ISIS operation security guide gives insight into group’s cybersecurity practices
Do ISIS terrorists use encryption, and if so, what tools do they favour?
The Combating Terrorism Centre (CTC), an academic institution at the US Military Academy in West Point, has managed to get their hands on a guide to operational security that’s apparently given out to members and sympathisers – a guide that defines which tools to use (and how to use them correctly) and which to avoid.
The original document is in Arabic, but has been translated via Google Translate, and can be found here.
In short, the organization advises followers to use:
- Tor, Onion, Aviator, Opera Mini browser for secure and private Internet browsing
- VPN services (and the Freedome app)
- Hushmail, ProtonMail, and Tutanota for secure, encrypted email communication
- Threema, Telegram, SureSpot, Wickr, Cryptocat, PQChat, Sicher, and iMessage for instant messaging
- Linphone, IO Swisscom’s app, Silent Circle’s solutions, RedPhone, Signal, and FaceTime for encrypted VoIP services
- Mega, SpiderOak, SugarSync, and Copy.com for safe cloud storage
- TrueCrypt, VeraCrypt, and Windows BitLocker for encrypting disks and volumes
- Twitter by SMS, FireChat, Tin-Can, The Serval Mesh if they can’t get online
- Complex and unique passwords.
The guide also includes instructions on how to protect Twitter accounts from hijacking, deactivate GPS tagging when taking photos, disable “location services” for their phone cameras, etc.
Apps and services they are instructed to avoid include Instagram and Facebook (as they have a bad reputation when it comes to privacy protection), Dropbox (because President Bush’s former Secretary of State Condoleezza Rice is on the company’s investors board, and Edward Snowden advised against using it), WhatsApp (because its end-to-end encryption is badly implemented).
Aaron F. Brantly, an analyst with the CTC note, says the guide is pretty good.
“This is roughly [the same advice] I give to human rights activists and journalists to avoid state surveillance in other countries,” he told Wired, but noted that “there’s a difference between telling somebody how to do it and then [them] doing it right.”
Fortunately for ISIS supporters, there is apparently a 24-hour Jihadi Help Desk that can help them with using these tools right.