Hiding in Plain Sight
How Online Archives Are Used to Spread Extremist Content
Internet archiving services are powerful open source intelligence (OSINT) tools that can be used like a time machine to look back in time for information that may be crucial to an online investigation. But, just as they can provide a glimpse into the past, these services have also been used to ensure that extremist content persists into the future.
Web archives like the Wayback Machine, Google Caches, and Archive.Today take and store snapshots of web pages to create digital records of online content over time. These services enable OSINT researchers to review historical records of web pages, even if they have since been altered or removed.
However, because archiving services create reviewable and persistent records of online content, various threat actors use them to create records of illicit and extremist content that are likely to be removed by the platforms where the content was originally posted.
Frequently, extremist content that is posted to social media platforms is removed (often due to terms of service violations), so posters will disseminate links to archives of original content as a way of continuing to promote the content.
Most online archiving services include web page information, such as HTML and JavaScript content, images, and associated metadata. This allows users to interact with the archive as they would an actual web page, as well as verify the archive’s authenticity. As such, archiving services are often superior to basic screenshot tools and are much more difficult to fake or alter.
Violent extremist organizations like the IS-affiliated Electronic Horizons Foundation often share propaganda and resources via various anonymous file-sharing sites, which are similar to Dropbox or Google Drive. Once this content has been posted to a file-sharing site, the organization creates an archive of what they have shared using Archive.Today’s manual URL capture tool. This process allows threat actors to share content through a file-sharing site and create a second anonymous copy of the information with the archiving service, which remains available even if the original page is taken down.
In addition to circumventing platform moderators, online archives also allow users to control the technical and behavioral information they communicate about themselves to website administrators. By archiving a web page and sharing the archive instead of the live page, users can share content without needing to interact directly with a site. Viewing an archive also prevents a user from inadvertently sharing their IP address, DNS calls, or machine type directly with any analytic tools employed by site operators. It doesn’t, however, prevent administrators of Wayback Machine or Archive.Today from seeing this information.
To learn how to use other OSINT tools—or to learn how those tools may be used by threat actors—please register for one of Ntrepid Academy’s OSINT webinars here.
