It has been known since before the 2015 Paris terror attacks that Islamic State news and propaganda is spread through Telegram, an encrypted messaging application for iPhone and Android. The app was also used to announce IS (Isis/Daesh) had taken responsibility for multiple explosions in Brussels which killed 34 people and wounded 250 on 22 March.
In the hours which followed the devastating attacks in Belgium, screenshots of Telegram messages surfaced online claiming to offer advice to IS militants. The instructions included staying away from social media sites such as Facebook and Twitter, changing location as soon as possible, encrypting "all jihadi files" and only accessing the web through the anonymising Tor browser.
However, the guidance has been dismissed by The Grugq as "extremely low quality, not actionable, self contradictory and of dubious value at best". Well respected in the hacking and computer security industry, Grugq is a South African who lives in Bangkok.
'Isis fanboys and jihobbiests'
In a Medium blog post with the subheading "No, this is not operational guidance for Isis terrorists to use encryption", Grugq says: "The target audience is probably other Isis fanboys in the jihobbiest community, and seems almost certainly not actual terrorist operatives."
The Telegram channel, called Information Security, a phrase often shortened to OpSec, said: "Attentions [sic] for all our brothers in Belgium. Stay away from using Internet unless you are using encryption Software such as (Tor Network – i2P Network – VPN)... Encrypt all your jihadies files and it's better to delete them permanently with eraser or iShredder or kill disk."
Grugq argues that this advice is flawed because the suggested services "do not provide end to end encryption. They are privacy and anonymity tools, not encryption tools... this fundamental error should raise a red flag for any reader, indicating that the author is ignorant of the subject matter."
'Keep calm... concentrate on your next move'
The advice continues to suggest Isis followers keep a low profile "until the heat [of the Brussels attacks] dies down" and to change their location. "Don't panic," it concludes. "Keep calm and concentrate on your next move and don't forget to warn your brother to take precautions."
IS' continued use of Telegram comes after the Berlin-based company shut down 78 IS-related broadcast channels in the wake of the Paris terror attacks in November. An earlier IBTimes UK investigation found IS had gathered more than 10,000 followers across more than 50 Telegram channels. Soon after, the company introduced a way for users to report channels and it took steps to shut down IS-run feeds.
However, a channel called Amaq Agency is still posting regular updates on IS activity, including the first report that IS had claimed responsibility for the Brussels bombings. Claiming to be an impartial news agency, Amaq has been criticised for being little more than a spokesperson for IS.
The New York Times said in January: "Make no mistake, though: Amaq is putting out the Islamic State's message, and the veneer of separation between the terrorist group and what has now become its unacknowledged wire service is quickly disintegrating. Though the group is not officially part of the Isis media apparatus, it functions much that way."
Summing up, Grugq says: "There is no practical advice here for real terrorists. It's just a statement of solidarity from the jihobbiest bros to Isis supporters, ostensibly those in Belgium... who happen to be subscribed to an English language Telegram channel."
IBTimes UK has contacted Telegram for a comment and will update this article when we receive one.