Monitoring online groups offers insight into ISIS attacks

Social media supporters of the Islamic State, or ISIS, form online groups that may provide clues crucial to predicting when terrorist attacks will take place, a new analysis finds.

These virtual communities drive ISIS activity on a Facebook-like site called VKontakte, say physicist Neil Johnson of the University of Miami in Coral Gables, Fla., and colleagues. VKontakte, a social networking service based in Russia with more than 350 million users, allows messaging in many languages and is used worldwide.

In the June 17 Science, Johnson’s team describes a mathematical model that predicts online groups of ISIS supporters will proliferate days before real-world Islamic State attacks. That’s just what happened in September 2014, researchers say. Pro-ISIS groups on VKontakte mushroomed the day before Islamic State forces overran Kobane, a small Syrian town.

The researchers refer to groups of followers of an online page that form spontaneously as aggregates. “Our work suggests that, to manage and monitor online ISIS activity, we need to focus on aggregates rather than individuals,” Johnson says.

Pro-ISIS aggregates on VKontakte exchanged information on issues such as recruiting fighters to Syria and how to survive drone attacks.

The new model suggests that authorities need to shut down online pro-ISIS groups in their early stages. Small-scale aggregates favoring the same cause gradually expand when left alone and eventually merge into a much larger online community that’s more difficult to break up, Johnson’s model forecasts.

“This is the first serious, large-scale, data-driven study that shows how online support develops for terrorist groups such as ISIS,” says computer scientist V.S. Subrahmanian of the University of Maryland in College Park, who builds computational models of terror networks. But it remains to be seen whether the new model can predict when and possibly where future Islamic State attacks will occur, Subrahmanian cautions.

Johnson’s team identified 196 pro-ISIS aggregates, consisting of 108,086 individual followers, which operated between January 1 and August 31, 2015. Intelligence agencies, hackers and website moderators work to shut down these online groups, but to a lesser extent on VKontakte than on Facebook.

Pro-ISIS aggregates rapidly adapted to these survival threats in several ways, the researchers say. Fifteen percent of aggregates changed their online names; 7 percent flipped back and forth between opening their content to any VKontakte user or to current aggregate followers only; and 4 percent engaged in a digital form of reincarnation. Pro-ISIS aggregates under unusually intense attack by hackers and others opted for reincarnation, Johnson says.

Reincarnating aggregates disappeared and then returned, often within weeks, with new names and at least 60 percent of the same followers as before. Aggregates that vanished appear to have reassembled without any direction or urging from one or a few members, Johnson says. New names of reincarnated groups often resembled original names enough to alert former members but not enough to trigger VKontakte’s automated system for identifying names of probable pro-militant groups, he points out.

As with predictions of terror attacks based on the expansion of pro-ISIS aggregates, the new model shows promise in predicting when mass public protests will occur based on sudden jumps in numbers of pro-protest aggregates, the scientists say. There is a difference: Reincarnation did not appear within the last three years among Facebook aggregates consisting of civil protesters in Brazil and several other Latin American countries, the researchers found. Those online groups experienced fewer pressures to shut down than pro-ISIS aggregates on VKontakte did.

Johnson’s analysis moves the study of online militant groups forward, says terrorism analyst J.M. Berger of George Washington University in Washington, D.C. But it’s likely that considerably fewer members of pro-ISIS aggregates than the total studied in the new analysis were actually hard-core Islamic State supporters, Berger contends. Concerted efforts to shut down online terrorist networks have depressed numbers of committed ISIS supporters using social media, in his view. Berger and a colleague have found that English-language Twitter use has declined sharply among ISIS supporters over the last two years, due to suspensions of their accounts by the social media site.

Johnson suspects most pro-ISIS aggregate members were staunch supporters, since aggregates aggressively weed out those deemed unserious or hostile.

Terrorists use chains of social and messaging sites online to achieve their ends, Subrahmanian says. How that works, and whether the same aggregate operates under different guises from one site to the next, has yet to be studied.