Pushed to the margins on mainstream social media sites by repeated bans, The Resistance Force (TRF) – an offshoot of Pakistan’s Lashkar-e-Taiba (LeT) which has been behind a spree of targeted killings and attacks in Kashmir – has shifted its digital operations to less regulated platforms and forums.
But the TRF is not alone. In an investigation, India Today’s Open Source Intelligence (OSINT) team found several groups and channels of al-Qaeda and the Islamic States (IS) spreading their propaganda and imparting training.
These groups are active on platforms such as Rocket Chat and Matrix, which are decentralised in nature. This means their source code can be modified by any developer, and they can be hosted on a server chosen by the user. This common characteristic makes these apps an ideal digital destination for bad actors intending to execute their nefarious designs, disrupt peace, and challenge nation states.
Inside TRF’s secret digital space
India Today gained access to TRF’s secret chat rooms and groups on Matrix and monitored their conversations for several days. The TRF chat room has a total of 65 members and the conversations are regulated by two admins, who periodically post threats to the Indian state, government officials and vocal pro-India Kashmiris, issue statements, and release video clips and photos of the attacks they claim to have carried out in the Valley.
In a message on December 9, the group admin who goes by the name ‘Kashmir Fight’ claimed that terrorists belonging to the ‘Falcon Squad’ of their outfit had targeted a constable, Hafiz Mohammed Chad, in Srinagar’s Bemina. The user claimed that the police officer was “warned” by TRF terrorists in the past.
Since its inception in 2019, the TRF has claimed several attacks targeting Kashmiri Pandits, police officers, and security forces. In 2022, the group intensified its activities, primarily using small arms, causing concern among security agencies in Kashmir and aiming to expand its operations into the Pir Panjal region. In April, TRF terrorists ambushed an army truck in Poonch, killing five and gravely injuring another. The attack, which included setting the truck on fire, was later published on the Telegram messenger app.
TRF and other smaller groups had previously used Telegram extensively. However, as their attacks increased, they faced frequent bans, with new channels being barred within days or weeks of their creation.
Online terror training & Ghazwa-e-Hind plan
We also found the presence of al-Qaeda on Matrix with a channel of 59 members. Some of these members operate another channel named ‘Curriculum Book’ where “guidebooks” on different subjects for radicalising gullible Muslims, provoking their religious emotions, imparting training for attacks, and launching guerilla war are distributes frequently.
Some of the online guide books are titled ‘Physical exercise before jihad,’ ‘How to confront and deal with intelligence,’ ‘Military training for mujahid,’ and ‘Explosive engineering course.’
Some of them provide alarmingly sophisticated guidance on terrorist activities. One such PDF document reviewed by India Today gives details of highly-destructive explosives like TNT, cautions while handling them, step-by-step tutorial for making different types of bombs along with necessary safety measures during the process.
Another document extolled the role of the media in waging jihad, or the so-called sacred war – apparently to encourage the intended audience to exploit different digital mediums to spread IS propaganda.
Similarly, a channel affiliated with IS on Rocket chat, featured pro-IS material and calls for Ghazwa-e-Hind, a term used to refer to the armed struggle to establish an Islamic rule guided by the principle of Sharia.
The Rocket chat channel also carried a pro-IS web propaganda magazine with references against India.
Migration to less-regulated platforms
For a better part of this decade, terrorist outfits have managed to find loopholes to bypass checks put in place by large social media companies like Facebook, X (Twitter), Instagram, WhatsApp, and YouTube. However, their survival on these platforms became extremely difficult in face of mounting scrutiny and pressure from governments globally.
Though a 2020 report claimed the IS was still finding ways to evade detection on Facebook, the presence of terror outfits is believed to be nearly extinct on major sites, forcing them to explore safer options. Then Telegram emerged as their safe haven but it also launched a crackdown in 2018.
Though some of these outfits are still spotted on Telegram, the messaging app’s vigil and reporting mechanism, and resultant mass removals have made matters worse for terrorists. On December 27 alone, Telegram banned 390 terrorist bots and channels, taking such removals to 6361 this month. The app has banned more than 1.29 lakh bots and channels linked to the IS in 2023.
In a 2019 report, the European Union’s information center said terror groups are looking to migrate to decentralised platforms in search for a “stable base”. Decentralisation refers to a mechanism where control is not concentrated to a single authority which makes detection of illegal content difficult.
Unlike mainstream social media platforms that are operated by large corporations, apps like Matrix are open source and offer transparency and control. Their focus on strong encryption and minimal data collection provides secure space for extremist activity.