A View from the CT Foxhole: An Interview with an Official at Europol's EU Internet Referral Unit.

• Author: Amarasingam, Amarnath

On November 21-22, 2019, the EU Internet Referral Unit (EU IRU)--a team inside the European Union's law enforcement agency, Europol--and Telegram engaged in a serious disruption campaign against the Islamic State's channels and groups on the platform. (1) While there had been similar 'days of action' in the past, the campaign of November 2019 was far greater in scope and impact. (2) Hundreds of channels associated with the Islamic State-affiliated Nashir News Agency disappeared and have yet to recover. (3) In this interview, which was conducted on December 11, 2019, via Skype, CTC talks with a member of the EU IRU about this campaign, about the ongoing relationship with social media companies, and the continued challenge of combating terrorist content online. The official requested anonymity. Europol has reviewed this interview and approved its publication.

CTC: What exactly is Europol's EU Internet Referral Unit? When was it founded? Was there an immediate cause that led to its founding?

Europol EU IRU Official: We set up the unit in July 2015. Within Europol, within the European Counter-Terrorism Centre (ECTC) of Europol, there was a capacity to monitor and analyze terrorist propaganda, meaning jihadist propaganda, since 2007. The scope was major jihadist groups, designated terrorist organizations. The reason for that was to have a better understanding of the threat picture, especially when it comes to the threat posed to Europe and European interests outside of Europe from these designated terrorist organizations. This was the case for some years, but then it became increasingly evident that we needed to build this capacity and also have a mandate for supporting member states with online investigations in the context of counterterrorism, plus engaging with online service providers in order to help them build their resilience against the dissemination of terrorist propaganda. So, this was the reason that the IRU was set up in 2015. And since day one, we started engaging with online service providers to flag terrorist content to them and find solutions on how to disrupt the dissemination of terrorist content online.

CTC: Were there certain social media platforms or companies that were more open to working with you from the beginning, and why do you think that was?

Europol EU IRU Official: Yeah, at that time, I recall that the bulk of the propaganda was on mainstream social media such as Twitter or Facebook. We prioritized these types of platforms to work together, and their response was very positive. We based this on a voluntary approach. So basically, we started our operations for monitoring terrorist content--meaning content that is branded, that is produced and disseminated by designated terrorist organizations --and by tracing this content across the internet, we were in a position to also flag [it] to online service providers. So, we started flagging this type of content to the social media companies, and we engaged in a discussion with them on how we can help them improve their internal operations so they can build some measures internally to prevent the exploitation of their platforms by terrorist organizations.

CTC: Were you asking them for anything in terms of help from their side, or was it mostly you providing information to them?

Europol EU IRU Official: Our starting point is a particular media file. We don't look into particular accounts; we don't look into profiles on Facebook or Twitter accounts. We start by detecting a new media file that is put on the internet by a designated terrorist organization, and whenever we are in a position to detect and collect this content, we collect the URLs and flag the URLs to the specific post to the social media companies. Another way we help them is to share some of our experiences in, let's say, collecting visuals, logos, or markers that are used by designated terrorist organizations. We share these types of packages with them to help them understand how terrorist organizations use branding to become visible and spread their message to wider audiences.

CTC: Can you describe what a typical day looks like at the EU IRU?

Europol EU IRU Official: We are a team with people of many different backgrounds. We have the counterterrorism investigators; we have IT experts, communication experts, researchers with expertise in Islamic jurisprudence, and also in area studies. We also have linguists; we cover most of the European languages plus Arabic, Russian, and Turkish. So, we try to combine this set of skills in order to understand both the content of the message and the dissemination of the propaganda. We collect and analyze this information. There are then two lines of work. First, we support member states in their online investigations, so it's like police work, it's law enforcement work. Second, we also flag the content to the online service providers, with a request not to take down content but to review the content against their own terms of reference. Then it's up to them to make the decision whether they act upon it or not.

CTC: A number of these companies weren't always so open to acting. Why do you think there has been such a shift in culture in these social media companies more recently? (4)

Europol EU IRU Official: It was not just a shift in the understanding of social media companies, but it was a shift in the understanding of the whole international community looking at this specific issue that we cannot allow terrorist organizations to exploit publicly accessible social media...