From message boards to TikTok: al-Qaeda’s two decades of internet exploitation

13 September 2024

By: Moustafa Ayad

The Islamic State’s affiliates have in recent months been in laser focus, with its multi-platform digital footprint being picked apart and analysed in the wake of failed inspired plots across the globe and centrally coordinated attacks inside of Europe. In comparison, little to no attention has been spent on an equally established al-Qaeda online ecosystem  which has thrived for more than 20 years on the open web, and has an online footprint older than the 9/11 attacks.  

On the anniversary of the 9/11 attacks, and 10 months removed from a TikTok and X [formerly Twitter] fad that resurrected a two decade old Osama bin Laden screed, ISD researchers dove once again into the digital ecosystem of al-Qaeda, which is often seen in comparison to the Islamic State as uninspiring, but that has survived waves of bans and takedowns only to continually regenerate and reinvent itself online for the past 20 summers. At its zenith, almost 16 years ago, terrorism scholars noted that al-Qaeda operated 5,600 websites, with 900 new sites, blogs, and forums appearing every year.   

While the heyday of al-Qaeda online is long past, and millions of dollars have been spent on degrading the appeal and impact of al-Qaeda’s digital footprint, its story of survival in the shadow of the Islamic State and the rise of new social media platforms, provides an apt lesson about the impact of terrorist exploitation of the internet — they just keep coming back.  

It is true that al-Qaeda is a shell of its former self, but it is also true that it is reconstituting itself in Afghanistan, holding its own and expanding in the Sahel, turning to its once most lethal affiliate in the Arabian Peninsula in a bid to inspire attacks in the West, and relying on the successes of al-Shabaab, both offline and online, to drive engagement— all the while escaping some of the same scrutiny applied to the Islamic State’s digital assets.  

In the shadow of the (online) Islamic State 

The most recent example of this dynamic happened in June 2024, when a coordinated action via Europol and the justice departments of the governments of Spain, the United States, Finland, the Netherlands and Germany took down key web websites linked to the Islamic State. The blow was so decisive that even their ‘dark web’ mirror presence went dark. It was a swift and rapid series of decisive takedowns from which the Islamic State has yet to recover, despite a half-hearted attempt by the group’s supporters to mirror and resurrect its assets on the dark web before they were similarly targeted by both governments and a hacking collective known for taking down terrorist-run websites.  

The Islamic State’s channels linked to these websites on Telegram were similarly stymied before returning to the messaging application. Most recently one of the largest Islamic State’s on the open web, consisting of 2.1 terabytes of content, was taken offline, again, dealing a decisive blow to the open web presence of the group. This was undoubtedly countered by numerous archive channels spread across messaging applications that provide supporters with reams of both current and legacy IS-linked content.  

Unscathed in this most recent government action were the primary websites of al-Shabaab, al-Qaeda in the Arabian Peninsula (AQAP), al-Qaeda archives and other al-Qaeda forums. These were groups and sites that have long had a presence online, including the takeover of a makeshift X knock-off, named Chirpwire, which hosts a range of al-Qaeda support arms and outlets operating in several languages. The platform has been slow to update, and is admittedly full of kinks, yet remains a spigot of propaganda linked to al-Qaeda.  

Data suggests al-Qaeda-linked attacks in the west have slowed, but attacks in sub-Saharan Africa and elsewhere persist. This can be attributed in part to al-Qaeda’s shift in strategy, but also to leadership vacuums resulting from continuous pressure from governments after 9/11, manifesting in the arrests and targeted assassinations of key ideologues and personnel.  

Al-Qaeda’s websites are similarly still in the shadow of the online presence of the Islamic State. Data points using the website analytics platform SimilarWeb indicate that one of the Islamic State’s primary forums online draws in an average of 19,000+ unique visitors a month versus a primary al-Qaeda forum’s 1,800+ unique visitors a month. Similarly, the same Islamic State forum has a much more Western visitor base compared to its al-Qaeda counterpart, whose visitors come more from the Middle East, Africa and Asia.  

In another head-to-head comparison, the Islamic State’s Raud website averaged 83,300+ unique visitors a month over the summer before it was taken offline by the joint Europol action. Al-Shabaab’s website meanwhile, while not directly similar in scope, averaged a paltry 941 unique visitors a month in the same period. These data points confirm that even in the internecine battle for Salafi-jihadist eyeballs, al-Qaeda is losing to the Islamic State, which paints a picture of a much larger and more pressing target for governments.  

Much of this dynamic can be attributed to the steady series of attacks, plots, and arrests linked to Islamic State, not to mention the relatively recent history of almost 40,000 foreign fighters flooding into the group’s makeshift ‘caliphate.’ The Islamic State is similarly buttressed by numerous propaganda arms linked directly to its affiliates and the unofficial support groups that have emerged over the past 10 years. ISD has tracked 74 unofficial propaganda groups supporting the Islamic State during that time, some of which are defunct, some of which arose from a long slumber, and some of which have just been born on a specific platform. 

Al-Qaeda’s online resilience 

While some of these dynamics exist in the al-Qaeda digital ecosystem, the group has managed to keep its online presence more stolid, a boomer-like persistence in using the web in a top-down fashion. The Islamic State meanwhile has found its footing as both a terrorist disruptor, and early adopter of technology online. Much of this can be attributed to unofficial outlets and groups that have diversified the Islamic State public relations portfolio to new platforms that are untouched by al-Qaeda counterparts, such as the short-lived Islamic State wiliyah, or province, that existed on a decentralised platform known as Amino, or the co-opting of the alt-tech X knockoff Gettr.  

In the post-October 7 reality, governments and platforms have had to reckon with how established foreign terrorist organisations have gained footholds on platforms through direct presence, proxy brands, or supportive communities that revel in their content. In an increasingly diffuse online threat environment, al-Qaeda is no longer the sole focus, as various groups now spread across platforms like Facebook, X, TikTok, YouTube, and messaging apps like Telegram, Discord, RocketChat, Threema, and Element.

Al-Qaeda has a similar spread on these platforms and competes for eyeballs and clicks in the same Salafi-jihadist space as Islamic State, or a range of other groups. Its message is diluted in the current landscape. Even attempts to resurrect its relevance on these platforms seem hatched by internet activists or prized outlets of the past: the 60+ “Inspire Tweets” it has been pushing since June, which call for attacks in western states; and a return to the “open-source jihad” principles of its Inspire Magazine. Ongoing ISD analysis shows evidence of automation being leveraged by al-Qaeda supporters on Facebook to pump out exact same content as their Telegram channels, and pages dedicated to al-Qaeda influencers with more than 5,600 followers, indicating they are having success in staying online. In 2022, ISD found that al-Shabaab, the Somalia-based al-Qaeda affiliate, was operating basically unencumbered on Facebook, promoting branded content, and pumping out content in a range of East African languages.   

Looking ahead 

If anything, another somber anniversary of September 11 — more than 20 years later —, proves that the challenge of internet exploitation by al-Qaeda is a long-term problem that will not go away anytime soon. The ability of al-Qaeda’s propaganda and support communities to adapt is part of the story of the post-9/11 reality and an apt example of it. While the past 20 years have been punctuated with strategic success offline against al-Qaeda, whether through targeted assassinations or arrests, the coming period — with a reestablishment of training camps and a more muscular approach to the Sahel — may soon test those global wins. The online presence of al-Qaeda follows a similar trajectory, one where the vast nature of its spread has been slowed by a persistent focus on its digital territory by its opponents, resulting in a much less effective online machine. However, unlike the offline success of counterterrorism joint operations, the group has been able to test the limits of containment as a strategy by adopting new platforms and messaging applications.  

The strategic effort to limit al-Qaeda’s influence online almost two decades on, does call into question the need to find new modes to disrupt and ultimate degrade the group further. There is no question the internet has proven fertile territory for al-Qaeda, but it doesn’t have to continue to be that way; if there is anything to be learned from the past 20 years of their existence on the open web.