Jihadists Thrive on Telegram as Takedowns Taper

Telegram Takedowns of Jihadist Accounts Decline Sharply in 2020

Over the past six months, the number of jihadist Telegram account suspensions decreased significantly–dropping to almost one-third of the monthly suspensions that Telegram took action against back in April 2020. 

This suspension slowdown, however, is not likely due to a downturn in jihadist Telegram activity. In fact, quite the opposite. Recent Flashpoint Finished Intelligence suggests that jihadist Telegram activity is surging. Capable of operating more freely and with less-frequent channel removals, associated jihadist Telegram channels and bots are more resilient and remain active for weeks if not longer now.

Jihadist Activity Ebbs and Flows Across Messaging Platforms

The growing jihadist presence on Telegram coincides with the account crackdown on the second-most active messaging platform at the time, Hoop, a Canada-based application. 

Beginning in late August 2020, Hoop began an aggressive–and quite successful–campaign to target and suspend jihadist-associated accounts on its platform.

The key takeaway here is that jihadist messaging activity is both strong and nimble. They’re able to adapt quickly to messaging platforms’ fluctuating enforcement initiatives, and can open and transition rapidly to new accounts. And when necessary, they move communication operations to another platform with ease.

Figure 1: Telegram Suspensions of Jihadist Channels in Past 12 Months

Bot Automation Key to Jihadist Messaging Coordination

An integral component to jihadists’ ongoing presence and activity on Telegram–and other messaging platforms–is their use of automated messaging bots. These bots enable the rapid dissemination of propaganda and orders at massive scale. Simultaneously, they sidestep oversight scrutiny by facilitating deception techniques that maneuver around the rules- and keyword-based detection capabilities of the social media platforms. 

Remain Vigilant on Telegram and Elsewhere

Account suspensions and takedowns on social messaging platforms, like Telegram, have at best a moderate effect on quelling threat activity. In most cases, enforcement campaigns on these channels offer only temporary respites in disrupting state, nonstate, or other adversarial-driven coordination and communications.

For now and the foreseeable future, Telegram remains the most critical node for jihadist activity as a source of official and nonofficial propaganda.

It’s critical today to keep an active pulse on all such related activity. Organizations must remain vigilant across social and messaging platforms to prepare for the possibility of abrupt threat actor communication transitions to new or different channels.

Connect With Us for More In-Depth Analysis and Reporting

Get in touch with Flashpoint for more detailed intelligence on this threat vector and others. Our specialized and veteran threat analysts can provide tailored insights and analysis of associated threat activity, as well as your organization’s current exposure to it.