RE S EAR CH | R E P O R T S

spatial coverage of measures of soil loss). Third, 25. S. R. Carpenter et al., Proc. Natl. Acad. Sci. U.S.A. 106, MEP/CAS project “Survey and Assessment of National Ecosystem
an expanded set of ecosystem services could be 1305–1312 (2009). Changes Between 2000 and 2010, China” and by the
26. C. Folke, S. R. Carpenter, B. Walker, M. Scheffer, Ecol. Soc. 15, international Natural Capital Project. All the data are available
quantified, including ecosystem contributions to 20 (2010). at www.sciencedb.cn/dataSet/handle/73.
securing water and air quality, both of which 27. National Development and Reform Commission of China,
have deteriorated in China in recent decades, Opinions on Accelerating the Construction of Ecological
SUPPLEMENTARY MATERIALS
and mental health benefits of exposure to nature Civilization (NDRCC, Beijing, 2013).
www.sciencemag.org/content/352/6292/1455/suppl/DC1
(24). Fourth, improved measures can be used ACKN OWLED GMEN TS Materials and Methods
that more directly link ecosystem services to We thank the Ministry of Environmental Protection (MEP) of
Figs. S1 to S5
human well-being, such as economic measures of Tables S1 to S5
China and Chinese Academy of Sciences (CAS) for organizing
References (28–98)
value and direct measures of impact on health, the Project, and experts in 31 provinces for collecting the field
livelihoods, happiness, or other aspects of well- data for statistics analysis on this manuscript. This work was 10 January 2016; accepted 18 May 2016
supported by the Ministry of Finance of China through the 10.1126/science.aaf2295
being (25, 26). Finally, better understanding of
human behavioral responses to changes in policy
or market conditions could improve policy ef-
fectiveness. Regularly repeating the CEA can pro-
vide insight into future national development HUMAN BEHAVIOR
pathways (27).

RE FE RENCES AND N OT ES New online ecology of adversarial

Downloaded from http://science.sciencemag.org/ on May 23, 2017

1. Q. Ye, M. H. Glantz, Mitig. Adapt. Strategies Glob. Change 10,
159–182 (2005).
2. J. Liu, S. Li, Z. Ouyang, C. Tam, X. Chen, Proc. Natl. Acad.
Sci. U.S.A. 105, 9477–9482 (2008).
aggregates: ISIS and beyond
3. P. Zhang et al., Science 288, 2135–2136 (2000).
4. J. Liu, Z. Ouyang, W. Yang, W. Xu, S. Li, in Encyclopedia of
N. F. Johnson,1 M. Zheng,1 Y. Vorobyeva,2 A. Gabriel,1 H. Qi,1 N. Velasquez,2
Biodiversity, S. A. Levin, Ed. (Academic Press, Waltham, P. Manrique,1 D. Johnson,3 E. Restrepo,4 C. Song,1 S. Wuchty5,6*
MA, ed. 2, 2013), pp. 372–384.
5. M.-N. Tuanmu et al., Conserv. Biol., 10.1111/cobi.12669
Support for an extremist entity such as Islamic State (ISIS) somehow manages to survive
(2016).
6. Materials and methods are available as supplementary globally online despite considerable external pressure and may ultimately inspire acts by
materials on Science Online. individuals having no history of extremism, membership in a terrorist faction, or direct links
7. R. Sharp et al., InVEST +VERSION+ User’s Guide (The Natural to leadership. Examining longitudinal records of online activity, we uncovered an ecology
Capital Project, Stanford University, University of Minnesota, evolving on a daily time scale that drives online support, and we provide a mathematical
The Nature Conservancy, and World Wildlife Fund, 2015).
8. P. Kareiva, H. Tallis, T. H. Ricketts, G. C. Daily, S. Polasky, Eds., theory that describes it. The ecology features self-organized aggregates (ad hoc groups
Natural Capital: Theory and Practice of Mapping Ecosystem formed via linkage to a Facebook page or analog) that proliferate preceding the onset of
Services (Oxford Univ Press, New York, 2011). recent real-world campaigns and adopt novel adaptive mechanisms to enhance their
9. I. J. Bateman et al., Science 341, 45–50 (2013). survival. One of the predictions is that development of large, potentially potent pro-ISIS
10. J. J. Lawler et al., Proc. Natl. Acad. Sci. U.S.A. 111, 7492–7497
(2014). aggregates can be thwarted by targeting smaller ones.
11. S. Hatfield-Dodds et al., Nature 527, 49–53 (2015).

E
12. Millennium Ecosystem Assessment, Ecosystems and
Human Well-Being: Synthesis (Island Press, Washington, xtremist entities such as ISIS (known as by individuals that casually mention ISIS or pro-
DC, 2005). Islamic State) stand to benefit from the tests is insufficient to identify any long-term
13. UKNEA (UK National Ecosystem Assessment), global reach and speed of the Internet for buildup ahead of sudden real-world events (see,
The UK National Ecosystem Assessment Technical Report
[United Nations Environment Programme (UNEP)–World
propaganda and recruiting purposes in for example, fig. S1). This leaves open the ques-
Conservation Monitoring Centre, Cambridge, 2011]. ways that were unthinkable for their prede- tion of how support for an entity like ISIS de-
14. UNEP, Intergovernmental Science-Policy Platform on cessors (1–10). This increased connectivity not velops online—possibly before any real-world
Biodiversity and Ecosystem Services, Decision IPBES-2/4: only may facilitate the formation of real-world group has been formed or any real-world attack
Conceptual framework for the Intergovernmental Science-
Policy Platform on Biodiversity and Ecosystem Services:
organized groups that subsequently carry out has been perpetrated—whether by “recruits” or
Report of the second session of the plenary of the violent attacks (e.g., the ISIS-directed attacks in by those simply “inspired.”
Intergovernmental Science-Policy Platform on Biodiversity and Paris in November 2015) but also may inspire Our data sets consist of detailed second-by-
Ecosystem Services (UNEP, 2014). self-radicalized actors with no known history of second longitudinal records of online support ac-
15. WAVES (Wealth Accounting and the Valuation of Ecosystem
Services), WAVES Annual Report 2015 (World Bank,
extremism or links to extremist leadership to op- tivity for ISIS from its 2014 development onward
Washington, DC, 2015). erate without actually belonging to a group (e.g., and, for comparison, online civil protestors across
16. P. R. Ehrlich, P. M. Kareiva, G. C. Daily, Nature 486, 68–73 the ISIS-inspired attack in San Bernardino in multiple countries within the past 3 years, follow-
(2012). December 2015) (11). Recent research has used ing the U.S. Open Source Indicator (OSI) project
17. Ministry of Environmental Protection of China and Chinese
Academy of Sciences, National Ecosystem Service Zoning in
records of attacks to help elucidate group struc- (14–16). The supplementary materials (SM) pro-
China (Ministry of Environmental Protection and CAS, Beijing, ture in past organizations for which the Inter- vide a roadmap for the paper, data descriptions,
2015). net was not a key component (3, 6, 12), the and downloads. The data show that operational
18. Ministry of Environmental Protection, National Ecological nature of attacks by lone-wolf actors (13), and pro-ISIS and protest narratives develop through
Protection Redlining (Ministry of Environmental Protection,
Beijing, 2015).
the relationship between general online buzz self-organized online aggregates, each of which is
19. China Council for International Cooperation on Environment and real-world events (14–16). Online buzz created an ad hoc group of followers of an online page
and Development, Report on Institutional Innovation of created through Facebook or its global equivalents,
1
Ecological Protection Redlining (CCICED, Beijing, 2014). Department of Physics, University of Miami, Coral Gables, such as ВКонтакте (VKontakte) at http://vk.com/
20. Ministry of Transport of China, National Road Development FL 33126, USA. 2Department of International Studies,
Planning (2014–2030) (MTC, Beijing, 2013). University of Miami, Coral Gables, FL 33126, USA.
(Fig. 1). These generic web-based interfaces allow
21. A. Viña, W. McConnell, H. B. Yang, Z. C. Xu, J. G. Liu, Sci. Adv. 3
Department of Government, Harvard University, Cambridge, such aggregates to form in a language-agnostic
2, e1500965 (2016). MA 02138, USA. 4Department of Geography and Regional way and with freely chosen names that help at-
22. B. Fu, Science 321, 611 (2008). Studies, University of Miami, Coral Gables, FL 33126, USA. tract followers without publicizing their members’
5
23. J. G. Liu, P. H. Raven, Crit. Rev. Environ. Sci. Technol. 40, Department of Computer Science, University of Miami,
823–851 (2010). Coral Gables, FL 33126, USA. 6Center for Computational
identities. Because the focus in this paper is on
24. G. N. Bratman, J. P. Hamilton, G. C. Daily, Ann. N.Y. Acad. Sci. Science, University of Miami, Coral Gables, FL 33126, USA. the ecosystem rather than the behavior of any
1249, 118–136 (2012). *Corresponding author. Email: [email protected] individual aggregate, the names are not being

SCIENCE sciencemag.org 17 JUNE 2016 • VOL 352 ISSUE 6292 1459

R ES E A RC H | R E PO R TS

released. They are available on request from software application programming interfaces any real-world actions to take place subsequently,
the authors. Pro-ISIS aggregates inhabit an online that expanded it by means of automated search because many additional factors can hinder real-
environment in which predatory entities such as snowballing (fig. S2). The expanded aggregate world execution. However, Fig. 2 suggests that the
police cybergroups, individual hackers, and web- list was then cross-checked to eliminate false online proliferation of pro-ISIS or protest aggre-
site moderators seek to shut down pro-ISIS ac- identifications. New embedded links were man- gates can indeed act as an indicator of conditions
tivity and narratives (17, 18). In contrast to the ually searched to identify more aggregates and becoming right for the onset of a real-world attack
largely mundane chatter that may casually men- hashtags. We then iterated this process until campaign or mass protests, respectively. We fit the
tion ISIS on Twitter and in aggregates focused closure of the aggregate list (i.e., the search led trend in the creation dates of new online aggre-
on sport, for example, pro-ISIS aggregates fre- back to aggregates that were already in the list). gates (Fig. 2, A and B) to a well-known organiza-
quently discuss operational details such as routes Although this process was labor intensive, we tional development curve (19). The escalation
for financing, technological know-how, and avoid- were able to find closure on a daily basis in real parameter b diverges at these real-world onsets
ing drone strikes. We chose VKontakte for our time. A similar process was followed for the civil (Fig. 2, C and D) and follows the same mathe-
pro-ISIS analysis because (i) pro-ISIS aggregates protest data. matical dependence (Tc – t)–1 as a wide class of
are shut down essentially immediately on Face- We uncovered 196 pro-ISIS aggregates involv- physical phase transitions (20), with the diver-
book, but not on VKontakte; (ii) it is the largest ing 108,086 individual followers between 1 January gence date Tc matching the actual onset almost
European online social networking service, with and 31 August 2015. On any given day, the total exactly (SM). The connection to physical phase
more than 350 million users; (iii) it allows number of follows in the follower-aggregate transitions again suggests that self-organization
multiple languages and is used worldwide; (iv) network [i.e., the total number of links that ex- is a driving factor (20). Although such a diver-
being based in Russia, it has a high concentra- isted on that day from followers (blue nodes) into gence will not necessarily preempt attacks in-

Downloaded from http://science.sciencemag.org/ on May 23, 2017

tion of users of Chechen origin focused in the the various aggregates (red nodes), as shown in volving only a few individuals, such as in San
Caucasus region near ISIS’s main area of in- the inset to Fig. 1) ranged up to 134,857. The data Bernardino or Paris, it can help indicate an align-
fluence in the Levant; and (v) ISIS used it to provided us with bipartite graphs in which indi- ment of favorable conditions and has the advan-
spread propaganda among the Russian-speaking vidual members belong to aggregates but aggre- tage that it does not rely on any real-world events
population (2). gates are not linked to each other except through having yet occurred or likely dates having been
Our methodology for identifying these pro-ISIS people. This two-mode network has a highly com- circulated through social media in advance (14–16).
aggregates was as follows. We manually identified plex temporal evolution—with strong heterogene- The far longer lifetimes for online aggregates of
relevant narratives using hashtags in multiple ity in both the number of follows per individual protestors in Fig. 2B, as compared with pro-ISIS
languages—e.g., #isn, #khilafah, #fisyria, #игиш follower (i.e., the number of links emanating from aggregates in Fig. 2A, makes sense because pred-
(i.e., ISIS), #дауля (i.e., dawla, meaning “state”), a given blue node) and the number of follows per atory online shutdown pressure was far less for
and #халифат (i.e., “Caliphate”)—and traced these aggregate (i.e., the number of links entering a the civil protestors; in particular, we found no
to underlying aggregates. The specific criterion for given red node, which we define as the aggregate’s evidence of any shutdowns in Fig. 2B, in stark
inclusion in the list was that the group explicitly size)—and no obvious hierarchical structure. This contrast to Fig. 2A. Figure 2D is likely smoother
expressed its support for ISIS, publishing ISIS- suggests that the follower-aggregate dynamics are than Fig. 2C for the same reason. More aggres-
related news or propaganda and/or calling for driven by self-organization. Such online support is sive antigovernment protests, such as the sudden
jihad in the name of ISIS. This list was fed into likely a necessary but not sufficient condition for outburst in Venezuela in February 2014 (fig. S6),

aggregate individual follower

10

September October November December January

2014 2015
Fig. 1. Pro-ISIS aggregates. Horizontal bars illustrate timelines of some typical pro-ISIS aggregates. Their names are available from the authors. Each timeline
starts when the aggregate appears and ends when it disappears. (Inset) Snapshot of part of an aggregate-follower network on 1 January 2015 showing
individual followers (blue nodes) linking to pro-ISIS aggregates (red nodes). Followers can link into as many aggregates as they wish. Aggregates emerge of all
sizes, where an aggregate’s size is the number of follows linking into it.

1460 17 JUNE 2016 • VOL 352 ISSUE 6292 sciencemag.org SCIENCE

 RE S EAR CH | R E P O R T S

generate an intermediate case between Fig. 2, A ability of a particular aggregate being picked for following coupled, nonlinear differential equations
and B. coalescence or targeted for shutdown as propor- describing the number ns of pro-ISIS aggregates
We now develop a systems-level theory of tional to the aggregate’s size (21), although this is of size s (s > 1) over time.
this online aggregate ecology. The aggregate size generalizable to other algebraic forms without
@ns ðtÞ vcoal
X
s−1
variations observed empirically were charac- affecting our main findings (SM). The total num-
¼ kðs − kÞnk ðtÞns−k ðtÞ−
terized by distinctive shark-fin shapes (Fig. 3A), ber of potential follows N in the system is a sum, @t N2
k¼1
with each shutdown of a pro-ISIS aggregate over all potential followers, of the maximum num-
2vcoal sns ðtÞ
X
∞
vfrag sns ðtÞ
severing the links into that particular aggregate ber of aggregates that each follower is prepared knk ðtÞ−
—hence the abrupt drop. This fragmentation to follow. The number of follows per individual N2
k¼1
N
coexists with self-organized coalescence by which can be heterogeneous, and at any time step, not
ð1Þ
individual followers sporadically link into exist- all N follows are necessarily used. Computer
ing aggregates while existing aggregates sporad- simulations of this coalescence-fragmentation A detailed discussion of Eq. 1 is given in the SM.
ically link into each other. Although each aggregate’s process reproduce the ecology of shark-fin shapes Like the data and computer simulation, solving
precise shark-fin shape will depend on its content of all sizes (Fig. 3B) with a power-law distribution Eq. 1 mathematically yields a power-law s–a for
and noticeability to external predators, Fig. 3 s–a for the time-average number of aggregates the time-averaged aggregate size, with an exact
shows that the system-level features are captured of size s where a = 2.5. This is similar to the em- exponent a = 2.5 [see (23, 24) and SM for the
using only this minimal coalescence-fragmentation pirical value of a = 2.33 that had high goodness- mathematical proof]. The spatial independence
process. At each time step, a phenomenological of-fit (P = 0.86) (Fig. 3C). These shark-fin dynamics of Eq. 1 is consistent with online interactions being
probability vcoal describes the sporadic addition are robust in that they emerge irrespective of largely independent of followers’ separation across

Downloaded from http://science.sciencemag.org/ on May 23, 2017

of 1,2,3,… etc. follows to an aggregate (coalescence when we examine the model’s evolution (Fig. 3B) the globe. The first term on the right describes the
of followers), whereas vfrag describes the sporadic and for any value of N as a result of the model’s formation of an aggregate of size s (i.e., s follows)
sudden shutdown of an aggregate (fragmentation self-similarity—i.e., the coalescence-fragmentation from a smaller one through the addition of 1,2,3,...
of followers). Such stochastic shutdown is realistic process generates the same dynamics across all etc. new follows; the second describes the loss of
because the predators (e.g., government moni- aggregate sizes (22). Connecting to real-world ISIS an aggregate that coalesced with another ag-
tors or individual hackers) are largely indepen- activity, we note that the severity of ISIS attacks is gregate; and the third describes the fragmenta-
dent entities and can only shut down aggregates also approximately power-law distributed with ex- tion of an aggregate of size s. ns=1(t) is the pool of
that they happen to find. Larger aggregates should ponent a = 2.44 and goodness-of-fit P > 0.1. The isolated (i.e., unused) follows at time t—i.e.,
be more noticeable; hence, we can take the prob- model can be represented mathematically by the potential “recruits”, with S∞s¼1 sns ðtÞ ¼ N . We take

2012 2013 2014

Apr Jun Aug Oct Dec Feb Apr Jun Aug Oct Dec Feb Apr Jun Aug Oct Dec
1.4
Pro-ISIS aggregates

1.2

1.0 Kobane: onset of ISIS attacks

0.8
Sept. 18, 2014

0.6

0.4
Escalation parameter

0.2

Sept. 18, 2014

August September October 2014
June 11, 2013 1.4
Brazil protest aggregates

1.2

1.0 Brazil:onset of mass protests

June 11, 2013
0.8

0.6

0.4

0.2

Jan Mar May Jul Sep Nov Jan Mar May Jul Sep Nov Jan Mar May Jul Sep Nov
2011 2012 2013 February March April May June July 2013
Time Time

Fig. 2. Proliferation in online aggregate creation before the onsets of aggregates on Facebook in Brazil. Each horizontal bar represents one
recent real-world campaigns (red vertical lines). (A and C) concern the aggregate. The aggregates are stacked separately along the vertical axis.
unexpected assault by ISIS on Kobane in September 2014. (B and D) concern [(C) and (D)] Divergence of escalation parameter b for aggregate creation
the unexpected outburst of protests in Brazil in June 2013, commonly termed (dark blue solid line) coincides with real-world onset at time Tc (vertical red
the “Brazil Winter,” which involved some violence and for which we were able line). The light blue dashed line shows theoretical form (Tc – t)–1. The
to collect accurate information following the Intelligence Advanced Research subsequent decrease in both curves likely occurs for system-specific reasons
Projects Activity (IARPA) OSI program (14, 15). Horizontal bars in (A) and (B) associated with coalition bombings starting in (C) and loss of public interest
show timelines for (A) pro-ISIS aggregates on VKontakte and (B) protestor in (D).

SCIENCE sciencemag.org 17 JUNE 2016 • VOL 352 ISSUE 6292 1461

R ES E A RC H | R E PO R TS

N to be reasonably slowly varying, although this tation rate should be greater than vcoal p/q. Fourth, an aggregate disappears completely and then re-
can be generalized (SM). Adding heterogeneity to any online “lone wolf” actor will only truly be alone emerges at a later time with another identity but
the aggregate formation process (e.g., preference for short periods of time (on the order of weeks with most (e.g., >60%) of the same followers. Such
for similar or diverse follows) leaves the expo- in Fig. 3A, for example) before being attracted reincarnation is not known to occur in real-world
nent a = 2.5 unchanged, as do a variety of other into one aggregate or another through coalescence. ecologies of living organisms. Figure 4D confirms
generalizations (table S2) (23, 24). Fifth, a systems-level tool emerges for detecting that these adaptations tend to increase not only
Our theoretical model generates various math- the future online emergence of new ISIS-like en- the maximum number of followers attracted into
ematically rigorous yet operationally relevant tities, which is to employ our methodology to the aggregate (maximum size) but also its lifetime.
predictions. First, anti-ISIS agencies can thwart determine whether a crude power-law distribu- The 0.9 value for the reincarnation lifetime can be
development of large aggregates that are poten- tion with a near 2.5 begins to emerge for aggre- understood as follows: Reincarnation involves the
tially far more potent (21) by breaking up smaller gate support surrounding a particular theme. aggregate temporarily disappearing; therefore, an
ones. As shown in Fig. 3D, adding a simple cost At a more microscopic level, the data reveal aggregate that uses reincarnation runs a high risk
into the model for shutting down an aggregate that pro-ISIS aggregates exhibit the ability to of losing followers because they do not know when,
makes this strategy actually more effective than collectively adapt in a way that can extend their and with what identity, the core follower group will
targeting the largest aggregates (SM). Second, if lifetime and increase their maximal size (Fig. 4), reemerge. Reincarnation hence tends to be used
anti-ISIS agencies are insufficiently active in despite the fact that each aggregate is an ad hoc by aggregates that are attracting unusually high
countermeasures and hence the overall rate at group of followers who likely have never met, do predation and would otherwise have had a much
which they fragment pro-ISIS clusters becomes not know each other, and do not live in the same shorter lifetime. Reincarnation extends this life-
too small—specifically, if the aggregate fragmenta- city or country. For the civil protests, by contrast, time beyond its otherwise much shorter value,
tion rate vfrag < (NlnN)–1—then pro-ISIS support will

Downloaded from http://science.sciencemag.org/ on May 23, 2017

we detected no such adaptations and no online but not enough to reach the value of 1 corre-
grow exponentially fast into one super-aggregate predatory shutdowns, adding support to the no- sponding to aggregates that experience less in-
(fig. S11). Third, when fragmentation rates drop tion that the pro-ISIS adaptations are a response tense shutdown pressure and hence do not employ
below a critical value vcritical
frag , the system enters a to their high-pressured online environment. Figure adaptations. These observations open up the pos-
regime in which any piece of pro-ISIS material can 4, A to C, illustrates the remarkable speed, variety, sibility to add evolutionary game theoretic fea-
spread globally across the pro-ISIS support net- and novelty of these adaptations, with 15% of tures into our systems-level theory to explain the
work through contagion: vcritical
frag ¼ vcoal p=q, with aggregates exhibiting name changes; 7% exhibit- multiple use of particular adaptations by partic-
p and q representing the probabilities of follower- ing flips between online visibility (i.e., content ular aggregates and their decision of when to
to-follower transmission and follower recovery, open to any VKontakte user) and invisibility (i.e., adapt. A future generalized theory could prove
respectively (25). To prevent diffusion of poten- content open only to current followers of the ag- possible, employing game theoretic ideas from
tially dangerous material and ideas, the fragmen- gregate); and 4% exhibiting reincarnation in which (26), for example.

1800 Empirical 300 500

Theory: Theory:
400 steady-state
1600 initial
Aggregate size

Aggregate size
200
300
1400
200
100
1200 100

0 0
Aggregate size

1000 0 200 400 600 800 1000 8000 8500 9000 9500 10000
Time Time
800
1 1000
# Aggregates of size s

600 100
attack
0.1 largest
10
P(S > s)

400 aggregates
1 attack
0.01 smaller
200
0.1 aggregates

0 0.001 0.01
0 10 20 30 40 50 1 10 100 1000 10000 1 10 100
Time Aggregate size s (# follows) Aggregate size s (# follows)

Fig. 3. Size dynamics of pro-ISIS aggregates. (A) Empirical size variation of increases by >1), as shown by the color change. In (B), knowledge of the
pro-ISIS aggregates. Shark-fin shapes of all sizes emerge with shutdowns that theory’s microscopic dynamics allows us to denote each coalescence of a
are not strongly correlated. (B) Similar results are predicted by our theoretical large aggregate by a color change, whereas in the empirical data (A), we maintain
model, irrespective of whether we consider the model’s initial (left) or steady- a constant color for each aggregate. (C) Complementary distribution function for
state (right) dynamics. Here, the total number of potential follows is N = 500; the observed aggregate sizes. (D) Effect of intervention strategy involving dis-
however, the model’s self-similar dynamics generate the same picture for any mantling smaller aggregates (SM). Using a larger N increases the vertical and
N with shark-fin shapes of all sizes. An aggregate grows by an individual linking horizontal scales without changing the main results (see fig. S10). Red
in (i.e., size increases by 1) or by an existing aggregate linking in (i.e., size diamonds: smin = 10 and smax = 50. Blue squares: smin = 200 and smax = 1000.

1462 17 JUNE 2016 • VOL 352 ISSUE 6292 sciencemag.org SCIENCE

 RE S EAR CH | R E P O R T S

5. J. E. Smith et al., Trends Ecol. Evol. 31, 54–66 (2016).

Name change 6. M. Kenney et al., Appl. Ergon. 44, 739–747 (2013).
7. J. N. Shapiro, The Terrorist’s Dilemma: Managing Violent Covert
Organizations (Princeton Univ. Press, 2013).
8. A. M. Morgenstern et al., Am. J. Phys. 81, 805 (2013).
9. G. King, J. Pan, M. E. Roberts, Science 345, 1251722 (2014).
10. D. J. Watts, P. S. Dodds, J. Consum. Res. 34, 441–458 (2007).
11. F. Karimi, C. E. Shoichet, D. Ford, “San Bernardino shooters
were radicalized 'for quite some time,' FBI says.”
CNN News, 7 December 2015; www.cnn.com/2015/12/07/us/
san-bernardino-shooting/index.html.
12. V. S. Subrahmanian, A. Mannes, A. Sliva, J. Shakarian,
J. P. Dickerson, Computational Analysis of Terrorist Groups:
Lashkar-e-Taiba (Springer, New York, 2013).
13. P. Gill, Lone Actor Terrorists: A Behavioural Analysis
0 20 40 60 80 100 120 140 160 180 200 220 240 (Routledge, London, 2015).
14. P. Manrique et al., Context matters: Improving the uses of big
data for forecasting civil unrest: Emerging phenomena and big data.
Invisibility IEEE Intelligence and Security Informatics (IEEE, 2013), pp. 169–172.
Pro-ISIS aggregates

15. J. Matheny, Test and evaluation in ACE and OSI IARPA (2013);
available online at http://semanticommunity.info/@api/deki/
visible files/21696/3-ACE_and_OSI_NIST_Brief.pdf.
invisible 16. J. Cadena et al., PLOS ONE 10, e0128879 (2015).
17. BBC News, “Anonymous targets IS sympathisers on Twitter”;

Downloaded from http://science.sciencemag.org/ on May 23, 2017

www.bbc.com/news/technology-33608369 (21 July 2015).
18. BBC News, “Islamic State web accounts to be blocked by new
police team”; www.bbc.com/news/world-europe-33220037
(22 June 2015).
19. N. Johnson et al., Science 333, 81–84 (2011).
20. A.-L. Barabasi, H. E. Stanley, Fractal Concepts in Surface
Growth (Cambridge University Press, 1995).
21. V. Asal, S. M. Chermak, S. Fitzgerald, J. D. Freilich,
0 20 40 60 80 100 120 140 160 180 200 220 240 Crim. Justice Rev. 2016, 10.1177/0734016815626970 (2016).
22. N. F. Johnson, P. Jefferies, P. M. Hui, Financial Market
Complexity (Oxford Univ. Press, 2003), chap. 5.
Reincarnation 23. J. C. Bohorquez, S. Gourley, A. R. Dixon, M. Spagat,
Aggregate N. F. Johnson, Nature 462, 911–914 (2009).
24. B. Ruszczycki, B. Burnett, Z. Zhao, N. F. Johnson, Eur. Phys. J.
Rel. Rel.
Adaptation 72, 289–302 (2009).
max. life 25. Z. Zhao et al., Phys. Rev. E Stat. Nonlin. Soft Matter Phys. 81,
size time 056107 (2010).
26. M. A. Nowak, Evolutionary Dynamics: Exploring the Equations of
None 1 1 Life (Belknap Press, New York, 2006).
27. N. Perra et al., Phys. Rev. Lett. 109, 238701 (2012).
All 1.4 1.4 28. D. Koutra, D. Jin, Y. Ning, C. Faloutsos, Perseus: An
interactive large-scale graph mining and visualization tool
Name change 1.1 1.5
(DEMO), VLDB 2015, Kohala Coast, Hawaii, 31 August to
Invisibility 1.5 2.4 4 September 2015.
0 20 40 60 80 100 120 140 29. Q. Zhao, M. Erdogdu, H. He, A. Rajaraman, J. Leskovec,

days Reincarnation 2.0 (0.9) SEISMIC: A self-exciting point process model for predicting
tweet popularity, ACM SIGKDD International Conference on
Knowledge Discovery and Data Mining (KDD), Sydney, 10 to
Fig. 4. Evolutionary adaptations. (A to C) Sample of pro-ISIS aggregate timelines showing evolutionary 13 August 2015.
30. A. Stanton, A. Thart, A. Jain, P. Vyas, A. Chatterjee,
adaptations (shown by switches in colors) that tend to increase an aggregate’s maximum attained size P. Shakarian, arXiv:1508.01192v1 (2015).
and extend its lifetime (D). Time is measured in days from 1 January 2015. In (A), the switch in colors 31. J. M. Berger, H. Perez, The Islamic State’s diminishing returns
within a given timeline indicates a switch in aggregate name. (B) Dark blue means the aggregate is on Twitter. GW Program on Extremism (2016); available at
visible (i.e., content open to any VKontakte user), while light blue means it is invisible (i.e., content open https://cchs.gwu.edu/sites/cchs.gwu.edu/files/downloads/
Berger_Occasional%20Paper.pdf.
only to current followers of the aggregate). (C) Aggregate has a specific initial identity (orange), then
disappears from the Internet for an extended time (white), then reappears with another identity shown AC KNOWLED GME NTS
by a switch in color. (D) Relative maximum aggregate size and relative lifetime for particular adaptations N.F.J. gratefully acknowledges partial support for preliminary
and their combinations, given as average values relative to the values for aggregates employing no work from Intelligence Advanced Research Projects Activity
adaptation. “All” corresponds to aggregates that use name change, invisibility, and reincarnation. See the (IARPA) under grant D12PC00285 and recent funding under
National Science Foundation (NSF) grant CNS1500250 and Air
text for explanation of the “(0.9)” entry. Force (AFOSR) grant 16RT0367. The views and conclusions
contained herein are solely those of the authors and do not
represent official policies or endorsements by any of the entities
named in this paper. Data described are presented in an
More generally, our findings suggest that in- online may have declined since summer 2015, it is Excel file available in the supplementary materials, and code is
stead of having to analyze the online activities of possible that there is lower detection due to novel provided in the SM document.
many millions of individual potential actors world- adaptations being employed—as in Fig. 4, but now
wide (27), interested parties can shift their focus likely more sophisticated. SUPPLEMENTARY MATERIALS
to aggregates, of which there will typically be only www.sciencemag.org/content/352/6292/1459/suppl/DC1
a few hundred. Our approach, combining auto- Materials and Methods
RE FERENCES AND NOTES Supplementary Text
mated data-mining with subject-matter expert 1. M. Weiss, H. Hassan, ISIS: Inside the Army of Terror (Regan Figs. S1 to S12
analysis and generative model-building drawn Arts, New York, 2015). Tables S1 to S3
from the physical and mathematical sciences, goes 2. BBC News, “Russian students targeted as recruits Database S1
by Islamic State”; http://linkis.com/dmFgu (24 July 2015). References
beyond existing approaches to mining such on- 3. P. Gill, J. Lee, K. Rethemeyer, J. Horgan, V. Asal, Int. Interact.:
line data (28–30). Although recent reports (31) sug- Empir. Theor. Res. Int. Relat. 40, 52–78 (2014). 13 December 2015; accepted 12 May 2016
gest that the amount of explicit pro-ISIS material 4. R. Wrangham, L. Glowacki, Hum. Nat. 23, 5–29 (2012). 10.1126/science.aaf0675

SCIENCE sciencemag.org 17 JUNE 2016 • VOL 352 ISSUE 6292 1463

 New online ecology of adversarial aggregates: ISIS and beyond
N. F. Johnson, M. Zheng, Y. Vorobyeva, A. Gabriel, H. Qi, N.
Velasquez, P. Manrique, D. Johnson, E. Restrepo, C. Song and S.
Wuchty (June 16, 2016)
Science 352 (6292), 1459-1463. [doi: 10.1126/science.aaf0675]

Editor's Summary

Tackling the advance of online threats

Online support for adversarial groups such as Islamic State (ISIS) can turn local into global
threats and attract new recruits and funding. Johnson et al. analyzed data collected on ISIS-related
websites involving 108,086 individual followers between 1 January 1 and 31 August 2015. They
developed a statistical model aimed at identifying behavioral patterns among online supporters of ISIS
and used this information to predict the onset of major violent events. Sudden escalation in the number
of ISIS-supporting ad hoc web groups (''aggregates'') preceded the onset of violence in a way that would

Downloaded from http://science.sciencemag.org/ on May 23, 2017

not have been detected by looking at social media references to ISIS alone. The model suggests how the
development and evolution of such aggregates can be blocked.
Science, this issue p. 1459

This copy is for your personal, non-commercial use only.

Article Tools Visit the online version of this article to access the personalization and
article tools:
http://science.sciencemag.org/content/352/6292/1459

Permissions Obtain information about reproducing this article:

http://www.sciencemag.org/about/permissions.dtl

Science (print ISSN 0036-8075; online ISSN 1095-9203) is published weekly, except the last week
in December, by the American Association for the Advancement of Science, 1200 New York
Avenue NW, Washington, DC 20005. Copyright 2016 by the American Association for the
Advancement of Science; all rights reserved. The title Science is a registered trademark of AAAS.