The Shabaab al-Mujahideen's attack and four-day-long siege at the Westgate mall in Nairobi, Kenya demonstrated a new trend in al-Qaeda's online media strategies, as online communication from the al-Qaeda affiliate in Somalia was routed exclusively through social media sites.

Leading to confusion and uncertainty, it was the first incident in which al-Qaeda or one of its affiliates used only the Twitter social networking site to release updates about the operation and claims of responsibility, instead of issuing communiqués through jihadist forums.


SSOfficialPageOn September 21, 2013, after the attack and siege at the Westgate mall was underway, the Shabaab al-Mujahideen started a Twitter campaign, providing real-time updates from an official "HSM [Harkat Shabaab al-Mujahideen] Press Office" account.

Through their Twitter platforms, the Shabaab released a claim of responsibility for the operation, rejected calls for a negotiated end to the attack, and threatened additional violence against Kenya. Before the siege had even been broken, the Twitter account was even used to release an audio message from the group's spokesman, Ali Mahmoud Ragi, praising the operation and threatening future attacks against Kenya.
The Shabaab's heavy use of an open-access social networking site to release information about an ongoing major attack—and to attempt to shape to public perception of operation while it is being carried out-- is unprecedented for a recent jihadi movement and the technique highlights the evolution of jihadi media strategies towards social networking sites. Although the Shabaab has been active on Twitter since December 2011 they, and other jihadi organizations, have previously used social media sites as a supplement to their activities on primary source jihadi forums or as a replacement when forums are inaccessible. However, during the Westgate mall attack, Twitter was the primary platform used by the Shabaab to communicate with media and supporters, and the group adapted their online presence to shape perception of their operation.
In issuing official messages during the Westgate mall siege, the Shabaab was able to harness overwhelming attention paid to the attack and interact directly with global media outlets covering the incident, at the height of global interest. Despite censorship from Twitter, in the form of suspended accounts, the official Press Office account of the Shabaab kept up a steam of nearly round the clock English-language content as did a second, unconfirmed, account also claiming to represent the Somali-based group.

Approximately eight hours after the mall siege began, the Shabaab announced their responsibility for the operation in a September 21, 2013 series of tweets that culminated in the announcement that: "The Mujahideen entered #Westgate Mall today at around noon and are still inside the mall, fighting the #Kenyan Kuffar inside their own turf." The messages included threats of future attacks in Kenya, such as a statement that that Shabaab "has on numerous occasions warned the #Kenyan government that failure to remove its forces from Somalia would have severe consequences" and the assertion that "For long we have waged war against the Kenyans in our land, now it's time to shift the battleground and take the war to their land #Westgate." Screenshots of selected tweets follow:



During the mall attack, the official Shabaab press office account issued messages that appeared to relate conditions within the mall, such as September 23 posts indicating that the "HSM Press has made contact with the Mujahideen inside #Westgate. They say they're going according plan with a surprising degree of accuracy!" and "The #Westgate Warriors informed HSM Press that they've successfully repelled a joint Kenyan- Jewish offensive & eliminated 13 Kenyan forces...they've obtained large amounts of ammunition and are, by the blessings of Allah alone, still firm and still dominating the show #Westgate."


Benefits of Twitter for Jihadi Communication

The Shabaab's use of Twitter to provide nearly hourly updates on an ongoing attack represents an evolution from previous jihadi use of Twitter as a supplement to the still-dominant model of distributing media through established channels on moderated jihadi forums. Jihadi forums allow groups to frame their messages, tightly control content, and eliminate ambiguity about credibility, but have the drawback that media posted to forums often diffuses slowly, causing jihadi groups to miss capitalizing on the window of heightened media attention following a major operation. In contrast, openly accessible social media platforms provide a number of benefits for jihadist groups: they are easily accessible and allow real-time engagement with supporters, prospective recruits, and members of the media. With little effort, jihadi groups and officials can directly share their positions- - on their own terms and in their own words—to shape media coverage of their actions. As well, messages posted to social networking sites reach audiences immediately, and are extremely easy to access and redistribute, exponentially multiplying their audience.

Further enhancing the appeal of social networking sites, the platforms are easily reached. The relative dependability of social networking accounts contrasts with the restrictions faced by jihadi forums, which may be offline, have been blocked by certain countries, and may invite scrutiny upon their users. In contrast, Twitter can be visited without raising suspicion, is almost always online, and it is easy to make and promote new accounts. With social media accounts, jihadi groups mirror established international actors, including governments, businesses, and NGOs, and continue their development of sophisticated media tools that enhance the credibility and believability in both the eyes of the West and to potential recruits. As jihadi groups explored the possibilities of social networking, those that have been particularly successful in recruiting fighters from the West—such as the Shabaab al-Mujahideen—have focused on releasing content in widely-spoken languages, particularly English.


Development of Twitter as a Jihadi Medium


Jihadis have been using Twitter at least since 2010, with the Shabaab joining the site in December 2011, but never before to this extent. One early adapter of Twitter, the Afghan Taliban, began to establish their social media presence in December 2010, through which they brief bulletins about their actions and alerts for forthcoming communiqués. Many of the most prominent jihadi groups have followed the same path, including the Shabaab al-Mujahideen, the Islamic State of Iraq and the Levant (ISIL), and al-Qaeda in the Islamic Maghreb (AQIM). The content of these Twitter accounts has tended to closely mirror material released to jihadi forums. For example, the Afghan Taliban may post the text of a communiqué to their website, to a jihadi forum, and to the Twitter account of one of their spokesmen. Mirroring jihadi groups, elements of the online jihadi community have also migrated to social media sites, with prominent forums such as Shumukh al-Islam and Ansar al- Mujahideen English Forum creating Twitter accounts to publicize notable releases and discussions. Concurrently, many individual jihadis and jihadi supporters have joined Twitter, enthusiastically circulating propaganda among themselves and promoting it to potential recruits.

Yet, the benefits conferred by social networking come with a substantial cost: social networking platforms can sow great confusion if known official accounts are deleted and reestablished or if there are multiple accounts claiming to represent a specific jihadi group. In order to reach the new official accounts, followers must be able to distinguish the legitimate social media accounts of jihadi groups from non-authenticated users, which is a level of ambiguity that is not found on jihadi forums.

An example of this ambiguity and confusion occurred in the aftermath of the Westgate mall attack, when two accounts claiming to be the "Press Office" of the Shabaab al-Mujahideen were issuing concurrent, and often conflicting, reports during the operation.1 Notably, one of the accounts issued what appeared to be real-time reporting on the actions of the fighters within the mall, threatened hostages, and listed purported names and nationalities of 21 alleged attackers.2 As well, the account sparked a frenzy by claiming, briefly, that the Westgate attack was directed by a high profile female British convert, Samatha Lewthwaite. Adding to the general confusion, each of the parallel "press office" accounts were targeted by Twitter, and so were constantly being taken down and migrating to new usernames. One of the two press office accounts was eventually verified by a journalist known to be in contact with official spokesmen for the Shabaab al-Mujahideen, and issued disavowals of the information being distributed by the second. Such confusion is rare on jihadi forums, where there is a clear structure of what releases are credible and where the forum administration team is able to not only denote official releases in their own section, but suppress the transmission of non-legitimated claims.
Despite the element of uncertainty, many jihadist groups have been moving to social networking sites and establishing official Twitter accounts for their press corps. Jihadis have turned to social media sites to broaden their reach online. Social media accounts, and particularly Twitter, provide not only a extra layer of legitimacy for groups, but also allow their spokesmen to present their messages, on their own terms. Yet, credibility of such accounts can be extremely difficult to parse and interpret, particularly in developing circumstances. For jihadi groups, social networking accounts can be advantageous, but their use comes at the cost of decreased authority and control.


[1] While the Shabaab al-Mujahideen has made frequent use of Twitter, they have never operated concurrent press office accounts.

[2] Another account resembling official outlets from the Shabaab, @HSMPress_, related satirical updates purportedly from the Shabaab that were also mistaken for official communications until the page added a disclaimer denying any relation to the terrorist group.