The Washington PostDemocracy Dies in Darkness

The ‘app of choice’ for jihadists: ISIS seizes on Internet tool to promote terror

Here's a look at what the Telegram app is and why terrorists are using it. (Video: Jhaan Elker/The Washington Post)

When the Islamic State was seeking volunteers for a holiday killing rampage in Europe, it sent word over its favorite social-media channel: the messaging service known as Telegram.

“Christmas, Hanukkah, and New Years Day is very soon,” began a Dec. 6 posting on one of the terrorist group’s usual Telegram bulletin boards. “So let’s prepare a gift for the filthy pigs/apes.”

Two weeks later, when a truck mowed down pedestrians at a crowded Berlin Christmas market, the group again used Telegram, this time to claim credit for the attack. On Friday, after chief suspect Anis Amri was killed in a Milan shootout, Telegram broadcast his posthumous video. The Tunisian migrant had fled Berlin and crisscrossed France and Italy before being stopped by Italian police looking for a burglary suspect. In his video he pledges allegiance to the Islamic State and issues a chilling warning to Westerners: "God willing, we will slaughter you."

The words and images flew across the globe over a network that terrorist leaders describe as ideal for their purposes — one that is highly discreet, with its heavy encryption and secret chat rooms, but also highly permissive, allowing violent Islamist groups to exchange ideas and spread propaganda with minimal interference. The same conclusion has been reached by terrorism analysts who say Telegram is now overwhelmingly preferred by extremist groups such as the Islamic State, in part because the company has failed to adopt the aggressive measures used by its competitors to kick terrorists off its channels.

A report this week by an organization that monitors Islamist militants' Internet communications calls Telegram "the app of choice for many ISIS, pro-ISIS and other jihadi and terrorist elements." The study describes the terrorists' mass migration to Telegram as one of the most striking developments in the field recently. ISIS is one of the common acronyms for the Islamic State.

"It has surpassed Twitter as the most important platform," said Steven Stalinsky, lead author of the report by the Washington-based Middle East Media Research Institute, also known as MEMRI. "All the big groups are on it. We see ISIS talking about the benefits of Telegram and encouraging its followers to use it."

‘Muslims will face two choices’: The strategy behind ISIS’s call for Christmas attacks

Terrorists' use of Telegram has been a growing concern among U.S. and European counterterrorism officials for more than a year, as well as a source of numerous inquiries and complaints lodged against the German-based company and its creator, Pavel Durov, a 32-year-old Russian national who launched the service in 2013 with his brother Nikolai.

Just three days before the assault on the Berlin Christmas market, senior members of the House Foreign Affairs Committee urged Durov to immediately take steps to block content from the Islamic State, warning that terrorists were using the platform not only to spread propaganda but also to coordinate actual attacks.

“No private company should allow its services to be used to promote terrorism and plan out attacks that spill innocent blood,” stated the letter, signed by Rep. Ted Poe (R-Tex.), the chairman of the panel’s subcommittee on terrorism and nonproliferation, and Rep. Brad Sherman (Calif.), the ranking Democrat on the subcommittee on Asia and the Pacific.

Efforts this week to reach Telegram’s founder through his social-media accounts were unsuccessful.

Durov, who fled Russia in 2014 and now lives in a kind of self-imposed exile as a citizen of the island state of Saint Kitts and Nevis, has in past interviews and essays defended his company’s efforts at self-policing, noting that Telegram shut down 78 channels used by the Islamic State in the wake of the Nov. 13, 2015, terrorist attack in Paris. In March, Durov told CBS’s “60 Minutes” that he was “horrified” to see terrorist groups infesting Telegram’s chat rooms, and he said the company was trying to do more to stop them.

But Durov also contends that it is impossible to fully prevent terrorists from taking advantage of the encrypted communication services Telegram offers to its 100 million active users, a global network that includes millions of people living in countries that deny citizens the right to free expression.

“There’s little you can do, because if you allow this tool to be used for good, there will always be some people who would misuse it,” Durov told CBS.

Search for Berlin attacker roils Germany

But critics of the company — a cohort that includes high-ranking U.S. counterterrorism officials — say Telegram could do more. A primary reason for the German firm’s popularity with violent groups is the fact that rival social-media companies have aggressively cracked down on them, U.S. officials say. Facebook and Twitter — two firms that were once criticized for allowing terrorist postings on their pages — have received high marks in recent months for their efforts to find and block radical Islamist content as soon as the material surfaces.

“Positive steps by Twitter, for example, are part of the reason Telegram is becoming the new thing,” said a senior administration official involved in tracking the Islamic State’s online presence. The official, who spoke on the condition of anonymity to discuss sensitive analysis of the terrorist group’s operations, called the migration to Telegram a “major cause of concern,” in part because of encryption features that make it harder for law enforcement officials to discover and thwart the terrorists’ plans.

“It’s alarming because it shows they’re really good at adapting to new means,” the official said. To stop attacks, private companies and government officials must stay a step ahead of the terrorists and “figure out how to deny them these capabilities before they even start using them,” he said, adding, “That simply hasn’t been the case with Telegram.”

New easy-to-use features installed by Telegram have made the task of preempting terrorism even harder, government officials and private experts say.

Originally a phone-based software with a relatively small but devoted following, Telegram last year introduced a new version for desktop computers that made it easier to transmit videos and large files as well as private messages.

New “end to end” encryption was added in April to give users an extra assurance of privacy. Independent analysts have described the quality of Telegram’s encryption as “military grade,” meaning that it is extremely difficult, if not impossible, to crack. Users can also opt for a self-destruct feature in which private messages disappear as soon as they are read.

MEMRI’s Stalinsky monitors hundreds of jihadist-related Telegram channels from a bank of computers at his office, watching live “chats” joined by individuals who sign on to forums linked to the Islamic State, al-Qaeda and dozens of other groups. Often, he says, a participant in one of the open discussions will signal that he wants to have a private conversation. That typically means joining a temporary, invitation-only “secret” chat group that will exist for only a few hours and then disappear.

“If you’re not watching at that precise moment, you’d never know about it,” Stalinsky said.

The Berlin attack is no surprise. Experts have issued warnings for years.

Even the more public conversations often convey specific instructions about bombmaking or potential targets for terrorist attacks. In recent months, Islamic State leaders and supporters have posted messages on Telegram containing lengthy “kill lists” of Westerners the terrorists sought to mark for execution, as well as appeals to sympathetic scientists and engineers to join the Islamic State’s efforts to produce advanced weapons.

Last month, Stalinsky, using an anonymous user name, gained entrance to a secret Telegram chat in which self-described British and American supporters of the Islamic State discussed ideas for attacking the U.S. Embassy in London.

Stalinsky alerted U.S. officials to the conversation, and there is no known evidence suggesting that the would-be terrorists put their plan into motion. But images of the text exchange show the participants discussing in detail the logistics for such an attack, including weapons and travel arrangements. The individuals even discuss whether they should take steps to avoid killing women and children.

“Women and children should be off limits,” one of the participants wrote. “We do not want to be like kuffar [infidels].”

The fact that the group allowed a complete stranger to monitor the chat suggests that the plotters were not true Islamic State operatives. While Telegram’s users include senior terrorist leaders and operatives, many chat-room inhabitants appear to be merely fanboys and wannabes, and some clearly “are not that smart,” Stalinsky said.

Yet, even bumblers are capable of striking a blow for the Islamic State. And using Telegram, Stalinsky said, the naive and willing have opportunities to connect with professionals — experts at the tools of terrorism and the use of social media — to put deadly plans into action.

“The West has been generally two steps behind the jihadis when it comes to cyber,” Stalinsky said. “Many people in government are still focused on Twitter, and they need to be. But what we tell them is, ‘That’s no longer the main story.’ ”

Read more:

Is air power really effective in the fight against the Islamic State? It depends.

Reward for information on ISIS leader increased to $25 million

Anatomy of a takedown: How the U.S. killed ISIS’s No. 2