JeM Financier Uses Social Media to Amplify Terrorist Propaganda Calling on Indian Muslims to Revolt

In an exclusive investigation, Logically has found that Farhatullah Ghauri, a terrorist recruiter and financier for Jaish-e-Mohammed (JeM), a Pakistan-backed terror group, is using a network of accounts on Facebook, Telegram, and YouTube to amplify terrorist propaganda videos targeting religious minorities in the country. JeM is the group responsible for several terror attacks in India, including the February 2019 Pulwama bombing that led to the death of 40 Indian security personnel.

The network was identified by Logically before it could accrue a significant audience peaking with 200-400 subscribers across all the accounts. The terrorist propaganda has circulated across other encrypted messaging channels on Telegram, including those affiliated with Islamabad-backed proxy terror groups claiming to operate in the Kashmir region, such as the Hizbul Mujahideen and The Resistance Front.

Closer scrutiny of the amplification patterns of the videos on Facebook since January 2022 suggests a concerted attempt by malicious actors to post the videos in Facebook groups and pages dedicated to socialism, Islam, and minority rights. These groups are frequented by larger, more mainstream audiences of domestic users who are critical of the Bharatiya Janata Party (BJP) government. Moreover, these coordinated online campaigns coincide with offline incidents of communal violence in the country, revealing how malicious actors abroad are leveraging major social media platforms to exploit domestic tensions and radicalise the minority population.

Who is Farhatullah Ghauri?

Farhatullah Ghauri is listed among 38 individuals as a terrorist by the Indian Ministry of Home Affairs under the Unlawful Activities (Prevention) Act, 1967 (amended in 2019). Also known as Abu Sufiyan, Ghuar is originally from Kurmaguda district in Hyderabad and primarily known for being a terrorist financier. He fled to Saudi Arabia in 1994 and finally settled in Pakistan in 2015.

In addition to being a close associate of Masood Azhar, a United Nations designated terrorist and the founder of JeM, Farhatullah is personally implicated by Indian intelligence services for planning and facilitating a series of terror attacks in the country. These attacks include an improvised explosive device (IED) attack at Sai Baba Temple in Saroornagar in 2002, a fidayeen (suicide) attack on the Akshardham Temple complex in Gujarat the same year, a suicide bomb attack targeting the Hyderabad City Police Commissioner’s Task Force office at Begumpet in 2005 and the attempted assassination of Nallu Indrasena Reddy, an Indian politician and current national secretary of the BJP in 2017.

According to intelligence from Indian agencies, Ghauri facilitates and finances these attacks without actively participating in them. He also actively recruits and indoctrinates individuals, including funding their travel from India to Dubai and Pakistan for radicalisation and training.

In April 2022, The Print reported on how the fugitive financier had decided to shed decades of anonymity in favour of amplifying propaganda on social media by following a more overt approach towards recruitment centered on personal outreach within close circles mediated by clerics and family ties. Through this approach, he seeks to recruit Indian Muslims to carry out domestic terror attacks on behalf of several other groups, namely, Al Qaeda in the Indian Subcontinent (AQIS) and Lashkar-e-Taiba (LeT), symbolic of a broader effort by jihadist groups to leverage popular digital communication platforms to appeal to a new generation of ‘Jihad volunteers’ by exploiting domestic communal tensions.

Also read: What Al-Zawahiri’s Killing Means for West Asia and the United States

A clash of civilisations

As part of this investigation, Logically identified three encrypted Telegram channels, two associated Facebook pages, and three YouTube channels operated by the group.

The terrorist propaganda amplified via these channels consists of professionally edited videos with voice overs by Farhatullah Ghauri. Some of the videos engage with the rhetoric of Muslim minorities allegedly facing human rights violations by Indian security services in Jammu, Kashmir and other parts of the country. This is then complemented with graphic images and news coverage referencing historical and current incidents of sectarian violence in the country.

The videos often address policy decisions enacted by the present central government that affect the Indian-Muslim community, including the reading down of Article 370, the implementation of the Citizenship Amendment Bill (CAB), and the National Registry of Citizens (NRC). The semantics used in the videos cleverly aim to portray the Indian government as ‘Hindu Fascists’ locked in an inter-civilisational conflict against Muslims across the world. Finally, there are explicit calls by Ghauri to Indian Muslims to revolt and take up arms against the Indian state. 

Stills from one of the terrorist recruitment videos drawing from media reportage and couched in the language of human rights advocacy. Source: Telegram@KaulAyushman

Other videos employ more overt appeals to religiosity by including references from Islamic theology, namely, Malhama Al-Kubra, an apocalyptical battle prophesied to signal armageddon and, Ghazwa-e-Hind (Holy war for India), an Islamic concept derived from the Hadiths that refers to Muslim warriors conquering the Indian subcontinent.

These references are paired with calls from the narrator for Indian Muslims to take up weapons and mount attacks against local politicians, civilians, and other ‘soft targets’ in India that are alleged to have blasphemed against Islam. The videos also implore Muslims abroad to engage in hijrah, a ‘holy pilgrimage’ to India to carry out terror attacks. 

Stills taken from another terrorist recruitment video that calls on Muslims to take up arms and provides a list of targets in India. Source: Telegram@KaulAyushman

Troublingly, an analysis into the spread of the videos on Facebook between January 1 and July 1, 2022, via CrowdTangle, a social media analysis tool, reveals that videos from Ghauri’s network were amplified across several mainstream Facebook groups and pages devoted to Islam, socialism and minority rights in a bid to help the extremist content accrue a larger audience among a user base critical of the ruling political party, BJP. While platform officials took down these posts, the time-stamps on the posts in these groups and the use of similarly written captions and descriptions accompanying the video suggest the presence of a copypasta campaign by a single entity. 

Examples of the same terrorist recruitment video being amplified in disparate groups dedicated to Muslim and minority rights in the country within minutes. Source: @KaulAyushman via CrowdTangle

Advertisement

Examples of the same terrorist training video being amplified across disparate groups with the same written caption. Source: @KaulAyushman via CrowdTangle

Identifying the network

The three encrypted Telegram channels, two associated Facebook pages, and three YouTube channels operated by the group were all created from February to June of this year. During the course of the investigation, the content moderation teams took down one Telegram channel and one Facebook page linked to the group.

Page ‘Transparency & Info’ for the two pages showed they were among the first assets to be created in the extremist network. Source: Facebook@KaulAyushman

The Facebook page was the first asset to be created on February 8, while the third Telegram channel, created on June 16, was the last asset to be added to the network. The creation dates of the accounts overlap with a series of protests beginning in January 2022 in Karnataka, which were triggered by the denial of entry to Muslim students wearing the Hijab at a state-run college in Udupi district. Each of the individual accounts incorporated the same branding and content modeled on a Palestinian resistance movement newsletter, aiding in identifying the different assets involved in the network. 

‘About’ section of the two Facebook pages tied to the extremist group. Source: Facebook@KaulAyushman

Note: The identity of the channels and accounts has been kept anonymous to prevent the amplification of extremist propaganda.

Despite being created first, the Facebook pages, which describe themselves as ‘personal blogs’ dedicated to the organisation and Farhatullah, were the least active of the assets and only posted a few videos from the network’s entire catalog. A status post uploaded on one of the pages on February 11 amplified a link to one of the Telegram channels created by the group and claimed the organisation sought to ‘help understand the contemporary affairs of the Ummah and clarify misconceptions. The same post also called on Indian Muslims to ‘share among your Muslim fellows’, promising ‘there is a lot more to come’.

Post uploaded on one of the Facebook pages tied to the outfit that amplified a link to an associated Telegram chat and called on users to share the post ‘among your Muslim fellows’. Source: Facebook@KaulAyushman

The three YouTube channels were created next and served as the second most significant repository of extremist content after the network of Telegram channels. This network served primarily to host and amplify the terrorist recruitment videos produced by the group targeting Indian Muslim users frequenting the platforms. The videos are shared alongside written messages, associated hashtags such as #Hind (India), #IndianMuslims, #IndianMujahideen (Indian holy warrior), and references to specific instances of communal violence between Hindu extremists and Muslims in the country.

The group operates a network of three YouTube channels to host and amplify terrorist propaganda. Source: YouTube@KaulAyushman

One video uploaded on one of the YouTube channels on February 9 used multiple hashtags referencing the Hijab protests that took place in Karnataka, further highlighting an attempt by the admins to target Indian-Muslim users frequenting the platforms.

The three Telegram channels served as the primary disseminators of the terrorist recruitment videos. While two of the three Telegram channels only posted and marketed extremist content produced by the group, the third channel also posted images and graphics depicting alleged instances of communal violence against Indian Muslims. Posts on this channel also included written messages that directly exhorted Indian-Muslim users to turn to violence and called on them to ‘prepare yourselves from swords to explosives’.

As with its other accounts managed by the outfit, the extremist recruitment videos amplified on the Telegram channels were also accompanied by targeted hashtags to expose the content to Indian-Muslim users frequenting the platform.

Admin post on one of the Telegram channels that advertised the network as the ‘voice of Indian Muslims’ and amplified the broader extremist network in an attempt to falsely represent themselves as Indian Muslims Source: Telegram@KaulAyushman

The group also used the Telegram channels to highlight the broader network of assets controlled by the organisation. A post uploaded on one of the Telegram channels on April 11, 2022, described the organisation as the ‘voice of Muslimeen in India’ and shared links to other accounts controlled by the organisation on Facebook, Telegram, YouTube, and Justpaste.it.

Justpaste.it is a free website that allows users to upload text and images to the site and distribute it via a link. It was previously used as a hosting platform by members of the erstwhile Islamic State of Syria and the Levant (ISIL) to upload propaganda and bypass content moderation policies of major social media platforms. The accounts also use tlgur.com, a similar free content hosting service and streamable.com, a video hosting website, to archive and amplify the extremist videos.

Examples of the outfit using third-party files and video hosting websites to amplify extremist propaganda. Source: Left, @KaulAyushman/justpaste.it; Center, @KaulAyushman/tlgur.com; Right, @KaulAyushman/streamable.com

The network on Telegram cross-posts links to the YouTube channels created by the group suggesting an attempt to diversify their online footprint and leverage YouTube’s more extensive user base in the country. Posts from these channels are also amplified in other Telegram channels affiliated with Islamabad-backed proxy terror groups in the region, including Hizbul Mujahideen and The Resistance Front, suggesting that despite failing to accrue mainstream appeal, the videos had found an audience in online fora frequented by local terrorist sympathizers.

While platform officials also took down the main Telegram channel of the outlet, the group created a replacement channel which remains active at the time of publication, albeit with a smaller audience than the original channel.

Screenshot of the ‘Links’ page of two encrypted Telegram chats tied to the outfit for April to June 2022, revealing the group archiving and amplifying the videos through various online platforms. Source: Telegram@KaulAyushman

Cycles of instability

According to the latest figures from January 2022 from Data Reportal, social media usage in India continues to skyrocket, with over 467 million users. Terrorist and extremist groups will persist in leveraging the anonymity and audience offered by social media platforms to amplify their extremist narratives, recruit disenfranchised and disaffected local youth, venerate dead and captured terrorists, and coordinate attacks against the Indian security services.

Pakistan-backed proxy terror groups will also seek to capitalise on the clash between communal groups and these offline incidents of unrest and incorporate them into propaganda videos. These videos are then disseminated across major social media platforms in a bid to foster the next generation of homegrown extremists. If left unchecked, the interplay between the fringe elements from both groups will likely continue to erode societal cohesion in India and portend a cycle of violence and domestic instability over the long term.

Ayushman Kaul is a Senior Threat Intelligence Analyst with a strong focus on geopolitics, violence perpetrated by non-state actors, cyber and information security in the South Asian regional context.

This article was originally published on Logically.