Rocket.Chat Remains One of the Most Resilient Platforms for Jihadists

Update January 21, 2021: Statement from Rocket.Chat

“Rocket.Chat absolutely condemns the usage of our software by terrorists. It’s true that our open-source software enables everyone to set up and manage their own private Rocket.Chat servers. The vast majority of our hundreds of thousands of Rocket.Chat deployments are managed by legitimate, small communities and businesses seeking to provide their users with secure, encrypted, and private communications—including many NGOs, NPOs, and independent journalists.

We welcome tips and information from the security and threat research community to identify servers using Rocket.Chat software for illegal purposes. Once identified, we work directly with the appropriate law enforcement bodies and officials to shut down these servers. In collaboration with law enforcement, we created detailed guidelines on how agencies can reach out to us effectively. Rocket.Chat is in direct contact with Flashpoint and we look forward to future joint efforts to build a safer cyberspace.”

For more information, please visit the Rocket.Chat website.

Rocket.Chat: Why It’s Important

Since its adoption by ISIS in December 2018 and by al-Qaeda about a year later, Rocket.Chat has remained one of the most reliable platforms for online jihadist communications. The Slack-like platform enables jihadist groups to converse with their supporters and to disseminate both official and unofficial propaganda via servers they control and operate. Privately-managed holistic platforms, such as Rocket.Chat, may represent the future of jihadist communications and propaganda dissemination, as their open-source architecture and owner-operated servers enable unfettered and persistent access for extremists.

Reliable and Persistent

Since their launch, the ISIS and al-Qaeda Rocket.Chat servers have been reliable and persistent sources of jihadist propaganda with only minor service interruptions. Over the past two years:

• ISIS Rocket.Chat has only suffered from one major shutdown lasting for a few days in April 2019 (due to technical issues). 
• Al-Qaeda Rocket.Chat has yet to suffer any significant outage. 
• Compared to other encrypted messaging platforms, like Telegram, individual users themselves are less likely to have their accounts suspended due to the way in which Rocket.Chat is set up.

Content and Scalability 

The ISIS and al-Qaeda servers each have thousands of users and hundreds of channels and groups. They broadcast a wide range of content throughout their communities, from official propaganda to “lone wolf” how-to guides. Languages observed on these servers include Arabic, English, Farsi, French, Italian, Pashto, Russian, Spanish, Turkish, Uighur, and Urdu.

Deep Dive: Rocket.Chat for ISIS and Al Qaeda

In comparison to the frequent removal of jihadist accounts and groups on other messaging platforms—such as Telegram, Hoop, and TamTam—Rocket.Chat remains one of the few platforms able to provide jihadists with a consistent way to communicate and distribute propaganda. 

Launched in December 2018 following a Telegram crackdown, the ISIS Rocket.Chat instance currently boasts more than 200 channels and groups, and over 3,700 registered users. To register for ISIS Rocket.Chat, users are required to send sign-up requests through Telegram bots or WhatsApp accounts. The server features content in multiple languages, including  Arabic, English, Farsi, French, Italian, Russian, Spanish, and Turkish.  

ISIS maintains at least one channel on the platform for releasing official ISIS propaganda. Many prominent pro-ISIS media units also maintain an active presence in multiple languages—including the Qimam Electronic Foundation, al-Battar Media, al-Taqwa Media, Greenb1rds, Jihad Fisabilillah (JSF), Sarh al-Khilafah, and al-Mutarjim.

These channels produce content ranging from operational security tips to guides on chemicals and explosives. Some of this content appears to be aimed specifically at potential terrorist recruits living inside Western countries.

Geo News (Al-Qaeda)

On December 5, 2019—roughly one year after ISIS announced its adoption of Rocket.Chat—the al-Qaeda-affiliated Global Islamic Media Front (GIMF) announced the launch of its own Rocket.Chat instance. GIMF is an al-Qaeda-affiliated media logistics unit that supports the group and its affiliates’ media units, disseminating official propaganda and often providing translations. 

Unlike ISIS—which has been able to maintain its presence on Telegram in the face of continual suspensions—Al-Qaeda and its supporters have struggled to achieve comparable representation on Telegram. As such, al-Qaeda’s Rocket.Chat server may now be the group’s single-most reliable and consistent source for its global propaganda dissemination efforts. 

Based on Flashpoint Intelligence, the Al-Qaeda Rocket.Chat community currently boasts more than 1,870 registered users and more than 95 channels—which is particularly noteworthy considering that new registration is currently closed. Content is available in multiple languages, including Arabic, Bengali, English, Farsi, French, Pashto, Uighur, and Urdu. Almost all of Al-Qaeda’s affiliates—and both the Afghani and Pakistani Taliban—are active and maintain channels on Rocket.Chat, as well as all of their media units, including Al-Qaeda Central, Al-Qaeda in the Arabian Peninsula (AQAP), Al-Qaeda in the Islamic Maghreb (AQIM), Shabaab al-Mujahideen in Somalia (aka al-Shabaab), Jama’at Nuṣrat al-Islam wal Muslimin (JNIM), the Taliban, and Al-Qaeda in the Subcontinent (India).

Assassination of Al-Qaeda Leader First Mentioned on Rocket.Chat

To illustrate the importance of Rocket.Chat for jihadist groups today, we can see the increasing frequency of relevant breaking news and headlines on these servers these, oftentimes occurring weeks or months before they appear in mainstream media.

For instance, news of the alleged assassination of top Al-Qaeda leader Abu Mohammed al-Masri in Tehran by an Israeli hit squad was reported by The New York Times on November 13, 2020. However, a user on al-Qaeda’s Rocket.Chat server made the same claim regarding al-Masri’s demise close to a full month earlier. 

On October 19th, an actor posted on Rocket.Chat claiming that al-Masri had been killed in Tehran sometime in August 2020. According to the message posted on Rocket.Chat, the two individuals who were assassinated in Tehran in August were al-Masri and his daughter, which are the facts that the New York Times ultimately published. At the time of the Rocket.Chat post, however, this ran counter to many Iranian and Arabic media organizations that were inaccurately claiming were a Hezbollah member and his daughter. This Rocket.Chat user claims to have been informed of al-Masri’s death from “exclusive sources who lived through the Afghan jihad period.”

Contact Flashpoint for More In-Depth Data and Analysis

Get in touch with Flashpoint for more information on how intelligence from Rocket.Chat has become an essential asset for physical threat analysts and the many ways Flashpoint can support your mission.