(U//FOUO//LES) DHS Terrorist Use of Social Networking Facebook Case Study

Due to its format, the following document cannot be conclusively dated. However, it is believed to have been created within the last month.


  • For Official Use Only
  • Law Enforcement Sensitive
  • 2010

Terrorists have traditionally sought to exploit new and alternative media, particularly on the Internet, to spread their propaganda and to a lesser extent, operational and tactical guidance to prospective supporters through websites, forums, blogs, chat rooms etc. In recent years, Islamic terrorists have expanded the purview of their online endeavors into social networking sites, websites that create and foster online communities organized around shared affinities and affiliations that connect people based on interests and relationships. In most cases, social networking sites are openly viewable to any participant on the site.

As part of this trend, jihad supporters and mujahideen are increasingly using Facebook, one of the largest, most popular and diverse social networking sites, both in the United States and globally, to propagate operational information, including IED recipes primarily in Arabic, but in English, Indonesian, Urdu and other languages as well. While some tactical information is available on Facebook, the majority of extremist use of Facebook focuses on disseminating ideological information and exploiting the site as an alternative media outlet for terrorist propaganda. However, to a lesser degree, the site is used as a gateway to radical forums and jihadi sites with explicit radical agendas (and easily downloadable operational information) and as a platform to promulgate some tactical and operational information.

Terrorist Use of Facebook:

• As a way to share operational and tactical information, such as bomb recipes, AK-47 maintenance and use, tactical shooting, etc.
• As a gateway to extremist sites and other online radical content by linking on
Facebook group pages and in discussion forums.
• As a media outlet for terrorist propaganda and extremist ideological messaging.
• As a wealth of information for remote reconnaissance for targeting purposes.

Operational & Tactical Information

Two Arabic-language IED recipes, one for explosive ammonal and one for a poisonous smoke bomb, along with Arabic-language instructions on how to prepare nitric acid were collected from the discussion board of a Facebook group with a clear radical preference. While the group only boasted 47 members and all the posts were from the same user whose profile picture and user name was Osama bin Laden (obscuring the user’s true identity), all content on the group’s Facebook page is open to the public, meaning anyone with a Facebook account has access to the posts.
By making a group open to the public, its actual membership number becomes almost irrelevant in terms of access to information sharing. It is worth noting that the same toxic smoke bomb recipe posted on the Facebook page was collected at roughly the same time from an Arabic-language radical forum, suggesting that there is some cross-over between radical content disseminated on Facebook and on Islamist extremist forums. In addition to explosives related material, informational videos with titles such as “tactical shooting,” “getting to know your AK-47,” “how to field strip an AK-47” etc. were collected from a radical Facebook group with over 2,000 members, which was open and accessible to non-members.

While how-to videos about firearms are not inherently terrorist source material pertaining to tactics and procedures, and are not nefarious in isolation (they are within the scope of acceptable content on Facebook, YouTube, and other social networking sites), the ones found on Facebook were taken from radical groups dedicated to jihad. These combined with the juxtaposition of a video on tactical shooting with video clips from al- Qaeda’s media wing, As-Sahab, featuring Osama bin Laden and Adam Gadahn from a Facebook page explicitly dedicated to jihad (“wherever the mujahedeen are fighting, they are doing their religious duty as well as fighting for their right”), makes these videos terrorist source material.

Facebook as a Gateway

While a plethora of radical content and terrorist propaganda is already being posted on Facebook, radicals are also using Facebook group discussion forums and wall posts to link to radical forums, media sites for extremist groups, and recruitment pages. Some Islamist radical forums even have Facebook pages, which facilitate navigation between the two. In this way, Facebook acts as a gateway or launching pad for further radicalization and for easy access to sites where explosives recipes and IED information are regularly posted. For example, a Facebook group with over 5,000 members claiming to defend Islam had links to Hizb ut Tahrir and al- Aqsa’s homepage.

Links to al-Qaeda videos on YouTube, propaganda videos featuring wounded and dead Palestinians in Gaza, and videos promoting female suicide bombers were all openly accessible as well. Facebook has also become a popular platform for the dissemination and quick spread of Osama bin Laden statements, whether audio or video. His most recent statements have appeared on a number of Facebook group pages within 48 hours of release. There were also a number of groups dedicated to Hezbollah and Hassan Nasr Allah that had propaganda videos showing the organization’s weapons arsenal and training.

Radical Forums and Facebook as Jihadi Media

While social networking sites have recently become popular with radicals, forums have long been used by terrorists to exchange ideas, and spread ideological, tactical and operational information among a sympathetic audience. A number of discussion threads have been collected from these well-established, radical forums that focus on expanding into other social networking interfaces, especially Facebook:

• This [Facebook] is a great idea, and better than the forums. Instead of waiting for people to [come to you so you can] inform them, you go to them and teach them! God willing, the mujahedeen, their supporters, and proud jihadi journalists will [use the site, too]. [First,] it has become clear that the market of social networking websites is developing in an astonishing manner and that it fulfills important needs for Internet users, particularly younger ones.
• Facebook has become very successful in this field; therefore, it is our duty to use it, as adherents of jihad and [members] of the blessed jihadi media. [I] mean, if you have a group of 5,000 people, with the press of a button you [can] send them a standardized message. [That] means if you send one message with a link to [forum names], a clear [path] to jihadi media is open.
• I entreat you, by God, to begin registering for Facebook as soon as you [finish] reading this post. Familiarize yourselves with it. This post is a seed and a beginning, to be followed by serious efforts to optimize our Facebook usage. Let’s start distributing Islamic jihadi publications, posts, articles, and pictures. Let’s anticipate a reward from the Lord of the Heavens, dedicate our purpose to God, and help our colleagues.

General Goals of the Invasion
1. Reach the wide base of Muslims who [use] Facebook.
2. Encourage brothers to devise new online media in support of jihadi media.
3. Form a solid base on Facebook and shed light on it as a medium for reaching people.
4. Move from an elite society ([on] jihadi forums and websites) to mainstream Muslims, [encourage] their participation, and interact with them.
5. Advance media operations and encourage creativity, innovation, flexibility, and change. Reach large [numbers] of Crusaders, broadcast the losses of their armies, expose the lies of their leaders, and call Muslims to jihad.

These posts call for the organized, strategic exploitation of Facebook, recognizing its value as a platform for reaching a wider, younger audience. The user who posted steps for ‘invading’ Facebook recognizes the inherent value in exploiting a non-ideological medium, namely its wide user base that is comprised of the general public.

It also serves as recognition that jihadi forums are mostly frequented by people who have already become radicalized or support jihad, i.e. “elite society,” whereas Facebook offers a space to interact with “mainstream Muslims” and attract and recruit new supporters. Given that in terror networks social bonds tend to be more significant than external factors like shared hatred or ideology, social networking interfaces whose purpose is to virtually connect people based on such common social bonds clearly lend themselves to extremist use and recruitment efforts.
Operational Security (OPSEC)

In addition to discussing the exploitation of Facebook to promote jihadi media, a number of forum threads also discuss how best to do so while maintaining a high level of operational security. The posts explicate OPSEC measures that should be taken to maintain anonymity, encourage users to fictionalize and use artifice and demonstrate a sophisticated understanding of the online security environment and the need for anonymity even within a medium that is relatively un-policed like Facebook. The following terrorist source material was harvested from a number of Arabic-language radical forum threads:

• First, we make clear that [you should] use Tor to email, register, and [use Facebook]. Don’t join unless you are using Tor. Take care that all data be “fictional,” and the Facebook password should not be the [same] as the email password. In general, don’t use a password twice, meaning don’t [use] your password for [forum] or [forum] on another forum.
• [Make sure] all the data is fictional and that the password for Facebook is a new
password [you have] never used before. [Make sure the password] is complicated [and includes] some uppercase and lowercase letters, numbers, and symbols. Save it in your notebook on the [computer] or on a flash (USB) [drive].
• I [think it’s best] not to post a picture with jihadi meaning, so that the eyes of the idolater dogs won’t be on you. If you want, post a picture that calls attention to God, so that you will benefit from good things. Don’t [use a picture] of yourself.
• In order for the maximum number of “Facebookers” to join your group, you should reveal to them that you are, for example, an expert in terrorist groups. You don’t have to reveal that you sympathize with al-Qaeda. The group’s members will automatically sympathize with the organization once they become familiar with the organization’s tapes and jihadi operations. You must use artifice.

While radical Islamist forum discussion threads demonstrate acuity for the need for strong OPSEC, there may be little need for such care on sites like Facebook. The much higher frequency with which radical content appears on Arabic-language Facebook group pages, as opposed to radical content in Spanish and English, may be due to the lack of oversight of the Arabic-language in comparison to the other two languages, which are well monitored because of the relative ease of doing so.

According to Facebook Rights and Responsibilities on the website, “You will not post content or take any action on Facebook that infringes or violates someone else’s rights or otherwise violates the law.” It also states that “We can remove any content or information you post on Facebook if we believe that it violates this Statement.” However, information is not screened before it is posted, so posts that violate the rules remain on the site until they are detected and removed.

Remote Reconnaissance

In addition to using Facebook to disseminate information, information posted by users can also be exploited by adversaries for targeting purposes. For example, Facebook postings have been used domestically by robbers to determine when a user would be out of the house. The Shin Bet security agency (part of the Israeli Ministry of Defense) has recognized terrorist use of social networking sites for remote reconnaissance, warning Israeli soldiers about posting sensitive information: “terror organizations are using these [social networking] sites to tempt Israelis to meet up in person in order to either abduct them, kill them or recruit them as spies.” The English-language Lebanese media outlet, Ya Libnan, has also reported that an Israeli soldier was sentenced to 19 days in a military brig after posting a photograph of the base where he was assigned.” Although there have been no reported cases of social network sites being used for targeting in explosives related cases, it is another reconnaissance resource available to terrorists.


The vast size, linguistically and culturally diverse user base, and lack of verification of user supplied biographical information on social networking sites make monitoring and evaluation of potential threats on these sites extremely difficult. Moreover, the presence of non-violent extremist material on user profiles and in “linked” content complicates the task of isolating and assessing more credible threats. These attributes, combined with the complicated array of privacy settings users may employ–or augment with secondary forms of communication, ranging from traditional web forums to email–make social networking sites a viable tool for terrorists to use.

While Facebook is currently being used as a platform to share operational and tactical information, a gateway to extremist sites and forums, an outlet for propaganda and extremist ideological messaging and for conducting remote reconnaissance, it is by no means the only social networking site being employed for extremist use. Radical material including documents, videos, and audio files have been disseminated on other popular social networking sites, such as Twitter, YouTube, and MySpace.

The radical Islamist group, the Muslim Brotherhood, has even created and launched its own social networking site that operates in much the same way as Facebook called Ikhwan Book. These sites, with their vast user bases and profusion of user generated information present both challenges and opportunities for law enforcement. While social networking sites are difficult to police given the sheer volume of information and complicated privacy settings, they do contain a wealth of knowledge about potential threats and current tactics and techniques being disseminated on the web.

Comment: For all inquiries related to Pinpoint Reports, please contact the Helpdesk at tripwirehelp@dhs.gov.

Source; TRIPwire’s Pinpoint. This report combine terrorist source material translation with open source research and original TRIPwire analysis to evaluate

DISSEMINATION INSTRUCTIONS: This document is marked Law Enforcement Sensitive/For Offical Use Only and may be disseminated, with proper attribution, to Law Enforcement, DOD, or U.S. Intelligence Agencies. Further disclosure to unauthorized entities could jeopardize ongoing investigations, operations, and personal safety. This product shall not be released to the public or media.

Share this: