Propaganda images reveal how terrorists think

Researchers have used artificial intelligence to analyse over 30,000 propaganda images produced by the Islamic State (IS) between 2014 and 2022. 

A group of IS soldiers with weapon and an IS flag.
From Diyala, Iraq, in the spring of 2022: a group of IS soldiers swears Bay’ah – an oath of allegiance to the new IS caliph. This is one of the 30,000 IS images that have now been analysed. 

Propaganda is an important part of the operation of a terrorist organisation. They use text, video, audio, and images to not only spread fear, but also to recruit and build their image internationally. By using the internet and social media, even terrorist groups with limited resources can reach a global audience.

For researchers studying terrorist groups, propaganda material is an important source in understanding who the actors are, what they want, and how they operate. The challenge for researchers is the sheer amount of propaganda that is being produced, which makes it almost impossible to get an overview through manual means. 

Because IS controlled a large area in Syria and Iraq for several years, they gained more resources and more members who could work as ‘journalists’ or content producers. Propaganda was clearly a prioritised area in the organisation, and the battles they were involved in provided them with plenty of raw material. 

‘IS stood out because their propaganda was better than the content of earlier terrorist groups. They managed to create a “brand” and a linguistic and visual expression that appealed to the youth, combined with extremely brutal content where close-ups of killings were almost a given,’ explains Skretting. 

Although the group is now marginalised in its original core areas in Syria and Iraq, its branches in other parts of the world have made significant progress – especially in Africa. IS still maintains a unified and substantial propaganda apparatus. 

IS – a pioneer in terrorist propaganda 

The researchers have based their work on the extensive image material published on IS’s official channels over the years. The dataset, consisting of 30,000 images, was fetched from an IS bot on Telegram. 

‘IS has revolutionised how non-state actors and terrorist groups conduct propaganda. This is considered one of the keys to the group’s success,’ says researcher Vidar Skretting. He co-authored the report with colleagues and AI researchers Mathias Bynke and Bernt Ivar Nødland.

The rise and fall of IS 

In 2013, a group called the Islamic State in Iraq and the Levant (ISIL), managed to occupy large parts of Syria and Iraq. In 2014, they seized Mosul, Iraq’s second-largest city. Shortly thereafter, ISIL declared that they had established a new caliphate, to which all Muslims were obliged to submit. At the same time, they removed the geographical reference from their name and adopted ‘the Islamic State’ as their designation, or IS for short. 

From 2014 to 2018, IS gained international notoriety for its brutal conduct. They implemented a reactionary form of Islamic law and carried out executions and amputations of prisoners, genocides against minorities, public slave trading, and numerous terrorist attacks on civilian targets in the Middle East, Asia, Africa, and Europe. 

At the same time, they wanted to show that they had established a true Islamic ‘state’. The group emphasised creating a civil state apparatus and established institutions for law and order, tax collection, education, and healthcare. In addition to violence and brutality, the ‘civil’ side of IS became a recurring theme in the group’s propaganda production. 

IS reached its territorial peak in 2015, when the group controlled about one-third of both Iraq and Syria. After this, IS was gradually pushed back by an international coalition. The last IS-controlled area was captured by Kurdish forces in early 2019. Thus, IS went from being a state-like entity back to an underground organisation.

A dedicated IS social media 

Initially, IS used established social media platforms like Twitter (X), Facebook, YouTube, and, later, the Telegram app to spread their content. 

‘The spread of propaganda on social media is one of the reasons so many foreign fighters from around the world joined IS,’ says Skretting. 

‘Today, it’s much more difficult for IS to reach out. Major social media platforms remove such content almost immediately after it’s posted. However, IS still manages to disseminate its content effectively through other channels, and it’s relatively easy for sympathisers to find them,’ Skretting adds. 

IS spreads its propaganda through three main channels: ‘private’ social media platforms that they run on their own servers, bots on Telegram, and regular indexed websites. 

‘The private social media platforms IS runs have been active for years. Telegram bots and the indexed websites are regularly taken down by administrators and authorities but are usually reopened by IS under different names shortly thereafter,’ says Skretting. 

Two researchers present at an FFI event.
Mathias Bynke (to the left) and Vidar Skretting (to the right) present their report during an FFI event on 12th of December 2023. Photo: FFI / Anders Halvorsen Fehn.

Sorting 30,000 images 

In their work, the researchers used a machine learning model from OpenAI called Contrastive Language-Image Pre-training (CLIP). The model is trained to compare images with text. 

CLIP has been trained by collecting enormous amounts of images and corresponding captions from the web. By comparing millions of images and captions, the model has gradually learned how images can be described in words and, conversely, how an image might look based on the text describing it. 

By running the 30,000 images through CLIP, the researchers could, for example, ask the model to find all images showing a ‘person praying’ or ‘combat action.’ However, instead of manually defining the categories in which the images should be sorted, the researchers used a clustering algorithm to group the images by theme. 

‘We didn’t know in advance which descriptions would suit various themes. When you provide the CLIP model with a limited number of categories, an image of a man diving into a river could easily end up in the category “image of someone praying”,’ explains Mathias Bynke.

Illustration of the Clip model.
The Clip model.

The CLIP model translates an image into an embedding vector, that is, a sequence of numbers. It also translates the image captions into a sequence of numbers. If you have an image of apples, the number sequence for the image should be approximately the same as the number sequence for the text ‘image of apples.’ 

The number sequence that CLIP generates for each image can be converted into coordinates in a coordinate system. This gives each image a position on a map. Then, an algorithm can cluster these points into groups. You can choose how many clusters you want, and the algorithm organises the images for you. 

When the researchers asked the algorithm to create two clusters, one group was dominated by military images, and the other by civilian images. 

In the end, they settled on 14 different named clusters: combat scenes, soldiers outside combat, enemy bodies, executions and killings, close-ups of individual fighters, weapons, civilian crowds, peaceful scenes, collapsed buildings, civilian casualties, food, public works, crafts and industrial production, and burning cigarette packets.

What have we learnt about IS from the images? 

Once the images were sorted, the researchers wanted to answer the following question: How has IS’s image propaganda evolved from 2014 to 2022, and what does this development tell us about IS as a group? 

‘The images IS publishes, the number of images published, and where they are published give us an indication of what IS is doing, how active they are, and in which areas they’re active,’ says Skretting. 

He believes that insight into the development of terrorist organisations can be important in predicting their direction and strategies: By looking at the images from the African provinces where IS is on the rise, we might gain insight into where IS is heading in the future. 

The analysis shows that in the early years (2014–2018), IS presented itself as both a military organisation and a civil state apparatus. This is linked to their attempt to build a ‘real’ Islamic state. 

Since 2019, the focus has shifted. IS now presents itself almost exclusively as a military movement and insurgent group. 

Two men working.
An example of one of the ‘civil’ images of IS’s Iraq and Syria branch, in the ‘public works’ cluster.

2015 was the year IS was most active in terms of propaganda. Nearly half of all the images in the dataset are from this year, which coincides with the time when IS was at the height of its power in Syria and Iraq. Thus, most of the images in the material are from Syria and Iraq. 

‘The group has been defeated in their previous primary areas but is rebuilding in Africa. We also see this trend in the image material,’ says Skretting. 

Activity was at a low point in 2020 but has since increased. The majority of images are now published in West and Central Africa. These differ from those produced in the Middle East in several ways. 

‘There is much less focus on individual jihadists and martyrs. At the same time, the propaganda images are generally more brutal. They’re dominated by military content, reflecting the fact that they are most active as a military organisation,’ says Skretting. 

Further development of the methods is needed 

The researchers conclude that the combination of CLIP and clustering algorithms is an effective method for quickly analysing large amounts of propaganda images. 

‘The division into clusters was not perfect. A certain proportion of the images appeared misclassified, and we had to implement mechanisms to filter these out. But the method helps to speed up the analysis,’ says Skretting. 

He emphasises that the combination of CLIP and clustering algorithms can be used for more than analysing terrorist images. 

‘The method is relatively simple and scalable. You can easily use it to sort image collections far larger than 30,000 images into thematic clusters. The method is particularly useful if you don’t know a lot about the content of the image material in advance.’ 

The researchers believe we should further develop machine learning methods to map propaganda from state and non-state actors. 

‘This type of method is not only relevant for image analysis but also for getting an overview of large text, audio, and video materials,’ stresses Mathias Bynke. 

FFI-Report 2026

Kontraktsstrategier i Forsvarets investeringsprosjekter – etterlevelse av statens prosjektmodell

According to the long-term plan for the defence sector, there is need for extensive investment in new materials, buildings, and facilities. An important part of the basis for such public sector investment projects is a contract strategy. The contract strategy is a description of, amongst other things, the types of contracts that will be used, the planned compensation scheme for the supplier(s), and the distribution of tasks and responsibilities between the parties involved. This study investigates how contract strategies in the Norwegian defence sector comply with the state project model. To investigate contract strategy characteristics, we analyse the documentation for the conceptual appraisal phase (konseptvalgutredning – KVU) and the pre-project phase (sentralt styringsdokument – SSD) of a selection of projects that have recently completed their pre-project phase. To investigate how the projects are constrained in which contract strategies they can use, we analyse the mission letters for each phase. The contract strategies in our sample are in large parts decided before the pre-project phase. Through the analysis of mission letters we identify a number of decisions, the most common being: exemption from the Norwegian law for procurement, the investment being part of an international collaborative project, that procurement should be off-the-shelf, that procurement should be direct from potential suppliers, or that procurement should be carried out through the American Foreign Military Sales program (FMS). The identified decisions are often elaborated upon, but the elaborations are typically very brief. The state project model requires that at least two alternative contract strategies should be put forward and discussed. We find, however, that most contract strategies in our sample do not have alternative strategies laid out in the SSD. The lack of alternatives is mostly unexplained. There is also a requirement that the structure of the contract, the compensation format, and the distribution of tasks are discussed as part of the contract strategy. Though most of the strategies we studied include descriptions of structure, compensation format, and task distribution, there is generally no discussion and little or no elaboration of why certain structures, compensation formats, and task distributions were chosen. The SSDs in our sample generally lack descriptions and discussions of other requirements under the state project model, such as descriptions of contract type, incentive schemes, the degree of specification and so on.
FFI-Report 2026

Happy Days – sosiale erfaringer fra 100 dager patruljetjeneste i arktisk vinter

In 2025, two patrols from the Long-Range Reconnaissance Squadron in Finnmark conducted a 100-day winter exercise, FAM100. This report examines social conditions and interpersonal relationships during the exercise. The dataset consists of semi-structured interviews with all 13 operators, analyzed using an exploratory, grounded theory-inspired approach in MAXQDA 24. A key finding is that the operators largely experienced the exercise as positive, despite expecting significant mental and social strain. Following an initial adaptation phase, many developed a sense of flow, well-being, camaraderie, and humor, referred to as “Happy Days.” However, it became evident that this sense of well-being was linked to the safe framework and known end date of the exercise. It therefore does not fully reflect the realities of war. Several factors contributed to effective collaboration: extensive preparation, selection and voluntariness; shared culture and training; and managed expectations and established ground rules. Collaboration was strongest with a clear framework with defined roles and tasks requiring contributions from the entire team. Mission command, characterized by clear intent and a high degree of autonomy within each individual’s area of expertise, proved particularly effective. At the same time, the study identified several sources of strain. Sleep deprivation emerged as the single most critical factor, significantly affecting cognitive capacity, decision-making, and social tolerance. Additional stressors included physical wear and tear, skin problems, cold exposure, limited daylight, use of night vision devices, and persistent equipment challenges. Irritation primarily arose from minor issues, uneven workload distribution, and personality differences, amplified by prolonged close cohabitation. Relational challenges were largely managed through strategies such as rest, temporary isolation, shielding from strain, and explicit conflict management. Two different feedback models—structured “hot wash” sessions and more selective, ongoing correction—were practiced in the two patrols, without one emerging as clearly superior. Effective management appears to depend on context, group dynamics, and individual maturity. The study also identifies significant challenges related to equipment, logistics, and operational frameworks. Operators perceive the system as largely adapted to peacetime conditions, characterized by slow procurement processes and insufficiently adapted equipment. This affects both operational capability and motivation. Furthermore, a tension was observed between field-based risk understanding and the system-level need for control and safety. In conclusion, the operators highlight the need for broader transformation within the Armed Forces from a peacetime mindset to a more realistic understanding of war. This includes faster and more flexible procurement processes, greater preparedness for casualties and ethical dilemmas, as well as strengthened medical support and operational adaptation to demanding environments. The study thus provides important insights for planning and execution of future long-duration operations.
FFI-Report 2026

Hurtigere fremskaffelser – suksessfaktorer i materiellprosjekter som lykkes

The Norwegian Long-term Defence Plan outlines a large increase in defence spending and investment. As a result of the war in Ukraine and rising geopolitical tensions, the Norwegian Armed Forces aim to procure significant amounts of armaments rapidly. Historically, military acquisitions in the Norwegian defence sector have tended to be delayed. However, several projects do deliver on time. To realise the ambitious program posed by the Long-term Defence Plan, it is beneficial to study what characterises these projects and to see what we can learn from them. In this report, we explore these questions. We carry out three case studies of expeditiously conducted defence projects. We analyse in-depth interviews and project documentation and conduct a cross-case analysis where we contextualise our findings with previous research. We identify some key factors for faster procurement. Competition seems to have allowed projects to choose suppliers with shorter lead times. Requirement moderation has allowed for a broader competition and off-the-shelf procurements. It has also reduced time spent on development. Finally, maintaining continuity within project teams have contributed to efficient project execution. Based on our findings, we give four recommendations for how the Norwegian Defence Materiel Agency (NDMA) and the defence sector in general can achieve faster procurement. They are: 1. As a rule, the sector should consider competition as a means of reducing procurement timelines. 2. The NDMA should strive for continuity within project teams and ensure that institutional knowledge is retained when continuity is disrupted. 3. The NDMA and the sector should focus efforts to moderate requirements to reduce time to delivery. 4. Project dialogue between the Defence Staff and the NDMA should include clear directions for what prioritising time entails.
FFI-Report 2026

Posisjon, navigasjon og tid –og betydningen for totalforsvaret

Commissioned by the Ministry of Trade, Industry and Fisheries, the Norwegian Defence Research Establishment (FFI) has assessed the importance of satellite-based position, navigation, and time (PNT) for Norway’s total defense. Global navigation satellite systems (GNSS) have increasingly been integrated into several parts of society as a source for highly accurate position and time. However, GNSS signals are very weak and highly vulnerable to electromagnetic disturbances, both natural and manmade. Norway has increasingly experienced such disturbances, and in their open threat assessment The Norwegian Intelligence Service assessed how outer space can be a future arena for warfighting. The main focus of our report is to assess GNSS, although other parts of the space industry are also discussed. The study has mapped different uses of GNSS in society and described intentional actions and hazards that can lead to loss of GNSS services and other satellite services. We have assessed the importance of GNSS for Norway’s total defense capability based on a risk analysis of critical societal functions. Our study has also identified several cross-sectoral vulnerabilities that increase the risk for total defense, including an increased dependency on GNSS and several uncertainty elements related to the ability of societal functions to withstand GNSS disturbances. We have concluded that satellite-based PNT strengthens Norway’s total defense and that loss of GNSS will reduce functional capabilities. The use of incorrect position or time data as a result of increasingly advanced spoofing attacks increases the risk for loss of functional capability in several societal functions. Loss of GNSS services increases the possibility for loss of life and health, especially relating to the emergency services’ need for PNT, and reduces situational awareness in the entire crisis spectrum. This may, for example, create dangerous situations for transport services and delays in supply deliveries. GNSS disturbances can cause problems for electricity supply and mobile networks. We recommend six measures that will reduce risk and increase PNT resilience in Norway: • enabling and conducting testing of equipment to identify and map vulnerabilities • developing national frameworks and standards for PNT that include requirements for societal sectors • developing ground-based alternatives to maintain and secure a stable time reference in Norway and Norway’s economic zone • ensuring more resilient use of GNSS • developing robust multi-sensor PNT systems • continuing international collaboration to improve the security and availability of satellite based PNT and satellite service
FFI-Report 2026

Development of off-road autonomy for unmanned ground vehicles

Unmanned ground vehicles (UGVs) are increasingly recognized as assets that can benefit military operations, offering the potential to reduce risk to personnel. Having autonomous capabilities on board UGVs can further enhance their utility by reducing operator workload and enabling more mission capabilities. This report describes the development of a modular autonomy stack for UGVs and its evaluation through experiments in off-road terrain. The autonomy stack integrates three core capabilities – perception, motion planning, and trajectory tracking – implemented on our Milrem Themis UGV platform, Tor. This autonomy system relies on onboard sensors and local mapping to navigate without predefined paths or precise satellite positioning, aiming to address the fundamental challenge of autonomous terrain traversability. To measure performance, we defined a set of benchmark routes representing diverse terrain types, from open fields and dirt roads to narrow trails and forests. These routes serve as structured test cases for assessing autonomy requirements and identifying limitations of our system. We have conducted experiments to assess our autonomy system at FFI’s LandX demonstrations and in long-range trials. The experiments revealed that Tor with our autonomy stack can successfully navigate simple environments such as open terrain and wide vehicle trails, but struggles in complex scenarios involving dense vegetation and narrow passages. Key limitations include the lack of semantic terrain classification and robust decision making in challenging scenarios. Predictability and reliability remain major challenges, with decisions influenced by randomness rather than consistent reasoning. While our current autonomy stack is not yet ready for operational use, it provides a solid foundation for continued research and experimentation. The benchmark routes and evaluation methodology offer a repeatable framework for measuring progress, ensuring that future iterations move closer to the ultimate goal: UGVs capable of operating effectively and autonomously in demanding environments.
FFI-Report 2026

Forsvarssektorens miljø- og klimaregnskap for 2025

The reports in the series ‘Environmental reporting in the Norwegian defence sector’ are published annually by the Norwegian Defence Research Establishment (FFI). These present data reported by the defence sector and associated partners to the Norwegian Defence Environmental Database (NDED). The reports provide an overview of results and trends for environmental aspects of the defence sector’s operations, including waste production, energy expenditure, fuel consumption, use of ammunition, water consumption, consumption of chemicals, and acute pollution. Greenhouse gas emissions are presented in a greenhouse gas inventory. Waste generation is reported to the NDED by associated waste management companies contracted within the various regions of the Norwegian Defence Estate Agency (NDEA). The total amount of waste produced in 2025 was 18 320 tons, which represents an 8 % increase compared to 2024. The degree of waste sorting was 64,8 %, a reduction of 0,3 percentage points compared to the previous year. 31.4 % of the waste was recycled, while 59.3 % was processed with energy recovery. Energy consumption associated with the defence sector’s buildings and properties in Norway is reported by the NDEA through statistics from suppliers. The total energy consumption in buildings and other properties is estimated to 702.5 GWh in 2025. This represents a marginal reduction compared to 2024. Of the energy used in 2025, 96 % came from renewable sources, which is about the same as the previous year. Fuel consumption connected to the use of vehicles, aircraft, vessels, and auxiliary power units was 100 066 m3 in 2025. This is an increase by approximately 2.4 % compared to 2024. Fuel consumption on aircraft and vessels represents 90.1 % of the total fuel consumption in the defence sector. The use of ammunition is reported and specified on a digital form (DBL-750) by organizational unit, shooting range, and ammunition type. A total of 22 223 554 units of ammunition were reported used in 2025, which is 8.4 % more than in 2024. The degree of reporting is the relationship between ammunition provided to the Armed Forces and the proportion reported being used. The degree of reporting in 2024 was 87 % (excluding blank ammunition), which is an increase of 2 percentage points compared to 2024. The reported use of lead-based small arms ammunition has decreased with 163 000 units, or 12 %, from 2024 to 2025. The estimated emission of lead is 5.5 tons in 2025, compared to 6.1 tons in 2024, a decrease of 11 %. Water consumption is reported by the NDEA based on measured and estimated volumes. The total water consumption in 2025 was 2.27 million m3, an increase of 4 % compared to 2024. The use of chemicals is reported from establishments within the sector where chemicals are used on a regular basis. However, with the exception of de-icing fluids, it is insufficiently reported. 40 517 kg of aircraft deicing and 292 700 kg of runway deicing fluids were reported in 2025. The relative usage of urea to the total usage of runway deicing fluids was 96 % in 2025, an increase of 34 percentage points compared to 2024. The greenhouse gas inventory consists of reported fuel and energy use and emission factors associated with the various materials. Emissions from the defence sector’s activities were estimated to 264 512 tons of CO2-equivalents in 2025 inscope 1 and 2, and 2 095 522 tons of CO2-equivalents when including indirect emissions not mandatory to reporting (scope 3). Emissions in scope 1 and 2 have increased by 2.4 % compared to 2024. There is a close relation between the demands and prerequisites which dictate the sector’s volume and pattern of activity and its total impact on the environment. It is therefore relevant to assess this impact in light of the tasks assigned to the defence sector within a dynamic political framework.