Sympathizers for the terrorist organization DAESH using social media to spread propaganda and recruit fighters are now drawing an increasing amount of return fire from activists who have been knocking some sites offline and infiltrating others, resulting in the terrorist group urging its supporters to use alternative channels, such as Telegram, for propaganda.
The loose hacking collective Anonymous is the latest to draw attention to such campaigns, with members claiming credit this week for having thousands of pro-DAESH Twitter accounts disabled.
But others claim to have been doing more for longer. One group that feeds information to the U.S. government says it has suppressed tens of thousands of Twitter accounts since January, and its members have posed as would-be recruits to gain information on so-called Dark Web operations supporting DAESH.
"We're playing more of an intelligence role," said the executive director of Ghost Security Group, who declined to be named, citing security concerns. The group is a volunteer organization that has been sending data to the FBI and other agencies via a Congressional terrorism adviser, Michael S. Smith II.
Smith said the group's infiltration efforts had given some actionable information to the government, and that coordinated complaints to Twitter had helped push DAESH supporters elsewhere.
At Twitter, Ghost Security Group and an affiliate now circulate lists of problem accounts. Ordinary users who see those lists can then complain about those accounts, getting them suspended more quickly than if the groups were acting alone.
"More accounts are being taken down," said J.M. Berger, a Brookings Institution expert on DAESH. "I do think the majority of the reporting is being done by groups like Anonymous and Ghost Security. But there are other initiatives, including the Counter Extremism Project and the Sawab Center, which are contributing to reporting efforts."
Berger said the efforts were helping to keep the DAESH's Twitter audience "about flat, which I think is positive."
The pressure on Twitter is one reason that DAESH has moved a lot of its broadcast communication to Telegram, which opened a "channels" service that lets a participant reach thousands of viewers, J.M. Berger, a Brookings Institution expert on DAESH and other security experts said.
The Ghost Security Group leader, who uses the moniker DigitaShadow, said that his group was still gathering information on Telegram.
In other cases, he said websites were taken down after his group's researchers notified the hosting provider. In a few cases, the group arranged denial-of-service attacks. But he said the guidance coming back to him through Smith was generally away from such brute-force methods.
"We've backed down from denial-of-service and moved toward intelligence collection," he stated.