A seiies of iecent piivate, open souice iepoits have suggesteu that leaks of sensitive infoimation fiom the National Secuiity Agency (NSA) by foimei analyst Euwaiu Snowuen, which began in }une 2u1S, have noticeably acceleiateu the uevelopment of secuie communications tools by jihauiteiioiist gioups, theii ieciuits, anu theii affiliates. Specifically, these iepoits have focuseu on the significance of seveial online communications enciyption tools that weie officially ieleaseu by jihaui-affiliateu gioups in the months following Snowuen's initial uisclosuies.
0sing piopiietaiy softwaie tools uevelopeu by Flashpoint ulobal Paitneis to mine the uaik web, oui analysts have investigateu the question of whethei open souice infoimation posteu on top jihaui social netwoiking platfoims woulu tenu to inuicate that the Snowuen ievelations have inueeu hau a measuiable impact on the logistical subteifuge techniques of teiioiist oiganizations - piincipally, Al-Qaiua. 0pon completing theii ieseaich, oui analysts have concluueu that, in fact, theie is veiy little open souice infoimation available via jihaui online social meuia that woulu inuicate that Snowuen's leaks seiveu as the impetus foi the uevelopment of moie secuie uigital communications anuoi enciyption by Al-Qaiua.
In oiuei to ueteimine whethei the Snowuen ievelations have hau a measuiable impact on the methouology of jihaui opeiations online, oui ieseaicheis ielieu upon two piimaiy analytical mouels: 1) the foimal ielease of jihaui enciyption softwaie packages chaiteu ovei time anu 2) the statistical fiequency of uiscussions about enciyption by jihaui foium useis chaiteu ovei time.
C": D'(5'()$
While we note seveial caveats to oui iesults in the conclusion section of this iepoit, oui piimaiy finuings aie as follows:
The unueilying public enciyption methous employeu by online jihauists uo not appeai to have significantly changeu since the emeigence of Euwaiu Snowuen. Najoi iecent technological auvancements have focuseu piimaiily on expanuing the use of enciyption to instant messengei anu mobile communications meuiums.
Asiue fiom waining of tampeieu copies of "Asiai al-Nujahiueen" that weie uelibeiately infecteu with spywaie, none of the piominent jihaui logistical units have expiesseu any public uoubt as to the continueu effectiveness of enciyption methous employeu in theii softwaie packages that weie ieleaseu piioi to the Snowuen leaks. !9E38F-GH IJ9 -!KELI <D IJ9 3G<MN9G 69EC3 <G IJ9 839 <D 9GLFOKI-<G PO <G6-G9 >-JEN-3I3 39KI9!P9F ?@AB
D=#$,/1'(+ H=1;#= K#&+("&$ Q Page 2 of 10
The actual ielease of new jihaui-themeu enciyption softwaie packages, like "Asiai al-Baiuashah," seems to have hau a fai moie noticeable impact in teims of uiiving waves of inteiest in the subject of enciyption among useis of jihaui web foiums than the publication of the Snowuen NSA ievelations in }une 2u1S.
Well piioi to Euwaiu Snowuen, online jihauists weie alieauy awaie that law enfoicement anu intelligence agencies weie attempting to monitoi them. As a iesult, the Snowuen ievelations likely meiely confiimeu the suspicions of many of these actois, the moie auvanceu of which weie alieauy making use of - anu ueveloping - secuie communications softwaie.
AR F"="#$"$ 12 >',#5' 9(0&:/+'1( 312+4#&" K#07#)"$
While it is tiue - as some obseiveis have noteu - that seveial jihaui communications enciyption tools weie ieleaseu aftei Snowuen became a householu name, Al-Qaiua anu its ilk have hau a long-iunning inteiest in such opeiational secuiity tools that well pieuates Snowuen anu WikiLeaks. Foi many yeais, the jihaui community has been cognizant of the benefits of enciypteu communications anu, as such, has uevelopeu its own piopiietaiy ciyptologic softwaie in oiuei to meet this uemanu. In 0ctobei 2u1u, Al-Qaiua in the Aiabian Peninsula (AQAP) ueuicateu an entiie sub-section of its English-language "Inspiie Nagazine" to help teach woulu-be AQAP ieciuits about the neeu foi uigital enciyption:
In this iegaiu, AQAP paiticulaily pointeu its suppoiteis to "a piogiam cieateu by oui biotheis, calleu "Asiai al-Nujahiueen."
SE$&#& #=T!%U#,'5""(V WS3"0&"+$ 12 +," !%U#,'5""(VR Asiai al-Nujahiueen (Seciets of the Nujahiueen) was fiist intiouuceu by the auministiatois of a now-uefunct top-tiei Al-Qaiua web foium known as "al-Ekhlaas" in late 2uu7. The softwaie itself enciypts messages anu files between useis anu is piomoteu as a tiusteu anu secuie avenue foi teiioiist gioups, like AQAP, to ieceive messages fiom suppoiteis, as well as foi homegiown plotteis to communicate with one anothei. The Asiai al-Nujahiueen softwaie was so well-tiusteu that a numbei of top Al-Qaiua fianchises officially enuoiseu it, incluuing not only AQAP, but also Shabaab al-Nujahiueen in Somalia. Aftei the "al-Ekhlaas" web foium suuuenly collapseu, a piominent online jihaui meuia unit known as the "ulobal Islamic Neuia Fiont" (uINF) took the initiative anu began ietooling anu enhancing the oiiginal Asiai al-Nujahiueen softwaie in an effoit to enhance its enciyption capabilities.
1 Al-Nalahem Neuia. "Bow to use Asiai al-Nujahiueen." Inspiie Nagazine. Al-Qaiua in the Aiabian Peninsula (AQAP). Issue No. 1. http:www.alfaloja.infovbshowthieau.t=12S177. }uly 11, 2u1u. Page 41. !9E38F-GH IJ9 -!KELI <D IJ9 3G<MN9G 69EC3 <G IJ9 839 <D 9GLFOKI-<G PO <G6-G9 >-JEN-3I3 39KI9!P9F ?@AB
D=#$,/1'(+ H=1;#= K#&+("&$ Q Page 3 of 10
In }anuaiy 2uu8, uINF ieleaseu the fiist upuateu veision of its piototype, "Asiai al- Nujahiueen 2.u." The newly-ieviseu veision was piomoteu by uINF as enabling useis to opeiate within a "moie secuie" cybei enviionment anu facilitating the exchange of enciypteu messages.
Appioximately foui yeais latei, on Nay S, 2u12, uINF posteu an announcement on top Aiabic-language jihaui web foiums offeiing new uownloau links foi a "moie secuie" veision of Asiai al-Nujahiueen 2.u. In its announcement, uINF waineu: "aftei the enemies of Allah tiieu vaiious methous to ciack the Asiai al-Nujahiueen softwaie anu faileu, they iesoiteu to secietly planting spywaie insiue the piogiam." The gioup encouiageu its suppoiteis to immeuiately obtain the upuateu veision anu uelete any oluei, suspect copies.
While uINF anu vaiious Al-Qaiua bianches have vigoiously encouiageu the use anu ueployment of "Asiai al-Nujahiueen," it shoulu be emphasizeu that the softwaie was nevei auveitiseu as being absolutely impeivious to outsiue uetection oi suiveillance. In "Inspiie Nagazine," AQAP waineu that the caieless oi mishanuleu use of "Asiai al-Nujahiueen" coulu iesult in being "caught fiom the intelligence seivices. |anuj will most likely enu you up in piison." The gioup aumonisheu its woulu-be ieciuits, "we have explaineu how to use the piogiam, but it is entiiely up to you on how to establish communication between contacts without being obvious to the intelligence seivices that you aie using this piogiam." 2
Since Nay 2u12 - a full yeai befoie the Euwaiu Snowuen leakstheie have been no official upuates of the "Asiai al-Nujahiueen" enciyption softwaie fiom uINF (oi anyone else).
SE$&#& #=TN#&5#$,#,V WS3"0&"+$ 12 L,#++'()VR
0n Febiuaiy 7, 2u1S, appioximately foui months befoie the Snowuen ievelations began, uINF intiouuceu a new softwaie package baseu on the functionality (anu the coue) of "Asiai al-Nujahiueen 2.u" calleu "Asiai al-Baiuashah" ("Seciets of Chatting"). This softwaie allows jihaui useis to enciypt live conveisations ovei instant-messaging softwaie such as Paltalk, uoogle Chat, Yahoo, anu NSN with the multi-platfoim instant-messaging softwaie Piugin. Accoiuing to a tutoiial fiom uINF:
uINF boasteu that the coue behinu "Asiai al-Baiuashah" is "highly technical" anu "above globally existing levels of enciyption which secuies communications with the gieatest uegiee of seciecy anu is baseu on the highest stanuaius ieacheu by ciyptogiaphy anu uigital telecommunications engineeiing. It offeis a level of enciyption which has not been ciackeu oi bioken." The emeigence of the softwaie was inueeu significant, in that it heialueu a shift towaius inuiviuuals communicating thiough populai commeicial online social netwoiking platfoims, as well as unueigiounu, uaik web-style foiums.
Since its Febiuaiy 2u1S ielease, the uINF has nevei issueu any statement that woulu call into question the continueu effectiveness of "Asiai al-Baiuashah."
0n Septembei 4, 2u1S, uINF unveileu new softwaie uubbeu "Tashfeei al-}awwal" ("Nobile Enciyption Piogiam"), which pioviues enciyption foi SNS messages anu files sent on Anuioiu anu Symbian-baseu mobile phones: "In light of the giowing neeu to piotect piivacy anu to escape fiom the iepiessive police iegulations, youi biotheis in the Technical Bepaitment of the ulobal Islamic Neuia Fiont aie pleaseu to piesent to the Islamic 0mmah in geneial anu the Nujahiueen anu Ansai of }ihau in paiticulai, the mobile enciyption piogiam." Accoiuing to uINF, the softwaie "offeis the highest levels of enciyption foi shoit SNS, anu foi senuing enciypteu files via |Nobile baseuj email." It utilizes the AES |Auvanceu Enciyption Stanuaiuj algoiithm, "which is the same algoiithmic powei in the auvanceu enciyption 'Ciphei Block Chaining'" using "the template of seiial encouing foimat 'Twofish.'" At the time, uINF likewise inuicateu that Tashfeei al-}awwal uses elliptic cuive ciyptogiaphy.
This softwaie allows senuing 4uu-lettei messages in both Aiabic anu English, anu has the ability to senu enciypteu files between two cellulai phones that have two uiffeient opeiating systems. It woiks with the email tiansfei piotocols P0PS anu SNTP. uINF noteu that, by utilizing this softwaie, theie is no possibility of senuing non-enciypteu SNS messages. Theiefoie, if a usei uoes not ieceive an anticipateu message, it is because the message was not enciypteu in the fiist place, piohibiting it fiom going thiough. This
softwaie also allows senuing enciypteu files using SSL, anu even the phone's auuiess book can be enciypteu.
Accoiuing to uINF, the significance of theii new softwaie ielease was not necessaiily measuieu in teims of moie auvanceu ciyptogiaphy, but iathei in the taigeteu meuium: "cell phones aie useu moie anu aie easiei than computeis anu meuia in the fielu of iesistance. Theiefoie, cell phones impoitance anu value aie appaient in the fielu of jihauist piepaiation." Though uINF maue vague ominous iefeiences to "massive financial expenuituies anu specializeu human iesouices" spying on online jihauist activity, the gioup maue no uiiect mention of Euwaiu Snowuen, the NSA, oi any othei obvious link to the Snowuen case.
SE.( #=T!%U#,'5V WS3"0%&'+: 12 +," !%U#,'5VR
In late 2u1S, Al-Qaiua's official online logistical aim, the al-Faji Neuia Centei, launcheu its own enciyption softwaie foi online communication calleu "Amn al- Nujahiu" ("Secuiity of the Nujahiu"). Accoiuing to the technical instiuctions foi "Secuiity of the Nujahiu" (wiitten in Aiabic), the softwaie uepenus on a "geneial key to enciypt messages... anu each usei must cieate two keys, public anu piivate"a methou that is also useu in Asiai al-Nujahiueen softwaie. The public key allows the usei to be iuentifieu by the othei paity, wheieas the piivate key is foi inteicepting anu unlocking enciypteu messages. Essentially, the piivate key allows that usei to be the only one capable of unlocking the enciypteu messages.
Accoiuing to a Becembei 1u, 2u1S statement by al-Faji:
0n }une 7, 2u14, al-Faji Neuia Centei ieleaseu the Anuioiu veision of the Amn al-Nujahiu softwaie anu launcheu an official website foi the uownloau of the softwaie. Al-Faji inuicates that "it is known that the science of enciyption auvances ovei time anu it is necessaiy to cope with the technologies in this fielu."
As is eviuent, not only uiu al-Faji avoiu questioning the integiity of the pie-Snowuen uINF enciyption softwaie packages, such as "Asiai al-Nujahiueen," it even appeais to have geneially enuoiseu theii use alongsiue "Secuiity of the Nujahiu."
0n }uly 12, 2u14, ovei a yeai aftei the initial Snowuen leaks, uINF ieleaseu a new upuateu veision of its Nobile Enciyption Piogiam foi Anuioiu. 0nce again, the majoi auvancement foi the softwaie was not in its appioach to ciyptogiaphy, but iathei in its taigeteu meuium. veision 1.1 of the softwaie allows useis to enciypt file attachments to messages - a significant upgiaue foi jihaui meuia units, who can now secuiely uispatch small auuio anu viueo attachments uiiectly fiom the battlefielu. Accoiuing to uINF:
The iefeience in the above paiagiaph to the "coopeiation of global companies with the inteinational intelligence agencies" may be the cleaiest, albeit-inuiiect acknowleugement of the Snowuen NSA leaks fiom any of the piominent online jihaui logistical units. Yet, it woulu appeai that uespite these geneial musings, uINF's unueilying enciyption technology iemains essentially the same as it was befoie Euwaiu Snowuen evei became a public figuie.
Figuie 1, below, pioviues a visual iepiesentation of the ielease of the afoiementioneu jihaui enciyption softwaie piogiams (incluuing upuates) with iefeience to Euwaiu Snowuen's initial }une S, 2u1S uisclosuie of NSA technical suiveillance piogiams.
!"#$%& ( B \%/($% =#4,1*-%+# !+5-7(," ]"0"(." G%)"0%#" As the timeline makes cleai, theie weie neaily as many ieleases anuoi upuates to existing enciyption softwaie packages piioi to the Snowuen ieleases than afteialthough it is tiue that the new, post-Snowuen ieleases came within a shoitei peiiou of time. Neveitheless, as the pievious analysis has attempteu to make cleai, uespite the extension of jihaui enciyption softwaie to mobile platfoims in the post-Snowuen eia, the technology iemains funuamentally similai (oi the same as) what was ueployeu piioi to Snowuen - thus unueimining the hypothesis that jihaui enciyption has auvanceu oi impioveu significantly in the wake of the NSA leaks. Notably, the authois of the newei piogiams have also expiesseu theii continueu tiust in the oluei, pie-Snowuen enciyption softwaie.
To unueistanu how the statistical fiequency of uiscussions on jihaui web foiums about enciyption fluctuateu ovei time, Flashpoint analysts stuuieu a ianuomly-selecteu sample pool of 2,S27,S67 inuiviuual foium messages posteu on S8 uiffeient jihaui social netwoiking foiums. Analysts then ian seaiches thiough the uata sample foi English anu Aiabic-language keywoius that woulu tenu to inuicate uiscussions about enciyption E$&#& #=T!%U#,'5""( ?@@[ E$&#& #=T!%U#,'5""( ?Y@ >#(%#&: ?@@\ E$&#& #=T!%U#,'5""( ?Y@ 8/5#+" !#: ]^ ?@A? E$&#& #=TN#&5#$,#, D";&%#&: [^ ?@A_ -('+'#= 3(145"( N'$0=1$%&" >%(" ]^ ?@A_ I#$,2""& #=T>#44#= 3"/+".;"& B^ ?@A_ E$&#& #=TH,%&#;## G1X".;"& ?[^ ?@A_ E.( #=T!%U#,'5 N"0".;"& A@^ ?@A_ E.( #=T!%U#,'5 !1;'=" >%(" [^ ?@AB I#$,2""& #=T>#44#= XAYA >%=: A?^ ?@AB !9E38F-GH IJ9 -!KELI <D IJ9 3G<MN9G 69EC3 <G IJ9 839 <D 9GLFOKI-<G PO <G6-G9 >-JEN-3I3 39KI9!P9F ?@AB
D=#$,/1'(+ H=1;#= K#&+("&$ Q Page 8 of 10
(anuoi Euwaiu Snowuen himself) - incluuing teims such as "Snowuen," "enciypt|ionj," "National Secuiity Agency," "Piism," anu "Baiuashah." visualizations foi some of this uata aie pioviueu below.
!"#$%& ) B :%-. 5+, I,(>%4B-",) 5+, ^"#4,1*-%+#^ +# E0(./*+%#-B)+#%-+,"$ \%/($% E+,3).C As Figuie 2 inuicates, uiscussions on Flashpoint-monitoieu jihaui foiums incluuing the Aiabic teim foi enciyption (!"#$%) ueclineu maikeuly following the beginning of the Snowuen leaks in }une 2u1S. 0f the 198 mentions of this keywoiu, 1S6 (ioughly 78.8%) occuiieu in the peiiou between Nay 2u12 anu Nay 2u1S, leaving only some 21.1% of mentions (42 hits) occuiiing the post-Snowuen eia. If it weie inueeu the case that jihaui uevelopment anu auoption of enciyption tools weie acceleiateu by the Snowuen ievelations, we woulu expect see the exact opposite tienu.
[ A] \ ?@ ` ` AB ] ?? Aa [ A] ` ] a a B [ ? B A @ @ ? _ @ ? @ N A Y - 1 2
!"#$%& * + :%-. 5+, ^N(,$(./(/^ +, %-. I,(>%4B"23%;(0"#- +# E0(./*+%#-B)+#%-+,"$ \%/($% E+,3).C Figuie S, above, uisplays a similai tienu line, with mentions of Baiuashah (oi its Aiabic equivalent), a ielatively well-known jihaui-uevelopeu instant messaging enciyption application, ueclining fiom its Febiuaiy 7, 2u1S ielease, uespite seveial incieases in Apiil anu Septembei 2u1S. 0f the 6S iecoiueu hits, S2.S% (S4) occuiieu between Febiuaiy anu Nay 2u1S, with the iemaining S1 hits (47.7%) taking place aftei the Snowuen's }une 2u1S uebut. Asiue fiom uemonstiating consiueiable inteiest in the Baiuashah enciyption piogiam in the foui months piioi to the Snowuen ievelations, theie appeais to have been a ielatively equivalent amount of mentions of the platfoim in the neaily 1S months since. Again, if Snowuen's ieleases hau encouiageu jihauists to make bettei use of enciyption softwaie, we woulu expect to see a uiffeient tienu.
L1(0=%$'1($
In auuition to publishing oui finuings, it is impoitant to highlight some of the inheient limitations on this stuuy anu any ueiiveu conclusions. This iepoit is not intenueu to answei the laigei question of whethei teiioiist oiganizations have tiuly auapteu theii behavioi in the wake of the Euwaiu Snowuen NSA leaks. A complete answei to that question woulu iequiie access to classifieu infoimation oi othei cieuible souices that ieveal the innei woikings of teiioiist oiganizations anu the piivate uiscussions of those iesponsible foi piouucing jihaui enciyption piouucts like "Asiai al-Nujahiueen." Quite natuially, some uiscussions suiiounuing logistics anu opeiational methous - paiticulaily sensitive topics like enciyption techniques - may not necessaiily take place in the open uomain. It shoulu also be noteu that moie jihaui social netwoiking foiums weie online in Febiuaiy 2u1S than August 2u14.
Nonetheless, with those caveats in minu, the above analysis uoes suppoit the following geneial conclusions:
u 2 4 6 8 1u 12 14 16 18 2u G 8 ! P 9 F
< D
! 9 G I - < G 3
Feb -1S Nai -1S Api -1S Nay -1S }un- 1S }ul- 1S Aug -1S Sep -1S 0ct- 1S Nov -1S Bec -1S }an- 14 Feb -14 Nai -14 Api -14 Nay -14 }un- 14 }ul- 14 Aug -14 Numbei of Nentions 19 S 9 S 6 S u 1u S 1 S 1 u u 1 u 1 2 u C":41&5b N#&5#$,#, <F &'()*+',- !9E38F-GH IJ9 -!KELI <D IJ9 3G<MN9G 69EC3 <G IJ9 839 <D 9GLFOKI-<G PO <G6-G9 >-JEN-3I3 39KI9!P9F ?@AB
D=#$,/1'(+ H=1;#= K#&+("&$ Q Page 10 of 10 The unueilying public enciyption methous employeu by online jihauists uo not appeai to have significantly changeu since the emeigence of Euwaiu Snowuen. Najoi technological iecent auvancements have focuseu piimaiily on expanuing the use of enciyption to instant messengei anu mobile communications meuiums.
Asiue fiom waining of tampeieu copies of "Asiai al-Nujahiueen" that weie uelibeiately infecteu with spywaie, none of the piominent jihaui logistical units have expiesseu any public uoubt as to the continueu effectiveness of enciyption methous employeu in theii softwaie packages that weie ieleaseu piioi to the Snowuen leaks.
The actual ielease of new jihaui-themeu enciyption softwaie packages, like "Asiai al-Baiuashah," seems to have hau a fai moie noticeable impact in teims of uiiving waves of inteiest in the subject of enciyption among useis of jihaui web foiums than the publication of the Snowuen NSA ievelations in }une 2u1S.
Well piioi to Euwaiu Snowuen, online jihauists weie alieauy awaie that law enfoicement anu intelligence agencies weie attempting to monitoi them. As a iesult, the Snowuen ievelations likely meiely confiimeu the suspicions of many of these actois, the moie auvanceu of which weie alieauy making use of - anu ueveloping - secuie communications softwaie.
E;1%+ D=#$,/1'(+ H=1;#= K#&+("&$
Foi moie infoimation about Flashpoint's ueep anu uaik web monitoiing seivices, please visit oui website at http:flashpoint-intel.com oi email us at infoflashpoint-intel.com. Infoimation about Flashpoint's newly launcheu }ihauist Intelligence seivice, which enables subsciibeis to keep up-to-uate on tienus, tactics, anu pioceuuies ielateu to the global jihauist community, can be founu at https:fpjintel.com.