Terrorists on Telegram
February 2024

Terrorists on Telegram
Terrorist and extremist groups like ISIS, al-Qaeda, Hamas, Hezbollah, and others use the encrypted
application Telegram for purposes that may include recruiting new members, fundraising, inciting
violence, and even coordinating terrorist activity. Telegram’s messaging application has bothpublic-facing and private components. This flexible interface enables extremists to do everythingfrom self-promotion, brand development, and propaganda dissemination, to in limited cases, secretplotting of attacks outside detection or interference from law enforcement.
Telegram’s public-facing “channels” and private messaging “chats” make it a dual-use weapon for
extremist groups like ISIS, al-Qaeda, and Hamas. Telegram is easy to use and can be accessed via
a desktop or mobile device. The platform can be used to directly share propaganda, or as a directory
to share links to propaganda websites and archives. As extremists have been pushed off ofmainstream social media websites, they have often come to less moderated online spaces such as
Telegram.
Along with extremist Islamist groups, other violent extremists have shifted their communications
onto the social platform. In early 2019, Telegram saw a surge of activity from right-wing
extremists who used the platform to call for violence against government officials, advocate forwhite supremacist terrorism, and distribute written materials such as instructional manuals on how
to make and conceal weapons. (Sources: Vice, NBC News, CNBC)
Brief History of Telegram and Terrorism
For years, ISIS has used a variety of online platforms—including Twitter and WhatsApp among
others—to communicate with recruits and operatives, issue claims of responsibility for attacks,and disseminate news updates and propaganda materials. In January 2015, the group evencirculated a list of recommended private messaging applications, ranking them from least to most“secure.” At the time, ISIS considered Telegram to be a ‘safe’ or secure communications
application and accordingly recommended its use. (Source: Wall Street Journal)
ISIS has previously encouraged its followers on Twitter and other social media sites to connect
with ISIS coordinators and recruiters on Telegram to discuss sensitive matters such as travel to

ISIS circulates a list of secure messaging applications, January
2015. Via WSJ.

ISIS recruiter Neil Prakash encourages supporters on German-basedsocial media platform Askbook to contact him on Telegram, mid-2015.

1

ISIS-held territory. This behavior has declined since 2019. ISIS also created public channels on
Telegram to broadcast pro-ISIS news updates and disseminate other propaganda materials.
The ISIS presence online has caused considerable concern among authorities. However, at a
TechCrunch conference in September 2015, Telegram founder Pavel Durov dismissed theseconcerns, asserting that “[t]he right for privacy is more important [to Telegram] than our fear of
bad things happening, like terrorism.” Two months later, ISIS carried out the deadliest terrorist
attack on French soil since World War II, killing 130 people and wounding 350 more. According
to French investigators, the group had relied in part on Telegram and WhatsApp to coordinate andplan the attacks. (Sources: YouTube, International Business Times)
Since the Paris attacks, Telegram has revised its formal position, pledging to remove ISIS
accounts, bots, and chats, from public channels. Since 2018, Telegram and Europol havecoordinated a large-scale effort to remove ISIS content from the platform. The result of themoderation initiative has delivered effective and sustainable results. While ISIS propaganda
remains on Telegram as of February 2024, its presence is often minimal, less stable, and ISIS
supporters often have a hard time keeping accounts and posting content. (Source: Europol)
Telegram’s action against ISIS and al-Qaeda only came after several years of allowing thesegroups to operate on the platform with relative impunity. Telegram was one of the main platforms
previously used by ISIS to claim credit through their Amaq Agency for terrorist attacks and todisseminate propaganda materials. On March 23, 2017, for example, ISIS used the platform toclaim responsibility for the lone-actor terrorist attack the day before in London, which left four
people dead and more than a dozen wounded. On May 23, 2017, ISIS again claimed responsibility
for the Manchester Arena attack, releasing responsibility claims and other propaganda materials
on Telegram.

ISIS claims responsibility for Westminster attack in London, March 2017.

Other extremist and terrorist groups continue to operate freely on Telegram without comment fromthe platform. Telegram continues to host channels operating on behalf of internationally sanctioned
terrorist organizations, including Hamas, Hezbollah, and the Taliban. Al-Qaeda previously
operated on the platform, but the group’s public and semi-public channels are routinely removed.
In one instance, between September and December of 2022, Telegram worked in conjunction with
the Riyadh-based Global Center for Combating Extremist Ideology to review and remove online
content posted in Arabic. The three-month period saw the removal of 625,337 al-Qaeda related
items through 259 channels. (Source: Arab News)2

U.S.-sanctioned Hamas and Hezbollah channels live on
Telegram (above). Al-Qaeda’s Indian Subcontinent
channel is also live on Telegram (below). March 2017.
Above: Channels operating on behalf of the al-Qaedaaffiliated al-Nusra Front group remain live on
Telegram. March 2017.

Telegram has remained noticeably silent on the presence of these and other terrorist groups on its
platform. In some instances, the aforementioned channels have remained operational for wellover a year without takedown. Despite international calls for increased monitoring and removalof content endorsing hate speech and violent activity across social platforms, Telegram hasreportedly chosen to restrict rather than ban or delete channels connected to violent extremists.
According to a November 2023 WIRED analysis of more than 100 restricted channels, most of
the channels remained active despite being hidden. Additionally, content from the restrictedchannels was instead forwarded onto more publicly accessible channels. (Source: WIRED)How Terrorists Use Telegram: Channels, Chats, Direct Messages
The Telegram platform consists of public channels, private chats, and direct messaging. Terrorists
have co-opted all three forms of communication to distribute propaganda, incite to violence,
coordinate travel to foreign conflicts, and claim responsibility for terrorist attacks.
Channels
Telegram channels allow ISIS, al-Qaeda, Hamas, the Taliban, and other extremist and terroristgroups to broadcast messages to groups of followers at once. CEP has collected examples
demonstrating how terrorist-affiliated channels on Telegram publish propaganda materials to
subscribers, claim responsibility for attacks, issue calls to action, and solicit donations.

3

Al-Nusra-affiliated media channel promotes a fundraising campaign for jihadists in Syria. January
2017.

ISIS releases propaganda videos (left) and magazines (right) through public channels on Telegram.

Al-Qaeda’s South Asian branch claims responsibility for the murder of LGBT activists in Bangladesh.

4

Groups like ISIS have also issued calls to violence on Telegram channels in advance of major
attacks. On December 6, 2016, one such message read, “Christmas, Hanukah, And New Years[sic] Day is very soon Insha Allah[.] So let’s prepare a gift for the filthy pigs/apes.” Less than two
weeks later, Tunisian suspect Anis Amri plowed a truck into a crowd of people at a Christmas
market in Berlin, killing 12 people and injuring 48 others. ISIS also claimed responsibility on
Telegram for the New Year’s Eve shooting attack at an Istanbul nightclub. The attack left 39
people dead and dozens wounded. (Sources: MEMRI, Telegraph, New York Times, Newsweek)
By 2019, the extreme right, including white supremacists and neo-Nazis, had also established apresence on Telegram. Channels affiliated with extreme-right groups and movements have used
the platform to spread propaganda, recruit, fundraise, and call for violence. A collection ofchannels, termed Terrorgram, routinely made posts calling for acts of violence and glorified
various white supremacist attacks, including the 2011 Norway attacks, the 2018 Pittsburgh
synagogue shooting, the 2019 Christchurch attack, and many others. Terrorgram eventually
published three text guides in 2021 and 2022 that advocated for acts of terrorism, spreading neoNazi accelerationist concepts and tactics, and in some cases, instructions for constructing explosive
devices and selecting targets to attack. In October 2022, the online collective released a 24-minutevideo celebrating dozens of individuals who had committed acts of murder and terrorism topromote white supremacist ideology. In January 2021, Telegram removed some extreme rightchannels promoting violence. However, this effort has been inconsistent and opaque. (Sources:
Vice, CNN, Huffington Post, NBC News)
January 2021 saw a significant shift of far-right content—especially Qanon and 2020 election
denial material—onto Telegram as the shutdown of Parler, a social network popular with the farright, left members turning to alternative communication platforms. In the weekend after Parler
went offline, hundreds of thousands downloaded Telegram, a pattern that repeated following
Twitter and Facebook’s ban on former U.S. President Donald Trump in 2021. (Sources: CNN,
New York Times)
ISIS Chats
ISIS previously encouraged supporters using platforms like Twitter, YouTube, and WordPress—
as well as Telegram’s public channels—to contact the group privately on secure messaging
platforms like WhatsApp, Threema, Viber, or Telegram’s secure chat platform. Although
YouTube was previously a top recruitment and propaganda medium for ISIS, ongoing monitoring
and removal efforts by the social media platform drastically reduced, and in some cases halted,
ISIS’s footprint on the platform by 2018. (Sources: WIRED, Homeland Security Today, Institutefor Strategic Dialogue)
After migrating their outreach onto Telegram’s secure chat platform, ISIS operatives were able toengage with followers one-on-one or in small groups to plan attacks or encourage travel to andfrom ISIS strongholds. As Telegram’s chats can accommodate up to 200,000 members, ISISrelated content has far-reaching potential. In the past, ISIS’s supporters used the chat platform toshare pro-ISIS content amongst themselves, chatting and sharing links on new, as well as archived,
5

ISIS videos, magazines, and attacks claims. ISIS supporters on Telegram have also tried to vet
journalists, analysts, and others—whom they refer to as “spies”—so they can share pro-ISIS
content amongst themselves. The expansive messaging network remains resilient, and despite
increased moderation of ISIS and other terror-related content on social media platforms in 2019
and the early 2020s, the terror group remains abreast of alternative communication channels suchas Rocket chat, Tam Tam, Nandbox, and Hoop Messenger to continue their outreach. (Sources:
Telegram, Institute for Strategic Dialogue, Institute for Strategic Dialogue)

ISIS supporters on a Telegram chat room share details about a “spy” so others can block him, January 2017.

Telegram continues to facilitate terrorist communication despite the platform taking actions to banthese groups and their respective channels. In the past, ISIS would typically coordinate its PR
campaigns on Twitter and other social media platforms, sharing the relevant materials—posters,
statements, hashtags, and links to ISIS videos hosted on other sites like JustPaste.it, SendVid, andInternet Archive—amongst themselves before pushing the materials out en masse. This process
now takes place on Telegram and similar platforms, where ISIS operatives often first coordinate
ISIS PR campaigns in secret, before sharing links on other social media platforms. Additionally,following the start of the Hamas-Israel War in October 2023, Telegram banned a few, but not allchannels dedicated to or affiliated with Hamas’s military wing. Those channels that evaded
removal collectively boasted 1 million subscribers. (Sources: Washington Post, MEMRI, NPR)
According to an April 2023 study published by the Global Network on Extremism & Technology,
ISIS has reportedly incorporated the use of Telegram bots to automate the sharing of content andmanage online chats. On average, the bots reportedly post 176 messages a day across ISIS
channels. The bots serve three functions: promoting ISIS propaganda, moderating discussions
within Telegram channels and groups, and administering groups such as overseeing the admissionof new members or blocking violators of the channel. (Sources: Global Network on Extremism &Technology, New York Times)
Secret Chats
Telegram also has a “secret chat” function, where the sender and recipient use end-to-end
encryption. Chats in this function are not stored on the Telegram cloud but instead stored on local
devices. Telegram cannot read messages sent as secret chats. (Source: Telegram)
From Telegram to Terrorism
6

Terrorists have used Telegram in the lead-up to a number of successful and thwarted terrorist
attacks worldwide:
•

•

•

•

•

•

•

•

November 13, 2015 – France: ISIS assailants target civilian locations across Paris in asynchronized attack, killing 130 people and wounding more than 350 others. French
investigators reveal a month later that the assailants used chats on Telegram to plan andcoordinate the attacks. (Sources: CNN, Hill)
December 2015 – Indonesia: Indonesian police arrest Arif Hidayatullah and members of
his pro-ISIS cell, who are believed to have received bomb-making instructions via
Telegram. Bahrun Naim, an Indonesian ISIS recruiter based in Raqqa, Syria, reportedly
directed Hidayatullah to target non-Muslim religious sites in Java, alongside a team ofsuicide bombers. (Source: Vocativ)
December 30, 2015 – United States: Police arrest Emanuel Lutchman the day before heplans to attack a bar on behalf of ISIS. Lutchman was allegedly directed to carry out theattack by an ISIS recruiter on Telegram who told Lutchman that he should “find the places
where the most population, take as many as possible out.” (Source: U.S. Department ofJustice)
June 13, 2016 – France: French ISIS supporter Larossi Abballa breaks into the home of a
French police officer and kills him and his wife. From the victims’ home, Abballa uses
Facebook Live to livestream his pledge of allegiance to ISIS leader Abu Bakr al-Baghdadi.
French officials later discover that Abballa had been in a Telegram chat group with ISIS
executioner and recruiter Rachid Kassim. (Source: BBC News)
June 29, 2016 – India: India’s National Investigation Agency arrests five men who had
allegedly created an ISIS terror cell with the aim of carrying out attacks in India. The
alleged leader of the cell, Mohammed Ibrahim Yazdani, had reached out to an ISIS recruiteron Telegram months before his arrest in an effort to reach Syria. When his efforts to travel
abroad failed, he and the recruiter switched between a number of encrypted apps in orderto plan and coordinate an attack within India. The ISIS recruiter reportedly vetted cell
members for Yazdani and even orchestrated weapon sales on his behalf. (Sources: Timesof India, New York Times)
Late July 2016 – Brazil: Ten members of a pro-ISIS cell are arrested in Brazil after
allegedly plotting terrorist attacks against LGBTQ+ people, Shiite Muslims, and Jews, aswell as foreigners at the 2016 Olympics in Rio de Janeiro. According to prosecutors,
members of the cell had communicated with each other over various platforms including
Telegram, where they had discussed training, how to obtain weapons, and plans forcarrying out attacks. (Sources: Reuters, New York Times)
July 26, 2016 – France: Abdel-Malik Petitjean and Adel Kermiche kill a priest in
Normandy after being introduced to one another through a pro-ISIS group on Telegram.
ISIS executioner and recruiter Rachid Kassim reportedly provided instruction andencouragement to the assailants via Telegram. (Source: BBC News)
August 4, 2016 – France: Police detain a 16-year-old girl for administering a Telegram
group where ISIS supporters discussed propaganda and called for terrorist attacks.
7

•

•
•

•

•

•

•

•

According to a French investigator, the girl “relayed numerous Islamic State grouppropaganda messages calling for attacks, and she also expressed her own intention oftaking action.” (Source: BBC News)
August 9, 2016 – Kuwait: Police arrest a Filipino woman whom they say was planning asuicide bombing attack within Kuwait. According to Kuwaiti authorities, the woman had
used Telegram to communicate with her husband, an ISIS militant in Libya. (Source: ABSCBN News)
September 14, 2016 – France: Police detain a 15-year-old boy who allegedly volunteered
to conduct a terrorist attack. According to French authorities, the boy had used Telegram
to stay in contact with ISIS executioner and recruiter Rachid Kassim. (Source BBC News)
December 19, 2016 – Germany: A driver—believed to be deceased Tunisian-born suspect
Anis Amri—plows a truck into a crowd of people at a Christmas market in Berlin, killing
12 people and injuring 48 others. Amri had previously used Telegram chat to communicate
with his nephew, urging him to pledge allegiance to ISIS. Two weeks prior to the attack, amessage appeared on a Telegram channel calling on ISIS supporters to “prepare a gift for
the filthy pigs/apes” in advance of the holiday season. (Sources: NBC News, MEMRI)
April 3, 2017 – Russia: A suicide bomber blows up a subway car in St. Petersburg, killing
15 people and wounding 51. Police identify the bomber as Akbarzhon Jalilov, aKyrgyzstan-born, naturalized Russian citizen and radical Islamist. Russia’s Federal
Security Service (FSB) claims to have received “reliable information about the use of
Telegram by the suicide bomber, his accomplices, and their mastermind abroad to conceal
their criminal plots at all stages of preparation for the terrorist attack.” (Sources: BBC
News, BBC News)
October 10, 2019 – United Kingdom: British ISIS-supporter Safiyya Amira Shaikh isarrested for plotting to blow up St. Paul’s Cathedral and a hotel in London. Shaikhreportedly used Telegram to communicate with her co-conspirators and promote ISIS.
(Sources: Times, Times)
June 22, 2020 – United States: U.S. Army private Ethan Phelan Melzer is charged withsharing secret information with the Order of Nine Angles (ONA), a neo-Nazi, raciallymotivated, occultist, and Satanist violent group, to orchestrate an ambush on his own unit
during a redeployment to Turkey. Melzer reportedly disseminated information such as his
unit’s location, strength, and armaments, to 09A members and their related group, theRapeWaffen Division, on Telegram. Melzer reportedly joined ONA in 2019, a year after
enlisting in the U.S. Army. He is sentenced to 45 years imprisonment in March 2023.
(Source: New York Times, U.S. Department of Justice)
October 12, 2022 – Slovakia: Juraj Krajčík murders two people and injures one other in ashooting outside of an LGBT bar in Bratislava before killing himself. In a manifesto
initially posted on Twitter, Krajčík identified himself as a Telegram user and thanked theneo-Nazi accelerationist Terrorgram community for their propaganda and how-to guides.
He also praised a notorious Slovak white supremacist Telegram propagandist. (Sources:
Vice, Huffington Post)
February 6, 2023 – United States: Brandon Russell, the founder of the neo-Nazi group
Atomwaffen Division, is arrested and charged with conspiracy to damage an energy facility
in the Baltimore, Maryland, area. According to leaked documents, prior to his arrest,8

•Russell reportedly communicated with Australian extremists on Telegram, where he shared
instructions on how to carry out attacks on power grids. (Source: BBC News)
October 2023 – Gaza Strip: Following Hamas’s October 7 attacks on Israel in whichapproximately 1,200 people are killed, Hamas continues its use of Telegram Hamas uses
Telegram to disseminate information and graphic images of the war and to encourage
members to act on behalf of the group. The following across Hamas related channels surges
in the aftermath of the attack. The channels publish a barrage of propaganda, including
rapid-response statements and highly produced videos. Although Telegram removes someHamas’s military channels by the end of the month, not all channels dedicated to oraffiliated with Hamas are removed. Instead, they are hidden and more difficult to access.
Additionally, media sources reveal that content from restricted channels continued to bebroadcast on unrestricted channels, allowing Hamas to continue its outreach. (Sources:
CNN, Telegraph, Washington Post, NPR, WIRED)

Conclusion: End Terrorists’ Access to Telegram
As of February 2024, Telegram has been reluctant to respond seriously to the threat of terrorist
activity on its platform. Despite action taken to make Telegram more inhospitable to ISIS and alQaeda, further steps need to be made to curtail ISIS’s access to Telegram’s private chats given
evidence that the platform has been used to plan and coordinate attacks. ISIS propaganda also
continues to appear regularly on Telegram to issue attack claims, videos, and threats of violence.
As ISIS’s propaganda output has decreased since late 2019, Telegram has been used to share links
to ISIS online propaganda depositories. Notably, CEO Pavel Durov has refused to publicly addressconcerns about other terrorist groups operating on his platform, including the Taliban. Despitepressure to remove Hamas channels after the start of the Israel-Hamas war in October 2023, Durov
has removed only a select number of the channels, with content still being disseminated acrossaffiliate groups on the platform. (Source: WIRED)
It is clear that more can and should be done. Terrorists continue to use Telegram to plan attacks
and recruit followers in North America, Europe, the Middle East, and Southeast Asia. And despite
efforts by Durov to present Telegram as a refuge for privacy and encryption, the company has
previously been a safe haven for groups like ISIS and the violent extreme right, and continues tobe used for propaganda purposes by ISIS, Hamas, al-Qaeda, and the Taliban. Until we take serious
efforts to reduce terrorists’ access to Telegram and other platforms, these groups will continue toinflict violence on civilians around the world, destabilizing the countries where attacks occur, andreducing global security and safety.

9