From Cyber Security to Digital Trust: What I Told NATO’s Counter-Terrorism Experts in Ankara
From Cyber Security to Digital Trust: What I Told NATO’s Counter-Terrorism Experts in Ankara
From Cyber Security to Digital Trust: What I Told NATO’s Counter-Terrorism Experts in Ankara
In March 2024, thousands of people watched an Islamic State attack video posted by a channel that looked exactly like CNN. Nobody hacked CNN. Nobody needed to. The trust was the payload.
This week I spoke at the Terrorism Experts Conference 2026, hosted in Ankara by the NATO Centre of Excellence Defence Against Terrorism (COE-DAT). The organisers gave me a title I have been thinking about ever since: From Cyber Security to Digital Trust: A New Frontier for Counter-Terrorism. This post is the long version of that talk, with the evidence, the two frameworks I used, and the six asks I put to COE-DAT and Alliance partners.
- Extremists increasingly borrow trust instead of breaking systems: fake news brands, AI anchors, hijacked accounts, friendly faces in game lobbies.
- The Trust Surfaces model (See, Talk, Rely) names the three things under attack: what people believe is real, who they think they are talking to, and who they expect to protect them.
- Adaptation Velocity has collapsed on their side. Extremists went from 66 months to adopt cryptocurrency to 2 months for livestreaming and 7 for generative AI.
- Our response time has not moved. Roughly three to four years from first extremist use to the first binding response, in every case I tracked.
- Both can be measured with data that already exists. What is missing is the decision to track it.
The case that opened the talk
After the Crocus City Hall attack near Moscow in March 2024, people on Facebook, YouTube and X saw the attack video shared by what looked like a news channel. The logo looked right. The ticker looked right. Some accounts looked like CNN, others like Al Jazeera.
They were run by an IS support outlet calling itself “War and Media”. The Institute for Strategic Dialogue documented the campaign in June 2024: paired Facebook pages, YouTube channels and X accounts, coordinated on Telegram, publishing newscasts in Arabic and English with realistic branding.
Ask yourself what was broken here. No server was hacked. No password was stolen. No firewall failed. What they took was credibility: a brand millions of people trust, borrowed for free. People did not share that video because it was clever. They shared it because of the name at the top of the post.
Why protecting systems is no longer enough
For about twenty years, counter-terrorism in cyberspace has focused on systems. We protected networks and data. We protected energy, water, hospitals and transport. We built real capability to find and remove terrorist content. A lot of that work was done by people sitting in that room in Ankara, and it was necessary work.
It also worked. Breaking into well-defended systems became harder and more expensive. So adversaries did what adversaries always do and found a cheaper route. The cheapest route is trust that already exists. Someone else spent years building it. They only have to borrow it.
Breaking in is the means. Borrowed trust is the goal.
Erdal Ozkaya
I want to be careful here, because this is easy to misread. I am not saying systems stopped mattering. Networks, data and infrastructure stay protected. System security becomes the inner circle of a bigger job. Around it sits digital trust: trust in what people see, in who they are talking to, and in the institutions that are supposed to protect them. If we only measure the breaking in, we miss what they came for.
The Trust Surfaces model: See, Talk, Rely
When I look at extremist operations that succeed without breaking anything, they go after one or more of three surfaces. I introduced this in Ankara as the Trust Surfaces model. The three verbs are short on purpose. They need to survive translation in a room where most people work in their second or third language.
See
What people believe is real. Synthetic news, deepfaked officials, AI-generated propaganda.
Talk
Who they think is on the other side. Borrowed brands, hijacked accounts, fake friends and mentors.
Rely
Who they expect to protect them. The story that nobody is coming to help.
The serious operations touch all three at once. Here is the evidence for each.
See: what people see is no longer proof
The Crocus attack produced a second campaign. On 26 March 2024, four days after the attack, IS supporters released the first of a series of near-weekly video news bulletins read by AI-generated anchors on a set built to look like a real broadcast. Rita Katz of the SITE Intelligence Group told The Washington Post: “For ISIS, AI means a game changer.”
It is not one group experimenting. By November 2023, Tech Against Terrorism had already archived more than 5,000 pieces of AI-generated content shared in terrorist and violent extremist spaces. For most of history, seeing was a reasonable basis for believing. For a seventeen-year-old scrolling at midnight, it no longer is.
Talk: fake the person, get the relationship
Radicalisation rarely runs on content alone. It runs on relationships: a friend, a mentor, a voice you already trust. If you can fake the person, you get the relationship. There are three ways in, and all three have happened:
| Route | Example |
|---|---|
| Borrowed | IS supporters posing as CNN and Al Jazeera, 2024 |
| Hijacked | US Central Command’s Twitter and YouTube accounts, taken over in 2015 by the so-called CyberCaliphate |
| Taken over quietly | A neo-Nazi group used a SIM swap in 2023 to seize an account with around two million followers and post hate content for three days |
Rely: the quiet surface
This is the surface we talk about least, and I think it is the most dangerous. Extremists do not only spread false content. They tell young people a story: nobody is coming to help you. Not the government, not the police, not the platforms. Once a young person believes that, the recruiter becomes the only one offering protection.
A careful note on the Microsoft figure, because someone always checks: the question was about responsibility, not trust. It does not say only 6% trust the police. What it does show is that very few young people expect institutions to be the ones keeping them safe online. The UK study, run by DSIT with Savanta, found young people sceptical that social media companies would act unless forced, and unsure government would enforce the rules either. A recruiter who says “nobody is coming for you” is not telling them anything new.
Where all three meet: gaming communities
Gaming communities are where content, identity and institutional absence come together, and where young people spend their evenings. The overwhelming majority of gamers have nothing to do with extremism. That is exactly why the trust inside those communities is worth borrowing.
Europol’s TE-SAT 2025 says gaming platforms and the metaverse continued to be used for grooming and recruiting young perpetrators. The 2026 edition goes further: radicalisation often developed rapidly, frequently starting with propaganda on youth-oriented social media or gaming platforms, and extremists have borrowed game design itself, with rankings, challenges and rewards. Two notes on accuracy. The 5,408 links were referred to platforms for review, not confirmed removals. And Europol does not name specific games, so neither will I.
I see the same patterns from a university security seat. With around 11,000 students on open networks, the threats my team watches for are trust attacks: someone impersonating a university office or staff member, a real account taken over and used to message students who trust it, and abuse of trust inside gaming and chat spaces. None of them needs to break a firewall.
Adaptation Velocity: they got faster, we did not
Adaptation Velocity is the speed at which extremists turn new technology into advantage. Not whether they adopt it. We know they do. How fast.
I introduced the term in my peer-reviewed paper for COE-DAT’s own journal, Cyberterrorism in the Age of AI and Gaming: What NATO Must Do Now (Defence Against Terrorism Review, Vol. 1, 2026). In Ankara I put numbers on it. For three technologies I took three dates each: public release, first documented extremist use, and the first binding or cross-platform response.
| Technology | Released | First extremist use | First binding response |
|---|---|---|---|
| Cryptocurrency | Bitcoin v0.1, Jan 2009 | ISIS-linked bitcoin funding guide reported, Jul 2014 | EU Directive 2018/843 (AMLD5), May 2018 |
| Livestreaming | Facebook Live for all users, Apr 2016 | Magnanville attack broadcast on Facebook Live, Jun 2016 | Australia’s Abhorrent Violent Material Act, Apr 2019 |
| Generative AI | ChatGPT, Nov 2022 | Al-Qaeda-aligned outlet using apparent AI imagery, Jun 2023 | None binding and terrorism-specific when I checked in September 2026 |
Their clock went from 66 months to 2. Ours still runs at three to four years. They have learned to learn.
Erdal Ozkaya
Three cases are a pattern, not a law. “Effective response” is contestable in every row, so I picked the earliest binding measure each time. Later choices make our lag longer: for livestreaming, the GIFCT crisis protocol first activated in October 2019 (40 months) and the EU Terrorist Content Online Regulation applied from June 2022 (72 months). AMLD5 and the Australian Act are broader than terrorism. The crypto date marks a reported funding guide, not a traced transaction, and earlier undocumented generative AI use is possible. I would rather show the limits than have someone else find them.
Why the gap stays open
It is not because people are slow. I see three structural reasons. Consensus: policy in an alliance moves at the speed of agreement, which is a strength of the Alliance, and extremists do not wait for it. Classification: the people who see a new technique first are often not allowed to share what they see. Advisory partnerships: platforms and governments meet, exchange views and go home. In the DATR paper I argue for integration at operational level, not advisory level.
What a trust-centred approach changes
Not censorship. Protecting trust means proving what is authentic, not policing what people say. Not surveillance of young people. Every indicator below is aggregate and never profiles an individual. Not a new bureaucracy. It runs on data and bodies that already exist.
How to measure digital trust
We cannot defend what we do not measure. One indicator per trust surface, each built on sources that already publish the data:
| Surface | Indicator | Possible source |
|---|---|---|
| See (content) | Time to label or remove synthetic extremist content | Tech Against Terrorism archive |
| Talk (identity) | Takeovers and impersonations of high-trust accounts: officials, journalists, community leaders | ISD, GNET, platform transparency reports |
| Rely (institutions) | Youth confidence in online protection | National and industry youth online safety surveys |
Every one of these is a proxy, and that is fine. The point is the trend over time, not false precision. Adaptation Velocity is even simpler: three dates per technology (public release, first extremist use, first effective response) give you their lag and our lag. Track it for each new technology, every year, and publish the trend. If our lag gets shorter, the Alliance is adapting. If it gets longer, that is a finding the Alliance needs to see.
Six asks: three for COE-DAT, three for Allies and platforms
- Run an annual Adaptation Velocity tracker, published through DATR.
- Build trust-surface scenarios (deepfakes, impersonation, gaming) into courses and exercises.
- Convene platforms and researchers at operational tempo: monthly, not annually.
- Report trust indicators alongside incident counts.
- Sign official accounts and statements with verifiable provenance, for example C2PA content credentials.
- Fund trust resilience where young people are: schools, universities and gaming communities.
Provenance will not prove a fake is fake. It proves the real thing is real, which is exactly what ministries, police and armed forces need when a deepfake of one of their people starts circulating. And on the first COE-DAT ask, I made an offer from the stage that I will repeat here: I would be glad to help build the first edition of the tracker.
Frequently asked questions
What is digital trust in counter-terrorism?
Digital trust is the confidence people place in what they see online, in who they are talking to, and in the institutions meant to protect them. A trust-centred approach treats that confidence as an asset extremists attack, alongside the networks, data and infrastructure counter-terrorism already protects.
What is the Trust Surfaces model?
A model introduced by Dr Erdal Ozkaya at the NATO COE-DAT Terrorism Experts Conference 2026 in Ankara. It names three surfaces extremists exploit: See (content, what people believe is real), Talk (identity, who they think is on the other side) and Rely (institutions, who they expect to protect them).
What is Adaptation Velocity?
Adaptation Velocity is the speed at which extremists turn new technology into advantage. The term comes from Ozkaya’s 2026 paper in COE-DAT’s Defence Against Terrorism Review. It is measured with three dates per technology: public release, first documented extremist use and first effective response.
How quickly have extremists adopted new technologies?
In three documented cases, the lag from public release to first extremist use fell from 66 months for cryptocurrency to 2 months for livestreaming and 7 months for generative AI. The lag from first use to the first binding response stayed at roughly 34 to 46 months, and for generative AI no binding terrorism-specific measure existed as of September 2026.
Are gaming platforms used for terrorist recruitment?
Europol’s TE-SAT 2025 and 2026 reports say gaming platforms continue to be used for grooming and recruiting young people, and in 2024 29% of EU terrorism arrestees were aged 12 to 20. The vast majority of gamers have no link to extremism, which is why trust inside those communities is valuable to borrow.
Get in touchRead the DATR paper summary
Sources
- Ozkaya, E. (2026). Cyberterrorism in the Age of AI and Gaming: What NATO Must Do Now. Defence Against Terrorism Review, Vol. 1. COE-DAT.
- Ayad, M. (18 June 2024). CNN: The Caliphate News Network. Institute for Strategic Dialogue.
- Verma, P. (17 May 2024). ISIS supporters use AI-generated news anchors. The Washington Post. See also AI Incident Database, Incident 690.
- Tech Against Terrorism (8 November 2023). Early terrorist adoption of generative AI.
- Jarvis, C. (16 August 2024). Extremist hackers hijacking prominent social media accounts. CTInsight.
- Europol. TE-SAT 2025 and TE-SAT 2026.
- Europol (13 November 2025). Referral Action Day on gaming platforms.
- Microsoft (August 2025). Global Online Safety Survey, teens aged 13 to 17, N=7,284.
- UK DSIT and Savanta (15 July 2026). Children’s wellbeing online.
- Velocity gap dates: Bitcoin v0.1 announcement (Jan 2009); Finance Magnates (Jul 2014); Directive (EU) 2018/843; Meta Newsroom (Apr 2016); Times of Israel (Jun 2016); Australian Attorney-General’s Department, AVM Act (Apr 2019); OpenAI (Nov 2022); Tech Against Terrorism briefing (Nov 2023).
Erdal Ozkaya is a CISO, NATO cybersecurity advisor, author and keynote speaker. He writes about cyber threats, AI governance and the realities of running security in large organisations.
About Author
