ON DA’ISH’S LATEST HIT LIST

22 March, 2015 INSIGHT & ANALYSIS 3416

ON DA’ISH’S LATEST HIT LIST
By Michael S. Smith II

On 21 March 2015, Twitter accounts used to promote Islamic State propaganda were observed promoting links to a list containing photos and corresponding names and addresses for US military personnel. Originally available at JustPaste.it, which, like Archive.org, has become a veritable clearinghouse for jihadist propaganda in recent years, the list has since been removed. Yet screenshots of its contents are available via dozens of popular Twitter accounts used to promote the group’s propaganda.

A message attributed to the “Islamic State Hacking Division (ISHD)” accompanied the list. It states ISHD has “hacked several military servers, databases and emails and with all this access we have successfully obtained personal information related to military personnel in the United States Air Force, Navy & Army … we have decided to leak 100 addresses so that our brothers residing in America can deal with you.”

The message also reflects DA’ISH’s efforts to capture more interest from jihadis active in two areas where a majority of al-Qa’ida’s senior leaders are presently based, the Khorasan and Yemen, along with DA’ISH’s courtship of al-Qa’ida’s East Africa branch, al-Shabaab. The “Brothers in America” are advised they should seek revenge for “a war against Islam,” as revealed by bombings targeting jihadis in “Syria, Iraq, Yemen, Khurasan and Somalia.” (In a recent video in which al-Shabaab proclaimed it is time to “redraw the map of East Africa,” the group may have been trying to contrast itself, thus al-Qa’ida from DA’ISH by highlighting al-Shabaab operatives’ efforts to avoid killing Muslims during terrorist campaigns executed in Kenya during 2014. Nevertheless, popular Twitter accounts used to promote DA’ISH’s propaganda still promoted that video.)

It is notable that the contents of DA’ISH’s latest hit list are not formatted utilizing the same slick designs featured in the materials labeled as contents of DA’ISH’s “Security Database” that were showcased in the video that documented the murder of captured Jordanian pilot Mu’ath Kaseasbeh. That this list lacks the same sophisticated graphic design features suggests there may not have been significant coordination between those responsible for producing and initially distributing this material and the influence operations agents responsible for producing and distributing much of the more high-profile material promoted by the group’s supporters.

From the group of Twitter accounts monitored by the DOWNRANGE team that promoted this material, @0Amqlw1Kap72hxn was among the first the team observed posting the link to the list. That account has since been deleted.

Meanwhile, another account that was among the earliest to begin promoting this material, @twit_kilafa51, was still active and had a following of 2,736 accounts at the time of this report’s production. With a following of more than 4,600 accounts, @103_GwiHkahe_yU, which also promoted the list, was also still active.

Using Twitter’s search service to search for the original list posted online via JustPaste.it/ISHDLEAK, one finds the material has also been promoted by a number of other popular accounts used to promote jihadist propaganda that were still active at the time of this report’s production, including:

@mlyce44
9,019 Followers at time of publication

@khelafa_media17
7,645 Followers at time of publication

@Jbha96ALnusra
4,241 Followers at time of publication

Popular accounts used to promote DA’ISH’s propaganda were also among the accounts that retweeted some of these accounts’ tweets. For instance, with a following of nearly 16,000 accounts at the time of this report’s publication, @RBk_999 retweeted a tweet from @mlyce44 that included a screenshot of the list, along with a link to it.

The removal of the list was anticipated by many DA’ISH supporters who exploit technologies made available by Twitter to promote the group’s propaganda. Many Twitter accounts managed by DA’ISH supporters have posted screenshots of the list.

The manager(s) of @hhazberr, an active account with a following of 2,321 at the time of this report’s publication, promoted a series of screenshots of the list. In addition, still active at the time of this report’s publication and with a following of more than 800 accounts, @G1945PS was among the Twitter accounts used to post larger sets of screenshots of the list.

Hackers associated with Anonymous have also piggybacked on the attention drawn to the list by such popular accounts as @khelafa_media17 to highlight their efforts to thwart DA’ISH propagandists’ online activities. A link posted by one “hacktivist” in response to a tweet containing a screenshot of the list from @khelafa_media17 leads to a message on Just.Paste.it that makes note of the efforts of “#OpAntiISIS.” Specifically, an accompanying short video purportedly documents successful efforts to hack e-mail accounts used by DA’ISH members.

Screenshots: Hacktivist drawing attention to Anonymous’ anti-IS activities

This is not the first time DA’ISH has furnished such a hit list. Following the release of the video produced to document the immolation of Jordanian pilot Mu’ath al-Kaseasbeh, DA’ISH influence operatives used Twitter to promote a hit list containing names of fighter pilots, along with “Wanted Dead” posters featuring names, photos and addresses for several pilots based in Jordan.

More recently, in the video documenting the execution of an alleged “Mossad agent” by a child soldier, DA’ISH included graphics of similar design to the aforementioned “Wanted Dead” posters, this time featuring information about members of an alleged Mossad-managed spy ring.

As with the latest hit list, all of these materials conveyed targets’ names and addresses in English.

All of these threats are intended to bolster DA’ISH’s position in its competition with al-Qa’ida for domination in the Global Jihad movement. Indeed, these threats generate much attention for the group.

In January, with the execution in France of an employee of Charlie Hebdo whose picture appeared on a hit list published in al-Qa’ida’s leading English-language magazine, Inspire, al-Qa’ida proved it remains capable of matching words and deeds — and with precision. It is assessed DA’ISH will seek to demonstrate similar capabilities to kill individuals listed as targets by the group, for matching words and deeds strengthens perceptions of the group’s legitimacy among both current supporters and prospective recruits.

Like al-Qa’ida, DA’ISH’s target list also includes high-profile civilians. Earlier in 2015, the group issued a threat against executives and employees of Twitter. Twitter creator Jack Dorsey was singled out then, and has been the focus in similar propaganda since. For instance, with a following of more than 4,300 accounts at the time of this report’s publication, @media_libi_is, one of the most popular Twitter accounts used to promote the propaganda of DA’ISH’s Libya-based operatives, features the following image in the account’s banner space: