Militants continue to distribute propaganda online despite statewide internet shutdown

Despite the imposition of some of the most pervasive physical and digital restrictions anywhere in the world, India’s northernmost state of Jammu and Kashmir has yet again erupted in another cycle of violence. The insurgency that has raged across the state since at least July 1989 is now being fueled by “The Resistance Front” (TRF), a new and reportedly Pakistan-backed terror outfit targeting Indian security services deployed there.

While the world’s attention was fixated on combating the ongoing COVID-19 pandemic, Islamabad’s strategy of using proxy forces to engage in asymmetric warfare appears to have been renewed with the creation of TRF and the improved mobility for operatives attempting to infiltrate via the mountainous terrain along the Line of Control (LOC), the de facto border between the two countries. As with other terror groups operating in the region, TRF has adapted to the proliferation of digital communication by adopting social media insurgency tactics.

The Resistance Front is one of the first major terror groups founded in direct opposition of the BJP-led Central Governments unilateral revocation of Article 370 on August 5, 2019. Following the introduction of sweeping amendments to the legal provisions governing the autonomy and administrative status of the state, the Indian government deployed additional troops to the region and instituted a comprehensive physical and digital lockdown, which is still in place more than 300 days later.

In spite of these restrictions, online activity by extremist groups in the state continues unabated, with many turning to virtual private networks (VPNs) to bypass the government measures. This in turn raises questions regarding the efficacy of imposing such sweeping measures in the state that have caused severe inconvenience to ordinary citizens while remaining ineffective at curbing terror groups activity online.

TRF maintains an active presence on multiple major platforms, including Facebook, WhatsApp, Twitter, and Telegram. They leverage the popularity of the platforms among Kashmiri locals, as well as the end-to-end encryption feature offered by some of them, to magnify their attacks, provide regular updates on their activities on ongoing counter-insurgency operations in the state, amplify propaganda venerating their fallen members, and urge locals to take up arms against India.

The DFRLab used open-source investigative techniques to highlight TRF’s active social media presence on a number of major platforms despite ongoing digital restrictions in the state. An analysis of the group’s online behavior over the month of April 2020 — during which the outfit claimed a series of high-profile attacks targeting Indian forces deployed the state — emphasized the importance accorded by the TRF to social media insurgency, with the active dissemination of propaganda mirroring and complementing the real-world violence carried out by its members.

A new proxy force in the valley

First appearing on social media platforms as early as October 2019, TRF gained the attention of local media after claiming responsibility for a grenade attack along Hari Singh High Street in the city of Srinagar that left one civilian dead and dozens injured, including three local policemen. Subsequently, the group went on to carry out a series of violent attacks over the month of October. TRF initially exhibited the same operational tactics and capabilities employed by other terror groups in the state, using indirect means of contact — usually grenade attacks and IEDs — to target local civilians and police officers.

In March 2020, Outlook India, a domestic publication, reported on how the group appeared on the radar of Indian security agencies after six of its members were arrested, uncovering a significant arms cache. Another Indian outlet, The New Indian Express, published an article highlighting how the interrogation of captured members revealed that they had received their instructions via a Pakistan-based operative known as “Andrew Jones” on Telegram and “Khan Bilal” on WhatsApp, two encrypted-messaging platforms.

From April 2020 onward, however, TRF began to claim a series of high-profile operations that saw members of the group switching from indirect means of targeting security services to using assault rifles to target directly Indian security services stationed in the state. This directly confrontational approach, alongside the presence of trained and battle-hardened militants among its cadre, further distinguished the tactics and operational capabilities of TRF from that of its peers in the valley.

Open-source data compiled by the South Asia Terrorism Portal, an independent Indian think tank, shows that the first five months of 2020 have already seen 43 violent incidents in the Jammu and Kashmir, leading to the death of 10 civilians, 74 insurgents, and 25 members of the armed forces.

Social media insurgency

TRF maintains an active presence on multiple terrorist channels, allowing them to disseminate propaganda via a range of digital platforms, including Facebook, WhatsApp, Telegram, and Twitter. Moreover, every attack by the group is quickly claimed and amplified via social media alongside posts containing stylized graphics and photographs memorializing the attacks, as well as threats of further violence.

Analysis of a now-deleted TRF Facebook page via CrowdTangle showed that, despite receiving little traction, the page received the highest interaction rate on April 26, 2020, and May 3, 2020, coinciding with days during which members of the group were involved in armed encounters in the state. Moreover, status updates announcing and claiming responsibility for attacks gained the highest traction reiterating the increasingly symbiotic nature of digital and physical violence in the operational strategy of terror groups in the region.

April is the cruelest month

On April 5, 2020, the group claimed responsibility for an armed encounter between security forces and members of the group infiltrating across the LOC in Keran sector, Kupwara, which resulted in several deaths. The Keran encounter also reinforced Indian security services’ suspicions of the group being funded and trained from across the border, with three members killed in the encounter discovered to be locals from South Kashmir who had traveled to Pakistan on valid Pakistani visas and had been reported missing since 2018, over which time they received training and supplies from their handlers in Pakistan, according to a report by the Hindustan Times.

On April 18, 2020, the group gained further notoriety after ambushing a paramilitary vehicle in Sopore, Baramulla, killing three members of the Central Reserve Police Force (CRPF) and wounding two others. Finally, on May 2, 2020, TRF engaged in one of its most high-profile attacks, an armed encounter in Handwara, Kupwara, with a 12-hour siege that resulted in the death of five security servicemen, including a colonel, a major, and a sub-inspector of the local police. Less than 24 hours later, the group struck again, on May 4, during which a lone member ambushed a patrol of CRPF servicemen in Sopore, Baramulla, killing three and injuring two others.

An enduring conflict in the valley

Jammu and Kashmir, a highly militarized regional battleground, has seen India and Pakistan engage in three conventional conflicts for control over the territory. As part of its policy of asymmetric warfare in the region, Islamabad has extended support to a range of proxy forces cloaked as indigenous resistance movements including Hizbul Mujahideen (HM), Jaesh-e-Mohammed (JeM), and Lashkar-e-Toiba (LeT), with the leadership of the groups based out of Pakistan and its members responsible for a number of violent attacks on Indian security forces stationed in the state.

In addition to expounding the same ideologies and tactics as Pakistan-backed terror groups in the valley, TRF exhibits a degree of coordination with such groups, using social media channels to cross-post propaganda and information about their attacks. Direct collusion is also postulated in an exchange between a member and the moderator in a WhatsApp group ostensibly meant for supporters of Ansar-Ghazwat Al-Hind (AGH), an affiliate of Al-Qaeda in the state. In the text exchange, a member asked, “Who is the TRF?” with another member with the screen name “Cobra” responding that “TRF is the organization that joins all the other groups together. Apart from AGH and ISJK [Islamic State Jammu and Kashmir] all other groups are part of it. Although perhaps even the AGH is part of it, only God knows.” Another user going by the screen name “Haq Parast” asked the moderator, “How correct is this statement?” The moderator responded by confirming the prior statement while adding, “This is the most active group in Kashmir today.”

Further evidence of coordination is also provided by a post uploaded in TRF’s personal chat group on Telegram in the hours after the Handwara encounter on May 2, 2020. A user with the screen name “Faisal Shafi” posted a video of the final testimonial of two militants who allegedly represented “Pak brothers at Handwara encounter” with the message “Haider bhai” (brother Haider). While TRF’s subsequent posts glorifying the attack on its digital channels claimed that both militants killed in the attack were locals, this was refuted by a subsequent investigation by the local police.

A story published by the Hindustan Times, citing a report from Asia News International, reported that one of the casualties of the encounter was “Haider, a Pakistani terrorist belonging to the Lashkar-e-Taiba,” leading to speculation that TRF was a “shadow outfit” that was largely comprised of militants drawing from HM and LeT.

Local security analysts believe that the formation of TRF represents an attempt by Islamabad to consolidate the “strengths, manpower, weaponry and training of various militant outfits into one group.” Accordingly, Indian strategists postulate that, by presenting TRF as an indigenous movement, Islamabad hopes to evade international pressure to cut off state support for proxy groups in the region brought on by its grey-listing by the Financial Action Task Force (FATF).

In the aftermath of the high-profile Handwara encounter claimed by TRF, Indian security services stepped up counterterrorism operations in the state. On June 10, security officials announced the elimination of 22 terrorists over the first half of June, including eight commanders of militant outfits associated with the TRF. The casualties of the counterterrorism operations included high-profile insurgents such as Riyaz Naikoo, former commander of HM, and Adil Ahmad Wand, former commander of ISJK, signaling a recognition by the Indian security establishment that TRF represented one of the most potent proxy forces operating in the state.

The latest counterterrorism measures brought the number of insurgents killed by security forces in the state over the last six months up to 93. Despite the mounting death toll, India Today reported a spike in local terror recruitment over the same period, suggesting that the enduring conflict shows no sign of abating in the near future.

The resumption of violence in Jammu and Kashmir after the abrogation of Article 370 also signals the need for Indian security agencies to rethink their broader policy toward containing violence in the valley. This need for a new approach is particularly germane given that, despite imposing stringent restrictions on movement and digital communications in the state, terror groups continue to carry out attacks and utilize social media platforms to claim responsibility and amplify their extremist propaganda.

Ayushman Kaul is a Research Assistant, South Asia, with the Digital Forensic Research Lab.

Follow along for more in-depth analysis from our #DigitalSherlocks.