U.S. Takes Fight to ISIS on Cyber Battlefield

No terrorist group has capitalized on networked technology more than ISIS, both for recruitment messaging and commanding their fighters on the ground.

The internet is their response to asymmetric disadvantage. Where they lack in infrastructure and resources of a state, they use the web to plan attacks, solicit money and reach out to potential members.

Meanwhile, U.S. Cyber Command has mustered an array of cyber capabilities intended to undermine ISIS’s operations and messaging on the web. Cyber Command’s campaign against ISIS continues to test capabilities against groups that turn to digital technology to advance their own agendas.

Much like the U.S. strategy of denying physical safehaven to terrorists, the U.S. and its allies are seeking to deny virtual safehaven for the spread of terrorist ideology and operational know-how.

On the battlefield, physical has merged with digital. ISIS commanders in Iraq and Syria have maneuvered their ranks through urban combat in cities such as Mosul or Raqqa, giving orders and sharing intelligence using networked-devices like phones, tablets, laptops, and small commercial drones. They use disposable Twitter accounts to distribute timely operational commands to fighters following specific hashtags, and create Facebook groups or Telegram channels to relay crude combat intelligence in real time.

While U.S.-backed Syrian Democratic Forces inch their way through ISIS’s self-proclaimed capital Raqqa – which has featured heavily in recruitment messaging since it became the group’s center of gravity in the fall of 2013 – another, far less visible force is at work.

From its headquarters in Fort Meade, U.S. Cyber Command has become an integral part of the fight against the terrorist organization. Forward-deployed cyber operators embedded in ground teams, or relaying from links to ISIS infrastructure through drones, aircraft or naval vessels, can access ISIS systems where internet or satellite links cannot.

The recently elevated combatant command first cut its teeth in February 2016 by launching targeted denial of service attacks and other cyber countermeasures to jam ISIS communications during the strategic recapturing of the town Shaddada in Syria.

In October 2016, British defense secretary Michael Fallon said the UK had for the first time joined the offensive cyber campaign against ISIS during the battle for Mosul in Iraq. Since then, coalition military hackers have sought, with mixed results, to subtly disrupt the terrorist organization’s ability to govern, pay its fighters, disseminate orders from commanders, and spread its narrative and know-how to attract those around the world to take part in its cause.

ISIS is vulnerable to cyber warfare and the campaign presents an opportunity for military hackers to hone their trade by testing doctrine, tactics, and integration with other domains of war. Without external nation-state support, ISIS relies on existing and improvised telecommunications infrastructure, and equipment is outdated and therefore insecure.

The UK and U.S. have an in-depth knowledge of the electromagnetic spectrum in the region going back to the 2003 invasion of Iraq. The majority of the networking gear that the terrorist organization relies on was captured from the retreating Iraqi forces during the fall of Mosul in the summer of 2014 – much of which was likely provided by the United States.

Such offensive cyber operations have, however, been shrouded in secrecy, and for good reason. Cyber intrusion tools used to gain entry into ISIS networks are limited and perishable, and should they be discovered, ISIS members will take precautions to negate them, either by turning to new technology or new behavior.

Already ISIS leadership practices online operational security to remain hidden. Tech-savvy jihadists distribute how-to-manuals designed to help recruits mask their IP addresses and communications by using anonymizing technology such as Tor and end-to-end encryption platforms as WhatsApp and Telegram. These countermeasures make the group’s communications at times unreadable, difficult to track and target, and therefore resilient against U.S. collection and disruption efforts.

While some offensive cyber capabilities – such as jamming through denial of service – are “loud,” they can be rationalized away by ISIS fighters as simple technical problems. But complete destruction of ISIS digital infrastructure – or just blatant interference – could cut off crucial intelligence collection avenues that are the foundation of the U.S.-led coalition’s air war over Iraq and Syria.

“NSA penetrations are stealthy and subtle – difficult, if not impossible, to detect,” says Ned Carmody, a former CIA Case Officer. “NSA cyber operators have the ability to extract large volumes of data from adversary networks without the enemy ever knowing it happened. On the other hand, when Cyber Command loudly kicks in the door of an ISIS computer, the secrecy is lost and intelligence avenues are blown.”

Similar to traditional electronic warfare methods used since World War II, cyber disruption of ISIS command and control networks is unlikely to simply jam their communications, but also spoof or manipulate their content for cognitive effects. Military cyber operators can turn ISIS command and control infrastructure against itself, distributing false orders or locations to lead members into traps. But again, the operational security of such efforts is integral, as ISIS knowledge of such intrusions would inform them to ignore spoofed communications.

Over time, such manipulation could have a psychological impact on ISIS fighters, perhaps even straining trust between leadership and ground forces or driving them to turn to alternative means of command and control that are either less effective or less secure.

“The substitution of commands or location information does not only have the immediate effect of that false data, but can also undermine confidence in command, control, and information systems, impacting on decision making and potentially channeling the adversary on to alternate means where they can be more easily targeted,” said Ewan Lawson, a Senior Research Fellow for Military Influence at the Royal United Services Institute in London,

As ISIS loses its footing in Syria, it will turn its focus further to global outreach, recruiting those vulnerable to its messaging and inspiring them to violence. The group has already proved itself deft at influencing the hearts and minds of many. They render audiences awed by their gruesome displays of violence, drawn to their slickly edited videos and primed by their mass dissemination through social media platforms. The world is flattening and the terrorist organization is increasingly capable of crowdsourcing headline-catching violence from afar.

Recruitment content is centralized through its media umbrella Al-Furqan Media, yet dissemination is decentralized and has leveraged nearly 50,000 active ISIS Twitter accounts at given time, as well as temporary “throwaway” accounts on Facebook, YouTube, Telegram and other communication platforms. Digital amplifiers such as bots unendingly propel the group’s narrative directly to the mobile devices of individuals on every continent susceptible to extremist messaging.

The group has proven resilient against tech companies deleting accounts for breaches of their terms of service and traditional warfare techniques of jamming and interception have left cyber operators in an unending game of Whac-A-Mole. Even Cyber Command’s operation codenamed Glowing Symphony, where military hackers breached ISIS administrator accounts, blocked out members, and deleted content such as battlefield videos displaying ISIS victories, wound up turning into a disappointment as the results were temporary. Content later reemerged on other servers.

But while progress in countering such a resilient messaging campaign is slow and disheartening, it is achievable. Repeatedly hitting the central nodes of ISIS influence – similar to a terrorist decapitation strategy – can undermine the production of content and slow their audience growth. Contesting these key sites forces ISIS to expend time, resources, infrastructure, and expertise to bring them back online elsewhere and if they become inconvenient or risky to access, audiences will slowly wane.

“The internet has allowed rapid and global dissemination of the extremist narrative,” says Zamawan Almemar, a former senior consultant for the U.S. Department of Defense. “Thus, an effective counter-radicalization effort must confront all the components of the radicalization process, including disabling online interactions between extremist supporters radicalized by online propaganda, who are geographically separated and motivated to take action against the West.”

There are, however, a number of legal considerations when removing ISIS content and disrupting their data. The terrorist organization relies on commercial software and their content often resides in servers housed in third party countries. The U.S. coercively disrupting data in countries around the world remains a contentious issue and exploiting rather than reporting vulnerabilities in commercial software is what underpins much of the government’s anti-ISIS hacking efforts.

Furthermore, the removal of political and religious-based recruitment messaging brings up First Amendment censorship concerns. The line of what amounts to incitement of violence is not always crystal clear in all ISIS content. How the U.S. and its allies navigate this challenge will have a lasting impact on discussions regarding freedom of expression in the future.

Levi Maxey is the cyber and technology analyst at The Cipher Brief. Follow him on Twitter @lemax13.