Online Radicalisation and Social Engineering

Choose your targets

One of the most effective ways of targeting European youngsters was online, bringing the world of the terrorist- recruiters into the bedrooms of vulnerable youngsters. Social media and YouTube were employed to make contact with their key demographic. Just as I, as a social engineer, would identify the key staff to target when testing a company’s security, so these recruiters knew the type of profiles they were looking for. Young, preferably vulnerable or troubled, perhaps they had suffered some bullying or family drama or were a bit of an outsider.

Create a social media profile to build rapport

Let’s say that their target was a fifteen-year-old boy from the U.K. They would make contact via a profile that was set up to look like a similarly aged individual, having examined their target’s profile and identified some of their likes and dislikes. Commonality builds rapport, making them more likely to like, listen and agree with what you say.

Introduce target to a new online community

Once this initial rapport is established they feed in key concepts that underpin their political messages, while staying as mainstream as possible. For example, an article from a western source and about the UK military in Iraq. Ideally with a human interest angle, perhaps a young boy who lost his mother and father in a bombing.  Nothing that gives away the end-goal but could be used to point up the idea of the west’s reckless actions causing the deaths of innocent people. The fifteen-year-old agrees with you that this is horrifying and unjustified. The recruiter suggests he join an online group that airs these sorts of things. He does. The group consists of other fake profiles and a few genuine people further down the path toward radicalisation. The discussions start introducing more conspiracy- orientated theories about the west targeting Muslims deliberately.

Echo chambers 

The recruiter gradually suggests other people and news sources to the target’s social media feed. The more direct messages, likes, comments, tags they make with their targets, the more likely their posts would be on their home feed every day. This creates an echo chamber controlled by the recruiters which drowns out counter-narratives from other online contacts.

Escalation

As their target becomes more comfortable with radical viewpoints, the recruiters’ strategies evolve. They show him videos and profiles of people who have joined the fight. For young boys, the recruiters would focus more on feeding them action videos of people firing guns, driving cars and blowing things up. For girls the focus is more on finding an ideal husband, nursing wounded people and saving innocent animals caught in the crossfire. They have their narratives perfected. Many would be encouraged to suggest other people as potential contacts and listen to more extreme religious views from people who were portrayed as scholars, such as Anjem Choudhry.

The Decision

Interestingly, more often than not it was the victim who initiated travel to Syria, not the recruiter. They were then referred to another contact who would have a detailed action plan ready.  They provided guidance on how to buy a plane ticket to Turkey and which were the best airports to fly from so you wouldn’t get stopped. Leave at a time of day when you wouldn’t be missed or tell your parents you were going to a friend’s house after school. They would tell their targets to erase their hard drives or, better still, take the hard drive with you. The plan was to leave no trace behind .Sadly, many young people right across Europe got caught up in this process and left for Syria. On arrival in Turkey they would often be met by Islamic State smugglers who would help them across the Syrian border and into training camps. Once there, messages would be sent from their profiles telling other “suitable” friends of the amazing time they were having. Whether it was even them writing the messages we will never know. Many who left for Syria have never been heard from again. A few now wish to return to the UK, USA and other European nations and those governments are faced with the difficult choice of managing these cases.

Online “radicalisation” and cybercrime

In my work helping companies with security, we are increasingly seeing cyber-attackers engaging in a very similar process to that just described. They find a member of staff, befriend them using a fake profile and bond with them to start introducing ideas about how the company they work for is corrupt or is committing immoral acts. They start asking them to steal data from the company, usually by photographing it on their phones. They will always feed some sort of “us versus themˮ narrative to their target and often paint what they are doing as activism. The company loses data, money and may even collapse. You may think that this could never work on me, that I could never be radicalised like this. However, there’s always a narrative that works, it’s just a matter of finding what it is. We are all of us different but each one of us can be got at, manipulated and fed a story that could take you down a path you never thought you would find yourself on.