HACKING THREAT IN ARAB CYBERSPACE: APPRAISAL ANALYSIS ON AL-HAKIRZ AL-MUSLIMUN ’S HACKTIVISM NARRATIVES

This research aims to describe the negotiation of the attitude of the hacker group زركاهلا نوملسملا (al-h ā kirz al-muslim ū n) 'Muslim hackers' (MH) in the narrative of their hacking threats to the governments of Sweden, Australia and Israel. A descriptive-explanatory design was applied by taking three hacking threat videos on the YouTube channel "Hacker News" as a data source. Data collection was carried out through the stages of transcription, re-reading, printing


INTRODUCTION
Throughout early 2023, the Arab cyber world was shocked by the emergence of a group of hackers who called themselves ‫الهاكرز‬ ‫المسلمون‬ (al-hākirz al-muslimūn) 'Muslim hackers'.Through the YouTube channel "Hacker News", this group, hereinafter referred to as "MH", carries out hacktivism, modern digital activism which aims to put political pressure on certain parties (George & Leidner, 2019;Gönç, 2022;Levet, 2023;Svyrydenko & Mozgin, 2022).MH took action in response to negative sentiment and behavior towards the Islamic religion.In the videos they published in January, March, and April, MH condemned the burning of the Koran in Sweden, the insulting of Allah's name by a fashion brand in Australia, and the Israeli army's violence against worshipers praying at the al-Aqsa mosque Palestine (News, 2023b(News, , 2023c(News, , 2023a)).By posing the threat of hacking these countries' strategic digital infrastructure, MH broke through the rigidity of traditional digital activism in the Arab cyber world which previously only focused on the distribution of issues on the internet and mass mobilization in the field (Abbas et al., 2022;Dumitrica & Felt, 2020;Ireland, 2022;Jacky & Sadewo, 2023).
In the historicity of conflicts in several Middle Eastern countries, user threat narratives in Arab cyberspace can be found on various social media platforms (Hamanaka, 2020;Harmatiy et al., 2021;Josua & Edel, 2021;Piazza & Guler, 2021).A large number of users who associate themselves with pro-Islam strongly oppose negative sentiments and physical violence committed against Muslims in the world (Al-Zaman, 2023;Dugan & Fisher, 2023;Lien, 2022).The Israeli army brigade and the occupation of the al-Aqsa mosque are examples of actions that triggered a strong and massive response so that internet users issued many condemnations and threats (Abushbak & Majeed, 2020;Amer, 2023;El-Awaisi & Sağlam, 2023;Maryoga & El Fasha, 2022).Another example is the Israeli army's attack on the al-Aqsa mosque in the month of Ramadan 2021.This act of violence which resulted in the loss of many victims attracted insults from social media users containing expressions of anger and the use of impolite language (Faisol & Rahmat, 2021a, 2021b).
Threat narratives from internet users also spread massively across various platforms in response to actions deemed insulting to the Islamic religion.Study of Tabib (2022) showed the great anger of pro-Islam groups over the burning of the Koran carried out by Terry Jones, a pastor in Florida.Not a few internet users even threatened to kill him.The same reaction also emerged in the publication of caricatures of the prophet Muhammad on Jyllands-Posten and Charlie Hebdo.Internet users staged large-scale protests on social media and held demonstrations in various countries (Grinell, 2019;Kabir, 2021;Kazkaz & Bosch, 2023;Tudor & Ladjouzi, 2020).Digital traces even record the involvement of governments in various countries in protesting against the films Fitna and Innocence of Muslims.These two films are considered an outrageous insult to the prophet Muhammad and the Islamic religion.Insults and threats on various social media platforms cannot be stopped in response to these extreme actions (Hussain et al., 2022;Iqbal et al., 2020;Yilmaz et al., 2022).
Substantively, the hacking threat narrative conveyed by HM is the same as various threat narratives on social media revealed by previous studies.The trigger for the emergence of the HM hacking threat narrative is also the same as previous threats, namely harassment and acts of violence against Islam.However, apart from that, the hacking threat narrative has differences in terms of form.The threats in previous studies were conveyed sporadically in the form of polylogues by internet users.Meanwhile, the threat of HM hacking is conveyed in the form of a complete narrative that is structured and systematic.From a perspective aspect, previous studies have described aspects of form, function, meaning, value, and ideology implicit in the threat of pro-Islamic internet users on various social media platforms.Even though they have described the elements of language comprehensively, the author has not found any studies that emphasize the attitudes and stances of these users in the threat narratives they spread.This empty gap needs to be filled through academic studies to obtain the latest findings in the threat research landscape on social media.
To fill the gap in this study, this research examined MH's negotiation of attitudes as represented through his hacking threats.Based on the context of the data, the attitude in question is the attitude towards harassment and acts of violence against Islam.The investigation into MH's attitude which was carried out by referring to appraisal theory (J.R. Martin & Rose, 2007;J.R. Martin & White, 2005) was formulated into the following three research questions: 1) what types of attitudes are represented by MH in the hacking threat narrative?2) what is MH's strategy in amplifying their expressions and statements in the hacking threat narrative?3) what are the sources of MH's statement in the hacking threat narrative?The answers to these three research questions described HM's attitudes and stance in the hacking threat narrative they convey.By obtaining these answers, the research findings provided a new perspective in the landscape of studying the language of threats from pro-Islamic groups on social media.The findings is a novelty that contributes to the dynamics of previous relevant studies.

RESEARCH METHOD Research Design and Data Sources
Systematic work stages to answer research questions are designed in qualitativeexplanatory construction (Alharahsheh & Pius, 2020;Aspers & Corte, 2019, 2021).Research data in the form of videos of MH hacking threats were taken from the Hacker News YouTube channel (https://www.youtube.com/@HackerNewsAR/about),a forum for publishing videos of hacking activities carried out by various hacker groups.From dozens of videos featuring various hacker groups all over the world, researchers selected three videos featuring the MH hacker group.Details of the three data source videos can be seen in the Table 1 below.

Data Collection
Data collection was carried out through four stages consisting of transcription, rereading, printing, and classification.Data transcription was carried out manually by paying attention to the narrative pronunciation in the video and the running text accompanying the pronunciation.In the transcription process, reference to audio data and running text also becomes a research data validation technique (Craig et al., 2021;Eaton et al., 2019;Phillippi & Lauderdale, 2020).Re-reading of data is carried out by verifying words, phrases, and clauses that have been transcribed repeatedly.Data from repeated readings was reverified through comparison with audio and video narrative text, resulting in final data.In the next stage, researchers printed the final data to simplify the classification process.Classification is the final stage of data collection.This stage begins by grouping the data according to the theoretical framework and appraisal analysis features.The data is then tabulated according to group and coded.The data classification stage ends with an inventory of each data on a data card containing keywords as a guide to data analysis (Lochmiller, 2021;Ningi, 2022).

Data Analysis
The final data listed on the data card was analysed through stages adopted and adapted from Antonio et al. (2020), Lester et al. (2020), Mezmir (2020), and Ningi (2022) consisting of reduction, presentation, analysis and interpretation, and concluding.Data reduction is carried out by selecting certain data as a representation that will be displayed in the analysis.At this stage, the researcher ensures that every variation in the data will be displayed as a representation.The data presentation stage begins with transliteration of the original Arabic script data into Latin script.In carrying out the transliteration, the researcher referred to the romanization guidelines published by American Library Association-Library of Congress.Thus, each data is presented in three forms: original Arabic data; transliteration data; and English translation data.In the next stage, the data displayed is analysed and interpreted.Analysis based on lingual elements in the data was carried out according to the theoretical framework and features of appraisal analysis.Meanwhile, interpretation is carried out by elaborating on the findings of the analysis and comparing them with the results of previous studies.In concluding the final stage, the researcher confirms the answers to the research questions and exposes the novelty points in the findings.
To answer the research questions and objectives, data analysis refers to the theoretical framework and features of appraisal analysis proposed by J.R. Martin & Rose (2007), J.R. Martin & White (2005) James R Martin (2014).Appraisal is an interpersonal meaning system used to negotiate social relationships by representing attitudes towards something (J.R. Martin & Rose, 2007; J.R. Martin & White, 2005;Matthiessen et al., 2010).In the appraisal system, attitude negotiation is implemented in the form of an assessment of something, how the assessment is amplified, and where the assessment comes from.The implementation of this assessment gives rise to three aspects of assessment consisting of attitudes, amplification, and resources, each of which can be carried out through the attitudinal, graduation, and engagement systems (J.R. Martin & Rose, 2007; J.R. Martin & White, 2005).The attitudinal system consists of an assessment of feelings (affect), a person's character (judgment), and the value of an object (appreciation).The graduation system consists of strategies to increase or decrease the intensity of assessment (force) or sharpen and weaken experiential categories (focus).Meanwhile, the engagement system explains whether the assessment originates from the speaker's subjectivity (monogloss) or intersubjectivity which involves things other than the speaker (heterogloss).The application of the theoretical framework and analysis features to answer research questions can be seen in the Table 2.

RESEARCH FINDINGS AND DISCUSSION Research Findings
By the appraisal analysis framework, the results of the study of HM's hacking threat narrative are classified into three parts: types of attitudes; strategies for amplifying attitudes; and sources of attitudes.

Types of Attitudes
Attitude in the MH threat narrative is quantitatively dominated by Judgment (38.6%) and Appreciation (36.4%).Apart from that, MH expressed an affect of as much as 25.0%.Details of the number of each type of attitude along with positive and negative tendencies are shown in the following Table 3.

Affect
The narrative of the MH hacking threat contains an entirely negative affect.In their narrative, MH not only expressed their feelings but also those of several other parties such as the governments of Israel, Sweden, and Australia.Examples of effect can be seen in the following data.

A.4
‫مدى‬ ‫يبين‬ ‫وحقد‬ ‫همجية‬ ‫اإلسالم‬ ‫على‬ ‫السويدية‬ ‫السلطان‬ yubayyinu madā hamajiyyah wa ḥaqd al-sulṭān al-swīdiyah 'alā al-islām 'show the extent of the Swedish authorities barbarism and hatried against Islam' A.6 ‫أن‬ ‫ونريد‬ ‫نذكركم‬ ‫فعل‬ ‫ردة‬ ‫فعل‬ ‫لكل‬ ‫أن‬ wa nurīdu an nudhakkirakum anna likulli fi'l raddah fi'l 'we want to remind you that for every action there is a reaction' Data A.4 above shows MH's assessment of the Swedish king's hatred of Islam.MH expresses this feeling of hatred directly through the phrase ‫همجية‬ ‫وحقد‬ (hamajiyah wa ḥaqd) 'barbarism and hatred'.Referring to the context of the data, the hatred of the King of Sweden is illustrated through his permissive attitude towards acts of racism committed by Rasmus Paludan.MH further assessed that there was barbarism because the Swedish king not only permitted the action of burning the Koran by Rasmus Paludan but more than also protected this action based on citizens' freedom of expression.In response to the hatred and barbarism of the Swedish king, MH expressed their anger in data A.9. Feelings of anger are represented through the clause ‫نريد‬ ‫أن‬ ‫نذكركم‬ (nurīdu a nudhakkirakum) 'we want to remind you' which has a threatening function.The data context shows that this expression became the basis for MH's narrative in constructing the narrative of the hacking threat to the Swedish king.As a form of negative affect, angry expressions with a dominant threatening function were found in all three data sources.

Judgment
MH provides many justifications for the morals and personalities of the people they mention in the narrative.All of HM's negative justifications were given to the Israeli army, the Israeli government, Rasmus Paludan, the Swedish government, and the Australian government.Examples of these judgments are shown in the following data.‫يفرقوا‬ ‫لم‬ ‫كبير...‬ ‫شيخ‬ ‫أو‬ ‫شاب‬ ‫امرأة‬ ‫أو‬ ‫رجل‬ ‫بين‬ lam yufarriqū bayna rajul aw imra'ah shāb aw shaykh kabīr… 'They did not differentiate between a man or a woman, young people or old people…' Data A.5 above contains negative judgment in the form of moral condemnation regarding the action of burning the Koran carried out by Rasmus Paludan in Sweden.MH criticized the moral character of this action through the adjective phrase ‫أخالق‬ ‫ومستوى‬ ‫حضاري‬ ‫متدني‬ (akhlāq wa mustawā ḥaḍarī mutadannī) 'low level of morals and civilization'.This justification is the result of Rasmus Paludan's actions which are considered racism and negative sentiment towards Islam.In their assessment, MH positions racism as a form of primitive conception that describes the low level of human morals and civilization.In contrast to data A.5, data C.2 represents negative judgment in the form of personal criticism directed at Israeli Zionist soldiers.Data A.9 has a context in the form of MH's criticism of the Israeli army's attack on the prayer congregation at the al-Aqsa mosque.The brutality of the Israeli army's attacks is expressed through the clause ‫لم‬ ‫يفرقوا‬ (lam yufarriqu) 'does not discriminate' which indicates sporadic attacks against all worshipers.They do not differentiate between ‫رجل‬ ‫أو‬ ‫امرأة‬ (rajul aw imra'ah) 'men and women' and ‫شاب‬ ‫أو‬ ‫شيخ‬ ‫كبير‬ (shāb aw shaykh kabīr) 'young people or old people' who ethically must be treated differently in war.

Appreciation
Appreciation is the only Attitude element that contains positive value in the MH hacking threat narrative.By the object of analysis in the form of 'things', MH gives value to the things they convey in their narratives.Several examples of appreciation can be seen in the following data.The data above represents positive and negative appreciation.The positive intentions that were only found in appreciation were directed at Islamic sacred symbols ‫المسجد‬ ‫األقصى‬ (almasjid al-Aqsā) 'al-Aqsa mosque' in data C.1 and ‫األرض‬ (al-arḍ ) 'land of Jerusalem' in data C.7. MH gives positive value through the adjective ‫المبارك‬ (al-mubārak) 'blessed' for the al-Aqsa mosque and ‫المقدسة‬ (al-muqaddasah) 'holy' for the land of Jerusalem which is the object of dispute between Palestine and Israel.This appreciation in the form of positive values strengthens the impression of the two symbols as vital elements of Muslim religiosity.Thus, it is not surprising that acts of violence involving these two symbols would trigger a strong reaction from MH.Meanwhile, in data B.6, MH gave appreciation in the form of a negative value for the counterattack they would carry out.They will carry out hacking as a resistance that is ‫قاس‬ (qās) 'hard', ‫مؤلم‬ (muallam) 'painful', and ‫مكلف‬ (mukallaf) 'severe'.The context of the data shows that the threat narrative is aimed at the Australian government which is considered to have insulted Islam.In another part of the same narrative, MH emphasizes this negative value by explaining in detail the object of hacking in the form of the entire government's strategic digital infrastructure.

Strategies for Amplifying Attitudes
The augmentation of attitudes within the narrative concerning the hacking threat in MH domain predominantly manifests through forceful expressions, constituting a substantial 95.2% of the overall amplification strategies identified.This dominance underscores the prevalence of heightened intensity and assertiveness in the narrative discourse, indicative of a pronounced volume increase.Conversely, a distinct and contrasting form of amplification, representing a mere 4.8% of the focus dimension, was observed, characterized by a softening scale.This nuanced softening stands in stark contrast to the prevalent forceful expressions, suggesting a divergent rhetorical approach aimed at attenuating the perceived severity or urgency of the hacking threat within the MH context.For a comprehensive understanding of the distribution and frequency of these amplification strategies, Table 4 provides a detailed breakdown of the data, delineating the occurrences of forceful and softening expressions.This tabulated representation facilitates a quantitative analysis, allowing for a clearer visualization of the prevalence and balance between these contrasting rhetorical approaches.The identification and scrutiny of these amplification strategies contribute to a nuanced comprehension of how attitudes are strategically framed and intensified or softened within the discourse, thereby shedding light on the rhetorical dynamics employed in shaping perceptions of the hacking threat within the mental health narrative.Force MH tends to evaluate feelings, character, and values on a strong scale.They volume up all forms of assessment, so that the level of assessment is always at the highest level.Examples of strengthening these attitudes can be seen in the following data.

C.10
‫جدا‬ ‫قاس‬ ‫الرد‬ ‫سيكون‬ sayakūnu al-radd qās jiddan 'the reaction will be very harsh' C.17 ‫كوابيسكم‬ ‫أسوأ‬ ‫وستتحقق‬ Wa satataḥaqqaqu aswa'a kawābīsikum 'your worst nightmares will come true' Data C.10 and C.17 above reflect MH's firm feelings in assessing various realities in the narrative they construct.Both data contain an intensifier that shows a 'volume up' gradient at the points evaluated.In data C.10, MH uses a superlative intensifier in the form of the  ‫المسلمين‬ ‫كافة‬ ‫لمشاعر‬ ‫مستفز‬ ‫عمل‬ ‫في‬ fi 'amal mustafiz li mashā'ir kāffah al-muslimīn 'In an action that provokers the feelings of the Muslims' Data C.11 and A.3 above show the high level of MH's subjectivity as a narrator of hacking threats.In negotiating their attitudes, MH only uses their subjective personal sources as creators, speakers, and disseminators of narratives.They do not mention information from outside their subjective personality, even when discussing the effects of other objects that are outside of them.For example, in data C.11, MH expresses his subjective knowledge about Israel.They explicitly mentioned ‫نحن‬ ‫نعلم‬ (nahnu na'lam) 'we know' the strategic dimensions which are the weaknesses of the Israeli government.MH did not strengthen this argument by citing other sources outside his knowledge.The same thing can also be seen in data A.3, expressing HM's knowledge about Muslim feelings.In arguing their position, HM represents the feelings of all Muslims who are provoked by the harassment of Islam in Australia.In this context, HM also positions themselves as monogloss actors who do not take their attitude sources from objects outside themselves.

Discussion
Descriptive statistics showed that MHs were more likely to provide justifications for people's characters and assessments of the things they mentioned in narratives than to express feelings.This finding means that the MH hacking threat narrative is propaganda about the others, which in this case are the Swedish government, the Australian government, and the Israeli government.From the dimensions of judgment and appreciation, the intentions and tendencies of evaluation of the governments of the three countries can be seen from the form and intensity of expression, where all assessments are expressed directly and contain negative intentions.Based on the principles put forward by J.R. Martin & Rose (2007), J.R. Martin & White (2005), the direct form of expression implies the assessor's desire for the audience to believe the assessment points he or she has given.MH, in this context, is persuading the audience to join in condemning the actions and government they are threatening.However, MH did not mobilize the audience to take action in the field.It is because hacking as modern digital activism can only be carried out by experts in the field of communications technology.
MH's negative propaganda against the governments of Sweden, Australia, and Israel was strengthened by strategies to amplify their attitudes.The use of the force strategy on 95% of the data containing the 'volume up' graduation to the highest level shows how bad MH's assessment of the three governments is.MH uses a focus strategy on 5% of the data.This strategy was not used to weaken negative assessments of the Swedish government, but rather to weaken the potential for positive assessments of the government.The results of the analysis on the dimensions of this amplification strategy have become a sufficient database to conclude MH's attitude and stance towards the parties they mentioned in the hacking threat narrative.MH has an attitude and stance that is very contradictory to those who commit violence against Muslims and insult the Islamic religion.On the other hand, MH has a completely pro-Islamic attitude and stance, where they do not hesitate to react strongly if Islamic religious elements are treated negatively.
MH's negative propaganda against the governments of Sweden, Australia, and Israel was strengthened by strategies to amplify their attitudes.The use of the force strategy on 95% of the data containing the 'volume up' MH shows strong confidence in their attitudes and stance.This can be seen from the type of attitude sources they use in assessing.All assessments are carried out based on monogloss sources, where MH is the sole inspirer, initiator, and driving force in all assessment processes.Based on the arguments of (J.R. Martin & Rose (2007) and J.R. Martin & White (2005), the monoglots reference on the one hand shows the assessor's subjectivity.However, on the other hand, this also shows the assessors' confidence that they have a good grasp of reality and can express their attitudes independently.This argument is relevant about MH's identity as a hacker group.Anonymity as one of their characteristics gives them dynamic space: unrecognized and able to act without burden.Apart from that, their expertise in hacking technological devices should also position them as an entity that knows many things, so they do not depend on other parties to obtain information.
Substantively, the MH hacking threat narrative strengthens previous research findings which show that pro-Islam internet users' reactions to sentiment and violence against Islam tend to be realized in the form of verbal threats (Dugan & Fisher, 2023;EL-AWAİSİ & SAĞLAM, 2023;Faisol & Rahmat, 2021a, 2021b;Lien, 2022).However, MH's narrative formally presents new findings that have not been revealed by previous studies (Hamanaka, 2020;Harmatiy et al., 2021;Josua & Edel, 2021;Piazza & Guler, 2021).MH negotiated their stance clearly and firmly in the hacking threat narrative they conveyed.This attitude was effectively amplified to increase the effect of fear on the object.This new finding emerged because MH's narrative existed in a complete and systematic format.They succeeded in empowering macro and micro scale lingual units as instruments to express clarity of attitude and stance.Similar attitudes and stances cannot be found in previous studies due to the data format which is mostly in the form of polylogues and single discourses.Apart from that, previous threats from internet users also mostly took the form of short criticisms that were distributed sporadically, making it difficult to read using appraisal analysis (Abushbak & Majeed, 2020;Kazkaz & Bosch, 2023;Maryoga & El Fasha, 2022).
The hacktivism narrative conveyed by MH introduces a new form of digital activism that is constructed and systematized in a more modern way.The hacktivism narrative will have more impact than traditional digital activism due to the heavier psychological effect on the target of the threat.MH understands the government's mentality well, where protests through demonstrations can always be anticipated and suppressed through various repressive measures.A different psychological condition will arise if the threat posed is hacking of the country's strategic digital infrastructure which can cause damage to structured and systemic governance.This is because almost all state administration activities are carried out using digital technology instruments.Thus, the threat of hacking against various digital facilities can exert greater political pressure than large-scale demonstrations mobilized in the streets.

CONCLUSION
Based on the research findings that have been presented, the author concludes that MH has a strong attitude and stance in opposing acts of harassment of Islam carried out by Swedish citizens, Australian trademarks, and Israeli soldiers.Through the hacking threat narrative, they negotiate this attitude directly as a form of negative propaganda aimed at persuading the audience and exerting political pressure on the objects of the threat, namely the governments of Sweden, Australia, and Israel.Even though it has explained the negotiation of attitudes in the MH hacking threat narrative, this research still has limitations.Among these limitations is the relatively small amount of data.This is an opportunity for further research to expand the scope of analysis by adding data from other media.Another limitation is the approach that focuses on one analytical perspective, namely appraisal.Appraisal is one of the theories constructed in functional systemic linguistic theory.In future opportunities, future researchers can apply other analytical perspectives, such as formal, dialectical, or critical to analyze the MH hacking threat narrative.

Table 2
Application of theoretical framework and analysis features

Table 3
Frequency and Percentage of the types of attitudes

Table 6
Frequency and percentage of the sources of attitudes