Propaganda images reveal how terrorists think

Researchers have used artificial intelligence to analyse over 30,000 propaganda images produced by the Islamic State (IS) between 2014 and 2022. 

A group of IS soldiers with weapon and an IS flag.
From Diyala, Iraq, in the spring of 2022: a group of IS soldiers swears Bay’ah – an oath of allegiance to the new IS caliph. This is one of the 30,000 IS images that have now been analysed. 

Propaganda is an important part of the operation of a terrorist organisation. They use text, video, audio, and images to not only spread fear, but also to recruit and build their image internationally. By using the internet and social media, even terrorist groups with limited resources can reach a global audience.

For researchers studying terrorist groups, propaganda material is an important source in understanding who the actors are, what they want, and how they operate. The challenge for researchers is the sheer amount of propaganda that is being produced, which makes it almost impossible to get an overview through manual means. 

Because IS controlled a large area in Syria and Iraq for several years, they gained more resources and more members who could work as ‘journalists’ or content producers. Propaganda was clearly a prioritised area in the organisation, and the battles they were involved in provided them with plenty of raw material. 

‘IS stood out because their propaganda was better than the content of earlier terrorist groups. They managed to create a “brand” and a linguistic and visual expression that appealed to the youth, combined with extremely brutal content where close-ups of killings were almost a given,’ explains Skretting. 

Although the group is now marginalised in its original core areas in Syria and Iraq, its branches in other parts of the world have made significant progress – especially in Africa. IS still maintains a unified and substantial propaganda apparatus. 

IS – a pioneer in terrorist propaganda 

The researchers have based their work on the extensive image material published on IS’s official channels over the years. The dataset, consisting of 30,000 images, was fetched from an IS bot on Telegram. 

‘IS has revolutionised how non-state actors and terrorist groups conduct propaganda. This is considered one of the keys to the group’s success,’ says researcher Vidar Skretting. He co-authored the report with colleagues and AI researchers Mathias Bynke and Bernt Ivar Nødland.

The rise and fall of IS 

In 2013, a group called the Islamic State in Iraq and the Levant (ISIL), managed to occupy large parts of Syria and Iraq. In 2014, they seized Mosul, Iraq’s second-largest city. Shortly thereafter, ISIL declared that they had established a new caliphate, to which all Muslims were obliged to submit. At the same time, they removed the geographical reference from their name and adopted ‘the Islamic State’ as their designation, or IS for short. 

From 2014 to 2018, IS gained international notoriety for its brutal conduct. They implemented a reactionary form of Islamic law and carried out executions and amputations of prisoners, genocides against minorities, public slave trading, and numerous terrorist attacks on civilian targets in the Middle East, Asia, Africa, and Europe. 

At the same time, they wanted to show that they had established a true Islamic ‘state’. The group emphasised creating a civil state apparatus and established institutions for law and order, tax collection, education, and healthcare. In addition to violence and brutality, the ‘civil’ side of IS became a recurring theme in the group’s propaganda production. 

IS reached its territorial peak in 2015, when the group controlled about one-third of both Iraq and Syria. After this, IS was gradually pushed back by an international coalition. The last IS-controlled area was captured by Kurdish forces in early 2019. Thus, IS went from being a state-like entity back to an underground organisation.

A dedicated IS social media 

Initially, IS used established social media platforms like Twitter (X), Facebook, YouTube, and, later, the Telegram app to spread their content. 

‘The spread of propaganda on social media is one of the reasons so many foreign fighters from around the world joined IS,’ says Skretting. 

‘Today, it’s much more difficult for IS to reach out. Major social media platforms remove such content almost immediately after it’s posted. However, IS still manages to disseminate its content effectively through other channels, and it’s relatively easy for sympathisers to find them,’ Skretting adds. 

IS spreads its propaganda through three main channels: ‘private’ social media platforms that they run on their own servers, bots on Telegram, and regular indexed websites. 

‘The private social media platforms IS runs have been active for years. Telegram bots and the indexed websites are regularly taken down by administrators and authorities but are usually reopened by IS under different names shortly thereafter,’ says Skretting. 

Two researchers present at an FFI event.
Mathias Bynke (to the left) and Vidar Skretting (to the right) present their report during an FFI event on 12th of December 2023. Photo: FFI / Anders Halvorsen Fehn.

Sorting 30,000 images 

In their work, the researchers used a machine learning model from OpenAI called Contrastive Language-Image Pre-training (CLIP). The model is trained to compare images with text. 

CLIP has been trained by collecting enormous amounts of images and corresponding captions from the web. By comparing millions of images and captions, the model has gradually learned how images can be described in words and, conversely, how an image might look based on the text describing it. 

By running the 30,000 images through CLIP, the researchers could, for example, ask the model to find all images showing a ‘person praying’ or ‘combat action.’ However, instead of manually defining the categories in which the images should be sorted, the researchers used a clustering algorithm to group the images by theme. 

‘We didn’t know in advance which descriptions would suit various themes. When you provide the CLIP model with a limited number of categories, an image of a man diving into a river could easily end up in the category “image of someone praying”,’ explains Mathias Bynke.

Illustration of the Clip model.
The Clip model.

The CLIP model translates an image into an embedding vector, that is, a sequence of numbers. It also translates the image captions into a sequence of numbers. If you have an image of apples, the number sequence for the image should be approximately the same as the number sequence for the text ‘image of apples.’ 

The number sequence that CLIP generates for each image can be converted into coordinates in a coordinate system. This gives each image a position on a map. Then, an algorithm can cluster these points into groups. You can choose how many clusters you want, and the algorithm organises the images for you. 

When the researchers asked the algorithm to create two clusters, one group was dominated by military images, and the other by civilian images. 

In the end, they settled on 14 different named clusters: combat scenes, soldiers outside combat, enemy bodies, executions and killings, close-ups of individual fighters, weapons, civilian crowds, peaceful scenes, collapsed buildings, civilian casualties, food, public works, crafts and industrial production, and burning cigarette packets.

What have we learnt about IS from the images? 

Once the images were sorted, the researchers wanted to answer the following question: How has IS’s image propaganda evolved from 2014 to 2022, and what does this development tell us about IS as a group? 

‘The images IS publishes, the number of images published, and where they are published give us an indication of what IS is doing, how active they are, and in which areas they’re active,’ says Skretting. 

He believes that insight into the development of terrorist organisations can be important in predicting their direction and strategies: By looking at the images from the African provinces where IS is on the rise, we might gain insight into where IS is heading in the future. 

The analysis shows that in the early years (2014–2018), IS presented itself as both a military organisation and a civil state apparatus. This is linked to their attempt to build a ‘real’ Islamic state. 

Since 2019, the focus has shifted. IS now presents itself almost exclusively as a military movement and insurgent group. 

Two men working.
An example of one of the ‘civil’ images of IS’s Iraq and Syria branch, in the ‘public works’ cluster.

2015 was the year IS was most active in terms of propaganda. Nearly half of all the images in the dataset are from this year, which coincides with the time when IS was at the height of its power in Syria and Iraq. Thus, most of the images in the material are from Syria and Iraq. 

‘The group has been defeated in their previous primary areas but is rebuilding in Africa. We also see this trend in the image material,’ says Skretting. 

Activity was at a low point in 2020 but has since increased. The majority of images are now published in West and Central Africa. These differ from those produced in the Middle East in several ways. 

‘There is much less focus on individual jihadists and martyrs. At the same time, the propaganda images are generally more brutal. They’re dominated by military content, reflecting the fact that they are most active as a military organisation,’ says Skretting. 

Further development of the methods is needed 

The researchers conclude that the combination of CLIP and clustering algorithms is an effective method for quickly analysing large amounts of propaganda images. 

‘The division into clusters was not perfect. A certain proportion of the images appeared misclassified, and we had to implement mechanisms to filter these out. But the method helps to speed up the analysis,’ says Skretting. 

He emphasises that the combination of CLIP and clustering algorithms can be used for more than analysing terrorist images. 

‘The method is relatively simple and scalable. You can easily use it to sort image collections far larger than 30,000 images into thematic clusters. The method is particularly useful if you don’t know a lot about the content of the image material in advance.’ 

The researchers believe we should further develop machine learning methods to map propaganda from state and non-state actors. 

‘This type of method is not only relevant for image analysis but also for getting an overview of large text, audio, and video materials,’ stresses Mathias Bynke. 

FFI-Report 2026

Development of off-road autonomy for unmanned ground vehicles

Unmanned ground vehicles (UGVs) are increasingly recognized as assets that can benefit military operations, offering the potential to reduce risk to personnel. Having autonomous capabilities on board UGVs can further enhance their utility by reducing operator workload and enabling more mission capabilities. This report describes the development of a modular autonomy stack for UGVs and its evaluation through experiments in off-road terrain. The autonomy stack integrates three core capabilities – perception, motion planning, and trajectory tracking – implemented on our Milrem Themis UGV platform, Tor. This autonomy system relies on onboard sensors and local mapping to navigate without predefined paths or precise satellite positioning, aiming to address the fundamental challenge of autonomous terrain traversability. To measure performance, we defined a set of benchmark routes representing diverse terrain types, from open fields and dirt roads to narrow trails and forests. These routes serve as structured test cases for assessing autonomy requirements and identifying limitations of our system. We have conducted experiments to assess our autonomy system at FFI’s LandX demonstrations and in long-range trials. The experiments revealed that Tor with our autonomy stack can successfully navigate simple environments such as open terrain and wide vehicle trails, but struggles in complex scenarios involving dense vegetation and narrow passages. Key limitations include the lack of semantic terrain classification and robust decision making in challenging scenarios. Predictability and reliability remain major challenges, with decisions influenced by randomness rather than consistent reasoning. While our current autonomy stack is not yet ready for operational use, it provides a solid foundation for continued research and experimentation. The benchmark routes and evaluation methodology offer a repeatable framework for measuring progress, ensuring that future iterations move closer to the ultimate goal: UGVs capable of operating effectively and autonomously in demanding environments.
FFI-Report 2026

Forsvarssektorens miljø- og klimaregnskap for 2025

The reports in the series ‘Environmental reporting in the Norwegian defence sector’ are published annually by the Norwegian Defence Research Establishment (FFI). These present data reported by the defence sector and associated partners to the Norwegian Defence Environmental Database (NDED). The reports provide an overview of results and trends for environmental aspects of the defence sector’s operations, including waste production, energy expenditure, fuel consumption, use of ammunition, water consumption, consumption of chemicals, and acute pollution. Greenhouse gas emissions are presented in a greenhouse gas inventory. Waste generation is reported to the NDED by associated waste management companies contracted within the various regions of the Norwegian Defence Estate Agency (NDEA). The total amount of waste produced in 2025 was 18 320 tons, which represents an 8 % increase compared to 2024. The degree of waste sorting was 64,8 %, a reduction of 0,3 percentage points compared to the previous year. 31.4 % of the waste was recycled, while 59.3 % was processed with energy recovery. Energy consumption associated with the defence sector’s buildings and properties in Norway is reported by the NDEA through statistics from suppliers. The total energy consumption in buildings and other properties is estimated to 702.5 GWh in 2025. This represents a marginal reduction compared to 2024. Of the energy used in 2025, 96 % came from renewable sources, which is about the same as the previous year. Fuel consumption connected to the use of vehicles, aircraft, vessels, and auxiliary power units was 100 066 m3 in 2025. This is an increase by approximately 2.4 % compared to 2024. Fuel consumption on aircraft and vessels represents 90.1 % of the total fuel consumption in the defence sector. The use of ammunition is reported and specified on a digital form (DBL-750) by organizational unit, shooting range, and ammunition type. A total of 22 223 554 units of ammunition were reported used in 2025, which is 8.4 % more than in 2024. The degree of reporting is the relationship between ammunition provided to the Armed Forces and the proportion reported being used. The degree of reporting in 2024 was 87 % (excluding blank ammunition), which is an increase of 2 percentage points compared to 2024. The reported use of lead-based small arms ammunition has decreased with 163 000 units, or 12 %, from 2024 to 2025. The estimated emission of lead is 5.5 tons in 2025, compared to 6.1 tons in 2024, a decrease of 11 %. Water consumption is reported by the NDEA based on measured and estimated volumes. The total water consumption in 2025 was 2.27 million m3, an increase of 4 % compared to 2024. The use of chemicals is reported from establishments within the sector where chemicals are used on a regular basis. However, with the exception of de-icing fluids, it is insufficiently reported. 40 517 kg of aircraft deicing and 292 700 kg of runway deicing fluids were reported in 2025. The relative usage of urea to the total usage of runway deicing fluids was 96 % in 2025, an increase of 34 percentage points compared to 2024. The greenhouse gas inventory consists of reported fuel and energy use and emission factors associated with the various materials. Emissions from the defence sector’s activities were estimated to 264 512 tons of CO2-equivalents in 2025 inscope 1 and 2, and 2 095 522 tons of CO2-equivalents when including indirect emissions not mandatory to reporting (scope 3). Emissions in scope 1 and 2 have increased by 2.4 % compared to 2024. There is a close relation between the demands and prerequisites which dictate the sector’s volume and pattern of activity and its total impact on the environment. It is therefore relevant to assess this impact in light of the tasks assigned to the defence sector within a dynamic political framework.
FFI-Report 2026

Producing an urban-wind field database with OpenFOAM – Work Package 6 of the CHIMERA project

The CHIMERA project (Comprehensive Hazard Identification and Monitoring systEm for uRban Areas) is based on developments in earlier research and innovation projects, i.e. EU-SENSE and EU-RADION, and aims to provide a technological improvement in the chemical, biological, radiological and nuclear (CBRN) hazard domain. Specifically, the goal is to develop software that can combine data from various sensor inputs with results from dispersion/backtracking models in a flexible manner, presented in a coherent graphical user interface. Part of the project, Work Package 6, involves the continued development of software for fast and reliable numerical predictions of CBRN dispersion and deposition, based on precomputed local-wind simulations. This report describes the meshing and simulation protocol developed in Task 6.2 of CHIMERA, presents the reasoning behind the most important modeling decisions, gives recommendations for usage, and shows a few examples of the application of the CHIMERA meshing and simulation protocol. A publicly available open-source software, OpenFOAM®, is the main component for meshing and simulation. Relevant literature for further insight into urban-wind modeling is also given in the report.
FFI-Report 2026

Hvordan forbedre Forsvarets evne til multidomeneoperasjoner? – utfordringer og kunnskapsbehov

Multi-domain operations (MDO) is an evolution of joint operations. The Armed Forces are to transition from conducting joint operations to MDO in order to improve their ability to meet future threats and to enhance their capacity to adopt and exploit new and existing technologies. This report documents a problem-structuring process based on characteristics that define multidomain operations, analyzes how these may affect the Armed Forces’ operational effectiveness, and identifies challenges and knowledge gaps that should be prioritized to support the development of MDO within the Armed Forces. A data-centric approach to operations is highlighted as fundamental to realizing MDO. High-quality data and digital, interoperable systems are essential to support timely and well-informed planning and decision-making processes, as well as the effective execution of operations. The shift from joint operations to MDO will require changes in technology, processes, organization, and competence. The development of MDO capabilities depends on coordinated progress within these areas. The report presents a simple system analysis that evaluates how different functional areas (the joint functions) are influenced by identified MDO characteristics. The analysis shows that all functional areas are affected, but that the greatest need for change lies within command and control (C2), and within intelligence, surveillance, and reconnaissance (ISR). Based on this analysis, we highlight several areas where there is significant need for knowledge development to support the advancement of MDO, both nationally and within the alliance. Examples of key areas include the development of data-centric planning and decision-making processes, increased interoperability, further development of decentralized command in light of MDO, and effective targeting across domains. There is also a need for knowledge on how to better integrate and exploit the space and cyber domains, electronic warfare, and the information environment. Other examples of challenge areas include how we can better facilitate innovation and strengthen collaboration with civilian actors. These, along with other challenge areas described in the report, will influence training and competence needs as well as the development of capabilities and capacities for MDO. The development of MDO should take place gradually, holistically, and in a knowledge-based manner, including the use of scenario-based analyses, experimentation, learning, simulations, and wargaming to assess the operational consequences of different measures aimed at increasing MDO capability.
FFI-Report 2026

Ekstern kvalitetssikring av Forsvarets investeringsprosjekter – hva kan vi lære?

Major investment projects in the defence sector follow the State project model, which means that both the concept appraisal and the pre‑project phase are subject to external quality assurance before the projects are approved and executed. This study examines what the defence sector can learn from previously conducted external quality assurance reviews. The objective is to generate knowledge and insights that can be used in efforts to further develop methods and templates for investment projects. The study is based on analyses of quality assurance reports prepared for defence sector projects in the period from 2019 to 2025. The study finds that external quality assurers consistently assess uncertainty as being higher than the projects themselves do. This indicates a more conservative approach to uncertainty in the quality assurance process. For many of the concept appraisals, the external quality assurers point out that strategic goals should be formulated more precisely and in ways that make it easier to verify achievement. Furthermore, the exploration of the opportunity space frequently provides insufficient descriptions of how the opportunity space has been identified and narrowed. Finally, the analysis of alternatives often lack adequate cost-benefit analyses. Most comments in the quality assurance of the pre‑project phase concern key governance and implementation issues. External quality assurers particularly highlight shortcomings related to change logs, contract strategy, benefits realisation plans, execution strategy, and organisation, as well as follow‑up of the choice of concept and realisation of expected benefits. Based on the identified areas for improvement, we recommend that the defence sector take measures to improve the traceability and quality of cost estimates by documenting assumptions more explicitly. Furthermore, we recommend improving project objective formulations, enhancing benefit realisation plans in line with current guidelines, and systematising and making more active use of change logs.
FFI-Report 2026

Anskaffelsen av 212CD-ubåtene i lys av forsvarssektorens klima- og bærekraftsambisjoner

In recent years, the Norwegian defence sector has made it clear that it aims to take greater responsibility for its impact on climate and environment and to contribute to achieve national climate and environmental goals, as well as UN’s Sustainable Development Goals. In 2022, the sector launched its own climate and environmental strategy to reduce its climate footprint and negative environmental impacts and to adapt the sector to future climate changes. The strategy was specified in the Action Plan 2023–2030. In 2021, Norway signed a procurement contract for 212CD submarines from the German shipyard TKMS to replace its Ula class submarines. The procurement process is a collaboration with Germany. In 2025, Norwegian Defence Material Agency (NDMA) Maritime Capabilities asked the Norwegian Defence Research Establishment (FFI) to evaluate how this procurement and the planned quay and maintenance facilities in Skværvika aligns with the sector’s climate and environmental strategy. FFI has analysed the procurement across all phases of the submarine’s life cycle and compared both the submarine acquisition and the new infrastructure with existing solutions for the Ula class. Emissions from the production of the 212CD submarines have been estimated by FFI at approximately 9000–10 000 tonnes of CO₂-equivalents (CO2e) per submarine. This is roughly three times higher than for the Ula class. In operation, annual emissions from the Norwegian 212CD fleet are estimated at approximately 4700 tonnes of CO2e, of which 86 % stems from the combustion of marine diesel oil in the diesel generators. The most effective climate measures will be to avoid higher sailing speeds than necessary, and in the future, replace current fuels with alternatives that have lower emissions. Local production of hydrogen for air independent propulsion can further reduce emissions by around 600 tonnes of CO₂e per year. In addition, new technological opportunities, such as planning the most energy-efficient sailing routes, may contribute to lower emissions and strengthen operational capability. The 212CD procurement contract does not contain specific requirements to avoid substances regulated under the REACH regulation or to provide an Inventory of Hazardous Materials (IHM). We do, however, expect such requirements to be introduced. For the Ula class, there are few plans for reuse and disposal. We consider access to an IHM important to ensure responsible end-of-life management. In Skværvika, the quay and maintenance facility is being built by the Norwegian Defence Estate Agency (NDEA) in accordance with the Norwegian building regulation TEK17. Greenhouse gas emissions related to the four quays are estimated to be approximately 9000-10 500 tonnes of CO2e. Similar calculations will be carried out for the maintenance facility once it is completed. The facility will be operated using self-produced energy from seawater-based district heating and will be prepared for installation of a solar power system. NDEA largely complies with the sector’s climate and environmental requirements. However, the blasting work carried out during quay construction exceeded the requirements for explosives quantities and noise levels.