Terrorism is considered as one of the current biggest threats to security in the European Union. Since the 9/11 attacks, and then all the terrorist actions that happened across Europe, Member States had to take terrorism and extremist violences very seriously. They implemented various policies, and created institutions or agencies to combat this type of crime, but the results are mixed. Indeed, according to the last Europol Trend report, in 2019, a total of 119 completed, failed or foiled attacks were reported on EU territory. National authorities mainly succeeded in foiling attacks perpetrated by jihadist or right wing groups (more than the double of completed and failed attacks). But left wing, anarchist, ethno-nationalist and separatist attacks were completed in their vast majority.[1] As this type of groups operates in few States with specific territory issues,[2] they will be excluded from the analysis presented in this article.

Thus, States do pretty well to stop individuals suspected of terrorist offences : they reported 1004 arrests in 2019.[3] However, arresting and prosecuting suspects is not enough to fight terrorism, it needs to find and understand the roots of radicalisation. In terms of public policies, prevention measures could mean studying the past of terrorists to compare social and economical environment, education, place of living etc… Concerning counterterrorism means, it starts with combating propaganda and radicalisation on social media. Terrorist attacks by themselves are often anchored in an area, a territory or a state. But all the upstream logistics, such as the recruitment, the financing or the organisation of operations, usually possesses a transnational character. In this case, it is sometimes hard to know which State has the responsibility or the competence to prevent these acts. That is why the role of the European Union in counterterrorism should be preponderant.

EU implication in counterterrorism 

The current European common legal framework relies mainly on the EU Directive 2017/541, which defines terrorist offenses as:

“certain intentional acts which, given their nature or context, may seriously damage a country or an international organisation when committed with the aim of : seriously intimidating a population; unduly compelling a government or international organisation to perform or abstain from performing any act; or seriously destabilising or destroying the fundamental political, constitutional, economic or social structures of a country or an international organisation.”[4]

This directive gives common and shared directions, but legislation on terrorism varies from a Member State to another. Moreover, there is no universal definition of terrorism, as some act of violence in one country could be regarded as necessary and legitimate in another. Most definitions share some key words, such as violence, creating fear, targeting of non combatants, loss of civilian lives.[5] Terrorism is generally considered as a set of violent acts employed mainly by extremists.[6] In its articles 5 and 6, the Directive 2017/541 also definies public incitement to commit a terrorist act and recruitment for the purpose of terrorism as offences. These infractions are the main terrorist activities related to social media.

          Why is that important to insist on online terrorist activities? The last decade witnessed a sharp increase in the use of social media in the world. This type of media provides social connections on a global scale, as they gather billions of users. Indeed, Facebook reported 2.45 billion monthly active users in 2019, Twitter 330 million and Instagram 1 billion.[7] These platforms allow users to share a large variety of content, and terrorist groups are very effective in their use. For instance, they released recordings of executions, advertisement for recruitment, and even some recent attacks have been livestreamed in order to get the most views and publicity possible.[8] The misuse of online platforms will be detailed and discussed further.

          Because of the increasing threat of the use of social media by terrorist groups, the European Commission has made a priority of fighting terrorist content online in the 2015 European Agenda on Security. As “citizens and Member States expect the EU’s support in fighting terrorism and radicalisation and facilitating coordination and cooperation between relevant authorities”,[9] the Commission announced the launch of the European Counter-Terrorism Center (ECTC), under Europol agency, to gather anti-terrorism law enforcement capabilities, and maximise the use of already existing structures. It also decided to put the future Internet Referral Unit (EU IRU) under ECTC command. Finally, it presented the EU-level Forum, which will bring “IT companies together with law enforcement authorities and civil society, to deploy the best tools to counter terrorist propaganda on the internet and in social media.”[10]

With the synopsis of the Agenda’s part about preventing radicalisation, one can already notice one of the biggest limits of EU counter-terrorism policy, which is the multiplication of agencies, institutions, platforms, forums etc… Because here are presented some of the Commission initiatives, but other EU institutions, such as the Council of the European Union, also engaged some. Of course they want to achieve similar objectives, and they try to make these instruments work together, but it is usually hard to understand their different competences and the hierarchisation between them (if there is).[11] As the aim of this article is not to detail each agency / institution, a table resuming their role can be found below.

Furthermore, European measures and mechanisms seem often elaborated in great haste, they lack uniformity and coherence because they are crisis-driven.[12] Indeed, they quickly answered major terrorist attacks, so they appear to rely on emotional needs to ward off fear, rather than on research about the roots of such phenomena. However, a lot is done trying to tackle terrorism online.

Terrorist abuse of the social media and counter-terrorism response

Terrorist and extremist groups gain multiple benefits from online tools and platforms. They can very easily spread propaganda contents, such as videos, manifestos or statements encouraging people to use violence. The Internet also facilitates recruitments, and all communication related activities. When acts are perpetrated, social networks allow terrorist and extremist groups to draw attention from all over the world, hence to get efficient publicity.[13] Online tools also ease financing and the perpetration of other criminal activities.    

The first violent actions that brought terrorism on television was the hostage taking during the 1972 Munich Olympics. Bin Laden used to give interviews on TV, whereas Abu Musab al Zarqawi, the founder of Al Qaeda in Iraq (now called ISIS), published about the group’s attacks by spreading manifestos, pictures and videos via text messages, emails or on social media. After his death, IS continued to, and even prospered in using such networks for years.[14] Jihadist groups are generally quite efficient because they use the same proven practices and methods as advertisers. Their highly organised social media campaigns demonstrate their understanding of such networks’ functioning.[15] As many organisations and companies, terror groups use social media to advertise and get customer loyalty. They own thousands of user accounts on Facebook, or Twitter, monitored by groups’ members or sympathisers. They support their ideology and they attempt to attract people in joining or supporting it as well. Furthermore, by broadcasting videos of bombing and executions, among other contents, they normalise and glorify violence.[16] Right wing extremists are less organised, but they were early users of NICTs (New Information and Communication Technologies).

One of the main measures possible to fight propaganda online is the removal of the content. The problem is the amount of data to manage it represents. According to Europol’s website, the EU IRU has assessed in total 42066 pieces of content since it was set up, which triggered 40714 decisions for referral across over 80 platforms in more than 10 languages. Once European agencies, such as the IRU, send decisions for referrals to hosting service providers,[17] they are supposed to remove them. Referral represents only a small portion of the removed content. Some companies did not wait for European instruments to be implemented and took proactive measures. For instance, Twitter suspended over 1.2 million accounts between August 2015 and December 2017, and Facebook acted on 1.9 million pieces of content in the first quarter of 2018.[18] It shows that, when managing the issue of terrorism on social media, cooperation between Member states is not enough. The consent, and even more the help from private companies owning the platforms is necessary.[19] Indeed, even if they are legally binding by the law of the State in which they are established, they decide if a content is appropriate or not, according to their general conditions.

It took some time for some of these platforms to act upon terrorist content, and they are still under some criticism. On the one hand, in terms of absolute numbers, it cannot be denied their efficiency, especially compared to European instruments. For example, in 2016, Twitter brought down 124 000 user accounts linked to ISIL DAESH or found spreading propaganda.[20] However, it does not take into account their means, often much more extensive than EU agencies’ ones. On the other hand, right wing extremism continued to enjoy much greater freedom than jihadist groups to act on major social media platforms, which remain important vectors for their expansion. They use a large variety of platforms including websites, online discussion forums and pseudo-news sites, to disseminate their ideology. Some constitute online safe bases for right-wing extremist movements and are even used to design campaigns. These campaigns are then launched onto mainstream platforms in order to insert right-wing extremist narratives into popular culture.[21] Also, new jihadist accounts are quickly created and continuously posting quality video advertisement and pictures convincing jihad is a worthy cause.

According to a EU Parliament study on terrorist content online, voluntary measures adopted by hosting service providers are not enough to counter the continuous flow of terrorist content. Furthermore, they have to face a complex legal framework at Member State level, which can be different from a State to another. In order to overcome the multifaceted security challenges such content represent, the Commission adopted a proposal for a regulation preventing the dissemination of terrorist content online in September 2018, first-read by the Parliament in April 2019. The proposal aims at enhancing such counter-terrorism actions with mandatory legal frameworks applicable to all industry stakeholders. It contains stricter requirements of removal, both in terms of terrorist content definition and deadline, but also the obligation for States to create effective judicial remedies and complaint mechanisms for providers.[22] Apart from  the efficiency of the proposal, the project  raised multiple concerns about free speech rights, and the eternal debate between protection of individual liberties and (trans)national security.

          Propaganda’s purpose is to radicalise and brainwash as many people as possible, in order to recruit them as foreign fighters. The latter are sent to training camps, and some are asked to come back to their country, to radicalize more people or carry out terrorist attacks. Some social media platforms furnish encrypted messaging applications, which are one of the safest ways for terrorist groups to communicate. Indeed, it is really hard for law enforcement authorities to find and decrypt such conversation. These applications are useful to exchange delicate information between recruiters and foreign fighters, such as brochures detailing the journey to ISIL/DAESH territory, logistics, or even instructions for attackers, about the supply of ammunition and explosives, and so on. Finally, social media allow extremist groups to get attention from the world. Before the Internet, they mainly relied on television, but they were not in charge of the discourse. After their violent actions, they want their intentions to be transmitted to a wide audience, which can be done through social media, with full control over their message.[23]

Consequences of the abuse IRL[24]

Online terrorism leads to various consequences for society, States, populations, and of course radicalised individuals. In recent years, some attacks have been perpetrated with an online component, namely livestreamed terror attacks, such as the Christchurch attack in New Zealand (2019), or the Halle attack in Germany (2019). These ones were Lone Actor Extremist Events, i.e. terrorist attacks carried out by individuals acting alone. Such events have been a growing source of concern, notably in Western countries because even if they remain rare occurrences, they constitute a particular challenge for law enforcement and intelligence agencies.

Both jihadist and right wing extremists incite individuals to perpetrate acts autonomously. They based their rhetoric on the concept of leaderless resistance, according to which violent acts perpetrated by individuals serve to instigate the anticipated “[race or religion] war”. These perpetrators are then celebrated by their transnational community as saints or martyrs, which can incite others to act.[25] As a matter of fact, lone operators, or “lone wolves”, are the most dangerous extremists, as group activities, involving multiple suspects, are easier to thwart than those of someone alone and self-radicalised. Some studies have been conducted on this subject to understand better such phenomenon, such as the PRIME project,[26] partly financed by the European union. It was led by Dr. Noemie Bouhana, and the following information about lone actors is based on the PRIME work. That being said, it should be noted that lone actors are not socially isolated, since most of them appeared to have contacts with clearly radical, extremist, or terrorist individuals. They found in online communities both ideological material and violent role models as sources of encouragement or justification for the use of violence. They draw inspiration from a wider radical environment of which they were part, but they are alone when they decide to carry out terrorist actions, and they are mainly alone in the preparation.[27] Their unpredictability makes them hard to target and identify for law enforcement authorities and European agencies.

As said before, the use of social media and various online platforms to spread terrorist content, glorify and give incentive to commit terrorist acts, is defined as a terrorist offence by the Directive 2017/541, and therefore in national legislations. Once national authorities, supported by Europol and Eurojust, arrest suspects, they are prosecuted and then, sometimes, convicted or acquitted. In this specific field, Eurojust is particularly useful, as it helps law enforcement and judicial departments to undertake investigations and build solid prosecution cases. Because of the cross-border character of terrorist offences, it is very important to identify possible connections with other investigations, in order to avoid conflicts of jurisdiction or parallel proceedings, which could lead to incomplete procedure, hence acquittals. Specific online related offences have been addressed by national courts, and these cases are reported by Europol and Eurojust. It should be noted that, in 2019, for example, offenders have been sentenced to prison, for a ranging from one year to six years and six months, for public incitement to provocation and glorification of terrorism.[28]

The European Union engaged various measures to fight terrorism. Among others, it implemented specific instruments to thwart online terrorist propaganda content, and its consequences. However, European counter-terrorism strategy seems to be confined to its role of supervising cooperation between Member States. The involvement of Europol and Eurojust in tackling terrorism online is useful and even necessary, but they lack competences and means to be as efficent as national authorities and private companies owning the targetted platforms.

[1] Europol, European Union Terrorism Situation and Trend report (TE-SAT) 2020, pp. 9-32.

Available online :

[2] It should be noted that these specific attacks were perpetrated only in Italy, Spain, Greece and the UK, whereas jihasdist groups are widespread all over Europe.

[3] Idem note 1.

[4] Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA, article 3.

[5] Haitham Abdelsamad, “Terrorism and counterterrorism in the EU”, DOC Research Institute, 22 Aug, 2018, pp. 1-15. Available online :

[6] Idem note 1.

[7] According to the website Agence des médias sociaux, in its articles “Facebook en chiffres édition 2020”, 10 January 2020; “Twitter en chiffres édition 2020”, 9 January 2020; and “Instagram en chiffres édition 2020”, 8 January 2020. [Consulted on the 5th of October 2020, on ]

[8] Erdal OZKAYA, “The Use of Social Media for Terrorism”, Defence Against Terrorism Review, Vol. 9, 2017, pp. 48-49.

[9] European Commission, The European Agenda on Security, 28 April, 2015, p.13. Available online :

[10] Idem

[11] Haitham Abdelsamad, “Terrorism and counterterrorism in the EU”, DOC Research Institute, 22 Aug, 2018, pp. 24-27.

[12] Idem

[13] Erdal OZKAYA, “The Use of Social Media for Terrorism”, Defence Against Terrorism Review, Vol. 9, 2017, pp. 49-53.

[14] Max Boot, “Why social media and terrorism make a perfect fit”, The Washington Post, March 16, 2019.

[15] J.M. Berger, “The Evolution of Terrorist Propaganda : The Paris Attack and Social Media”, Brookings, January 27, 2015.

[16] Erdal OZKAYA, “The Use of Social Media for Terrorism”, Defence Against Terrorism Review, Vol. 9, 2017, pp. 49-53.

[17] “A hosting service provider (HSP) is a type of IT service provider that provisions and serves a pool of remote, Internet-based IT resources to individuals and organizations for hosting their websites.”, definition by Technopedia :

[18] European Parliament Research Service (François Théron), “Terrorist content online – Tackling online terrorist propaganda”, Briefing – EU Legislation in Progress, March 2020, p.2.

Available online:

[19] Europol, Internet Organised Crime Threat Assessment (IOCTA) 2019, p. 11. Available online :

[20] Idem note 16.

[21] Europol, European Union Terrorism Situation and Trend report (TE-SAT) 2020, pp. 22-24.

[22] European Parliament Research Service (François Théron), “Terrorist content online – Tackling online terrorist propaganda”, Briefing – EU Legislation in Progress, March 2020, pp. 1-5.

[23] Erdal OZKAYA, “The Use of Social Media for Terrorism”, Defence Against Terrorism Review, Vol. 9, 2017, pp. 49-53.

[24] Abbreviation for « In Real Life. » Often used in internet chat rooms to let people you are talking about something in the real world and not in the internet world.

[25] Europol, European Union Terrorism Situation and Trend report (TE-SAT) 2020, pp. 19-24.

[26] To learn more about the PRIME project and its results and reports, a link is available here :

[27] Schuurman, B.W., Bakker, E., Gill, P. and N. Bouhana, « Lone Actor Terrorist Attack Planning and Preparation: A Data-Driven Analysis. » Journal of Forensic Sciences, Vol. 63, Issue 4, July 2018, pp. 1191-1200.

[28]  Europol, European Union Terrorism Situation and Trend report (TE-SAT) 2020, p.29.

L’article Terrorism in Europe : countering terrorism on social media est apparu en premier sur Le portail de référence pour l'espace de liberté, sécurité et justice.

Author :