Skip to main content

What is the Syrian Electronic Army?

  • The Syrian Electronic Army has claimed hacks on AP, CBS News, NPR and the BBC
  • Its attack on the AP Twitter feed caused a flurry of panic and sent stocks plunging
  • The group is hosted on the network of the Syrian government, says researcher
  • Syrian President Bashar al-Assad has previously praised the group's work, he says

(CNN) -- The Syrian Electronic Army -- a group of pro-Syrian regime hackers that has aggressively targeted major news organizations and activists -- may operate in cyberspace, but its attacks can have real-life impact.

The power of misinformation was amply demonstrated when the group hacked the Associated Press Twitter feed Tuesday.

The fake AP message -- which read, "Breaking: Two Explosions in the White House and Barack Obama is injured," -- caused a brief flurry of panic and sent stocks plummeting.

The tweet was quickly revealed as false, and the Dow Jones Industrial Average recovered from its 145-point dip, but it was nearly a day before the AP Twitter account was restored to life.

Was Obama's 'red line' crossed in Syria?
Israel: Syria used chemical weapons
A Syrian town ruled by rebels
Babacan: Syrian regime will fall

Now, fresh questions are being asked about what the Syrian Electronic Army is, where it's from and how it operates.

In its own words, on is website, the Syrian Electronic Army says, "We are a group of enthusiastic Syrian youths who could not stay passive towards the massive distortion of facts about the recent uprising in Syria."

Over the past few months, the group claims to have hacked British broadcaster the BBC and U.S. outlets CBS News and NPR, as well as Columbia University and rights group Human Rights Watch.

The group even compromised the Twitter account Monday of the head of world soccer, FIFA President Sepp Blatter and FIFA's official account for the 2014 World Cup in Brazil.

But much about the Syrian Electronic Army remains unknown.

'Tacit support' from Syria

One key question revolves around how close the group is to the government of Syrian President Bashar al-Assad, which has been involved in a bloody civil war for more than two years.

On that subject, all the signs are of "tacit support," says Helmi Noman, a senior researcher at the Citizen Lab, Munk School of Global Affairs at the University of Toronto.

He has been tracking the Syrian Electronic Army since May 2011, when it first emerged as an organized group with a Facebook page and then its own website.

"What we know is their domain name was registered by the Syrian Computer Society. We looked into the Syrian Computer Society and discovered that it was headed by al-Assad in the 1990s, before he was president," said Noman.

"It's hosted on the network of the Syrian government, which is interesting because it's the first time we've seen a group with questionable activities being hosted on a national computer network."

Al-Assad has also backed the group by name and "expressed his appreciation for their work and described them as a real army on the Internet," he said.

However, Noman and his fellow researchers do "not have evidence that this group is actually a Syrian government operation."

Even if it were, he points out, the Syrian government would be unlikely to be open about it. This is in part because it could face legal and political consequences for its actions -- for example, over the financial loss suffered as a result of the fake AP tweet, he said.

Who the individual members of the Syrian Electronic Army are and where they're from is also shrouded in mystery.

The group has sought to recruit volunteers through its Facebook page, inviting them to flood selected websites with pre-prepared spam comments, said Noman.

"Of course, we cannot tell if these volunteers are from Syria only, or from other countries," he added.

Many people are familiar with Anonymous, the hacker collective that is known for its DDOS, or distributed denial of service, attacks that take websites offline, and backed the 2011 Occupy movement and WikiLeaks' Julian Assange.

But while the Syrian Electronic Army's activities bear some similarities to those of Anonymous, the group is quite different in other ways, said Noman.

Not only do its domain name and registration betray clear connections with Syria, but its members are reachable through the group's website, Facebook and Twitter pages.

Disrupting the flow

The group also appears robust, bouncing back despite the efforts of U.S. authorities and Twitter to suspend its activities.

And Noman has noted an evolution in the Syrian Electronic Army's methods over time.

Early attacks focused on apparently irrelevant websites, but later efforts shifted first toward compromising the Facebook pages of organizations seen as hostile to the Syrian government, and now high-profile Twitter accounts.

"They demonstrate interest in disrupting the flow of information, especially the flow of information from international media," Noman said of the group.

This is not surprising because it is in line with what the Syrian government itself has tried to do, in accusing the regional and international media of being biased against it, he said.

Tuesday's attack on the AP Twitter feed shows "an escalation in depth but not in scale," Noman said.

While the Syrian Electronic Army has compromised the Twitter accounts of several international media organizations before, the kind of message sent to the AP feed was more disturbing.

The attack on BBC Weather's Twitter feed, for example, was hard to take seriously. "Syrian Electronic Army Was Here," read one tweet. "Saudi weather station down due to head-on collision with camel," said another.

Others were more inflammatory -- "Hazardous fog warning for North Syria: Erdogan orders terrorists to launch chemical weapons at civilian areas" -- but still not credible.

What is worrying about the AP Twitter hack is that next time there is breaking news on Twitter, people will wonder if it's true or just another compromise, Noman said.

It's a warning to everyone to step up their own online security measures -- and be aware that not all they read may be true.

READ MORE: AP hack proves Twitter has a serious cybersecurity problem

READ MORE: FIFA chief Blatter's Twitter account hacked

Part of complete coverage on
Syrian crisis
June 26, 2014 -- Updated 1243 GMT (2043 HKT)
Jihadists have kidnapped over 140 Kurdish boys to "brainwash" them. But a few boys made a daring escape.
June 26, 2014 -- Updated 1248 GMT (2048 HKT)
Reports that Syrian warplanes carried out a cross-border attack on Iraqi towns is further evidence of the blurring of the two countries' borders.
June 24, 2014 -- Updated 2133 GMT (0533 HKT)
CNN's Atika Shubert speaks to a father whose teenage son joined the Jihad movement in Syria.
June 23, 2014 -- Updated 1141 GMT (1941 HKT)
At the start of Syria's civil unrest, Omar would rally against the government alongside his schoolmates, later taking to the streets in his hometown of Salqin.
June 23, 2014 -- Updated 2117 GMT (0517 HKT)
Atika Shubert looks at the rise of European jihadists traveling to Syria and whether they soon could join ISIS in Iraq.
June 23, 2014 -- Updated 1453 GMT (2253 HKT)
The final stockpile of Syria's chemical weapons has been shipped out of the country, according to the OPCW, the Organisation for the Prohibition of Chemical Weapons.
June 25, 2014 -- Updated 2025 GMT (0425 HKT)
The US isn't doing airstrikes in Iraq. Is there a vacuum for Syria and Iran to step in? CNN's Fareed Zakaria weighs in.
June 10, 2014 -- Updated 0804 GMT (1604 HKT)
CNN's Nick Paton Walsh reports on Syrian rebels using underground explosions against the better-equipped regime.
June 9, 2014 -- Updated 1151 GMT (1951 HKT)
CNN's Nick Paton Walsh returns to the besieged rebel areas of Aleppo, a pale skeleton of a city that has had the life bombed out of it.
June 2, 2014 -- Updated 1151 GMT (1951 HKT)
Syria may be embroiled in a brutal three-year civil war, but that's not stopping the government from holding presidential elections.
June 3, 2014 -- Updated 1123 GMT (1923 HKT)
CNN's Nick Paton Walsh meets an ISIS defector in hiding and gets a rare look into the group's recruitment process.
June 5, 2014 -- Updated 1610 GMT (0010 HKT)
Over a thousand Syrian refugees have turned an abandoned shopping mall in Lebanon into makeshift living quarters.
May 28, 2014 -- Updated 2119 GMT (0519 HKT)
What caught our experts' ears was as much about what he didn't address as much as what he did.
May 20, 2014 -- Updated 1019 GMT (1819 HKT)
The three-year war in Syria has claimed 162,402 lives, an opposition group said Monday, as the raging conflict shows no signs of abating.
May 31, 2014 -- Updated 0141 GMT (0941 HKT)
Official: The U.S. believes a jihadi featured in a suicide bombing video in Syria is Moner Mohammad Abu-Salha who grew up in Florida.
May 20, 2014 -- Updated 1437 GMT (2237 HKT)
For the first time, Britain has convicted someone of a terrorism offense related to the Syrian civil war.