#OpParis: Anonymous pursuit of Isis sees jihadists retreat to the dark web

Islamic State (Isis) has turned to the dark web to spread news and propaganda in an apparent attempt to protect the identities of the group's supporters and safeguard its content from hacktivists. The move comes after hundreds of websites associated with IS were taken down as part of the Operation Paris (OpParis) campaign launched by Anonymous in the wake of the Paris attacks last week.

The IS website on the dark web is only accessible using the Tor browser, specialist software that uses a system known as onion routing to disguise a user's location. Links to the site, which is a mirror of a site that can be found on the surface web, have been shared through IS's propaganda network on social media. IBTimes UK discovered links to the site on several of the group's channels on the encrypted messaging app Telegram.

According to security expert Scot Terban, the creators of the site made some "rookie stupid" mistakes when setting it up that leave it vulnerable to attacks. In a blog post analysing data pulled from the site, Terban found that the site was hosted by Choopa LLC on servers located in Amsterdam.

What is the dark web?

The dark web is a section of the internet that requires specialist software tools to access, such as the Tor browser. Originally designed to protect privacy, it is also associated with illicit activities.

It is often confused with the deep web, which is a vast section of the surface internet not indexed by search engines such as Google. The deep web comprises around 95% of the internet.

"The system behind this data feed (could be) vulnerable to some attacks," Terban said. "All this data leads me to believe that the end user can be tracked down easily enough by authorities but I also think that without that, I can still track down who set this up without having to attack an onion site like the FBI."

Some of the site's contents, including videos and pictures, are embedded from the surface web, meaning visitors clicking on the content will expose their identities. It also means that the site's domain can be viewed on the surface web using simple tools like Google Translate.

IS' increased use of encrypted services such as Tor and Telegram comes as hacktivists from the amorphous collective Anonymous intensify their cyberwar campaign against the terrorist organisation. Telegram in particular has provided a platform that has allowed IS to communicate, disseminate propaganda and recruit potential jihadists.

The group operates across more than 50 channels on the messaging app and have attracted tens of thousands of followers without any of them being shut down, either by authorities or the app's creator. Telegram is yet to respond to a request for comment from IBTimes UK, however the chat app's founder has previously stated his position on the importance to protect privacy, regardless of how the service might be being used.

Privacy advocates have criticised US and European officials using the Paris attacks as an opportunity to reignite the debate surrounding encryption technologies and online surveillance, despite lack of proof that secure communication methods were used to coordinate the attacks.

"We were shocked and saddened to learn of the attacks in Paris and Beirut," Electronic Frontier Foundation (EFF) executive director Cindy Cohn wrote in a statement. "But these heinous attacks must not be used to justify further erosion of our security, civil liberties or privacy."