1. Now that the dust had settled a bit, some reflections on the recent decimation of #IS on Telegram:

2. On 21-24 November, Europol trashed #IS’s entire media distribution network on Telegram, not to mention most of its major munasir groups and foundations.

3. Europol campaigns against #IS on Telegram—of which there have been many in recent years—have historically had little to no discernible impact on the group and its supporters. They’ve seemed misguided at best and lip service at worst.

4. This latest campaign was, however, different. Not only was its targeting sound, the pressure was sustained. Over the three-day period, for example, more than 250 Nashir News Agency channels and groups were knocked—and subsequently kept—offline.

5. The same can be said for the likes of Caliphate News 24, the Nasikh Agency and most of the munasirin big hitters—not just decimation, but sustained decimation.

6. For that, Europol—and, indeed, Telegram—should be commended. #IS’s online community is now hanging onto its favourite haunt by a thread. However, it’s important that (a) we don’t get ahead of ourselves and (b) we recognise that there will be some negative consequences to this.

7. On not getting ahead of ourselves: The claim that #IS was comprehensively booted off the Internet is false. Not only do its supporters remain alive and well on mainstream platforms (albeit in small numbers), it still retains a robust shell of a network on Telegram.

8. [...] The Nashir News Agency is still up and running; Caliphate News 24 is still up and running; the Nasikh Agency is still up and running—and so too are most (if not all) of the major munasir foundations. Moreover, there’s been no real let up in the flow of new content.

9. [...] Certainly, #IS has been destabilised and, certainly, it is now much harder for networked supporters to access its media output (let alone newbies), but it remains on Telegram and doesn’t seem to be rushing anywhere else *for now*.

10. [...] Among other things, that’s because Telegram, for all its disruption sins, is still way better than the next best options (prob RocketChat & Riot in that order). Still though, #lIS’s experimental proto-networks are out there, so if it needs to, it will migrate elsewhere.

11. On the potential for negative consequences: This disruption event could end up having strategic implications for #IS that will leave it worse off. However, it could also leave the practitioner community worse off.

12. [...] That’s because #IS was more-or-less contained on Telegram before this. Its networks were thoroughly infiltrated and its content disseminators hiding in plain sight. In short, it was a problem, but a problem we had a handle on.

13. [...] In light of this disruption, the likelihood of #IS—both the organisation and its supporters—migrating onto some obscurer, less surveillable platform has dramatically increased. Should that happen, it’ll take quite some time to rebuild past intelligence capabilities.

14. All in, I’d say the last few days have yielded a net benefit to security practitioners— #IS’s online network is much diminished, something it’ll struggle to recover from, and yet it’s still anchored on Telegram.

15. Equally though, we’re now perilously close to new and unstable waters. #IS’s next move could prove to be very problematic from a long-term security standpoint, even if it ends up making it because its enemies have seized the initiative.