In the private sector, we analyze competitors to understand where they excel, so we can improve our approach. With this same mindset, I reviewed how 15 adversarial groups utilize media to communicate locally and internationally.
The headline is that the groups, ranging from Al-Shabaab to ISIS-K to Hezbollah, are clearly learning from each other, leading to an informal universal playbook that is consistent across the groups.
This is quite similar to the private sector where innovation is more of an iterative race. We have a tendency to copy what works.
Let’s take a look at these common behaviors by separating them into media strategy and narrative style.
Media Strategy
Telegram is home base. It is the top distribution channel for a reason. Telegram offers broadcast channels with no limit on subscribers, bots for automation, end-to-end encrypted direct messages, minimal content moderation and easy migration after bans via invite links. Narratives often start in Telegram, then content is fed to other platforms.
Each group has a similar distribution strategy that anticipates content takedowns. Groups distribute content, on average, across 3-7 platforms simultaneously. Knowing takedowns will occur, they also upload content to Archive.org, which serves as a holding tank. If content goes down on a social channel, it can be re-uploaded from Archive.org. An example of a media mix may include Telegram, Facebook, TikTok, Element and Archive.org.
A two-tier distribution system. All groups have two-tier distribution – their official channels for direct distribution and unofficial channels for supporters/surrogates (TikTok, Instagram, YouTube) to reshare and amplify content. The supporters help groups maintain a presence despite official account bans. Platform policies have difficulties proactively monitoring and patrolling the surrogate amplification layer.
Enforcement leads to migration. Each group pre-positions on other channels, e.g., Rocket.Chat, Element and Session so they can more easily activate a pre-existing presence in alternative channels or they move to new channels beyond the reach of platform moderation, such as satellite TV (Hezbollah, Houthis) and physical offline media (JI, Boko Haram).
Narrative Style
Groups are expert at establishing a false narrative frame. It is standing protocol to exploit major geopolitical events by immediately inserting their narrative within hours. If they conduct this type of “narrative jacking” within 2-4 hours of the incident they have a chance to lead the first wave of interpretation before mainstream media establishes the dominant frame.
Video accelerates attack claims. Every group releases an official video within hours of any attack. Pre-produced, officially branded with logos, released to Telegram first. Sets the frame and it is often more emotional.
Expertise in parallel audience messaging. The local message is in local language and often focuses on governance legitimacy or grievance. The international message focuses on solidarity, victimhood and humanitarian framing. Dual-narrative analysis will be more instructive than tracking either alone.
Ability to reframe civilian imagery. The footage is often authentic. The deception is in the attribution, the framing, or the claimed scale.
Grievance amplification is a gateway to radicalization. Media strategy often begins by amplifying legitimate grievance – real injustices, real conflicts, civilian suffering. Extreme content gets layered on top over time, and because the foundation is real, platform policies usually don’t flag it.
Overall, if we understand how groups learn from each other, it improves our ability to identify which media, technology and AI trends are being utilized by any of the groups. We know that what breaks new ground will be analyzed and implemented as quickly as possible.
The implication for any counter-messaging team is practical. Watching one group’s innovation is watching all fifteen. The right question to ask inside your own operation is whether you are monitoring the first mover in the playbook — not just the group on your assigned target list.
Note: the groups analyzed include ISIS, Al-Qaeda, Al-Shabaab, Boko Haram/ISWAP, Taliban, Hay’at Tahrir al-Sham, Hezbollah, Hamas, Tehrik-i-Taliban Pakistan, AQAP, ISIS-K, Jemaah Islamiyah, Abu Sayyaf Group, Jaish-e-Mohammed/Lashkar-e-Taiba, Houthis.
The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
