Somali al Qaeda affiliate al-Shabab woke up one January morning to discover that its popular English-language Twitter account -- @HSMPress -- had been suspended, apparently because it had issued a direct, specific threat of violence in breach of Twitter's terms of service.
This rare termination dusted off one of the counterterrorism industry's most-cobwebbed and least-resolved debates: Should we let terrorist groups use the Internet, or should we try to knock them offline?
When the debate first started, not long after 9/11, terrorist use of social media -- anything from message boards to Facebook accounts -- was concentrated in a relative few channels. Today, it's spread to hundreds of different outlets, including multiple dedicated Web forums, blogs, Facebook, Twitter, YouTube, and beyond.
Stopping terrorists from spreading their propaganda online (using U.S.-based Internet companies to boot) seems like a no-brainer to many. But within the terrorism studies community, there are two common and sincere objections to disruptive approaches for countering violent extremism online.
The first objection is that knocking terrorists offline "doesn't work," because when you eliminate one account, the terrorists just open up a new account under a different name -- which is exactly what al-Shabab did after a little more than a week. And then, the theory goes, you're back to square one. It's a high-tech game of whack-a-mole.
The second objection is that forcing terrorists off the Internet destroys a valuable source of intelligence, because government, academic, and private sector researchers rely on these online operations for information about what distant groups are doing and who supports them. "The intelligence community took the position that you cannot take this stuff, you cannot take these sites, down," intelligence historian Matthew Aid told Voice of America last year after a number of jihadist forums went offline. The argument was that more information was gained "by monitoring these sites than any possible advantage that could be derived from shutting them down. And the intelligence community prevailed on this point."
Until now, there has been precious little data in the public domain to clearly support or refute either notion. But al-Shabab's termination is what scientists call a "found experiment" -- a free lunch in which the universe hands you the data you need to test a theory.
Al-Shabab is a particularly useful example, since its Twitter account has by most measures been one of the most successful terrorist forays into popular social media. But it's not the only one. Jabhat al-Nusra already has more Twitter followers than al-Shabab ever did, and jihadis are by no means the only extremists using the medium. So the lessons learned from this example are likely to have broad applications.
Theory One: Disruption accomplishes nothing because they just come roaring back
I collected a list of @HSMPress's followers on January 16, less than a week before the account was suspended on January 25. At the time, al-Shabab had nearly 21,000 followers. As of Sunday, February 17, two weeks after its creation, the new account had just passed the 2,400-follower mark. (I won't help them out by linking the new account, but it's not hard to find if you're interested.)
Obviously, al-Shabab will continue to rebuild its follower network, but a disruption doesn't have to be permanent to be effective. From January 26 to February 17, al-Shabab averaged about 1,300 followers per day. It currently has less than 12 percent of its former reach. And its followers are in no hurry to come back.
If it maintains its current rate of growth, al-Shabab will need six months to a year to rebuild its former network. While that pace could well accelerate, there's also no guarantee the account will ever fully recover.
Significantly, Al Jazeera English did a story on al-Shabab's return during the period used to make this forecast. The story linked directly to al-Shabab's account, yet it barely moved the needle in terms of generating new followers for the Somali terrorists.
So the termination is likely to produce months or more of disadvantage to al-Shabab. Its ability to communicate with fans and generate a supportive social network certainly hasn't been eliminated, but it's been seriously and measurably damaged for a fairly significant length of time.
This isn't the only dataset suggesting that disruptions to online extremist networks do long-term damage. An ambitious New America Foundation paper published last week by Aaron Zelin, a fellow at the Washington Institute for Near East Policy, tracked the number of posts per day at the most important jihadi message forums.
Zelin also benefited from a found experiment when two of the three top forums he was tracking were knocked offline for a significant amount of time. The cause of the disruption is still unknown, but its effects were easy to see in Zelin's data.
While two of the three forums were offline, the third one picked up some activity -- but not nearly enough to compensate for the loss of other two. The overall number of posts per day plummeted by 80 percent. After the two disrupted forums returned, their posts per day ran 13 percent lower than before the takedown.
One reason the disruption was less severe on the forums than on Twitter has to do with the structure of each network. When al-Shabab's Twitter account was terminated, it lost all of its followers and had to rebuild from scratch. User accounts on the forums can be backed up, so users did not have to re-register and they could jump right back in.
The forums are also destination Web sites; you go there seeking out specific kinds of discussion and community. On Twitter, where attention spans are shorter, most users follow multiple accounts, so the loss of @HSMPress was more easily overlooked.
Importantly, although there's a Web forum devoted specifically to al-Shabab, it has never gained nearly the same kind of traction that the Arabic jihadist forums enjoy. Al-Shabab is much more reliant on social media than the broader global jihadist community, so the termination of its Twitter account was a pretty big deal.
Theory Two: You lose valuable intelligence by knocking terrorists offline
@HSMPress had 21,000 followers -- surely that's more useful than 2,400, right? It's intuitive to think that more is better in the intelligence business -- no matter how many times solid leads drown while we try to drink from the fire hose.
But although we're still getting the same basic information from the account's tweets, our ability to evaluate al-Shabab's social network of supporters just got a big boost.
Twitter accounts accrue followers; that is their nature. Some of those followers are indiscriminate about who they link up with, others become inactive over time. Some are curiosity-seekers with a casual interest who are too lazy to unfollow. The vast majority are simply passive consumers of information.
Any time you can weed a dataset down from large and fuzzy down to small and focused, you're winning the intelligence game. The active social network that springs up around a propaganda account is its most important feature, and to study it, you need to winnow that list of 21,000 users down to the handful who are really engaged.
There are many different ways to do this, but here's just one, and it happens to be easy. We know who followed al-Shabab in January, and we know follows al-Shabab at its new account. There's noise in the new list of 2,400 followers as well, but we can use a comparison of the two lists to figure out who among the first group made a conscious effort to find and follow al-Shabab at its new address.
The former followers who quickly signed up for al-Shabab's new Twitter account -- just 882 users -- have a serious interest in the al Qaeda affiliate's activities.
While there is still some noise in the set -- well over 100 journalists and researchers, for instance -- this smaller group forms a strong starting point for analysis. We know these users are more likely to be very interested in al-Shabab, and the number is manageable enough that a single analyst can look at each account individually to make a more sophisticated evaluation.
A concerted effort to keep al-Shabab off Twitter forever would indeed cost Western observers valuable intelligence. But "forever" is only one option in a universe of possibilities. The "found experiment" of al-Shabab's Twitter suspension demonstrates that disrupting terrorists online doesn't hurt intelligence-gathering. It strengthens it.
In the world of countering violent extremism, opinions are plentiful, but unambiguous data are rare. Al-Shabab's travails provide us with clear evidence for the value of disruption.
All of this illustrates an important but oft overlooked point: Strategy doesn't have to be an all-or-nothing proposition. Total suppression of extremists on the Internet would cost us real intelligence, but that isn't a reason to just let them do whatever they want. By making their lives difficult, we make ours easier in ways large and small.