ISIS Social Media Analysis of twitter news outlets following @Th3j35t3r Tango-Downs

## Disclaimer

First of all let me clarify **this is an exercise in Social Media monitoring and analysis**, not a **full featured Intelligence** report. Not by far. We do Social Media Monitoring for a living and we use the same technology you’ll see in these images and tables mainly to monitor *Corporate events* and to spot out the *Influencers* on online conversations regarding a peculiar subject. Nothing too fancy, but often useful and full of insights.
**I’m not affiliated** with the Intelligence community but have a somewhat extensive background in *IT Security* and has been in US under the *IVLP Program on “Combating Cybercrime”*. I also teach *Open Source Intelligence* as Contract Professor. That said, I’m *not really a US Fanboy* and, more over, not really a [@Th3j35t3r’s][jester] fan. But we sort of respect each other, though, and have chatted sparsely.
**In addition to this**, please understand **this is not a scientific paper**: it’s just an analysis done to find out if software we routinely use in some context (business) could be used in different contexts (intelligence). It is but a draft, but I hope you’ll find it interesting enough to spark a little bit of conversation about the results.
**Finally:** I do not understand and speak arab, and this analysis has been made on a pure mathematical and statistical approach on users. Please, be a good fellow and not an idiot and use this data to **muse on correlations** and not to **point out anyone** in these charts and graphs as terrorists and/or terrorist’s allies. Deal?
If you have any further question you can [contact me][contact] (mf @ matteoflora.com) and/or comment below. Or you can talk about this on the [Reddit Page][reddit]. Hope you’ll enjoy! M.

## What is this stuff?

On August 20th 2014, the famous grey hat and hacktivist (or computer vigilante, depending on your point of view) [Th3j35t3r][jester] has started a *Tango Down*[^tango] operation on several (19) Twitter accounts disseminating pro-jihad news, during the Twitter outbreak of the **#ISISMediaBlackOut** campaign[^isisbo].
All the accounts were referred to [Th3j35t3r][jester] manually by some Twitter users and were not correlated in any way, aside from the sheer fact that they were promoting pro-jihad news.
The *Tango Down*ed Twitter accounts were the following (many of them are now again online but I’ll not provide links).

|#|ID|followers|#|ID|followers|
|—|—-|—|—-|
|1.|@jnoubisis|5.4K|11.|@nynwa_news|18.2K|
|2.|@albaraka_news2|5.9K|12.|@hamahama0|19.1K|
|3.|@baghdadfawares|8.2K|13.|@qaadayaalumaa1|21.9K|
|4.|@homs_isis|8.7K|14.|@albarak_news|29.5K|
|5.|@lashkegah09|9.2K|15.|@al3gneg|29.7K|
|6.|@salahaddennew|9.8K|16.|@wilaiat_halab|31.8K|
|7.|@kirkuk_isis7|10.1K|17.|@mamoo_n111|32.3K|
|8.|@raqqaa|13.6K|18.|@alanbar_news|51.4K|
|9.|@ahlam_alnasr|14K|19.|@minbar_s|173K|

Looking at the accounts and the similarity in the topic they were discussing, it came to my mind that finding out some other accounts with similar behaviour is not only possible, but extremely simple from our point of view, since we do this kind of things all the time.
To be clear, no, we don’t find jihad news sites every day, but the problem of **finding out who is talking about a particular topic** and who, in this group, is the **most influential** hub to disseminate information is a routine job on many different topics such as politics, fashion, automotive, banking, technology and so on…
It is something that is normally called Social Media Influencers Analysis and is used to map those accounts that are most “influential” over content diffusion.

Every company has its **own methodology** to spot out who the **Influencers** are, and so do we. It doesn’t really matter which method is better: different methods are most suitable for different situations and in this case we’ll apply a little bit of **Engagement Analysis**[^engagement] and a little bit of **Eigenvector Analysis**[^eigen] to find out what will come out of it.

## Methodology and extracted data

For creating the analysis we **acquired[^data] historical data** of the **last month** of Twitter conversations that included the mention of **any of the 19 accounts**. To avoid altering the results we explicitly excluded data after August 19th to avoid that mentioning the account **after the Tango Down** would result in false data about the interactions.

What we want to achieve here is **spotting out the community** and **how the community interact** with the various members. To do so we **did not download** all the tweets **made by those accounts** but only the tweet that **mentioned** or **retweeted** (a different kind of mention, if you think about it) them. In this way we’re able to spot:

* The endorsements and retweets
* All the conversations happening between two (or more) accounts
* All the questions/answers between two (or more) accounts

In the time frame between July 17th 2014 and August 18th 2014 we were able to find **23,677 tweets** (of which **20,850 retweets**) made by a total of **5,504 unique users**, with an average of 4 tweets per account. The peak minute in conversations was found July 18th at 06:27 AM GMT+1 with 37 conversations in a single minute.
In total, the conversations led to 40,039,424 Impressions[^impression] (or, better, Opportunities to See) impacting on a total[^total] (not de-duplicated) of 7,046,241 followers

Here is a little graph showing up the minute-by-minute tweet flow *(sorry for the italian UI ;])*:

## A little bit more about users

It is easy to spot out that the **most popular users** (users who **received** the most mentions or retweets) are led by **@ahlam_alnasr** mentioned in 7,083 tweet, immediately followed by **@diyala1435_w** with a total of 3,621 tweets mentioning it and by *@nynwa_news* with 3,344 mentions and @homs_isis following with 3,154.

Here a more compete listing:

|#|Twitter User|Number of Mentions|
|–|–|–|
|1 |@ahlam_alnasr|7.083|
|2 |@diyala1435_w|3.621|
|3 |@nynwa_news|3.344|
|4 |@homs_isis|3.154|
|5 |@albaraka_news2|2.407|
|6 |@alanbar_news|1.537|
|7 |@jnoubnews|1.215|
|8 |@al_bttaar|744|
|9 |@qaadayaalumaa1|516|
|10|@i_s_durr|474|
|11|@raqqaa|405|
|12|@triumph_isis|325|
|13|@kirkuk_isis7|226|
|14|@islamic_press|197|
|15|@jnoubisis|187|
|16|@kl_salahadden|181|
|17|@m_al_bttaar|172|
|18|@minbar_k|151|
|18|@lashkegah09|149|
|20|@s_h_i_b_l|147|

**Most active users**, calculated by the number of tweets/retweets generated containing mention of one of the 19 users in the examined time frame, we find out **@isis_daash]** with 1,121 tweets
, **@triumph_isis** with a total of 414 tweets, along with **@isis_time** and **@fajeralislam90** with 326 and 296 tweets sent.
Here a list of the Top 20:

|#|Twitter User|Number of Tweets|
|–|–|–|
|1 |@isis_daash|1.121|
|2 |@triumph_isis|414|
|3 |@isis_time|326|
|4 |@fajeralislam90|296|
|5 |@ahmed_isis|252|
|6 |@lan_nark3|244|
|7 |@s_h_i_b_l|234|
|8 |@state_al_islam|205|
|9 |@isis_defender|202|
|10|@aws_mk|192|
|11|@x6_kh|171|
|12|@mkthm44_isis|171|
|13|@isis_1919|170|
|14|@dawla_isis|160|
|15|@isis_invasions|150|
|16|@w_d_news|141|
|17|@saem_isis|132|
|18|@isis_1111|127|
|18|@ansarii_isis|120|
|20|@lion_dev|117|

Looking at the users with the largest impact generated Impressions[^impression] we find out in leading position **@isis_daash** with a total of 3,861,769 generated Impressions, **@fc3o** with 2,800,006, **@7ob_3** and **@triumph_isis** respectively with 1,832,692 and 1,688,959.
An interesting fact: impression generated **by these 4 accounts alone** amount to 25.4% of the total Impressions.
Here a list of the Top 20:

|#|Twitter User|Number of Impressions|
|–|–|–|
|1 |@isis_daash|3.861.769|
|2 |@fc3o|2.800.006|
|3 |@7ob_3|1.832.692|
|4 |@triumph_isis|1.688.959|
|5 |@al3r_b|1.544.060|
|6 |@mt_bader|887.331|
|7 |@s_h_i_b_l|482.556|
|8 |@isis_ammar|436.804|
|9 |@dawla_isis|421.388|
|10|@dawnofvictories|398.296|
|11|@1arabfollow|391.897|
|12|@jeme36|362.564|
|13|@x6_kh|349.339|
|14|@asawirtimedia|348.867|
|15|@mkthm44_isis|345.379|
|16|@sas201416|342.723|
|17|@lahn_m4|336.928|
|18|@isis_inspire|330.870|
|18|@al_khansaa2|320.552|
|20|@minbar_k|319.319|

Very last bit of information about users: **Twitter Superstars** (users with the largest followers count) tweeting mentioning the 19 accounts are **@7ob_3**with 458,173 followers, **@fc3o** with 311,148 followers, **al3r_b** with 220,499 followers and **@sas201416** with 171,362 followers.

## HashTags analysis

Being unable to read and understand arab language, the only meaningful analysis I can present is based not on text but on HashTags, that are used in english language only (or, at least, without arab letters). In the following bubble chart you can find the most used (with repetition):

Most used HastTags (counting repetitions by a user) has been **#isis** (3.004 uses), **#syria** (1.381 uses), **#is** (739) e **#iraq** (708). But a complete listing of the Top 20 is far more meaningful:

|#|HashTag|Number of Uses|
|–|–|–|
|1 |#isis|3.004|
|2 |#syria|1.381|
|3 |#is|739|
|4 |#iraq|708|
|5 |**#amessagefromisistous**|483|
|6 |#pkk|388|
|7 |#khilafa|313|
|8 |#khilafah|215|
|9 |#egypt|193|
|10|#us|179|
|11|#media|179|
|12|#raqqa|167|
|13|**#usweaponsrourwarloot**|152|
|14|#rt|151|
|15|#islam|134|
|16|#hawaii|98|
|17|#ksa|91|
|18|#aleppo|87|
|18|#lebanon|76|
|20|#islamic_state|60|

Pay attention to the **bold** ones, that are most important, since they convey intimidation messages widely spread after release by many of the different sub-communities!

You can, obviously, see them as a tag-cloud if you prefer:

Another interesting way of looking into this data is to analyse which COUPLE of HashTags are presented together in the tweets and map out them into a ribbon graph:

## The Global Picture

Aside from the statistical part, that in my opinion provide a lot of information to find out the **most active**, **most mentioned** and *most influential** accounts, it’s time to picture the entire community using some Graph visualisation of the entire space: using a customised version of [Gephi][gephi] and a pre-compiled graph file generated from the platform, we can map interactions between different accounts in a single picture *(that is BTW the most interesting part of this long post)*…

In the following image, a **Vertex** (the *point* or *ball) with a name is the Twitter account, while the **Edge** (the *line* connecting vertexes) is a mention or a retweet.

The largest node is the result of **Eigenvector Centrality**[^eigen], and represent the **most influential account** within its micro-community.
The color of a Vertex and Edge is calculated using **Modularity**[^modularity] (see below).

## Modularity and Sub-communities

Using **Modularity**[^modularity] we tried to spot out *groups*, *clusters* or *communities* within the original community). We retrieved a bunch of them (20+), some of which seemed numerically more important than others.
You’ll find out the most representative ones here below: please note that each of the following images is, in fact, a sort of filter on the original above:

## Some information on shared content

Parsing the content of the tweets we searched the most important content shared through the tweets (in terms of popularity). This let to interesting content in the platforms itself (**warning: some content contain strong images not pictured here but available following the links**).

First of all let’s look at the most retweeted tweets:

Being unable to read arab content and to understand link contents from the t.co link shortener, we expanded all the links found into the tweets and catalogued each of them in different typologies, based on the domains.

## Top Overall Content Shared

Not categorised top content being shared is:

|#|URL|Number of Uses||
|–|–|–||
|1 |https://www.youtube.com/watch?v=q-mK6-Z__aQ|791|
|2 |http://justpaste.it/sha3er|632|
|3 |http://justpaste.it/homs7|454|
|4 |http://justpaste.it/Flour|296|
|5 |http://justpaste.it/ReEx2|200|
|6 |http://justpaste.it/islamic-state|171|
|7 |https://www.youtube.com/watch?v=DgJ04JySH_o|133|
|8 |https://twitter.com/I_S_DURR/status/490452965137076224|117|
|9 |http://justpaste.it/gdpy|117|
|10|http://justpaste.it/kathibat|100|
|11|http://justpaste.it/ftohat|95|
|12|https://twitter.com/Islamic_Press/status/497255835534245889|85|
|13|https://www.youtube.com/watch?v=q-mK6-Z__aQ|78|
|14|https://www.youtube.com/watch?v=t4cXtVeH_6A|76|
|15|http://justpaste.it/boshra|72|
|16|http://justpaste.it/gk02|68|
|17|http://www.dailymotion.com/video/x234yq5|67|
|18|http://justpaste.it/gb4a|61|
|19|http://justpaste.it/Nafe|61|

## Top Twitter Images

Most Shared **Twitter Images** are, instead:

|#|URL|Number of Uses||
|–|–|–||
|1 |https://twitter.com/minbar_k/status/490957514226151424/photo/1|55|
|2 |https://twitter.com/Muslim1x/status/495213370253910016/photo/1|41|
|3 |https://twitter.com/Al_Gorelioni/status/497854756602146816/photo/1|17|
|4 |https://twitter.com/fursanalbalaagh/status/490466985734438912/photo/1|11|
|5 |https://twitter.com/diyala1435_w/status/493052790651256833/photo/1|10|
|6 |https://twitter.com/alghuraba_ar/status/498786157438963713/photo/1|10|
|7 |https://twitter.com/MKTHM44_isis/status/497323923500204032/photo/1|9|
|8 |https://twitter.com/Nynwa_news/status/487979288562790400/photo/1|7|
|9 |https://twitter.com/KarzanKurdy/status/497410007852650496/photo/1|6|
|10|https://twitter.com/sf4t9rfan1/status/497935833505476609/photo/1|5|
|11|https://twitter.com/minbar_k/status/493036257111339011/photo/1|5|
|12|https://twitter.com/PetoLucem/status/492621701193420801/photo/1|5|
|13|https://twitter.com/DestroTheNoble/status/497976158093574144/photo/1|5|
|14|https://twitter.com/minbar_k/status/491739399890014208/photo/1|4|
|15|https://twitter.com/green_lemonnn/status/494795723670814720/photo/1|4|
|16|https://twitter.com/agado11/status/491480703222046720/photo/1|4|
|17|https://twitter.com/Nynwa_news/status/494905572891062273/photo/1|4|
|18|https://twitter.com/Al_Gorelioni/status/497853823759560705/photo/1|4|
|19|https://mobile.twitter.com/katibat_d/status/490891856243212288/photo/1|4|
|20|https://twitter.com/minbar_k/status/490927970026926081/photo/1|3|

## Top YouTube Videos

Here is la list of the Most Shared **Youtube Videos**

|#|URL|Number of Uses||
|–|–|–||
|1 |https://www.youtube.com/watch?v=q-mK6-Z__aQ|791|
|2 |https://www.youtube.com/watch?v=DgJ04JySH_o|133|
|3 |https://www.youtube.com/watch?v=q-mK6-Z__aQ|78|
|4 |https://www.youtube.com/watch?v=t4cXtVeH_6A|76|
|5 |https://www.youtube.com/watch?v=ZQJczbow528|53|
|6 |https://www.youtube.com/watch?v=af2WlNzU3T0|38|
|7 |https://www.youtube.com/watch?v=JV3KRIid78o|38|
|8 |https://www.youtube.com/watch?v=scBxrOZwr78|31|
|9 |https://www.youtube.com/watch?v=ggHRxhynUZg|31|
|10|https://www.youtube.com/watch?v=_XWBfSo-344|30|
|11|https://www.youtube.com/watch?v=0zhi08bk0To|30|
|12|https://www.youtube.com/watch?v=oLWmjyHxIGo|26|
|13|https://www.youtube.com/watch?v=Qe7kexyH2uc|26|
|14|https://www.youtube.com/watch?v=vV0tF5fpsyQ|25|
|15|https://www.youtube.com/watch?v=SHaPVDrlpV8|24|
|16|https://www.youtube.com/watch?v=WdXkIOlnvSI|23|
|17|https://www.youtube.com/watch?v=MvS2JZyn2OA|23|
|18|https://www.youtube.com/watch?v=u47s5OjIwRQ|21|
|19|https://www.youtube.com/watch?v=g9WRMykHKpw|21|
|20|https://www.youtube.com/watch?v=9N2yVA8zdfc|21|

## Conclusions

Not much to be said, here: it’s **quite fun to see** how software designed and created **for Marketing and Communication** purpose quite nicely **fit into the Intelligence world**. It really make sense, since Marketing itself stole methodologies and visualisations from the Intelligence software and community.
Twitter (and social media in general), as demonstrated by the Arab Spring and Occupy Movement, are an incredible source of information about **uprisings**, but also for **terrorism** and people behaviour in general. The use of this king of tech must be considered **standard** in any kind of Electronic Warfare scenario, boing it CyberAttacks, CyberIntelligence or plain old PsyOp.

Feel free to [contact][contact] me (mf @ matteoflora.com) for specific information, to point out errors in the analysis or to point out grammar monster I created (there will be plenty, as a non-english mother-tongue). Or you can talk about this on the [Reddit Page][reddit].

Estote parati.

[^modularity]: Modularity is one measure of the structure of networks or graphs. It was designed to measure the strength of division of a network into modules (also called groups, clusters or communities).
[^impression]: While an industry standard, the measurement of Impressions is of little use in practice: it is calculated multiplying the number of tweets (and retweets) one account has made by the number of followers it had in that peculiar moment in time. A better-suited definition could be “Opportunities to See”.
[^total]: Calculated summing up, without de-duplication, the number of the followers of all the users spotted out in the conversations.
[^tango]: A word used to describe a terrorist that has been eliminated. It is mainly used by the Special Forces to describe an eliminated enemy during a firefight.
[^isisbo]: The call for ‘IS’ media blackout after reported execution of the US journalist.
[^engagement]: Measuring who much (and by who) the information written by a single user is carried on on the web.
[^eigen]: The most connected people in a social network — those with the highest number of incoming and outgoing connections — have high eigenvalues. These eigenvalues can be calculated — like Google’s PageRank algorithm — by weighting the value of each connection based on the eigenvalue of the originator.
[^data]: We do have a paid firehose to get unmediated access to the Twitter stream. Most of what we did, though, can be replicated using free data from the API.

[gephi]: http://gephi.org
[thefool]: http://thefool.it/en
[contact]: mgpf.it/who-is-matteo-flora
[jester]: http://en.wikipedia.org/wiki/The_Jester
[reddit]: http://www.reddit.com/r/Isis/comments/2eii9p/infographics_isis_social_media_analysis_of/