Katiba des Narvalos

The Katiba des Narvalos (from Arabic "Katiba"="battalion" and Romani or French slang "Narvalo"="mad") is a non-partisan collective constituted from citizens from all venues of life, dedicated to fighting jihadism on social networks and more generally on the Internet. Their tactics comprise parody, as to discredit jihadist propaganda; surveying and reporting offending accounts; and infiltrating cyber-jihadist networks as to prevent terrorist attacks.

Background
Islamic State (aka "ISIS" or "Daesh") strategists state that at least half of their fight is being waged in the media, especially on social networks, and that "cyber-jihadists" are both fighters and propagandists.

The Islamic State fields an elaborate media strategy based on extreme cruelty, high technical expertise  and psychological manipulation. Its aim is to instill fear, encourage violence, and find new recruits. This influence is felt far from the front lines, including within the cities of ISIS enemies.

The first cyber-jihadists of the Islamic State depicted themselves as merciless and successful warriors. Between battles, they would share moments of fun (dubbed "lol-jihad") within an idealised proto-state, complete with a booming economy and efficient public services.

In the fourth quarter of 2014, jihadist networks comprised at least 50,000 accounts on Twitter, which was their favorite social network at the time.

First parody accounts
The first French-language parody accounts appeared on Twitter in the summer of 2014,  after ISIS broadcast images of the murder of James Foley.

The aim was to disrupt terrorist propaganda using humour and mockery as means of resilience, deconstructing the misleading motive of an invincible jihad in an ideal Caliphate, and oppose the violence of its images.

Humorous effect was obtained by impersonating jihadists of the Iraq-Syria area and using their vocabulary to ridicule and discredit them, or sow discord between them. At the time, there was no straightfoward way to tell parody accounts from those of authentic members of ISIS or Al-Qaeda, and they themselves would sometimes be fooled. Parody tweets used the #TweetCommeAbuUthman hashtag ("Tweet like Abu Uthman", pseudonym of Mickael dos Santos, a very prolific French jihadist propagandist on Twitter at the time). The most famous parody account was Abou Jean René al-Faransi, followed by further "Abu" account such as comme Abou Francis al-Israeli, Abou Rico, Abou Dinblanc (a pun on "boudin blanc"), Abou Tantrain (pun on "boute-en-train", French for "funny person"), Abou Jaja, Abou Dner (pun on "à bout de nerfs", French for "at one's wit's end") and Bernard le Lorrain.

Operation of Anonymous against ISIS
Following the January 2015 terrorist attacks, thousands of pro-terrorist messages appeared on Twitter with the hashtags #JeSuisKouachi and #JeSuisCoulibaly, as opposed to #JeSuisCharlie.

At the time, French authorities were not very interested in this phenomenon: the official anti-radicalisation website, Stop-djihadisme.gouv.fr, was started three weeks after the attacks and was still in its infancy. On the side of social networks, there was little enthusiasm to suppress jihadist propaganda accounts.

The group Anonymous then launched an operation with the hashtags #OpCharlieHebdo (aimed at French speakers) and #OpIceISIS (aimed at English speakers), reinforcing the already-existing #OpISIS as to freeze (or "ice") communication of the terrorist organisation. These operations were undertaken while there was still little action from the authorities against jihadist propaganda on social networks.

This series of terrorist attacks thus ended up having a mobilising effect on individual citizens, who organised to push back against armed fundamentalists.

Beginning of the group
The Katiba des Narvalos (from Arabic for "battalion" and Romani slang for "madman") emerged from the coalescence of the first anti-ISIS trolls, member of Anonymous taking part in #opCharlieHebdo, and other individual activists.

The Katiba des Narvalos then gained independence from Anonymous, all the while retaining a position of influence within #opISIS.

On 15 February 2015, the Narvalos launched their first deception operation, #DimancheNoir ("black Sunday"). The hashtag #KatibaDesNarvalos first appeared in March 2015, marking the official birth of the group.

Members
Many of the members joined the group after the terrorits attacks of January 2015. The militants, dubbed "Narvalos" (masculine) and "Narvalettes" (feminine) come from all venues of life, all religions and any age, more or less representative of France including its overseas territories. Members are required not to state their political opinions and to teach themselves about the geopolitics of the Middle East, computing and security.

The group is led by an "Emir". The first Emir was Abou Jean-René al-Faransi, succeeded by Abou Tantrain (Jihadi Jean), himself followed by Abd-Charlie in April 2015.

In March 2016, some of the members quit oven ideological disagreements and founded another group.

The Katiba is now organised like an intelligence service, with various security habilitation depending on the domains of competence of the members. Part of the teams work on the surveillance of the Internet and reports offending contents to social networks moderation as to have them removed quickly. Other teams work on investigations and jihadist-hunting all over the world through the Internet.

Ethics
The Katiba des Narvalos has a charter written in French, English and Arabic. Notably, it explicitly states that the Katiba combats jihadist propaganda only, and is not aimed at Islam or Muslims.

Counter-discourse
The Katiba des Narvalos aims at disrupting terrorist propaganda (counter-propaganda) by using various methods such as hijacking the meaning of an image, changing the soundtrack of a propaganda video, copying the voice of a jihadist into a video spot, issuing fake Amaq press releases, spamming jihadist hastags to remove their campaigns from Twitter Trends, etc.

It notably targeted French jihadists Omar Omsen and Rachid Kassim, as well as the Al-Hayat Media Center (main editing and production organ of the Islamic State).

The Controlling Section (CtrlSec) and reporting jihadist accounts on Twitter
The "Controlling Section", named after the London Controlling Section founded in 1941 by Winston Churchill, complements counter-propaganda and parodies.

Created in March 2015 as a Twitter bot, CtrlSec quickly grew into an independent international group. It surveys accounts that incite to terrorism and reports them in tweets via the account @CtrlSec, so that its followers can mass-report them to Twitter moderators and have them suspended. The daily count of reported accounts in around 500.

Soon after the terrorist attacks of 13 November 2015, the Katiba des Narvalos and Controlling Section worked closely with Ghost Security for a few days.

The Katiba des Narvalos has operated in tandem with CtrlSec since its inception, as well as with independent groups of "hunters" who detect jihadist accounts and report them. According to a survey by CtrlSec on 3 August 2018, they are collectively credited with suspending over 250 000 Twitter accounts. The high effectiveness of the system has been noticed by numerous specialists, such as E.T. Brooking, a researcher in international security policy, who wrote in Foreign Policy: "online activists play an important role in bringing Islamic State supporters to Twitter's attention and review"; Jihadism expert Romain Caillet, who stated that "without these Internet users, some jihadist accounts would have 10,000 followers today";  and Jean-Luc Marret, researcher at Fondation pour la recherche stratégique, who stated that the Katiba des Narvalos is a "powerful actor against Daech on the Internet.

Due to these propaganda-disrupting activities, the "Cyber" division of ISIS, led by Junaid Hussain, put some members of the group on kill lists.

Extending to further networks
Multilingual survey of jihadist propaganda material has been extended to all sorts of platforms.

In 2016, Internet activities of Daech fighters and propagandists have noticeably receded on Twitter, at least in French language, due to accelerating suspensions of their accounts. They switched to other platforms such as Telegram,  Vimeo, YouTube... Consequently, the Narvalos and Controlling Section have extended their own activities to these networks.

Psychological operations
The group has mounted psychological operations aiming at demoralising, deceive and hinder jihadist propagandists.

Jihadist hunting
Some Narvalos have developed more offensive tactics, infiltrating jihadist networks in a manner similar to those of intelligence services. In order to avoid incidents, sensitive Katiba accounts are reported to the DGSI.

In early 2018, an officer of a Security service, specialist of Internet monitoring, testified to Médiapart: "The Katiba put us to shame, that are better than we are. They manage to geolocalise a jhadist form a single photograph. We cannot do that."

Contributions to counter-terrorism
On 1 May 2015, two days before a Muhammad drawing and caricature competition was due to take place in Garland, Texas, Narvalette Khalan Cypher reported an imminent terrorist attack to the police. In the ensuing Curtis Culwell Center attack, the two terrorists were killed.

In the following months, cooperation between the Katiba des Narvalos, the Controlling Section and Ghost Security with antiterrorist authorities made it possible to arrest terrorist cells that were preparing attacks in July 2015 in Tunisia and New York City

In 2017, the Katiba detected a threatening person on Telegram, identified him as Riad Ben Cheikh and geolocalised him at La Réunion, before notifying authorities. The man was arrested a few months afterwards, just as he was about to travel to mainland France, where he was preparing a terrorist attack. Ben Cheikh was sentenced to 4 years in prison for incitation to terrorism and contempt.

By mid-September 2018, the Katiba claimed to have derailed four terrorist attacks in France, identified 20 offenders, contributed to a dozen arrests, and dismantled several networks.