ISIS 'still evading detection on Facebook', report says

Image copyright Getty Images

Facebook accounts linked to the Islamic State group (ISIS) are still finding ways to evade detection on the social media platform, a new report claims.

One network's tactics included mixing its material with content from real news outlets, such as recorded TV news output and the BBC News theme music.

It also hijacked Facebook accounts, and posted tutorial videos to teach other Jihadists how to do it.

Facebook said it had "no tolerance for terrorist propaganda".

The Institute for Strategic Dialogue (ISD), which carried out the study, tracked 288 Facebook accounts linked to a particular ISIS network over three months.

The group behind them was able to exploit gaps in both the automated and manual moderation systems on Facebook, to generate tens of thousands of views of their material.

Facebook said most of them had now been removed.

Networks of ISIS supporters were also found to be plotting, preparing and launching 'raids' on other Facebook pages, including those belonging to the US military and political leaders.

Image copyright Facebook Image caption The comments section of Donald Trump's Facebook page was also targeted

The ISD researchers say they watched in real-time as instructions were posted for followers to flood comment sections of the sites with terrorist material.

One attack targeted US President Trump's Facebook page with fake African-American accounts. Another put images of the 11 September 2001 attack on the US Department of Defense and Air Force Academy pages, along with messages.

'Digital territory'

On 7 April, a series of Twitter accounts began to send out links to a Facebook Watch party.

The accounts all used the phrase 'Fuouaris Upload', a reference to medieval Islamic warriors.

The ISD researchers say this was part of a co-ordinated attempt to 'amass digital territory' on Facebook.

The network shared video content which received tens of thousands of views, and which extended out to other platforms with links to Telegram, WhatsApp, ISIS stand-alone websites and SoundCloud.

The researchers believe that at the centre of the network was one user who managed around a third (90 out of 288) of the Facebook profiles.

At times, this user would boast of holding 100 'war spoils' accounts, saying: "They delete one account, and I replace it with 10 others."

This was accomplished by generating real North American phone numbers and looking for associated Facebook accounts.

If it found a match it would request a re-set code to be sent to the phone number, so it could lock out the original account holder and use the Facebook profile to spread content.

Blurred logos

The researchers say another key to the survival of ISIS content on the platform was the way in which ISIS supporters have learned to modify their content to evade controls.

This included:

Breaking up text and using strange punctuation to evade any tools which would search for key words Blurring ISIS branding, or adding Facebook's own video effects Adding the branding of mainstream news outlets over the top of ISIS content

Facebook has tried to develop ways of avoiding taking down mainstream news content which contains excerpts of ISIS material, and this was an attempt to take advantage of that.

In one case, an ISIS video was uploaded, but with 30 seconds of the France 24 news channel as an introduction before 49 minutes of the ISIS Iraq video.

In another case, a remix of a BBC News jingle with a pop song that became popular during the Coronavirus outbreak was used to mask ISIS content.

The researchers found that 70% of the "Fuouaris Upload" accounts were taken down during the nearly three-month period.

But the network adapted and survived relatively easily by shifting from one account to another.

As accounts were taken down, members of the network publicly mocked Facebook for not understanding the way they could operate on the platform.

The followers and friends of the main Facebook accounts included supporters from a number of different language groups, including Albanian, Turkish, Somali, Ethiopian and Indonesian communities.

Image copyright ISD Image caption This video was found on an Indonesian language account

The researchers say these accounts did not seem to be as heavily moderated as the Arabic and English ISIS accounts.

On one Indonesian language account the researchers found a video, set in a kitchen, featuring a man in a balaclava explaining how to create explosives using household items.

The video had been viewed 89 times and shared through 41 other Indonesian and Arabic language accounts, and flagged to Facebook.

'Inner workings'

"Our report is about the evasive behaviours of ISIS-supporting accounts on Facebook," the report's author Moustafa Ayad said.

"It is a deep dive into the inner workings of a singular terrorist-support network, connected to many others across the platform.

"The tactics we outline in our report are shifting as we speak. Without a clear understanding of these networks, and their behaviours, responses reliant on takedowns do little to quell ISIS-support expansion across our primary platforms."

ISD says Facebook's automated and manual detection systems need to be updated, with proactive investigations into repeat offending accounts and their connections to other accounts on the platform.

It says the platform needs to re-examine account security protocols, and how these security measures are being actively subverted by users.

In response to the research, a Facebook spokesperson told ISD: "We had already removed more than 250 accounts referenced in ISD's report and are reviewing the remaining 30 accounts against our policies.

"We have no tolerance for terrorist propaganda on our platform, and remove content and accounts that violate our policy as soon as we identify them."