‘CNN’, the Caliphate News Network: IS support groups hiding behind faux media giant social accounts

18 June 2024

‘Too Many Projects’

Like any new project, it started with a groan. “Too many projects, so little time,” read a message from 15 February 2024. The Telegram channel it was posted in was dedicated to “an accredited global news network specializing in monitoring international and regional events,” with a miniscule number of subscribers.

That would soon change.

In the two weeks that would follow, that same Telegram channel, linked to Islamic State (IS) support outlet ‘War and Media’, would create two Facebook pages, two YouTube channels, and two accounts on X (formerly Twitter). All of them were dedicated to sharing content modeled after – and branded as – familiar global news networks such as CNN and Al Jazeera.

Within IS support circles online, War and Media is best known for creating long-form IS propaganda modeled after historical documentaries. Earlier this year, the outlet launched its ‘State Series’, a two-part documentary on the history of IS. A poster it created to complement it, using the style of the movie The Godfather, was widely panned on social media. But War and Media’s ability to create a sham mainstream media ecosystem demonstrates how more than 64 unofficial IS outlets and their supporters are exploiting platform moderation gaps to create short-lived campaigns that effectively spread the group’s ideology.

Figure 1: The growth experienced by the two Facebook pages linked to ‘War and Media’ over February through April 2024, according to Meta research tool CrowdTangle.

Fake news stealing real branding

The rapid growth of the State Series pages on Facebook illustrates how these networks are playing the social media game to their advantage. Between February and April 2024, its follower count grew from a standing start to over 1,600, according to Meta research tool CrowdTangle.

During this period, the War and Media pages produced eight different video newscasts in Arabic and English, branded as CNN and the Al Jazeera Centre for Studies, a real entity associated with Al Jazeera that acts as a self-described think tank and non-profit. Rather than drawing attention to the larger brand of Al Jazeera, the group sought to use the Al Jazeera research entity to cloak its faux Al Jazeera video content.

Each video focused on an element of IS’ expansion globally, choosing to hone in specifically on Africa and its war with both Russia’s Wagner Group and al-Qaeda, its attacks in Moscow, its attacks on the Nigerian army, and its escalating attacks in Syria.

Besides using the videos to provide rationale and spread IS ideology, and its attacks globally, one of the first videos produced under its imitation Al Jazeera brand was an attack on the Saudi Arabian news channel Al Arabiya for “spreading lies” in an interview with the widow of now dead IS leader Abu Bakr al-Baghdadi. Amongst other revelations in the interview, Asma Mohammad, al-Baghdadi’s widow claimed he was “obsessed with women” and held “more than 10 Yazidi women as slaves.” The United Nations determined IS committed a genocide against the Yazidis, which included amongst targeted mass killings of Yazidis, a slave trade.

The War and Media page specifically called out Al Arabiya for the interview referring to them as “cowards,” and produced an Al Jazeera piece that sought to debunk the statements made in the interview. The falsified newscast began with a quote often attributed to Adolf Hitler that “if you tell a big enough lie and tell it frequently enough, it will be believed,” over images of Hitler hailing Nazi soldiers. The group then sought to paint Al Arabiya as an arm of US foreign policy choosing to broadcast lies rather than facts as it went through “debunking” the interview and Mohammad’s account of al-Baghdadi’s life. The video was even thought to be an actual Al Jazeera broadcast by one of the supporters, who asked “if this from Al Jazeera?” and was corrected by another supporter who stated it was by an IS support group. IS and its supporters have long instructed their supporters not to believe the “fake news” about the group.

The videos were meticulously branded as the news agencies and included news tickers at the bottom of the screen which adjusted to the script. These spoof newscasts were then shared through Facebook, X and YouTube, where accounts created to mimic the look and feel of CNN and the Al Jazeera Centre for Studies provided more authority.

The IS-orchestrated Crocus City Hall attack in Russia on 22 March this year, which killed 143 people, propelled this fake network content. The Kremlin sought to pin the attack on Ukraine, despite numerous official claims made by IS in the wake of the attack. On Facebook, War and Media used the moment to create a fictitious news broadcast in Arabic and in English with its fake Al Jazeera and CNN social media assets, seeding terrorist content in their names.

Figure 2: Screenshot of the ”CNN 24” YouTube Channel set up by the ’War and Media’ page and the fake newscast created by the group in order to spread IS talking points following the Crocus City Hall attack. The channel was taken down by the network.

The group’s faux CNN offering was posted to Facebook from YouTube, labelled as a “very important” video responding to “the lies about the Moscow operation.” Its fake Al Jazeera channel spread the same video, using the Qatari outlet’s branding in Arabic. The videos were viewed 9,400 times on Facebook and shared 3,200 times.

While the pages had small followings, the networked nature of IS supporters online created momentum. Supporters downloaded the faux newscasts before uploading them natively to their pages and profiles. ISD analysts found multiple instances of the videos reshared by different profiles and pages, generating more views.

Shortly after the release of the videos on YouTube, the CNN and Al Jazeera pages managed by War and Media on YouTube were shut down. What remains is the husk of what was once a faux digital news empire: two Facebook pages, a single X account still branded as Al Jazeera, and the Telegram channel, all of which have fallen silent.

The Aftermath

War and Media’s experimentation with branding IS accounts and content as mainstream news is an old tactic in these circles, but the creation of entire social media channels branded as those outlets is not.

Figure 3: The faux Netflix film produced by IS supporters in the wake of the release of the Netflix film ‘Mosul.’

Since 2019, IS supporters on Facebook have attempted to rebrand the group’s content as well-known media brands to evade moderation and boost viewership. That year, in response to the Netflix film ‘Mosul’ — where an Iraqi SWAT team hunts down IS members in the city — the group’s supporters produced their own Netflix-branded response video. It consisted of cobbled-together edits from various official videos released by IS at the time. IS supporters on Facebook built on this further by circulating official videos cloaked by using the same branding as Netflix or Amazon Studios.

In 2020, during the height of the Black Lives Matter protest movement, Islamic State supporters hijacked individual accounts and masqueraded as Black Americans; they peppered the comments sections of then-President Donald Trump’s Facebook page with content meant to incite racial violence. In 2022, Islamic State supporters impersonated OnlyFans models whose X accounts had hundreds of thousands of followers to spread their content far and wide. Many of these tactics have been used by Kremlin influence operations in the Middle East, such as the use of internet models to spread Kremlin talking points.

Many of these tactics bear resemblance to those deployed by the Kremlin, indicating that IS supporters are learning from state-backed information operations. It also demonstrates how they are building on successful moderation workarounds to cloak and spread terrorist content online. While the War and Media campaign was short-lived, it showed how a single terrorist support group could create its own parallel social media ecosystem and survive long enough to spread and share its content across multiple platforms undetected, natively uploaded by other users. The evolution of IS tactics has been ham-fisted, but the faux news network campaign illustrates support groups are learning.

Figure 4. A fake Al Jazeera newscast produced by ‘War and Media’ shared by an IS supporter on Facebook.

Conclusion

The creation of fake CNN and Al Jazeera social media channels in order to spread faux-branded newscasts in their names is a new tactic for IS support groups. War and Media’s experimentation seems to build upon not only IS supporters’ previous moderation workarounds, but also state influence operations that have become part and parcel of the information ecosystem. The group’s rapid growth corresponded with the height of its fake newscast production. As IS support groups continue to proliferate on popular social media platforms, honeypot-like campaigns such as the use of popular news brands will likely continue to build on the successes of previous exploitation measures, making it harder to curtail terrorist content spreading online.