Whispers 002: Who is Helping the Taliban Target Afghans on Social Media?

Regional actors are reportedly assisting the Taliban to root out critics and activists by surveilling social media and passing the information to the Taliban's Ministry of Interior.

Whispers is an intelligence and analysis column focused on post-democratic Afghanistan.

A Shift in Taliban Internet Policy

TIP: Regional governments are reportedly assisting the Taliban in rooting out critics and activists by surveilling social media and passing the information to the Taliban’s Ministry of Interior.

During their regime in the 1990s, the Taliban banned the internet, television, music, and any other technology they perceived as breeding immorality. However, they could not completely prevent users from connecting to the internet through neighboring countries. The citizenry’s access to the internet was particularly threatening to the Taliban because isolating Afghans from the outside world was one of their most effective tools of subjugation. However, even then, the regime’s leadership understood the importance of the internet as a tool of communication and has maintained an official website since 1998. 

Shortly after the Taliban’s overthrow in 2001, President Hamid Karzai officially authorized internet usage and promoted it as a tool for development. Although connectivity has always been limited, the intervening two decades saw growth and active participation in the global online community. By the time the Taliban came back into power in August 2021, the internet was deeply integrated into Afghan institutions and among the urban population.

As internet access grew among Afghan citizens, the Taliban integrated it more and more into their strategy as well. The information campaigns they waged throughout their insurgency allowed for considerable refinement of their techniques as they learned what was and was not effective. NATO and American forces witnessed the consequences of the evolution of the Taliban’s information campaigns over time. 

An example of growing Taliban proficiency with online information campaigns occurred in 2016 when they exploited an attack on Kunduz to portray ISAF as incompetent and/or untruthful:

Figure 1 Sample Misinformation Campaign (Source: The Atlantic Council Blog)  

Screenshots of tweets published during the Taliban’s blitz on Kunduz in October 2016, showing how the Taliban and Afghan citizens flooded Twitter with video evidence that contradicted reassurances by the ISAF and the Afghan government that the city was not under major attack. 

At left, the initial ISAF announcement and a witness video stand in sharp contradiction. 

In the center, a series of battle updates was provided by Zabihullah Mujahid, a Taliban spokesman. 

At right are more announcements and imagery of the Taliban’s successful incursion. The Taliban withdrew soon after. 

Screenshots via @ResoluteSupport/archive, upper left; @Ahmdyarr/archive, lower left; Thomas Joscelyn/Long War Journal, middle; @Ahmdyarr, upper right; @Ahmdyarr/archive, lower right.

Prior to Kabul’s fall, the Taliban showcased their advancement when they launched a massive preplanned “victory” campaign online that was both sophisticated and effective. By proclaiming victory prematurely, they were able to lower morale and confuse forces who were fighting back.

After the Taliban takeover, the international community was not sure if a more modern, moderate Taliban 2.0 could be expected. Would they revert back to banning the internet and TV? Or had the internet and modern technology become too integral to the Taliban’s operations for them to turn away from it again?

So far, the Taliban have allowed the internet to continue to operate unrestricted with only sporadic outages reported in late August and September. Panjshir Province has been the exception with blackouts and only periodic access to the internet since the Taliban’s takeover. Most international observers presume these blackouts are intended to disrupt potential opposition groups. However, by and large internet access has remained uninterrupted throughout the country. 

Social Media Targeting 

While continued internet access is positive for Afghan citizens in many ways, it also makes them vulnerable to additional threats. Since taking over, the new Taliban regime has been targeting critics and activists through social media. Many of the roughly 14% of Afghans who were connected to the internet immediately deleted their social media accounts for fear of being arrested. Companies like Facebook and LinkedIn tightened security to try and protect Afghan subscribers.

Some prominent activists and critics openly criticized the regime and were publicly arrested. Others may have been targeted through fake posts. An example of this occurred in early January when Professor Faizullah Jalal, a lecturer at Kabul University and frequent critic of both regimes, was arrested for “inciting people against the system” through a Twitter post attributed to him. The professor and his family claimed they did not own the account, and he was released days later after an international outcry. 

Confirmed reports of individuals being arrested and murdered began to pour in around October and November of 2021. In several instances, friends and relatives claimed that the victims had posted inflammatory remarks about the Taliban online and were engaged by seemingly pro-Taliban supporters in both comments and via private messaging. 

A forensic review of online discussions indicated that many of the victims did not reveal their identities or locations. Cybersecurity experts we consulted suggested their identities and locations were most likely compromised by a moderately sophisticated cross-referencing system that would have been time intensive and involved several technologically proficient technicians to analyze and share the data. 

Considering the chaos in the early months of the Taliban takeover, it seemed unrealistic that they had both the capacity and skill to mount effective social media monitoring operations, especially given that targeting was often happening within 12-48 hours. The skill and efficiency behind their social media operations strongly suggest external assistance is being provided. It is a well-known fact that the Taliban have a sizable network of volunteers and allies outside the country. Furthermore, several countries in the region understand that Afghanistan’s stability is critical to regional stability, so they have few qualms with helping the regime crackdown on critics.

The Afghan Digest’s intelligence team consulted with local sources familiar with the situation and discovered the breadth of collaboration between the Taliban and neighboring governments to monitor Afghan citizens.

Several neighboring countries that provide internet access to Afghanistan have regularly monitored online activity in Afghanistan through their intelligence services. At least three neighboring governments offered to give the Taliban access to this information as early as September 15, 2021.

Furthermore, at least two neighboring states intercepted Afghan refugees with technical skills and co-opted them into working with their monitoring cells in exchange for safe lodging. In the best-known case, co-opted Afghan spies are located adjacent to a building that delivers internet into Afghanistan and carries out constant monitoring of Afghans’ social media. They work in shifts and are under the supervision of the host nation’s intelligence agency.

Beginning in January, additional neighbors and one Gulf State nation began offering official assistance to the Taliban’s Ministry of the Interior to help implement national firewalls, establish cybersecurity protocols, and train monitors in advanced techniques of detection and identification. It is not known if any of these offers have been accepted.

These reports from sources on the ground and former members of the US intelligence community strongly support the assumption that the rapid reaction times witnessed in the reported cases indicate cooperation with foreign intelligence services. It is also likely that the foreign intelligence services involved were able to rapidly reorient surveillance cells to target anti-Taliban individuals and groups. Incriminating information gleaned from monitoring operations may have been offered as gifts to the fledgling regime in return for favors.

Although we are barred from specifically identifying which countries are reported to be involved in these covert operations, it is logical to assume that nations with sufficiently advanced technological skill, a history of domestic surveillance activities, and an interest in a strong relationship with the Taliban government are the main culprits.

Clearly, online activism within Afghanistan is increasingly dangerous, and individuals and groups wishing to challenge the regime are encouraged to investigate alternative methods to avoid being targeted.

Suggested Resources

The Dangers of Digital Activism

An Activists Guide to Online Privacy and Safety

Social Media: A tool for peace or conflict

JMH