"Fake jihadi" Joshua Goldberg had numerous online alter egos, allegedly including the Twitter handle AustraliWitness. Digita says the group came together after the Charlie Hebdo massacre in Paris in January, having seen IS's aggressive use of social media to promote its agenda. "We knew we had the right skills that could be applied to help with disrupting propaganda, and perhaps even to help detect communications about real plots," Digita says, via email. "We thought all of that may help save lives – and it has." The group targets websites and infiltrates jihadi networks, often using Arabic translators to identify the level of threat. GSG works closely with CtrlSec group, which focuses on identifying suspect social media accounts. Once satisfied of an extremist link, they tweet the account name, encouraging followers to report it to Twitter for removal. Fairfax Media can reveal that GSG played a previously unreported role in events ahead of the arrest of "fake" jihadist Joshua Goldberg, a 20-year-old man taken into custody in September in Florida and charged with sending bomb-making information to an FBI informant. US authorities started monitoring AustraliWitness, Goldberg's alleged online persona, after AustraliWitness called for an attack on a Texas event in May where cartoons of the prophet Muhammad were being drawn. Two gunmen were shot dead there by police.

Video posted on youtube of an Anonymous member in a Guy Fawkes mask in front of the group's flag. Credit:Justin McManus In a June 9 online post, someone using the alias AustraliWitness boasted of inspiring the Texas attack and said he was a Lebanese refugee living in Perth. He described himself as a supporter of the Islamic State. He also said he'd convinced "mujahideen" in Los Angeles and Melbourne to attack synagogues in the cities. "I helped them every step of the way [in the concept]," he wrote. GSG collectors saw the post on a social media account used to encourage terrorism. They sent a link to the post to Michael S. Smith II, a founder of US firm Kronos Advisory and a counter-terrorism​ adviser to members of the United States Congress. He acts as a conduit between GSG and US authorities. Smith had been initially unsure what to make of GSG. He added, "However, from feedback I have received from federal officials in the US, I know counter-terrorism​ practitioners in the US government and their counterparts abroad have found data provided by [GSG] to be very useful. They are indeed helping officials identify, monitor and disrupt terrorist activities, both online and off." (An AFP spokesperson declined to comment on the group's activities, on operational or intelligence matters and police methodology.)

Fairfax Media can reveal that GSG played a previously unreported role in events ahead of the arrest of "fake" jihadist Joshua Goldberg, a 20-year-old man taken into custody in September in Florida and charged with sending bomb-making information to an FBI informant. A manager of the social media account on which the AustraliWitness post had been made was, unwittingly, communicating with an undercover GSG operative. The two continued chatting via Surespot, an encrypted instant messaging app, on which the individual – now believed to have been Goldberg – complained a Melbourne jihadi was dragging his feet on an attack plot in the city. Eventually, GSG infiltrated the social media account Goldberg is believed to have managed. The group was then able to identify the physical location in Florida for the IP address associated with the account's activity, according to Smith. "Fortunately, federal authorities had already linked the account and this IP address," Smith noted. Smith believes there's "sufficient evidence" to tie the AustraliWitness post to Goldberg, but is careful to point out that US prosecutors have to prove that Goldberg was responsible for this and other alarming posts attributed to AustraliWitness. Goldberg is suspected of a number of other online hoaxes.

In correspondence with Fairfax Media cited in the FBI affidavit, Goldberg allegedly said he was thought he was addressing "keyboard warriors" – in other words, people who are all talk and no action. But Smith believes IS sympathisers could have been motivated to commit acts of terror via messages like the one posted on June 9. "Cheerleaders are valued by jihadi groups, too," Smith said. He forwarded the information gathered by GSG to multiple US government agencies. Investigations by the Australian Federal Police in June 2015 found "no initial threat" to the Australian community. GSG's activities have certainly riled Islamic State supporters. A representative of the Islamic State Hacking Division told the Blaze website in August that the group had "hacked nothing" and was "all talk". Members believe the person was British jihadist Junaid Hussain, who was killed in a US drone strike in Syria that month. An online post dated September 17 called them "independent cyber punks and hooligans". A screengrab of the group's website was attached, listing 10 Twitter handles of the core members with the message: "Block these Kuffar [unbelievers]!" Smith confirmed that GSG helped stop an alleged plot this July to attack a marketplace in Djerba, Tunisia. One of the group's operatives uncovered a militant account citing threats against British and Jewish tourists in the town that also mentioned suicide bombings, said Digita.

The group took the threat seriously – the account was linked to other high-profile IS accounts – and began looking for events in the area where casualties could be maximised. The Houmt Souk open market that day was a well-known tourist attraction, and two churches in the immediate area were also holding services. GSG gathered evidence, including social media account names, screenshots, images and maps, sending them to Smith who forwarded them to authorities. Seventeen arrests were made in connection to the alleged plot. "Our prime focus is to help officials stop attacks before they can be executed," said Digita, who claims to work 16 hours a day, seven days a week. GSG's core members need an independent income and almost round-the-clock availability. They are sent pictures of murdered people and daily death threats. Very few people in their lives know much about the full extent of their efforts, or the impact of their work, they say. Digita said, "When you have the ability to save someone's life – to prevent a terrorist attack or a recruitment of a young person by a group like the Islamic State – we believe it is your responsibility to do so, regardless of how you will be rewarded ...

"But when your life is ending, would you be at peace if you had the ability to save lives, but you chose not to because you put your financial interests above someone else's security?"