The key to fighting the Islamic State group, or ISIS, in the real world may lie in watching social media.
A group of researchers has studied the online behavior of pro-ISIS groups on Europe's largest online social networking service, Russia-based VKontakte, and found some striking patterns they say can track and fight ISIS, or potentially any extreme group in the real world. They also hope that their research will help predict real-world attacks by extremist groups and contribute to better tracking for so-called lone wolf attackers, who carry out assaults alone, or aren't connected to extremist groups offline.
The team published its results in the peer-reviewed journal Science on Thursday.
Russia's VKontakte social network is very similar to Facebook. Like Facebook, anyone is allowed to create a community devoted to whatever subject they like — "the Penguins winning the Stanley Cup, or whatever else they like," said Neil Johnson, lead researcher on the study and a professor of physics at the University of Miami in Coral Gables, Florida.
But VKontakte has several features that make it a good place to study extremist behavior online. First, VKontakte is less efficient at shutting down extremist groups than Facebook. As Europe's largest social network, it has about 350 million members who speak many languages and live around the world. Also, because it is based in Russia, it has many Muslim Chechen users in the Caucasus region, which is relatively close to ISIS' power center in the Levant, and ISIS has used the network to spread propaganda among Russian speakers. The Levant can mean all the countries bordering the Mediterranean from Greece to Egypt.
They identified 196 groups on VKontakte, consisting of a total of about 108,000 members spread around the globe. These are "serious" groups, in that they are sharing information that is operational: knowledge on how to avoid drones, financing data, information on areas of unrest and so on. What is key about these groups is that they are talking about things that can be separated from mere online chatter.
"Once you have found the aggregates, you have got your hand on the pulse of the serious, global, pro-ISIS support," Johnson said.
It isn't limited to ISIS. I would like to think this is some generic way in which humans use the internet.Neil JohnsonProfessor of physics, University of Miami
Pro-ISIS groups online don't have the typical organized hierarchical structures led by individuals. They are more like "aggregates" of members that cluster together, somewhat like a school of fish in nature. Their decentralized nature is vital to understanding how they work and what kind of threat they pose.
"Among those aggregates," Johnson said, "we find there are these pro-ISIS aggregates that are exchanging things internally, that are operational, they have to do with particular designs of drones, how to avoid drones, what kind of kind of unrest is forming in certain areas, information on financing. This is the hardcore kind of material."
Johnson's team saw several striking patterns emerge from their data.
They found that the rate at which these pro-ISIS aggregates were forming accelerated in the days and months that lead up to certain attacks. Johnson's team found just such a spike in the rate of the creation of groups established right before ISIS' surprise attack on Kobane, Syria, in September 2014.
The study noted that this pattern is not unique to ISIS. In previous research, Johnson and his colleagues found that sudden and unexpected protests in Brazil during the summer of 2013 were preceded by a similar spike in the creation of online aggregates.
"If we monitor then the creation of aggregates and begin to see that rate of creation escalate, we can begin to monitor — at least it is helping us to predict — when conditions are favorable for real-world attacks. Basically, it tells us that something is brewing," he said.
Johnson likens it to a doctor who can tell that the conditions are right in a patient for heart disease, while not necessarily predicting exactly when a heart attack will strike. They cannot yet tell when or where such attacks will occur, but this coalescence of people online reliably precedes these major events in the real world. Johnson said he would like to refine the programs to track the content being shared on social media, and develop ways of pinpointing details about major events.
Shutting the groups down, or influencing their behavior, may be one way to prevent attacks in the offline world.
For example, the team also found that the aggregates tend to coalesce like schools of fish — smaller groups merge and become larger groups. By tracking these groups, anti-ISIS agents can break down the smaller ones before they grow to a more powerful size.
In fact, they need to be shut quickly. The team even worked out a formula for the ideal rate of shutdown. If the groups are not shut down fast enough, two things can happen.
Smaller groups will tend to congeal into one big aggregate, which could become far more potent. Instead of people splitting into 196 different groups, there would simply one big group, with "108,000 people across the world all talking the same thing, having the same information, sharing the same everything."
Secondly, if the rate at which the groups are fragmenting drops too far, pro-ISIS information can begin to spread virally among the remaining groups. Members from one shutdown group tend to scatter and join other groups and they carry their information with them.
The team says its system could be improved to potentially identify "lone wolves." Johnson said that it is likely that a person who is a lone wolf in real life is communicating with extremists online.
Chances are a lone wolf "was in an aggregate, will be in an aggregate and carries the knowledge of previous aggregates," he said. "There is no such thing as a lone wolf. Or rather, we can at least mathematically give an estimate of how long it has been since one has been in its last aggregate, and even — I haven't done this yet — get the trajectory of someone you observe now to be a lone wolf, in terms of likely aggregates they have passed through."
To be sure, the research drew some skepticism as to how effective the data would be in helping to stop ISIS.
"I think the paper did an outstanding job looking at VKontakte, however, I think the jury is still out on how this would apply to the fact that ISIS is a very versatile organization," said V.S. Subrahmanian, a computer scientist at the University of Maryland, in an interview with IEEE Spectrum. "They understand social media pretty well and they are not likely to be bound by the constraints of operating on just one social media platform."
Johnson expects the team has found a model that shows something fundamental about human behavior that can be used to track all sorts of extremist groups.
"It isn't limited to ISIS. I would like to think this is some generic way in which humans use the internet. That is how we do stuff on the internet, we self-organize into groups," he said.
"I think it is an attractive thing for people who have extreme views — who don't necessarily get the feedback that they need in daily life. I think this same dynamic will happen for any extreme subset of the entire population."