How Dark Web Monitoring can Overcome the Challenges of Policing Terrorism on the Dark Web

The rise of terrorism groups using the dark web

The dark web has long been a haven for illegal activities. Among its most critical dangers is its role in facilitating terrorism, which poses complex challenges for law enforcement across the globe.

Terrorist groups have significantly expanded their cyber capabilities in recent years. They are now using the dark web to carry out a range of activities, including fundraising through cryptocurrencies, acquiring weapons, and planning attacks. However, perhaps the most alarming use of the dark web is the spread of extremist ideologies, recruitment of new members, and the radicalization of individuals around the world. Manuals such as “How to Survive in the West: A Mujahid Guide” provide instructions on internet privacy and the use of Tor, demonstrating terrorists’ adaptability to technological advancements.

Radicalization no longer happens solely in physical spaces like mosques or underground cells. It has moved online, where terrorist groups can reach vulnerable individuals with sophisticated propaganda. Extremist content on the dark web is often designed to target disenfranchised individuals, playing on their grievances and pulling them into a cycle of violence and hate.

This underlines the new digital realm of terrorism. Unlike traditional criminal activities, terrorist recruitment and radicalization on the dark web crosses borders, making it a global problem.

The use of the dark web by terrorist groups presents law enforcement with a challenge. Traditional security frameworks, focused on physical threats and tangible crimes, aren’t sufficient enough in dealing with the nature of online terrorism. Law enforcement agencies are now tasked with monitoring vast expanses of the dark web, which is designed to provide anonymity to individuals.

As well as the dark web, terrorist groups are using communication channels, such as Telegram, to make it difficult, and further complicate efforts for law enforcement to track them down. The large-scale messaging capabilities also makes it an ideal breeding ground for terrorist propaganda and recruitment.

Current challenges facing law enforcement fighting terrorism on the dark web

Law enforcement faces several challenges when fighting terrorism on the dark web. These challenges stem from the dark web’s structure, its anonymity, and the evolving tactics of terrorist groups. Here are some of the key issues law enforcement agencies currently have:

Anonymity and encryption

The nature of the dark web is to keep its users anonymous and mask identities and locations. This makes it extremely difficult for law enforcement to track down who is behind terrorist activities. Even when agencies manage to access dark web forums or chat rooms, identifying the individuals responsible for creating content, communicating, or facilitating terrorist acts is often impossible without breaking through multiple layers of encryption.

Decentralization and dispersed networks

Unlike traditional terrorist networks that had a clear structure, modern terrorist groups using the dark web are often decentralized. This means that instead of having a single hub or leadership, cells or individuals act independently while being connected to larger ideological movements online. This decentralized format makes it difficult for law enforcement to shut down entire operations by targeting just one group or platform. When one network is disrupted, others quickly emerge. 

Lack of jurisdiction and global reach

Terrorist activities on the dark web are not confined to national borders. A recruiter in one country can radicalize an individual in another, and payments for illegal activities can be facilitated across multiple regions using cryptocurrencies. This global reach complicated investigations because no single law enforcement agency has the jurisdiction or authority to act across all borders. International cooperation is crucial, but the differing laws and policies make coordination slow.

Encrypted communication channels

Terrorist groups frequently use encrypted messaging apps like Telegram, Signal, and WhatsApp in addition to the dark web to communicate securely. These platforms are protected by end-to-end encryption, meaning that even the service provider themselves can’t access the content of the communications. This makes it extremely hard for law enforcement to intercept messages or understand the communications.

Propaganda and recruitment

One of the dark web’s primary uses in terrorism is the dissemination of extremist propaganda. This material is designed to radicalize vulnerable individuals and recruit them into terrorist organizations. Law enforcement agencies struggle to keep up with the vast amount of content being produced and shared on the dark web. Even when platforms are taken down, new ones quickly emerge, and the propaganda continues to spread.

Language barrier

While a lot of communication on the dark web is written in English, Russian is the second most popular language, accounting for 66 percent of non-English language content. Analysts and investigators monitoring criminal activity on the dark web can approach this by copy and pasting the content they find into generic translation tools, which may not be accurate, but is also extremely time consuming considering the size of the dark web. As well as having to use resource to translate Russian, many cybercriminals and terrorists using the dark web use Russian slang, which may cause further issues when translating using free online tools.

Law enforcement successes combating terrorism on the dark web

While law enforcement do face many challenges with the rise of terrorism on the dark web, there have been some successful cases where agencies have infiltrated terrorist organizations.

Operation Onymous

One of the largest international law enforcement operations targeting dark web activities, Operation Onymous resulted in the takedown of multiple dark web sites, including terrorist-affiliated networks. Several individuals with connections to terrorism financing and propaganda dissemination were arrested. This operation demonstrated the potential for coordinated global action to target illicit activities, including terrorism on the dark web.

The operation resulted in:

• 410 hidden services taken down.
• 17 vendors and administrators arrested.
• $1 million of Bitcoins.
• 180,000 Euros in cash, as well as drugs, gold and silver seized.

Operation Glowing Symphony

In 2016 Operation Glowing Symphony targeted the terrorist group, ISIS, and their use of the dark web and other encrypted platforms. U.S. Cyber Command and other intelligence agencies disrupted ISIS’s online operations, including their propaganda distribution and recruitment on the dark web.

The operation managed to shut down the mobile application of ISIS’s official news outlet “Amaq Agency”, and interrupted the regular publishing of the group’s most popular magazine online, which was discontinued later together with the organization’s websites in foreign languages.

Overall, Operation Glowing Symphony has been described by U.S. officials as “a watershed moment” in the process of commanding as well as conducting complex cyber operations. It has also been considered as an example of the “American way” of fighting a cyberwar, and a demonstration of its offensive cyber capability.

Europol’s counter-terrorism unit – 2018

In 2018 Europol worked with several national law enforcement agencies to take down numerous online networks linked to terrorist organizations like al-Qaeda and ISIS. The takedowns focused on websites, dark web forums, and encrypted communication channels that terrorists were using to spread extremist materials and guide their recruits.

The operation was coordinated by the European Union Internet Referral Unit (EU IRU) within the European Counter Terrorism Centre (ECTC) at Europol and involved authorities from Belgium, Bulgaria, Canada, France, the Netherlands, Romania, the United Kingdom and the U.S.

This law enforcement activity led to the seizure of servers and evidence, helping to arrest individuals responsible for maintaining these platforms.

“With this groundbreaking operation we have punched a big hole in the capability of IS to spread propaganda online and radicalize young people in Europe,” outgoing Europol Director Rob Wainwright said.

European Commissioner for Migration and Home Affairs Dimitris Avramopoulos also expressed optimism that the operation would bolster the EU’s fight against terrorism and extremism. “Today’s international takedown action, with the support of Europol, shows our global strength and our unwavering resolve to fight against terrorist content online,” Avramopoulos said. “Daesh is no longer just losing territory on the ground — but also online. We will not stop until their propaganda is entirely eradicated from the internet.”

How can law enforcement agencies overcome the threat of terrorism on the dark web?

The takedowns discussed demonstrate that while the dark web offers a level of anonymity, cybercriminals shouldn’t feel complacent that they won’t ever be uncovered. But what more can law enforcement agencies do to tackle terrorism on the dark web?

Anonymity and encryption

Despite the dark web anonymity, dark web monitoring tools help law enforcement agencies navigate the challenge by focusing on the behavior and operation patterns of users rather than uncovering users identities. While the dark web allows users to obscure IP addresses, people often leave digital traces through repeated actions or distinct communication styles. By tracking these patterns, law enforcement can build profiles of potential suspects.

Additionally, monitoring cryptocurrency transactions on the dark web – often used to fund terrorism – can also reveal links between anonymous online users and real-world people.

Decentralization and dispersed networks

Dark web monitoring and threat intelligence are critical in identifying decentralized and dispersed terrorist networks by uncovering hidden communications, financial transactions, and behavioral patterns across multiple platforms. Using not only current data, but being able to look back at historical data, law enforcement can gain a broader understanding of how decentralized terrorist networks begin, operate, fund themselves, and communicate. Monitoring cryptocurrency transactions or the exchange of illegal goods on the dark web can reveal links between distant cells, while threat intelligence can map out the broader network. This approach allows authorities to track and disrupt these dispersed networks more effectively, preventing threats before they escalate.

Lack of jurisdiction and global reach

Dark web monitoring and threat intelligence are essential tools in overcoming the lack of jurisdiction and the global reach of terrorism on the dark web. Terrorist networks exploit the anonymity and encryption provided by the dark web to operate across borders without being tied to any specific jurisdiction, making traditional law enforcement methods less effective. The ability to gather intelligence from a global network helps bridge the gap, as authorities can observe and collect intelligence on terrorist operations that span multiple countries. This intelligence can be shared across borders and barriers, which gives agencies the information they need to act against terrorist networks.

Encrypted communication channels

Telegram, with its end-to-end encryption and large group functionalities, has become a popular platform for terrorist networks to communicate, recruit, and plan attacks. While these messages are often hidden from public, dark web monitoring can track discussions around Telegram channels or coordinate illicit activities. Threat intelligence further supports this by leveraging intelligence to gather actionable data from these Telegram conversations.

By combining dark web monitoring with threat intelligence, law enforcement can effectively track present and past terrorist communications on Telegram, disrupt planning efforts, and gather crucial information to prevent attacks.

Propaganda and recruitment

Terrorist organizations use the dark web to distribute extremist content, recruit new members, and radicalize individuals. By monitoring dark web forums, and communication platforms, law enforcement agencies can track the distribution of propaganda materials, such as videos, manifestos, or extremist teachings. This helps law enforcement identify how and where terrorist groups are disseminating their ideology and engaging potential recruits.

By understanding how these networks operate, authorities can take targeted action to shut down websites, intercept communications, and arrest individuals involved in recruitment efforts. This proactive approach helps prevent terrorist groups from growing their ranks and reduces the impact of their propaganda, making it harder for them to spread their extremist narratives across the internet.

Language barrier

While free online translation tools may not be answer to help translate the likes of Russian slang from the dark web, AI-powered language translation tools are. Used alongside dark web monitoring and threat intelligence, Neural Machine Translation (NMT) system isn’t a tool that simply translates on word at a time, it takes the entire sentence and translates the target language the way a professional human translator would. This vastly increases the accuracy of the translation as the true meaning of the sentence is captured. The NMT system has been trained on Searchlight Cyber’s data lake, once again increasing the accuracy of the translation for content that law enforcement agents deal with.

Using the dark web to weaken terrorist cells

The dark web’s role in terrorism represents a significant threat to global security. Its use for recruitment, radicalization, and communication by terrorist organizations demonstrates the evolving nature of terrorism. Dark web monitoring is essential for law enforcement to counter terrorist activities that thrive on anonymity. By using intelligence and monitoring, agencies can seize dark web servers, shut down terrorist groups, disrupt networks, and ultimately weaken terrorist cells.