A majority of the profiles identified in this research posted and shared official or unofficial IS propaganda, but a particular group of nodes were observed to be much more active at sharing pro-IS content. Among the 1,000 IS supporters identified, there were 28 unique Facebook accounts belonging to active pro-IS propagandists. At least 

20 of the 28 propaganda accounts used hacked Facebook profiles. Eight 

of the propaganda accounts had at least four backups, with several having ten or more backup accounts should Facebook remove their more active account.

Amaq statements and general IS news often appears to follow the regional theme of the propaganda account. For example, an Arabic-language account almost exclusively posts about IS in Syria and Iraq. Egyptian propaganda accounts typically post about IS activities in the Sinai Peninsula, Afghan accounts about Wilayat Khorasan – IS’s province in Afghanistan and Pakistan – and the Israeli account about anti-Israel and anti-Jordan propaganda.

Other profiles connect users by providing a link to another pro-IS account and advising their friends to also follow the advertised account. This is an important activity as it can help new propagandists build their online support network quickly, increases the resilience of said network, and draw an individual deeper into this IS network on Facebook. Eight of the propagandists identified are unique from the other 20 IS Facebook propagandists. 

Hacking

IS supporters also use Facebook to hack, report, and spam non-IS supporting profiles. According to our observations, accounts engaged in these activities appear to be largely run through Egyptian Facebook accounts. Many hacked profiles change their nickname to either “Spider of the Caliphate” or “Pirate of the Caliphate” and display a prominent affiliation to the Islamic State.

Since these accounts initially have hundreds of non-IS supporting friends, IS supporters use the opportunity to post hateful and violent rhetoric targeting these individuals. This is a particularly rampant problem in Egypt, where IS supporters have hacked more than 60 Christian Facebook profiles.

Two hacked Facebook profiles, ID 842 and 843, appear to be regularly used by the people responsible for hacking them. These accounts post IS propaganda and various technical information, including how to hack Facebook profiles. They also coordinate the mass reporting of accounts. We also identified a private Facebook group, which was used to coordinate mass reporting. 

A hacked or IS propagandist account posts the name of a non-IS account to be reported or spammed and provides a link to that account as well as a justification for the attack, such as claiming that the target individual belongs to a state security force, is a Christian, or posts anti-IS statements. Other IS supporters then report the account en masse, causing it to be temporarily removed by Facebook. 

Key profiles and pages

Outside of propagandists and hackers, some profiles can be deduced as being key figures based on the data gathered for this research paper. One of these is ID 954, a suspected Jordanian or Egyptian last believed to be in Syria. It is likely that ID 954 fought alongside or is affiliated with IS’s southwestern Syria affiliate, Jaish Khalid Ibn al-Walid. ID 954 has an eigenvector centrality of 0.84, the third highest of all 1,000 nodes and the highest among non-propaganda accounts. The eigenvector centrality measures a node’s level of connection to other important nodes and indicates centers of gravity within a network.

In other words, ID 954 is the most central figure documented in this report. This is not to say that he is connected to every community, though. His Facebook network seems to indicate an elevated role within IS.

ID 339 is a similarly key figure who hails from and currently lives in Namibia and has nearly 5,000 friends, many of whom support IS. Unlike ID 954, his profile gives no indication that he has ever traveled abroad or physically joined an IS-affiliated group. Instead, he appears to be a man in his late teens or early twenties who has dedicated much of his time to building a large Facebook network of pro-IS friends. ID 339 likely built his network by actively seeking out other IS-supporting users. We have documented him openly asking others on Facebook if they are IS supporters. He is also part of at least three pro-IS Facebook groups – two Indonesian groups and a Tamil group – which likely helped him build connections, especially since many of his connections are to Indonesian IS supporters. Additionally, after making initial connections with IS supporting Facebook users around the world, it is likely that Facebook presented him with further connections through the ‘suggested friends’ feature. He serves as the most central bridge connecting to a number of Indonesian and Filipino IS supporters, as well as multi-national nodes close to the Madagascar, Afghan, and East African networks and several nodes directly within the core IS network. While many nodes in the Indonesia and Philippines networks have individual connections to each other, ID 339 is central to much of the region’s interconnections.

ID 339 has previously posted on Facebook asking people if they are IS supporters and has shared two pieces of IS propaganda. He has shared a nasheed (a form of vocal music which is popular in Islam) played over a still image released by IS and a short video apparently produced by IS’s Al Hayat media center.

ID 339’s online activities and Facebook connections demonstrates how someone who is not an official IS member or an active propogandist can still become an important figure of the pro-IS network on Facebook. As well as profiles, pro-IS groups and pages are also active on Facebook. Some of the pages 

are popular and receive thousands of likes. Two Philippines-based groups are clear about their pro-IS nature, with the names ‘DAWLATUL ISLAMIA ISIS ASG BIFF’ and ‘Dawlah Al-Islamiah in Islamic City of Marawi’.21 While Facebook users in those groups are not particularly active that is not always the case. At the very least, these groups provide a place where IS supporters can build new connections on Facebook. In other cases, they can be used by IS supporters to discuss and carry out actions online and offline.

In addition, pro-IS organizations have utilized Facebook in an official capacity. Al-Ansar Bank, which provides new Twitter and Facebook accounts for IS supporters, created a Facebook page and advertised it on their Telegram account. Shortly after Al-Ansar Bank’s Facebook account was established, a known IS supporter identified during this research asked the organization for two new accounts, which Al Ansar Bank quickly delivered to him.

– The study was funded by Counter Extremism Project