Jihadi Use Of Encrypted Messaging App WhatsApp

Note to media and government: For a full copy of this report, send an email with the title of the report in the subject line to media@memri.org. Please include your name, title, and organization in your email.

 

Introduction

WhatsApp, the most widely used messaging app worldwide[1] – used by over 1 billion people in over 180 countries[2] – is also of late growing in popularity among jihadi groups and individuals and their supporters, including the Islamic State (ISIS), Al-Qaeda, Hizbullah, the Taliban, and others. WhatsApp was founded in 2009 by ex-Yahoo! employees Jan Koum and Brian Acton. Koum was ranked No. 140 in the Forbes 2017 list of the world's billionaires, with a net worth of $9 billion, and Acton was ranked No. 269 in the same list, with a net worth of $5.6 billion.[3] The app was bought by Facebook in February 2014 for $19 billion.

With its end-to-end encryption and ease of use on both smartphones and, now, desktop computers – with the desktop version being very similar in design and function to Telegram[4] – WhatsApp is regularly used by these extremists not only for exchanging messages, but also for disseminating jihadi news and other publications, media productions, and photos, as well as recruitment and fundraising. In their communications, they also regularly use images denoting jihad and martyrdom. Jihad fighters on the front communicate via WhatsApp with sympathizers in other countries who are eager for news on the ground, interested in joining up, or supporting the organization or individual financially or in other ways at home.

Desktop Version Of WhatsApp: Group Members On Left, Messages In Center, Group Info On Right 

As WhatsApp continues to gain in popularity among jihadi users, we expect that, since WhatsApp is owned by Facebook, the platform will become more adept at removing jihadi content, following the Facebook model.

This report will present MEMRI research on how jihadis and jihadi organizations are using WhatsApp; on WhatsApp's Terms of Service; on how the platform is being used in terror attacks in the West, and for disseminating content, fundraising, recruiting, and other communications; on how its jihadi users are disseminating imagery of ISIS, jihad, and martyrdom; and how links to jihadi content on it are being shared on other platforms. The MEMRI research included in this report also reveals the wide-ranging geographic locations of jihadi WhatsApp users as may be indicated by their phone numbers – which appear to be from 41 U.S. states and 73 countries but may be merely virtual or temporarily numbers – and jihadi WhatsApp group chats that MEMRI has discovered.

TABLE OF CONTENTS

I. HOW JIHADIS ARE USING WHATSAPP

II. WHATSAPP TERMS OF SERVICE BAN "PROMOTING VIOLENT CRIMES" ON THE PLATFORM; WHATSAPP SAYS IT WILL "REVIEW AND RESPOND TO LAW ENFORCEMENT REQUESTS BASED ON APPLICABLE LAW AND POLICY" AND WORKS WITH FACEBOOK TO REMOVE TERRORIST ACCOUNTS

III. WHATSAPP USED IN TERROR ATTACKS IN U.S., U.K., EUROPE

IV. WHATSAPP USED BY JIHADIS FOR DISSEMINATING CONTENT, FUNDRAISING, RECRUITING, AND OTHER COMMUNICATIONS – WITH AVATARS DENOTING ISIS, JIHAD, MARTYRDOM

V. WHATSAPP GROUP CHATS

VI. JIHADIS DISSEMINATE WHATSAPP LINKS ON TELEGRAM
 

I. How Jihadis Are Using WhatsApp

WhatsApp allows users to send photos, videos, and audio files. The end-to-end encryption system utilized by WhatsApp is extremely attractive to jihadis, as it allows them to communicate among different elements, such as terrorist cells, support networks, or even ISIS in the Middle East with relative impunity. The anonymity that the WhatsApp service provides is also conducive to providing an environment in which radicalization can occur. In addition, it allows a relatively unmonitored spread of extremist ideology through vulnerable groups and communities. Jihadis are using WhatsApp in four main ways:

As a secure communications platform:

• For communication among cells and jihadi leadership.

• For coordination of support networks and elements, domestically and internationally.

• For discussion and formulation of individuals' plans to join jihadi elements abroad.

As a platform for radicalization and recruitment:

• For disseminating training materials for making explosives and carrying out various forms of attacks.

• For "grooming" young potential recruits.

As a platform for discussion forums to further spread extremist ideology:

• For discussions of extremist ideology.

• For sharing jihadi organizations' and other extremists' news and events.

As a fundraising and sales platform:

• For selling of jihadi-related wares such as ISIS flags and backpacks, wallets, and magnets, as well as weapons and military surplus items.

• For donation campaigns,[5] such as the "Equip a Fighter" campaign.

Jihadis Share Information For More Effective Use Of WhatsApp

Additionally, jihadis are always looking for ways to enhance and upgrade their use of platforms such as WhatsApp. For example, on August 2, 2017, the pro-Islamic State (ISIS) Horizons Foundation, aka the Electronic Horizon Foundation, posted two infographics showing readers how to activate the two-step verification feature on WhatsApp and Telegram.

II. WhatsApp Terms Of Service Ban "Promoting Violent Crimes" On The Platform; WhatsApp Says It Will "Review And Respond To Law Enforcement Requests Based On Applicable Law And Policy" And Works With Facebook To Remove Terrorist Accounts

While WhatsApp's Terms of Service do not explicitly prohibit the use of the platform by terror groups or terrorists, designated or otherwise, it does state that it must not be used for "defamatory, threatening, intimidating, harassing, hateful, racially or ethnically offensive" communications or "instigate or encourage conduct that would be illegal or otherwise inappropriate, including promoting violent crimes."[6]

WhatsApp Publishes "Information For Law Enforcement Authorities"

During the summer of 2017, WhatsApp published on its website "Information for Law Enforcement Authorities." It stated "WhatsApp appreciates the work that law enforcement agencies do to keep people safe around the world. We are prepared to carefully review, validate and respond to law enforcement requests based on applicable law and policy" and added operational guidelines for law enforcement officials seeking records from WhatsApp, for example in emergencies such as a terrorist attack or threat of an attack. [7]

WhatsApp Working With Facebook On Cross-Platform Removal Of Accounts Involved In Terrorism

Earlier, in June 2017, Facebook announced that it was now working with WhatsApp on cross-platform takedowns of accounts involved in terrorism, saying that "we don’t want Facebook to be used for any terrorist activity whatsoever." It continued: "[W]e have begun work on systems to enable us to take action against terrorist accounts across all our platforms, including WhatsApp... Given the limited data some of our apps collect as part of their service, the ability to share data across the whole family is indispensable to our efforts to keep all our platforms safe."[8]

WhatsApp Finishes Rolling Out Default End-To-End Encryption

WhatsApp users' phone numbers are visible to other participants. In April 2016, WhatsApp announced that it had completed the years-long deployment of an end-to-end encryption feature to the app and that the feature was now on by default.[9] However, prior to this there were cases in which it was learned that terrorists had used WhatsApp in connection with attacks, such as in 2015 in Belgium.

Users Can Generate Virtual/Temporary Phone Numbers To Create WhatsApp Accounts With Misleading Numbers

In order to create a WhatsApp account, a potential user must input a verification code sent via text message. This shows that the user has access to and control of the phone number that they are using. However, the Internet is full of information on services allowing users to generate virtual and/or temporary phone numbers that appear to be based in the U.S. or other countries.[10] Jihadis are looking to exploit this; MEMRI researchers have found numerous discussions on jihadi social media accounts and other platforms about creating such virtual numbers for opening accounts on WhatsApp and other messaging apps.[11] Note: It should be kept in mind that phone numbers mentioned in this report that appear to be from the U.S., Canada, and Western countries could be virtual and/or temporary and may not actually be from those countries.

WhatsApp Encourages Users To Report "Problematic Content"

WhatsApp states on its website: "We encourage you to report problematic content to us. Please keep in mind that to help ensure the safety, confidentiality and security of your messages, we generally do not have the contents of messages available to us, which limits our ability to verify the report and take action. When needed, you can take a screenshot of the content and share it, along with any available contact info, with appropriate law enforcement authorities." It adds that "[w]e may ban accounts if we believe the account activity is in violation of our Terms of Service."[12]

III. WhatsApp Used In Terror Attacks And Terror Cases In U.S., U.K., Europe

Over the past few years, there have been a number of terror attacks in the U.S., U.K., and Europe in which jihadi operatives used WhatsApp prior to and during attacks for planning, communication, and coordination. The following are some examples of attacks and other jihadi communications on WhatsApp:

MEMRI JTTM Finds That Indicted Pro-ISIS Jamaican Sheikh Abdullah Al-Faisal Communicated With Followers Via WhatsApp

The MEMRI Jihad and Terrorism Threat Monitor (JTTM) recently found, in its ongoing monitoring, that the Jamaican pro-ISIS sheikh Abdullah Al-Faisal, arrested in Kingston, Jamaica and indicted in August 2017 on charges of recruiting would-be terrorists in New York, communicated with his followers via WhatsApp. His followers expressed concern on WhatsApp about their messages to the sheikh that went unanswered, before they found out about his arrest. Al-Faisal is said to have inspired terrorists ranging from shoe bomber Richard Reid and 9/11 plotter Zacarias Moussaoui to London bombers Muhammad Sidique Khan and Germaine Lindsay and Christmas Day bomber Umar Farouq Abdulmutullab.[13]

ISIS Used Social Media – Including WhatsApp – To Seek Out Muslim Teens To Carry Out June 2017 London Bridge Attack, Earlier Attacks

A two-year BBC investigation has found that ISIS recruiters, as well as ISIS fighters in Syria, have attempted to use social media to recruit young Muslims in the UK, including teens, to carry out attacks locally. According to the investigation, a year prior to the June 3, 2017 London Bridge vehicular and stabbing attack, ISIS fighters in Syria used this method to encourage an attack at that site, telling one potential recruit to use a "truck, axe anything can work." It was also found that ISIS recruiters – among them British jihadi Junaid Hussain – had reached out to this audience as early as June 2015, inviting them to communicate on encrypted messaging apps such as WhatsApp, urging attacks in London, "the heart of the crusader army," and saying, "You wanna do something over there?... We can train you, how to make bombs. Easy ticket to Jannah [Paradise]." Other recruiters directed potential recruits to terror tutorials on the dark web, including instructions for making bombs and for inflicting maximum damage in stabbing attacks.[14]

Junaid Hussain.

Perpetrator Used WhatsApp Moments Before Launching London Houses Of Parliament Attack

Khalid Masood, the perpetrator of the March 22, 2017 attack outside the Houses of Parliament in London, was reported to have used the app just moments before he launched the attack.

Khalid Masood (Standard.co.uk, March 28, 2017).

As a result, UK Home Secretary Amber Rudd called for police and intelligence agencies to be given access to WhatsApp, along with other encrypted messaging platforms, to thwart future attacks. It was "completely unacceptable," she said, that the government could not read messages protected by end-to-end encryption, and added that WhatsApp must not "provide a secret place for terrorists to communicate."[15]

UK Elementary School Special-Needs Teacher Arrested, Charged For Distributing Terrorist Material Via WhatsApp

On August 29, 2017, elementary-school special-needs teacher Sadia Malik, from Wales, appeared in Westminster Magistrates Court after being arrested and charged in January 2014, together with her husband Sajid Idris, with distributing terrorist material. She is accused of using WhatsApp to send YouTube links and links to a website connected to UK jihadi preacher Omar Bakri Muhammad. One of the videos described tactics for fighting in Syria and Iraq, and another described how martyrs would be still be smiling even if decapitated. She and her husband are both also alleged to have links to the imprisoned cleric Anjem Choudary's banned Al-Muhajiroun organization.[16]

Source: Uk.news.yahoo.com, August 28, 2017.

UK Report On ISIS Manual For Recruiting On WhatsApp

An October 6, 2015 UK report details how an ISIS training manual recovered by U.S. forces in 2009, titled "A Course in the Art of Recruiting," sets out step-by-step methods used by ISIS groomers on messaging platforms, including WhatsApp. In one case, Boy S, a 15-year-old Blackburn teen, was convicted of inciting terrorism after he exchanged more than 3,000 encrypted instant messages with Australian teenager Sevdit Besim in which they discussed a potential terror plot centered around the yearly ANZAC Day parade.[17]

Sevdit Besim.

UK Woman Used WhatsApp to Communicate with Known Jihadi

A December 11, 2014 U.K. report detailed how social media was used to radicalize a British woman, Runa Khan, who was imprisoned for spreading ISIS ideology. She used WhatsApp to attempt to find a way into Syria. She also communicated with Mohammed Nahin Ahmed, who had been imprisoned for going to Syria for jihadi training. Khan discussed the possibility of finding a jihadi to marry and said she would bring her young children with her.[18]

Runa Khan, Mohammad Nahin Amhed.

UK Terror Suspect Found To Have Praised ISIS, Promoted Jihad On WhatsApp

Terror suspect Taha Hussain, 21, a dual British-Pakistani national living in Slough, Berkshire, accused of making dozens of pro-jihad videos of himself and his friends, of attending meetings with known extremists, and of distributing speeches supporting ISIS, was found to have used WhatsApp to send pro-ISIS and pro-jihad content. Among the content sent was a July 2015 message titled "Lions of the UK" promoting jihad, files titled "Paris Outrage: A Muslim Perspective," glorifying the November 2015 Paris attacks, and more. The prosecutor in the case said: "In essence, it is alleged that when all this material was sent, it was done with the intention that it would be understood by its recipients as a direct or indirect encouragement to the commission, instigation or preparation of acts of terrorism."[19]

Kingston Crown Court where Taha Hussain's case is being heard. Dailymail.co.uk, March 8, 2017.

Buffalo, NY Man Used WhatsApp To Discuss Plans To Travel To ISIS Territory

Arafat Nagi, from Buffalo, New York, used WhatsApp to talk about his plans to travel to ISIS-held territory. In one WhatsApp conversation on August 27, 2013, he said: "I didn't stay to [sic] long I had to come back home because gallbladder almost burst had to a emergency flight back in sha Allah I'm making plans to go again." In 2014, he did travel to Turkey and Yemen, preparing for it by purchasing combat gear. His other social media accounts indicate his support for ISIS. In 2015, he was planning on returning when he was arrested.[20]

Arafat Nagi.

Rochester, NY Man Used WhatsApp To Plan Trips To Syria And Raise Funds For ISIS

Mufid Elfgeeh, a pizza shop owner from Rochester, New York, used WhatsApp to declare his allegiance to ISIS and to fundraise for it. In the summer of 2014, WhatsApp was forced to turn over the numbers Elfgeeh used on its application through a court warrant. However, even with the warrant it was difficult to access Elfgeeh's content. Elfgeeh did acknowledge that he communicated with a Jordanian individual in Syria through WhatsApp; the Jordanian was urging Elfgeeh to join ISIS in Syria. The search warrant describes how Elfgeeh used WhatsApp to tell the Jordanian that an informant "wanted to go to the college/university, which is a coded reference to [the informant] traveling to Syria to join ISIL." Elfgeeh also communicated via WhatsApp with a Yemeni individual, who advised Elfgeeh to tell his informants to travel to Turkey before entering Syria. Elfgeeh pled guilty and was sentenced to 22 years in prison.[21]

 
Mufid Elfgeeh.

Virginia Woman Communicated With ISIS Member On WhatsApp

On May 11, 2015, Heather Elizabeth Coffman was sentenced to four and a half years in prison for attempting to aid ISIS. Coffman communicated with an ISIS facilitator on WhatsApp after the facilitator's Facebook account had been disabled. In November 2014, she messaged the facilitator seeking to coordinate a friend's travel into Syria to join ISIS. In addition to her attempts to aid ISIS, her other social media accounts demonstrated consisted and active support for the terrorist group.[22]

Heather Elizabeth Coffman.

Leader In November 13, 2015 Paris Attacks Explains To Attackers How To Use WhatsApp For Secure Communications

The Syria-based Belgian national Abdelhamid Abaaoud, a major figure in the November 13, 2015 Paris attacks, included in his selection, training, and deployment of jihadis to Europe in 2014 and early 2015 instruction in using secure communications, including WhatsApp, and set up protocols for contacting them once they were in place using them.[23]

  
Abdelhamid Abaaoud. MEMRI JTTM, February 12, 2015.

Najim Laachroui, a coordinator for the Paris attack and one of the suicide bombers in the March 2016 Brussels attacks, used WhatsApp for coordination among the members of his cell of jihadis as well as with ISIS figures in Syria. In April 2015, police heard a Moroccan suspect living near Milan in whose car they had placed a microphone listen to a recorded WhatsApp message from an unidentified senior ISIS figure in Syria urging him: "Detonate your belt in the crowds declaring Allah Akbar! Strike! (Explode!) Like a volcano, shake the infidels, confront the throng of the enemy, roaring like lightning, declare Allah Akbar and blow yourself up, O lion!"[24]

Belgian Police Arrest Two After Monitoring Communications On WhatsApp

On June 8, 2015, it was reported that two people were arrested and arrest warrants were issued for three others as part of a series of 21 simultaneous anti-terror raids against Chechen jihadi groups operating in Belgium. The arrests were based on police information gleaned from the communications of a returning fighter from Syria. According to investigators, at least 16 people had also been detained in the raids using information gained from a joint Belgian-FBI monitoring of the suspects communications on the WhatsApp messaging service (note: this incident occured before WhatsApp completed its rollout of its default end-to-end encryption feature).[25]

Source: BBC.com, June 8, 2017.

Interception Of WhatsApp Communications Led To Arrest Of Jihadi Chechen Groups In Belgium

On June 9, 2015, it was reported that the anti-terror raids conducted against two Chechen groups in Belgium had been made possible by intercepting communications between suspects over WhatsApp. At the time of the arrests, neither Apple iOS nor Android operating systems supported end-to-end encryption systems such as WhatsApp's. It is possible that authorities could have utilized the metadata present on the server to establish connections between the suspects, which would have allowed more targeted surveillance by Belgian authorities to take place.[26]

Group Arrested In Brazil For Terror Plot Against Olympics; Group Members Communicated Via WhatsApp

In July 2016, Brazilian authorities arrested 10 members of a pro-ISIS group on suspicion of planning terrorist attacks during the Olympic Games in Rio de Janeiro the following month. Group members, all Brazilian citizens and some of whom had sworn allegiance to ISIS on social media, did not know each other personally but maintained contact with each other via WhatsApp.[27] 

Source: Reuters, July 21, 2016.

Jerusalem Attacker Found To Be Part Of Extremist WhatsApp Group

On March 19, 2017, it was reported that Israeli police had arrested 18 members of a WhatsApp group named The Path to Heaven which was allegedly used to plan a stabbing attack against police officers at the Old City of Jerusalem's Lions' Gate. Two officers were attacked and moderately wounded by the assailant who entered a guard booth holding a large butcher's knife. The assailant was shot after a brief struggle and later died of his wounds. According to police, the group was set up to spread extremist ideology and the members had been recently radicalized.[28]

Ibrahim Mahmoud Matar.

Two Malaysian Men Used WhatsApp To Collect Information And Discuss Support For ISIS

According to a September 9, 2015 report, two men in Malaysia, Mohd Syafrien and Mohamad Yusoffe, had utilized a variety of social media platforms including Facebook, YouTube, and WhatsApp, in order to discuss plans for 'jihad' as well as research the ongoing Syrian Civil War. Specifically, they shared information on the fighting in Syria through the "Jihad Fisabilillah" WhatsApp group. They also joined another WhatsApp group called "Melancong" which attempted to support ISIS in Syria.[29]

Mohd Syafrien and Mohamad Yusoff.

Pakistani Fighter In Syria Used WhatsApp To Connect With Fighters In The Punjab Region, Pakistan

In December 2015, police in Karachi, Pakistan detained six women thought to be recruiting other women for ISIS, and police in Sialkot arrested eight young men who were recruiting for ISIS and who were found to be in possession of weapons, explosives, and CDs with ISIS literature. Police said that these men "told us that a local from their area, Rizwan or Abu Muawiya, was in Syria" and that "he would connect with them through WhatsApp." The Pakistani government has vowed to not let the ISIS ideology into their country through preventing Pakistani ISIS fighters' reentry, but WhatsApp-style communications can bypass those efforts.[30]

ISIS Operative Recruits Via WhatsApp In India

Following the October 2016 arrest of six men from Kerala state, India who were allegedly planning terror attacks in the country, Indian authorities are searching for an ISIS operative who they say opened at least two WhatsApp groups with hundreds of people to send messages urging them to join ISIS. The man, Abdul Rasheed, an engineer who left the country in 2016, is thought to be hiding in Afghanistan. He is believed to be responsible for indoctrinating 21 people, among them pregnant women, who have left India since last year to join ISIS.[31]

 
Source: NDTV.com, May 31, 2017.

Messages From Jihadis Before They Are Killed Go Viral On WhatsApp In India

Audio and video recordings of jihadis' final messages before they are killed are going viral in India, including via WhatsApp. One such message was by Lashkar-e Taiba commander Abu Dujana, who was killed August 1, 2017 in Hikripora, Pulwama in India; he told an army officer, "I won't surrender. I have left home to get martyred." Earlier, on June 17, three jihadis – Junaid Matto, Nasir Wani, and Adil Mushtaq Mir – were killed in an encounter at Arwani in Kulgam; just before their deaths, one allegedly sent audio farewell messages via WhatsApp to family and friends. According to a report, scores of such messages, and messages to fellow jihadis and family members, by jihadis tracked down by security forces and facing imminent death, are going viral on WhatsApp and other social media.[32]

Source: Catchnews.com/indianews, August 4, 2017.

IV. WhatsApp Used By Jihadis For Disseminating Content, Fundraising, Recruiting, And Other Communications – With Avatars Denoting ISIS, Jihad, Martyrdom

WhatsApp is among the many social media apps that the MEMRI Jihad and Terrorism Threat Monitor (JTTM) has been monitoring. Recently, jihadi usage of WhatsApp, has increased; JTTM team members have frequently notified authorities when they discover timely information, including disseminating content, fundraising, recruiting, and other communications and publishing published many reports on the subject. These include reports of terror attacks and plans on or involving WhatsApp, including names of terrorists, sites of attacks in the U.S. and elsewhere. Below are examples:

ISIS Supporter On Telegram Promotes Pro-ISIS WhatsApp ‎Group ‎

On July 14, 2017, a member of a pro-ISIS Telegram group promoted a link to a pro-ISIS WhatsApp group. The WhatsApp group, called A'maq Agency, currently has 61 members. ISIS supporters are increasingly posting invite links on Telegram to similar groups on WhatsApp.[33]

The Telegram account that promoted the WhatsApp group.

The WhatsApp join link posted on Telegram.

The WhatsApp group with ISIS A'maq news agency logo (top left).

Website Of Hizbullah's Al-Manar – A Designated Terrorist Organization – Provides Group's WhatsApp Information

The website of Hizbullah's Al-Manar, which is a U.S.-designated Foreign Terrorist Organization, and which is active across multiple social media platforms, also has a presence on WhatsApp. Its invitation to join it on WhatsApp states: "Group participation – To participate, open up a group made of five people at least, then add the following number to the group [number provided]. Individual participation – Send the word 'participate' [to number provided]."

Almanar.com.lb/legacy/whatsapp.php, accessed July 24, 2017.

 

...