ISIS supporters secretly staged a mass migration from Telegram to a little-known Russian platform

In the wake of Friday’s terror attack near London Bridge, terrorism researchers combed chat groups popular with ISIS supporters on the messaging app Telegram looking for clues about the attack. But then the groups began to disappear.

By Saturday afternoon scores of groups with thousands of subscribers had been booted off Telegram as part of a major crackdown that began on Nov 25.

But even as prosecutors and police officials in Europe claimed it as a major victory in the fight against terrorist propaganda, terrorism researchers were working as hard as ISIS itself to get around the ban in an effort to see whether ISIS would try and claim the London attack.

Belgian terrorism researcher Pieter Van Ostaeyen, who specializes in tracking foreign fighters who have joined ISIS, saw the 50 or so groups he had infiltrated go dark starting on Friday evening after the London attack. By Saturday afternoon Telegram was a ghost town for Islamic extremists. But a single tweet from an anonymous ISIS supporter gave him something to work with: It linked to a discussion group on TamTam, a much less well-known application developed by a Russian social media network.

Using that lead, Van Ostaeyen made a wild discovery: Most of the groups he followed had conducted a cyber withdrawal from Telegram in favor of TamTam.

“They probably had already set up TamTam” in case of being shut down by Telegram, he said, suspecting that this was a prepared move. “I noticed an ISIS account linking to TamTam. So we decided to have a look. There were hundreds of channels there.”

The formality of the switchover was highlighted by a claim of responsibility by ISIS for the London attack, where two victims and the attacker were killed, that Van Ostaeyen spotted Saturday afternoon.

“It came on TamTam two minutes before any announcement on the handful of Telegram channels that were still up,” he said.

The crackdown on ISIS-linked Telegram accounts had been years in the making, a Belgian police official closely involved in the Europol-led effort told Insider.

“We had to act on these Telegram channels and this was a long term coordinated effort to shut down these accounts,” said the official, who as a police officer cannot be named in the media.

“Was it partially a political move where we decided to go after some obvious targets to show the public that this stuff won’t be tolerated? Of course.”

After the loss of ISIS’ physical territory in Syria and Iraq, authorities are keen to suppress the groups online, the police official said. The web- and app-based chat groups are the last stable area in which the group can work openly — even if only in a virtual sense.

“It was a coincidence that the anti-Telegram operation was started just a few days before the London attack but it was a very helpful one because as London happened, the ISIS groups all began to show lots of activity that made it easier to identify them and take them down,” the police official said.

Multiple researchers noted that on Friday and Saturday a handful of previously secure extremist chat groups had re-formed despite the ban and were calling for people to relax and subscribe to the new groups. Some suspect those groups are traps for unsophisticated supporters.

“I mean it was the most obvious honey pot ever,” said one researcher, who asked not to be named mocking Western intelligence services. “All the groups go down and the chat room moderators move everyone to TamTam. It was clearly a planned coordinated effort in case of a major Telegram problem, but there’s still a couple of groups on Telegram asking people to subscribe. I sensed it was an intelligence service trying to collect information on the accounts that might join these obviously fake groups.”

The migration to TamTam seems likely to be short-lived. On Monday night, in response to multiple questions from journalists and analysts about the TamTam’s sudden burst of popularity among extremist groups, TamTam also began blocking groups.

As of Tuesday afternoon, according to Van Ostaeyen, all the groups had disappeared from TamTam while Telegram had only two active groups.

“I was following around 50 groups [before the crackdown],” he said. “[They were] highly useful to keep an eye on ISIS. Now [only] two [are] left.”

Source: Insider