On 25 April 2018 law enforcement authorities of the European Union Member States, Canada and the USA launched a joint action against the so-called Islamic State (IS) propaganda machine in order to severely disrupt their propaganda flow. The takedown operation was coordinated by the European Union Internet Referral Unit (EU IRU) within the European Counter Terrorism Centre (ECTC) at the Europol headquarters.

 

Led by the Belgian Federal Prosecutor’s Office and with the support of Eurojust, the operation involved authorities from Belgium, Bulgaria, Canada, France, the Netherlands, Romania, the United Kingdom and the USA in a coordinated effort to hinder IS’s central capability to broadcast terrorist material for an undetermined period of time.

 

The case started at the end of 2015 when Europol informed all EU Member States about the rise of the Amaq News Agency and the technical resilience of the terrorist online infrastructure. Since then law enforcement agencies have, in a continuous joint effort, taken down the web assets of the media outlet.

 

In August 2016, thanks to contributions from EU Member States and non-EU countries, a first takedown was launched against Amaq’s mobile application and web infrastructure. This action forced the propagandists to build a more complex and secure infrastructure to prevent further disruption from law enforcement. In June 2017 a second strike, led by the Spanish Guardia Civil and supported by Europol and the USA, targeted part of the news agency’s web assets and infrastructure. The servers seized by the Guardia Civil allowed for the identification of radicalised individuals in more than 100 countries worldwide.

 

On 25-26 April 2018 a simultaneous multinational takedown, coordinated by Europol’s EU IRU and with the support of Eurojust and the Belgian Federal Prosecutor, led to the seizure of digital evidence by law enforcement from Bulgaria (Cybercrime Department in General Directorate Combatting Organised Crime), France (SDAT-SDLC), Romania (Directorate for Countering Organised Criminality – Terrorism Investigation Unit with the support of the Romanian Intelligence Service), and the seizure of IS servers in the Netherlands (Dutch National Police – Internet Referral Unit together with the Belgian Federal Judicial Police – East-Flanders), Canada and the USA. Meanwhile, the United Kingdom (Counter Terrorism Internet Referral Unit) took the lead in the referral process of top-level domain registrars abused by IS.

 

With this takedown action, targeting major IS-branded media outlets like Amaq, but also al-Bayan radio, Halumu and Nashir news, IS's capability to broadcast and publicise terrorist material has been compromised.

 

Rob Wainwright, Executive Director of Europol, commented: ‘With this ground-breaking operation we have punched a big hole in the capability of IS to spread propaganda online and radicalise young people in Europe. I applaud the determined and innovative work by Europol and its partners to target a major part of the international terrorist threat prevalent in Europe today.’

 

Main mouthpiece of IS

Initially giving the impression of an independent media outlet providing factual information on IS, Amaq was used in 2016 to claim the attacks in the Levant and all over the world, including the attacks in Paris, Brussels, Barcelona and Berlin, and more recently in Trèbes (France). Amaq News Agency is the main mouthpiece of IS. It was officially endorsed by the terrorist organisation in July 2017 and has since become the primary source of information regarding the remaining activities of IS worldwide.

Since 2015 Amaq News Agency has been launching its own software and has developed highly resilient online infrastructure hosting. As of December 2017 the entire range of IS propaganda is available in at least nine different languages, as well as a wide range of online services, such as mailed newsletters and add-on extensions for the most common browsers.

 

Law enforcement agencies involved expect that the data retrieved as a result of the takedown will help to identify the administrators behind IS media outlets and potentially radicalised individuals on European soil and beyond.

 

In the context of the EU Internet Forum, the EU IRU proactively monitors online propaganda activities of the listed jihadi terrorist organisations in the EU on a daily basis, including related websites, servers and applications disseminating IS propaganda.

Commissioner Julian King said: 'This shows that by working together we can stamp out the poisonous propaganda Da'esh has used to fuel many of the recent terror attacks in Europe. For too long the internet has been open to terrorists and those who seek to do us harm: those days are coming to an end thanks to this type of coordinated global work.'