Global terrorism thread

“We are Muslims, Christians, Jews,” the wire-frame Guy Fawkes mask announces in an eerie robot voice. “We are hackers, crackers, hacktivists, phishers, agents, spies, or just the guy from next door…. ISIS, we will hunt you, take down your sites, accounts, emails, and expose you…. You will be treated like a virus and we are the cure. We own the Internet.”

The “we” here is Anonymous, the vaunted global hacking collective that launched a furious online offensive against the Islamic State in early February, and which declared war on the group shortly after the fall of Mosul last June. As the alternative Counter Current News reported (and as Anonymous #Op ISIS You Tube videos proudly trumpeted), these attacks exposed more than 6,600 Islamic State-linked Twitter accounts, along with 2,000 email addresses and about 100 IP/VPN channels. Several of the group’s major recruiting sites were also knocked offline.

But Fawkes’s wire-frame visage sounded about as frustrated as a robot voice can in a subsequent video released on Feb. 11, announcing a third attack. “With our last Operation ISIS, we showed the world and especially governments it’s not that hard to fight back ISIS online. So why’s no government doing it?”

Great question. How is it that the U.S. government, capable of coordinating a complex air campaign from nearly 6,000 miles away, remains virtually powerless against the Islamic State’s online messaging and distribution network? For months, the militant group’s horrifying, crisply edited videos of death marches, beheadings, and immolations have churned their way through the social media landscape, commanding near-instantaneous global attention. Add to this the group’s use of more intimate web platforms for international recruiting (20,000 foreign fighters from 90 countries at last count), and the scope of the problem only widens.

These online mouthpieces carry immense strategic value. The Islamic State’s June 2014 offensive into Mosul, for instance, was accompanied by a well-choreographed social media campaign, sowing terror and confusion far in advance of its fighters. Tellingly, when the Iraqi government finally acted, it did so by banning its own citizens’ access to Facebook and Twitter. Within the last month, videos of the Islamic State’s atrocities have resonated so strongly with citizens of Jordan and Egypt that they’ve provoked armed escalation and retaliation by these Arab governments. This is arguably exactly what the Islamic State wants.

If the United States is struggling to counter the Islamic State’s dispersed, rapidly regenerative online presence, why not turn to groups native to this digital habitat? Why not embrace the efforts of third-party hackers like Anonymous to dismantle the Islamic State — and even give them the resources to do so?

To date, the State Department’s tiny Center for Strategic Counterterrorism Communications — with its 21,000-follower “Think Again Turn Away” Twitter account — has been the tip of the spear in the U.S. effort to short-circuit the Islamic State’s propaganda machine. At best, its efforts are like spitting in the wind. At worst, it has been an embarrassment, as when the account confused al Qaeda and the Islamic State in a much-maligned tweet that baffled jihadis around the globe.

Although the Obama administration has announced a significant expansion of the office and put forth an encouraging plan to empower networks of university students to counter violent extremism online, these initiatives only address half the problem. As anyone who’s ever gotten in a political debate on Twitter can tell you, the availability of a viable counter-narrative in no way guarantees that somebody will actually listen to it. A remarkable number of people seek out information online with their minds firmly made up. Just as the United States must push back against Islamic State messaging, it must also take steps to tear out its voice box.

Those best suited to this task are not necessarily the thousands of professional hackers at U.S. Cyber Command and related agencies, who are trained and equipped to counter cyberattacks by rogue states and sophisticated non-state actors. Instead, the U.S. government should look to those unaffiliated, socially minded hackers (“hacktivists”) who have their own reasons to despise the Islamic State. This includes self-declared, underutilized “white hat” hackers, who use their expertise to test and improve the cyber-defenses of companies. It also includes those individuals and hacktivist collectives like Anonymous who have had a traditionally antagonistic relationship with the U.S. government.

What might a U.S. “partnership” with dispersed, largely unaccountable — if not uncontrollable — groups of shadowy individuals often at odds with U.S. laws look like?

It’s a radical idea: a nonprofit foundation, sponsored by the anti-Islamic State coalition and funded through a mix of U.S. public support and private contributions. (Think NPR doing bounty-hunting.) This small institution could issue bite-sized rewards (or tote bags?) for proof of the identification or elimination of Islamic State-linked social media accounts, VPN/IP channels, recruiting websites, or any other sort of online refuge. Defining “proof” here would be a significant engineering challenge — but certainly not as hard as flying unmanned space planes or deploying Star Wars lasers.

So long as the initiative attracted attention and payment proved quick, reliable, and tamper-proof — critical when dealing with hackers — it could open a new front in the digital war against the Islamic State. Already, social media administrators are struggling to shut down jihadi accounts at a pace that’s not even close to that with which they are being opened. A crowdsourced hacktivist army could supplement those efforts, identifying and flagging new nodes in the Islamic State’s network the moment they began attracting followers. These paid volunteers could also harass the Islamic State with phishing and distributed denial of service (D Do S) attacks — the bread and butter of today’s online vigilantes. Strong verification mechanisms could incentivize a more surgical approach to identifications and attacks, limiting collateral damage.

The effect would be to exert a constant pressure on the Islamic State’s digital operations. Social media companies like Twitter, which have been fighting a long-running game of whack-a-mole against the Islamic State, could get a huge boost in their never-ending effort to track down targets. Long lists of jihadi accounts, compiled by hacktivists and verified by government proxies, could be sent to the immediate attention of social media monitors. Likewise, brute-force D Do S assaults (which overwhelm servers’ nonstop connection requests) against Islamic State websites and forum boards could stymie its global coordination and recruiting drives. Other, stealthier attacks could sow confusion among Islamic State supporters, as with Anonymous’s recent hack that compromised more than 2,000 emails.

The goal would be to push the Islamic State into deeper and deeper parts of the web. No longer would grisly execution videos trend so quickly worldwide; no longer could the Islamic State so easily pull the strings of public attention. As prospective jihadis (particularly in the West) found it harder to establish contact with recruiters in Iraq and Syria, governments would find it easier to identify and stop them. In time, the Islamic State’s global reach and influence would wane.

This sort of partnership wouldn’t require any deeper mending of the rifts between hacktivists and the U.S. government. Those attacking the Islamic State and seeking anonymized payment could be greeted with a simple message: “You don’t like us and we often don’t like you. Performing this service will in no way immunize you from applicable domestic laws, now or in the future. But we share a common enemy and will defeat it best by working together.”

If individuals and groups like Anonymous are performing this service for free today, why pay them? It’s a question that speaks to the dynamics of these decentralized groups. The fact is that, while loose hacktivist collectives are excellent at mounting one-time “operations” to disrupt or disable target networks, they’re much less effective at sustaining that pressure over the long run. Those involved can get bored or distracted. The effort can fizzle.

This poses a problem. After all, there will never be a single decisive moment — an online Battle of the Bulge — that drives the Islamic State off the Internet for good. So long as the group exists, its fighters will always gravitate toward online services to achieve their goals of international terrorism and recruitment. Accordingly, rolling back the Islamic State’s virtual operations will be a continual task, akin to spraying for pests or mowing a really big lawn. This is the kind of job you pay for.

“Enlisting trolls to fight trolls” sounds like a surreal, distinctly 21st-century idea. It’s not. The United States has often embraced unlikely collaborators to realize strategic goals. In the early 1940s, tens of thousands of American Jeeps rumbled into Nazi Germany — driven by Soviet soldiers. In the 1980s, Afghan mujahideen shot down Soviet helicopters with U.S.-supplied Stinger missiles. In the war-torn Iraq of 2007, the United States showered money on previously hostile Sunni tribes to finally quash al Qaeda’s influence. Even today, Washington navigates tenuous partnerships with Iranian-backed Shiite militias and the terrorist-designated Kurdistan Workers’ Party. By comparison, offering micropayments to socially minded hackers comes across as fairly benign. U.S. soldiers are less likely to one day find themselves on the wrong end of a U.S.-supplied piece of crypto-currency.