Report

New online ecology of adversarial aggregates: ISIS and beyond

See allHide authors and affiliations

Science  17 Jun 2016:
Vol. 352, Issue 6292, pp. 1459-1463
DOI: 10.1126/science.aaf0675
  • Fig. 1 Pro-ISIS aggregates.

    Horizontal bars illustrate timelines of some typical pro-ISIS aggregates. Their names are available from the authors. Each timeline starts when the aggregate appears and ends when it disappears. (Inset) Snapshot of part of an aggregate-follower network on 1 January 2015 showing individual followers (blue nodes) linking to pro-ISIS aggregates (red nodes). Followers can link into as many aggregates as they wish. Aggregates emerge of all sizes, where an aggregate’s size is the number of follows linking into it.

  • Fig. 2 Proliferation in online aggregate creation before the onsets of recent real-world campaigns (red vertical lines).

    (A and C) concern the unexpected assault by ISIS on Kobane in September 2014. (B and D) concern the unexpected outburst of protests in Brazil in June 2013, commonly termed the “Brazil Winter,” which involved some violence and for which we were able to collect accurate information following the Intelligence Advanced Research Projects Activity (IARPA) OSI program (14, 15). Horizontal bars in (A) and (B) show timelines for (A) pro-ISIS aggregates on VKontakte and (B) protestor aggregates on Facebook in Brazil. Each horizontal bar represents one aggregate. The aggregates are stacked separately along the vertical axis. [(C) and (D)] Divergence of escalation parameter b for aggregate creation (dark blue solid line) coincides with real-world onset at time Tc (vertical red line). The light blue dashed line shows theoretical form (Tct)–1. The subsequent decrease in both curves likely occurs for system-specific reasons associated with coalition bombings starting in (C) and loss of public interest in (D).

  • Fig. 3 Size dynamics of pro-ISIS aggregates.

    (A) Empirical size variation of pro-ISIS aggregates. Shark-fin shapes of all sizes emerge with shutdowns that are not strongly correlated. (B) Similar results are predicted by our theoretical model, irrespective of whether we consider the model’s initial (left) or steady-state (right) dynamics. Here, the total number of potential follows is N = 500; however, the model’s self-similar dynamics generate the same picture for any N with shark-fin shapes of all sizes. An aggregate grows by an individual linking in (i.e., size increases by 1) or by an existing aggregate linking in (i.e., size increases by >1), as shown by the color change. In (B), knowledge of the theory’s microscopic dynamics allows us to denote each coalescence of a large aggregate by a color change, whereas in the empirical data (A), we maintain a constant color for each aggregate. (C) Complementary distribution function for the observed aggregate sizes. (D) Effect of intervention strategy involving dismantling smaller aggregates (SM). Using a larger N increases the vertical and horizontal scales without changing the main results (see fig. S10). Red diamonds: smin = 10 and smax = 50. Blue squares: smin = 200 and smax = 1000.

  • Fig. 4 Evolutionary adaptations.

    (A to C) Sample of pro-ISIS aggregate timelines showing evolutionary adaptations (shown by switches in colors) that tend to increase an aggregate’s maximum attained size and extend its lifetime (D). Time is measured in days from 1 January 2015. In (A), the switch in colors within a given timeline indicates a switch in aggregate name. (B) Dark blue means the aggregate is visible (i.e., content open to any VKontakte user), while light blue means it is invisible (i.e., content open only to current followers of the aggregate). (C) Aggregate has a specific initial identity (orange), then disappears from the Internet for an extended time (white), then reappears with another identity shown by a switch in color. (D) Relative maximum aggregate size and relative lifetime for particular adaptations and their combinations, given as average values relative to the values for aggregates employing no adaptation. “All” corresponds to aggregates that use name change, invisibility, and reincarnation. See the text for explanation of the “(0.9)” entry.

Supplementary Materials

  • New online ecology of adversarial aggregates: ISIS and beyond

    N. F. Johnson, M. Zheng, Y. Vorobyeva, A. Gabriel, H. Qi, N. Velasquez, P. Manrique, D. Johnson, E. Restrepo, C. Song, S. Wuchty

    Materials/Methods, Supplementary Text, Tables, Figures, and/or References

    Download Supplement
    • Materials and Methods
    • Supplementary Text
    • Figs. S1 to S12
    • Tables S1 to S3
    • References
    Data S1
    The datafile can be easily opened using any spreadsheet software. It contains data used to produce curves in the graphs shown in the paper. The sheets in this file are as follows and have the following content: Fig.1. Bipartite network of aggregates and followers. Column B corresponds to the anonymized identity of follower and Column C the anonymized identity of aggregate. Follower and aggregate in the same row are connected; Fig.2(b) List of Facebook aggregates in Brazil. Column A contains an anonymized version of the aggregate’s name (name available from authors) and Column B the corresponding date of creation; Fig.2(c) Data-points of escalation parameter with the corresponding date for pro-ISIS aggregates; Fig.2(d) Data-points of escalation parameter with the corresponding date for Brazil aggregates; Fig.3(a) Data-points of number of follows (from Column C to AD) as a function of time located in Column B; Fig.3(c) Data-points of the empirical distribution of aggregate sizes; Fig.4(a) Name change adaptation. Column B contains time. Columns C to AI aggregate identities (anonymized) followed by integer numbers from 0 to 6. Number 0 means that the aggregate does not exist at that timestep while numbers 1-5 corresponds to variations on aggregate’s name; Fig.4(b) Invisibility adaptation. Column B contains time. Columns C to P aggregate identities (anonymized) followed by integer numbers between 0 and 2. Number 0 means that the aggregate does not exist at that timestep. Numbers 1 and 2 means that the aggregate at that timestep is visible and invisible, respectively; Fig.4(c) Reincarnation adaptation. Column B contains time. Columns C to J aggregate followed by integer numbers between 0 and 5. Number 0 means that the aggregate does not exist on that timestep. Number 1 represents the original aggregate. Numbers from 2 to 5 are revivals of the original aggregate that started with a significant percentage of follows that came from the original aggregate; Fig.S4. Civil unrest events in Brazil in 2013. Part A contains a table with information about Brazil protests including state, city, geolocation (longitude and latitude), date and number of protestors. Part B contains the consolidated number of events for a particular date; Fig.S6. Part A contains a list of Facebook aggregates in Venezuela. Column B contains the aggregate’s name (anonymized) and Column C the corresponding date of creation. Part B contains the data-points of escalation parameter with the corresponding date for aggregates in Venezuela; Fig.S5. Data-points of escalation parameter from Facebook data (Column C) and from event data (Column F) with the corresponding dates (Column B and E, respectively) for Brazil aggregates; Fig.S1. Civil unrest events and Google Trends (GT) volumes in Chile. GT volumes of search term 'Protesta' (Column E) and 'Huelga' (Column F) for a particular date (Columns B-D). Number of civil unrest events events (Column K) for a particular date (Column H-J)

Navigate This Article