Propaganda images reveal how terrorists think

Researchers have used artificial intelligence to analyse over 30,000 propaganda images produced by the Islamic State (IS) between 2014 and 2022. 

A group of IS soldiers with weapon and an IS flag.
From Diyala, Iraq, in the spring of 2022: a group of IS soldiers swears Bay’ah – an oath of allegiance to the new IS caliph. This is one of the 30,000 IS images that have now been analysed. 

Propaganda is an important part of the operation of a terrorist organisation. They use text, video, audio, and images to not only spread fear, but also to recruit and build their image internationally. By using the internet and social media, even terrorist groups with limited resources can reach a global audience.

For researchers studying terrorist groups, propaganda material is an important source in understanding who the actors are, what they want, and how they operate. The challenge for researchers is the sheer amount of propaganda that is being produced, which makes it almost impossible to get an overview through manual means. 

Because IS controlled a large area in Syria and Iraq for several years, they gained more resources and more members who could work as ‘journalists’ or content producers. Propaganda was clearly a prioritised area in the organisation, and the battles they were involved in provided them with plenty of raw material. 

‘IS stood out because their propaganda was better than the content of earlier terrorist groups. They managed to create a “brand” and a linguistic and visual expression that appealed to the youth, combined with extremely brutal content where close-ups of killings were almost a given,’ explains Skretting. 

Although the group is now marginalised in its original core areas in Syria and Iraq, its branches in other parts of the world have made significant progress – especially in Africa. IS still maintains a unified and substantial propaganda apparatus. 

IS – a pioneer in terrorist propaganda 

The researchers have based their work on the extensive image material published on IS’s official channels over the years. The dataset, consisting of 30,000 images, was fetched from an IS bot on Telegram. 

‘IS has revolutionised how non-state actors and terrorist groups conduct propaganda. This is considered one of the keys to the group’s success,’ says researcher Vidar Skretting. He co-authored the report with colleagues and AI researchers Mathias Bynke and Bernt Ivar Nødland.

The rise and fall of IS 

In 2013, a group called the Islamic State in Iraq and the Levant (ISIL), managed to occupy large parts of Syria and Iraq. In 2014, they seized Mosul, Iraq’s second-largest city. Shortly thereafter, ISIL declared that they had established a new caliphate, to which all Muslims were obliged to submit. At the same time, they removed the geographical reference from their name and adopted ‘the Islamic State’ as their designation, or IS for short. 

From 2014 to 2018, IS gained international notoriety for its brutal conduct. They implemented a reactionary form of Islamic law and carried out executions and amputations of prisoners, genocides against minorities, public slave trading, and numerous terrorist attacks on civilian targets in the Middle East, Asia, Africa, and Europe. 

At the same time, they wanted to show that they had established a true Islamic ‘state’. The group emphasised creating a civil state apparatus and established institutions for law and order, tax collection, education, and healthcare. In addition to violence and brutality, the ‘civil’ side of IS became a recurring theme in the group’s propaganda production. 

IS reached its territorial peak in 2015, when the group controlled about one-third of both Iraq and Syria. After this, IS was gradually pushed back by an international coalition. The last IS-controlled area was captured by Kurdish forces in early 2019. Thus, IS went from being a state-like entity back to an underground organisation.

A dedicated IS social media 

Initially, IS used established social media platforms like Twitter (X), Facebook, YouTube, and, later, the Telegram app to spread their content. 

‘The spread of propaganda on social media is one of the reasons so many foreign fighters from around the world joined IS,’ says Skretting. 

‘Today, it’s much more difficult for IS to reach out. Major social media platforms remove such content almost immediately after it’s posted. However, IS still manages to disseminate its content effectively through other channels, and it’s relatively easy for sympathisers to find them,’ Skretting adds. 

IS spreads its propaganda through three main channels: ‘private’ social media platforms that they run on their own servers, bots on Telegram, and regular indexed websites. 

‘The private social media platforms IS runs have been active for years. Telegram bots and the indexed websites are regularly taken down by administrators and authorities but are usually reopened by IS under different names shortly thereafter,’ says Skretting. 

Two researchers present at an FFI event.
Mathias Bynke (to the left) and Vidar Skretting (to the right) present their report during an FFI event on 12th of December 2023. Photo: FFI / Anders Halvorsen Fehn.

Sorting 30,000 images 

In their work, the researchers used a machine learning model from OpenAI called Contrastive Language-Image Pre-training (CLIP). The model is trained to compare images with text. 

CLIP has been trained by collecting enormous amounts of images and corresponding captions from the web. By comparing millions of images and captions, the model has gradually learned how images can be described in words and, conversely, how an image might look based on the text describing it. 

By running the 30,000 images through CLIP, the researchers could, for example, ask the model to find all images showing a ‘person praying’ or ‘combat action.’ However, instead of manually defining the categories in which the images should be sorted, the researchers used a clustering algorithm to group the images by theme. 

‘We didn’t know in advance which descriptions would suit various themes. When you provide the CLIP model with a limited number of categories, an image of a man diving into a river could easily end up in the category “image of someone praying”,’ explains Mathias Bynke.

Illustration of the Clip model.
The Clip model.

The CLIP model translates an image into an embedding vector, that is, a sequence of numbers. It also translates the image captions into a sequence of numbers. If you have an image of apples, the number sequence for the image should be approximately the same as the number sequence for the text ‘image of apples.’ 

The number sequence that CLIP generates for each image can be converted into coordinates in a coordinate system. This gives each image a position on a map. Then, an algorithm can cluster these points into groups. You can choose how many clusters you want, and the algorithm organises the images for you. 

When the researchers asked the algorithm to create two clusters, one group was dominated by military images, and the other by civilian images. 

In the end, they settled on 14 different named clusters: combat scenes, soldiers outside combat, enemy bodies, executions and killings, close-ups of individual fighters, weapons, civilian crowds, peaceful scenes, collapsed buildings, civilian casualties, food, public works, crafts and industrial production, and burning cigarette packets.

What have we learnt about IS from the images? 

Once the images were sorted, the researchers wanted to answer the following question: How has IS’s image propaganda evolved from 2014 to 2022, and what does this development tell us about IS as a group? 

‘The images IS publishes, the number of images published, and where they are published give us an indication of what IS is doing, how active they are, and in which areas they’re active,’ says Skretting. 

He believes that insight into the development of terrorist organisations can be important in predicting their direction and strategies: By looking at the images from the African provinces where IS is on the rise, we might gain insight into where IS is heading in the future. 

The analysis shows that in the early years (2014–2018), IS presented itself as both a military organisation and a civil state apparatus. This is linked to their attempt to build a ‘real’ Islamic state. 

Since 2019, the focus has shifted. IS now presents itself almost exclusively as a military movement and insurgent group. 

Two men working.
An example of one of the ‘civil’ images of IS’s Iraq and Syria branch, in the ‘public works’ cluster.

2015 was the year IS was most active in terms of propaganda. Nearly half of all the images in the dataset are from this year, which coincides with the time when IS was at the height of its power in Syria and Iraq. Thus, most of the images in the material are from Syria and Iraq. 

‘The group has been defeated in their previous primary areas but is rebuilding in Africa. We also see this trend in the image material,’ says Skretting. 

Activity was at a low point in 2020 but has since increased. The majority of images are now published in West and Central Africa. These differ from those produced in the Middle East in several ways. 

‘There is much less focus on individual jihadists and martyrs. At the same time, the propaganda images are generally more brutal. They’re dominated by military content, reflecting the fact that they are most active as a military organisation,’ says Skretting. 

Further development of the methods is needed 

The researchers conclude that the combination of CLIP and clustering algorithms is an effective method for quickly analysing large amounts of propaganda images. 

‘The division into clusters was not perfect. A certain proportion of the images appeared misclassified, and we had to implement mechanisms to filter these out. But the method helps to speed up the analysis,’ says Skretting. 

He emphasises that the combination of CLIP and clustering algorithms can be used for more than analysing terrorist images. 

‘The method is relatively simple and scalable. You can easily use it to sort image collections far larger than 30,000 images into thematic clusters. The method is particularly useful if you don’t know a lot about the content of the image material in advance.’ 

The researchers believe we should further develop machine learning methods to map propaganda from state and non-state actors. 

‘This type of method is not only relevant for image analysis but also for getting an overview of large text, audio, and video materials,’ stresses Mathias Bynke. 

FFI-Report 2024

The cyber dimension of space systems – an analysis of offensive cyber operations targeting space infrastructure

Cyber security and space security are merging due to increased digitalization of space infrastructure and operations. Non-kinetic counterspace capabilities such as cyber operations are an attractive alternative to kinetic weapons due to their ability to avoid hazardous debris and operate below the threshold of armed conflict. This continued intertwining of outer space and cyber space introduces a larger cyber dimension to space infrastructure. This report is a step towards building an understanding of what this development may entail by exploring how offensive cyber operations can be used to target space infrastructure. It serves as a starting point for understanding the implications of these developments for security and strategy. The research question guiding the analysis is “how does the space-cyberspace nexus influence the risk of offensive cyberoperations targeting space infrastructure?” The question is answered by analyzing how a motivated actor can gain access to key components of the infrastructure and what effect such operations may create. The analysis begins with a description of the elements of space infrastructure before expanding on a conceptualization of offensive cyber operations derived from cyber conflict literature. Further, we analyze how offensive cyber operations may be used to target space infrastructure. Focus is on two of the three components in space infrastructure: the ground segment and the space segment. Finally, we present a summary of effects and a categorization of vulnerabilities, before concluding and pointing to recommendations. We identify two interlinked groups of vulnerabilities. The first is the vulnerabilities following from the practices in the contemporary space industry popularly called New Space. The second group of vulnerabilities follow from the lack of implementation of well-known best practices in ensuring adequate cyber security. The reasoning for these not being implemented is twofold. Firstly, there are practical challenges stemming from the physical qualities of space technology and infrastructure. Secondly, the New Space industry is still in its youth and has yet to establish a security culture incorporating an understanding of the cyber threat landscape. The limited attention allotted to cyber security responsibilities and risk in the supply chain of the space industry is a testament to this reality. This points to a need to prioritize an adequate risk awareness, security culture and cyber security in space systems. We recommend strengthening the security and resilience of space infrastructure against offensive cyber operations by promoting comprehensive risk assessments, enhancing cyber security practices, cultivating a robust security culture, improving supply chain security, and enhancing preparedness through contingency planning and scenario-based implication analysis.
FFI-Report 2024

Multinational search and rescue in the Arctic – findings from a concept development assessment game

The Norwegian Defence Research Establishment (FFI) facilitated a three-day concept develop-ment assessment game (CDAG) in Oslo, October 15–17, 2024. FFI conducted the game to support the multinational project Climate change in the Arctic: Security implications and conse-quences for military operations (CLIMARCSEC), which develops a conceptual framework to help military planners better conduct, align, and deploy resources in future multinational force operations in the Arctic. The primary purpose of the Oslo CDAG was to provide results for a report on the implications of climate change for search and rescue (SAR). The game used scenarios which described hypo-thetical SAR missions in the Arctic. A total of 15 international participants took part in the game, playing as two operational teams which developed simple courses of action and plans for the possible SAR response within the scenarios. By comparing plans made by the two teams, the participants were able to identify several challenges that military planners must consider for missions in the Arctic. Search and rescue in the Arctic may seem well regulated through international agreements, where SAR is treated as a national responsibility within pre-defined geographical regions. However, the Arctic is a huge area, and rescue resources are limited and thinly spread. Thus, the practical conduct of SAR will often be multinational, based on whatever resources are near the mission area. Participating units may be both civilian and military, which adds to the challenge of sharing information and coordinating operations. Through plenary discussions, the participants identified possible recommendations and solutions to address some of the challenges. We have analysed these recommendations and grouped them into four categories: 1. ensuring international and civil-military collaboration 2. developing relevant multinational planning products and operational tools 3. conducting more multinational exercises and training 4. linking multinational SAR operations to guidance from higher-order military concepts This report is not a comprehensive functional concept to guide multinational SAR in the Arctic. However, it provides relevant guidance if such a concept is to be developed. Additionally, the report gives valuable input to future scenario-based analyses of SAR capabilities and solutions through the description of courses of action, tasks, and challenges.
FFI-Report 2024

Nyttestyring i forsvarsprosjekter – hvordan formulere gode effektmål?

The defence sector, as other sectors, experience challenges both with measuring and with achieving effect from investments. Benefit management is an essential tool to achieve effect from investments. This has been well documented in empirical studies. However, there has been limited research on benefit management within the defence sector. An important part of benefit management in the early phase of a project is defining goals. This study considers how goals for defence projects should be defined, with focus on the early phase of a project. The research questions are thus: 1) How is effect described in the early phase of defence projects? 2) How should the defence sector define appropriate effect goals? To answer the first research question, we have analysed goals in a selection of concept studies in the defence sector. This has given us an overview of how identification and planning is done in the early phase of defence projects. The second research question was answered by comparing our findings to best practice for SMART goals and considering how the defence sector can defined suitable effect goals. We find that the effect goals are not formulated as technical deliveries. This shows that the sector differentiates between effects and results, which is good. The sector is less effective, however, at setting clear levels of ambitions. Phrases such as ‘increased’, ‘reduce’ and ‘improved ability’ are common in the projects we have evaluated. Such intangible ambitions make it harder to verify that the goal is achieved and connect the results to the investment. Our analysis shows that the effect goals achieve medium score on the SMART scale and that there are significant variations between the projects and the quality of goals within the same projects. This shows that there is still potential to improve and create a unified understanding of how project goals are defined. Our analysis concludes that overall, the goals are sufficiently defined for the early phase of a project but are less suited when the same goals are used through the later project phases. Building on these results, we have developed specific guidelines based on the SMART framework to help develop suitable effect goals. In addition, we have three recommendations for developing guidelines and templates for better benefit management: 1. Making clear guidelines and requirements for effect goals – to ensure a unified understanding and high quality. 2. Requiring that the effect goals are updated – to make sure that the goals are revised if they are no longer relevant. 3. Making guidelines to follow up effect goals – to measure and govern investments based on effect.
FFI-Report 2024

Bedre samarbeid – læringspunkter fra Forsvarsmateriells strategiske samarbeid med Teleplan Globe

Collaboration with the Norwegian defence industry aims to strengthen the defence sector’s access to critical equipment, services, and expertise. This report aims to support the Norwegian Defence Materiel Agency (NDMA) in collaborative efforts with the defence industry. We identify key takeaways and experiences from NDMA’s strategic partnership with Teleplan Globe, a supplier of tactical battle management solutions. In order to identify key takeaways, we use an analytical framework developed at the Norwegian Defence Research Establishment. In the report, we have identified five key takeaways that the NDMA can implement to improve future collaborations. 1. The NDMA should work to ensure continuity in relations with external strategic partners and develop processes that reduce the consequences of personnel turnover on the relationship. 2. The NDMA should ensure long-term predictability by linking collaborative efforts to strategic priorities in the defence sector. Should this prove unfeasible, the NDMA should consider whether collaboration is the correct approach or ensure direct involvement from executives. 3. The NDMA should facilitate coordination by establishing arenas for close coordination, planning, information sharing, and discussion with partners. Early supplier involvement should be considered to improve resource planning and use of partner capabilities. 4. The NDMA should aim to delegate decision-making powers to the personnel with the best situational awareness related to the collaborative activities and objectives. These will often be situated on a lower organisational level. This requires clear communication between delegated personnel and NDMA executives to ensure the pursuit of strategic objectives at all levels. 5. The NDMA should aim to clarify expectations related to intellectual property rights (IPR) tied to the collaborative efforts before agreements are made. They should also assess how the distribution of IPR can affect the incentives of the collaborative partners.
FFI-Report 2024

Kremls økonomiske planer – den russiske regjeringens forslag til føderalt budsjett for 2025 og planperioden 2026–2027

The Russian government submitted its draft federal budget for 2025–2027 to the State Duma on September 30, 2024. The budget is expected to be signed into law by the end of November. This report analyzes the budget’s main characteristics. Preliminary Russian estimates for future GDP growth are relatively optimistic. The Russian Ministry of Economic Development expects an increase in GDP growth from 2.5 percent in 2025 to 2.8 percent in 2027. This is considerably higher than market estimates, which projects a yearly GDP growth between 1.0 and 1.5 during the same period. However, future developments are highly uncertain. The Russian economy is overheated, with high inflation (8.5 percent), well above the authorities’ 4 percent target, and the economy experiences a historically low unemployment rate (2.4 percent). To control the situation, the Central bank has raised the key rate several times. As of November 2024, it currently stands at 21 percent. The high key rate has caused discontent among both businesses and the political leadership. Several factors will probably contribute to future developments. In this regard, developments in the petroleum market are highly important, as are the result of the Centrals bank’s efforts to reduce inflation and the effects of the sanctions currently imposed on Russia. Since 2022, the federal budget has consistently posted significant annual deficits. However, compared to recent years, the deficit in 2025 is expected to be slightly reduced. This is likely a result of the government’s efforts to cool down the economy and may also be a sign of the federal budget reaching its limit. Unsurprisingly, the new budget bill calls for a further increase in Russian defense spending. The defense budget will amount to 33 percent of all federal expenditures next year. This amounts to 6.3 percent of GDP, the highest GDP share recorded after the collapse of the Soviet Union. The high defense expenditure is also starting to affect the government’s ability to fund other important areas. The 2025 budget sees a significant reduction in social spending, and a new tax reform will help collect more money to fund the war. We argue that civilian parts of the budget, i.e. spending outside the defense and security chapters, are increasingly used to finance the military and Russia’s warfare in Ukraine. By adding spending outside of Russia’s defense budget to the effective defense budget, we estimate that the defense spending will amount to 8.8 percent of GDP in 2025. The militarization of the Russian economy makes it difficult to estimate precisely the amount of resources Russia directs towards the military and the war in Ukraine. It also shows that the regime uses a broad array of tools to succeed in its current military buildup.
FFI-Report 2024

Merutnyttelse av E-blanks med app for skytetrening og Saab-integrasjon – med Hurtig problemløsning som metode

In 2022, FFI’s centre for innovation in the defence sector, ICE worx, established a new type of innovation activity called Rapid Problem Solving (Hurtig problemløsing – HP). An HP activity aims to identify needs within the Armed Forces, iteratively develop technology in close collaboration with industry, and thus enhance the capability for technological innovation for military purposes. To succeed with this type of activity, close access to the Armed Forces’ resources for testing and experimentation is essential, as well as the knowledge base from FFI researchers, logistical support for faster contracting, and a willingness to take risks. This report describes the first activity conducted using the HP method. The starting point for this HP activity was the Army’s acquisition of 80 test sets of E-blanks from the Norwegian company Green Ammo AS. The E-blanks technology is designed to replace blank ammunition, with sharp components of the weapon replaced by electronics that simulate live fire. Shooting ranges are a limited resource in the Armed Forces, including access to instructors and live ammunition. FFI wanted to use the HP methodology to explore the E-blanks technology and find additional opportunities to improve recruits’ shooting skills before they reach the shooting range. The idea was that sensor data about weapon movements and their patterns during dry-fire practice could be used to provide feedback to recruits, enabling them to correct their own mistakes and helping instructors provide better training. The goal of the HP activity was to gather sufficient knowledge about the E-blanks technology to develop a minimum viable product (MVP) of an app for use in testing and experimentation. Experiences from this activity suggest that further development of the technology tested via the app would add value for the Armed Forces. We recommend that if an electronic blank ammunition system is acquired, a corresponding application for shooting training should be included. Other findings from this report should also be considered in any future acquisition. For instance, we found that soldiers were more motivated to train when an element of competition was included in the training. Electronic ammunition opens up many new possibilities in education, training, and exercises. The Armed Forces would be able to collect and utilize data from all electronic shots fired with such a system. This can be valuable for individual soldiers, instructors, or, at a higher level, in assessing the operational readiness of different units. It would also make it possible to link systems, such as the Saab integration with the Combat Training Centre (Kamptreningssenteret – KTS) or to a digital target. The HP methodology, which includes the flexibility to seize good ideas and reprioritize along the way, with room for higher risk, has been crucial to this success. The methodology made it possible, among other things, to integrate E-blanks with the Armed Forces’ instrumented training system (Saab). Rapid Problem Solving will be one of the tools ICE worx will continue to use to promote innovation.