ISIS Tech Team Warns 'Brothers In Belgium' To Avoid Social Media After Brussels Attacks

A message purportedly sent to supporters of the Islamic State over the anonymous messaging app Telegram on Tuesday warned the group's "brothers in Belgium" to avoid social media, use "encryption" to communicate and to "keep [a] low profile until the heat dies down."

That message and others like it were first flagged on Twitter by Michael S. Smith II, a principal at the counter-terrorism firm Kronos Advisory, who told Mashable he viewed it in an invite-only channel that is dedicated to discussing ISIS and information security.

The Daily Dot identified that channel as one belonging to the Afaaq Electronic Foundation, an ISIS arm established in January dedicated to "raising security and technical awareness."

The message viewed by Mashable is directed to "all our brothers in Belgium," and provides seven tips for jihadis there hoping to avoid the police crackdown in the wake of Tuesday morning's bombings.

The missive tells supporters to "stay away from using Internet unless you are using encryption software," listing anonymizing tools such as Tor and the Invisible Internet Project (I2P), or the operating systems Qubes and Tails. 

When it comes to social media, the message says to avoid it completely. "Stay away from social media websites, don't share any information with your brothers right now," it says. The message also includes more general advice, such telling jihadis that they should "be ready to act," "change your location as soon as possible" and "keep calm."

If authentic, the message reveals a rarely-seen glimpse into how the group and its supporters race to clean their digital tracks in the wake of massive attacks. 

At the same time, it shows the group hasn't fully embraced actual encryption, as a number of security-focused people pointed out (one security researcher called it "Jihobbiests Jabber Gibberish").

These recommendations are not encryption tools, they are anonymity tools to disguise IP addresses. https://t.co/O4H3Mss6l0

— the grugq (@thegrugq) March 22, 2016

Others criticized the advice as merely too simple to be real.

"If its indeed ISIS, it's either too basic or nonsense," wrote Zeynep Tufekci, an opinion writer at the New York Times, professor and surveillance researcher, in a tweet.

"I hope ISIS recruits or fans try to take all the dumb advice above, and drastically and suddenly change their behavior, even go on TOR," she added. "Especially hope as many of them as possible try the change your location immediately and don't tell anyone bit. Because that would make them quite likely to get caught sooner. Doesn't read like serious 'advice,' more like posturing kids."

I hope ISIS recruits or fans try to take all the dumb advice above, and drastically and suddenly change their behavior, even go on TOR.

— Zeynep Tufekci (@zeynep) March 22, 2016

Supporters and fighters with the Islamic State embraced the private messaging app Telegram when it launched last year, and despite a purge of ISIS-focused accounts, it remains a favorite for those seeking to communicate with or about the group.

Speaking of ISIS: over 660 public ISIS channels banned since November; 5-10 removed daily following reports to abuse@telegram.org

— Pavel Durov (@durov) January 15, 2016

For example, the widely-reported statement attributing Tuesday's attack to the Islamic State first surfaced on a channel run by a news group aligned with ISIS.

The message is likely to be cited as evidence by writers and policymakers who view encryption as the latest threat to security in the United States.

Gotten lots of press people asking me if I think the Brussels bombers used crypto. Who knows. Maybe. They definitely used explosives, tho.

— matt blaze (@mattblaze) March 22, 2016

The American Enterprise Institute, a nonpartisan public policy research institute, tweeted a graphic on Tuesday detailing how terrorists use encryption, sharing it with the #BrusselsAttack hashtag.

How encryption aids terrorists & why we need a natl. commission @ohiomatt#brusselsattack https://t.co/FEwiezAykH pic.twitter.com/CXNuP5vjcz

— AEI Foreign Policy (@AEIfdp) March 22, 2016

Rep. Adam Schiff, a Republican congressman from California who is the Ranking Member of the House Intelligence Committee, later issued a statement, saying, "We do not know yet what role, if any, encrypted communications played in these attacks." 

But, he added, "we can be sure that terrorists will continue to use what they perceive to be the most secure means to plot their attacks."