On November 2, 2020, a 20-year-old Austrian national posted some concerning images on Instagram.
In one, the user posed with an AK-style rifle and a machete. Another used bullets to spell out “baqiya,” a reference to the Islamic State’s slogan baqiya wa tatamaddad (“remaining and expanding”). Hours later, the poster claimed four lives and injured 22 in Vienna—Austria’s worst terrorist attack since 1985.
Jihadist-motivated attacks continue to pose national security threats worldwide, and online networks are now central to their propagation. In tragedies like Vienna, online spaces not only create a platform for leakage before attacks but also for radicalizing audiences of suggestible individuals—whether they’re an “inspired” lone wolf or directly tied to organized groups like ISIS.
In fact, the internet is quickly evolving as a central weapon for groups like ISIS in the post-caliphate era, especially as extremists adapt to heightened censorship on mainstream social media.
To inform effective national security, governments must understand how jihadist movements are changing online in what many now refer to as the “virtual caliphate.” What do these changes mean for government, defense, and counter-terror strategies?
Online Extremism Is Getting More Fragmented
For years, social media platforms like Twitter and YouTube have faced an uphill battle censoring jihadist propaganda. What does its online presence look like now?
Content censorship means that jihadists have migrated to less-regulated or encrypted platforms like Telegram. However, even Telegram has “cracked down” on violent extremism. While violent extremism is still prevalent on Telegram, groups like ISIS have responded by moving to even smaller networks like Koonekti, Discord, and decentralized platforms designed to evade takedowns.
Alongside this fragmentation, jihadists continue to pursue mainstream networks, which are valuable for reaching wider audiences and luring viewers onto more obscure platforms. To survive on mainstream networks, jihadists are developing more advanced obfuscation tactics.
Research by the Institute for Strategic Dialogue found that ISIS-linked Facebook accounts are still successfully deceiving detection systems. This is accomplished by combining propaganda with legitimate news, masking red-flag keywords with text breaks and punctuation errors, blurring ISIS branding, and editing mainstream news content or logos into their videos.
A recent article by the Global Network on Extremism and Technology also suggests that jihadist communities are becoming more globally dispersed, niched, and “emancipated” from ISIS as an organization. This also applies to extremist media and propaganda strategies, which have become more outsourced and targeted to various online audiences.
New Blockers to Detection, Censorship, and De-Escalation
These changes are impacting how groups like ISIS identify, organize, and recruit around the world. From a national security perspective, this matters for a number of reasons.
For one, movement to encrypted or decentralized web spaces can make extremist content—like the caliphate cache—virtually impossible to dismantle. This means that propaganda can now be exposed to new audiences for longer, increasing the risk of recruitment and terrorism worldwide.
It may also get even more challenging to detect jihadist content on social networks, and not just because of improved obfuscation tactics. An article by Maura Conway, an online extremism researcher, suggests that non-ISIS jihadist groups tend to be less censored on social media. This means more content could be overlooked as smaller jihadist communities become less tied to ISIS in their identity and propaganda narratives.
When extremist movements become fragmented and less centralized, they get harder to monitor and understand. This might seem like a weakness, as dispersed groups tend to have fewer resources and logistics than if they were centrally governed and organized. However, as we’re seeing with right-wing extremism in the United States, a more fractured approach can actually work to deceive the target and further jihadist agendas.
Monitoring Online Extremism for National Security
Government, defense, and counter-terror organizations have a lot to gain from keeping up with changes in jihadist internet use. Monitoring content offers a window into trends in these populations. This can indicate where content needs to be dismantled—beyond the standard social media platforms—and where improvements in content detection systems, whether automated or manual, are required.
Online analysis also helps identify who is vulnerable to radicalization, how they’re being targeted, and how to counter that process. And beyond supporting investigations into physical or digital attacks, monitoring online networks helps intelligence professionals identify trends around recruitment, propaganda, ideology, and pathways to extremist funding.
How can governments adapt their national security strategy in response to changes in jihadist online extremism?
To start, extremism analysis must cast a net wider than mainstream social media networks or even the dark web. Instead, monitoring jihadist populations online requires a systems-based approach that also covers emerging, obscure, and decentralized web spaces, and analyzes connections between fragmented networks.
It’s hard to mention online extremism monitoring solutions without talking about threat intelligence software. Some commercially-available tools focus specifically on filling this role—providing defense analysts with access to extremist chatter on a mixture of well-known and fringe sites not commonly combined in threat intelligence tooling. This means mixing mainstream feeds like Twitter and YouTube with more obscure sources like chan sites, Telegram, I2P, and other decentralized networks.
As with many other national security initiatives, AI also plays a big role in tackling online extremism. Flawlessly detecting radicalized individuals or imminent security threats with AI is not a realistic goal. But investing in machine learning development can further support content detection and removal efforts—especially as non-English and Arabic content targets global audiences.
Access to jihadist propaganda online has a huge impact on an individual’s path to radicalization and action. In the post-caliphate era, the internet has become increasingly weaponized by ISIS and other Islamic extremists to serve their violent agendas.
This may not be fully predictable—but we do know that around the world, jihadist identity and strategies are rapidly changing alongside their use of online platforms. Analyzing these changes is crucial for investigating and anticipating public safety threats, and more clearly understanding where Islamic extremism is headed.
Are you monitoring jihadist groups on Telegram?
Contact us to streamline your process and explore alternative data sources.