Extremists experiment with decentralised social networks

[googlepdf url=”https://www.the420.in/wp-content/uploads/2019/11/Algorithms-Fintech-Lab.pdf” download=”Download” width=”400″ height=”600″]Extremists experiment with decentralised social
networks
Date Posted: 06-Dec-2019
Author: Ben Pierce Peter King
Publication: Jane’s Intelligence Review
Islamist and far-right extremists are widening their use of decentralised social
networks. Peter King and Ben Pierce assess the nature of these networks and
how they are being exploited by extremists.
Key Points
 Decentralised networks offer Islamist and far-right extremists online resilience, providing
them with a back-up in the face of online crack-downs.
 Extremists have not yet flocked to such platforms in large numbers because of their obscure
nature and current lack of reach when compared with more mainstream platforms.
 Extremists’ use of open-source code to set up their own interconnected platforms creates
resource challenges for online investigators, who will likely be required to operate across
more platforms.
Islamist and far-right extremists have long used social media outlets to recruit, radicalise, and fund
their activities, recently focusing mainly on exploiting platforms such as Facebook, Telegram, and
Twitter. These platforms are centralised – located on a specific set of servers that are controlled and
administered by a single entity. However, faced with ongoing crack-downs on such platforms,
extremists are increasingly experimenting with decentralised social networks that to varying
degrees are spread across multiple servers and not controlled by one entity. Jane’s assesses that
such networks can be categorised into those that rely partly on blockchain and peer-to-peer (P2P)
technology to create a truly dispersed network, and those that deploy open-source code on
conventional servers to form a series of interconnected platforms, known as a federated network.
Blockchain-linked platforms
Some social media platforms base themselves partly on decentralised technology known as
blockchain, which offers a different way of storing and authenticating data online. On a blockchain,
online information is packaged into blocks that are then linked with other blocks of information to
form a chain. That chain cannot be altered, because it is distributed across a global network of
computers that have to agree on its true state. The technology was originally deployed to support
the cryptocurrency Bitcoin, but it can also be applied to a range of online activities, such as
developing messaging services, games, storage platforms, or online shops, as well as social
networks. Information stored on a blockchain is decentralised, not stored in one place but on
multiple computers across several participating servers. For extremists, this eliminates the risks
associated with centrally stored data, providing them with a back-up option if they are removed
from centralised services

Steemit
One social network making use of this technology is Steemit, which was launched by US-based
social media firm Steemit Inc in January 2016. Steemit appears similar to mainstream social media
platforms, with users able to post text, images, and videos, like or dislike content, and follow or be
followed by other Steemit users. Unlike mainstream platforms, Steemit rewards users for their
contributions to the network, based on the popularity of their content on the platform. These
rewards are issued in the form of cryptocurrency tokens. Steemit is based on a blockchain called
Steem, which stores Steemit’s cryptocurrency transactions and some of its social media content
such as text. Content on the platform is grouped together under topic tags.
The platform is used by a limited number of far-right activists, political parties, and organisations,
who appear to create most of their content around the “information war” tag. An account in the
name of British far-right activist Tommy Robinson has been operating on the platform since
February 2019 and had 380 followers as of 26 November. The account promotes content that
targets Islam, far-left activists, and mainstream media outlets. Since its creation, it has built up
373,045 Steem cryptocurrency tokens, with Steemit estimating the value of the account to be
USD1,109 as of 26 November.
The account is linked to tr.news, a far-right website that appears to be run by Robinson supporters.
Robinson’s Steemit account republishes content on Steemit from tr.news by using SteemPress, a
plugin for the blogging platform WordPress that connects blogs to the Steem blockchain. Reposting
content on Steemit increases the online resilience of Robinson’s supporters. If tr.news were taken
offline, its content would remain online via Steemit, as it would be stored on the Steem blockchain.
3Speak
3Speak, which describes itself as a “free-speech video platform” that provides a service for
“content creators who have been deplatformed or demonetised by large tech companies”, is also
partly based on Steem blockchain. Registered users interacting with content on the platform are
rewarded by 3Speak with Steem’s cryptocurrency.
The platform has attracted a limited number of British and Australian far-right users, with accounts
set up and functioning in the name of Robinson; pro-Robinson users such as Broken Britain, Active
Patriot UK, and Antifa Watch Media; Britain First; former Britain First member Jayda Fransen; and
Australian activist Avi Yemini.

A screenshot of an account in the name of British far-right activist Tommy Robinson. The account
posts content on video-sharing blockchain platform 3Speak. (Source withheld)
1723220
Far-right users are attracted to the platform for several reasons. First, the platform’s “free speech”
outlook means it is unlikely to remove far-right content. The platform states that it supports users’
“right to be offensive” as long as they do not call for or incite violence. Second, 3Speak claims that
content uploaded on the platform is stored on the blockchain, meaning that it cannot be arbitrarily
removed by 3Speak, adding to the resilience of far-right content on the platform. Third, the
platform gives far-right users an avenue to generate limited amounts of funding through creating
content. For example, Robinson’s account had by 27 November posted 46 videos on 3Speak, with
each video generating up to USD100 depending on its popularity on the platform.
Minds
Minds is another social media platform making use of blockchain technology. Set up in 2015 by
American web entrepreneur Bill Ottman, Minds claims to be an open-source platform, which
means it has published its code online for others to use and improve. Similar to mainstream social
media platforms, users can set up “channels” on which they can post a variety of content.
Connecting with other users is done through subscribing to other channels or joining chat groups.
The platform is a hybrid of centralised and decentralised features. In terms of social media content,
Minds is a centralised platform hosted by Amazon Web Services. However, it features a
decentralised monetary component. This comes in the form of Minds tokens, which users earn
through generating content, maintaining their channel, or developing the platform’s code. Tokens
are issued via the Etherium blockchain and can also be purchased with the cryptocurrency Ether.
Users can send tokens as rewards to other users to support the content they prefer, or use tokens to
promote or “boost” their content so it receives more views. In addition, Minds features a peer-topeer payment system called Wire, which allows users to send each other recurring payments to
financially support their content. Payments can be sent in US dollars, Ether, or Bitcoin.
Far-right users have established a larger, more consistent presence on Minds than on Steemit. Many
of these users, particularly those espousing neo-Nazi ideology, connect with each other via theplatform’s group function, through joining groups such as The White Wolf Order, with 193
members, and The Fashington Post, with 393 members. Far-right users on Minds also appear to be
more geographically dispersed than Steemit users, claiming to be from Australia, Canada, Eastern
Europe, Scandinavia, the United Kingdom, and the United States.
Far-right activists tend to focus on using the centralised features of Minds in terms of posting text,
video, and photo content on the platform, as well as liking or disliking content and commenting on
it. However, they also use Minds’ decentralised features such as tokens and Wire. A panScandinavian neo-Nazi group known as the Nordic Resistance Movement (NRM) has amassed
more than 1,100 followers on the platform. During November 2019 alone, the group had received
16 peer-to-peer payments via Minds’ Wire feature. The platform does not reveal the amount or
currency of funds changing hands. The same month, the NRM received 58 Minds tokens, which the
group can use to “boost” its content to reach a wider audience on the platform. Minds tokens and
peer-to-peer payments are also being used by prominent neo-Nazi media activists on the platform,
such as the US-focused NatSockaccount, The Western Alliance, and Heathen Ways.

A screenshot of a purported Nordic Resistance Movement (NRM) account on Minds. The neo-Nazi
Nordic Resistance Movement exploits blockchain features of Minds to raise funds. (Source
withheld)
1723223
ZeroNet
ZeroNet is a decentralised network that does away with conventional servers altogether. Launched
in 2015, it relies on P2P technology, so that people visiting a site on the network also host its
content on their own computers. The content, which is dispersed across the network, is then served
or “seeded” to other users. This means that sites located on the network are virtually invulnerable to
take-down, making them far more resilient than a federated network of decentralised but
conventional servers, which remain vulnerable to distributed denial of service (DDoS) attacks and
dehosting

A screenshot of an Islamic State site on ZeroNet that has been dormant since March 2019 but
remains accessible. This attests to the resilience of blockchain technology. (Source withheld)
1723221
ZeroNet also uses blockchain technology to verify users’ identities and to register domains on the
network, which are assigned a bitcoin address rather than a conventional domain name associated
with an IP address. To access ZeroNet sites, users are required to download the open-source
ZeroNet client, which probably limits how much it appeals to a wider audience. The platform has
few users: it numbered in the low hundreds when accessed by Jane’s in November 2019.
ZeroNet has been used by Islamist extremists and far-right extremists, although neither grouping
has widely adopted the platform. A ZeroNet site hosting media output from the Islamic State
surfaced in December 2018 and continued publishing its propaganda, including editions of its
weekly Arabic-language newspaper al-Naba , until March 2019. The site has been dormant since
then, although it remains accessible, attesting to the technology’s resilience.
In August 2019, far-right users of the message board website 8chan set up what they called a
“semi-official 8chan emergency bunker” on ZeroNet following the disappearance of their surface
web site (8chan.net) after the 3 August El Paso attack in the US. But despite describing itself as
“semi-official”, 8chan administrator @CodeMonkeyZ tweeted on 6 August 2019 to say that his
team had played no part in setting it up. Writing on the same day, dark-web database firm DarkOwl
Vision claimed the site had actually been set up in April 2019, but said that it had remained largely
inactive until the main site went down. The landing page of the site was still available on ZeroNet
on 28 November, although none of its messaging boards appeared to be accessible. Another factor
potentially limiting the platform’s appeal is that users host and serve the content they access,
causing some visitors to voice concerns that they could be complicit in serving illegal material such
as images of child sexual abuse posted to ZeroNet’s 8chan site, according to The Daily Beast on 8
August.
In another development, @CodeMonkeyZ announced on Twitter on 2 November that 8kun, the
successor to 8chan, had successfully launched on a “new and experimental” decentralised platform
called Lokinet, which uses blockchain technology and a new routing protocol called Low Latency
Anonymous Routing Protocol (LLARP). Lokinet claims to be “censorship resistant” and “resilient
to attack” because it does not rely on a single server. Like ZeroNet, Lokinet requires the installation
of Lokinet’s open-source software to access sites on the network, which could restrict take-up.

Federated social networks are series of interconnected social media platforms that have published
their source code. Anyone can take that source code and create their own version, or “instance”, of
that network based on a different server, with users able to communicate with each other within and
between instances. Federated networks are decentralised in the sense that there is no single person,
company, or server running the wider network, but the individual instances that form that network
are run on conventional servers operated by specific entities.
Mastodon
According to The Federation, a website that gathers data on federated platforms, as of 27
November 2019 at least 2,721 instances have been built using Mastodon’s code, which was
launched in 2016. Mastodon, which adopts a micro-blogging format similar to Twitter, runs its own
instance known as Mastodon.Social, but Jane’s has detected little activity by far-right activists
there. However, far-right activists and groups are active on other instances created using
Mastodon’s source code. The most prominent of these is the self-styled “free speech” social
network Gab, which switched to base itself on Mastodon’s source code on 4 July 2019. According
to data from the Fediverse Network, which gathers information on Mastodon instances, as of 27
November Gab was the largest instance of Mastodon, with just over 1 million users.
Far-right activists on Gab connect with each other via the platform’s chat groups, such as White
Protection League (2,600 members), Australia (12,900 members), The Coming European Civil War
(3,200 members), National Socialists (1,400 members), and The Anglosphere (794 members). They
also communicate with far-right activists on other instances that are based on source code from
Pleroma, such as The Shitposters Club and Kiwifarms.cc, the latter of which is based on the US
internet forum of the same name that hosted content relating to the 15 March 2019 Christchurch
mosque attacks.
A screenshot of a white supremacist user on Gab connecting with Shitposter Club. Shitposter Club
is another far-right instance based on Pleroma’s open-source code. (Source withheld)
1723219
There have also been reports of Islamic State supporters setting up accounts on Mastodon, but
Jane’s has seen little evidence that the platform is being exploited by them in any co-ordinated
way.

RocketChat promotes itself as an alternative to online team collaboration tools such as Slack, which
are designed to enable direct communication between relatively limited groups of people.
Originally launched in 2015, the company provides free open-source software that anyone can
download and deploy on their own servers, enabling them to retain full control of their
community’s data. Because of this, RocketChat itself is unable to take any action against content
posted to privately hosted instances of the platform and its terms of service only apply to instances
hosted on RocketChat’s own cloud.
In May 2019, RocketChat also introduced federation, which means that users on one private
instance of the platform are now able to chat to users on other servers. This potentially provides
exposure to RocketChat’s 25 million users across 350,000 servers worldwide. However, federation
is not enabled by default and the owner of an instance has to opt in to the functionality, meaning
that the likely potential audience is much reduced.
As RocketChat instances rely on conventional servers, they are still vulnerable to dehosting or
DDoS attacks that can take them offline.
Media operatives associated with the Islamic State began openly exploiting RocketChat in
December 2018 when the Islamic State-affiliated Nashir News Agency announced that it had
established a presence on the platform and began to publish official media output there. That
content was posted to a privately hosted pro-Islamic State chat service built on RocketChat’s opensource software using the name TechHaven. Although TechHaven has never overtly expressed its
Islamist extremist affiliations or pro-Islamic State stance, its almost exclusive hosting of channels
promoting the Islamic State and its media content give a clear indication of its agenda. The
TechHaven user guide hints at its leanings while avoiding militant terminology, claiming to provide
“an open forum for discussion, digital privacy, and innovation to oppressed users in conflict zones
who are targeted for their beliefs by the authoritarian regimes of the West”.
TechHaven has never opted into RocketChat’s federated network, so the potential audience for
material posted there is currently restricted to the approximately 1,700 registered users of the server
at most. The service effectively functions as a mini private social network for a small number of
Islamic State supporters. Accessibility is restricted to those with whom the registration link has
been shared. The link enables people to bypass the landing page which advises that “new user
registration is currently disabled”.
Sporadic Islamist extremist activity on TechHaven suggests it is likely being maintained as a
potential back-up for Islamic State channels on the messaging app Telegram, which has been the
key distribution platform for Islamist extremist propaganda since September 2015.
There has been relatively little disruption to the pro-Islamic State instance of RocketChat, although
it does appear to have been subject to a DDoS attack in March 2019, when the service went offline
for around one week. The service was revived with its database intact at a new domain and has
since operated without significant disruption.
Friendica and Diaspora
Friendica and Diaspora both allow users to set up their own privately-hosted instances. Both were
set up in 2010, placing an emphasis on users’ ability to retain control of their data rather than handing it over to the big social media firms where it is stored on centrally operated servers. The
two networks use different federation protocols.
Friendica was first released under the name Mistpark and has been developed by a network of
volunteers who publish their source code and offer the service for free. The platform enables
communication with users of other Friendica servers, as well as those with accounts on instances of
other federated social networks such as Diaspora, Mastodon, and GNU Social, as well as Twitter.
Friendica currently lists 127 servers, many with only a handful of users. Statistics from The
Federation website, accessed on 26 November 2019, suggest that there are just under 15,000 users
of the network.
Diaspora has grown to sustain a far larger user base, with more than 720,000 Diaspora users
dispersed across more than 200 servers or “pods”, according to The Federation website. The
platform is backed by a non-profit foundation that oversees branding and finances. The Diaspora
protocol of federation is currently unable to pull posts from other social networks as it works on a
“push” model of federation. However, other federated social networks are able to pull Diaspora
posts. Diaspora has said it is planning to change its code to enable it to communicate with other
networks.
Friendica was the first decentralised network that Islamist extremists were observed to experiment
with; in June–July 2014, Islamic State media operatives set up “official” accounts there amid a
clampdown on the group’s presence on Twitter. The accounts were set up on a third-party Friendica
server (friendica.eu) where they survived for more than one month before being taken down by the
server’s administrators.
After the removal of accounts from Friendica, Islamic State media operatives then turned to
Diaspora and another decentralised platform called Quitter – an instance of the GNU Social
federated network. In both instances, the accounts were again set up on default or third-party
servers and operatives did not set up their own server. Although the Quitter accounts were taken
down within a day, Islamic State members used Diaspora as their primary route for disseminating
propaganda for approximately one month before they too were taken down after being used to
publish a beheading video.
At the time, no discussion was observed among Islamist extremists about the possibility of setting
up privately hosted servers on these federated social networks that might have made the Islamic
State accounts more resilient. Since these failed experiments in 2014, there have been no signs of
Islamist extremists persevering with the platforms.
Riot
Riot was launched in July 2016 and built on a different communication protocol: Matrix. Like
Friendica and Diaspora, users can choose to set up their own server, register an account on the
default server (in this case, matrix.org), or register on a third-party server (e.g. tchncs.de). Riot says
its servers are always interoperable, which means users on any server can talk to people on any
other Riot server. But it also gives users the ability to limit access, for example restricting a chat
room to those who have been specifically invited. In this way, Riot has the potential to be exploited
for private communication on an invitation-only basis, with all data stored on a server run by one of
the participants.

Riot was promoted briefly as an alternative dissemination platform for Islamic State propaganda in
September 2017, just over one year after the platform’s launch, when the key distributor of official
Islamic State media output, Nashir News Agency, set up accounts there. The accounts were,
however, set up on Riot’s default server and were quickly taken down.
A screenshot from the federated network Riot on 28 November. Islamic State supporters continue to
use Riot despite being removed from its default server. (Source withheld)
1723222
Despite the swift action against the extremist accounts, Islamic State supporters have continued
using the platform. The main proponent of Riot since then within Islamic State circles has been the
tech-focused Electronic Horizons Foundation (Arabic: Mu’assasat Afaq al-Iliktruniyah), which has
hosted its accounts on a third-party server run by an individual in Germany: tchncs.de. Those
accounts have generally remained resilient, although the platform as a whole has only attracted
between a dozen and 100 Islamic State supporters as members. Jane’s observed that activity levels
of members were low, however, suggesting that members may sign up to channels but not visit the
platform again.
There are currently more than 1,600 servers on the Matrix network, of which Riot is the main client
app. Although no Islamist extremists have been observed setting up their own servers, it remains
possible that private servers may have been set up for secret communications between extremists
on Riot and other federated networks.
Conversations
The Android app Conversations, launched in 2014, is a client for the Jabber/XMPP federated
messaging protocol that allows users to set up their accounts on the server of their choice or set up
their own XMPP server. But the XMPP protocol itself dates to the late 1990s.
Conversations supports the OMEMO encryption mechanism, which has attracted interest from
Islamist extremists including the Islamic State. In November 2016, the group’s weekly Arabiclanguage newspaper al-Naba recommended Conversations for private communication in some
circumstances. It has also been used and promoted by pro-Islamic State security-focused groups
including Electronic Horizons Foundation, which has advertised its own Conversations address
hosted on the third-party server draugr.de. No examples have been observed of Islamist extremists

publicly operating their own XMPP server.
Outlook
Far-right activists see advantages in using platforms based partly on blockchain technology. By
doing so, their content is more difficult to take down because it dispersed across the world wide
web, and they also use such platforms to generate funding for their activities in the form of
cryptocurrency. Again, as this activity is blockchain-based and therefore distributed across several
servers, it appears to offer a stable source of funding for such activists.
However, the far right is still experimenting with blockchain-based platforms and has not yet
gravitated to such platforms in large numbers, instead preferring to build its online resilience
through a presence on multiple centralised social media platforms, one of which is Gab.
Although Gab is based on a conventional centralised server, its role as an instance of a wider,
decentralised network of federated social media platforms is connecting far-right activists to likeminded individuals in other instances. This presents resource challenges for online investigators as
it may require them to operate across more instances and understand particular online subcultures
in each instance to appear credible and gain access to such instances.
In addition, some instances cannot be fully researched without creating an account and logging in.
Setting up a presence on Gab, for example, will allow an investigator to search for and find targets
on another federated social media network, but it may not allow the investigator to see the full
extent of communication between users on that other network – only creating an account on that
network would allow this.
Investigators have to take into account more considerations when creating accounts on separate
instances. Some instances have set up security questions to vet new members before they are
allowed to join, which means that investigators may have to spend more time on creating believable
personas that will get them inside.
However, Blockchain-linked platforms do offer new opportunities to collect information on targets.
The transparency of information on the blockchain means that on platforms such as Steemit, it is
possible to see who is wiring funds to specific accounts. This is useful information in terms of
building a picture of a target’s funding network.
Although Islamist extremist groups such as the Islamic State, and their supporters, have
experimented with decentralised social networks, these more obscure platforms do not yet offer
them the same reach as centralised social networks such as Twitter, Facebook, or Telegram. For
this reason, they are unlikely to be the first choice of extremists, despite playing an important role
in providing resilience after online takedowns on more mainstream platforms. If decentralised
platforms become more widely adopted, they will then have more reach and at that point will likely
become destinations of choice for extremists.
***This feature, originally published on 6 December 2019, has been republished to correct an
error in an image caption

On the web
RocketChat platform offers potential Telegram back-up for Islamic State
UK’s far-right groups flee to alternative platforms to evade scrutiny
Islamist extremists advised to improve operational security on Telegram
Author
Peter King has investigated Islamist extremists’ internet use since 2004, when he pioneered the
systematic research and analysis of online militant media for the UK government. Ben Pierce is a
consulting principal based in Jane’s Intelligence Unit, focusing on investigating online far-right
extremism.