Inside the dirty Twitter war against ISIS

Before it was deleted, Twitter account @6Haqq was a one-person tourism board for the Islamic State. Instead of the beheadings and endless stretches of desert that most of the world associates with his group, @6Haqq offered postcard-like, bizarro-world view of the chunks of Syria and Iraq that the terrorist group has taken over. 

“Come to the Islamic State,” it begged. Here, @6Haqq said, there is no crime. The Islamic State’s libraries were full of books. People enjoy their tea.

Twitter

“I wish you were here,” reads one of them, showing a jewelry shop that’s, well, full of jewelry.

Twitter

This was surely not @6Haqq’s first account. The 6 at the end indicates the number of times the user had to delete his account, and there’s no telling how many usernames the person at the other end of the screen went through before that. For a short while, @6Haqq agreed to chat with me over direct message about how Islamic State (aka ISIS or ISIL) uses the service. @6Haqq ignored most of my questions, though, and mostly instead ranted about “pro war media bias.” The user did, at least, employ creative emoji use.

Twitter

Briefly, @6Haqq outlined a strategy:

Twitter

But when I asked for elaboration, a curious thing happened: Without warning, @6Haqq blocked me. A few hours later, the account was deleted. I reached out to account after account, but no one else bit. A few told me they weren’t affiliated with ISIS, despite posting their imagery. Some ignored me. A number blocked me. Soon, @6Haqq had completely disappeared.

The process for cutting the 140-character voice box out of the militant group is, I found, a messy effort led not by Twitter but by dedicated volunteer vigilantes who are nearly as mysterious as the Islamic State itself.


It can be rough out there for Twitter users who spread ISIS propaganda. Since August 2014, when the group’s decapitation of American journalist James Foley went viral on the site, Twitter has routinely engaged in purges of ISIS-associated accounts and tweets. One such crackdown happened in early March, when I first started reaching out.

As it turns out, I had caught @6Haqq at a particularly bad time: Twitter reportedly ended up taking down at least 2,000 accounts that week alone. But there was no mistaking I had gotten on that account’s bad side: @8Haqq, an account that used the same avatar and tweeted similar content, and which also has since been suspended, also blocked me.

@6Haqq’s struggles were but a blip in a constant, bitterly fought, seemingly never-ending war waged on Twitter, one that is almost unfathomably boring and petty. 

According to a recent study by the Brookings Institute, there were at least 46,000 Twitter accounts that actively promoted or were affiliated with ISIS, in some way or another, between September and December of 2014. (For comparison, though numbers for real-life ISIS fighters are similarly hard to gauge, estimates vary from 20,000 to 200,000.)

Of those active ISIS accounts, the study only confirmed around 1,000 ISIS accounts were actually suspended. The full number is clearly much higher; Twitter itself even says so, though a spokesperson refused to give me specifics. Effective ISIS accounts, though, were much rarer; between 500 and 2,000 users are believed to be the driving force of ISIS’s Twitter effort.

For the accounts I observed, the process can go like this: An online jihadist creates an account. He might recall his closest online compatriots’ usernames offhand and quickly find them and follow them. Or he might try to identify himself and ask them to follow back. But that friend might be have since been suspended, as well. So, what then?

I noticed a number of tactics ISIS employs to deal with the problem of creating now accounts from scratch. First, many keep their successive usernames similar, which makes them easier to find: @6Haqq was presumably just @Haqq at one point. I noticed @10Haqq a few days after @6Haqq blocked me; as of publication time, I couldn’t find any working account with a variation on that name. Other users were explicit about their new accounts.

Twitter

Some shout out their friends when they notice them back online as a way of quickly rebuilding the accounts. Some say they regularly change their handle in an effort to keep their followers while confusing people who might report them.

Twitter

The easiest way to find newly created ISIS accounts, at least as someone outside Islamic State ranks, is through hashtags, which allows anyone who picks the right term to filter through Twitter’s noise and find whoever’s talking about a given subject. Some are in Arabic, and many inherently difficult for much of the world to easily guess. But the simple #IS is remarkably common, and it’s how I first found related accounts.

But by the very fact that the hashtag makes an account easily accessible to a potential IS ally means it’s easy for an enemy to find it, too.


Per official policy that a Twitter spokesperson stressed to the Daily Dot, the company doesn’t actively seek out accounts to ban. Instead, it relies heavily on users moderating each other. So, as much as IS wants to create new accounts, stymying the militants and their propaganda is a task led almost entirely by other Twitter users.

That’s how I came across @CtrlSec, a movement that began as an offshoot of #OpISIS, itself an offshoot of Anonymous hackers and supporters who want to fight the terrorist group from their computers. Their goal is simple: to identify and report as many ISIS-affiliated Twitter accounts as they can. To be the mallet in the never ending game of whack a mole.

One CtrlSec leader, who refused to reveal his name, told the Daily Dot that as of March 9, the group has identified 11,660 accounts. Of those, 9,524 have been suspended, he said, and 102 were deleted entirely, likely by the user. Just over 2,000 ISIS accounts spotted by CtrlSec remain active.

CtrlSec gets more advanced than just searching for a hashtag and filing reports, the leader said, enlisting native Arabic speakers who pretend to be sympathizers in order to be introduced to more reclusive ISIS members. But when going for bulk identification, CtrlSec uses the very openness of Twitter—the same openness that helped ISIS spread its propaganda—against it.

“We also see what they publish online to spread to their followers, so basically they are telling us their plans,” he said. “I can’t count on my hands how many confused rage death threats I have gotten lol.”

I asked him why ISIS might have started blocking me after initially answering my questions. They are propagandists, after all, and I was always straightforward about being a journalist asking them about their methods.

“They have also gone so far and said that all the people who follow CtrlSec is behind the account.”

They’re confused, he said, lashing out despite their apparent social media skill.

“They’re fishing with dynamite.”

Illustration by Jason Reed

Kevin Collier

Kevin Collier

A former senior politics reporter for the Daily Dot, Kevin Collier focuses on privacy, cybersecurity, and issues of importance to the open internet. Since leaving the Daily Dot in March 2016, he has served as a reporter for Vocativ and a cybersecurity correspondent for BuzzFeed.