS, the group has maintained a consistent structure with roles for both Minister of Information and Spokesman for the organization. Under al-Zarqawi, the AQI organizational mouthpiece was Abu Maysara al-Iraqi. Under Abu Ayyub al-Masri, the first ISI spokesman, Abu Muhammad Mashhadani, would handle the spokesman duties until his capture in 2007. And under Abu Bakr al-Baghdadi, the first ISIS spokesman would be Abu Muhammed al-Adnani.
First Spokesman Emir for al-Qaeda in Iraq (AQI)
Abu Maysara al-Iraqi (2004–2007)—Killed March 2007
The first spokesman for the organization that would become ISIS was Abu Maysara al-Iraqi. When ISIS was still in its infancy, Abu Maysara’s name popped up in web forums like Muntada al-Ansar to promote the latest utterances of the then-leader of AQI, Abu Musab al-Zarqawi.2 To get into these forums, one had to be vetted, and the entry was password protected. Abu Maysara was a Syrian and, in addition to his media work, had many other job responsibilities. He had been captured by Coalition forces on November 29, 2004. He was identified by the US Army as “Muhammad Wasim Abdullah Halabi.” He was held at Badush prison until freed in the mass prison break in March 2007. His freedom didn’t last long; he was killed on November 17, 2007, just northeast of Samarra. Coalition forces started a massive campaign to hunt down and kill all AQI media sources, and Maysara was target number one. According to the Pentagon, his body was positively identified by DNA. Maysara was also living in a technological setting quite different from the ones Islamic State fighters encountered, since he had access to mobile phones and Internet. Twitter, YouTube, and other media sharing sites were not available yet, so the spokesperson for Zarqawi turned to YouSendIt to share files online.3
First Minister of Information for al-Qaeda in Iraq (AQI)
Muharib Abdul Latif al-Jubouri—Killed May 2007
Named the al-Qaeda in Iraq Minister of Information, Muharib Abdul Latif al-Jubouri was responsible for the al-Qaeda in Iraq propaganda releases. He was also noted for a role in the kidnapping of Jill Carroll, an American journalist, in 2006, and American peace activist Tom Fox in November 2005.
Al-Jubouri was killed along with four others near the Camp Taji military base north of Baghdad. The predawn raid was a part of Operation Rat Trap. Six other workers were arrested. His death was announced by Maj. Gen. William Caldwell on May 4, 2007,4 and was celebrated as martyrdom by forums linked to AQI. After his death there was speculation about whether he was secretly “Abu Omar al-Baghdadi,” the leader of AQI who was in fact later killed on April 18, 2010, in Tikrit, Iraq.
First Spokesman Emir for Islamic State in Iraq (ISI)
Khalid Abdul Fatah Da’ud Mahmud al-Mashhadani5
(a.k.a. Abu Zayd al-Mashhadani, Abu Muhammad al-Mashhadani, and Abu Shahid)
With a long history in jihadist groups including time as leader of Ansar al-Sunna, al-Mashhadani was the first Minister of Information after the process that transformed AQI into ISI in 2006.6 A very trusted agent of Osama Bin Laden, he was close to the interim joint AQI leader, Abu Ayyub al-Masri. In this capacity, he was responsible not only for media responsibilities, but he was a liaison officer between AQI and the leaders of al-Qaeda in Afghanistan. Al-Mashhadani was captured in a raid in Mosul in July 2007. Coalition forces had specially targeted the media centers for months before the raid. A few months later, coalition forces arrested a Saudi video editor with special effects skills and a computer graphics artist. Navy Rear Adm. Gregory Smith explained the mission: “Since the surge began, we’ve uncovered eight separate al-Qaeda media offices and cells, have captured or killed 24 al-Qaeda propaganda cell members, and have discovered 23 terabytes of information.”7
In July 2007, the reported mass haul of AQI media materials came after a raid in Samarra found a fully functioning film studio that was capable of mass producing CDs, DVDs, posters, pamphlets, and web materials. The raid found a dozen computers, 65 hard drives, hundreds of CDs, and 18 thumb drives.8
First ISIS Minister of Information
Abu Mohammad al-Furqan—Killed September 2016
Wa’el Adel Hasan Salman al-Fayad
Head of al-Furqan—Senior Shura Council member
a.k.a. Dr. Wa’el al-Rawi, Dr. Wa’el Adel Hussain
Known as “Dr. Wa’el,” he was one of the more elusive ISIS figures, yet he was responsible for the creation and publication of thousands of videos, mp3s, pdfs, and the system that projected weaponized media to the world. He was the head of al-Furqan, the first and main ISIS media house, as well as al-Hayat, the non-Arabic ISIS outlet, and was a board member of Amaq News Agency.9 He also played a role in the publication of the weekly newsletter an-Naba.
He was chosen by the Shura Council to be the replacement for Abu Muhammad al-Adnani. He worked closely with Abu Muhammad al-Adnani, who was killed just nine days before. The Pentagon announced on September 1610 that Wa’el was killed on September 7, 2016, in Raqqa. Though the news of this death took over a week to travel to the West, it was noted the next day, September 8, 2016, by Abu Musab al-Zarqawi’s mentor, Syrian Salafist scholar, Abu Muhammad al-Maqdisi, who confirmed Dr. Wa’el was dead. The trail of whether and when these players had been killed or captured is a long and confused one. After al-Rawi’s death, Craig Whiteside of the Naval War College noted that it was the third time the United States had killed both the spokesman and media emir for ISIS at the same time. The first was when Abu Maysara and an unnamed media emir were captured. In 2007, Muharib and Mashhadani were killed. In 2016, it was al-Adnani first, then Dr. Wa’el a week later.11
Figure 4: Abu Al-Atheer al-Absi as seen in al-Furqan video. (Source: TAPSTRI)
Abu al-Atheer Amr al-Absi—Killed March 2016
Amr al-Absi was the emir of ISIS media until his death in 2016 by a US drone attack. Al-Absi rose through the ranks in Syria’s early civil war battles. He was a core member in the establishment of the caliphate. It was al-Absi who helped bring Omar al-Shishani (Omar the Chechen), the black-bearded Chechen warlord, to support Abu Bakr al-Baghdadi. Some have suggested it was al-Absi who put the idea in al-Baghdadi’s head to declare the caliphate.12
Amr al-Absi and his older brother, Firas al-Absi, were well-established members of the jihadist cadre before the announcement of the caliphate. Firas al-Absi had been known to Abu Musab al-Zarqawi since 2000, since the al-Absi brothers were prominent in the Syrian town of Aleppo. The older brother, Firas, was the founder of the ISIS advisory council, or “Majlis Shura Dawlat al Islam.” His group was also involved in kidnappings, and eventually Amr came to be known as “kidnapper in chief” by both the United States and Britain.13 Amr al-Absi would eventually become the Emir of the media. Under his authority, ISIS personnel in the media efforts turned to recruiting online volunteers from the region and also ones in North Africa to engage in an online offensive that was preparing to seize an opportunity. In an attempt to gather as many fighters to the cause as possible, the campaign presented images of a victorious group that was vibrant and active. They knew that fighters under al-Qaeda influence were restless for results, so they crafted the image necessary to recruit over 10,000 fighters from around the world.
Firas was killed in August 2012 by the Salafist group al-Farouq Battalion over territorial disputes and because he was extorting payments from those seeking access trade routes along the northern Syria border with Turkey.14 The younger brother took over the group, and under his guidance the group would become a major component to the ISIS campaign to seize land in Syria and Iraq in the summer of 2014. The younger brother went on to become the Emir of Halab. In September 2014, he also became a designated terrorist under Executive Order 13224. He was featured once in a video from the al-Furqan series called Messages from the Land of Epics, which also featured the former Chechen military Emir Omar al-Shishani. In the video, you can watch al-Absi and al-Shishani plan an attack on Assad’s 66th Brigade. He, too, was killed in an airstrike on March 3, 2016, by the Syrian Air Force.
First ISIS Official Spokesman
Abu Muhammad al-Adnani— Killed August 2016
Perhaps the only man in a position that rivals that of the caliph, Abu Bakr al-Baghdadi, was his mouthpiece, the official spokesperson. From 2006, the announcement of the transition from al-Qaeda in Iraq into the Islamic State of Iraq (ISIS) was handled by Abu Abdullah Moharib Abdul Latif al-Jubouri. He was also alleged to have been part of the kidnapping of American journalist Jill Carroll. He held this position until his death on May 3, 2007.
All of the transitional AQI members were good at their jobs, but they tended to have a short shelf life. The spokesman and media Emir for the Islamic State would most recently be held by one of the oldest and wiliest of the Old Guard, Abu Muhammad al-Adnani. Adnani was the voice of ISIS until his death was announced on August 30, 2016.15 His real name was Taha Subhi Falaha.16 Born in the Idlib town of Binnish, he had been an active jihadi and a prominent figure in the organization’s lineage from Zarqawi’s leadership until the present day and was reportedly personally involved with the selection of elements of the ISIS media campaign, including having control over what got released. This was confirmed by Harry Sarfo, the German documentarian who went to Syria and was featured in an August 2015 video shot in Palmyra, who said al-Adnani personally picks out videos that are to be released.17
Figure 5: Abu Muhammad al-Adnani. (Source: TAPSTRI)
The announcement of al-Adnani’s death was of no small consequence. It was al-Adnani who announced the caliphate had been restored for the first time since the fall of the Ottomans in 1924. It was al-Adnani who announced that Abu Bakr al-Baghdadi would be the new Caliph Ibrahim as a rightful descendent of the Prophet Muhammad.
Adnani had a role much larger than simply being a spokesman. According to reporting by New York Times reporter Rukmini Callimachi, Adnani was in charge of a secret organization within ISIS known as the “al-Amni” or “Security,” a group that was a dual-purpose intelligence cell used to spy on ISIS members and conduct covert operations outside of Syria and Iraq.18
Adnani was killed in Aleppo on August 30, 2016. The announcement of his death on that same day came first from the Amaq News Agency before an official notice of his death was released by an ISIS official. Telegram channels posted photos of him for days. The an-Naba newsletter featured his death in their first release after his death a day later. Videos from Al-Battar and other memorials followed. ISIS had lost its voice in another round of defeats by the coalition of nations.
Figure 6: The AMAQ news agency delivers the news that the ISIS mouthpiece has been silenced. (Source: TAPSTRI).
In September, ISIS launched a new multilingual web magazine called Rumiyah through their al-Hayat Media Center. It was released the day after al-Adnani was killed, yet he was on the cover and in the first and last pages. No replacement for al-Adnani was announced by the group in the subsequent weeks.
Figure 7: The official notice from ISIS of the death of spokesman Abu Muhammad al-Adnani. (Source: TAPSTRI)