Telegram, an online instant messaging service popular among adherents of the Islamic State (IS), remains vital to the organization’s ecosystem of communications. The platform’s functional affordances, paired with relatively lax enforcement of Telegram’s terms of service (ToS), offers IS sympathizers a user-friendly medium to engage with like-minded supporters and content.
This report examines 636 pro-IS Telegram channels and groups that contain English-language content collected between June 1, 2017 and October 24, 2018. While this time-bound and linguistically limited sample represents a sliver of the pro-IS ecosystem on Telegram, the subsequent findings have important implications for policymakers assigned to the dual tasks of countering IS’ online foothold and engaging with service providers like Telegram. Among other findings, this report assesses that:
- English-speaking IS supporters exploit Telegram’s suite of features to communicate with like-minded supporters across the world, disseminate official and unofficial IS media, and provide instructional material for operations.
- Pro-IS channels and groups can be categorized into five primary functions: forum, shoutout, instructional, core and distribution. Distribution channels are the largest category within the sample and serve to proliferate all types of pro-IS content without regard to their origin.
- Across all channels in the sample, IS sympathizers use three primary tactics to ensure community resiliency: proliferating joinlinks, exploiting Telegram’s internal file-sharing capabilities, and observing basic cybersecurity measures.
- English-speaking IS supporters on Telegram are fundamentally concerned about operational security, but their continued reliance on public outreach results in inconsistent application of operational security measures and exacerbates vulnerabilities.
- The majority of the sample is comprised of private groups and channels, only accessible through URL keys (joinlinks), but public channels play an important role as key nodes for entry into the private network.
- Despite Telegram’s encryption protocols and privacy protections, English-speaking IS sympathizers continue to rely on insecure public-facing platforms to reach a wider audience. File-sharing sites are particularly popular, representing 15 of the top 20 website base domains shared within the sample.
- The loss of IS territory and the crackdown against its presence on public-facing platforms forces English-speaking IS supporters to focus on the group’s military activities, ensure resilience of their networks on Telegram, supplement official media with unofficial productions, and develop new measures for online guidance of operations.
- Within the sample, supporters discuss IS military activities in Iraq or Syria and the activities of IS’ affiliates more than IS attacks or events in the West.
- No single terrorist attack outside IS-held territory generated enough sustained conversation to register as one of the top 25 hashtags by name within the sample.
- IS sympathizers respond to online and offline pressure against IS media by enabling grassroots actors, proliferating unofficial or “gray” media, and distributing operational and instructional material.