Jihadis Shift To Using Secure Communication App Telegram's Channels Service
Inquiry & Analysis Series No. 1198, October 29, 2015
By: M. Khayat*
The following report is a complimentary offering from MEMRI's Jihad and Terrorism Threat Monitor (JTTM). For JTTM subscription information, click here.
In the last few weeks, a number of jihadis and terrorist organizations have announced that they are opening their own channels on the Berlin-based secure messaging app Telegram. Telegram's Channels Service, launched in late September 2015, allows individual message content to be transmitted to an unlimited number of subscribed users. Terrorist organizations like the Islamic State (ISIS) and Al-Qaeda in the Arabian Peninsula (AQAP) have already created several channels on Telegram for sharing their content with thousands of followers.
Telegram was founded by Pavel Durov, known as "Russia's Mark Zuckerberg." Durov also created Vkontakte (VK), a popular Russian social network website.
Jihadis' use of Telegram and other secure messaging apps has gained momentum in the last year, for purposes such as communications, propaganda, and recruitment. The new service offered by Telegram constitutes a step up from the standard one-on-one messaging function, and there seems to be no way to censor it.
One of the main strategies in combating jihadi content online has been identifying, reporting, and removing it. Currently, Telegram's channels offer no way in to monitor them, and thus are expected to pose an obstacle to this with regard to them. Also, based on the rate at which new jihadi channels are emerging, and on the large number of members they are attracting, these channels can be expected to become a fertile and secure arena for jihad-related activities.
Content shared on Telegram channels goes beyond the mere reposting of jihadi groups' propaganda, and includes tutorials on manufacturing weapons and launching cyberattacks, calls for targeted killing and lone-wolf attacks, and more. Some channels, such as those belonging to ISIS, show various levels of coordination among them, even using bots to aid their efforts.
Telegram's Channels Service
Telegram announced its channels service on September 22 as a replacement for its old Broadcast lists. As noted, the channels allow content to be shared with an unlimited number of subscribed users, either by invitation from the channel's administrator or by following a public URL.
Telegram accounts are tied to the telephone number of the user. A user must be in possession of the telephone with that number that is verified with a code sent to it by SMS or phone call. Telegram also offers a web service, telegram.me, which allows users to open a chat directly with another user by following a URL such as telegram.me/username. Telegram channels use similar URLs, which, in the case of jihadis, are frequently shared and promoted on Twitter and elsewhere. The channels also offer their subscribers a notification function for whenever new content is posted on the page. Since it is a cloud-based app, content is synchronized across a user's devices.
Telegram channels have some features and functions that are advantageous to the typical jihadi user. First, they provide relative anonymity. A channel displays only the total number of its subscribers to other users without disclosing their names. However, a channel administrator can see the names of members. The relative anonymity makes it harder to identity and track followers of a certain channel for a number of reasons: First, on a social network such as Twitter, following and follower lists are public, and therefore pro-ISIS accounts can be cross-referenced by checking the accounts that they follow and those that follow them. Second, Telegram users can forward content they find on the channel to other Telegram users, thus heightening the sharing and dissemination of jihadi content. Third, messages on the channels are transmitted in a single direction, and no reverse interaction from channel subscribers to the broadcaster is possible. This eliminates the possibility of counter-messaging and the disruption of a content's feed, both of which are used on Twitter as a strategy to counter extremist propaganda. Finally, Telegram provides a client-server/server-client encryption as a default option, which, in theory, adds security to the entire interaction.
Reporting Illegal Content On Telegram Channels
One of the ways to combat jihadi content posted online is to identify it and subsequently flag or report it whenever feasible. This strategy, albeit not the most efficient, has been used with varying levels of success on platforms favorited by jihadis such as YouTube, Twitter, and Facebook. Telegram channels do not have a flagging mechanism; moreover, they appear to operate as a "no man's land" away from any moderation, even moderation by the company itself.
In writing this report, MEMRI contacted Telegram with questions on how to report content on its channels, such as ones promoting violence, for example. Telegram wrote in response that its private and group chats (likely referring to its channels service) were the "private territory" of their respective participants, and that the company did not process any requests related to them. Telegram added that only complaints concerning its bots and sticker sets (an emoji-like feature) could be submitted; both features are publicly available services. Telegram's October 21, 2015 response read as follows: "Hi there. All Telegram chats and group chats are private territory of their respective participants and we do not process any requests related to them. But sticker sets and bots on Telegram are publically available. If you find sticker sets or bots on Telegram that you think are illegal, please ping us at [email protected] But please understand that we only accept such reports."
It seems that Telegram's overall approach to the issue is reflected in the last sentence of its response: "By the way, you can always leave a channel you dislike."
Telegram has an application program interface (API) for bots as well. The API allows a user to connect bots, which are special accounts designed to automatically handle messages, to Telegram servers. Telegram Bots do not require an additional phone number to set up. Bot usernames always end in "bot." The Islamic State has a handful of Telegram bots (see "ISIS Bots" below) which aid it in its propaganda efforts.
The following are jihadi channels found on Telegram. Note: The channel URLs are redacted but MEMRI has a full list in its possession.
Jihadi Telegram Channels
Nasher is currently the flagship of ISIS-related news on Telegram. Nasher was already associated with ISIS when it operated as a webpage (Nasher.me) and as an app as well.
Nasher operates a number of channels on Telegram that provide ISIS-related news in a number of languages. The main hub of those different channels appears to be the Arabic-language Nasher channel, whereas the remaining channels offer various translations and content summaries. Also, content posted on the Nasher channels mirrors ISIS releases that appear on Twitter and on the Shumoukh Al-Islam forum.
Nasher English channel on Telegram
Nasher channels are offered in the following languages: Arabic (over 10,000 members); English (998 members); French (348 members); Indonesian (1,076 members); German (340 members); Bosnian (201 members); Turkish (181 members), and Bengali (159 members).
Instructions from one of the Nasher channels on how to forward content to other users
The ISIS-affiliated A'maq news agency channel provides around the clock updates on the Islamic State, focusing primarily at ISIS's military operations. A'maq had previously operated on Facebook, but its pages there were constantly shut down by administrators. A'maq's channel was created on October 1, and currently has over 9,000 members.
A generic channel that publishes ISIS-related news, mostly reposting of various official ISIS releases. It currently has 300 members.
Russian ISIS News
Opened on October 8, the channel delivers ISIS-related news in Russian. It currently has 1,919 members.
ISIS news channel in English, and currently has 1,711 members.
Promotion of the KhilafaNews channel on pro-ISIS Twitter account (Source: @mhistory087, October 12, 2015)
News for Libya is an unofficial channel reporting about ISIS operations in Libya. The channel currently has over 500 members.
"Libya and The Honor of the Caliphate"
Also an unofficial channel reporting about ISIS activities in Libya. The channel publishes various religious content as well. It currently has 1,437 members.
An unofficial channel publishing ISIS news from Sinai. The channel is named after Abu Suhaib Al-Ansari, a slain commander of ISIS in Sinai. The channel currently has 437 members.
"Elite Section Of IS"
The channel posts cyber-related content by a number of ISIS hackers. The channel states that it is the official channel of the "Islamic Cyber Army" and the so-called "Elite Section" of the Islamic State hackers. The channel was created on October 15, and currently has 698 members.
Top members of ISIS's cyber channel
Fursan Al-Rafi' ("Knights of Upload")
With over 3,000 members, the Fursan Al-Rafi' channel is dedicated to uploading ISIS releases on various hosting websites, including YouTube, the Internet Archive (Archive.org), Sendvid, Google Drive, and others.
A channel that offers a "library" of ISIS releases. It has over 2,600 members.
A channel belonging to Al-Battar media foundation, a prominent pro-ISIS media entity. It currently has over 4,400 members.
Publication Knights Workshop
A channel that focuses on generating pro-ISIS Tweets, which members can readily copy and paste to their Twitter accounts. The channel is affiliated with Al-Battar media, and currently has 1,205 members.
Opened on September 30 and currently has over 480 members, the channel is dedicated to publishing the names of anti-ISIS Twitter accounts for the purpose of reporting them to Twitter. The channel also offers instructions on how to use the reporting function on Twitter.
Instructions on reporting anti-ISIS Twitter accounts
The channel is connected to one of ISIS's bot channels (see "ISIS Bots" below) that focuses on providing various refutations to anti-ISIS allegations. The channel is relatively focused on Saudi Arabia, attacking the Saudi regime and the Shi'ites in the country. It currently has over 3,200 members.
Telegram has several ISIS channels that are run by bots. These channels, who all have a "bot" suffix, provide various functions. It is worth noting that bot channels do not display their number of members. The following are ISIS bot channels:
A channel dedicated to refuting ISIS opponents. Once a user joins the channel, they are presented with various clickable boxes. The label for each box pertains to an area of criticism against ISIS or an area where ISIS propaganda efforts are directed. Clicking the box posts its content into the user's thread. Below is a sample of these topics, which include criticism of the Al-Saud monarchy; responses to questions concerning the Islamic Caliphate; refutations of arguments made by the Taliban and Al-Qaeda leader Ayman Al-Zawahiri, and more.
Once running, this bot will periodically post ISIS-related news into a user's thread.
This bot will post ISIS releases from its official and affiliated media companies into a user's thread.
"What can this bot do?" Response in Arabic: "Publish releases from [Islamic State] media companies, and media [companies] of [its] provinces, and [releases] from pro[-ISIS media] companies." (Source: Videodila Bot, October 21, 2015)
Publishes ISIS-related images.
Publishes ISIS nasheeds, addresses by jihad leaders, and Koran recitations.
Publishes ISIS official nasheeds from ISIS's official audio production company Ajnad.
This bot connects directly to the Isdarat website where ISIS releases are constantly posted. This bot notes that it might often be unreachable due to the Isdarat website being offline. Isdarat has changed its domain names several times already due to repeated attacks against it.
This bot is connected A'maq news agency and posts items from it into a user's thread.
This bot provides tutorials on graphic design and media production in support of ISIS.
Al-Qaeda in the Arabian Peninsula (AQAP TV)
The channel, which has over 2,700 members, circulates releases and statements from Al-Qaeda's branch in Yemen.
A sample of links shared on AQAP's Telegram channel to a recent video from the group. Links to various video hosting platforms can be seen (Source: AQAP TV, October 23, 2015)
Al-Manara Al-Bayda' is the media wing for Jabhat Al-Nusra (JN), Al-Qaeda's Syrian branch. The channel was created on October 21, and currently has 4,648 members.
Global Islamic Media Front (GIMF)
Created on October 2, the channel publishes content from the Al-Qaeda affiliated Global Islamic Media Front (GIMF). It currently has 1,055 members.
GIMF channel promoting the second issue of the Jabhat Al-Nusra (JN) English-language magazine Al-Risalah
Military Preparation And Incitement
"Be a [Lone] Wolf"
A channel dedicated to sharing military training and weapons manufacturing for the purpose of carrying out attacks. The channel focuses on Saudi Arabia and issues repeated calls to carry out lone wolf attacks there. The channel's moto is "Expel the polytheists from the Arabian Peninsula."
The channel was created on October 18, 2015, and currently has 51 members.
The Channel's description reads: "Posting messages and military-related information directed at lone wolves, especially those in the place of [Islam's] revelation [i.e. Saudi Arabia]."
The channel's profile pic with the caption: "Lone Wolves: Soon [Will Be] My Turn"
The channel publishes jihadi posters privately created various graphic designers. The channel is always on the lookout for new "talent," and also holds competitions. It has over 1,100 members. Poster topics vary but include incitement for violence as well.
Poster showing various methods of killing people. Top caption in red reads: "It is my turn." Center image is of a wolf, a reference to lone wolf attacks (Source: Jihadi Designs, October 26, 2015)
A general channel that publishes items pertaining to the "jihad and mujahideen in the Arabian Peninsula." The channels appears unaffiliated with any jihad group, publishing items ranging from ISIS's Najd Province in Saudi Arabia to AQAP. The channel also publishes names and details of wanted Saudi security personnel along with calls for lone wolves to kill them.
The channel was created on September 30, 2015, and currently has 1,047 members.
A picture of an "apostate" Saudi interrogator along with his home address and vehicle information. The caption next to the knife image at the bottom reads: "wanted for slaughter."
*M. Khayat is a research fellow at MEMRI.
 See MEMRI Inquiry & Analysis Series No. 1168, Encryption Technology Embraced By ISIS, Al-Qaeda, Other Jihadis Reaches New Level With Increased Dependence On Apps, Software – Kik, Surespot, Telegram, Wickr, Detekt, TOR: Part IV – February-June 2015, June 15, 2015.
 Telegram offers a more secure chat option called Secret Chat, which uses end-to-end encryption, and includes features like message self-destruct.
 Telegram users can send direct messages to the company from their accounts.
 See MEMRI JTTM report, ISIS-Affiliated News Agency A'maq Remains Active On Facebook Despite Consecutive Shutdowns, March 5, 2015.
 See MEMRI JTTM report, Following Repeated Shutdowns, Prominent Website Disseminating ISIS Materials Resurfaces With New Doman Name – Isdarat.pw, October 15, 2015.