The following report is now a complimentary offering from MEMRI's Jihad and Terrorism Threat Monitor (JTTM). For JTTM subscription information, click here.
Ansar At-Tawhid (AT) – "Supporters of Monotheism" – is a media operation comprising either an individual Francophone Salafi-jihadi online operative, or a small group of them. The following report will show how this entity serves as a community meeting point and as a facilitator, recruiter, fundraiser and organizer of activities in direct support of the Islamic State (ISIS), as well as its influence as an ideological authority.
An examination of the content disseminated by AT shows that it encourages and assists individuals in travelling to ISIS-controlled territory in order to join the jihad there and possibly return later to carry out operations in the West. A post on AT emphasized the ease with which this is done: "15, more or less, is the number of French people who enter Syria each month and it is not diminishing. [...] When brothers succeed in going back and forth into Syria and then attack the West while being actively tracked by intelligence services, who do you think blinded the enemy? Allah did !!!" AT also emphasizes that, if an individual is unable to reach the Caliphate, he may serve ISIS by pledging loyalty to its leader and carrying out a lone-wolf attack in the West: " As [ISIS spokesman] 'Adnani said, an operation in the land of unbelief is more valuable in [ISIS's] eyes than a martyrdom mission in the land of Islam."
A close analysis of the content posted on AT indicates that the entity likely had a direct influence and operational role in the June 12, 2016 terror attack by French national Larossi Abballa, who killed a police officer and his partner in Magnanville, near Paris. Some of Abballa's statements are nearly identical to messages posted by AT, indicating that he followed AT media accounts and was possibly even in direct contact with AT operatives prior to the attack. The attack was later claimed by ISIS.
This report focuses on the operational aspect of AT's activity (recruitment, fundraising, encouragement and facilitation of travel to Syria and Iraq of jihad in the West, etc.). The ideological-inspirational aspect of AT's activity will be addressed in Part II of this report, to be published in the coming days.
Banner of the Ansar At-Tawhid website, setting out the fundamental religious principles of Salafi doctrine
Table Of Contents
Note: At the time of publication, AT is still fully operational.
While ISIS media activity has gradually shifted from an outside network of supporters to an internalized media apparatus directly controlled by ISIS media offices, semi-official pro-ISIS media entities such as AT, which are directly endorsed by ISIS, still serve an important function within online jihadi networks. Such entities finish the job of official ISIS media by providing less visible and more personal liaison between the organization and its community of online supporters. These semi-official networks of media supporters were recently featured in an ISIS video setting out the organization's structure, placed alongside its own media branches.
AT distributes Salafi-jihadi religious ideological content in French, in the form of translated fatwas, religious essays, opinions, and commentary. It also provides news and information about global jihad, with a special focus on ISIS activity in Syria and Iraq. Additionally, it serves as an operational intermediary, a meeting point for French-speaking jihadi operatives and sympathizers all over the world who share a common religious view.
The entity's online activity takes place on a website as well as on Facebook, Telegram, Kik, Twitter, YouTube and Snapchat. While some of its social media accounts have been shut down, at least one has been operational at any given time. Also, due to the religious nature of most of the content, the entity's activity is under less scrutiny and pressure than others that continuously disseminate all ISIS official media productions.
Between May 11 and July 1, 2016, the AT account on Telegram shared 491 photos and 312 links. During this time, AT posted close to 2,000 messages, and dozens of other files and documents, for an average of nearly 50 posts per day.
The following report is based on data published by AT media and collected by MEMRI during May and June 2016. Most of the material quoted was taken from the entity's Telegram channel, although the majority of messages were also disseminated via Twitter, Facebook, Kik, and Snapchat.
Graphic showing where to find Ansar At-Tawhid on its website and on Twitter, Kik, Snapchat, Facebook, and Telegram.
The Individual(s) Behind AT
It is unclear whether AT is run from within ISIS-controlled territory or from another location, or whether it is an operation or strictly an individual initiative. The content of the messages and the style of writing appear to indicate that one individual is responsible for running the entity, but the occasional use of the first-person plural could mean that a group is carrying out the activity.
AT messages occasionally contain some information about the author(s) and about individuals and groups with whom he or they are in contact. A June 1, 2016 post suggested that the author may be an ISIS fighter in Syria. A May 26 post states that the author spent some time in Paris and was in contact with members of the French non-profit salafi organization "Ana Muslim": "In France I saw a mosque of the [jihadi] creed closed down three times in a row. I say [that the mosque was] 'of the [right] creed' because they spoke only of the exclusive worship of Allah and explained things well, though without mentioning jihad etc. Even the brothers of 'Ana Muslim' were there." AT has also shared several videos published by the Ana Muslim organization. This Paris-based non-profit was the subject of a March 2014 MEMRI report. In June 2014 the French government froze its assets and the assets of two of its leaders. It has since been dissolved on charges of supporting terrorism.
II. AT's Affiliation And Loyalties
While AT is openly pro-ISIS, it is not a typical pro-ISIS supporter group; members of those groups tend to have a very strict sectarian approach, rejecting conversation or any other contact with other Salafi-jihadis who do not share their doctrine. AT media, however, shares and conducts conversations with Al-Qaeda supporters, and favors a more open approach to members of different jihadi groups. Although it is critical of other jihadis, and espouses the ISIS doctrine of declaring other Muslims as apostates, AT shows unusual restraint in any discussion of other Muslims. This makes the group all the more attractive, and its core message all the more powerful, to jihadis in the West who are concerned about the internal strife between the Al-Qaeda and ISIS camps.
"We will never give up. Victory or martyrdom – Omar Al-Mokhtar [Figurehead of the jihad against Italian colonization of Libya]" The accompanying message reads: "Victory or martyrdom, God willing, may God grant it to us."
III. Operational Content
AT serves several purposes, constituting an online meeting point for a community of jihadi supporters sharing religious viewpoints, carrying out organizing and fundraising in support of that community and its common objectives, and sharing and spreading operational security information.
Practical Advice For Joining ISIS, Migrating To ISIS Territories And/Or Carrying Out Attacks In West
AT also offered practical operational advice, most notably information about physical travel to ISIS territory in Syria. In several posts, the entity incited followers to take immediate steps to join the jihad in Syria, and gave details on the process and the situation on the border.
A May 12 post about the Syria-Turkey border stated: "The Syria-Turkey border will become like the border that separates Mexico from America – that is, ultra-secured, but there will always be ways to go through. And the sooner you leave the better for you." Offering regular updates on the situation at the border, it wrote on May 24, for instance: "Read this, all those that doubt. Brothers and sisters, for those who ask if Syria is still accessible, the answer is yes. [...] I will give you a number: 15 is more or less the number of French people who enter Syria each month and it is not diminishing. [...] When brothers succeed in going back and forth into Syria and then attack the West while being actively tracked by intelligence services, who do you think blinded the enemy? Allah did !!!"
On May 15, AT encouraged followers in Europe to depart for ISIS territory, explaining that doing so was easy and breaking down for them the cost of such a project: "Flee before it is too late. A month of work at minimum wage [will give you] more than enough to cross the border. Allah has made the trip easy for you. Paris-Istanbul: €100 (outside of holiday periods) (same for a departure from other big cities)/ Istanbul-Gaziantep (Bus €50)/ Istanbul-Gaziantep (12 hour drive, €120 gas)/ Hotel (€45/day)/ (Rent a car €30 /day). In total the trip for one person does not even exceed €500. With one month of saving you are in Syria, God permitting, but you, you are asleep. Wake up! Soon it will be too late."
On May 24, AT elaborated on the price of the immigration process, of smugglers, and of hotels in Turkey: "It all depends on where you are leaving from, when and how long the trip will be. Just to give you an idea of prices, [it costs] €500 for a passage in one day, otherwise it's a lot more if you need to go to a hotel, switch hotels so as not to be discovered etc. For a week over there [in Turkey], you should count [on having] €2,000 to be comfortable. [...] But in general, if you are well prepared and find brothers who know some smugglers, in 3 days you should be able to get through, God willing." It added: "The Syria-Turkey border is like Swiss cheese."
On May 22, AT further urged followers to act quickly, preferably during vacation season: "Those who want to immigrate, it is the best time during the vacation season (increase of tourists), and during the blessed month of Ramadan, while the devils are chained."
Message urging followers to immigrate: "[On a TV show] they cross a whole country with €1, and you, with a salary, you still think you can't immigrate?"
On May 31, AT offered more details about the immigration process, with a motivational speech to those who are hesitating. It also hinted that if the immigration attempt fails, there are other ways of joining the jihad, such as carrying out attacks in the West: "We can make certain things easier for you, but know that we are not a travel agency. That is to say that even we do not know where the smugglers are located, they have nothing to do with us, they do not work [directly] for ISIS. Some brothers can find one for you, but it's very difficult. [...] My sister, my brother, take your luggage, get ready, pray, and take off or take the boat as you wish, place your trust in Allah with the intention to please Him, to die for His cause. You can be certain that Allah will put a smuggler in your path – if you cannot find him, he will find you. [...] Know that the believers in Syria are facing trials and tribulations, but so are you. Do you have classes on the exclusive worship of Allah [where you live]? Do you hear the call to prayer outside? Can you walk around wearing the niqab? Can you eat halal without fear? It is a test for you, and for every test there is freedom and reward. Perhaps Allah has even chosen you to carry out a mission in the land of unbelief, but you do not yet know it."
On June 3, AT posted the story of a French fighter's journey to join ISIS, which pointed up the failures of security services around the world in preventing this particular fighter from joining the fight in Syria: "I was talking to a brother not long ago, and he told me he had left with €8000 originally to reach Syria, and he arrived in Turkey with nothing at all. When I asked him why, this was his answer: 'They [the French authorities] came to take my passport; I said I'd left it with my girlfriend and I'd bring it to them in two hours. So I left immediately for Algeria via Germany. To make a long story short, they blocked my way there, but with prayers I made it to Algeria. I stayed there for a few months, then I went to Malaysia to get a [fake] passport, but they only had Tunisian [passports] available, I didn't want that, but I went to Dubai for two days to test it out. In short, [I had] no problem, so I went to Turkey and there they turned me back to Dubai. In Dubai, I had issues with the police, etc. I managed to negotiate to be sent back to Malaysia, not to France, for $600, so I went back to Malaysia. I got in touch with a smuggler [to take me] from Iran to Turkey, so I went to Iran and again I was turned back, $600 and back to Malaysia. There, I obtained a Bulgarian passport and I was able to get through, Allah be praised.'"
On June 5, AT forwarded a message from an anonymous ISIS member advising those who are preparing to immigrate to ISIS-controlled lands: "Brother, I am contacting you to forward this information to those who want to leave [and join ISIS] and have no money. [...] They should try to sell a maximum of stuff like on [websites] 'Le Bon coin' or eBay, and get their relatives to share [their 'for sale' ads] on Facebook etc. and to sell stuff such as PlayStations, phones, TVs etc."
On several separate occasions, AT mentioned forged identity papers, and sought to contact followers who could provide assistance in obtaining them. On June 12 it wrote: "Anyone who knows brothers who forge papers, private message @anonyme ['anonymous']." On June 15, it noted the possibilities offered by Deep Web or Dark Web fake identity procurement, while warning of the risks involved: "For those who need fake papers, there is the Deep Web. It remains very risky."
Indications Of AT Influence On Larossi Abballa
In the video he filmed at the scene of his June 12, 2016 killing of a police officer and his partner in Magnanville, near Paris, which he streamed live via Facebook and which was later distributed by ISIS media, Larossi Abballa made several statements and arguments about the motivations behind his act. Some of his statements appeared to have been lifted directly from some of the dozens of messages posted by AT in the weeks preceding the attack, including calls for Muslims to carry out such attacks in the West. One of the messages suggested that AT might have had prior knowledge of Abballa's attack.
Larossi Abballa in his video message.
One indication of a connection is Abballa's statement in the video about the obligation of jihad even in the absence of instructions by an imam, which is nearly identical to a March 18 post on the AT website that was reposted on its Telegram channel on May 22. The text and references are unusual, and if it indeed originated with AT, it would indicate that Abballa was following AT's publications.
Left: The text posted by AT. Right: Transcript of Abballa's video message. The two are nearly identical.
Another suggestive element is the threats made by Abballa in this video against two French rappers, Booba and Kaaris. On May 19, three weeks before the attack, AT shared the following post about rappers in the US and France: "Brothers and sisters who listen to music: about American rappers, see [link to 10 part YouTube video claiming that Rap is a satanic conspiracy]; about French rappers, see [link to video by a French Muslim claiming French rap musicians are agents of Satan]. You will quickly understand that music is not just entertainment. No. Music is a religion. The singers = preachers. You = the congregation. Their songs = their scripture. It's simply Satan that you follow. Two things cannot live together in one heart: love for the Quran and the love for music. It's either one or the other. The earthly world or the afterlife. Heaven or Hell." The next message by AT was a link to a video published in 2013 by Mysa, a member of a group of salafi online media activists called Ciné Deen. The video, titled "The Blasphemy and Incantations of Rappers Kaaris and Booba," calls these two singers "satanic" and warns against their music. In his video Abballa echoed these sentiments, saying: "I also call you to target rappers, because they are allies of Satan. Kaaris mocked his Lord. Stick a bullet between his eyes, as well as Booba['s]. Kill them at one of their concerts. They lead people astray and they deserve to be sent to Hell. Oh you rappers, repent sincerely, for we will come to get you, just as I have come to get this police officer in his home."
AT post sharing a video that describes French rappers Kaaris and Booba as "allies of Satan". Terrorist Larossi Abballa mentioned the same two rappers in his post-attack message.
On the day of the Abballa attack, AT published a text about lone wolf attackers who pledge loyalty to ISIS's leader, stressing that their pledge is almost certain to be accepted by ISIS and that they are true soldiers of the Caliphate: "The media are idiots. They are saying that someone who attacks and pledges allegiance is not necessarily a soldier of the Caliphate. But if you associate [yourself] with ISIS you are a lone wolf. If you attack the West and you pledge allegiance, you can be 99% sure that the Caliph will accept your pledge. As [ISIS spokesman] 'Adnani said, an operation in the land of unbelief is more valuable in their eyes than a martyrdom mission in the land of Islam. Allah said: 'And fight the unbelievers that are close to your homes.'" Abballa's video message was first and foremost a pledge of allegiance to Abu Bakr Al-Baghdadi.
On the morning following the attack, AT posted a message praising Abballa and hinting that the author(s) of the message knew him before the attack and even had knowledge of his intentions: "All we can tell you about this attack is that the brother before his attack asked that his attack be claimed [by ISIS], and this has been done, and now pray for him, for he has been truthful. He spoke and then he acted... PS: no further information will be given."
Raising Funds For ISIS Operatives In France
AT has launched several small campaigns to fund initiatives within its community of followers, aimed both at helping people in need and financing travels for individuals desiring to join the Islamic State; they may also have been used to finance terror attacks in the West. These campaigns have used Lepotcommun.fr, Leetchi.com, and Cotizup.com for fundraising, and have also used PayPal for transactions. All messages concerning fundraising instruct followers to conduct further communications via private message.
Message linking to Lepotcommun.fr for donating "for the sake of Allah."
From May through June, there were over 25 messages mentioning the term "money pot" and calling on followers to donate, such as, on May 24: "For those who want to anonymously help a brother financially, send a private message [...] If brothers and sisters are in need of help, for the sake of Allah, for future immigration, send a private message." On May 25, it posted: "Brothers and sisters who want to give for the sake of Allah to brothers and sisters in need and anonymously, send a private message."
On May 29, AT offers some explanation on how donated funds are distributed: "The pot is for sisters and brothers in need. Basically, you donate and we distribute [the funds] fairly to those in need. Example of help: debts, evictions, immigration, books, prisoners, etc. The online transaction is anonymous. For those who do not want [to donate] online, there are other ways. [...] All of those who have requested financial aid from me, private message me."
On June 1, AT posted a long message explaining how money is distributed among its followers, and who is entitled to receive funds: "There are two categories of applicants. There are those who really don't have anything, who cannot work, for example sisters who wear the head cover or don't have their papers anymore, etc. And [then] there are those who stay in their beds [and say] 'Brother, I need €1000 to leave' [...] My honorable brother, I know you want to leave, to flee this land, that you seek the fastest way to leave, but [we] cannot help everyone, so [we] set priorities. [...] And since you are in the lands of unbelief, these are the priorities, since charity in some cases is distributed by the ruler, which is not possible in the land of unbelief: 1. The destitute. 2. Poor people/ prisoners/ sisters 3. Those deeply in debt 4. Travelers in need. [...] I help; I do my best to help [my] brothers and sisters in Allah. We help as much as we can, but know that we will not be able to help everyone. There are over 30 people who have asked for financial help, for a minimum of €500. 500x30 = 15,000. [Here] in Syria we do not have millions. [We here in Syria] receive €100 per month, and still we get help from brothers all over. So if you don't get anything, it's normal. I not give by [personal] preference but according to each situation. I do not give only for the purpose of immigrating but for everything."
Posted announcements of alleged money transfers made by AT.
On June 17, AT noted: "Sisters and brothers who are in need of financial aid, do not forget to make your request. By the grace of Allah, all the requested sums of money were provided, from the largest to the smallest (witnesses are available). [...] By Allah, I have never taken more than three days to find the money..."
On several occasions, AT also mentioned the possibility of direct cash transfers, possibly from hand to hand, writing, on June 18: "If brothers and sisters want to help out in cash, PM [private message] me." On June 19, it wrote: "For brothers and sisters want to help the Muslim people in cash, PM me."
AT also provided religious justification for stealing and taking loans for the purpose of jihad or hijra (migration), encouraging followers to steal or borrow from banks, even at interest, if it is for the sole purpose of migrating or waging jihad. This money, it said, should be considered licit war booty from a shari'a perspective: "To the brothers and sisters who ask if taking a loan is considered illicit or licit: To start with, you must know that you are not in a land of Islam, you are in a land of war. [...] It is licit for you to take money for your hijra or for jihad, taking a loan in the land of unbelief to make hijra is not considered usury, quite the opposite." It then posted a fatwa by the late Al-Qaeda Yemeni-American sheikh Anwar Al-Awlaki which gives further religious justification to this position.
Community Meeting Point
AT operates as an online meeting hub for those espousing ISIS ideology. It shares offers and requests from readers and acts as intermediary by operating private messaging accounts that enable third parties to contact each other. A Telegram account under the screen name @anonyme is used for private communications. Many calls to contact this account suggest that much of AT's activity takes place on @anonyme.
On May 14, AT warned followers that "the brother Abou Ines Bouyhoumad appears to have been arrested in these past few days, and that it isn't him on his Facebook account, so be careful what you tell him when you talk to him, because it isn't him."
On June 11, AT posted a message calling for prayers "for our brothers in hardship who are currently on their way to the blessed lands [of Syria]." Several messages suggest that AT is in constant contact with individuals who are traveling to join ISIS in Syria, and that it provides assistance in the process. On June 8, the account wrote: "Brothers and sisters are immigrating soon, pray for them!" and two days later, on June 10, it asked for contacts in ISIS territories: "Brothers in Syria, private message @anonyme. [...] Pray for the brothers on their way towards the lands of the Caliphate."
Messages on the AT Telegram channel, calling for followers to contact it to organize their immigration to ISIS lands and to pray for those already en route.
The following two messages, from June 12 and 13, suggest that AT is actively engaged in assisting members of its community of followers to immigrate to join ISIS: "If you have already taken the boat, private message @anonyme [...] Brothers who have a car, private message @anonyme."
Ansar At-Tawhid Facebook page.
In several instances, AT shared messages or relayed requests from followers who wanted to get together in real life, who sought housing or a mosque, and so on. On June 2, it wrote: "A brother in Lyon is looking for brothers of the [jihadi] creed. Available brothers contact @anonyme." On June 6, it wrote that there is a mosque near Lyon, France "which doesn’t call for unbelief," i.e. follows the correct doctrine, and forwarded the address and information to its followers. In another instance, on June 22, it relayed the message, "A brother asks if someone among the brothers can host him in the Paris area."
On June 16 and 17, AT posted a message suggesting that it was involved directly in organizing several new ISIS members' travel to ISIS territory: "Brothers and sisters who want to leave and already have what they need (minimum €1000) or who can obtain €1000 before August (it's preferable that you have a driver's license, but if not come anyway). I say again, to brother and sisters who have the money I will explain in private message @anonyme [...] Sister or sisters who have a [driver's] license... [and can] flee, [contact me on] @anonyme."
On June 18, AT forwarded a message from another account asking for help in organizing car trips in France to the Swiss and Italian borders: "Message from a brother. Brother, do you know anyone with a driver's license and a car to do the following trip: Paris to North-West; North-West to Paris; Paris to Lyon. And from Lyon, a brother that can go by car to the Swiss or Italian border. Private message @anonyme."
Advice For Communications Security
AT offers comprehensive communications security (ComSec) advice to its followers on how to operate online so as to avoid detection by the authorities. It disseminated several tutorials and guides on the use of Android and Apple smartphones, for instance on how to "jailbreak" a phone and which apps to use and which to avoid. Its aim is to show followers how to achieve operational security, enabling them to anonymously surf the web on traceless access points, including freely accessing desired content; to communicate using secure two-way messaging; to engage in safe practices to avoid detection and suspicion, and so on. The information provided is also valuable for operational purposes, and can easily be used in coordinating terror attacks and other terror related activity.
Image shared by AT that was originally posted by official ISIS media explaining how use encryption and TOR for secure communications.
On several occasions, AT has strongly emphasized basic principles of operational security (OpSec) in order to avoid notice by authorities. On June 5, it warned followers: "Brothers and sisters, if you have a goal in mind, keep it between you and Allah, because He is your best guarantee. Enough for you to talk a bit too much, and your goal will be delayed because of someone, even someone in your family, etc." Then, on June 11, it warned followers not to travel by air under certain circumstances: "For brothers and sisters who are being tracked – Do not travel by air if you ever had the smallest problem with the authorities related to Islam, do not take a plane. But if you are totally clean, no problem, but do not look suspicious.
On June 23, AT shared more tutorials pertaining to secure communications: "I will give you tutorials on [information] security on and on, until you become [ghost emoticons]."
*S. Benjamin is a Research Fellow at MEMRI.
 See MEMRI JTTM report ISIS Spokesman Al-'Adnani Urges 'Caliphate Soldiers,' ISIS Supporters To Target Civilians In Europe, U.S. During Ramadan, May 21, 2016.
 See MEMRI JTTM report French 'Gatekeepers' Disseminate Islamic State (ISIS) Information On Social Media, December 31, 2014.
 See MEMRI JTTM Inquiry & Analysis Series No. 1229 Understanding The ISIS Media Apparatus: Distribution Networks And Practices, February 19, 2016.
 See MEMRI report in French, Violente campagne anti-démocratique sur le site de l’Association loi de 1901 Ana Muslim, March 19, 2014.
 For more information on the Dark Web, see MEMRI JTTM report The 'Dark Web' And Jihad: A Preliminary Review Of Jihadis' Perspective On The Underside Of The World Wide Web, May 21, 2014.
 See MEMRI's full transcript and translation of the message, ISIS News Agency Releases Video Of Larossi Abballa, Who Killed Two Police Officers In Paris Suburb, June 14, 2016.
 For a full transcript of the original statement in French, see MEMRI France report Déclaration de Larossi Abballa, suite à l’assassinat de deux officiers de police dans les Yvelines, commis au nom de l’Etat islamique, June 15, 2016.
 This presumably refers to women who wear the full veil (niqab); French law bans the wearing of the niqab in public.
 Souleiman Abou Ines Bouyhoumad appears to be a resident of Belgium. Facebook.com/profile.php?id=100009225167074.
 See MEMRI report French ISIS Media Operative Advises On Secure Use Of iPhone, Android Phone, June 20, 2016.