New Online Ecology of Adversarial Aggregates: ISIS and beyond
N.F. Johnson, M. Zheng, Y. Vorobyeva, A. Gabriel, H. Qi, N. Velasquez, P. Manrique, D. Johnson, E. Restrepo, C. Song, S. Wuchty
NNew Online Ecology of Adversarial Aggregates: ISIS and beyond
N.F. Johnson , M. Zheng , Y. Vorobyeva , A. Gabriel , H. Qi , N. Velasquez , P. Manrique , D. Johnson , E. Restrepo , C. Song and S. Wuchty Dept. of Physics, University of Miami, Coral Gables, FL 33126, USA Dept. of International Studies, University of Miami, Coral Gables, FL 33126, USA Dept. of Government, Harvard University, Cambridge, MA 02138, USA Dept. of Geography and Regional Studies, University of Miami, Coral Gables, FL 33126, USA Dept. of Computer Science, University of Miami, Coral Gables, FL 33126, U.S.A. Center for Computational Science, University of Miami, Coral Gables, FL 33126, USA
Abstract : Support for extremist entities – whether from the far right, or far left -- often manages to survive globally online despite significant external pressure, and may ultimately inspire violent acts by individuals having no obvious prior history of extremism. Examining longitudinal records of extremist online activity, we uncovered an ecology evolving on a daily timescale that drives online support, and we provide a mathematical theory that describes it. The ecology features self-organized aggregates (online groups such as on Facebook or another social media analog) that proliferate preceding the onset of recent real-world campaigns, and adopt novel adaptive mechanisms to enhance their survival. One of the predictions is that development of large, potentially potent online groups can be thwarted by targeting smaller ones. Extremist entities such as ISIS (known as Islamic State) stand to benefit from the global reach and speed of the Internet for propaganda and recruiting purposes, in ways that were unthinkable for their predecessors (1-10) . This increased connectivity may not only facilitate the formation of real-world organized groups that subsequently carry out violent attacks (e.g. the ISIS-directed attacks in Paris, November 2015) but may also inspire self-radicalized actors with no known prior history of extremism or links to extremist leadership, to operate without actually belonging to a group (e.g. the ISIS-inspired attack in San Bernardino, December 2015) (11) . Recent research has used records of attacks to help elucidate group structure in past organizations for which the Internet was not a key component (3,6,12) , the nature of attacks by lone-wolf actors (13) and the relationship between general online buzz and real-world events (14-16) . Online buzz created by individuals that casually mention ISIS or protests is insufficient to identify any long-term build up ahead of sudden real-world events (see for example Fig. S1). This leaves open the question of how support for an entity like ISIS develops online prior to any real-world group necessarily being formed, or any real-world attack perpetrated -– whether by ‘recruits’ or those simply ‘inspired’. Our datasets consist of detailed second-by-second longitudinal records of online support activity for ISIS from its 2014 development onwards and, for comparison, online civil protestors across multiple countries within the past three years following the U.S. Open Source Indicator (OSI) project (14-16) . The online Supplementary Material (SM) provides a roadmap for the paper, data descriptions and downloads. The data shows that operational pro-ISIS and protest narratives develop through self-organized online aggregates , each of which is an ad hoc group of followers of an online page created through Facebook or its global equivalents such as
ВКонтакте (17,18) . In contrast to the largely mundane chatter that may casually mention ISIS on Twitter and in aggregates focused on sport for example, pro-ISIS aggregates frequently discuss operational details such as routes for financing, technological know-how and avoiding drone strikes. We chose VKontakte for our pro-ISIS analysis as (i) pro-ISIS aggregates are shut down essentially immediately on Facebook, but not on VKontakte; (ii) it is the largest European online social networking service, with more than 350 million users; (iii) it allows multiple languages and is used worldwide; (iv) being based in Russia, it has a high concentration of users of Chechen origin focused in the Caucasus region near ISIS’ main area of influence in the Levant; (v) ISIS used it to spread propaganda among the Russian-speaking population (2) . Our methodology for identifying these pro-ISIS aggregates was as follows. We manually identified relevant narratives using hashtags in multiple languages, e.g. игиш (i.e. ISIS) дауля (i.e. dawla , meaning ‘state’) халифат (i.e. ‘Caliphate’), and traced these to underlying aggregates. The specific criterion for inclusion in the list was that the group explicitly expressed its support for ISIS, publishing ISIS-related news or propaganda and/or calling for jihad in the name of ISIS. This list was fed into software Application Programming Interfaces (APIs) that expanded it by means of automated search snowballing (Fig. S2). The expanded aggregate list was then cross-checked to eliminate false identifications. New embedded links were manually searched to identify more aggregates and hashtags. We then iterated this process until closure of the aggregate list (i.e. the search led back to aggregates that were already in the list). Although labor intensive, we were able to find closure on a daily basis in real time. A similar process was followed for the civil protest data. We uncovered 196 pro-ISIS aggregates involving 108,086 individual followers between January 1 and August 31 2015 (Fig. 1). On any given day, the total number of follows in the follower-aggregate network (i.e. total number of links that existed on that day from followers, blue nodes, into the various aggregates, red nodes, in Fig. 1 inset) ranged up to 134,857. The data provided us with bipartite graphs in which individual members belong to aggregates, but aggregates are not linked to each other except through people. This two-mode network has a highly complex temporal evolution with strong heterogeneity in both the number of follows per individual follower (i.e. the number of links emanating from a given blue node) and the number of follows per aggregate (i.e. the number of links entering a given red node, which we define as the aggregate’s size); and no obvious hierarchical structure. This suggests that the follower-aggregate dynamics are driven by self-organization. Such online support is likely a necessary but not sufficient condition for any real-world actions to subsequently take place, since many additional factors can hinder real-world execution. However Fig. 2 suggests that the online proliferation of pro-ISIS or protest aggregates can indeed act as an indicator of conditions becoming right for the onset of a real-world attack campaign or mass protests respectively. We fit the trend in the creation dates of new online aggregates (Figs. 2A-B) to a well-known organizational development curve ( ). The escalation parameter b diverges at these real-world onsets (Figs. 2C-D) and follows the same mathematical dependence 𝑇 " − 𝑡 %& as a wide class of physical phase transitions (20), with the divergence date 𝑇 " matching the actual onset almost exactly (SM). The connection to physical phase transitions again suggests self-organization is a driving factor (20) . While such a divergence will not necessarily pre-empt attacks involving only a few individuals, such as in San Bernardino or Paris, it can help indicate an alignment of favorable conditions and has the advantage that it does not rely on any real-world events having yet occurred or likely dates having being circulated through social media in advance (14-16) . The far longer lifetimes for online aggregates of protestors in Fig. 2B as compared to pro-ISIS aggregates in Fig. 2A, makes sense as predatory online shutdown pressure was far less for the civil protestors – in particular, we found no evidence of any shutdowns in Fig. 2B, in stark contrast to Fig. 2A. Figure 2D is likely smoother than 2C for the same reason. More aggressive anti-government protests such as the sudden outburst in Venezuela in February 2014 (Fig. S6) generate an intermediate case between Fig. 2A and 2B. We now develop a systems level theory of this online aggregate ecology. The aggregate size variations observed empirically were characterized by distinctive shark-fin shapes (Fig. 3A) with each shutdown of a pro-ISIS aggregate severing the links into that particular aggregate -- hence the abrupt drop. This fragmentation co-exists with self-organized coalescence by which individual followers sporadically link into existing aggregates while existing aggregates sporadically link into each other. Although each aggregate’s precise shark-fin shape will depend on its content and noticeability to external predators, Fig. 3 shows that the system-level features are captured using only this minimal coalescence-fragmentation process. At each time-step, a phenomenological probability 𝜈 coal describes the sporadic addition of 1,2,3,… etc. follows to an aggregate (coalescence of followers) whereas 𝜈 frag describes the sporadic sudden shutdown of an aggregate (fragmentation of followers). Such stochastic shutdown is realistic since the predators (e.g. government monitors, individual hackers) are largely independent entities and can only shut down aggregates that they happen to find. Larger aggregates should be more noticeable, hence we can take the probability of a particular aggregate being picked for coalescence or targeted for shutdown as proportional to the aggregate’s size (21) though this is generalizable to other algebraic forms without affecting our main findings (SM). The total number of potential follows N in the system is a sum, over all potential followers, of the maximum number of aggregates that each follower is prepared to follow. The number of follows per individual can be heterogeneous, and at any time step, not all N follows are necessarily used. Computer simulations of this coalescence-fragmentation process reproduce the ecology of shark-fin shapes of all sizes (Fig. 3B) with a power-law distribution 𝑠 %* for the time-average number of aggregates of size 𝑠 where 𝛼 = 2.5 . This is similar to the empirical value of 𝛼 = 2.33 that had high goodness-of-fit (𝑝 = 0.86) (Fig. 3C). These shark-fin dynamics are robust in that they emerge irrespective of when we examine the model’s evolution (Fig. 3B) and for any value of N as a result of the model’s self-similarity, i.e. the coalescence-fragmentation process generates the same dynamics across all aggregate sizes. Connecting to real-world ISIS activity, we note that the severity of ISIS attacks is also approximately power-law distributed with exponent 𝛼 = 2.44 and goodness-of-fit 𝑝 > 0.1 (22) . The model can be represented mathematically by the following coupled, nonlinear differential equations describing the number 𝑛 ; of pro-ISIS aggregates of size s ( 𝑠 > 1 ) over time: 𝜕𝑛 ; (𝑡)𝜕𝑡 = 𝜈 coal 𝑁 > 𝑘 𝑠 − 𝑘 𝑛 @ (𝑡)𝑛 ;%@ (𝑡) ;%&@A& − 2𝜈 coal 𝑠𝑛 ; (𝑡)𝑁 > 𝑘𝑛 @ (𝑡) B@A& − 𝜈 frag 𝑠𝑛 ; (𝑡)𝑁 (1) A detailed discussion of Eq. (1) is given in the SM. Like the data and computer simulation, solving Eq. (1) mathematically yields a power-law 𝑠 %* for the time-averaged aggregate size, with an exact exponent 𝛼 = 2.5 (see Refs. 23, 24 and SM for proof). The spatial independence of Eq. (1) is consistent with online interactions being largely independent of followers’ separation across the globe. The first term on the right describes the formation of an aggregate of size s (i.e. s follows) from a smaller one through the addition of 1,2,3,.. etc. new follows; the second describes the loss of an aggregate that coalesced with another aggregate; and the third describes the fragmentation of an aggregate of size s . 𝑛 ;A& (𝑡) is the pool of isolated (i.e. unused) follows at time t , i.e. potential ‘recruits’, with 𝑠𝑛 ; (𝑡) = 𝑁 B;A& . We take N to be reasonably slowly varying though this can be generalized (SM). Adding heterogeneity to the aggregate formation process (e.g. preference for similar or diverse follows) leaves the exponent 𝛼 = 2.5 unchanged, as do a variety of other generalizations (Table S2) (23,24) . Our theoretical model generates various mathematically rigorous yet operationally relevant predictions. First, anti-ISIS agencies can thwart development of large aggregates that are potentially far more potent (21) , by breaking up smaller ones. As shown in Fig. 3D, adding a simple cost into the model for shutting down an aggregate makes this strategy actually more effective than targeting the largest aggregates (SM). Second, if anti-ISIS agencies are insufficiently active in counter-measures and hence the overall rate at which they fragment pro-ISIS clusters becomes too small, specifically if the aggregate fragmentation rate 𝜈 frag < 𝑁 ln 𝑁 %& , then pro-ISIS support will grow exponentially fast into one super-aggregate (Fig. S11). Third, when fragmentation rates drop below a critical value 𝜈 fragcritical , the system enters a regime in which any piece of pro-ISIS material can spread globally across the pro-ISIS support network through contagion: 𝜈 fragcritical = 𝜈 coal 𝑝 𝑞 with p and q representing the probabilities of follower-to-follower transmission and follower recovery respectively ( ). To prevent diffusion of potentially dangerous material and ideas, the fragmentation rate should be greater than 𝜈 coal 𝑝 𝑞 . Fourth, any online ‘lone wolf’ actor will only truly be alone for short periods of time (of the order of weeks in Fig. 3A for example) before being attracted into one aggregate or another through coalescence. Fifth, a systems level tool emerges for detecting the future online emergence of new ISIS-like entities, which is to employ our methodology to check if a crude power-law distribution with 𝛼 near 2.5 begins to emerge for aggregate support surrounding a particular theme. At a more microscopic level, the data reveals that pro-ISIS aggregates exhibit the ability to collectively adapt in a way that can extend their lifetime and increase their maximal size (Fig. 4) despite the fact that each aggregate is an ad-hoc group of followers who likely have never met, do not know each other, and do not live in the same city or country. For the civil protests, by contrast, we detected no such adaptations and no online predatory shutdowns, adding support to the notion that the pro-ISIS adaptations are a response to their high-pressured online environment. Figures 4A-C illustrate the remarkable speed, variety and novelty of these adaptations, with 15% of aggregates exhibiting name changes; 7% exhibiting flips between online visibility (i.e. content open to any VKontakte user) and invisibility (i.e. content open only to current followers of the aggregate); and 4% exhibiting reincarnation in which an aggregate disappears completely and then re-emerges at a later time with another identity but with most (e.g. >60%) of the same followers. Such reincarnation is not known to occur in real-world ecologies of living organisms. Figure 4D confirms these adaptations tend to increase not only the maximum number of followers attracted into the aggregate (maximum size) but also its lifetime. The 0.9 value for the reincarnation lifetime can be understood as follows: Reincarnation involves the aggregate temporarily disappearing, therefore an aggregate that uses reincarnation runs a high risk of losing followers since they do not know when, and with what identity, the core follower group will re-emerge. Reincarnation hence tends to be used by aggregates that are attracting unusually high predation and would otherwise have had a much shorter lifetime. Reincarnation extends this lifetime beyond its otherwise much shorter value, but not enough to reach the value of 1 corresponding to aggregates that experience less intense shutdown pressure and hence do not employ adaptations. These observations open up the possibility to add evolutionary game theoretic features into our systems-level theory in order to explain the multiple use of particular adaptations by particular aggregates, and their decision of when to adapt. A future generalized theory could prove possible employing game theoretic ideas from ( ), for example. More generally, our findings suggest that instead of having to analyse the online activities of many millions of individual potential actors worldwide (27) , interested parties can shift their focus to aggregates of which there will typically only be a few hundred. Our approach combining automated data-mining with subject-matter expert analysis and generative model building drawn from the physical and mathematical sciences, goes beyond existing approaches to mining such online data (28-30) . While recent reports (31) suggest that the amount of explicit pro-ISIS material online may have declined since summer 2015, it is possible that there is lower detection due to novel adaptations being employed -- as in Fig. 4 but now likely more sophisticated. References and Notes:
1. M. Weiss, H. Hassan.
ISIS: Inside the Army of Terror (Regan Arts, New York, 2015). 2. BBC News. Russian students targeted as recruits by Islamic State. http://linkis.com/dmFgu (July 24, 2015) 3. P. Gill, J. Lee, K. Rethemeyer, J. Horgan, V. Asal. Lethal Connections: The Determinants of Network Connections in the Provisional Irish Republican Army, 1970-1998.
International Interactions: Empirical and Theoretical Research in International Relations , 52 (2014). 4. R. Wrangham, L. Glowacki, L. Intergroup aggression in chimpanzees and war in nomadic hunter-gatherers. Human Nature , 5 (2012). 5. J.E. Smith, S. Gavrilets, M. Mulder, P. Hooper, C. El Mouden, D. Nettle, C. Hauert, K. Hill, S. Perry, A.E. Pusey, M. van Vugt, E. Smith. Leadership in Mammalian Societies: Emergence, Distribution, Power, and Payoff. Trends in Ecology and Evolution (2015). Available online: http://dx.doi.org/10.1016/j.tree.2015.09.013 6. M. Kenney, J. Horgan, C. Horne, P. Vining, K.M. Carley, M. Bigrigg, M. Bloom, K. Braddock. Organisational Adaptation in an Activist Network: Social Networks, Leadership, and Change in al-Muhajiroun.
Applied Ergonomics
44, 739 (2013) 7. J.N. Shapiro.
The terrorist’s dilemma: Managing violent covert organizations (Princeton University Press, 2013). 8. A.M. Morgenstern, N. Velasquez, P. Manrique, Q. Hong, N. Johnson, N.F. Johnson. Modeling Political Conflict, Violence and Wars: A Survey.
American Journal of Physics , 805 (2013). 9. G. King, J. Pan, M. E. Roberts, Reverse-engineering censorship in China: randomized experimentation and participant observation. Science , 981 (2014). 10. D.J. Watts, P.S. Dodds. Influentials, Networks, and Public Opinion Formation.
Journal of Consumer Research Computational Analysis of Terrorist Groups: Lashkar-e-Taiba (Springer, New York, 2013) 13. P. Gill.
Lone Actor Terrorists: A Behavioural Analysis . (Routledge, London, 2015) 14. P. Manrique, H. Qi, A. Morgenstern, N. Velasquez, T-C. Lu, N.F. Johnson.
Context Matters: Improving the Uses of Big Data for Forecasting.
IEEE Intelligence and Security Informatics , (2013). ISBN 978-1-4673-6214-62013 15. J. Matheny. Test and evaluation in ACE and OSI IARPA (2013). Available online at: http://semanticommunity.info/@api/deki/files/21696/3-ACE_and_OSI_NIST_Brief.pdf 16. J. Cadena, G. Korkmaz, C.J. Kuhlman, A. Marathe, N. Ramakrishnan, A. Vullikanti. Forecasting Social Unrest Using Activity Cascades. PLoS ONE
Science , 81 (2011) 20. A-L. Barabasi and H.E. Stanley,
Fractal Concepts in Surface Growth (Cambridge University Press, Cambridge, 1995).
21. V. Asal, S.M. Chermak, S. Fitzgerald, J.D. Freilich. Organizational-Level Characteristics in Right-Wing Extremist Groups in the United States Over Time,
Criminal Justice Review (2016). DOI: 10.1177/0734016815626970 cjr.sagepub.com 22. S. Van Weezel, Bulletin of 16th Jan Tinbergen European Peace Science Conference, Italy 2016 23. J.C. Bohorquez, S. Gourley, A. R. Dixon, M. Spagat, N.F. Johnson. Common ecology quantifies human insurgency.
Nature , 911 (2009). 24. B. Ruszczycki, Z. Zhao, B. Burnett, N.F. Johnson. Relating the microscopic rules in coalescence-fragmentation models to the cluster-size distribution,
European Physical Journal , 289 (2009) 25. Z. Zhao, J. P. Calderon, C. Xu, G. Zhao, D. Fenn, D. Sornette, R. Crane, P.M. Hui, N.F. Johnson. Effect of social group dynamics on contagion, Phys. Rev. E , 056107 (2010) 26. M.A. Nowak. Evolutionary Dynamics: Exploring the Equations of Life (Belknap Press, New York, 2006) 27. N. Perra, A. Baronchelli, D. Mocanu, B. Goncalves, R. Pastor-Satorras, A. Vespignani. Random walks and search in time-varying networks.
Phys. Rev. Lett. , , 238701, (2012) 28. D. Koutra, D. Jin, Y. Ning, C. Faloutsos. Perseus: An Interactive Large Scale Graph Mining and Visualization Tool (DEMO) VLDB 2015, Kohala Coast, Hawaii, 2015 29. Q. Zhao, M. Erdogdu, H. He, A. Rajaraman, J. Leskovec. SEISMIC: A Self-Exciting Point Process Model for Predicting Tweet Popularity by ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) , 2015 30. A. Stanton, A. Thart, A. Jain, P. Vyas, A. Chatterjee, P. Shakarian. Mining for Causal Relationships. Available at arXiv:1508.01192v1 [cs.CY] 31. J.M. Berger and H. Perez. The Islamic State’s Diminishing Returns on Twitter. GW Program on Extremism (2016). Available at https://cchs.gwu.edu/sites/cchs.gwu.edu/files/downloads/Berger_Occasional%20Paper.pdf 32. N.F. Johnson, P. Jefferies, P.M. Hui.
Financial Market Complexity (Oxford University Press, Oxford, 2003) Chap. 5. 33. P. Manrique, P.M. Hui, N.F. Johnson. Internal character dictates transition dynamics between isolation and cohesive grouping.
Phys. Rev. E , 062803 (2015) Acknowledgments:
NFJ gratefully acknowledges partial support for preliminary work from Intelligence Advanced Research Projects Activity (IARPA) under grant D12PC00285 and recent funding under National Science Foundation (NSF) grant CNS1500250 and Air Force (AFOSR) grant 16RT0367. The views and conclusions contained herein are solely those of the authors and do not represent official policies or endorsements by any of the entities named in this paper. Figure 1.
Pro-ISIS aggregates. Horizontal bars illustrate timelines of some typical pro-ISIS aggregates. Their names are available from the authors. Each timeline starts when the aggregate appears and ends when it disappears. Inset: Snapshot of part of an aggregate-follower network on January 1, 2015 showing individual followers (blue nodes) linking to pro-ISIS aggregates (red nodes). Followers can link into as many aggregates as they wish. Aggregates emerge of all sizes, where an aggregate’s size is the number of follows linking into it. October November JanuaryDecember
Septemberaggregateindividual follower Figure 2 : Proliferation in online aggregate creation ahead of the onsets of recent real-world campaigns (red vertical lines). A and C concern the unexpected assault by ISIS on Kobane in September 2014. B and D concern the unexpected outburst of protests in Brazil in June 2013, commonly termed the ‘Brazil Winter’, which involved some violence and for which we were able to collect accurate information following the IARPA OSI program (14,15) . Horizontal bars in A and B show timelines for ( A ) pro-ISIS aggregates on VKontakte, and ( B ) protestor aggregates on Facebook in Brazil. Each horizontal bar represents one aggregate. The aggregates are stacked separately along the vertical axis. C and D : Divergence of escalation parameter b for aggregate creation (dark blue solid line) coincides with real-world onset at time 𝑇 " (vertical red line). Light blue dashed line shows theoretical form 𝑇 " − 𝑡 %& . Subsequent decrease in both curves likely occurs for system-specific reasons associated with coalition bombings starting in C and loss of public interest in D . August September October
Facebook Brazil ab June 11 th March April May June July0.40.81.20.20.61.01.4February b ( t )~1 ( T c − t ) B ISIS
September OctoberAugust B Sept. 18 th th August September October
Facebook Brazil ab June 11 th March April May June July0.40.81.20.20.61.01.4February B ISIS b ( t )~1 ( T c − t ) September OctoberAugust A Sept. 18 th th esca l a t i on p a r a m e t e r b A gg r e g a t es ( B r a z il ) Jan Mar 2013 Sep NovMay JulJan Mar 2012 Sep NovMay Jul BA Jan Mar 2011 Sep NovMay Jul
Brazil: starts June 11 th Vilayat Noxçiyçö
Книга ведет , ربكا للها , а меч помогает ربكا للها Книга ведет , ربكا للها , а меч помогает ربكا للها Λ U H I D
Вера в Аллаха сила
Ислама (c)Muvahhidun
Единомышленники
SHAMTODAY«
Минбар ат - Таухид » Камилькала ( Бывший
Избербаш )-->
Группа удалена
Anonymous Caucasus
Гражданин р . Дагестанат - Таифатуль - Мансура .books. بيرغ fi al-'Iraq wa sh-Sham
Ради довольства
Аллаха
SHAMTODAY --> cay kofeANONYMOUS MOSLIMZelim Yugra
Потомки
Ибрахима
FI SABILILLAHB o r o d a
Аль - МуваххидПраведный путь к РАЮ ! قحلا لها Мухаммад
Таухидов فينح وبأ
Rabbat Riyahu Ssalihinanonymous moslim مجنم "Millatu Ibraheem"book --> (c)Muvahhidun (
Книги ) Призыв
Ахлю - Сунны в Чечне -->
Призыв
Ахлю - Сунны к ТаухидуЕдиная
УммаЛя та h зан ... нет границ милости Всевышнего
Аллаха …djundullah1 Said Al-JannahSelefi Salih ةَّيملاسلاا ةلوَّدلا Не Важно -->
Видеозаписи - Абу Ам u наНовости Халифата pl ё tki™Anonymous Caucasus (1) Напоминание и наставления для молодежи Исламаинформ - бюро (c)Muvahhidun ( резерв )Shariatu-Robbina-Nurun Земля единобожников | نيدحولما راد public77330204 ربكأ للها Новости
Халифата : Новости
ИГШ С М SHAM SHAM SHAMIsn News«
Бойцы
Ислама »Ahly SunnaISLAMIC STATE NEWSISLAMIC STATE NEWS страх kafirov страх kafirovNews UmmaNews UmmaNews UmmaTAUHID_ ديحوت A gg r e g a t es ( I S I S ) Apr Jun Feb Apr Aug DecJun OctAug Oct Dec Feb Apr Oct DecAugJun
Kobane (ISIS): starts Sept. 18 th A B C D
Time Time E s c a l a / o n p a r a m e t e r B r a z il p r o t e s t a gg r e g a t e s P r o - I S I S a gg r e g a t e s Coali/on bombings start: Sept 27
Kobane ISIS onset: Sept 18, 2014 Brazil protest onset: June 11, 2013 Kobane: onset of ISIS aIacks
Sept 18, 2014
Brazil: onset of mass protests
June 11, 2013 June 11, 2013 Sept 18, 2014
C D Figure 3 : Size dynamics of pro-ISIS aggregates. A : Empirical size variation of pro-ISIS aggregates. Shark-fin shapes of all sizes emerge with shutdowns that are not strongly correlated. B : Similar results are predicted by our theoretical model, irrespective of whether we consider the model’s initial (left) or steady-state (right) dynamics. Here 𝑁 = 500 , however the model’s self-similar dynamics generate the same picture for any N with shark-fin shapes of all sizes. An aggregate grows by an individual linking in (i.e. size increases by 1) or by an existing aggregate linking in (i.e. size increases by >1) as shown by the color change. In B , knowledge of the theory’s microscopic dynamics allows us to denote each coalescence of a large aggregate by a color change, whereas in the empirical data A we maintain a constant color for each aggregate. C : Complementary distribution function for the observed aggregate sizes. D : Effect of intervention strategy involving dismantling smaller aggregates (SM). Using a larger N increases the vertical and horizontal scales without changing the main results (see Fig. S10). Red diamonds: 𝑠 min = 10 and 𝑠 max = 50 . Blue squares: 𝑠 min = 200 and 𝑠 max = 1000 . Time A gg r e g a t e s i z e A B
Time A gg r e g a t es o f s i z e s D attack largestaggregatesattack smalleraggregates Time A gg r e g a t e s i z e A gg r e g a t e s i z e P ( S > s ) Aggregate size s ( C α = 2.33 Empirical Aggregate size s ( Figure 4 : Evolutionary adaptations.
A-C : Sample of pro-ISIS aggregate timelines showing evolutionary adaptations (shown by switches in colors) that tend to increase an aggregate’s maximum attained size and extend its lifetime ( D ). Time measured in days from January 1, 2015. In A , the switch in colors within a given timeline indicates a switch in aggregate name. B : dark blue means aggregate is visible (i.e. content open to any VKontakte user) while light blue means invisible (i.e. content open only to current followers of the aggregate). C : aggregate has a specific initial identity (orange), then disappears from the Internet for an extended time (white), then reappears with another identity shown by switch in color. D : relative maximum aggregate size and relative lifetime for particular adaptations and their combinations, given as average values relative to the values for aggregates employing no adaptation. ‘All’ corresponds to aggregates that use name-change, invisibility and reincarnation. See text for explanation of (0.9) entry. visibleinvisible P r o - I S I S a gg r e g a t es InvisibilityReincarnation AD days Adaptation Aggregate
Rel. max. size Rel. life timeNone
All
Name change
Invisibility