Pro-ISIS groups online don't have the typical organized hierarchical structures led by individuals. They are more like "aggregates" of members that cluster together, somewhat like a school of fish in nature. Their decentralized nature is vital to understanding how they work and what kind of threat they pose.
"Among those aggregates," Johnson said, "we find there are these pro-ISIS aggregates that are exchanging things internally, that are operational, they have to do with particular designs of drones, how to avoid drones, what kind of kind of unrest is forming in certain areas, information on financing. This is the hardcore kind of material."
Johnson's team saw several striking patterns emerge from their data.
They found that the rate at which these pro-ISIS aggregates were forming accelerated in the days and months that lead up to certain attacks. Johnson's team found just such a spike in the rate of the creation of groups established right before ISIS' surprise attack on Kobane, Syria, in September 2014.
The study noted that this pattern is not unique to ISIS. In previous research, Johnson and his colleagues found that sudden and unexpected protests in Brazil during the summer of 2013 were preceded by a similar spike in the creation of online aggregates.
"If we monitor then the creation of aggregates and begin to see that rate of creation escalate, we can begin to monitor — at least it is helping us to predict — when conditions are favorable for real-world attacks. Basically, it tells us that something is brewing," he said.
Johnson likens it to a doctor who can tell that the conditions are right in a patient for heart disease, while not necessarily predicting exactly when a heart attack will strike. They cannot yet tell when or where such attacks will occur, but this coalescence of people online reliably precedes these major events in the real world. Johnson said he would like to refine the programs to track the content being shared on social media, and develop ways of pinpointing details about major events.
Shutting the groups down, or influencing their behavior, may be one way to prevent attacks in the offline world.
For example, the team also found that the aggregates tend to coalesce like schools of fish — smaller groups merge and become larger groups. By tracking these groups, anti-ISIS agents can break down the smaller ones before they grow to a more powerful size.
In fact, they need to be shut quickly. The team even worked out a formula for the ideal rate of shutdown. If the groups are not shut down fast enough, two things can happen.
Smaller groups will tend to congeal into one big aggregate, which could become far more potent. Instead of people splitting into 196 different groups, there would simply one big group, with "108,000 people across the world all talking the same thing, having the same information, sharing the same everything."
Secondly, if the rate at which the groups are fragmenting drops too far, pro-ISIS information can begin to spread virally among the remaining groups. Members from one shutdown group tend to scatter and join other groups and they carry their information with them.
The team says its system could be improved to potentially identify "lone wolves." Johnson said that it is likely that a person who is a lone wolf in real life is communicating with extremists online.
Chances are a lone wolf "was in an aggregate, will be in an aggregate and carries the knowledge of previous aggregates," he said. "There is no such thing as a lone wolf. Or rather, we can at least mathematically give an estimate of how long it has been since one has been in its last aggregate, and even — I haven't done this yet — get the trajectory of someone you observe now to be a lone wolf, in terms of likely aggregates they have passed through."
To be sure, the research drew some skepticism as to how effective the data would be in helping to stop ISIS.
"I think the paper did an outstanding job looking at VKontakte, however, I think the jury is still out on how this would apply to the fact that ISIS is a very versatile organization," said V.S. Subrahmanian, a computer scientist at the University of Maryland, in an interview with IEEE Spectrum. "They understand social media pretty well and they are not likely to be bound by the constraints of operating on just one social media platform."
Johnson expects the team has found a model that shows something fundamental about human behavior that can be used to track all sorts of extremist groups.
"It isn't limited to ISIS. I would like to think this is some generic way in which humans use the internet. That is how we do stuff on the internet, we self-organize into groups," he said.
"I think it is an attractive thing for people who have extreme views — who don't necessarily get the feedback that they need in daily life. I think this same dynamic will happen for any extreme subset of the entire population."